44 U.S.C. § 3506 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 35: COORDINATION OF FEDERAL INFORMATION POLICY / Subchapter I: FEDERAL INFORMATION POLICY / Section 3506: Federal agency responsibilities
Federal agency responsibilities
Status: in_force

(a)(1) The head of each agency shall be responsible for—

(A) carrying out the agency's information resources management activities to improve agency productivity, efficiency, and effectiveness; and

(B) complying with the requirements of this subchapter and related policies established by the Director.

(2)(A) Except as provided under subparagraph (B), the head of each agency shall designate a Chief Information Officer who shall report directly to such agency head to carry out the responsibilities of the agency under this subchapter.

(B) The Secretary of the Department of Defense and the Secretary of each military department may each designate Chief Information Officers who shall report directly to such Secretary to carry out the responsibilities of the department under this subchapter. If more than one Chief Information Officer is designated, the respective duties of the Chief Information Officers shall be clearly delineated.

(3) The Chief Information Officer designated under paragraph (2) shall head an office responsible for ensuring agency compliance with and prompt, efficient, and effective implementation of the information policies and information resources management responsibilities established under this subchapter, including the reduction of information collection burdens on the public. The Chief Information Officer and employees of such office shall be selected with special attention to the professional qualifications required to administer the functions described under this subchapter.

(4) Each agency program official shall be responsible and accountable for information resources assigned to and supporting the programs under such official. In consultation with the Chief Information Officer designated under paragraph (2) and the agency Chief Financial Officer (or comparable official), each agency program official shall define program information needs and develop strategies, systems, and capabilities to meet those needs.

(b) With respect to general information resources management, each agency shall—

(1) manage information resources to—

(A) reduce information collection burdens on the public;

(B) increase program efficiency and effectiveness; and

(C) improve the integrity, quality, and utility of information to all users within and outside the agency, including capabilities for ensuring dissemination of public information, public access to government information, and protections for privacy and security;

(2) in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that, to the extent practicable—

(A) describes how information resources management activities help accomplish agency missions;

(B) includes an open data plan for data that does not concern monetary policy that—

(i) requires the agency to develop processes and procedures that—

(I) require data collection mechanisms created on or after the date of the enactment of the OPEN Government Data Act to be available in an open format; and

(II) facilitate collaboration with non-Government entities (including businesses), researchers, and the public for the purpose of understanding how data users value and use government data;

(ii) identifies and implements methods for collecting and analyzing digital information on data asset usage by users within and outside of the agency, including designating a point of contact within the agency to assist the public and to respond to quality issues, usability issues, recommendations for improvements, and complaints about adherence to open data requirements within a reasonable period of time;

(iii) develops and implements a process to evaluate and improve the timeliness, completeness, consistency, accuracy, usefulness, and availability of open Government data assets;

(iv) includes requirements for meeting the goals of the agency open data plan, including the acquisition of technology, provision of training for employees, and the implementation of procurement standards, in accordance with existing law, regulation, and policy, that allow for the acquisition of innovative solutions from public and private sectors;

(v) identifies as priority data assets any data asset for which disclosure would be in the public interest and establishes a plan to evaluate each priority data asset for disclosure on the Federal Data Catalogue under section 3511 and for a determination under 1 3511(a)(2)(A)(iii)(I)(bb), including an accounting of which priority data assets have not yet been evaluated; and

(vi) requires the agency to comply with requirements under section 3511, including any standards established by the Director under such section, when disclosing a data asset pursuant to such section; and

(C) is updated annually and made publicly available on the website of the agency not later than 5 days after each such update;

(3) develop and maintain an ongoing process to—

(A) ensure that information resources management operations and decisions are integrated with organizational planning, budget, financial management, human resources management, and program decisions;

(B) in cooperation with the agency Chief Financial Officer (or comparable official), develop a full and accurate accounting of information technology expenditures, related expenses, and results; and

(C) establish goals for improving information resources management's contribution to program productivity, efficiency, and effectiveness, methods for measuring progress towards those goals, and clear roles and responsibilities for achieving those goals;

(4) in consultation with the Director, the Administrator of General Services, and the Archivist of the United States, maintain a current and complete inventory of the agency's information resources, including directories necessary to fulfill the requirements of section 3511 of this subchapter;

(5) in consultation with the Director and the Director of the Office of Personnel Management, conduct formal training programs to educate agency program and management officials about information resources management; and

(6) in accordance with guidance by the Director—

(A) make each data asset of the agency available in an open format; and

(B) make each public data asset of the agency available—

(i) as an open Government data asset; and

(ii) under an open license.

(c) With respect to the collection of information and the control of paperwork, each agency shall—

(1) establish a process within the office headed by the Chief Information Officer designated under subsection (a), that is sufficiently independent of program responsibility to evaluate fairly whether proposed collections of information should be approved under this subchapter, to—

(A) review each collection of information before submission to the Director for review under this subchapter, including—

(i) an evaluation of the need for the collection of information;

(ii) a functional description of the information to be collected;

(iii) a plan for the collection of the information;

(iv) a specific, objectively supported estimate of burden;

(v) a test of the collection of information through a pilot program, if appropriate; and

(vi) a plan for the efficient and effective management and use of the information to be collected, including necessary resources;

(B) ensure that each information collection—

(i) is inventoried, displays a control number and, if appropriate, an expiration date;

(ii) indicates the collection is in accordance with the clearance requirements of section 3507; and

(iii) informs the person receiving the collection of information of—

(I) the reasons the information is being collected;

(II) the way such information is to be used;

(III) an estimate, to the extent practicable, of the burden of the collection;

(IV) whether responses to the collection of information are voluntary, required to obtain a benefit, or mandatory; and

(V) the fact that an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a valid control number; and

(C) assess the information collection burden of proposed legislation affecting the agency;

(2)(A) except as provided under subparagraph (B) or section 3507(j), provide 60-day notice in the Federal Register, and otherwise consult with members of the public and affected agencies concerning each proposed collection of information, to solicit comment to—

(i) evaluate whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information shall have practical utility;

(ii) evaluate the accuracy of the agency's estimate of the burden of the proposed collection of information;

(iii) enhance the quality, utility, and clarity of the information to be collected; and

(iv) minimize the burden of the collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology; and

(B) for any proposed collection of information contained in a proposed rule (to be reviewed by the Director under section 3507(d)), provide notice and comment through the notice of proposed rulemaking for the proposed rule and such notice shall have the same purposes specified under subparagraph (A)(i) through (iv);

(3) certify (and provide a record supporting such certification, including public comments received by the agency) that each collection of information submitted to the Director for review under section 3507—

(A) is necessary for the proper performance of the functions of the agency, including that the information has practical utility;

(B) is not unnecessarily duplicative of information otherwise reasonably accessible to the agency;

(C) reduces to the extent practicable and appropriate the burden on persons who shall provide information to or for the agency, including with respect to small entities, as defined under section 601(6) of title 5, the use of such techniques as—

(i) establishing differing compliance or reporting requirements or timetables that take into account the resources available to those who are to respond;

(ii) the clarification, consolidation, or simplification of compliance and reporting requirements; or

(iii) an exemption from coverage of the collection of information, or any part thereof;

(D) is written using plain, coherent, and unambiguous terminology and is understandable to those who are to respond;

(E) is to be implemented in ways consistent and compatible, to the maximum extent practicable, with the existing reporting and recordkeeping practices of those who are to respond;

(F) indicates for each recordkeeping requirement the length of time persons are required to maintain the records specified;

(G) contains the statement required under paragraph (1)(B)(iii);

(H) has been developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected, including the processing of the information in a manner which shall enhance, where appropriate, the utility of the information to agencies and the public;

(I) uses effective and efficient statistical survey methodology appropriate to the purpose for which the information is to be collected; and

(J) to the maximum extent practicable, uses information technology to reduce burden and improve data quality, agency efficiency and responsiveness to the public; and

(4) in addition to the requirements of this chapter regarding the reduction of information collection burdens for small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)), make efforts to further reduce the information collection burden for small business concerns with fewer than 25 employees.

(d) With respect to information dissemination, each agency shall—

(1) ensure that the public has timely and equitable access to the agency's public information, including ensuring such access through—

(A) encouraging a diversity of public and private sources for information based on government public information;

(B) in cases in which the agency provides public information maintained in electronic format, providing timely and equitable access to the underlying data (in whole or in part); and

(C) agency dissemination of public information in an efficient, effective, and economical manner;

(2) regularly solicit and consider public input on the agency's information dissemination activities;

(3) provide adequate notice when initiating, substantially modifying, or terminating significant information dissemination products;

(4) not, except where specifically authorized by statute—

(A) establish an exclusive, restricted, or other distribution arrangement that interferes with timely and equitable availability of public information to the public;

(B) restrict or regulate the use, resale, or redissemination of public information by the public;

(C) charge fees or royalties for resale or redissemination of public information; or

(D) establish user fees for public information that exceed the cost of dissemination;

(5) ensure that any public data asset of the agency is machine-readable; and

(6) engage the public in using public data assets of the agency and encourage collaboration by—

(A) publishing on the website of the agency, on a regular basis (not less than annually), information on the usage of such assets by non-Government users;

(B) providing the public with the opportunity to request specific data assets to be prioritized for disclosure and to provide suggestions for the development of agency criteria with respect to prioritizing data assets for disclosure;

(C) assisting the public in expanding the use of public data assets; and

(D) hosting challenges, competitions, events, or other initiatives designed to create additional value from public data assets of the agency.

(e) With respect to statistical policy and coordination, each agency shall—

(1) ensure the relevance, accuracy, timeliness, integrity, and objectivity of information collected or created for statistical purposes;

(2) inform respondents fully and accurately about the sponsors, purposes, and uses of statistical surveys and studies;

(3) protect respondents' privacy and ensure that disclosure policies fully honor pledges of confidentiality;

(4) observe Federal standards and practices for data collection, analysis, documentation, sharing, and dissemination of information;

(5) ensure the timely publication of the results of statistical surveys and studies, including information about the quality and limitations of the surveys and studies; and

(6) make data available to statistical agencies and readily accessible to the public.

(f) With respect to records management, each agency shall implement and enforce applicable policies and procedures, including requirements for archiving information maintained in electronic format, particularly in the planning, design and operation of information systems.

(g) With respect to privacy and security, each agency shall—

(1) implement and enforce applicable policies, procedures, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for the agency; and

(2) assume responsibility and accountability for compliance with and coordinated management of sections 552 and 552a of title 5, subchapter II of this chapter, and related information management laws.

(h) With respect to Federal information technology, each agency shall—

(1) implement and enforce applicable Governmentwide and agency information technology management policies, principles, standards, and guidelines;

(2) assume responsibility and accountability for information technology investments;

(3) promote the use of information technology by the agency to improve the productivity, efficiency, and effectiveness of agency programs, including the reduction of information collection burdens on the public and improved dissemination of public information;

(4) propose changes in legislation, regulations, and agency procedures to improve information technology practices, including changes that improve the ability of the agency to use technology to reduce burden; and

(5) assume responsibility for maximizing the value and assessing and managing the risks of major information systems initiatives through a process that is—

(A) integrated with budget, financial, and program management decisions; and

(B) used to select, control, and evaluate the results of major information systems initiatives.

(i)(1) In addition to the requirements described in subsection (c), each agency shall, with respect to the collection of information and the control of paperwork, establish 1 point of contact in the agency to act as a liaison between the agency and small business concerns (as defined in section 3 of the Small Business Act (15 U.S.C. 632)).

(2) Each point of contact described under paragraph (1) shall be established not later than 1 year after the date of enactment of the Small Business Paperwork Relief Act of 2002.

(Added Pub. L. 104–13, §2, May 22, 1995, 109 Stat. 171; amended Pub. L. 104–106, div. E, title LI, §5125(a), Feb. 10, 1996, 110 Stat. 684; Pub. L. 106–398, §1 [[div. A], title X, §1064(b)], Oct. 30, 2000, 114 Stat. 1654, 1654A–275; Pub. L. 107–198, §2(b), (c), June 28, 2002, 116 Stat. 729; Pub. L. 107–217, §3(l)(6), Aug. 21, 2002, 116 Stat. 1302; Pub. L. 107–296, title X, §1005(c)(3), Nov. 25, 2002, 116 Stat. 2273; Pub. L. 107–347, title III, §305(c)(3), Dec. 17, 2002, 116 Stat. 2961; Pub. L. 115–435, title II, §202(c)(1), Jan. 14, 2019, 132 Stat. 5536.)

Editorial Notes

References in Text

The date of the enactment of the OPEN Government Data Act, referred to in subsec. (b)(2)(B)(i)(I), is the date of enactment of title II of Pub. L. 115–435, which was approved Jan. 14, 2019.

The date of enactment of the Small Business Paperwork Relief Act of 2002, referred to in subsec. (i)(2), is the date of enactment of Pub. L. 107–198, which was approved June 28, 2002.

Prior Provisions

A prior section 3506, added Pub. L. 96–511, §2(a), Dec. 11, 1980, 94 Stat. 2819; amended Pub. L. 99–500, §101(m) [title VIII, §816], Oct. 18, 1986, 100 Stat. 1783–308, 1783–338, and Pub. L. 99–591, §101(m) [title VIII, §816], Oct. 30, 1986, 100 Stat. 3341–308, 3341–338, related to Federal agency responsibilities prior to the general amendment of this chapter by Pub. L. 104–13.

Another prior section 3506, Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1303, provided for determination of necessity for information and hearing thereon, prior to the general amendment of this chapter by Pub. L. 96–511. See section 3508 of this title.

Amendments

2019—Subsec. (b)(2). Pub. L. 115–435, §202(c)(1)(A)(i), amended par. (2) generally. Prior to amendment, par. (2) read as follows: "in accordance with guidance by the Director, develop and maintain a strategic information resources management plan that shall describe how information resources management activities help accomplish agency missions;".

Subsec. (b)(6). Pub. L. 115–435, §202(c)(1)(A)(ii)–(iv), added par. (6).

Subsec. (d)(5), (6). Pub. L. 115–435, §202(c)(1)(B), added pars. (5) and (6).

2002—Subsec. (c)(4). Pub. L. 107–198, §2(c), added par. (4).

Subsec. (g)(1). Pub. L. 107–296, §1005(c)(3)(A), and Pub. L. 107–347, §305(c)(3)(A), amended par. (1) identically, inserting "and" at end.

Subsec. (g)(2). Pub. L. 107–296, §1005(c)(3)(B), and Pub. L. 107–347, §305(c)(3)(B), amended par. (2) identically, substituting "subchapter II of this chapter" for "section 11332 of title 40" and a period for "; and" at end.

Pub. L. 107–217, §3(l)(6)(A), substituted "section 11332 of title 40" for "the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (g)(3). Pub. L. 107–296, §1005(c)(3)(C), and Pub. L. 107–347, §305(c)(3)(C), amended subsec. (g) identically, striking out par. (3) which read as follows: "consistent with section 11332 of title 40, identify and afford security protections commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of information collected or maintained by or on behalf of an agency."

Pub. L. 107–217, §3(l)(6)(B), substituted "section 11332 of title 40" for "the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (i). Pub. L. 107–198, §2(b), added subsec. (i).

2000—Subsecs. (a)(1) to (3), (b)(4), (c)(1). Pub. L. 106–398 substituted "subchapter" for "chapter" wherever appearing.

1996—Subsec. (a)(2)(A). Pub. L. 104–106, §5125(a)(1)(A), substituted "Chief Information Officer" for "senior official".

Subsec. (a)(2)(B). Pub. L. 104–106, §5125(a)(1)(B), substituted "designate Chief Information Officers" for "designate senior officials", "Chief Information Officer" for "official", and "the Chief Information Officers" for "the officials".

Subsec. (a)(3), (4). Pub. L. 104–106, §5125(a)(1)(C), substituted "Chief Information Officer" for "senior official" wherever appearing.

Subsec. (c)(1). Pub. L. 104–106, §5125(a)(2), substituted "Chief Information Officer" for "official" in introductory provisions.

Statutory Notes and Related Subsidiaries

Effective Date of 2019 Amendment

Pub. L. 115–435, title II, §202(c)(3), Jan. 14, 2019, 132 Stat. 5538, provided that: "The amendments made by this subsection [amending this section] shall take effect on the date that is 1 year after the date of the enactment of this Act [Jan. 14, 2019]."

Effective Date of 2002 Amendment

Amendment by Pub. L. 107–347 effective Dec. 17, 2002, see section 402(b) of Pub. L. 107–347, set out as a note under section 3504 of this title.

Amendment by Pub. L. 107–296 effective 60 days after Nov. 25, 2002, see section 4 of Pub. L. 107–296, set out as an Effective Date note under section 101 of Title 6, Domestic Security.

Effective Date of 2000 Amendment

Amendment by Pub. L. 106–398 effective 30 days after Oct. 30, 2000, see section 1 [[div. A], title X, §1065] of Pub. L. 106–398, Oct. 30, 2000, 114 Stat. 1654, formerly set out as an Effective Date note under former section 3531 of this title.

Effective Date of 1996 Amendment

Amendment by Pub. L. 104–106 effective 180 days after Feb. 10, 1996, see section 5701 of Pub. L. 104–106, Feb. 10, 1996, 110 Stat. 702.

Effective Date

Section effective Oct. 1, 1995, except as otherwise provided, see section 4(a) of Pub. L. 104–13, set out as a note under section 3501 of this title.

Use of Open Data Assets

Pub. L. 115–435, title II, §202(c)(2), Jan. 14, 2019, 132 Stat. 5538, provided that: "Not later than 1 year after the date of the enactment of this Act [Jan. 14, 2019], the head of each agency (as defined in section 3502 of title 44, United States Code) shall ensure that any activity by the agency meets the requirements of section 3506 of title 44, United States Code, as amended by this subsection."

Executive Documents

Ex. Ord. No. 13073. Year 2000 Conversion

Ex. Ord. No. 13073, Feb. 4, 1998, 63 F.R. 6467, as amended by Ex. Ord. No. 13127, June 14, 1999, 64 F.R. 32793, provided:

The American people expect reliable service from their Government and deserve the confidence that critical government functions dependent on electronic systems will be performed accurately and in a timely manner. Because of a design feature in many electronic systems, a large number of activities in the public and private sectors could be at risk beginning in the year 2000. Some computer systems and other electronic devices will misinterpret the year "00" as 1900, rather than 2000. Unless appropriate action is taken, this flaw, known as the "Y2K problem," can cause systems that support those functions to compute erroneously or simply not run. Minimizing the Y2K problem will require a major technological and managerial effort, and it is critical that the United States Government do its part in addressing this challenge.

