IoT Cybersecurity Improvement Act of 2019
Do you support it?
Want to know if it passes?
We'll email you when S 734 moves — a committee vote, a floor vote, or a signature. Nothing else.
Free forever · unsubscribe in one click.
Your answer was recorded either way.
Which district are you in?
Your ZIP is all we need to match you to your own representatives — so we can tell you how they voted on S 734.
You're tracking S 734
We'll email you the moment it moves.
S 734 — IoT Cybersecurity Improvement Act of 2019
Last action — Placed on Senate Legislative Calendar under General Orders. Calendar No. 215.
No card. One bill, free forever — alerts when it moves.
-
✓Introduced
-
2In Committee
-
3Passed Senate
-
4Passed House
-
5To Executive
-
6Enacted
This bill died with 116th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
This bill is no longer active — its legislative session has ended, so there is no live prognosis. It would have to be reintroduced in the current session to move again.
Summary
Internet of Things Cybersecurity Improvement Act of 2019 or the IoT Cybersecurity Improvement Act of 2019 This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects. By March 31, 2020, NIST must develop standards and guidelines for the appropriate use and management of IoT devices owned or controlled by the government, including minimum information security requirements for managing cybersecurity risks. The OMB shall then issue policies and principles for each agency that are consistent with such guidelines. NIST shall publish guidelines for the reporting, coordinating, publishing, and receiving of information about a security vulnerability relating to agency information systems, including IoT devices, and the resolution of such security vulnerability. The OMB shall oversee the implementation of the guidelines.
Bill Text
What changed in the latest version
288 added · 119 removedPlain-language change summary
The amendment made several changes to the definitions in the bill. Notably, it updated the terminology and added clarity regarding what constitutes a "covered device," specifying it as an object that connects to the Internet and has data processing capabilities, while excluding general-purpose computing devices. Additionally, it introduces a process for interested parties to petition the Director of the Office of Management and Budget regarding devices that should not be categorized as covered devices. These changes aim to refine the scope of the bill and outline the procedures for reconsidering definitions related to Internet-connected devices.
734 IntroducedReported in Senate (IS)](RS)] <DOC> 116thCalendar CONGRESSNo. 1st Session S.
734215 To116th leverageCONGRESS Federal1st GovernmentSession procurementS. power to encourage increased cybersecurity for Internet of Things devices, and for other purposes.
734 [Report No.
116-112] To leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things devices, and for other purposes.
Hassan, and Mr.
Daines)Daines, introducedMs. the following bill;
whichCortez wasMasto, read twice and referredMr. to the Committee on Homeland Security and Governmental Affairs _______________________________________________________________________ A BILL To leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things devices, and for other purposes.
BeRounds) itintroduced enacted by the Senatefollowing andbill; House of Representatives of the United States of America in Congress assembled, SECTION 1.
which was read twice and referred to the Committee on Homeland Security and Governmental Affairs September 23, 2019 Reported by Mr.
Johnson, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] _______________________________________________________________________ A BILL To leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things devices, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, <DELETED>SECTION 1.
SHORT TITLE.</DELETED> <DELETED> This Act may be cited as the ``Internet of Things Cybersecurity Improvement Act of 2019'' or the ``IoT Cybersecurity Improvement Act of 2019''.</DELETED> <DELETED>SEC.
2.
