1. Short title This Act may be cited as the Federal Cybersecurity Oversight Act of 2020 . 2. Federal cybersecurity requirements (a) Exemption from Federal requirements Section 225(b)(2) of the Federal Cybersecurity Enhancement Act of 2015 ( 6 U.S.C. 1523(b)(2) ) is amended to read as follows: (2) Exception (A) In general A particular requirement under paragraph (1) shall not apply to an agency information system of an agency if— (i) with respect to the agency information system, the head of the agency submits to the Director an application for an exemption from the particular requirement, in which the head of the agency personally certifies to the Director with particularity that— (I) operational requirements articulated in the certification and related to the agency information system would make it excessively burdensome to implement the particular requirement; (II) the particular requirement is not necessary to secure the agency information system or agency information stored on or transiting the agency information system; and (III) the agency has taken all necessary steps to secure the agency information system and agency information stored on or transiting the agency information system; (ii) the head of the agency or the designee of the head of the agency has submitted the certification described in clause (i) to the appropriate congressional committees and any other congressional committee with jurisdiction over the agency; and (iii) the Director grants the exemption from the particular requirement. (B) Duration of exemption (i) In general An exemption granted under subparagraph (A) shall expire on the date that is 1 year after the date on which the Director grants the exemption. (ii) Renewal Upon the expiration of an exemption granted to an agency under subparagraph (A), the head of the agency may apply for an additional exemption. . (b) Report on exemptions Section 3554(c)(1)(A) of title 44, United States Code, is amended— (1) in clause (iii), by striking and at the end