Accordingly, by the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows:

Section 1. Policy. (a) It shall be the policy of the executive branch that agencies shall:

(1) assure that no critical Federal program experiences disruption because of the Y2K problem;

(2) assist and cooperate with State, local, and tribal governments to address the Y2K problem where those governments depend on Federal information or information technology or the Federal Government is dependent on those governments to perform critical missions;

(3) cooperate with the private sector operators of critical national and local systems, including the banking and financial system, the telecommunications system, the public health system, the transportation system, and the electric power generation system, in addressing the Y2K problem; and

(4) communicate with their foreign counterparts to raise awareness of and generate cooperative international arrangements to address the Y2K problem.

(b) As used in this order, "agency" and "agencies" refer to Federal agencies that are not in the judicial or legislative branches.

Sec. 2. Year 2000 Conversion Council. There is hereby established the President's Council on Year 2000 Conversion (the "Council").

(a) The Council shall be led by a Chair who shall be an Assistant to the President, and it shall be composed of one representative from each of the executive departments and from such other Federal agencies as may be determined by the Chair of the Council (the "Chair").

(b) The Chair shall appoint a Vice Chair and assign other responsibilities for operations of the council as he or she deems necessary.

(c) The Chair shall oversee the activities of agencies to assure that their systems operate smoothly through the year 2000, act as chief spokesperson on this issue for the executive branch in national and international fora, provide policy coordination of executive branch activities with State, local, and tribal governments on the Y2K problem, and promote appropriate Federal roles with respect to private sector activities in this area.

(d) The Chair and the Director of the Office of Management and Budget shall report jointly at least quarterly to me on the progress of agencies in addressing the Y2K problem.

(e) The Chair shall identify such resources from agencies as the Chair deems necessary for the implementation of the policies set out in this order, consistent with applicable law.

Sec. 3. Responsibilities of Agency Heads. (a) The head of each agency shall:

(1) assure that efforts to address the Y2K problem receive the highest priority attention in the agency and that the policies established in this order are carried out; and

(2) cooperate to the fullest extent with the Chair by making available such information, support, and assistance, including personnel, as the Chair may request to support the accomplishment of the tasks assigned herein, consistent with applicable law.

(b) The heads of executive departments and the agencies designated by the Chair under section 2(a) of this order shall identify a responsible official to represent the head of the executive department or agency on the Council with sufficient authority and experience to commit agency resources to address the Y2K problem.

Sec. 4. Responsibilities of Interagency and Executive Office Councils. Interagency councils and councils within the Executive Office of the President, including the President's Management Council, the Chief Information Officers Council, the Chief Financial Officers Council, the President's Council on Integrity and Efficiency, the Executive Council on Integrity and Efficiency, the National Science and Technology Council, the National Performance Review, the National Economic Council, the Domestic Policy Council, and the National Security Council shall provide assistance and support to the Chair upon the Chair's request.

Sec. 5. Information Coordination Center. (a) To assist the Chair in the Y2K response duties included under section 2(c) of this order, there shall be established the Information Coordination Center (ICC) in the General Services Administration.

(b) At the direction of the Chair, the ICC will assist in making preparations for information sharing and coordination within the Federal Government and key components of the public and private sectors, coordinating agency assessments of Y2K emergencies that could have an adverse affect on U.S. interests at home and abroad, and, if necessary, assisting Federal agencies and the Chair in reconstitution processes where appropriate.

(c) The ICC will:

(1) consist of officials from executive agencies, designated by agency heads under subsection 3(a)(2) of this order, who have expertise in important management and technical areas, computer hardware, software or security systems, reconstitution and recovery, and of additional personnel hired directly or by contract, as required, to carry out the duties described under section 5 of this order;

(2) work with the Council and the Office of Management and Budget to assure that Federal efforts to restore critical systems are coordinated with efforts managed by Federal agencies acting under existing emergency response authorities.

(d) The Chair of the President's Council on Year 2000 Conversion shall designate a Director of the ICC.

Sec. 6. Judicial Review. This Executive order is intended only to improve the internal management of the executive branch and does not create any right or benefit, substantive or procedural, enforceable at law or equity by a party against the United States, its agencies, or instrumentalities, its officers or employees, or any other person.

William J. Clinton.      

1 So in original. Probably should be followed by "section".
44 U.S.C. § 3609 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 36: MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES / Section 3609: Roles and responsibilities of the General Services Administration
Roles and responsibilities of the General Services Administration
Status: in_force

(a) Roles and Responsibilities.—The Administrator shall—

(1) in consultation with the Secretary, develop, coordinate, and implement a process to support agency review, reuse, and standardization, where appropriate, of security assessments of cloud computing products and services, including, as appropriate, oversight of continuous monitoring of cloud computing products and services, pursuant to guidance issued by the Director pursuant to section 3614;

(2) establish processes and identify criteria consistent with guidance issued by the Director under section 3614 to make a cloud computing product or service eligible for a FedRAMP authorization and validate whether a cloud computing product or service has a FedRAMP authorization;

(3) develop and publish templates, best practices, technical assistance, and other materials to support the authorization of cloud computing products and services and increase the speed, effectiveness, and transparency of the authorization process, consistent with standards and guidelines established by the Director of the National Institute of Standards and Technology and relevant statutes;

(4) establish and update guidance on the boundaries of FedRAMP authorization packages to enhance the security and protection of Federal information and promote transparency for agencies and users as to which services are included in the scope of a FedRAMP authorization;

(5) grant FedRAMP authorizations to cloud computing products and services consistent with the guidance and direction of the FedRAMP Board;

(6) establish and maintain a public comment process for proposed guidance and other FedRAMP directives that may have a direct impact on cloud service providers and agencies before the issuance of such guidance or other FedRAMP directives;

(7) coordinate with the FedRAMP Board, the Director of the Cybersecurity and Infrastructure Security Agency, and other entities identified by the Administrator, with the concurrence of the Director and the Secretary, to establish and regularly update a framework for continuous monitoring under section 3553;

(8) provide a secure mechanism for storing and sharing necessary data, including FedRAMP authorization packages, to enable better reuse of such packages across agencies, including making available any information and data necessary for agencies to fulfill the requirements of section 3613;

(9) provide regular updates to applicant cloud service providers on the status of any cloud computing product or service during an assessment process;

(10) regularly review, in consultation with the FedRAMP Board—

(A) the costs associated with the independent assessment services described in section 3611; and

(B) the information relating to foreign interests submitted pursuant to section 3612;

(11) in coordination with the Director, the Secretary, and other stakeholders, as appropriate, determine the sufficiency of underlying requirements to identify and assess the provenance of the software in cloud services and products;

(12) support the Federal Secure Cloud Advisory Committee established pursuant to section 3616; and

(13) take such other actions as the Administrator may determine necessary to carry out FedRAMP.

(b) Website.—

(1) In general.—The Administrator shall maintain a public website to serve as the authoritative repository for FedRAMP, including the timely publication and updates for all relevant information, guidance, determinations, and other materials required under subsection (a).

(2) Criteria and process for fedramp authorization priorities.—The Administrator shall develop and make publicly available on the website described in paragraph (1) the criteria and process for prioritizing and selecting cloud computing products and services that will receive a FedRAMP authorization, in consultation with the FedRAMP Board and the Chief Information Officers Council.

(c) Evaluation of Automation Procedures.—

(1) In general.—The Administrator, in coordination with the Secretary, shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of FedRAMP authorizations, including continuous monitoring of cloud computing products and services.

(2) Means for automation.—Not later than 1 year after the date of enactment of this section, and updated regularly thereafter, the Administrator shall establish a means for the automation of security assessments and reviews.

(d) Metrics for Authorization.—The Administrator shall establish annual metrics regarding the time and quality of the assessments necessary for completion of a FedRAMP authorization process in a manner that can be consistently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section 3554 in a manner that minimizes the agency reporting burden.

(Added Pub. L. 117–263, div. E, title LIX, §5921(b), Dec. 23, 2022, 136 Stat. 3450.)

Repeal of Section

For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below.

Editorial Notes

References in Text

The date of enactment of this section, referred to in subsec. (c)(2), is the date of enactment of Pub. L. 117–263, which was approved Dec. 23, 2022.

Statutory Notes and Related Subsidiaries

Effective Date of Repeal

Pub. L. 117–263, div. E, title LIX, §5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this section is effective on the date that is 5 years after Dec. 23, 2022.

Construction

For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title.
44 U.S.C. § 1718 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 17: DISTRIBUTION AND SALE OF PUBLIC DOCUMENTS / Section 1718: Distribution of Government publications to the Library of Congress
Distribution of Government publications to the Library of Congress
Status: in_force

There shall be printed and furnished to the Library of Congress for official use in the District of Columbia not to exceed twenty-five copies of:

House documents and reports, bound;

Senate documents and reports, bound;

Senate and House journals, bound;

public bills and resolutions;

the United States Code and supplements, bound; and

all other publications and maps which are printed, or otherwise reproduced, under authority of law, upon the requisition of a Congressional committee, executive department, bureau, independent office, establishment, commission, or officer of the Government.

Confidential matter, blank forms, and circular letters not of a public character shall be excepted.

In addition, there shall be delivered as printed to the Library of Congress:

ten copies of each House document and report, unbound;

ten copies of each Senate document and report, unbound; and

ten copies of each private bill and resolution and fifty copies of the laws in slip form.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1282; Pub. L. 97–276, §101(e), Oct. 2, 1982, 96 Stat. 1189.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §139 (Jan. 28, 1899, No. 12, 30 Stat. 1388; Mar. 2, 1901, No. 16, §§1, 2, 31 Stat. 1464; June 20, 1936, ch. 630, title IV, §6, 49 Stat. 1550).

Reference to the Official Register is omitted as obsolete. The authorization for its compilation was repealed by Public Law 88–626 [86–626].

Editorial Notes

Codification

The 1982 amendment by Pub. L. 97–276 is based on section 305(a) of S. 2939, Ninety-seventh Congress, 2d Session, as reported Sept. 22, 1982, and incorporated by reference in section 101(e) of Pub. L. 97–276, to be effective as if enacted into law.

Amendments

1982—Pub. L. 97–276 substituted "not to exceed twenty-five copies of" for ", and for international exchange as provided by section 1719 of this title, not to exceed one hundred and fifty copies of".
44 U.S.C. § 3509 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 35: COORDINATION OF FEDERAL INFORMATION POLICY / Subchapter I: FEDERAL INFORMATION POLICY / Section 3509: Designation of central collection agency
Designation of central collection agency
Status: in_force

The Director may designate a central collection agency to obtain information for two or more agencies if the Director determines that the needs of such agencies for information will be adequately served by a single collection agency, and such sharing of data is not inconsistent with applicable law. In such cases the Director shall prescribe (with reference to the collection of information) the duties and functions of the collection agency so designated and of the agencies for which it is to act as agent (including reimbursement for costs). While the designation is in effect, an agency covered by the designation may not obtain for itself information for the agency which is the duty of the collection agency to obtain. The Director may modify the designation from time to time as circumstances require. The authority to designate under this section is subject to the provisions of section 3507(f) of this subchapter.

(Added Pub. L. 104–13, §2, May 22, 1995, 109 Stat. 180; amended Pub. L. 106–398, §1 [[div. A], title X, §1064(b)], Oct. 30, 2000, 114 Stat. 1654, 1654A–275.)

Editorial Notes

Prior Provisions

A prior section 3509, added Pub. L. 96–511, §2(a), Dec. 11, 1980, 94 Stat. 2821, related to designation of central collection agency prior to the general amendment of this chapter by Pub. L. 104–13.

Another prior section 3509, Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1304, related to plans or forms for collecting information, submission to Director, and his approval, prior to the general amendment of this chapter by Pub. L. 96–511.

Amendments

2000—Pub. L. 106–398 substituted "subchapter" for "chapter".

Statutory Notes and Related Subsidiaries

Effective Date of 2000 Amendment

Amendment by Pub. L. 106–398 effective 30 days after Oct. 30, 2000, see section 1 [[div. A], title X, §1065] of Pub. L. 106–398, Oct. 30, 2000, 114 Stat. 1654, formerly set out as an Effective Date note under former section 3531 of this title.

Effective Date

Section effective Oct. 1, 1995, except as otherwise provided, see section 4(a) of Pub. L. 104–13, set out as a note under section 3501 of this title.
44 U.S.C. § 515 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 5: PRODUCTION AND PROCUREMENT OF PRINTING AND BINDING / Section 515: Default of contractor; new contracts and purchase in open market
Default of contractor; new contracts and purchase in open market
Status: in_force

If a contractor fails to comply with his contract, the Director of the Government Publishing Office shall report the default to the Joint Committee on Printing, and under its direction, enter into a new contract with the lowest, best, and most responsible bidder for the interest of the Government among those whose proposals were rejected at the last opening of bids, or he shall advertise for new proposals, under the regulations provided by sections 509–517 of this title. During the interval that may thus occur he may, under the direction of the Joint Committee on Printing, purchase in open market, at the lowest market price, paper necessary for the public printing.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1245; Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §11 (Jan. 12, 1895, ch. 23, §9, 28 Stat. 602; Mar. 3, 1917, ch. 163, §6, 39 Stat. 1121).

Editorial Notes

Amendments

2014—Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer".
44 U.S.C. § 3903 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 39: GOVERNMENT PUBLISHING OFFICE: OFFICE OF INSPECTOR GENERAL / Section 3903: Duties, responsibilities, authority, and reports
Duties, responsibilities, authority, and reports
Status: in_force

(a) Sections 404, 405, 406 (other than subsection (a)(7) and (8) thereof), and 407 of title 5 shall apply to the Inspector General of the Government Publishing Office and the Office of such Inspector General and such sections shall be applied to the Government Publishing Office and the Director of the Government Publishing Office by substituting—

(1) "Government Publishing Office" for "establishment"; and

(2) "Director of the Government Publishing Office" for "head of the establishment".

(b)(1) The Inspector General, in carrying out the provisions of this chapter, is authorized, without the supervision or approval of any other employee, office, or other entity within the Government Publishing Office, to select, appoint, and employ such officers and employees as may be necessary for carrying out the functions, powers, and duties of the Office of Inspector General subject to the provisions of this title governing selections, appointments, and employment in the Government Publishing Office (and any regulations thereunder).

(2) Appointments under the authority under paragraph (1) shall be made consistent with personnel security and suitability requirements.

(3) Any appointment of a consultant under the authority under paragraph (1) shall be made consistent with section 6(a)(8) of the Inspector General Act of 1978 (5 U.S.C. App.).1

(c)(1) Subject to paragraph (2), any supervisory special agent under the Inspector General and any special agent supervised by such a supervisory special agent is authorized to—

(A) make an arrest without a warrant while engaged in official duties as authorized under this chapter or any other statute for any offense against the United States committed in the presence of such supervisory special agent or special agent, or for any felony cognizable under the laws of the United States if such supervisory special agent or special agent has reasonable grounds to believe that the person to be arrested has committed or is committing such felony;

(B) seek and execute warrants for arrest, search of a premises, or seizure of evidence issued under the authority of the United States upon probable cause to believe that a violation has been committed; and

(C) carry a firearm while engaged in official duties as authorized under this chapter or any other statute.

(2)(A)(i) In order to exercise the authority under paragraph (1), a supervisory special agent or a special agent supervised by such a supervisory special agent shall certify that he or she—

(I) is a citizen of the United States;

(II) has successfully completed a basic law enforcement training program or military or other equivalent; and

(III) is not prohibited from receiving a firearm under Federal law, including under section 922(g)(9) of title 18, United States Code, because of a conviction of a misdemeanor crime of domestic violence.

(ii) After providing notice to the appropriate committees of Congress, the Inspector General may add requirements to the certification required under clause (i), as determined appropriate by the Inspector General.

(B) The Inspector General shall maintain firearms-related requirements (including quarterly firearms qualifications) and use of force training requirements that, except to the extent the Inspector General determines necessary to effectively carry out the duties of the Office of the Inspector General, are in accordance with the Council of the Inspectors General on Integrity and Efficiency use of force policies, which incorporate Department of Justice guidelines.

(C)(i) The Inspector General shall—

(I) determine whether an individual meets the requirements under this subsection; and

(II) revoke any authority granted to an individual under paragraph (1) if the individual is not in compliance with the requirements of this subsection.

(ii) The Inspector General may reauthorize an individual to exercise the authority granted under paragraph (1) if the Inspector General determines the individual has achieved compliance with the requirements under this subsection.

(iii) A revocation of the authority granted under paragraph (1) shall not be subject to administrative, judicial, or other review, unless the revocation results in an adverse action. Such an adverse action may, at the election of the applicable individual, be reviewed in accordance with the otherwise applicable procedures.

(3)(A) Before the first grant of authority under paragraph (1), and semiannually thereafter as part of the report under section 5 of the Inspector General Act of 1978 (5 U.S.C. App.),1 the Inspector General shall submit to the appropriate committees of Congress a written certification that adequate internal safeguards and management procedures exist that, except to the extent the Inspector General determines necessary to effectively carry out the duties of the Office of the Inspector General, are in compliance with standards established by the Council of the Inspectors General on Integrity and Efficiency, which incorporate Department of Justice guidelines, to ensure proper exercise of the powers authorized under this subsection.

(B) The authority granted under this subsection (including any grant of authority to an individual under paragraph (1), without regard to whether the individual is in compliance with paragraph (2)) may be suspended by the Inspector General if the Office of Inspector General fails to comply with the reporting and review requirements under subparagraph (A) of this paragraph or paragraph (4). Any suspension of authority under this subparagraph shall be reported to the appropriate committees of Congress.

(4) To ensure the proper exercise of the law enforcement powers authorized under this subsection, the Office of Inspector General shall submit to and participate in the external review process established by the Council of the Inspectors General on Integrity and Efficiency for ensuring that adequate internal safeguards and management procedures continue to exist. Under the review process, the exercise of the law enforcement powers by the Office of Inspector General shall be reviewed periodically by another Office of Inspector General or by a committee of Inspectors General. The results of each review shall be communicated in writing to the Inspector General, the Council of the Inspectors General on Integrity and Efficiency, and the appropriate committees of Congress.