DEFINITIONS.</DELETED> <DELETED> In this Act:</DELETED> <DELETED> (1) Agency.--The term ``agency'' has the meaning given such term in section 3502 of title 44, United States Code.</DELETED> <DELETED> (2) Covered device.--</DELETED> <DELETED> (A) In general.--The term ``covered device'' means a physical object that--</DELETED> <DELETED> (i) is capable of connecting to and is in regular connection with the Internet;</DELETED> <DELETED> (ii) has computer processing capabilities that can collect, send, or receive data;
and</DELETED> <DELETED> (iii) is not a general-purpose computing device, including personal computing systems, smart mobile communications devices, programmable logic controls, and mainframe computing systems.</DELETED> <DELETED> (B) Modification of definition.--The Director of the Office of Management and Budget shall establish a process by which--</DELETED> <DELETED> (i) interested parties may petition for a device that is not described in subparagraph (A) to be considered a device that is not a covered device;
and</DELETED> <DELETED> (ii) the Director acts upon any petition submitted under clause (i) in a timely manner.</DELETED> <DELETED> (3) Security vulnerability.--The term ``security vulnerability'' means any attribute of hardware, firmware, software, or combination of 2 or more of these factors that could enable the compromise of the confidentiality, integrity, or availability of an information system or its information or physical devices to which it is connected.</DELETED> <DELETED>SEC.
3.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY CONSIDERATIONS AND RECOMMENDATIONS REGARDING MANAGING INTERNET OF THINGS CYBERSECURITY RISKS.</DELETED> <DELETED> (a) Completion of Ongoing Efforts Relating to Considerations for Managing Internet of Things Cybersecurity Risks.-- </DELETED> <DELETED> (1) In general.--The Director of the National Institute of Standards and Technology shall ensure that the efforts of the Institute in effect on the date of the enactment of this Act regarding considerations for managing Internet of Things cybersecurity risks, especially regarding examples of possible cybersecurity capabilities of Internet of Things devices, are completed no later than September 30, 2019.</DELETED> <DELETED> (2) Matters addressed.--In ensuring efforts are completed under paragraph (1), the Director shall also ensure that such efforts address, at a minimum, the following considerations for covered devices:</DELETED> <DELETED> (A) Secure Development.</DELETED> <DELETED> (B) Identity management.</DELETED> <DELETED> (C) Patching.</DELETED> <DELETED> (D) Configuration management.</DELETED> <DELETED> (b) Development of Recommended Standards for Use of Internet of Things Devices by Federal Government.--</DELETED> <DELETED> (1) In general.--Not later than March 31, 2020, the Director of the Institute shall develop recommendations for the Federal Government on the appropriate use and management by the Federal Government of Internet of Things devices owned or controlled by the Federal Government, including minimum information security requirements for managing cybersecurity risks associated with such devices.</DELETED> <DELETED> (2) Consistency with ongoing efforts.--The Director of the Institute shall ensure that the recommendations and standards developed under paragraph (1) are consistent with the efforts referred to in subsection (a), especially with respect to the examples of possible cybersecurity capabilities referred to in such subsection.</DELETED> <DELETED> (c) Institute Report on Cybersecurity Considerations Stemming From the Convergence of Information Technology, Internet of Things, and Operational Technology Devices, Networks and Systems.--Not later than 180 days following the enactment of this Act, the Director of the Institute shall publish a draft report related to the increasing convergence of traditional Information Technology devices, networks, and systems with Internet of Things devices, networks and systems and Operational Technology devices, networks and systems, including considerations for managing cybersecurity risks associated with such trends.</DELETED> <DELETED>SEC.
4.
POLICIES FOR FEDERAL AGENCIES ON USE AND MANAGEMENT OF INTERNET OF THINGS DEVICES.</DELETED> <DELETED> (a) Revisions to the Federal Acquisition Regulation.--Not later than 180 days after the date on which the Director of the National Institute of Standards and Technology completes the development of the recommendations required under section 3(b), the Director of the Office of Management and Budget shall issue guidelines for each agency that are consistent with such recommendations.</DELETED> <DELETED> (b) Requirement.--In issuing the guidelines required under subsection (a), the Director of the Office of Management and Budget shall ensure that the guidelines are consistent with the information security requirements in subchapter II of chapter 35 of title 44, United States Code.</DELETED> <DELETED> (c) Quinquennial Reviews and Revisions.--Not less frequently than once every 5 years--</DELETED> <DELETED> (1) the Director of the Office of Management and Budget and the Director of the National Institute of Standards and Technology shall review the policies issued under subsection (a);
and</DELETED> <DELETED> (2) the Director of the Office of Management and Budget shall, in consultation with the Director of the National Institute of Standards and Technology, revise such policies.</DELETED> <DELETED>SEC.
