I

106TH CONGRESS

2D SESSION H. R. 5024

To provide for the coordination of Federal information policy through the

establishment of a Federal Chief Information Officer and an Office

of Information Policy in the Executive Office of the President, and

to otherwise strengthen Federal information resources management.

IN THE HOUSE OF REPRESENTATIVES

JULY 27, 2000

Mr. DAVIS of Virginia introduced the following bill; which was referred to the

Committee on Government Reform

A BILL

To provide for the coordination of Federal information policy

through the establishment of a Federal Chief Information Officer and an Office of Information Policy in the

Executive Office of the President, and to otherwise

strengthen Federal information resources management.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Federal Information

5 Policy Act of 2000’’.

6 SEC. 2. FINDINGS AND PURPOSES.

7 (a) FINDINGS.—The Congress finds—
2

•HR 5024 IH

1 (1) the use of computers and the Internet are

2 fundamentally changing the way in which the Fed3 eral Government operates;

4 (2) Government service to the public is signifi5 cantly harmed by the failure of the Federal Govern6 ment to efficiently and effectively develop, use, and

7 manage information resources, particularly informa8 tion technology;

9 (3) Government agency information activities

10 are poorly coordinated and implemented;

11 (4) the current statutory framework for the

12 management of Federal Government information re13 sources is fundamentally flawed by its reliance on di14 rection and oversight by the Office of Management

15 and Budget;

16 (5) new leadership, and a new oversight frame17 work, is required to provide efficient and effective

18 management of Federal Government information re19 sources; and

20 (6) the executive branch agencies do not have

21 an effective framework for establishing essential re22 quirements to ensure adequate control and protec23 tion of information resources that support Federal

24 operations and assets, and thus cannot provide effec-
3

•HR 5024 IH

1 tive management and oversight of the related infor2 mation security risks.

3 (b) The purposes of this Act are to—

4 (1) establish a Chief Information Officer for the

5 Federal Government who can assert leadership, di6 rection, and oversight of Federal agency manage7 ment of information resources to efficiently and ef8 fectively perform governmental functions;

9 (2) harmonize existing information resources

10 management laws in order to coordinate and im11 prove the Federal Government’s development, use,

12 and management of information resources, particu13 larly information technology;

14 (3) create opportunities for innovation in the

15 development, use, and management of information

16 resources, including information technology, by the

17 Federal Government; and

18 (4) create effective management and oversight

19 of related information security risks, including the

20 coordination of information security standards and

21 efforts throughout the executive branch.

22 SEC. 3. COORDINATION OF FEDERAL INFORMATION POL23 ICY.

24 Chapter 35 of title 44, United States Code, is amend25 ed to read as follows:
4

•HR 5024 IH

1 ‘‘CHAPTER 35—COORDINATION OF FEDERAL

2 INFORMATION POLICY

‘‘Sec.

‘‘3501. Purposes.

‘‘3502. Definitions.

‘‘3503. Office of Information Policy.

‘‘3504. Authority and functions of the Chief Information Officer.

‘‘3505. Assignment of tasks and deadlines.

‘‘3506. Federal agency responsibilities.

‘‘3507. Federal agency chief information officers.

‘‘3508. Chief Information Officers Council.

‘‘3509. Establishment and operation of Government Information Locator Service.

‘‘3510. Chief Information Officer review of agency activities; reporting; agency

response.

‘‘3511. Report to Congress.

‘‘3512. Rules and regulations.

‘‘3513. Effect on existing laws and regulations.

‘‘3514. Access to information.

‘‘3515. Application to national security systems.

‘‘3516. Authorization of appropriations.

