15 U.S.C. § 278g–3c — Guidelines on the disclosure process for security vulnerabilities relating to information systems, including Internet of Things devices

(a) In general: Within 180 days of December 4, 2020, the Institute's Director, after consulting cybersecurity researchers, private industry experts, and the Secretary, had to develop and publish, under section 278g–3, guidelines covering: how to report, coordinate, publish, and receive information about a security vulnerability in an agency's information systems (including IoT devices), and how to resolve it; and, for contractors (and subcontractors at any level) that supply an agency with an information system or IoT device, how they should receive vulnerability information and share information about fixing it. (b) Elements: The guidelines must, as much as practical, follow industry best practices and International Standards Organization Standards 29147 and 30111 (or successor or other widely used standards). They must cover receiving vulnerability information about agency-owned systems and IoT devices, and sharing how those vulnerabilities get fixed. They must also match the policies and procedures created under section 659(m) of title 6. (c) Information items: The guidelines must give example content for what information a contractor or subcontractor providing an information system or IoT device should report, coordinate, publish, or receive under this section. (d) Oversight: The Director of OMB oversees how these guidelines get carried out. (e) Operational and technical assistance: The Secretary, working with OMB's Director, must run the guidelines and give agencies operational and technical help using them.