Yesterday, the Senate took up S 3600, the Strengthening American Cybersecurity Act of 2022, which was introduced last week. The Senate considered the bill under the unanimous consent process. After adopting two amendments, the Senate passed S 3600 without debate or vote. The bill contains FISMA modifications similar to those found in S 2902, cybersecurity incident reporting requirements similar to those found in S 2875, as well as federal cloud security requirements.
Similarities to S 2902
Three new sections were added to the provisions that were included in the version of S 2902 introduced in October. Those sections were:
§117. Council of the Inspectors General on Integrity and Efficiency dashboard.
§119. Establishment of risk-based budget model
§122. Extension of Chief Data Officer Council
Two provisions that were included in S 2902 are not found in this bill. Those sections are:
Relationship to S 2875
While S 3600 is very similar to S 2875 there has been a significant rewrite of the provisions. The 72-hour reporting requirements remains, but the new bill assigns responsibility for receiving the incident reports to the current National Infrastructure Coordinating Center (NICC) instead or establishing a new agency within CISA to accept those reports. I will be doing a more detailed assessment of the differences in a separate post.
Amendments
The Senate approved two amendments to the bill; SA 4953 and SA 4954 (pg S890).
SA 4593 was proposed by Senators Peters (D,MI) and Portman (R,OH). It would revise procedures for exempting federal agencies from select information system cybersecurity requirements. The amendment is very similar to S 3618.
SA 4954 was proposed by Senators Peters and Wicker (R,MS). It includes an additional amendment to 44 USC 3551 in §103 of the bill. That amendment adds two new subsections to §3551, subsection (o) and subsection (p). Section 3551(o) requires OMB to “review the efficacy of the guidance and policy developed by the Director under subsection [§3551](a)(1)”. Section 3551(p) requires NIST, once standards required by 15 USC 278g–3(a)(2) and (3), to consider developing “specifications to enable the automated verification of the implementation of the controls within the standard”.
Moving Forward
This strongly bipartisan action by the Senate would seem to grease the skids for this to pass quickly through the House and land on the President’s desk. Unfortunately, there are competing versions of portions of this bill in the House and this bill will have to overcome the ‘my bill first’ claims from at least two different House committees, Homeland Security and Science, Space, and technology. The current concerns about the Russian/Ukrainian related cybersecurity threats, may provide sufficient impetus to bring this bill to the floor of the House. If it gets by the two Chairs, this bill could easily be considered under the House suspension of the rules process and it could be on the President’s desk before the end of the month, or it could still be sitting on the Clerk’s desk at the end of the year.
Commentary:
This bill reflects a great deal of behind the scenes bargaining in the Senate. This will probably be the premier cybersecurity legislation for this Congress. My review today was done quickly to get it out and I am going to have to take a very detailed look at the cyber incident reporting requirements of §203. That post will come out later this week.