HR 6497 Introduced - FISMA Update

Last week, Rep Maloney (D,NY) introduced HR 6497, the Federal Information Security Modernization Act of 2022. The bill is one of the periodic updates of the Federal Information Security Management Act (FISMA, 44 USC 3551 et seq) which outlines the cybersecurity programs for the federal government. It also includes two additional Titles:

• Title II – Improving Federal Cybersecurity, and

• Title III - Pilot Programs To Enhance Federal Cybersecurity

Definitions

Section 3 provides nine definitions of key terms that are used in this bill. Three of those definitions are taken directly from the §3552. Two new technical terms are defined in this section:

• Threat hunting, and

• Zero trust architecture

Additionally, §101(b) amends 44 USC 3552, Definitions, by adding new definitions, including:

• Additional cybersecurity procedure,

• High value asset,

• Major incident,

• Penetration test, and

• Shared service

No changes were made to any of the existing definition in §3552.

Federal Incident Response

Section 101(e) amends 44 USC Chapter 35 by adding a new Subchapter IV, Federal Incident Response. The new Subchapter includes:

• §3591 – Definitions,

• §3592 – Notification of breach,

• §3593 – Congressional and executive branch reports,

• §3594 – Government information sharing and incident response,

• §3595 – Responsibilities of contractors and awardees,

• §3596 – Training,

• §3597 – Analysis and report on Federal incidents,

• §3598 – Major incident definition,

Guidance Development

The crafters of the bill would require CISA to develop guidance for:

• Mobile security standards,

• Data logging and retention,

• Federal penetration testing, and

• Implementing zero trust architecture

Additionally, CISA would be required to establish the following pilot programs:

• Risk-based budget for cybersecurity spending,

• Security operations center as a service, and

• Endpoint detections and response as a service

Moving Forward

Maloney is the Chair of the House Oversight and Reform Committee to which this bill is assigned for consideration. As I mentioned yesterday, the bill is currently scheduled to be considered by the Committee tomorrow. With the bipartisan co-sponsorship (8 Democrats and 8 Republicans) that this bill has, I expect the bill to be favorably reported at the end of tomorrow’s hearing with strong (perhaps a voice vote) bipartisan support, though there may be some amendments offered. The full bill will be taken up by the full House later this year and there is a good chance that the bill will be considered under the suspension of the rules process. In any case, I would suspect the bill to pass with strong bipartisan support.

Commentary

This bill continues the congressional ignorance of the fact that there are operations technology systems in the federal government that need cybersecurity protections that might be different than the protections required for purely information systems. One needs to read no further than the definitions in §3552 (and by reference §3502) to see the truth of that assertion. This bill could be a first step in correcting that oversight by including the following new and revised definitions in §3552:

Control System - the term ‘control system’ means a discrete set of information resources, sensors, communications interfaces and physical devices organized to monitor, control and/or report on physical processes, including manufacturing, transportation, access control, and facility environmental controls;

Incident - the term "incident" means an occurrence that actually or imminently jeopardizes, without lawful authority;

(A) the integrity, confidentiality, or availability of information on an information system,

(B) the timely availability of accurate process information, the predictable control of the designed process or the confidentiality of process information, on a control system or

(C) an information system or a control system;

Information System – the term information system has the meaning given that term in §3502 and includes controls systems as defined in this section;