§278g–3e Contractor Compliance with Coordinated Disclosure of Security Vulnerabilities Relating to Agency Internet of Things Devices

Summary

Agency leaders must not buy, renew, or use an Internet of Things (IoT) device if the agency Chief Information Officer, during the required review under section 11319(b)(1)(C) of title 40, finds the device would stop the agency from following the security standards and guidelines created under sections 278g–3b and 278g–3c. That rule applies even to contracts or subcontracts at or below the simplified acquisition threshold. An agency head can waive the ban if the CIO finds the waiver is needed for national security, is needed for research, or the device is protected by other effective security methods appropriate to its function. The Director of OMB must create a standard process for CIOs to use when deciding waivers. Every 2 years during the 6-year period starting on December 4, 2020, the Comptroller General must report to specified House and Senate committees on how the waiver process works, give recommended buying practices for IoT devices, and list the number and types of devices granted waivers in the prior 2 years and the legal reason for each. Those reports must be unclassified but may include a classified annex. The ban takes effect 2 years after December 4, 2020.