**Section 7 from E.O. 13286 of February 28, 2003**

Sec. 7. Executive Order 13231 of October 16, 2001 (\"Critical
Infrastructure Protection in the Information Age\"), as amended, is
further amended to read in its entirety as follows:

\"Critical Infrastructure Protection in the Information Age

By the authority vested in me as President by the Constitution and the
laws of the United States of America, and in order to ensure protection
of information systems for critical infrastructure, including emergency
preparedness communications and the physical assets that support such
systems, in the information age, it is hereby ordered as follows:

Section 1. Policy. The information technology revolution has changed the
way business is transacted, government operates, and national defense is
conducted. Those three functions now depend on an interdependent network
of critical information infrastructures. It is the policy of the United
States to protect against disruption of the operation of information
systems for critical infrastructure and thereby help to protect the
people, economy, essential human and government services, and national
security of the United States, and to ensure that any disruptions that
occur are infrequent, of minimal duration, and manageable, and cause the
least damage possible. The implementation of this policy shall include a
voluntary public-private partnership, involving corporate and
nongovernmental organizations.

Sec. 2. Continuing Authorities. This order does not alter the existing
authorities or roles of United States Government departments and
agencies. Authorities set forth in 44 U.S.C. chapter 35, and other
applicable law, provide senior officials with responsibility for the
security of Federal Government information systems.

\(a\) Executive Branch Information Systems Security. The Director of the
Office of Management and Budget (OMB) has the responsibility to develop
and oversee the implementation of government-wide policies, principles,
standards, and guidelines for the security of information systems that
support the executive branch departments and agencies, except those
noted in section 2(b) of this order. The Director of OMB shall advise
the President and the appropriate department or agency head when there
is a critical deficiency in the security practices within the purview of
this section in an executive branch department or agency.

\(b\) National Security Information Systems. The Secretary of Defense
and the Director of Central Intelligence (DCI) shall have responsibility
to oversee, develop, and ensure implementation of policies, principles,
standards, and guidelines for the security of information systems that
support the operations under their respective control. In consultation
with the Assistant to the President for National Security Affairs and
the affected departments and agencies, the Secretary of Defense and the
DCI shall develop policies, principles, standards, and guidelines for
the security of national security information systems that support the
operations of other executive branch departments and agencies with
national security information.

\(i\) Policies, principles, standards, and guidelines developed under
this subsection may require more stringent protection than those
developed in accordance with section 2(a) of this order.

\(ii\) The Assistant to the President for National Security Affairs
shall advise the President and the appropriate department or agency when
there is a critical deficiency in the security practices of a department
or agency within the purview of this section.

\(iii\) National Security Systems. The National Security
Telecommunications and Information Systems Security Committee, as
established by and consistent with NSD-42 and chaired by the Department
of Defense, shall be designated as the \"Committee on National Security
Systems.\"

\(c\) Additional Responsibilities. The heads of executive branch
departments and agencies are responsible and accountable for providing
and maintaining adequate levels of security for information systems,
including emergency preparedness communications systems, for programs
under their control. Heads of such departments and agencies shall ensure
the development and, within available appropriations, funding of
programs that adequately address these mission systems, especially those
critical systems that support the national security and other essential
government programs. Additionally, security should enable, and not
unnecessarily impede, department and agency business operations.

Sec. 3. The National Infrastructure Advisory Council. The National
Infrastructure Advisory Council (NIAC), established on October 16, 2001,
shall provide the President through the Secretary of Homeland Security
with advice on the security of information systems for critical
infrastructure supporting other sectors of the economy: banking and
finance, transportation, energy, manufacturing, and emergency government
services.

\(a\) Membership. The NIAC shall be composed of not more than 30 members
appointed by the President. The members of the NIAC shall be selected
from the private sector, academia, and State and local government.
Members of the NIAC shall have expertise relevant to the functions of
the NIAC and generally shall be selected from industry Chief Executive
Officers (and equivalently ranked leaders of other organizations) with
responsibilities for security of information infrastructure supporting
the critical sectors of the economy, including banking and finance,
transportation, energy, communications, and emergency government
services. Members shall not be full-time officials or employees of the
executive branch of the Federal Government. The President shall
designate a Chair and Vice Chair from among the members of the NIAC.

\(b\) Functions of the NIAC. The NIAC will meet periodically to:

\(i\) enhance the partnership of the public and private sectors in
protecting information systems for critical infrastructures and provide
reports on this issue to the Secretary of Homeland Security, as
appropriate;

\(ii\) propose and develop ways to encourage private industry to perform
periodic risk assessments of critical information and telecommunications
systems;

\(iii\) monitor the development of private sector Information Sharing
and Analysis Centers (ISACs) and provide recommendations to the
President through the Secretary of Homeland Security on how these
organizations can best foster improved cooperation among the ISACs, the
Department of Homeland Security, and other Federal Government entities;

\(iv\) report to the President through the Secretary of Homeland
Security, who shall ensure appropriate coordination with the Assistant
to the President for Homeland Security, the Assistant to the President
for Economic Policy, and the Assistant to the President for National
Security Affairs under the terms of this order; and

\(v\) advise lead agencies with critical infrastructure
responsibilities, sector coordinators, the Department of Homeland
Security, and the ISACs.

\(c\) Administration of the NIAC.

\(i\) The NIAC may hold hearings, conduct inquiries, and establish
subcommittees, as appropriate.

\(ii\) Upon request of the Chair, and to the extent permitted by law,
the heads of the executive departments and agencies shall provide the
NIAC with information and advice relating to its functions.

\(iii\) Senior Federal Government officials may participate in the
meetings of the NIAC, as appropriate.

\(iv\) Members shall serve without compensation for their work on the
NIAC. However, members may be reimbursed for travel expenses, including
per diem in lieu of subsistence, as authorized by law for persons
serving intermittently in Federal Government service (5 U.S.C.
5701-5707).

\(v\) To the extent permitted by law and subject to the availability of
appropriations, the Department of Homeland Security shall provide the
NIAC with administrative services, staff, and other support services,
and such funds as may be necessary for the performance of the NIAC\'s
functions.

\(d\) General Provisions.

\(i\) Insofar as the Federal Advisory Committee Act, as amended (5
U.S.C. App.) (Act), may apply to the NIAC, the functions of the
President under that Act, except that of reporting to the Congress,
shall be performed by the Department of Homeland Security in accordance
with the guidelines and procedures established by the Administrator of
General Services.

\(ii\) The NIAC shall terminate on October 15, 2003, unless extended by
the President.

\(iii\) Executive Order 13130 of July 14, 1999, was revoked on October
16, 2001.

\(iv\) Nothing in this order shall supersede any requirement made by or
under law.

Sec. 4. Judicial Review. This order does not create any right or
benefit, substantive or procedural, enforceable at law or in equity,
against the United States, its departments, agencies, or other entities,
its officers or employees, or any other