Cybersecurity Act of 2023

The Cybersecurity Act of 2023 aims to improve federal government cybersecurity through two main titles: one modernizing federal information security laws and another enhancing cybersecurity for rural hospitals. Title I, the Federal Information Security Modernization Act of 2023, updates definitions and makes amendments to titles 44 and 40 of the U.S. Code. It requires the Director of the Office of Management and Budget to issue guidance on ongoing risk assessments and remedial action status for high-value assets. Agencies must notify private sector entities that submit sensitive information if an incident is likely to substantially impact that information. The Director must brief Congress on agency compliance with the No TikTok on Government Devices Act and provide a list of exceptions. Guidance on logging, log retention, and log management for incident response must be updated within two years. The Cybersecurity and Infrastructure Security Agency (CISA) must assign at least one cybersecurity professional as a liaison to each agency's Chief Information Security Officer. The Director must issue guidance requiring agencies to perform penetration testing on information systems, including high-value assets. A new section requires federal vulnerability disclosure policies to allow the public to report vulnerabilities. The Director must brief Congress on progress in implementing zero trust architecture and other internal defenses. Guidance on using artificial intelligence to improve cybersecurity must be issued, and the Chief Data Officer Council is extended until December 31, 2031. The Council of the Inspectors General on Integrity and Efficiency must include a dashboard of open information security recommendations. CISA must brief Congress on security operations center shared services. Specific cybersecurity requirements are codified for agencies, including identifying sensitive data and assessing access controls. A Federal Chief Information Security Officer is established, serving in both the Office of the Federal Chief Information Officer and the Office of the National Cyber Director. The Office of Electronic Government is renamed the Office of the Federal Chief Information Officer. Rules of construction clarify that the title does not authorize unauthorized actions, violate constitutional rights, or impinge on privacy. Title II, the Rural Hospital Cybersecurity Enhancement Act, requires the Secretary of Homeland Security, through the CISA Director, to develop a rural hospital cybersecurity workforce development strategy within one year, consulting with various agencies and rural healthcare providers. The CISA Director must make instructional materials available for rural hospitals to train staff on fundamental cybersecurity, including an awareness campaign. No additional funds are authorized for this title.