Federal Information Security Modernization Act of 2024

This bill aims to improve the cybersecurity of the U.S. Federal Government by updating laws, requiring new security practices, and creating new oversight roles. Sec. 2, Definitions: Defines key terms used in the bill, such as 'agency', 'incident', 'penetration test', 'threat hunting', and 'zero trust architecture'. Sec. 3, Amendments to title 44: Updates the Director of the Office of Management and Budget's (OMB) responsibilities to include overseeing information security policies in consultation with the National Cyber Director, and requires agency inventories to identify internet-accessible information systems. Sec. 4, Amendments to subtitle III of title 40: Modifies the Technology Modernization Fund to require proposals to include cybersecurity risk management and supply chain risk assessments, especially for high value assets, and adds a CISA official to the board. Sec. 5, Actions to enhance Federal incident transparency: Requires the Director of CISA to develop a plan for analyzing and reporting on federal cybersecurity incidents, and requires the OMB Director to update related laws and improve incident data sharing. Sec. 6, Agency requirements to notify private sector entities impacted by incidents: Requires the OMB Director to issue guidance for agencies to notify private entities that submitted sensitive information if an agency incident likely affects that information's confidentiality or integrity. Sec. 7, Federal penetration testing policy: Requires the OMB Director to issue guidance requiring agencies to perform penetration testing on information systems, including high value assets, with exceptions for national security systems. Sec. 8, Vulnerability disclosure policies: Requires the OMB Director to issue guidance for agencies to establish formal processes for the public to report security vulnerabilities in federal information systems. Sec. 9, Implementing zero trust architecture: Requires the OMB Director to brief Congress on progress shifting to zero trust architecture and to include updates on agency implementation in annual reports for up to ten years. Sec. 10, Automation and artificial intelligence: Directs the OMB Director to issue guidance on using AI to improve federal cybersecurity and requires reports from the OMB Director and the Comptroller General on AI use and associated risks. Sec. 11, Federal cybersecurity requirements: Codifies specific cybersecurity requirements for agencies into law, including identifying sensitive data, encrypting data, and implementing identity and access management systems. Sec. 12, Federal Chief Information Security Officer: Establishes a Senate-confirmed Federal Chief Information Security Officer position within both OMB and the Office of the National Cyber Director to oversee federal cybersecurity. Sec. 13, Renaming Office of the Federal Chief Information Officer: Renames the 'Office of Electronic Government' to the 'Office of the Federal Chief Information Officer' and its head from 'Administrator' to 'Federal Chief Information Officer'. Sec. 14, Rules of construction: States that nothing in the bill authorizes actions not already permitted by law, or allows the violation of constitutional rights, privacy rights, or unauthorized use of personal data.