(5) Any allegation of misconduct by an individual granted authority under paragraph (1) may be reviewed by the Integrity Committee of the Council of the Inspectors General on Integrity and Efficiency.

(6) In this subsection, the term "appropriate committees of Congress" means—

(A) the Committee on Rules and Administration and the Committee on Appropriations of the Senate; and

(B) the Committee on House Administration and the Committee on Appropriations of the House of Representatives.

(d) The Director of the Government Publishing Office shall include the annual budget request of the Inspector General in the budget of the Government Publishing Office without change.

(Added Pub. L. 100–504, title II, §202, Oct. 18, 1988, 102 Stat. 2531; amended Pub. L. 113–235, div. H, title I, §1301(b), (c)(1), Dec. 16, 2014, 128 Stat. 2537; Pub. L. 116–94, div. P, title XVI, §§1603(c), 1604(c), 1605(c), Dec. 20, 2019, 133 Stat. 3216, 3219, 3220; Pub. L. 117–286, §4(b)(90), Dec. 27, 2022, 136 Stat. 4352.)

Editorial Notes

References in Text

Sections 5 and 6(a)(8) of the Inspector General Act of 1978, referred to in subsecs. (b)(3) and (c)(3)(A), are sections 5 and 6(a)(8) of Pub. L. 95–452, which were set out in the Appendix to Title 5, Government Organization and Employees, and were repealed and restated as sections 405 and 406(a)(8), respectively, of Title 5 by Pub. L. 117–286, §§3(b), 7, Dec. 27, 2022, 136 Stat. 4212, 4219, 4361.

Amendments

2022—Subsec. (a). Pub. L. 117–286 substituted "Sections 404, 405, 406 (other than subsection (a)(7) and (8) thereof), and 407 of title 5" for "Sections 4, 5, 6 (other than subsection (a)(7) and (8) thereof), and 7 of the Inspector General Act of 1978 (Public Law 95–452; 5 U.S.C. App. 3)" in introductory provisions.

2019—Subsec. (b). Pub. L. 116–94, §1605(c), designated existing provisions as par. (1), inserted ", without the supervision or approval of any other employee, office, or other entity within the Government Publishing Office," after "is authorized", and added pars. (2) and (3).

Subsec. (c). Pub. L. 116–94, §1603(c), added subsec. (c).

Subsec. (d). Pub. L. 116–94, §1604(c), added subsec. (d).

2014—Subsec. (a). Pub. L. 113–235, §1301(c)(1), substituted "Director of the Government Publishing Office" for "Public Printer" in introductory provisions and par. (2).

Statutory Notes and Related Subsidiaries

Change of Name

"Government Publishing Office" substituted for "Government Printing Office" wherever appearing in text on authority of section 1301(b) of Pub. L. 113–235, set out as a note preceding section 301 of this title.

Effective Date

Section effective 180 days after Oct. 18, 1988, see section 206 of 100–504, set out as a note under section 3901 of this title.

1 See References in Text note below.
44 U.S.C. § 312 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 3: GOVERNMENT PUBLISHING OFFICE / Section 312: Machinery, material, equipment, or supplies from other Government agencies
Machinery, material, equipment, or supplies from other Government agencies
Status: in_force

An officer of the Government having machinery, material, equipment, or supplies for printing, binding, and blank-book work, including lithography, photolithography, and other processes of reproduction, no longer required or authorized for the service of such officer, shall submit a detailed report of them to the Director of the Government Publishing Office. The Director of the Government Publishing Office, with the approval of the Joint Committee on Printing, may requisition such articles as are serviceable in the Government Publishing Office, and they shall be promptly delivered to that office.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1242; Pub. L. 113–235, div. H, title I, §1301(b), (c)(1), (i)(8), Dec. 16, 2014, 128 Stat. 2537, 2539.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §59 (July 19, 1919, ch. 24, §3, 41 Stat. 233).

Editorial Notes

Amendments

2014—Pub. L. 113–235, §1301(i)(8), substituted "the service of such officer" for "his service".

Pub. L. 113–235, §1301(c)(1), substituted "Director of the Government Publishing Office" for "Public Printer" in two places.

Statutory Notes and Related Subsidiaries

Change of Name

"Government Publishing Office" substituted for "Government Printing Office" in text on authority of section 1301(b) of Pub. L. 113–235, set out as a note preceding section 301 of this title.
44 U.S.C. § 509 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 5: PRODUCTION AND PROCUREMENT OF PRINTING AND BINDING / Section 509: Standards of paper; advertisements for proposals; samples
Standards of paper; advertisements for proposals; samples
Status: in_force

The Joint Committee on Printing shall fix upon standards of paper for the different descriptions of public printing and binding, and the Director of the Government Publishing Office, under their direction, shall advertise in six newspapers or trade journals, published in different cities, for sealed proposals to furnish the Government with paper, as specified in the schedule to be furnished applicants by the Director of the Government Publishing Office, setting forth in detail the quality and quantities required for the public printing. The Director of the Government Publishing Office shall furnish samples of the standard of papers fixed upon to applicants who desire to bid.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1244; Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §5 (Jan. 12, 1895, ch. 23, §3, 28 Stat. 601; Mar. 3, 1925, ch. 421, §1, 43 Stat. 1105).

Editorial Notes

Amendments

2014—Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer" wherever appearing.

Statutory Notes and Related Subsidiaries

National Policy on Permanent Papers

Pub. L. 101–423, Oct. 12, 1990, 104 Stat. 912, as amended by Pub. L. 113–235, div. H, title I, §1301(b), (d), Dec. 16, 2014, 128 Stat. 2537, provided that:

"Whereas it is now widely recognized and scientifically demonstrated that the acidic papers commonly used for more than a century in documents, books, and other publications are self-destructing and will continue to self destruct;

"Whereas Americans are facing the prospect of continuing to lose national, historical, scientific, and scholarly records, including government records, faster than salvage efforts can be mounted despite the dedicated efforts of many libraries, archives, and agencies, such as the Library of Congress and the National Archives and Records Administration;

"Whereas nationwide hundreds of millions of dollars will have to be spent by the Federal, State, and local governments and private institutions to salvage the most essential books and other materials in the libraries and archives of government, academic, and private institutions;

"Whereas paper manufacturers can produce a sufficient supply of acid free permanent papers with a life of several hundred years, at prices competitive with acid papers, if publishers would specify the use of such papers, and some publishers and many university presses are already publishing on acid free permanent papers;

"Whereas most Government agencies do not require the use of acid free permanent papers for appropriate Federal records and publications;

"Whereas librarians, publishers, and other professional groups have urged the use of acid free permanent papers;

"Whereas even when books are printed on acid free permanent paper this fact is often not made known to libraries by notations in the book or by notations in standard bibliographic listings; and

"Whereas there is an urgent need to prevent the continuance of the acid paper problem in the future: Now, therefore, be it

"Resolved by the Senate and House of Representatives of the United States of America in Congress assembled,

"Section 1. It is the policy of the United States that Federal records, books, and publications of enduring value be produced on acid free permanent papers.

"Sec. 2. The Congress of the United States urgently recommends that—

"(1) Federal agencies require the use of acid free permanent papers for publications of enduring value produced by the Government Publishing Office or produced by Federal grant or contract, using the specifications for such paper established by the Joint Committee on Printing;

"(2) Federal agencies require the use of archival quality acid free papers for permanently valuable Federal records and confer with the National Archives and Records Administration on the requirements for paper quality;

"(3) American publishers and State and local governments use acid free permanent papers for publications of enduring value, in voluntary compliance with the American National Standard;

"(4) all publishers, private and governmental, prominently note the use of acid free permanent paper in books, advertisements, catalogs, and standard bibliographic listings; and

"(5) the Secretary of State, Librarian of Congress, Archivist of the United States, and other Federal officials make known the national policy regarding acid free permanent papers to foreign governments and appropriate international agencies since the acid paper problem is worldwide and essential foreign materials being imported by our libraries are printed on acid papers.

"Sec. 3. The Librarian of Congress, the Archivist of the United States, and the Director of the Government Publishing Office shall jointly monitor the Federal Government's progress in implementing the national policy declared in section 1 regarding acid free permanent papers and shall report to the Congress regarding such progress on December 31, 1991, December 31, 1993, and December 31, 1995. In carrying out the monitoring and reporting functions under this section, the Librarian of Congress, the Archivist of the United States, and the Director of the Government Publishing Office may consult with the National Endowment for the Humanities, National Agricultural Library, National Library of Medicine, other Federal and State agencies, international organizations, private publishers, paper manufacturers, and other organizations with an interest in preservation of books and historical papers."
44 U.S.C. § 3551 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 35: COORDINATION OF FEDERAL INFORMATION POLICY / Subchapter II: INFORMATION SECURITY / Section 3551: Purposes
Purposes
Status: in_force

The purposes of this subchapter are to—

(1) provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets;

(2) recognize the highly networked nature of the current Federal computing environment and provide effective governmentwide management and oversight of the related information security risks, including coordination of information security efforts throughout the civilian, national security, and law enforcement communities;

(3) provide for development and maintenance of minimum controls required to protect Federal information and information systems;

(4) provide a mechanism for improved oversight of Federal agency information security programs, including through automated security tools to continuously diagnose and improve security;

(5) acknowledge that commercially developed information security products offer advanced, dynamic, robust, and effective information security solutions, reflecting market solutions for the protection of critical information infrastructures important to the national defense and economic security of the nation that are designed, built, and operated by the private sector; and

(6) recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products.

(Added Pub. L. 113–283, §2(a), Dec. 18, 2014, 128 Stat. 3073.)

Editorial Notes

Prior Provisions

Provisions similar to this section were contained in sections 3531 and 3541 of this title prior to repeal by Pub. L. 113–283.

Statutory Notes and Related Subsidiaries

Cybersecurity Improvements to Agency Information Systems

Pub. L. 114–4, title V, §547, Mar. 4, 2015, 129 Stat. 69, provided that:

"(a) Of the amounts made available by this Act [Pub. L. 114–4, see Tables for classification] for 'National Protection and Programs Directorate, Infrastructure Protection and Information Security', $140,525,000 for the Federal Network Security program, project, and activity shall be used to deploy on Federal systems technology to improve the information security of agency information systems covered by [former] section 3543(a) of title 44, United States Code [see now 44 U.S.C. 3553]: Provided, That funds made available under this section shall be used to assist and support Government-wide and agency-specific efforts to provide adequate, risk-based, and cost-effective cybersecurity to address escalating and rapidly evolving threats to information security, including the acquisition and operation of a continuous monitoring and diagnostics program, in collaboration with departments and agencies, that includes equipment, software, and Department of Homeland Security supplied services: Provided further, That continuous monitoring and diagnostics software procured by the funds made available by this section shall not transmit to the Department of Homeland Security any personally identifiable information or content of network communications of other agencies' users: Provided further, That such software shall be installed, maintained, and operated in accordance with all applicable privacy laws and agency-specific policies regarding network content.

"(b) Funds made available under this section may not be used to supplant funds provided for any such system within an agency budget.

"(c) Not later than July 1, 2015, the heads of all Federal agencies shall submit to the Committees on Appropriations of the Senate and the House of Representatives expenditure plans for necessary cybersecurity improvements to address known vulnerabilities to information systems described in subsection (a).

"(d) Not later than October 1, 2015, and semiannually thereafter, the head of each Federal agency shall submit to the Director of the Office of Management and Budget a report on the execution of the expenditure plan for that agency required by subsection (c): Provided, That the Director of the Office of Management and Budget shall summarize such execution reports and annually submit such summaries to Congress in conjunction with the annual progress report on implementation of the E-Government Act of 2002 (Public Law 107–347) [see Tables for classification], as required by section 3606 of title 44, United States Code.

"(e) This section shall not apply to the legislative and judicial branches of the Federal Government and shall apply to all Federal agencies within the executive branch except for the Department of Defense, the Central Intelligence Agency, and the Office of the Director of National Intelligence."

Similar provisions were contained in the following prior appropriation acts:

Pub. L. 113–76, div. F, title V, §554, Jan. 17, 2014, 128 Stat. 278.

Pub. L. 113–6, div. D, title V, §558, Mar. 26, 2013, 127 Stat. 377.

Executive Documents

Ex. Ord. No. 14028. Improving the Nation's Cybersecurity

Ex. Ord. No. 14028, May 12, 2021, 86 F.R. 26633, provided:

By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows:

Section 1. Policy. The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the American people's security and privacy. The Federal Government must improve its efforts to identify, deter, protect against, detect, and respond to these actions and actors. The Federal Government must also carefully examine what occurred during any major cyber incident and apply lessons learned. But cybersecurity requires more than government action. Protecting our Nation from malicious cyber actors requires the Federal Government to partner with the private sector. The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace. In the end, the trust we place in our digital infrastructure should be proportional to how trustworthy and transparent that infrastructure is, and to the consequences we will incur if that trust is misplaced.

Incremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes and significant investments in order to defend the vital institutions that underpin the American way of life. The Federal Government must bring to bear the full scope of its authorities and resources to protect and secure its computer systems, whether they are cloud-based, on-premises, or hybrid. The scope of protection and security must include systems that process data (information technology (IT)) and those that run the vital machinery that ensures our safety (operational technology (OT)).

It is the policy of my Administration that the prevention, detection, assessment, and remediation of cyber incidents is a top priority and essential to national and economic security. The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order.

Sec. 2. Removing Barriers to Sharing Threat Information. (a) The Federal Government contracts with IT and OT service providers to conduct an array of day-to-day functions on Federal Information Systems. These service providers, including cloud service providers, have unique access to and insight into cyber threat and incident information on Federal Information Systems. At the same time, current contract terms or restrictions may limit the sharing of such threat or incident information with executive departments and agencies (agencies) that are responsible for investigating or remediating cyber incidents, such as the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and other elements of the Intelligence Community (IC). Removing these contractual barriers and increasing the sharing of information about such threats, incidents, and risks are necessary steps to accelerating incident deterrence, prevention, and response efforts and to enabling more effective defense of agencies' systems and of information collected, processed, and maintained by or for the Federal Government.

(b) Within 60 days of the date of this order [May 12, 2021], the Director of the Office of Management and Budget (OMB), in consultation with the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence, shall review the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement contract requirements and language for contracting with IT and OT service providers and recommend updates to such requirements and language to the FAR Council and other appropriate agencies. The recommendations shall include descriptions of contractors to be covered by the proposed contract language.

(c) The recommended contract language and requirements described in subsection (b) of this section shall be designed to ensure that:

(i) service providers collect and preserve data, information, and reporting relevant to cybersecurity event prevention, detection, response, and investigation on all information systems over which they have control, including systems operated on behalf of agencies, consistent with agencies' requirements;

(ii) service providers share such data, information, and reporting, as they relate to cyber incidents or potential incidents relevant to any agency with which they have contracted, directly with such agency and any other agency that the Director of OMB, in consultation with the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence, deems appropriate, consistent with applicable privacy laws, regulations, and policies;

(iii) service providers collaborate with Federal cybersecurity or investigative agencies in their investigations of and responses to incidents or potential incidents on Federal Information Systems, including by implementing technical capabilities, such as monitoring networks for threats in collaboration with agencies they support, as needed; and

(iv) service providers share cyber threat and incident information with agencies, doing so, where possible, in industry-recognized formats for incident response and remediation.

(d) Within 90 days of receipt of the recommendations described in subsection (b) of this section, the FAR Council shall review the proposed contract language and conditions and, as appropriate, shall publish for public comment proposed updates to the FAR.

(e) Within 120 days of the date of this order, the Secretary of Homeland Security and the Director of OMB shall take appropriate steps to ensure to the greatest extent possible that service providers share data with agencies, CISA, and the FBI as may be necessary for the Federal Government to respond to cyber threats, incidents, and risks.

(f) It is the policy of the Federal Government that:

(i) information and communications technology (ICT) service providers entering into contracts with agencies must promptly report to such agencies when they discover a cyber incident involving a software product or service provided to such agencies or involving a support system for a software product or service provided to such agencies;

(ii) ICT service providers must also directly report to CISA whenever they report under subsection (f)(i) of this section to Federal Civilian Executive Branch (FCEB) Agencies, and CISA must centrally collect and manage such information; and

(iii) reports pertaining to National Security Systems, as defined in section 10(h) of this order, must be received and managed by the appropriate agency as to be determined under subsection (g)(i)(E) of this section.

(g) To implement the policy set forth in subsection (f) of this section:

(i) Within 45 days of the date of this order, the Secretary of Homeland Security, in consultation with the Secretary of Defense acting through the Director of the National Security Agency (NSA), the Attorney General, and the Director of OMB, shall recommend to the FAR Council contract language that identifies:

(A) the nature of cyber incidents that require reporting;

(B) the types of information regarding cyber incidents that require reporting to facilitate effective cyber incident response and remediation;

(C) appropriate and effective protections for privacy and civil liberties;

(D) the time periods within which contractors must report cyber incidents based on a graduated scale of severity, with reporting on the most severe cyber incidents not to exceed 3 days after initial detection;

(E) National Security Systems reporting requirements; and

(F) the type of contractors and associated service providers to be covered by the proposed contract language.

(ii) Within 90 days of receipt of the recommendations described in subsection (g)(i) of this section, the FAR Council shall review the recommendations and publish for public comment proposed updates to the FAR.

(iii) Within 90 days of the date of this order, the Secretary of Defense acting through the Director of the NSA, the Attorney General, the Secretary of Homeland Security, and the Director of National Intelligence shall jointly develop procedures for ensuring that cyber incident reports are promptly and appropriately shared among agencies.

(h) Current cybersecurity requirements for unclassified system contracts are largely implemented through agency-specific policies and regulations, including cloud-service cybersecurity requirements. Standardizing common cybersecurity contractual requirements across agencies will streamline and improve compliance for vendors and the Federal Government.

(i) Within 60 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA, in consultation with the Secretary of Defense acting through the Director of the NSA, the Director of OMB, and the Administrator of General Services, shall review agency-specific cybersecurity requirements that currently exist as a matter of law, policy, or contract and recommend to the FAR Council standardized contract language for appropriate cybersecurity requirements. Such recommendations shall include consideration of the scope of contractors and associated service providers to be covered by the proposed contract language.

(j) Within 60 days of receiving the recommended contract language developed pursuant to subsection (i) of this section, the FAR Council shall review the recommended contract language and publish for public comment proposed updates to the FAR.

(k) Following any updates to the FAR made by the FAR Council after the public comment period described in subsection (j) of this section, agencies shall update their agency-specific cybersecurity requirements to remove any requirements that are duplicative of such FAR updates.

