There are 5 versions of this bill. View text

Click the check-box to add or remove the section, click the text link to scroll to that section.
Titles Actions Overview All Actions Cosponsors Committees Related Bills Subjects Latest Summary All Summaries

Titles (6)

Short Titles

Short Titles as Enacted

Federal Information Security Modernization Act of 2014

Short Titles - House of Representatives

Short Titles as Passed House

Federal Information Security Modernization Act of 2014

Short Titles - Senate

Short Titles as Passed Senate

Federal Information Security Modernization Act of 2014

Short Titles as Reported to Senate

Federal Information Security Modernization Act of 2014

Short Titles as Introduced

Federal Information Security Modernization Act of 2014

Official Titles

Official Titles - Senate

Official Titles as Introduced

A bill to amend chapter 35 of title 44, United States Code, to provide for reform to Federal information security.

Actions Overview (7)

Date Actions Overview
12/18/2014Became Public Law No: 113-283. (TXT | PDF)
12/18/2014Signed by President.
12/12/2014Presented to President.
12/10/2014Passed/agreed to in House: On passage Passed without objection.(text: CR H8994-8998)
12/08/2014Passed/agreed to in Senate: Passed Senate with an amendment by Voice Vote.
09/15/2014Committee on Homeland Security and Governmental Affairs. Reported by Senator Carper without amendment. With written report No. 113-256.
06/24/2014Introduced in Senate

All Actions (18)

Date Chamber All Actions
12/18/2014Became Public Law No: 113-283. (TXT | PDF)
12/18/2014Signed by President.
12/12/2014SenatePresented to President.
12/10/2014-5:23pmHouseMotion to reconsider laid on the table Agreed to without objection.
12/10/2014-5:23pmHouseOn passage Passed without objection. (text: CR H8994-8998)
12/10/2014-5:23pmHouseConsidered by unanimous consent. (consideration: CR H8994-8998)
12/10/2014-5:23pmHouseMr. Meadows asked unanimous consent to take from the Speaker's table and consider.
12/09/2014-3:58pmHouseHeld at the desk.
12/09/2014SenateMessage on Senate action sent to the House.
12/09/2014-12:51pmHouseReceived in the House.
12/08/2014SenatePassed Senate with an amendment by Voice Vote.
12/08/2014SenateS.Amdt.3975 Amendment SA 3975 agreed to in Senate by Unanimous Consent.
12/08/2014SenateS.Amdt.3975 Amendment SA 3975 proposed by Senator Reid for Senator Carper. (consideration: CR S6395) In the nature of a substitute.
12/08/2014SenateMeasure laid before Senate by unanimous consent. (consideration: CR S6395)
09/15/2014SenatePlaced on Senate Legislative Calendar under General Orders. Calendar No. 564.
09/15/2014SenateCommittee on Homeland Security and Governmental Affairs. Reported by Senator Carper without amendment. With written report No. 113-256.
06/25/2014SenateCommittee on Homeland Security and Governmental Affairs. Ordered to be reported without amendment favorably.
06/24/2014SenateRead twice and referred to the Committee on Homeland Security and Governmental Affairs.

Cosponsors (1)

* = Original cosponsor
CosponsorDate Cosponsored
Sen. Coburn, Tom [R-OK]* 06/24/2014

Committees (2)

Committees, subcommittees and links to reports associated with this bill are listed here, as well as the nature and date of committee activity and Congressional report number.

Committee / Subcommittee Date Activity Reports
Senate Homeland Security and Governmental Affairs06/24/2014 Referred to
06/25/2014 Markup by
09/15/2014 Reported by S. Rept. 113-256
House Homeland Security08/01/2014 Legislative interest

A related bill may be a companion measure, an identical bill, a procedurally-related measure, or one with text similarities. Bill relationships are identified by the House, the Senate, or CRS, and refer only to same-congress measures.

Latest Summary (5)

There are 5 summaries for S.2521. View summaries

Shown Here:
Public Law No: 113-283 (12/18/2014)

(This measure has not been amended since it was passed by the Senate on December 8, 2014. The summary of that version is repeated here.)

Federal Information Security Modernization Act of 2014 - Amends the Federal Information Security Management Act of 2002 (FISMA) to: (1) reestablish the oversight authority of the Director of the Office of Management and Budget (OMB) with respect to agency information security policies and practices, and (2) set forth authority for the Secretary of Homeland Security (DHS) to administer the implementation of such policies and practices for information systems.

Requires the Secretary to develop and oversee implementation of operational directives requiring agencies to implement the Director's standards and guidelines for safeguarding federal information and systems from a known or reasonably suspected information security threat, vulnerability, or risk. Authorizes the Director to revise or repeal operational directives that are not in accordance with the Director's policies.

Requires the Secretary (currently, the Director) to ensure the operation of the federal information security incident center (FISIC).

Directs the Secretary to administer procedures to deploy technology, upon request by an agency, to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities.

Requires the Director's annual report to Congress regarding the effectiveness of information security policies to assess agency compliance with OMB data breach notification procedures.

Provides for OMB's information security authorities to be delegated to the Director of National Intelligence (DNI) for certain systems operated by an element of the intelligence community.

Directs the Secretary to consult with and consider guidance developed by the National Institute of Standards and Technology (NIST) to ensure that operational directives do not conflict with NIST information security standards.

Directs agency heads to ensure that: (1) information security management processes are integrated with budgetary planning; (2) senior agency officials, including chief information officers, carry out their information security responsibilities; and (3) all personnel are held accountable for complying with the agency-wide information security program.

Provides for the use of automated tools in agencies' information security programs, including for periodic risk assessments, testing of security procedures, and detecting, reporting, and responding to security incidents.

Requires agencies to include offices of general counsel as recipients of security incident notices. Requires agencies to notify Congress of major security incidents within seven days after there is a reasonable basis to conclude that a major incident has occurred.

Directs agencies to submit an annual report regarding major incidents to OMB, DHS, Congress, and the Comptroller General (GAO). Requires such reports to include: (1) threats and threat actors, vulnerabilities, and impacts; (2) risk assessments of affected systems before, and the status of compliance of the systems at the time of, major incidents; (3) detection, response, and remediation actions; (4) the total number of incidents; and (5) a description of the number of individuals affected by, and the information exposed by, major incidents involving a breach of personally identifiable information.

Authorizes GAO to provide technical assistance to agencies and inspectors general, including by testing information security controls and procedures.

Requires OMB to ensure the development of guidance for: (1) evaluating the effectiveness of information security programs and practices, and (2) determining what constitutes a major incident.

Directs FISIC to provide agencies with intelligence about cyber threats, vulnerabilities, and incidents for risk assessments.

Directs OMB, during the two-year period after enactment of this Act, to include in an annual report to Congress an assessment of the adoption by agencies of continuous diagnostics technologies and other advanced security tools.

Requires OMB to ensure that data breach notification policies require agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General, heads of elements of the intelligence community, or the DHS Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions.

Requires OMB to amend or revise OMB Circular A-130 to eliminate inefficient and wasteful reporting.

Directs the Information Security and Privacy Advisory Board to advise and provide annual reports to DHS.