§278g–3e Contractor compliance with coordinated disclosure of security vulnerabilities relating to agency Internet of Things devices

Summary

Agency heads must not buy, renew, or use Internet of Things (IoT) devices if the agency’s Chief Information Officer (CIO), during a required contract review, finds the device would stop the agency from meeting the federal IoT security standards and guidelines. That rule applies even to small contracts or subcontracts that are below the simplified acquisition threshold. The ban takes effect 2 years after December 4, 2020. An agency can make an exception only if the CIO says it’s needed for national security, for research, or if the device is protected by other effective security methods. The Office of Management and Budget must create a standard process for CIOs to decide on these exceptions. The Comptroller General must report every 2 years during the 6-year period beginning on December 4, 2020 to the House Oversight and Reform Committee, the House Homeland Security Committee, and the Senate Homeland Security and Governmental Affairs Committee on how the process works, recommended buying practices, and a list of waivers granted (what devices and which legal reason). Reports should be unclassified but may include a classified annex.