(l) The Director of OMB shall incorporate into the annual budget process a cost analysis of all recommendations developed under this section.

Sec. 3. Modernizing Federal Government Cybersecurity. (a) To keep pace with today's dynamic and increasingly sophisticated cyber threat environment, the Federal Government must take decisive steps to modernize its approach to cybersecurity, including by increasing the Federal Government's visibility into threats, while protecting privacy and civil liberties. The Federal Government must adopt security best practices; advance toward Zero Trust Architecture; accelerate movement to secure cloud services, including Software as a Service (SaaS), Infrastructure as a Service (IaaS), and Platform as a Service (PaaS); centralize and streamline access to cybersecurity data to drive analytics for identifying and managing cybersecurity risks; and invest in both technology and personnel to match these modernization goals.

(b) Within 60 days of the date of this order, the head of each agency shall:

(i) update existing agency plans to prioritize resources for the adoption and use of cloud technology as outlined in relevant OMB guidance;

(ii) develop a plan to implement Zero Trust Architecture, which shall incorporate, as appropriate, the migration steps that the National Institute of Standards and Technology (NIST) within the Department of Commerce has outlined in standards and guidance, describe any such steps that have already been completed, identify activities that will have the most immediate security impact, and include a schedule to implement them; and

(iii) provide a report to the Director of OMB and the Assistant to the President and National Security Advisor (APNSA) discussing the plans required pursuant to subsection (b)(i) and (ii) of this section.

(c) As agencies continue to use cloud technology, they shall do so in a coordinated, deliberate way that allows the Federal Government to prevent, detect, assess, and remediate cyber incidents. To facilitate this approach, the migration to cloud technology shall adopt Zero Trust Architecture, as practicable. The CISA shall modernize its current cybersecurity programs, services, and capabilities to be fully functional with cloud-computing environments with Zero Trust Architecture. The Secretary of Homeland Security acting through the Director of CISA, in consultation with the Administrator of General Services acting through the Federal Risk and Authorization Management Program (FedRAMP) within the General Services Administration, shall develop security principles governing Cloud Service Providers (CSPs) for incorporation into agency modernization efforts. To facilitate this work:

(i) Within 90 days of the date of this order, the Director of OMB, in consultation with the Secretary of Homeland Security acting through the Director of CISA, and the Administrator of General Services acting through FedRAMP, shall develop a Federal cloud-security strategy and provide guidance to agencies accordingly. Such guidance shall seek to ensure that risks to the FCEB from using cloud-based services are broadly understood and effectively addressed, and that FCEB Agencies move closer to Zero Trust Architecture.

(ii) Within 90 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA, in consultation with the Director of OMB and the Administrator of General Services acting through FedRAMP, shall develop and issue, for the FCEB, cloud-security technical reference architecture documentation that illustrates recommended approaches to cloud migration and data protection for agency data collection and reporting.

(iii) Within 60 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA shall develop and issue, for FCEB Agencies, a cloud-service governance framework. That framework shall identify a range of services and protections available to agencies based on incident severity. That framework shall also identify data and processing activities associated with those services and protections.

(iv) Within 90 days of the date of this order, the heads of FCEB Agencies, in consultation with the Secretary of Homeland Security acting through the Director of CISA, shall evaluate the types and sensitivity of their respective agency's unclassified data, and shall provide to the Secretary of Homeland Security through the Director of CISA and to the Director of OMB a report based on such evaluation. The evaluation shall prioritize identification of the unclassified data considered by the agency to be the most sensitive and under the greatest threat, and appropriate processing and storage solutions for those data.

(d) Within 180 days of the date of this order, agencies shall adopt multi-factor authentication and encryption for data at rest and in transit, to the maximum extent consistent with Federal records laws and other applicable laws. To that end:

(i) Heads of FCEB Agencies shall provide reports to the Secretary of Homeland Security through the Director of CISA, the Director of OMB, and the APNSA on their respective agency's progress in adopting multifactor authentication and encryption of data at rest and in transit. Such agencies shall provide such reports every 60 days after the date of this order until the agency has fully adopted, agency-wide, multi-factor authentication and data encryption.

(ii) Based on identified gaps in agency implementation, CISA shall take all appropriate steps to maximize adoption by FCEB Agencies of technologies and processes to implement multifactor authentication and encryption for data at rest and in transit.

(iii) Heads of FCEB Agencies that are unable to fully adopt multi-factor authentication and data encryption within 180 days of the date of this order shall, at the end of the 180-day period, provide a written rationale to the Secretary of Homeland Security through the Director of CISA, the Director of OMB, and the APNSA.

(e) Within 90 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA, in consultation with the Attorney General, the Director of the FBI, and the Administrator of General Services acting through the Director of FedRAMP, shall establish a framework to collaborate on cybersecurity and incident response activities related to FCEB cloud technology, in order to ensure effective information sharing among agencies and between agencies and CSPs.

(f) Within 60 days of the date of this order, the Administrator of General Services, in consultation with the Director of OMB and the heads of other agencies as the Administrator of General Services deems appropriate, shall begin modernizing FedRAMP by:

(i) establishing a training program to ensure agencies are effectively trained and equipped to manage FedRAMP requests, and providing access to training materials, including videos-on-demand;

(ii) improving communication with CSPs through automation and standardization of messages at each stage of authorization. These communications may include status updates, requirements to complete a vendor's current stage, next steps, and points of contact for questions;

(iii) incorporating automation throughout the lifecycle of FedRAMP, including assessment, authorization, continuous monitoring, and compliance;

(iv) digitizing and streamlining documentation that vendors are required to complete, including through online accessibility and pre-populated forms; and

(v) identifying relevant compliance frameworks, mapping those frameworks onto requirements in the FedRAMP authorization process, and allowing those frameworks to be used as a substitute for the relevant portion of the authorization process, as appropriate.

Sec. 4. Enhancing Software Supply Chain Security. (a) The security of software used by the Federal Government is vital to the Federal Government's ability to perform its critical functions. The development of commercial software often lacks transparency, sufficient focus on the ability of the software to resist attack, and adequate controls to prevent tampering by malicious actors. There is a pressing need to implement more rigorous and predictable mechanisms for ensuring that products function securely, and as intended. The security and integrity of "critical software"—software that performs functions critical to trust (such as affording or requiring elevated system privileges or direct access to networking and computing resources)—is a particular concern. Accordingly, the Federal Government must take action to rapidly improve the security and integrity of the software supply chain, with a priority on addressing critical software.

(b) Within 30 days of the date of this order, the Secretary of Commerce acting through the Director of NIST shall solicit input from the Federal Government, private sector, academia, and other appropriate actors to identify existing or develop new standards, tools, and best practices for complying with the standards, procedures, or criteria in subsection (e) of this section. The guidelines shall include criteria that can be used to evaluate software security, include criteria to evaluate the security practices of the developers and suppliers themselves, and identify innovative tools or methods to demonstrate conformance with secure practices.

(c) Within 180 days of the date of this order, the Director of NIST shall publish preliminary guidelines, based on the consultations described in subsection (b) of this section and drawing on existing documents as practicable, for enhancing software supply chain security and meeting the requirements of this section.

(d) Within 360 days of the date of this order, the Director of NIST shall publish additional guidelines that include procedures for periodic review and updating of the guidelines described in subsection (c) of this section.

(e) Within 90 days of publication of the preliminary guidelines pursuant to subsection (c) of this section, the Secretary of Commerce acting through the Director of NIST, in consultation with the heads of such agencies as the Director of NIST deems appropriate, shall issue guidance identifying practices that enhance the security of the software supply chain. Such guidance may incorporate the guidelines published pursuant to subsections (c) and (i) of this section. Such guidance shall include standards, procedures, or criteria regarding:

(i) secure software development environments, including such actions as:

(A) using administratively separate build environments;

(B) auditing trust relationships;

(C) establishing multi-factor, risk-based authentication and conditional access across the enterprise;

(D) documenting and minimizing dependencies on enterprise products that are part of the environments used to develop, build, and edit software;

(E) employing encryption for data; and

(F) monitoring operations and alerts and responding to attempted and actual cyber incidents;

(ii) generating and, when requested by a purchaser, providing artifacts that demonstrate conformance to the processes set forth in subsection (e)(i) of this section;

(iii) employing automated tools, or comparable processes, to maintain trusted source code supply chains, thereby ensuring the integrity of the code;

(iv) employing automated tools, or comparable processes, that check for known and potential vulnerabilities and remediate them, which shall operate regularly, or at a minimum prior to product, version, or update release;

(v) providing, when requested by a purchaser, artifacts of the execution of the tools and processes described in subsection (e)(iii) and (iv) of this section, and making publicly available summary information on completion of these actions, to include a summary description of the risks assessed and mitigated;

(vi) maintaining accurate and up-to-date data, provenance (i.e., origin) of software code or components, and controls on internal and third-party software components, tools, and services present in software development processes, and performing audits and enforcement of these controls on a recurring basis;

(vii) providing a purchaser a Software Bill of Materials (SBOM) for each product directly or by publishing it on a public website;

(viii) participating in a vulnerability disclosure program that includes a reporting and disclosure process;

(ix) attesting to conformity with secure software development practices; and

(x) ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software used within any portion of a product.

(f) Within 60 days of the date of this order, the Secretary of Commerce, in coordination with the Assistant Secretary for Communications and Information and the Administrator of the National Telecommunications and Information Administration, shall publish minimum elements for an SBOM.

(g) Within 45 days of the date of this order, the Secretary of Commerce, acting through the Director of NIST, in consultation with the Secretary of Defense acting through the Director of the NSA, the Secretary of Homeland Security acting through the Director of CISA, the Director of OMB, and the Director of National Intelligence, shall publish a definition of the term "critical software" for inclusion in the guidance issued pursuant to subsection (e) of this section. That definition shall reflect the level of privilege or access required to function, integration and dependencies with other software, direct access to networking and computing resources, performance of a function critical to trust, and potential for harm if compromised.

(h) Within 30 days of the publication of the definition required by subsection (g) of this section, the Secretary of Homeland Security acting through the Director of CISA, in consultation with the Secretary of Commerce acting through the Director of NIST, shall identify and make available to agencies a list of categories of software and software products in use or in the acquisition process meeting the definition of critical software issued pursuant to subsection (g) of this section.

(i) Within 60 days of the date of this order, the Secretary of Commerce acting through the Director of NIST, in consultation with the Secretary of Homeland Security acting through the Director of CISA and with the Director of OMB, shall publish guidance outlining security measures for critical software as defined in subsection (g) of this section, including applying practices of least privilege, network segmentation, and proper configuration.

(j) Within 30 days of the issuance of the guidance described in subsection (i) of this section, the Director of OMB acting through the Administrator of the Office of Electronic Government within OMB shall take appropriate steps to require that agencies comply with such guidance.

(k) Within 30 days of issuance of the guidance described in subsection (e) of this section, the Director of OMB acting through the Administrator of the Office of Electronic Government within OMB shall take appropriate steps to require that agencies comply with such guidelines with respect to software procured after the date of this order.

(l) Agencies may request an extension for complying with any requirements issued pursuant to subsection (k) of this section. Any such request shall be considered by the Director of OMB on a case-by-case basis, and only if accompanied by a plan for meeting the underlying requirements. The Director of OMB shall on a quarterly basis provide a report to the APNSA identifying and explaining all extensions granted.

(m) Agencies may request a waiver as to any requirements issued pursuant to subsection (k) of this section. Waivers shall be considered by the Director of OMB, in consultation with the APNSA, on a case-by-case basis, and shall be granted only in exceptional circumstances and for limited duration, and only if there is an accompanying plan for mitigating any potential risks.

(n) Within 1 year of the date of this order, the Secretary of Homeland Security, in consultation with the Secretary of Defense, the Attorney General, the Director of OMB, and the Administrator of the Office of Electronic Government within OMB, shall recommend to the FAR Council contract language requiring suppliers of software available for purchase by agencies to comply with, and attest to complying with, any requirements issued pursuant to subsections (g) through (k) of this section.

(o) After receiving the recommendations described in subsection (n) of this section, the FAR Council shall review the recommendations and, as appropriate and consistent with applicable law, amend the FAR.

(p) Following the issuance of any final rule amending the FAR as described in subsection (o) of this section, agencies shall, as appropriate and consistent with applicable law, remove software products that do not meet the requirements of the amended FAR from all indefinite delivery indefinite quantity contracts; Federal Supply Schedules; Federal Government-wide Acquisition Contracts; Blanket Purchase Agreements; and Multiple Award Contracts.

(q) The Director of OMB, acting through the Administrator of the Office of Electronic Government within OMB, shall require agencies employing software developed and procured prior to the date of this order (legacy software) either to comply with any requirements issued pursuant to subsection (k) of this section or to provide a plan outlining actions to remediate or meet those requirements, and shall further require agencies seeking renewals of software contracts, including legacy software, to comply with any requirements issued pursuant to subsection (k) of this section, unless an extension or waiver is granted in accordance with subsection (l) or (m) of this section.

(r) Within 60 days of the date of this order, the Secretary of Commerce acting through the Director of NIST, in consultation with the Secretary of Defense acting through the Director of the NSA, shall publish guidelines recommending minimum standards for vendors' testing of their software source code, including identifying recommended types of manual or automated testing (such as code review tools, static and dynamic analysis, software composition tools, and penetration testing).

(s) The Secretary of Commerce acting through the Director of NIST, in coordination with representatives of other agencies as the Director of NIST deems appropriate, shall initiate pilot programs informed by existing consumer product labeling programs to educate the public on the security capabilities of internet-of-Things (IoT) devices and software development practices, and shall consider ways to incentivize manufacturers and developers to participate in these programs.

(t) Within 270 days of the date of this order, the Secretary of Commerce acting through the Director of NIST, in coordination with the Chair of the Federal Trade Commission (FTC) and representatives of other agencies as the Director of NIST deems appropriate, shall identify IoT cybersecurity criteria for a consumer labeling program, and shall consider whether such a consumer labeling program may be operated in conjunction with or modeled after any similar existing government programs consistent with applicable law. The criteria shall reflect increasingly comprehensive levels of testing and assessment that a product may have undergone, and shall use or be compatible with existing labeling schemes that manufacturers use to inform consumers about the security of their products. The Director of NIST shall examine all relevant information, labeling, and incentive programs and employ best practices. This review shall focus on ease of use for consumers and a determination of what measures can be taken to maximize manufacturer participation.

(u) Within 270 days of the date of this order, the Secretary of Commerce acting through the Director of NIST, in coordination with the Chair of the FTC and representatives from other agencies as the Director of NIST deems appropriate, shall identify secure software development practices or criteria for a consumer software labeling program, and shall consider whether such a consumer software labeling program may be operated in conjunction with or modeled after any similar existing government programs, consistent with applicable law. The criteria shall reflect a baseline level of secure practices, and if practicable, shall reflect increasingly comprehensive levels of testing and assessment that a product may have undergone. The Director of NIST shall examine all relevant information, labeling, and incentive programs, employ best practices, and identify, modify, or develop a recommended label or, if practicable, a tiered software security rating system. This review shall focus on ease of use for consumers and a determination of what measures can be taken to maximize participation.

(v) These pilot programs shall be conducted in a manner consistent with OMB Circular A–119 and NIST Special Publication 2000–02 (Conformity Assessment Considerations for Federal Agencies).

(w) Within 1 year of the date of this order, the Director of NIST shall conduct a review of the pilot programs, consult with the private sector and relevant agencies to assess the effectiveness of the programs, determine what improvements can be made going forward, and submit a summary report to the APNSA.

(x) Within 1 year of the date of this order, the Secretary of Commerce, in consultation with the heads of other agencies as the Secretary of Commerce deems appropriate, shall provide to the President, through the APNSA, a report that reviews the progress made under this section and outlines additional steps needed to secure the software supply chain.

Sec. 5. Establishing a Cyber Safety Review Board. (a) The Secretary of Homeland Security, in consultation with the Attorney General, shall establish the Cyber Safety Review Board (Board), pursuant to section 871 of the Homeland Security Act of 2002 (6 U.S.C. 451).

(b) The Board shall review and assess, with respect to significant cyber incidents (as defined under Presidential Policy Directive 41 of July 26, 2016 (United States Cyber Incident Coordination) (PPD–41)) affecting FCEB Information Systems or non-Federal systems, threat activity, vulnerabilities, mitigation activities, and agency responses.

(c) The Secretary of Homeland Security shall convene the Board following a significant cyber incident triggering the establishment of a Cyber Unified Coordination Group (UCG) as provided by section V(B)(2) of PPD–41; at any time as directed by the President acting through the APNSA; or at any time the Secretary of Homeland Security deems necessary.

(d) The Board's initial review shall relate to the cyber activities that prompted the establishment of a UCG in December 2020, and the Board shall, within 90 days of the Board's establishment, provide recommendations to the Secretary of Homeland Security for improving cybersecurity and incident response practices, as outlined in subsection (i) of this section.

(e) The Board's membership shall include Federal officials and representatives from private-sector entities. The Board shall comprise representatives of the Department of Defense, the Department of Justice, CISA, the NSA, and the FBI, as well as representatives from appropriate private-sector cybersecurity or software suppliers as determined by the Secretary of Homeland Security. A representative from OMB shall participate in Board activities when an incident under review involves FCEB Information Systems, as determined by the Secretary of Homeland Security. The Secretary of Homeland Security may invite the participation of others on a case-by-case basis depending on the nature of the incident under review.

(f) The Secretary of Homeland Security shall biennially designate a Chair and Deputy Chair of the Board from among the members of the Board, to include one Federal and one private-sector member.

(g) The Board shall protect sensitive law enforcement, operational, business, and other confidential information that has been shared with it, consistent with applicable law.

(h) The Secretary of Homeland Security shall provide to the President through the APNSA any advice, information, or recommendations of the Board for improving cybersecurity and incident response practices and policy upon completion of its review of an applicable incident.

(i) Within 30 days of completion of the initial review described in subsection (d) of this section, the Secretary of Homeland Security shall provide to the President through the APNSA the recommendations of the Board based on the initial review. These recommendations shall describe:

(i) identified gaps in, and options for, the Board's composition or authorities;

(ii) the Board's proposed mission, scope, and responsibilities;

(iii) membership eligibility criteria for private-sector representatives;

(iv) Board governance structure including interaction with the executive branch and the Executive Office of the President;

(v) thresholds and criteria for the types of cyber incidents to be evaluated;

(vi) sources of information that should be made available to the Board, consistent with applicable law and policy;

(vii) an approach for protecting the information provided to the Board and securing the cooperation of affected United States individuals and entities for the purpose of the Board's review of incidents; and

(viii) administrative and budgetary considerations required for operation of the Board.