5.
NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY GUIDANCE ON COORDINATED DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO INTERNET OF THINGS DEVICES.</DELETED> <DELETED> (a) In General.--Not later than 180 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall, in consultation with such cybersecurity researchers and private-sector industry experts as the Director considers appropriate, publish guidance on policies and procedures for the reporting, coordinating, publishing, and receiving of information about--</DELETED> <DELETED> (1) a security vulnerability relating to a covered device used by the Federal Government;
and</DELETED> <DELETED> (2) the resolution of such security vulnerability.</DELETED> <DELETED> (b) Elements.--The guidance published under subsection (a) shall include the following:</DELETED> <DELETED> (1) Policies and procedures described in subsection (a) that, to the maximum extent practicable, are aligned with Standards 29147 and 30111 of the International Standards Organization, or any successor standards.
Such policies and procedures shall include policies and procedures for a contractor or vendor providing a covered device to the Federal Government on--</DELETED> <DELETED> (A) receiving information about a potential security vulnerability relating to the covered device;
and</DELETED> <DELETED> (B) disseminating information about the resolution of a security vulnerability relating to the covered device.</DELETED> <DELETED> (2) Guidance, including example content, on the information items that should be produced through the implementation of the security vulnerability disclosure process of the contractor.</DELETED> <DELETED>SEC.
6.
GUIDELINES FOR FEDERAL AGENCIES ON COORDINATED DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO INTERNET OF THINGS DEVICES.</DELETED> <DELETED> (a) Agency Guidelines Required.--Not later than 180 days after the date on which the guidance required under section 4 is published, the Director of the Office of Management and Budget shall, in consultation with the Administrator of the General Services Administration, issue guidelines for each agency on reporting, coordinating, publishing, and receiving information about--</DELETED> <DELETED> (1) a security vulnerability relating to a covered device used by the agency;
and</DELETED> <DELETED> (2) the resolution of such security vulnerability.</DELETED> <DELETED> (b) Contractor and Vendor Compliance With National Institute of Standards and Technology Guidance.--The guidelines required by subsection (a) shall include a limitation that prohibits an agency from acquiring or using any covered device from a contractor or vendor if the contractor or vendor fails to comply with the guidance published under section 5(a).</DELETED> <DELETED> (c) Consistency With Guidance From National Institute of Standards and Technology.--The Director shall ensure that the guidelines issued under subsection (a) are consistent with the guidance published under section 5(a).</DELETED> SECTION 1.
(2) CoveredDirector.--The device.-- (A) In general.--The term ``covered``Director'' device'' means athe physicalDirector objectof that--the (i)National isInstitute capable of connectingStandards to and isTechnology. in regular connection with the Internet;
(ii)(3) Information system.--The term ``information system'' has computerthe processingmeaning capabilitiesgiven thatthe canterm collect,in send,section or3502 receiveof data;title 44, United States Code.
and(4) (iii)Secretary.--The isterm not``Secretary'' ameans general-purposethe computingSecretary device,of includingHomeland personalSecurity. computing systems, smart mobile communications devices, programmable logic controls, and mainframe computing systems.
(B)(5) ModificationSecurity ofvulnerability.--The definition.--Theterm Director``security ofvulnerability'' has the Officemeaning ofgiven Managementthe andterm Budget shall establish a process by which-- (i) interested parties may petition for a device that is not described in subparagraphsection (A)102 toof bethe consideredCybersecurity aInformation deviceSharing thatAct isof not2015 a(6 coveredU.S.C. device;
and1501). (ii) the Director acts upon any petition submitted under clause (i) in a timely manner.
(3) Security vulnerability.--The term ``security vulnerability'' means any attribute of hardware, firmware, software, or combination of 2 or more of these factors that could enable the compromise of the confidentiality, integrity, or availability of an information system or its information or physical devices to which it is connected.
