H.R. 6497 · 117th Congress
Federal Information Security Modernization Act of 2022
Key: what the circles and colors mean
Each circle is a bill. The ring fills as it moves through Congress:
Under the number: the Yea · Nay count of its final (or latest) recorded vote. On a member's page, the small badge is how that member voted: Y Yea / Aye, N Nay / No, P Present, – Not voting.
Gold and violet are only for Yea and Nay; they never mean a party. A member's party is the letter on their photo.
Never voted on. It didn't reach a floor vote before the 117th Congress ended, so it expired. A bill has to be introduced again to be considered in a new Congress.
D
MaloneySponsor16 cosponsors · 8 D, 8 R
D
Brown
JC
D
Cooper
GC
D
Connolly
JC
R
Comer
CF
R
Franklin
BG
R
Gibbs
JH
R
Hice
FK
R
Keller
SL
D
Lynch
EN
D
Norton
JR
D
Raskin
PS
R
Sessions
DW
D
Wasserman Schultz
JL
R
LaTurner
NM
R
Mace
KM
D
Mfume13 signed on when it was introduced; the rest joined later. Cosponsors who withdrew aren't shown.
This bill addresses federal information security management, notification and remediation of cybersecurity incidents, and the roles of the Office of Management and Budget (OMB) and the Cybersecurity and Infrastructure Security Agency (CISA).
What it does: CRS summary · Introduced in House · Jan 25, 2022
Federal Information Security Modernization Act of 2022
This bill addresses federal information security management, notification and remediation of cybersecurity incidents, and the roles of the Office of Management and Budget (OMB) and the Cybersecurity and Infrastructure Security Agency (CISA).
CISA must perform, on an ongoing and continuous basis, assessments of federal risk posture. The bill requires evaluation by each agency of whether additional cybersecurity procedures are appropriate at least once every three years.
An agency, as expeditiously as practicable and without unreasonable delay, and within 45 days after it has a reasonable basis to conclude that a breach has occurred, must (1) determine whether notice to any individual potentially affected by the breach is appropriate based on a risk assessment; and (2) as appropriate, provide written notice to each individual potentially affected. Notification may be delayed under specified circumstances.
Each agency must provide any information relating to a major incident to CISA, the OMB, the Office of the National Cyber Director, the agency's office of inspector general, the Government Accountability Office, and Congress.
An agency's contractors and grant recipients must notify the agency of an incident involving federal information within a specified time frame.
Each agency shall develop training for individuals at the agency with access to federal information or information systems on how to identify and respond to an incident.
CISA must establish a program to provide ongoing, hypothesis-driven threat-hunting services on the network of each agency.
The bill establishes specified pilot programs to enhance federal cybersecurity.
Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov
About this bill and sources
Official title: Federal Information Security Modernization Act of 2022
Latest action (Feb 2, 2022): Ordered to be Reported (Amended) by Voice Vote.
Policy area: Government Operations and Politics · Origin: House · Introduced: Jan 25, 2022
Official page on Congress.gov · Bill text (GovInfo) · Status record (XML)
No recorded floor vote found.