NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017
Latest action. Placed on the Union Calendar, Calendar No. 276.
NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017
(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST), in developing standards for information systems, to emphasize the principle that expanding cybersecurity threats require: (1) engineering security from the beginning of a system's life cycle, (2) building more trustworthy and secure components and systems from the start, and (3) applying well-defined security design principles throughout systems.
(Sec. 3) NIST must provide guidance for agencies to incorporate into their information security risk management efforts the Framework for Improving Critical Infrastructure Cybersecurity (Framework). Such guidance shall:
describe how the Framework aligns or augments existing agency practices;
identify any areas of conflict or overlap between the Framework and existing cybersecurity requirements;
include a template for federal agencies on how to use the Framework and recommend procedures for streamlining and harmonizing existing and future cybersecurity-related requirements;
recommend other procedures for compliance with cybersecurity reporting, oversight, and policy review; and
be updated to reflect what NIST learns from ongoing research, cybersecurity audits, information compiled by the federal working group, and annual reports.
NIST must chair a federal working group to coordinate the development of metrics and tools to measure the effectiveness of the Framework for federal agencies protecting their information and information systems.
The federal working group must assist the Office of Management and Budget (OMB) and Office of Science and Technology Policy (OSTP) in publishing annual reports on agency adoption rates and the effectiveness of the Framework.
NIST must initiate an individual cybersecurity audit of certain agencies to assess the extent to which each agency meets information security standards. NIST shall prepare a needs-based plan for the audits that includes: (1) a description of staffing plans, (2) workforce capabilities, (3) methods of conducting such audits, (4) coordination with agencies to support such audits, (5) expected timeframe for the completion of the audits, and (6) other relevant information.
The summary continues for 1 more paragraph. Read it in full on Congress.gov
Written by analysts at the Congressional Research Service and published on Congress.gov, not by Civibrief. Summarized at the "Reported to House with amendment(s)" stage on October 31, 2017. It describes the bill, it is not the legal text.
Where is it in the process, and what happens next?
4 steps remain before this bill could become law.
The record's latest action, on October 31, 2017: Placed on the Union Calendar, Calendar No. 276.
- Clearing the committees it was referred to, and being scheduled for a floor vote
- Passage by the House
- Passage by the Senate
- The President's signature. If the President vetoes it, two-thirds of both chambers must vote to override.
How likely is it to become law?
Civibrief does not forecast outcomes and this page has no opinion about this one. What the record supports is a base rate, which is a fact about the whole pile, not a prediction about this measure.
In the 115th Congress (2017-18), 442 of the 11,421 bills and joint resolutions introduced became law, about 3.9 percent. That count covers every measure at every stage, including the many that never left committee.
This one is not there yet: 4 steps are still outstanding, listed above.
Has anyone actually voted on it?
No. No roll call in this Congress cites this measure. That is the ordinary outcome: most measures never reach a recorded floor vote, and a committee ends most of them simply by not acting.
A vote is not the only thing that happens to a measure. Hearings, markups, and referrals are all recorded actions, and none of them is a vote of the full chamber.
Who is behind it?
Ralph Abraham (R-LA) introduced it on February 27, 2017, and 5 members have since signed on as cosponsors.
They are 5 Republicans.
Cosponsoring is a formal signature on the text. It is not a commitment to vote for the measure, it does not bind anyone's party, and a long list of cosponsors is a measure of attention rather than of prospects.
How long has it been in play?
It was introduced on February 27, 2017, 3529 days ago. The most recent recorded action was 3283 days ago, on October 31, 2017.
Measures do not carry over. Anything the 115th Congress has not finished by January 3, 2019 dies when the term ends, and has to be introduced again from the start in the next Congress.
Every answer above is assembled from this measure's own record on Congress.gov and from published counts of what Congress has passed before. Civibrief does not predict outcomes and takes no position on any measure.
Vote history
- HouseIn committee, no floor vote yet
- SenateAwaits House passage
- PresidentAwaits both chambers