3 ‘‘CHAPTER 35—COORDINATION OF

4 FEDERAL INFORMATION POLICY

5 ‘‘§ 3501. Purposes

6 ‘‘The purposes of this chapter are to—

7 ‘‘(1) establish a central focal point to provide

8 effective leadership to improve Federal Government

9 information resources management, particularly with

10 regard to efforts to use information technology to

11 more efficiently and effectively perform govern12 mental functions;

13 ‘‘(2) provide a mechanism for improved coordi14 nation among Federal agencies for the development,

15 use, and management of information technology and
5

•HR 5024 IH

1 related information resources by the Federal Gov2 ernment;

3 ‘‘(3) create opportunities for innovation in the

4 development, use, and management of information

5 technology and related information resources by the

6 Federal Government;

7 ‘‘(4) ensure the greatest possible public benefit

8 from and maximize the utility of information cre9 ated, collected, maintained, used, shared and dis10 seminated by or for the Federal Government, while

11 minimizing burdens on the public;

12 ‘‘(5) coordinate, integrate, and to the extent

13 practicable and appropriate, make uniform Federal

14 information resources management policies and

15 practices as a means to improve the productivity, ef16 ficiency, and effectiveness of Government programs,

17 including the reduction of information collection bur18 dens on the public and the improvement of service

19 delivery to the public;

20 ‘‘(6) improve the quality and use of Federal in21 formation to strengthen decisionmaking, account22 ability, and openness in Government and society;

23 ‘‘(7) minimize the cost to the Federal Govern24 ment of the creation, collection, maintenance, use,

25 dissemination, and disposition of information;
6

•HR 5024 IH

1 ‘‘(8) strengthen the partnership between the

2 Federal Government and State, local, and tribal gov3 ernments by minimizing the burden and maximizing

4 the utility of information created, collected, main5 tained, used, disseminated, and retained by or for

6 the Federal Government;

7 ‘‘(9) provide for the dissemination of public in8 formation on a timely basis, on equitable terms, and

9 in a manner that promotes the utility of the infor10 mation to the public and makes effective use of in11 formation technology;

12 ‘‘(10) ensure that the creation, collection, main13 tenance, use, dissemination, and disposition of infor14 mation by or for the Federal Government is con15 sistent with applicable laws, including laws relating

16 to—

17 ‘‘(A) privacy and confidentiality, including

18 section 552a of title 5;

19 ‘‘(B) security of information, including the

20 Computer Security Act of 1987 (Public Law

21 100–235); and

22 ‘‘(C) access to information, including sec23 tion 552 of title 5;

24 ‘‘(11) ensure the integrity, quality, and utility

25 of the Federal statistical system;
7

•HR 5024 IH

1 ‘‘(12) ensure that information technology is ac2 quired, used, and managed to improve performance

3 of agency missions, including the reduction of infor4 mation collection burdens on the public; and

5 ‘‘(13) improve the responsibility and account6 ability of the President and all agencies of the Fed7 eral Government to Congress and to the public for

8 complying with information resources management,

9 and related policies and guidelines established under

10 this chapter.

11 ‘‘§ 3502. Definitions

12 ‘‘As used in this chapter—

13 ‘‘(1) the term ‘agency’ means any executive de14 partment, military department, Government corpora15 tion, Government controlled corporation, or other es16 tablishment in the executive branch of the Govern17 ment (including the Executive Office of the Presi18 dent), or any independent regulatory agency, but

19 does not include—

20 ‘‘(A) the Federal Election Commission;

21 ‘‘(B) the governments of the District of

22 Columbia and of the territories and possessions

23 of the United States, and their various subdivi24 sions; or
8

•HR 5024 IH

1 ‘‘(C) Government-owned contractor-oper2 ated facilities, including laboratories engaged in

3 national defense research and production activi4 ties;

5 ‘‘(2) the term ‘Director’ means the Director of

6 the Office of Management and Budget;

7 ‘‘(3) the term ‘independent regulatory agency’

8 means the Board of Governors of the Federal Re9 serve System, the Commodity Futures Trading Com10 mission, the Consumer Product Safety Commission,

11 the Federal Communications Commission, the Fed12 eral Deposit Insurance Corporation, the Federal En13 ergy Regulatory Commission, the Federal Housing