(j) The Secretary of Homeland Security, in consultation with the Attorney General and the APNSA, shall review the recommendations provided to the President through the APNSA pursuant to subsection (i) of this section and take steps to implement them as appropriate.

(k) Unless otherwise directed by the President, the Secretary of Homeland Security shall extend the life of the Board every 2 years as the Secretary of Homeland Security deems appropriate, pursuant to section 871 of the Homeland Security Act of 2002.

Sec. 6. Standardizing the Federal Government's Playbook for Responding to Cybersecurity Vulnerabilities and Incidents. (a) The cybersecurity vulnerability and incident response procedures currently used to identify, remediate, and recover from vulnerabilities and incidents affecting their systems vary across agencies, hindering the ability of lead agencies to analyze vulnerabilities and incidents more comprehensively across agencies. Standardized response processes ensure a more coordinated and centralized cataloging of incidents and tracking of agencies' progress toward successful responses.

(b) Within 120 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA, in consultation with the Director of OMB, the Federal Chief Information Officers Council, and the Federal Chief Information Security Council, and in coordination with the Secretary of Defense acting through the Director of the NSA, the Attorney General, and the Director of National Intelligence, shall develop a standard set of operational procedures (playbook) to be used in planning and conducting a cybersecurity vulnerability and incident response activity respecting FCEB Information Systems. The playbook shall:

(i) incorporate all appropriate NIST standards;

(ii) be used by FCEB Agencies; and

(iii) articulate progress and completion through all phases of an incident response, while allowing flexibility so it may be used in support of various response activities.

(c) The Director of OMB shall issue guidance on agency use of the playbook.

(d) Agencies with cybersecurity vulnerability or incident response procedures that deviate from the playbook may use such procedures only after consulting with the Director of OMB and the APNSA and demonstrating that these procedures meet or exceed the standards proposed in the playbook.

(e) The Director of CISA, in consultation with the Director of the NSA, shall review and update the playbook annually, and provide information to the Director of OMB for incorporation in guidance updates.

(f) To ensure comprehensiveness of incident response activities and build confidence that unauthorized cyber actors no longer have access to FCEB Information Systems, the playbook shall establish, consistent with applicable law, a requirement that the Director of CISA review and validate FCEB Agencies' incident response and remediation results upon an agency's completion of its incident response. The Director of CISA may recommend use of another agency or a third-party incident response team as appropriate.

(g) To ensure a common understanding of cyber incidents and the cybersecurity status of an agency, the playbook shall define key terms and use such terms consistently with any statutory definitions of those terms, to the extent practicable, thereby providing a shared lexicon among agencies using the playbook.

Sec. 7. Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Networks. (a) The Federal Government shall employ all appropriate resources and authorities to maximize the early detection of cybersecurity vulnerabilities and incidents on its networks. This approach shall include increasing the Federal Government's visibility into and detection of cybersecurity vulnerabilities and threats to agency networks in order to bolster the Federal Government's cybersecurity efforts.

(b) FCEB Agencies shall deploy an Endpoint Detection and Response (EDR) initiative to support proactive detection of cybersecurity incidents within Federal Government infrastructure, active cyber hunting, containment and remediation, and incident response.

(c) Within 30 days of the date of this order, the Secretary of Homeland Security acting through the Director of CISA shall provide to the Director of OMB recommendations on options for implementing an EDR initiative, centrally located to support host-level visibility, attribution, and response regarding FCEB Information Systems.

(d) Within 90 days of receiving the recommendations described in subsection (c) of this section, the Director of OMB, in consultation with Secretary of Homeland Security, shall issue requirements for FCEB Agencies to adopt Federal Government-wide EDR approaches. Those requirements shall support a capability of the Secretary of Homeland Secretary, acting through the Director of CISA, to engage in cyber hunt, detection, and response activities.

(e) The Director of OMB shall work with the Secretary of Homeland Security and agency heads to ensure that agencies have adequate resources to comply with the requirements issued pursuant to subsection (d) of this section.

(f) Defending FCEB Information Systems requires that the Secretary of Homeland Security acting through the Director of CISA have access to agency data that are relevant to a threat and vulnerability analysis, as well as for assessment and threat-hunting purposes. Within 75 days of the date of this order, agencies shall establish or update Memoranda of Agreement (MOA) with CISA for the Continuous Diagnostics and Mitigation Program to ensure object level data, as defined in the MOA, are available and accessible to CISA, consistent with applicable law.

(g) Within 45 days of the date of this order, the Director of the NSA as the National Manager for National Security Systems (National Manager) shall recommend to the Secretary of Defense, the Director of National Intelligence, and the Committee on National Security Systems (CNSS) appropriate actions for improving detection of cyber incidents affecting National Security Systems, to the extent permitted by applicable law, including recommendations concerning EDR approaches and whether such measures should be operated by agencies or through a centralized service of common concern provided by the National Manager.

(h) Within 90 days of the date of this order, the Secretary of Defense, the Director of National Intelligence, and the CNSS shall review the recommendations submitted under subsection (g) of this section and, as appropriate, establish policies that effectuate those recommendations, consistent with applicable law.

(i) Within 90 days of the date of this order, the Director of CISA shall provide to the Director of OMB and the APNSA a report describing how authorities granted under section 1705 of Public Law 116–283 [amending 44 U.S.C. 3553], to conduct threat-hunting activities on FCEB networks without prior authorization from agencies, are being implemented. This report shall also recommend procedures to ensure that mission-critical systems are not disrupted, procedures for notifying system owners of vulnerable government systems, and the range of techniques that can be used during testing of FCEB Information Systems. The Director of CISA shall provide quarterly reports to the APNSA and the Director of OMB regarding actions taken under section 1705 of Public Law 116–283.

(j) To ensure alignment between Department of Defense Information Network (DODIN) directives and FCEB Information Systems directives, the Secretary of Defense and the Secretary of Homeland Security, in consultation with the Director of OMB, shall:

(i) within 60 days of the date of this order, establish procedures for the Department of Defense and the Department of Homeland Security to immediately share with each other Department of Defense Incident Response Orders or Department of Homeland Security Emergency Directives and Binding Operational Directives applying to their respective information networks;

(ii) evaluate whether to adopt any guidance contained in an Order or Directive issued by the other Department, consistent with regulations concerning sharing of classified information; and

(iii) within 7 days of receiving notice of an Order or Directive issued pursuant to the procedures established under subsection (j)(i) of this section, notify the APNSA and Administrator of the Office of Electronic Government within OMB of the evaluation described in subsection (j)(ii) of this section, including a determination whether to adopt guidance issued by the other Department, the rationale for that determination, and a timeline for application of the directive, if applicable.

Sec. 8. Improving the Federal Government's Investigative and Remediation Capabilities. (a) Information from network and system logs on Federal Information Systems (for both on-premises systems and connections hosted by third parties, such as CSPs) is invaluable for both investigation and remediation purposes. It is essential that agencies and their IT service providers collect and maintain such data and, when necessary to address a cyber incident on FCEB Information Systems, provide them upon request to the Secretary of Homeland Security through the Director of CISA and to the FBI, consistent with applicable law.

(b) Within 14 days of the date of this order, the Secretary of Homeland Security, in consultation with the Attorney General and the Administrator of the Office of Electronic Government within OMB, shall provide to the Director of OMB recommendations on requirements for logging events and retaining other relevant data within an agency's systems and networks. Such recommendations shall include the types of logs to be maintained, the time periods to retain the logs and other relevant data, the time periods for agencies to enable recommended logging and security requirements, and how to protect logs. Logs shall be protected by cryptographic methods to ensure integrity once collected and periodically verified against the hashes throughout their retention. Data shall be retained in a manner consistent with all applicable privacy laws and regulations. Such recommendations shall also be considered by the FAR Council when promulgating rules pursuant to section 2 of this order.

(c) Within 90 days of receiving the recommendations described in subsection (b) of this section, the Director of OMB, in consultation with the Secretary of Commerce and the Secretary of Homeland Security, shall formulate policies for agencies to establish requirements for logging, log retention, and log management, which shall ensure centralized access and visibility for the highest level security operations center of each agency.

(d) The Director of OMB shall work with agency heads to ensure that agencies have adequate resources to comply with the requirements identified in subsection (c) of this section.

(e) To address cyber risks or incidents, including potential cyber risks or incidents, the proposed recommendations issued pursuant to subsection (b) of this section shall include requirements to ensure that, upon request, agencies provide logs to the Secretary of Homeland Security through the Director of CISA and to the FBI, consistent with applicable law. These requirements should be designed to permit agencies to share log information, as needed and appropriate, with other Federal agencies for cyber risks or incidents.

Sec. 9. National Security Systems. (a) Within 60 days of the date of this order, the Secretary of Defense acting through the National Manager, in coordination with the Director of National Intelligence and the CNSS, and in consultation with the APNSA, shall adopt National Security Systems requirements that are equivalent to or exceed the cybersecurity requirements set forth in this order that are otherwise not applicable to National Security Systems. Such requirements may provide for exceptions in circumstances necessitated by unique mission needs. Such requirements shall be codified in a National Security Memorandum (NSM). Until such time as that NSM is issued, programs, standards, or requirements established pursuant to this order shall not apply with respect to National Security Systems.

(b) Nothing in this order shall alter the authority of the National Manager with respect to National Security Systems as defined in National Security Directive 42 of July 5, 1990 (National Policy for the Security of National Security Telecommunications and Information Systems) (NSD–42). The FCEB network shall continue to be within the authority of the Secretary of Homeland Security acting through the Director of CISA.

Sec. 10. Definitions. For purposes of this order:

(a) the term "agency" has the meaning ascribed to it under 44 U.S.C. 3502.

(b) the term "auditing trust relationship" means an agreed-upon relationship between two or more system elements that is governed by criteria for secure interaction, behavior, and outcomes relative to the protection of assets.

(c) the term "cyber incident" has the meaning ascribed to an "incident" under 44 U.S.C. 3552(b)(2).

(d) the term "Federal Civilian Executive Branch Agencies" or "FCEB Agencies" includes all agencies except for the Department of Defense and agencies in the Intelligence Community.

(e) the term "Federal Civilian Executive Branch Information Systems" or "FCEB Information Systems" means those information systems operated by Federal Civilian Executive Branch Agencies, but excludes National Security Systems.

(f) the term "Federal Information Systems" means an information system used or operated by an agency or by a contractor of an agency or by another organization on behalf of an agency, including FCEB Information Systems and National Security Systems.

(g) the term "Intelligence Community" or "IC" has the meaning ascribed to it under 50 U.S.C. 3003(4).

(h) the term "National Security Systems" means information systems as defined in 44 U.S.C. 3552(b)(6), 3553(e)(2), and 3553(e)(3).

(i) the term "logs" means records of the events occurring within an organization's systems and networks. Logs are composed of log entries, and each entry contains information related to a specific event that has occurred within a system or network.

(j) the term "Software Bill of Materials" or "SBOM" means a formal record containing the details and supply chain relationships of various components used in building software. Software developers and vendors often create products by assembling existing open source and commercial software components. The SBOM enumerates these components in a product. It is analogous to a list of ingredients on food packaging. An SBOM is useful to those who develop or manufacture software, those who select or purchase software, and those who operate software. Developers often use available open source and third-party software components to create a product; an SBOM allows the builder to make sure those components are up to date and to respond quickly to new vulnerabilities. Buyers can use an SBOM to perform vulnerability or license analysis, both of which can be used to evaluate risk in a product. Those who operate software can use SBOMs to quickly and easily determine whether they are at potential risk of a newly discovered vulnerability. A widely used, machine-readable SBOM format allows for greater benefits through automation and tool integration. The SBOMs gain greater value when collectively stored in a repository that can be easily queried by other applications and systems. Understanding the supply chain of software, obtaining an SBOM, and using it to analyze known vulnerabilities are crucial in managing risk.

(k) the term "Zero Trust Architecture" means a security model, a set of system design principles, and a coordinated cybersecurity and system management strategy based on an acknowledgement that threats exist both inside and outside traditional network boundaries. The Zero Trust security model eliminates implicit trust in any one element, node, or service and instead requires continuous verification of the operational picture via real-time information from multiple sources to determine access and other system responses. In essence, a Zero Trust Architecture allows users full access but only to the bare minimum they need to perform their jobs. If a device is compromised, zero trust can ensure that the damage is contained. The Zero Trust Architecture security model assumes that a breach is inevitable or has likely already occurred, so it constantly limits access to only what is needed and looks for anomalous or malicious activity. Zero Trust Architecture embeds comprehensive security monitoring; granular risk-based access controls; and system security automation in a coordinated manner throughout all aspects of the infrastructure in order to focus on protecting data in real-time within a dynamic threat environment. This data-centric security model allows the concept of least-privileged access to be applied for every access decision, where the answers to the questions of who, what, when, where, and how are critical for appropriately allowing or denying access to resources based on the combination of sever.

Sec. 11. General Provisions. (a) Upon the appointment of the National Cyber Director (NCD) and the establishment of the related Office within the Executive Office of the President, pursuant to section 1752 of Public Law 116–283 [enacting 6 U.S.C. 1500], portions of this order may be modified to enable the NCD to fully execute its duties and responsibilities.

(b) Nothing in this order shall be construed to impair or otherwise affect:

(i) the authority granted by law to an executive department or agency, or the head thereof; or

(ii) the functions of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals.

(c) This order shall be implemented in a manner consistent with applicable law and subject to the availability of appropriations.

(d) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.

(e) Nothing in this order confers authority to interfere with or to direct a criminal or national security investigation, arrest, search, seizure, or disruption operation or to alter a legal restriction that requires an agency to protect information learned in the course of a criminal or national security investigation.

J.R. Biden, Jr.
44 U.S.C. § 1507 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 15: FEDERAL REGISTER AND CODE OF FEDERAL REGULATIONS / Section 1507: Filing document as constructive notice; publication in Federal Register as presumption of validity; judicial notice; citation
Filing document as constructive notice; publication in Federal Register as presumption of validity; judicial notice; citation
Status: in_force

A document required by section 1505(a) of this title to be published in the Federal Register is not valid as against a person who has not had actual knowledge of it until the document has been filed with the Office of the Federal Register and a copy made available for public inspection as provided by section 1503 of this title. Unless otherwise specifically provided by statute, filing of a document, required or authorized to be published by section 1505 of this title, except in cases where notice by publication is insufficient in law, is sufficient to give notice of the contents of the document to a person subject to or affected by it. The publication in the Federal Register of a document creates a rebuttable presumption—

(1) that it was duly issued, prescribed, or promulgated;

(2) that it was filed with the Office of the Federal Register and made available for public inspection at the day and hour stated in the published notation;

(3) that the copy contained in the Federal Register is a true copy of the original; and

(4) that all requirements of this chapter and the regulations prescribed under it relative to the document have been complied with.

The contents of the Federal Register shall be judicially noticed and without prejudice to any other mode of citation, may be cited by volume and page number.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1276; Pub. L. 118–267, §2(a)(2), Jan. 4, 2025, 138 Stat. 2983.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §307 (July 26, 1935, ch. 417, §7, 49 Stat. 502).

Editorial Notes

Amendments

2025—Pub. L. 118–267, §2(a)(2)(A), substituted "the document has been filed" for "the duplicate originals or certified copies of the document have been filed" in introductory provisions.

Par. (2). Pub. L. 118–267, §2(a)(2)(B), substituted "published" for "printed".
44 U.S.C. § 1714 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 17: DISTRIBUTION AND SALE OF PUBLIC DOCUMENTS / Section 1714: Publications for use of National Archives and Records Administration
Publications for use of National Archives and Records Administration
Status: in_force

The Director of the Government Publishing Office shall print and deliver to the National Archives and Records Administration for use by the Archivist of the United States, including use by the Presidential Library established for the President during whose term the documents were issued, which shall be chargeable to Congress three copies each of the following publications:

House documents and public reports, bound;

Senate documents and public reports, bound;

Senate and House journals, bound;

United States Code and Supplements, bound;

United States Statutes at Large, bound;

the United States Reports, bound;

all other documents bearing a congressional number, or printed upon order of a committee in either House of Congress, or of a department, independent agency or establishment, commission, or officer of the Government, except confidential matter, blank forms, and circular letters not of a public character; and

public bills and resolutions in Congress in each parliamentary stage.

The Superintendent of Documents shall furnish, without cost, copies of publications available for free distribution.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1281; Pub. L. 98–497, title I, §107(b)(6), Oct. 19, 1984, 98 Stat. 2287; Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §215a (Jan. 12, 1895, ch. 23, §—, as added June 17, 1935, ch. 267, 49 Stat. 386, and amended June 30, 1949, ch. 288, title I, §104(a), 63 Stat. 381; Oct. 15, 1966, Pub. L. 89–678, 80 Stat. 956.)

Editorial Notes

Amendments

2014—Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer" in introductory provisions.

1984—Pub. L. 98–497 substituted "National Archives and Records Administration" for "General Services Administration" in section catchline and text.

Statutory Notes and Related Subsidiaries

Effective Date of 1984 Amendment

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of this title.
44 U.S.C. § 735 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 7: CONGRESSIONAL PRINTING AND BINDING / Section 735: Binding for Senators
Binding for Senators
Status: in_force

Each Senator is entitled to the binding in half morocco, or material not more expensive, of one copy of each public document to which he is entitled, an account of which shall be kept by the Secretary of the Senate.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1254; Pub. L. 104–186, title II, §223(4)(A), Aug. 20, 1996, 110 Stat. 1751.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §160 (Jan. 12, 1895, ch. 23, §2, 28 Stat. 601; Mar. 1, 1907, ch. 2284, §1, 34 Stat. 1013).

Editorial Notes

Amendments

1996—Pub. L. 104–186, in section catchline, substituted "Senators" for "Members of Congress", and in text, substituted "Senator" for "Member of Congress" and struck out "and Clerk of the House of Representatives, respectively" after "Secretary of the Senate".