(a) CompletionDevelopment of OngoingRecommended EffortsGuidelines Relating to Considerations for ManagingUse of Internet of Things CybersecurityDevices Risks.--by Federal Government.-- (1) In general.--Thegeneral.--Not Directorlater ofthan theMarch National31, Institute2020, ofthe StandardsDirector and Technology shall ensuredevelop thatstandards theand effortsguidelines offor the InstituteFederal inGovernment effect on the dateappropriate ofuse theand enactmentmanagement ofby thisthe ActFederal regardingGovernment considerationsof for managing Internet of Things cybersecuritydevices risks,owned especiallyor regardingcontrolled examplesby ofthe possibleFederal cybersecurityGovernment, capabilitiesincluding ofminimum Internetinformation ofsecurity Thingsrequirements devices,for aremanaging completedcybersecurity norisks laterassociated thanwith Septembersuch 30,devices. 2019.
(2) MattersConsistency addressed.--Inwith ensuringongoing effortsefforts.--The areDirector completedshall ensure that the standards and guidelines developed under paragraph (1),(1) are consistent with the Directorefforts shallof alsothe ensureNational thatInstitute suchof effortsStandards address,and atTechnology ain minimum,effect on the date of enactment of this Act regarding considerations for managing Internet of Things cybersecurity risks, especially regarding examples of possible cybersecurity capabilities of Internet of Things devices, and in particular with respect to the following considerations for coveredInternet of Things devices:
(A) Secure Development.development.
(b) DevelopmentInstitute ofReport Recommendedon StandardsCybersecurity forConsiderations UseStemming From the Convergence of Information Technology, Internet of ThingsThings, Devicesand byOperational FederalTechnology Government.--Devices, (1)Networks, Inand general.--NotSystems.--Not later than Marchdays 31,after 2020, the Directordate of enactment of this Act, the InstituteDirector shall developbrief recommendationsthe forappropriate thecommittees Federalof GovernmentCongress on the appropriateincreasing useconvergence andof managementtraditional byinformation thetechnology Federaldevices, Governmentnetworks, ofand systems with Internet of Things devicesdevices, ownednetworks, orand controlledsystems byand theoperational Federaltechnology Government,devices, includingnetworks, minimumand informationsystems, securityincluding requirementsconsiderations for managing cybersecurity risks and security vulnerabilities associated with such devices.trends.
(2) Consistency with ongoing efforts.--The Director of the Institute shall ensure that the recommendations and standards developed under paragraph (1) are consistent with the efforts referred to in subsection (a), especially with respect to the examples of possible cybersecurity capabilities referred to in such subsection.
Show all 71 changed lines (31 more)
(c) Institute Report on Cybersecurity Considerations Stemming From the Convergence of Information Technology, Internet of Things, and Operational Technology Devices, Networks and Systems.--Not later than days following the enactment of this Act, the Director of the Institute shall publish a draft report related to the increasing convergence of traditional Information Technology devices, networks, and systems with Internet of Things devices, networks and systems and Operational Technology devices, networks and systems, including considerations for managing cybersecurity risks associated with such trends.
POLICIES AND PRINCIPLES FOR FEDERAL AGENCIES ON USE AND MANAGEMENT OF INTERNET OF THINGS DEVICES.
(a) RevisionsIn toGeneral.--Not the Federal Acquisition Regulation.--Not later than 180 days after the date on which the Director of the National Institute of Standards and Technology completes the development of the recommendationsstandards and guidelines required under section 3(b),3(a), the Director of the Office of Management and BudgetBudget, in consultation with the Secretary, shall issue guidelinespolicies and principles for each agency that are consistent with such recommendations.standards and guidelines.
(b) Requirement.--In issuing the policies, principles, standards, or guidelines required under subsection (a), the Director of the Office of Management and BudgetBudget, in consultation with the Secretary, shall ensure that the guidelinespolicies and principles are consistent with the information security requirements in subchapter II of chapter 35 of title 44, United States Code.
