Earlier this month, Sen Wyden (D,OR) introduced S 3618, the Federal Cybersecurity Oversight Act of 2022. The bill would slightly revise the process for exempting federal agencies from select information system cybersecurity requirements outlined in 6 USC 1523 while setting a time limit for those exemptions and establishing reporting requirements for those exemptions.
Revised Exemption Provisions
Section 2(a) of the bill revises §1523(b)(2) by taking the existing subparagraphs ‘(A)’ and ‘(B)’ and combining them into a new subparagraph “(A) IN GENERAL….” There are some minor changes in wording that attend that change, but most reflect the stylistic requirements of clauses found in federal legislation.
The reason for those changes is that the crafters of this bill added a new subparagraph “(B) DURATION OF EXEMPTION.” That subparagraph establishes that the exemption provided in (A) will expire one year after they are approved by the Director of the Office of Management and Budget (OMB) and may only be renewed for a single 1-year period.
Reporting Requirement
Section 2(b) of the bill amends the annual reporting requirements of 44 USC 3554(c)(1)(A), inserting a new clause (iv). The new language requires agencies to include in their annual report to OMB, DHS and Congress on information security activities a listing of each exemption granted under 6 USC 1523. That portion of the report would include:
An identification of each particular requirement from which any agency information system is exempted,
An identification of the agency information system exempted, and
An estimate of the date on which the agency will to be able to comply with the requirement.
Moving Forward
Wyden is not a member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This means that there is probably not enough influence to see this bill considered in Committee. I see nothing in the bill that would engender any significant opposition. The bill would likely advance in Committee with significant bipartisan support if considered.
This bill will not move to the floor of the Senate under regular order. It is not important enough to take up that much time, particularly as the mid-term elections approach. This bill might be able to pass in the Senate if considered under the unanimous consent process.