Statutory Notes and Related Subsidiaries

Written Requests for Bound Copies of Documents

Pub. L. 94–59, title VIII, July 25, 1975, 89 Stat. 296, provided that: "Hereafter, notwithstanding any other provisions of law appropriations for the binding of copies of public documents by Committees for distribution to Senators and Representatives (including Delegates to Congress and the Resident Commissioner from Puerto Rico) shall not be available for a Senator or Representative unless such Senator or Representative specifically, in writing, requests that he receive bound copies of any such documents."
44 U.S.C. § 1509 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 15: FEDERAL REGISTER AND CODE OF FEDERAL REGULATIONS / Section 1509: Costs of publication, etc.
Costs of publication, etc.
Status: in_force

(a) The cost of publishing the Federal Register and the Code of Federal Regulations, and, except as provided in subsection (b), other expenses incurred by the Government Publishing Office in carrying out the duties placed upon it by this chapter shall be charged to the revolving fund provided in section 309. Reimbursements for such costs and expenses shall be made by the Federal agencies and credited, together with all receipts, as provided in section 309(b).

(b) The cost of publishing all other publications of the Federal Register program, and other expenses incurred by the Government Publishing Office in connection with such publications, shall be borne by the appropriations to the Government Publishing Office and the appropriations are made available, and are authorized to be increased by additional sums necessary for the purposes, the increases to be based upon estimates submitted by the Director of the Government Publishing Office.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1277; Pub. L. 95–94, title IV, §408(a)(1), Aug. 5, 1977, 91 Stat. 683; Pub. L. 113–235, div. H, title I, §1301(b), (c)(1), Dec. 16, 2014, 128 Stat. 2537; Pub. L. 118–267, §2(a)(3), Jan. 4, 2025, 138 Stat. 2983.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §309 (July 26, 1935, ch. 417, §9, 49 Stat. 502).

A reference to section 10 of Act June 19, 1934 is deleted because of the repeal of that section by Act June 30, 1949.

Editorial Notes

Amendments

2025—Pub. L. 118–267 substituted "publishing" for "printing, reprinting, wrapping, binding, and distributing" in two places.

2014—Subsec. (b). Pub. L. 113–235, §1301(c)(1), substituted "Director of the Government Publishing Office" for "Public Printer".

1977—Pub. L. 95–94 substituted "Costs of publication, etc." for "Cost of publication; appropriations authorized; penalty mail privilege" in section catchline, added subsec. (a), designated former first paragraph as subsec. (b) and inserted provision restricting coverage to the other publications of the Federal Register program and struck out provision requiring payments for the Federal Register to be covered into the Treasury as miscellaneous receipts and former second paragraph relating to penalty mail privileges for the Federal Register.

Statutory Notes and Related Subsidiaries

Change of Name

"Government Publishing Office" substituted for "Government Printing Office" wherever appearing in text on authority of section 1301(b) of Pub. L. 113–235, set out as a note preceding section 301 of this title.

Effective Date of 1977 Amendment

Pub. L. 95–94, title IV, §408(b), Aug. 5, 1977, 91 Stat. 683, provided that: "The amendments made by subsection (a) [amending this section] shall take effect on October 1, 1977."
44 U.S.C. § 2307 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 23: NATIONAL ARCHIVES TRUST FUND BOARD / Section 2307: Trust fund account; disbursements; sales of publications and releases
Trust fund account; disbursements; sales of publications and releases
Status: in_force

The income from trust funds held by the Board and the proceeds from the sale of securities and other personal property, as and when collected, shall be covered into the Treasury of the United States in a trust fund account to be known as the National Archives Trust Fund, subject to disbursement on the basis of certified vouchers of the Archivist of the United States (or his designee) for activities approved by the Board and in the interest of the national archival and records activities administered by the National Archives and Records Administration, including but not restricted to the preparation and publication of special works, and collections of sources and the preparation, duplication, editing, and release of historical photographic materials and sound recordings. The Archivist may sell publications and releases authorized by this section and paid for out of the income derived from trust funds at a price which will cover their cost, plus 10 percent, and moneys received from these sales shall be paid into, administered, and expended as part of the National Archives Trust Fund.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1293; Pub. L. 98–497, title II, §202(b), Oct. 19, 1984, 98 Stat. 2294.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §300ee (July 9, 1941, ch. 284, §5, 55 Stat. 581).

Editorial Notes

Amendments

1984—Pub. L. 98–497 substituted "on the basis of certified vouchers of the Archivist of the United States (or his designee) for activities approved by the Board and in the interest of the national archival and records activities administered by the National Archives and Records Administration" for "by the Division of Disbursement, Treasury Department, on the basis of certified vouchers of the Chairman or his authorized agent, unless otherwise restricted by the instrument of gift or bequest, for and in the interest of the national archival and records activities administered by the General Services Administration" and "Archivist" for "Chairman" in second sentence.

Statutory Notes and Related Subsidiaries

Effective Date of 1984 Amendment

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of this title.

Executive Documents

Transfer of Functions

Division of Disbursement of Treasury Department consolidated into Fiscal Service of Treasury Department by section 1(a)(1) of Reorg. Plan No. III of 1940, eff. June 30, 1940, 5 F.R. 2107, 54 Stat. 1231, set out in the Appendix to Title 5, Government Organization and Employees. See section 306 of Title 31, Money and Finance.
44 U.S.C. § 738 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 7: CONGRESSIONAL PRINTING AND BINDING / Section 738: Binding of publications for distribution to libraries
Binding of publications for distribution to libraries
Status: in_force

The Director of the Government Publishing Office shall supply the Superintendent of Documents with sufficient copies of publications distributed in unbound form, to be bound and distributed to the State libraries and other designated depositories for their permanent files. Every publication of sufficient size on any one subject shall be bound separately and receive the title suggested by the subject of the volume, and the others shall be distributed in unbound form as soon as printed. The library edition, as well as all other bound sets of congressional numbered documents and reports, shall be arranged in volumes and bound in the manner directed by the Joint Committee on Printing.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1254; Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §143 (Jan. 15, 1908, No. 3, §2, 35 Stat. 566).

Editorial Notes

Amendments

2014—Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer".
44 U.S.C. § 3504 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 35: COORDINATION OF FEDERAL INFORMATION POLICY / Subchapter I: FEDERAL INFORMATION POLICY / Section 3504: Authority and functions of Director
Authority and functions of Director
Status: in_force

(a)(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—

(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and

(B) provide direction and oversee—

(i) the review and approval of the collection of information and the reduction of the information collection burden;

(ii) agency dissemination of and public access to information;

(iii) statistical activities;

(iv) records management activities;

(v) privacy, confidentiality, security, disclosure, and sharing of information; and

(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.

(2) The authority of the Director under this subchapter shall be exercised consistent with applicable law.

(b) With respect to general information resources management policy, the Director shall—

(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;

(2) foster greater sharing, dissemination, and access to public information, including through—

(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and

(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for security, interconnectivity and interoperability;

(3) initiate and review proposals for changes in legislation, regulations, and agency procedures to improve information resources management practices;

(4) oversee the development and implementation of best practices in information resources management, including training;

(5) oversee agency integration of program and management functions with information resources management functions; and

(6) issue guidance for agencies to implement section 3506(b)(6) in a manner that takes into account—

(A) risks and restrictions related to the disclosure of personally identifiable information, including the risk that an individual data asset in isolation does not pose a privacy or confidentiality risk but when combined with other available information may pose such a risk;

(B) security considerations, including the risk that information in an individual data asset in isolation does not pose a security risk but when combined with other available information may pose such a risk;

(C) the cost and benefits to the public of converting a data asset into a machine-readable format that is accessible and useful to the public;

(D) whether the application of the requirements described in such section to a data asset could result in legal liability;

(E) a determination of whether a data asset—

(i) is subject to intellectual property rights, including rights under titles 17 and 35;

(ii) contains confidential business information, that could be withheld under section 552(b)(4) of title 5; or

(iii) is otherwise restricted by contract or other binding, written agreement;

(F) the requirement that a data asset be disclosed, if it would otherwise be made available under section 552 of title 5 (commonly known as the "Freedom of Information Act"); and

(G) any other considerations that the Director determines to be relevant.

(c) With respect to the collection of information and the control of paperwork, the Director shall—

(1) review and approve proposed agency collections of information;

(2) coordinate the review of the collection of information associated with Federal procurement and acquisition by the Office of Information and Regulatory Affairs with the Office of Federal Procurement Policy, with particular emphasis on applying information technology to improve the efficiency and effectiveness of Federal procurement, acquisition and payment, and to reduce information collection burdens on the public;

(3) minimize the Federal information collection burden, with particular emphasis on those individuals and entities most adversely affected;

(4) maximize the practical utility of and public benefit from information collected by or for the Federal Government;

(5) establish and oversee standards and guidelines by which agencies are to estimate the burden to comply with a proposed collection of information; 1

(6) publish in the Federal Register and make available on the Internet (in consultation with the Small Business Administration) on an annual basis a list of the compliance assistance resources available to small businesses, with the first such publication occurring not later than 1 year after the date of enactment of the Small Business Paperwork Relief Act of 2002.

(d) With respect to information dissemination, the Director shall develop and oversee the implementation of policies, principles, standards, and guidelines to—

(1) apply to Federal agency dissemination of public information, regardless of the form or format in which such information is disseminated; and

(2) promote public access to public information and fulfill the purposes of this subchapter, including through the effective use of information technology.

(e) With respect to statistical policy and coordination, the Director shall—

(1) coordinate the activities of the Federal statistical system to ensure—

(A) the efficiency and effectiveness of the system; and

(B) the integrity, objectivity, impartiality, utility, and confidentiality of information collected for statistical purposes;

(2) ensure that budget proposals of agencies are consistent with system-wide priorities for maintaining and improving the quality of Federal statistics and prepare an annual report on statistical program funding;

(3) develop and oversee the implementation of Governmentwide policies, principles, standards, and guidelines concerning—

(A) statistical collection procedures and methods;

(B) statistical data classification;

(C) statistical information presentation and dissemination;

(D) timely release of statistical data; and

(E) such statistical data sources as may be required for the administration of Federal programs;

(4) evaluate statistical program performance and agency compliance with Governmentwide policies, principles, standards and guidelines;

(5) promote the sharing of information collected for statistical purposes consistent with privacy rights and confidentiality pledges;

(6) coordinate the participation of the United States in international statistical activities, including the development of comparable statistics;

(7) appoint a chief statistician who is a trained and experienced professional statistician to carry out the functions described under this subsection;

(8) establish an Interagency Council on Statistical Policy to advise and assist the Director in carrying out the functions under this subsection that shall—

(A) be headed by the chief statistician; and

(B) consist of—

(i) the heads of the major statistical programs; and

(ii) representatives of other statistical agencies under rotating membership;

(9) provide opportunities for training in statistical policy functions to employees of the Federal Government under which—

(A) each trainee shall be selected at the discretion of the Director based on agency requests and shall serve under the chief statistician for at least 6 months and not more than 1 year; and

(B) all costs of the training shall be paid by the agency requesting training; and

(10) ensure that any change to the standards of core-based statistical area (as defined in section 4 of the MAPS Act of 2021) delineations pursuant to this subsection shall—

(A) be accompanied by a public report that explains—

(i) the scientific basis, criteria, and methodology for such change to existing standards, including clear quantitative thresholds for determining any future statistical re-delineations; and

(ii) the opinions of domestic and international experts in statistics and demographics, including government experts at the Bureau of the Census and other relevant agencies, who were consulted regarding such change to existing standards;

(B) not be influenced by any non-statistical considerations such as impact on program administration or service delivery; and

(C) not propagate automatically for any non-statistical use by any domestic assistance program (as defined in section 4 of the MAPS Act of 2021).

(f) With respect to records management, the Director shall—

(1) provide advice and assistance to the Archivist of the United States and the Administrator of General Services to promote coordination in the administration of chapters 29, 31, and 33 of this title with the information resources management policies, principles, standards, and guidelines established under this subchapter;

(2) review compliance by agencies with—

(A) the requirements of chapters 29, 31, and 33 of this title; and

(B) regulations promulgated by the Archivist of the United States and the Administrator of General Services; and

(3) oversee the application of records management policies, principles, standards, and guidelines, including requirements for archiving information maintained in electronic format, in the planning and design of information systems.

(g) With respect to privacy and security, the Director shall—

(1) develop and oversee the implementation of policies, principles, standards, and guidelines on privacy, confidentiality, security, disclosure and sharing of information collected or maintained by or for agencies; and

(2) oversee and coordinate compliance with sections 552 and 552a of title 5, sections 20 and 21 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3 and 278g–4), section 11331 of title 40 and subchapter II of this chapter, and related information management laws.

(h) With respect to Federal information technology, the Director shall—

(1) in consultation with the Director of the National Institute of Standards and Technology and the Administrator of General Services—

(A) develop and oversee the implementation of policies, principles, standards, and guidelines for information technology functions and activities of the Federal Government, including periodic evaluations of major information systems; and

(B) oversee the development and implementation of standards under section 11331 of title 40; 2

(2) monitor the effectiveness of, and compliance with, directives issued under subtitle III of title 40 and directives issued under section 322 2 of title 40;

(3) coordinate the development and review by the Office of Information and Regulatory Affairs of policy associated with Federal procurement and acquisition of information technology with the Office of Federal Procurement Policy;

(4) ensure, through the review of agency budget proposals, information resources management plans and other means—

(A) agency integration of information resources management plans, program plans and budgets for acquisition and use of information technology; and

(B) the efficiency and effectiveness of inter-agency information technology initiatives to improve agency performance and the accomplishment of agency missions; and

(5) promote the use of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of Federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.

(Added Pub. L. 104–13, §2, May 22, 1995, 109 Stat. 167; amended Pub. L. 104–106, div. E, title LI, §5131(e)(1), title LVI, §5605(b), (c), Feb. 10, 1996, 110 Stat. 688, 700; Pub. L. 105–85, div. A, title X, §1073(h)(5)(B), (C), Nov. 18, 1997, 111 Stat. 1907; Pub. L. 105–277, div. C, title XVII, §1702, Oct. 21, 1998, 112 Stat. 2681–749; Pub. L. 106–398, §1 [[div. A], title X, §1064(b)], Oct. 30, 2000, 114 Stat. 1654, 1654A–275; Pub. L. 107–198, §2(a), June 28, 2002, 116 Stat. 729; Pub. L. 107–217, §3(l)(5), Aug. 21, 2002, 116 Stat. 1301; Pub. L. 107–296, title X, §1005(c)(1), Nov. 25, 2002, 116 Stat. 2272; Pub. L. 107–347, title III, §305(c)(1), Dec. 17, 2002, 116 Stat. 2960; Pub. L. 115–435, title II, §202(b), (d)(2)(B), Jan. 14, 2019, 132 Stat. 5535, 5541; Pub. L. 117–219, §7, Dec. 5, 2022, 136 Stat. 2274.)

Editorial Notes

References in Text

The date of enactment of the Small Business Paperwork Relief Act of 2002, referred to in subsec. (c)(6), is the date of enactment of Pub. L. 107–198, which was approved June 28, 2002.

Section 4 of the MAPS Act of 2021, referred to in subsec. (e)(10), is section 4 of Pub. L. 117–219, which is set out as a note under section 6102 of Title 31, Money and Finance.

The text of section 11331 of title 40, referred to in subsec. (h)(1)(B), was generally amended by Pub. L. 117–167, div. B, title II, §10246(f), Aug. 9, 2022, 136 Stat. 1492, so as to provide for the prescription by the Secretary of Commerce of standards and guidelines pertaining to Federal information systems.

Section 322 of title 40, referred to in subsec. (h)(2), was repealed by Pub. L. 109–313, §3(h)(1), Oct. 6, 2006, 120 Stat. 1736.

Prior Provisions

A prior section 3504, added Pub. L. 96–511, §2(a), Dec. 11, 1980, 94 Stat. 2815; amended Pub. L. 98–497, title I, §107(b)(26), Oct. 19, 1984, 98 Stat. 2291; Pub. L. 99–500, §101(m) [title VIII, §§814, 821(b)(2)], Oct. 18, 1986, 100 Stat. 1783–308, 1783–336, 1783–342, and Pub. L. 99–591, §101(m) [title VIII, §§814, 821(b)(2)], Oct. 30, 1986, 100 Stat. 3341–308, 3341–336, 3341–342, related to authority and functions of Director prior to the general amendment of this chapter by Pub. L. 104–13.

Another prior section 3504, Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1303, provided for designation of a central collection agency, prior to the general amendment of this chapter by Pub. L. 96–511. See section 3509 of this title.

Amendments

2022—Subsec. (e)(10). Pub. L. 117–219 added par. (10).

2019—Subsec. (b)(2)(A). Pub. L. 115–435, §202(d)(2)(B), substituted "the use of comprehensive data inventories and the Federal data catalogue under section 3511" for "the use of the Government Information Locator Service".

Subsec. (b)(6). Pub. L. 115–435, §202(b), added par. (6).

2002—Subsec. (c)(6). Pub. L. 107–198 added par. (6).

Subsec. (g)(1). Pub. L. 107–296, §1005(c)(1)(A), and Pub. L. 107–347, §305(c)(1)(A), amended par. (1) identically, inserting "and" at end.

Subsec. (g)(2). Pub. L. 107–347, §305(c)(1)(B), substituted "section 11331 of title 40 and subchapter II of this chapter" for "sections 11331 and 11332(b) and (c) of title 40" and a period for "; and" at end.

Pub. L. 107–296, §1005(c)(1)(B), which directed amendment of par. (2) by substituting "section 11331 of title 40 and subchapter II of this title" for "sections 11331 and 11332(b) and (c) of title 40" and a period for the semicolon, could not be executed because of amendment by Pub. L. 107–347, §305(c)(1)(B). See Amendment note above and Effective Date of 2002 Amendments notes below.

Pub. L. 107–217, §3(l)(5)(A), substituted "sections 11331 and 11332(b) and (c) of title 40" for "section 5131 of the Clinger-Cohen Act of 1996 (40 U.S.C. 1441), and sections 5 and 6 of the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (g)(3). Pub. L. 107–296, §1005(c)(1)(C), and Pub. L. 107–347, §305(c)(1)(C), amended subsec. (g) identically, striking out par. (3) which read as follows: "require Federal agencies, consistent with the standards and guidelines promulgated under sections 11331 and 11332(b) and (c) of title 40, to identify and afford security protections commensurate with the risk and magnitude of the harm resulting from the loss, misuse, or unauthorized access to or modification of information collected or maintained by or on behalf of an agency."