(c) Quinquennial Reviews and Revisions.--NotRevisions.--The less frequently than once every 5 years-- (1) the Director of the Office of Management and BudgetBudget, andin theconsultation Directorwith of the NationalSecretary, Instituteshall-- of(1) Standardsreview andany Technologypolicies, shallprinciples, reviewstandards, theor policiesguidelines issued under subsection (a);
and (2) therevise Directorsuch ofpolicies, theprinciples, Officestandards, of Management and Budgetguidelines. shall, in consultation with the Director of the National Institute of Standards and Technology, revise such policies.
NATIONALGUIDELINES INSTITUTE OF STANDARDS AND TECHNOLOGY GUIDANCE ON COORDINATED DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO INFORMATION SYSTEMS, INCLUDING INTERNET OF THINGS DEVICES.
(a) In General.--Not later than 1801 daysyear after the date of the enactment of this Act, the DirectorDirector, of the National Institute of Standards and Technology shall, in consultation with such cybersecurity researchers and private-sector industry experts as the Director considers appropriate, publishand guidancein onconsultation policieswith andthe proceduresSecretary, shall publish guidelines for the reporting, coordinating, publishing, and receiving of information about-- (1) a security vulnerability relating to aagency coveredinformation devicesystems, usedincluding byInternet theof FederalThings Government;devices;
(b) Elements.--The guidanceguidelines published under subsection (a) shallshall-- include(1) to the following:maximum extent practicable, be aligned with industry best practices and Standards 29147 and 30111 of the International Standards Organization, or any successor standards;
(1) Policies and procedures(2) describedincorporate inguidelines subsectionon-- (a)(A) that,receiving toinformation theabout maximuma extentpotential practicable,security areor alignedpersonal withinformation Standardsvulnerability 29147relating andto 30111agency ofinformation thesystems, Internationaland Standardswhen Organization,relevant, orInternet anyof successorThings standards.devices;
Such policies and procedures(B) shalldisseminating includeinformation policiesabout andthe proceduresresolution forof a contractorsecurity or vendorpersonal providinginformation avulnerability coveredrelating device to theagency Federal Government on-- (A) receiving information aboutsystems, aand potentialwhen securityrelevant, vulnerabilityInternet relatingof toThings thedevices. covered device;
and(c) (B)Information disseminatingItems.--The guidelines published under subsection (a) shall include guidelines, including example content, on the information aboutitems that should be produced through the resolutionimplementation of athe security vulnerability relatingdisclosure process of a contractor or vendor providing Internet of Things devices to the coveredFederal device.Government.
(2)(d) Guidance,Oversight.--The includingDirector exampleof content, on the informationOffice itemsof thatManagement shouldand beBudget producedshall throughoversee the implementation of the securityguidelines vulnerabilitypublished disclosureunder processsubsection of(a). the contractor.
(e) Operational and Technical Assistance.--The Secretary shall provide operational and technical assistance in implementing the guidelines published under subsection (a).
GUIDELINESIMPLEMENTATION FOROF FEDERAL AGENCIES ON COORDINATED DISCLOSURE OF SECURITY VULNERABILITIES RELATING TO AGENCY INFORMATION SYSTEMS, INCLUDING INTERNET OF THINGS DEVICES.
(a) Agency Guidelines Required.--Not later than 180 days after the date on which the guidanceDirector requiredpublishes guidelines under section 45(a), is published, the Director of the Office of Management and Budget shall,shall in consultation with the Administrator of the General Services Administration, issue guidelinespolicies forand eachprinciples agency on reporting,security coordinating,vulnerabilities publishing,of and receiving information about--systems, (1)including aInternet securityof vulnerabilityThings relatingdevices. to a covered device used by the agency;
and(b) (2)Procedures.--The Secretary, in consultation with the resolutionDirector of suchthe Office of Management and Budget, shall develop and issue procedures for each agency on reporting, coordinating, publishing, and receiving information about security vulnerability.vulnerabilities of information systems, including Internet of Things devices.
