Federal Information Security Modernization Act of 2022
5/11/2023, 3:46 PMSummary of Bill HR 6497
Bill 117 HR 6497, also known as the Federal Information Security Modernization Act of 2022, aims to enhance the cybersecurity of federal information systems and data. The bill seeks to improve the overall security posture of federal agencies by requiring them to implement stronger security measures and protocols.Key provisions of the bill include:
1. Strengthening the role of the Department of Homeland Security (DHS) in overseeing federal information security efforts. 2. Requiring federal agencies to develop and implement risk-based cybersecurity programs to protect their information systems. 3. Mandating the use of best practices and standards for securing federal information systems, such as the National Institute of Standards and Technology (NIST) cybersecurity framework. 4. Enhancing the coordination and sharing of cybersecurity information between federal agencies and with the private sector. 5. Establishing reporting requirements for federal agencies to regularly assess and report on their cybersecurity posture. Overall, the Federal Information Security Modernization Act of 2022 aims to improve the cybersecurity of federal agencies and protect sensitive government information from cyber threats. By implementing stronger security measures and protocols, the bill seeks to enhance the overall security posture of federal information systems and data.
Congressional Summary of HR 6497
Federal Information Security Modernization Act of 2022
This bill addresses federal information security management, notification and remediation of cybersecurity incidents, and the roles of the Office of Management and Budget (OMB) and the Cybersecurity and Infrastructure Security Agency (CISA).
CISA must perform, on an ongoing and continuous basis, assessments of federal risk posture. The bill requires evaluation by each agency of whether additional cybersecurity procedures are appropriate at least once every three years.
An agency, as expeditiously as practicable and without unreasonable delay, and within 45 days after it has a reasonable basis to conclude that a breach has occurred, must (1) determine whether notice to any individual potentially affected by the breach is appropriate based on a risk assessment; and (2) as appropriate, provide written notice to each individual potentially affected. Notification may be delayed under specified circumstances.
Each agency must provide any information relating to a major incident to CISA, the OMB, the Office of the National Cyber Director, the agency's office of inspector general, the Government Accountability Office, and Congress.
An agency's contractors and grant recipients must notify the agency of an incident involving federal information within a specified time frame.
Each agency shall develop training for individuals at the agency with access to federal information or information systems on how to identify and respond to an incident.
CISA must establish a program to provide ongoing, hypothesis-driven threat-hunting services on the network of each agency.
The bill establishes specified pilot programs to enhance federal cybersecurity.