Pub. L. 107–217, §3(l)(5)(B), substituted "sections 11331 and 11332(b) and (c) of title 40" for "section 5131 of the Clinger-Cohen Act of 1996 (40 U.S.C. 1441) and sections 5 and 6 of the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (h)(1)(B). Pub. L. 107–217, §3(l)(5)(C), substituted "section 11331 of title 40" for "section 5131 of the Clinger-Cohen Act of 1996 (40 U.S.C. 1441)".

Subsec. (h)(2). Pub. L. 107–217, §3(l)(5)(D), substituted "subtitle III of title 40" for "division E of the Clinger-Cohen Act of 1996 (40 U.S.C. 1401 et seq.)" and "section 322 of title 40" for "section 110 of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 757)".

2000—Subsecs. (a)(2), (d)(2), (f)(1). Pub. L. 106–398 substituted "subchapter" for "chapter".

1998—Subsec. (a)(1)(B)(vi). Pub. L. 105–277 amended cl. (vi) generally. Prior to amendment, cl. (vi) read as follows: "the acquisition and use of information technology."

1997—Subsecs. (g)(2), (3), (h)(1)(B). Pub. L. 105–85, §1073(h)(5)(C), substituted "Clinger-Cohen Act of 1996 (40 U.S.C. 1441)" for "Information Technology Management Reform Act of 1996".

Subsec. (h)(2). Pub. L. 105–85, §1073(h)(5)(B), substituted "division E of the Clinger-Cohen Act of 1996 (40 U.S.C. 1401 et seq.)" for "the Information Technology Management Reform Act of 1996".

1996—Subsec. (g)(2). Pub. L. 104–106, §5131(e)(1)(A), substituted "sections 20 and 21 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3 and 278g–4), section 5131 of the Information Technology Management Reform Act of 1996, and sections 5 and 6 of the Computer Security Act of 1987 (40 U.S.C. 759 note)" for "the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (g)(3). Pub. L. 104–106, §5131(e)(1)(B), substituted "the standards and guidelines promulgated under section 5131 of the Information Technology Management Reform Act of 1996 and sections 5 and 6 of the Computer Security Act of 1987 (40 U.S.C. 759 note)" for "the Computer Security Act of 1987 (40 U.S.C. 759 note)".

Subsec. (h)(1)(B). Pub. L. 104–106, §5605(b), substituted "section 5131 of the Information Technology Management Reform Act of 1996" for "section 111(d) of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 759(d))".

Subsec. (h)(2). Pub. L. 104–106, §5605(c), substituted "the Information Technology Management Reform Act of 1996 and directives issued under section 110 of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 757)" for "sections 110 and 111 of the Federal Property and Administrative Services Act of 1949 (40 U.S.C. 757 and 759)".

Statutory Notes and Related Subsidiaries

Effective Date of 2019 Amendment

Amendment by Pub. L. 115–435 effective 180 days after Jan. 14, 2019, see section 403 of Pub. L. 115–435, set out as a note under section 306 of Title 5, Government Organization and Employees.

Effective Date of 2002 Amendments

Pub. L. 107–347, title IV, §402(b), Dec. 17, 2002, 116 Stat. 2962, provided that: "Title III [see Short Title of 2002 Amendments note set out under section 101 of this title] and this title [enacting provisions set out as a note under section 3601 of this title] shall take effect on the date of enactment of this Act [Dec. 17, 2002]."

Amendment by Pub. L. 107–296 effective 60 days after Nov. 25, 2002, see section 4 of Pub. L. 107–296, set out as an Effective Date note under section 101 of Title 6, Domestic Security.

Effective Date of 2000 Amendment

Amendment by Pub. L. 106–398 effective 30 days after Oct. 30, 2000, see section 1 [[div. A], title X, §1065] of Pub. L. 106–398, Oct. 30, 2000, 114 Stat. 1654, formerly set out as an Effective Date note under former section 3531 of this title.

Effective Date of 1996 Amendment

Amendment by Pub. L. 104–106 effective 180 days after Feb. 10, 1996, see section 5701 of Pub. L. 104–106, Feb. 10, 1996, 110 Stat. 702.

Effective Date

Section effective Oct. 1, 1995, except as otherwise provided, see section 4(a) of Pub. L. 104–13, set out as a note under section 3501 of this title.

Government Paperwork Elimination

Pub. L. 105–277, div. C, title XVII, Oct. 21, 1998, 112 Stat. 2681–749, provided that:

"SEC. 1701. SHORT TITLE.

"This title may be cited as the 'Government Paperwork Elimination Act'.

"SEC. 1702. AUTHORITY OF OMB TO PROVIDE FOR ACQUISITION AND USE OF ALTERNATIVE INFORMATION TECHNOLOGIES BY EXECUTIVE AGENCIES.

"[Amended this section.]

"SEC. 1703. PROCEDURES FOR USE AND ACCEPTANCE OF ELECTRONIC SIGNATURES BY EXECUTIVE AGENCIES.

"(a) In General.—In order to fulfill the responsibility to administer the functions assigned under chapter 35 of title 44, United States Code, the provisions of the Clinger-Cohen Act of 1996 (divisions D and E of Public Law 104–106) [see Short Title of 1996 Act note set out under section 101 of Title 41, Public Contracts] and the amendments made by that Act, and the provisions of this title, the Director of the Office of Management and Budget shall, in consultation with the National Telecommunications and Information Administration and not later than 18 months after the date of enactment of this Act [Oct. 21, 1998], develop procedures for the use and acceptance of electronic signatures by Executive agencies.

"(b) Requirements for Procedures.—(1) The procedures developed under subsection (a)—

"(A) shall be compatible with standards and technology for electronic signatures that are generally used in commerce and industry and by State governments;

"(B) may not inappropriately favor one industry or technology;

"(C) shall ensure that electronic signatures are as reliable as is appropriate for the purpose in question and keep intact the information submitted;

"(D) shall provide for the electronic acknowledgment of electronic forms that are successfully submitted; and

"(E) shall, to the extent feasible and appropriate, require an Executive agency that anticipates receipt by electronic means of 50,000 or more submittals of a particular form to take all steps necessary to ensure that multiple methods of electronic signatures are available for the submittal of such form.

"(2) The Director shall ensure the compatibility of the procedures under paragraph (1)(A) in consultation with appropriate private bodies and State government entities that set standards for the use and acceptance of electronic signatures.

"SEC. 1704. DEADLINE FOR IMPLEMENTATION BY EXECUTIVE AGENCIES OF PROCEDURES FOR USE AND ACCEPTANCE OF ELECTRONIC SIGNATURES.

"In order to fulfill the responsibility to administer the functions assigned under chapter 35 of title 44, United States Code, the provisions of the Clinger-Cohen Act of 1996 (divisions D and E of Public Law 104–106) [see Short Title of 1996 Act note set out under section 101 of Title 41] and the amendments made by that Act, and the provisions of this title, the Director of the Office of Management and Budget shall ensure that, commencing not later than five years after the date of enactment of this Act [Oct. 21, 1998], Executive agencies provide—

"(1) for the option of the electronic maintenance, submission, or disclosure of information, when practicable as a substitute for paper; and

"(2) for the use and acceptance of electronic signatures, when practicable.

"SEC. 1705. ELECTRONIC STORAGE AND FILING OF EMPLOYMENT FORMS.

"In order to fulfill the responsibility to administer the functions assigned under chapter 35 of title 44, United States Code, the provisions of the Clinger-Cohen Act of 1996 (divisions D and E of Public Law 104–106) [see Short Title of 1996 Amendment Act set out under section 101 of Title 41] and the amendments made by that Act, and the provisions of this title, the Director of the Office of Management and Budget shall, not later than 18 months after the date of enactment of this Act [Oct. 21, 1998], develop procedures to permit private employers to store and file electronically with Executive agencies forms containing information pertaining to the employees of such employers.

"SEC. 1706. STUDY ON USE OF ELECTRONIC SIGNATURES.

"(a) Ongoing Study Required.—In order to fulfill the responsibility to administer the functions assigned under chapter 35 of title 44, United States Code, the provisions of the Clinger-Cohen Act of 1996 (divisions D and E of Public Law 104–106) [see Short Title of 1996 Act note set out under section 101 of Title 41] and the amendments made by that Act, and the provisions of this title, the Director of the Office of Management and Budget shall, in cooperation with the National Telecommunications and Information Administration, conduct an ongoing study of the use of electronic signatures under this title on—

"(1) paperwork reduction and electronic commerce;

"(2) individual privacy; and

"(3) the security and authenticity of transactions.

"(b) Reports.—The Director shall submit to Congress on a periodic basis a report describing the results of the study carried out under subsection (a).

"SEC. 1707. ENFORCEABILITY AND LEGAL EFFECT OF ELECTRONIC RECORDS.

"Electronic records submitted or maintained in accordance with procedures developed under this title, or electronic signatures or other forms of electronic authentication used in accordance with such procedures, shall not be denied legal effect, validity, or enforceability because such records are in electronic form.

"SEC. 1708. DISCLOSURE OF INFORMATION.

"Except as provided by law, information collected in the provision of electronic signature services for communications with an executive agency, as provided by this title, shall only be used or disclosed by persons who obtain, collect, or maintain such information as a business or government practice, for the purpose of facilitating such communications, or with the prior affirmative consent of the person about whom the information pertains.

"SEC. 1709. APPLICATION WITH INTERNAL REVENUE LAWS.

"No provision of this title shall apply to the Department of the Treasury or the Internal Revenue Service to the extent that such provision—

"(1) involves the administration of the internal revenue laws; or

"(2) conflicts with any provision of the Internal Revenue Service Restructuring and Reform Act of 1998 [Pub. L. 105–206, see Tables for classification] or the Internal Revenue Code of 1986 [26 U.S.C. 1 et seq.].

"SEC. 1710. DEFINITIONS.

"For purposes of this title:

"(1) Electronic signature.—The term 'electronic signature' means a method of signing an electronic message that—

"(A) identifies and authenticates a particular person as the source of the electronic message; and

"(B) indicates such person's approval of the information contained in the electronic message.

"(2) Executive agency.—The term 'Executive agency' has the meaning given that term in section 105 of title 5, United States Code."

1 So in original. Probably should be followed by "and".

2 See References in Text note below.
44 U.S.C. § 2204 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 22: PRESIDENTIAL RECORDS / Section 2204: Restrictions on access to Presidential records
Restrictions on access to Presidential records
Status: in_force

(a) Prior to the conclusion of a President's term of office or last consecutive term of office, as the case may be, the President shall specify durations, not to exceed 12 years, for which access shall be restricted with respect to information, in a Presidential record, within one or more of the following categories:

(1)(A) specifically authorized under criteria established by an Executive order to be kept secret in the interest of national defense or foreign policy and (B) in fact properly classified pursuant to such Executive order;

(2) relating to appointments to Federal office;

(3) specifically exempted from disclosure by statute (other than sections 552 and 552b of title 5, United States Code), provided that such statute (A) requires that the material be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of material to be withheld;

(4) trade secrets and commercial or financial information obtained from a person and privileged or confidential;

(5) confidential communications requesting or submitting advice, between the President and the President's advisers, or between such advisers; or

(6) personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy.

(b)(1) Any Presidential record or reasonably segregable portion thereof containing information within a category restricted by the President under subsection (a) shall be so designated by the Archivist and access thereto shall be restricted until the earlier of—

(A)(i) the date on which the former President waives the restriction on disclosure of such record, or

(ii) the expiration of the duration specified under subsection (a) for the category of information on the basis of which access to such record has been restricted; or

(B) upon a determination by the Archivist that such record or reasonably segregable portion thereof, or of any significant element or aspect of the information contained in such record or reasonably segregable portion thereof, has been placed in the public domain through publication by the former President, or the President's agents.

(2) Any such record which does not contain information within a category restricted by the President under subsection (a), or contains information within such a category for which the duration of restricted access has expired, shall be exempt from the provisions of subsection (c) until the earlier of—

(A) the date which is 5 years after the date on which the Archivist obtains custody of such record pursuant to section 2203(d)(1); 1 or

(B) the date on which the Archivist completes the processing and organization of such records or integral file segment thereof.

(3) During the period of restricted access specified pursuant to subsection (b)(1), the determination whether access to a Presidential record or reasonably segregable portion thereof shall be restricted shall be made by the Archivist, in the Archivist's discretion, after consultation with the former President, and, during such period, such determinations shall not be subject to judicial review, except as provided in subsection (e) of this section. The Archivist shall establish procedures whereby any person denied access to a Presidential record because such record is restricted pursuant to a determination made under this paragraph, may file an administrative appeal of such determination. Such procedures shall provide for a written determination by the Archivist or the Archivist's designee, within 30 working days after receipt of such an appeal, setting forth the basis for such determination.

(c)(1) Subject to the limitations on access imposed pursuant to subsections (a) and (b), Presidential records shall be administered in accordance with section 552 of title 5, United States Code, except that paragraph (b)(5) of that section shall not be available for purposes of withholding any Presidential record, and for the purposes of such section such records shall be deemed to be records of the National Archives and Records Administration. Access to such records shall be granted on nondiscriminatory terms.

(2) Nothing in this Act shall be construed to confirm, limit, or expand any constitutionally-based privilege which may be available to an incumbent or former President.

(d) Upon the death or disability of a President or former President, any discretion or authority the President or former President may have had under this chapter, except section 2208, shall be exercised by the Archivist unless otherwise previously provided by the President or former President in a written notice to the Archivist.

(e) The United States District Court for the District of Columbia shall have jurisdiction over any action initiated by the former President asserting that a determination made by the Archivist violates the former President's rights or privileges.

(f) The Archivist shall not make available any original Presidential records to any individual claiming access to any Presidential record as a designated representative under section 2205(3) of this title if that individual has been convicted of a crime relating to the review, retention, removal, or destruction of records of the Archives.

(Added Pub. L. 95–591, §2(a), Nov. 4, 1978, 92 Stat. 2525; amended Pub. L. 98–497, title I, §107(b)(7), Oct. 19, 1984, 98 Stat. 2287; Pub. L. 113–187, §§2(a)(2)(A), (d), 8(4), Nov. 26, 2014, 128 Stat. 2005, 2006, 2011.)

Editorial Notes

References in Text

This Act, referred to in subsec. (c)(2), probably means Pub. L. 95–591, Nov. 4, 1978, 92 Stat. 2523, known as the Presidential Records Act of 1978, which enacted this chapter, amended sections 2107 and 2108 of this title, and enacted provisions set out as notes under section 2201 of this title. For complete classification of this Act to the Code, see Short Title of 1978 Amendment note set out under section 101 of this title and Tables.

Amendments

2014—Subsec. (a). Pub. L. 113–187, §8(4)(A)(i), substituted "a President's" for "his" in introductory provisions.

Subsec. (a)(5). Pub. L. 113–187, §8(4)(A)(ii), substituted "the President's" for "his".

Subsec. (b)(1)(B). Pub. L. 113–187, §8(4)(B)(i), substituted "the President's" for "his".

Subsec. (b)(3). Pub. L. 113–187, §8(4)(B)(ii), substituted "the Archivist's discretion" for "his discretion" and "the Archivist's designee" for "his designee".

Subsec. (d). Pub. L. 113–187, §2(a)(2)(A), inserted ", except section 2208," after "chapter".

Subsec. (f). Pub. L. 113–187, §2(d), added subsec. (f).

1984—Subsec. (c)(1). Pub. L. 98–497 substituted "National Archives and Records Administration" for "National Archives and Records Service of the General Services Administration".

Statutory Notes and Related Subsidiaries

Effective Date of 1984 Amendment

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of this title.

Effective Date

Section effective with respect to Presidential records created during a term of office of President beginning on or after Jan. 20, 1981, see section 3 of Pub. L. 95–591, set out as a note under section 2201 of this title.

Executive Documents

Executive Order No. 12667

Ex. Ord. No. 12667, Jan. 18, 1989, 54 F.R. 3403, which established policies and procedures governing the assertion of Executive privilege by incumbent and former Presidents in connection with the release of Presidential records by the National Archives and Records Administration pursuant to this chapter, was revoked by Ex. Ord. No. 13233, §13, Nov. 1, 2001, 66 F.R. 56029, formerly set out below.

Executive Order No. 13233

Ex. Ord. No. 13233, Nov. 1, 2001, 66 F.R. 56025, which related to further implementation of the Presidential Records Act, was revoked by Ex. Ord. No. 13489, §6, Jan. 21, 2009, 74 F.R. 4671, set out below.

Ex. Ord. No. 13489. Presidential Records

Ex. Ord. No. 13489, Jan. 21, 2009, 74 F.R. 4669, provided:

By the authority vested in me as President by the Constitution and the laws of the United States of America, and in order to establish policies and procedures governing the assertion of executive privilege by incumbent and former Presidents in connection with the release of Presidential records by the National Archives and Records Administration (NARA) pursuant to the Presidential Records Act of 1978, it is hereby ordered as follows:

Section 1. Definitions. For purposes of this order:

(a) "Archivist" refers to the Archivist of the United States or his designee.

(b) "NARA" refers to the National Archives and Records Administration.

(c) "Presidential Records Act" refers to the Presidential Records Act, 44 U.S.C. 2201–2207.

(d) "NARA regulations" refers to the NARA regulations implementing the Presidential Records Act [of 1978], 36 C.F.R. Part 1270.

(e) "Presidential records" refers to those documentary materials maintained by NARA pursuant to the Presidential Records Act, including Vice Presidential records.

(f) "Former President" refers to the former President during whose term or terms of office particular Presidential records were created.

(g) A "substantial question of executive privilege" exists if NARA's disclosure of Presidential records might impair national security (including the conduct of foreign relations), law enforcement, or the deliberative processes of the executive branch.

(h) A "final court order" is a court order from which no appeal may be taken.

Sec. 2. Notice of Intent to Disclose Presidential Records. (a) When the Archivist provides notice to the incumbent and former Presidents of his intent to disclose Presidential records pursuant to section 1270.46 of the NARA regulations, the Archivist, using any guidelines provided by the incumbent and former Presidents, shall identify any specific materials, the disclosure of which he believes may raise a substantial question of executive privilege. However, nothing in this order is intended to affect the right of the incumbent or former Presidents to invoke executive privilege with respect to materials not identified by the Archivist. Copies of the notice for the incumbent President shall be delivered to the President (through the Counsel to the President) and the Attorney General (through the Assistant Attorney General for the Office of Legal Counsel). The copy of the notice for the former President shall be delivered to the former President or his designated representative.