(b)(c) Contractor and Vendor Compliance With NationalPolicies Institute of Standards and TechnologyProcedures.--The Guidance.--Theprocedures guidelines required byunder subsection (a)(b) shall include a limitation that prohibits an agency from acquiring or using any coveredInternet of Things device from a contractor or vendor if the contractor or vendor fails to comply with the guidanceguidelines published under section 5(a).
(c)(d) Consistency With GuidanceGuidelines From National Institute of Standards and Technology.--The DirectorSecretary shall ensure that the guidelinesprocedures issuedrequired under subsection (a)(b) are consistent with applicable standards and publications established by the guidanceNational publishedInstitute underof sectionStandards 5(a).and Technology.
<all>SEC.
7.
WAIVER.
The head of an agency may use an Internet of Things device without regard to any policies, principles, standards, or guidelines issued under this Act if the use of the Internet of Things device is-- (1) necessary for national security or for research purposes;
(2) appropriate to the function of the covered device;
(3) secured using alternative and effective methods;
or (4) of substantially higher quality or affordability than a product that meets such policies, principles, standards, or guidelines.
Calendar No.
215 116th CONGRESS 1st Session S.
734 [Report No.
116-112] _______________________________________________________________________ A BILL To leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things devices, and for other purposes.
_______________________________________________________________________ September 23, 2019 Reported with an amendment
Show all 71 changed rows (31 more)
View plain text versions (2)
- Reported Reported to Senate Current html September 23, 2019
- Introduced Introduced in Senate html March 11, 2019
Sections of law this bill changes
From the bill's own amending language, matched to the official United States Code (current through Public Law 119-121).
Also cites: 6 U.S.C. § 1501, 44 U.S.C. § 3502
Action History
-
Committee on Homeland Security and Governmental Affairs. Reported by Senator Johnson with an amendment in the nature of a substitute. With written report No. 116-112.
-
Committee on Homeland Security and Governmental Affairs. Reported by Senator Johnson with an amendment in the nature of a substitute. With written report No. 116-112.
-
Placed on Senate Legislative Calendar under General Orders. Calendar No. 215.
-
Committee on Homeland Security and Governmental Affairs. Ordered to be reported with an amendment in the nature of a substitute favorably.
-
Introduced in Senate
-
Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Sponsors
- Mark R. Warner · Primary
Sponsorship breakdown
Export CSV (upgrade) →1 sponsors · 0 co-sponsors · 546 not signed on
Sponsors (1)
- Warner, Mark R. Democratic
Co-sponsors (0)
None.
Not signed on (546)
546 members have not signed on to this bill.
Show all 546 →"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.
Subjects
Frequently asked questions
- What does S 734 do?
- Internet of Things Cybersecurity Improvement Act of 2019 or the IoT Cybersecurity Improvement Act of 2019 This bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB) to take specified steps to increase cybersecurity for Internet of Things (IoT) devices. IoT is the extension of internet connectivity into physical devices and everyday objects. By March 31, 2020, NIST must develop standards and guidelines for the appropriate use and management of IoT devices owned or controlled by the government, including minimum information security requirements for managing cybersecurity risks. The OMB shall then issue policies and principles for each agency that are consistent with such guidelines. NIST shall publish guidelines for the reporting, coordinating, publishing, and receiving of information about a security vulnerability relating to agency information systems, including IoT devices, and the resolution of such security vulnerability. The OMB shall oversee the implementation of the guidelines.
- Who sponsors S 734?
- S 734 is sponsored by Warner, Mark R. (Democratic).
- What is the current status of S 734?
- This bill died with 116th Congress. It reached “In Committee” and never advanced before the session ended, so it can no longer move — a new version would have to be reintroduced in the current session.
- Where can I track S 734?
- Track S 734 free on One Click Politics — get push/email alerts when it moves.
Make your voice heard on S 734
Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.
Stay ahead of S 734
Last checked for changes 3 months ago · updated continuously
One Click Politics tracks every bill in Congress and all 50 states.
Track this bill →