(b) Upon the passage of 30 days after receipt by the incumbent and former Presidents of a notice of intent to disclose Presidential records, the Archivist may disclose the records covered by the notice, unless during that time period the Archivist has received a claim of executive privilege by the incumbent or former President or the Archivist has been instructed by the incumbent President or his designee to extend the time period for a time certain and with reason for the extension of time provided in the notice. If a shorter period of time is required under the circumstances set forth in section 1270.44 of the NARA regulations, the Archivist shall so indicate in the notice.

Sec. 3. Claim of Executive Privilege by Incumbent President. (a) Upon receipt of a notice of intent to disclose Presidential records, the Attorney General (directly or through the Assistant Attorney General for the Office of Legal Counsel) and the Counsel to the President shall review as they deem appropriate the records covered by the notice and consult with each other, the Archivist, and such other executive agencies as they deem appropriate concerning whether invocation of executive privilege is justified.

(b) The Attorney General and the Counsel to the President, in the exercise of their discretion and after appropriate review and consultation under subsection (a) of this section, may jointly determine that invocation of executive privilege is not justified. The Archivist shall be notified promptly of any such determination.

(c) If either the Attorney General or the Counsel to the President believes that the circumstances justify invocation of executive privilege, the issue shall be presented to the President by the Counsel to the President and the Attorney General.

(d) If the President decides to invoke executive privilege, the Counsel to the President shall notify the former President, the Archivist, and the Attorney General in writing of the claim of privilege and the specific Presidential records to which it relates. After receiving such notice, the Archivist shall not disclose the privileged records unless directed to do so by an incumbent President or by a final court order.

Sec. 4. Claim of Executive Privilege by Former President. (a) Upon receipt of a claim of executive privilege by a living former President, the Archivist shall consult with the Attorney General (through the Assistant Attorney General for the Office of Legal Counsel), the Counsel to the President, and such other executive agencies as the Archivist deems appropriate concerning the Archivist's determination as to whether to honor the former President's claim of privilege or instead to disclose the Presidential records notwithstanding the claim of privilege. Any determination under section 3 of this order that executive privilege shall not be invoked by the incumbent President shall not prejudice the Archivist's determination with respect to the former President's claim of privilege.

(b) In making the determination referred to in subsection (a) of this section, the Archivist shall abide by any instructions given him by the incumbent President or his designee unless otherwise directed by a final court order. The Archivist shall notify the incumbent and former Presidents of his determination at least 30 days prior to disclosure of the Presidential records, unless a shorter time period is required in the circumstances set forth in section 1270.44 of the NARA regulations. Copies of the notice for the incumbent President shall be delivered to the President (through the Counsel to the President) and the Attorney General (through the Assistant Attorney General for the Office of Legal Counsel). The copy of the notice for the former President shall be delivered to the former President or his designated representative.

Sec. 5. General Provisions. (a) Nothing in this order shall be construed to impair or otherwise affect:

(i) authority granted by law to a department or agency, or the head thereof; or

(ii) functions of the Director of the Office of Management and Budget relating to budget, administrative, or legislative proposals.

(b) This order shall be implemented consistent with applicable law and subject to the availability of appropriations.

(c) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person.

Sec. 6. Revocation. Executive Order 13233 of November 1, 2001, is revoked.

Barack Obama.      

1 So in original. Probably should be "2203(g)(1);".
44 U.S.C. § 1301 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 13: PARTICULAR REPORTS AND DOCUMENTS / Section 1301: Agriculture, Department of: report of Secretary
Agriculture, Department of: report of Secretary
Status: in_force

The annual report of the Secretary of Agriculture shall be submitted and printed in two parts, as follows:

part 1, containing purely business and executive matter necessary for the Secretary to submit to the President and Congress;

part 2, reports from the different bureaus and divisions, and papers prepared by their special agents, accompanied by suitable illustrations as are, in the opinion of the Secretary, specially suited to interest and instruct the farmers of the country, and to include a general report of the operations of the department for their information.

In addition to the usual number, there shall be printed of part 1, one thousand copies for the Senate, two thousand copies for the House of Representatives, and three thousand copies for the Department of Agriculture; and of part 2, one hundred and ten thousand copies for the use of the Senate, three hundred and sixty thousand copies for the use of the House of Representatives, and thirty thousand copies for the use of the Department of Agriculture, the illustrations for part 2 to be subject to the approval of the Secretary of Agriculture, and executed under the supervision of the Director of the Government Publishing Office, in accordance with directions of the Joint Committee on Printing, and the title of each of the parts shall show that each part is complete in itself.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1265; Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §241 (Jan. 12, 1895, ch. 23, §73, 28 Stat. 612).

Editorial Notes

Amendments

2014—Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer" in last par.

Statutory Notes and Related Subsidiaries

Unavailability of Department Funds To Produce Part 2 of Annual Report

Funds available to Department of Agriculture not to be used to produce part 2 of annual report of Secretary (known as the Yearbook of Agriculture), see title I of Pub. L. 103–111, 107 Stat. 1048, set out as a note under section 2207 of Title 7, Agriculture.
44 U.S.C. § 2903 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 29: RECORDS MANAGEMENT BY THE ARCHIVIST OF THE UNITED STATES AND BY THE ADMINISTRATOR OF GENERAL SERVICES / Section 2903: Custody and control of property
Custody and control of property
Status: in_force

(a) The Archivist shall have immediate custody and control of the National Archives Building and its contents, and may design, construct, purchase, lease, maintain, operate, protect, and improve buildings used by him for the storage of records of Federal agencies in the District of Columbia and elsewhere.

(b) When the Archivist considers it to be in the public interest, the Archivist may charge and collect reasonable fees from the public for the occasional, non-official use of rooms and spaces, and services related to such use, in the buildings subject to this section. Fees collected under this subsection shall be paid into an account in the National Archives Trust Fund and shall be held, administered, and expended for the benefit and in the interest of the national archival and records activities administered by the National Archives and Records Administration, including educational and public program purposes.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1296; Pub. L. 98–497, title I, §107(b)(15)(A), Oct. 19, 1984, 98 Stat. 2288; Pub. L. 108–383, §4(b), Oct. 30, 2004, 118 Stat. 2218.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §392 (June 30, 1949, ch. 288, title V, §502, as added Sept. 5, 1950, ch. 849, §6(d), 64 Stat. 583).

Editorial Notes

Amendments

2004—Pub. L. 108–383 designated existing provisions as subsec. (a) and added subsec. (b).

1984—Pub. L. 98–497 substituted "Archivist" for "Administrator".

Statutory Notes and Related Subsidiaries

Effective Date of 1984 Amendment

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of this title.
44 U.S.C. § 1909 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 19: DEPOSITORY LIBRARY PROGRAM / Section 1909: Requirements of depository libraries; reports on conditions; investigations; termination; replacement
Requirements of depository libraries; reports on conditions; investigations; termination; replacement
Status: in_force

Only a library able to provide custody and service for depository materials and located in an area where it can best serve the public need, and within an area not already adequately served by existing depository libraries may be designated by Senators, Representatives, the Resident Commissioner from Puerto Rico, the Commissioner of the District of Columbia,1 or the Governors of Guam, American Samoa, or the Virgin Islands as a depository of Government publications. The designated depository libraries shall report to the Superintendent of Documents at least every two years concerning their condition.

The Superintendent of Documents shall make firsthand investigation of conditions for which need is indicated and include the results of investigations in his annual report. When he ascertains that the number of books in a depository library is below ten thousand, other than Government publications, or it has ceased to be maintained so as to be accessible to the public, or that the Government publications which have been furnished the library have not been properly maintained, he shall delete the library from the list of depository libraries if the library fails to correct the unsatisfactory conditions within six months. The Representative or the Resident Commissioner from Puerto Rico in whose area the library is located or the Senator who made the designation, or a successor of the Senator, and, in the case of a library in the District of Columbia, the Commissioner of the District of Columbia, and, in the case of a library in Guam, American Samoa, or the Virgin Islands, the Governor, shall be notified and shall then be authorized to designate another library within the area served by him, which shall meet the conditions herein required, but which may not be in excess of the number of depository libraries authorized by laws within the State, district, territory, or the Commonwealth of Puerto Rico, as the case may be.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1285.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §86 (Jan. 12, 1895, ch. 23, §70, 28 Stat. 612; Aug. 9, 1962, Pub. L. 87–579, §6, 76 Stat. 354).

Statutory Notes and Related Subsidiaries

Transfer of Functions

Office of Commissioner of District of Columbia, as established under Reorg. Plan No. 3 of 1967, eff. Nov. 3, 1967 (in part), 32 F.R. 11669, 81 Stat. 948, abolished as of noon Jan. 2, 1975, by Pub. L. 93–198, title VII, §711, Dec. 24, 1973, 87 Stat. 818, and replaced by office of Mayor of District of Columbia by section 421 of Pub. L. 93–198.

1 See Transfer of Functions note below.
44 U.S.C. § 3106 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 31: RECORDS MANAGEMENT BY FEDERAL AGENCIES / Section 3106: Unlawful removal, destruction of records
Unlawful removal, destruction of records
Status: in_force

(a) Federal Agency Notification.—The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records in the custody of the agency, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records the head of the Federal agency knows or has reason to believe have been unlawfully removed from that agency, or from another Federal agency whose records have been transferred to the legal custody of that Federal agency.

(b) Archivist Notification.—In any case in which the head of a Federal agency does not initiate an action for such recovery or other redress within a reasonable period of time after being notified of any such unlawful action described in subsection (a), or is participating in, or believed to be participating in any such unlawful action, the Archivist shall request the Attorney General to initiate such an action, and shall notify the Congress when such a request has been made.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1298; Pub. L. 98–497, title I, §107(b)(21), title II, §203(b), Oct. 19, 1984, 98 Stat. 2290, 2294; Pub. L. 113–187, §4, Nov. 26, 2014, 128 Stat. 2009.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §396(f) (June 30, 1949, ch. 288, title V, §506(f), as added Sept. 5, 1950, ch. 849, §6(d), 64 Stat. 583).

Editorial Notes

Amendments

2014—Pub. L. 113–187 amended section generally. Prior to amendment, text read as follows: "The head of each Federal agency shall notify the Archivist of any actual, impending, or threatened unlawful removal, defacing, alteration, or destruction of records in the custody of the agency of which he is the head that shall come to his attention, and with the assistance of the Archivist shall initiate action through the Attorney General for the recovery of records he knows or has reason to believe have been unlawfully removed from his agency, or from another Federal agency whose records have been transferred to his legal custody. In any case in which the head of the agency does not initiate an action for such recovery or other redress within a reasonable period of time after being notified of any such unlawful action, the Archivist shall request the Attorney General to initiate such an action, and shall notify the Congress when such a request has been made."

1984—Pub. L. 98–497, §107(b)(21), substituted "Archivist" for "Administrator of General Services" and "Archivist" for "Administrator".

Pub. L. 98–497, §203(b), inserted at end "In any case in which the head of the agency does not initiate an action for such recovery or other redress within a reasonable period of time after being notified of any such unlawful action, the Archivist shall request the Attorney General to initiate such an action, and shall notify the Congress when such a request has been made."

Statutory Notes and Related Subsidiaries

Effective Date of 1984 Amendment

Amendment by Pub. L. 98–497 effective Apr. 1, 1985, see section 301 of Pub. L. 98–497, set out as a note under section 2102 of this title.
44 U.S.C. § 1916 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 19: DEPOSITORY LIBRARY PROGRAM / Section 1916: Designation of libraries of accredited law schools as depository libraries
Designation of libraries of accredited law schools as depository libraries
Status: in_force

(a) Upon the request of any accredited law school, the Director of the Government Publishing Office shall designate the library of such law school as a depository library. The Director of the Government Publishing Office may not make such designation unless he determines that the library involved meets the requirements of this chapter, other than those requirements of the first undesignated paragraph of section 1909 of this title which relate to the location of such library.

(b) For purposes of this section, the term "accredited law school" means any law school which is accredited by a nationally recognized accrediting agency or association approved by the Commissioner of Education for such purpose or accredited by the highest appellate court of the State in which the law school is located.

(Added Pub. L. 95–261, §1, Apr. 17, 1978, 92 Stat. 199; amended Pub. L. 113–235, div. H, title I, §1301(c)(1), Dec. 16, 2014, 128 Stat. 2537.)

Editorial Notes

Amendments

2014—Subsec. (a). Pub. L. 113–235 substituted "Director of the Government Publishing Office" for "Public Printer" in two places.

Statutory Notes and Related Subsidiaries

Effective Date

Pub. L. 95–261, §3, Apr. 17, 1978, 92 Stat. 199, provided that: "The amendments made by this Act [enacting this section] shall take effect on October 1, 1978."

Transfer of Functions

Functions of Commissioner of Education transferred to Secretary of Education pursuant to section 3441(a)(1) of Title 20, Education.
44 U.S.C. § 1310 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 13: PARTICULAR REPORTS AND DOCUMENTS / Section 1310: Commerce Department: navigation and weather information
Commerce Department: navigation and weather information
Status: in_force

The Secretary of Commerce may cause to be printed the number of copies of tide tables, coast pilots, and other special publications relating to the Coast and Geodetic Survey, Weather Bureau maps, charts, bulletins of not more than one hundred octavo pages, and minor reports of the Weather Bureau, he considers for the best interest of the Government.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1267.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §213 (part) (Jan. 12, 1895, ch. 23, §89, 28 Stat. 622; Mar. 13, 1896, No. 23, 29 Stat. 466; Mar. 3, 1925, ch. 421, §4, 43 Stat. 1106; 1940 Reorg. Plan No. IV, §8, eff. June 30, 1940, 54 Stat. 1234; Reorg. Plan No. 2 of 1965, eff. July 13, 1965, 30 F.R. 8819, 79 Stat. 1318).

This section incorporates only parts of former section 213 relating to Coast and Geodetic Survey and Weather Bureau. The balance will be found in sections 1102, 1116, 1302, 1308, 1309, 1336 of the revision.

Executive Documents

Change of Name

Weather Bureau of Department of Commerce consolidated with Coast and Geodetic Survey to form a new agency in Department of Commerce to be known as Environmental Science Services Administration and office of Chief of Weather Bureau abolished by Reorg. Plan No. 2 of 1965, eff. July 13, 1965, 30 F.R. 8819, 79 Stat. 1318, set out in the Appendix to Title 5, Government Organization and Employees. Functions of Bureau and Chief of Bureau transferred to Secretary of Commerce by the Plan.

Environmental Science Services Administration abolished by Reorg. Plan No. 4 of 1970, eff. Oct. 3, 1970, 35 F.R. 15627, 84 Stat. 2090, set out in the Appendix to Title 5, Government Organization and Employees, which created National Oceanic and Atmospheric Administration in Department of Commerce. By Department Organization Order 25–5A, republished 39 F.R. 27486, Secretary of Commerce delegated to NOAA his functions relating to Weather Bureau. By order of Acting Associate Administrator of NOAA, organization name of Weather Bureau changed to National Weather Service. By order of Acting Associate Administrator of NOAA, 35 F.R. 19249, Dec. 19, 1970, Coast and Geodetic Survey redesignated National Ocean Survey. For further details, see Codification note set out under section 311 of Title 15, Commerce and Trade.
44 U.S.C. § 3607 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 36: MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES / Section 3607: Definitions
Definitions
Status: in_force

(a) In General.—Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through section 3616.

(b) Additional Definitions.—In this section through section 3616:

(1) Administrator.—The term "Administrator" means the Administrator of General Services.

(2) Appropriate congressional committees.—The term "appropriate congressional committees" means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives.

(3) Authorization to operate; federal information.—The terms "authorization to operate" and "Federal information" have the meaning given those term 1 in Circular A–130 of the Office of Management and Budget entitled "Managing Information as a Strategic Resource", or any successor document.

(4) Cloud computing.—The term "cloud computing" has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document.

(5) Cloud service provider.—The term "cloud service provider" means an entity offering cloud computing products or services to agencies.

(6) FedRAMP.—The term "FedRAMP" means the Federal Risk and Authorization Management Program established under section 3608.

(7) FedRAMP authorization.—The term "FedRAMP authorization" means a certification that a cloud computing product or service has—

(A) completed a FedRAMP authorization process, as determined by the Administrator; or

(B) received a FedRAMP provisional authorization to operate, as determined by the FedRAMP Board.

(8) Fedramp authorization package.—The term "FedRAMP authorization package" means the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services authorized by FedRAMP.

(9) FedRAMP board.—The term "FedRAMP Board" means the board established under section 3610.

(10) Independent assessment service.—The term "independent assessment service" means a third-party organization accredited by the Administrator to undertake conformity assessments of cloud service providers and the products or services of cloud service providers.

(11) Secretary.—The term "Secretary" means the Secretary of Homeland Security.

(Added Pub. L. 117–263, div. E, title LIX, §5921(b), Dec. 23, 2022, 136 Stat. 3449.)

Repeal of Section

For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below.

Statutory Notes and Related Subsidiaries

Change of Name

Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023.

Effective Date of Repeal

Pub. L. 117–263, div. E, title LIX, §5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this section is effective on the date that is 5 years after Dec. 23, 2022.

Construction

Pub. L. 117–263, div. E, title LIX, §5921(e), Dec. 23, 2022, 136 Stat. 3458, provided that: "Nothing in this section [see Short Title of 2022 Amendment note set out under section 101 of this title] or any amendment made by this section shall be construed as altering or impairing the authorities of the Director of the Office of Management and Budget or the Secretary of Homeland Security under subchapter II of chapter 35 of title 44, United States Code."

1 So in original. Probably should be "terms".
44 U.S.C. § 1334 (2024) — Title 44: PUBLIC PRINTING AND DOCUMENTS / Chapter 13: PARTICULAR REPORTS AND DOCUMENTS / Section 1334: Naval Intelligence Office: additional copies of publications
Naval Intelligence Office: additional copies of publications
Status: in_force

In addition to one thousand copies previously authorized, the Secretary of the Navy may print extra copies of the publications of the Office of Naval Intelligence necessary for distribution to the naval service and to meet other official demands. The edition of any one publication may not exceed two thousand copies.

(Pub. L. 90–620, Oct. 22, 1968, 82 Stat. 1271.)

Historical and Revision Notes

Based on 44 U.S. Code, 1964 ed., §278 (Mar. 21, 1900, No. 14, 31 Stat. 713).