14 Finance Board, the Federal Maritime Commission,

15 the Federal Trade Commission, the Interstate Com16 merce Commission, the Mine Enforcement Safety

17 and Health Review Commission, the National Labor

18 Relations Board, the Nuclear Regulatory Commis19 sion, the Occupational Safety and Health Review

20 Commission, the Postal Rate Commission, the Secu21 rities and Exchange Commission, and any other

22 similar agency designated by statute as a Federal

23 independent regulatory agency or commission;
9

•HR 5024 IH

1 ‘‘(4) the term ‘information resources’ means in2 formation and related resources, such as personnel,

3 equipment, funds, and information technology;

4 ‘‘(5) the term ‘information resources manage5 ment’ means the process of managing information

6 resources to accomplish agency missions and to im7 prove agency performance, including through the re8 duction of information collection burdens on the

9 public;

10 ‘‘(6) the term ‘information system’ means a dis11 crete set of information resources organized for the

12 collection, processing, maintenance, use, sharing,

13 dissemination, or disposition of information;

14 ‘‘(7) the term ‘information technology’—

15 ‘‘(A) means any equipment or inter16 connected system or subsystem of equipment,

17 that is used in the automatic acquisition, stor18 age, manipulation, management, movement,

19 control, display, switching, interchange, trans20 mission, or reception of data or information by

21 an agency. For purposes of the preceding sen22 tence, equipment is used by an agency if the

23 equipment is used by the agency directly or is

24 used by a contractor under a contract with the

25 agency which (i) requires the use of such equip-
10

•HR 5024 IH

1 ment, or (ii) requires the use, to a significant

2 extent, of such equipment in the performance of

3 a service or the furnishing of a product;

4 ‘‘(B) includes computers, ancillary equip5 ment, software, firmware and similar proce6 dures, services (including support services), and

7 related resources; and

8 ‘‘(C) notwithstanding subparagraphs (A)

9 and (B), does not include—

10 ‘‘(i) any equipment that is acquired by

11 a Federal contractor incidental to a Fed12 eral contract; or

13 ‘‘(ii) any national security system;

14 ‘‘(8) the term ‘information technology architec15 ture’ means an integrated framework for evolving or

16 maintaining existing information technology and ac17 quiring new information technology to achieve the

18 agency’s strategic goals and information resources

19 management goals;

20 ‘‘(9) the term ‘national security system’ means

21 any telecommunications or information system oper22 ated by the United States Government, the function,

23 operation, or use of which—

24 ‘‘(A) involves intelligence activities;
11

•HR 5024 IH

1 ‘‘(B) involves cryptologic activities related

2 to national security;

3 ‘‘(C) involves command and control of mili4 tary forces;

5 ‘‘(D) involves equipment that is an integral

6 part of a weapon or weapons system; or

7 ‘‘(E) is critical to the direct fulfillment of

8 military or intelligence missions, provided that

9 this exclusion does not apply to a system that

10 is used for routine administrative and business

11 applications (including payroll, finance, logis12 tics, and personnel management applications);

13 ‘‘(10) the term ‘person’ means an individual,

14 partnership, association, corporation, business trust,

15 or legal representative, an organized group of indi16 viduals, a State, territorial, tribal, or local govern17 ment or branch thereof, or a political subdivision of

18 a State, territory, tribal, or local government or a

19 branch of a political subdivision; and

20 ‘‘(11) the term ‘public information’ means any

21 information, regardless of form or format, that an

22 agency discloses, disseminates, or makes available to

23 the public.
12

•HR 5024 IH

1 ‘‘§ 3503. Office of Information Policy

2 ‘‘(a) ESTABLISHMENT.—There is established in the

3 Executive Office of the President an Office of Information

4 Policy (hereinafter in this chapter referred to as the ‘Of5 fice’). The purpose of the Office shall be to serve as a

6 source of advice for the President and to direct and over7 see agencies with respect to the development, use, and

8 management of information resources.

9 ‘‘(b) CHIEF INFORMATION OFFICER OF THE UNITED

10 STATES.—There shall be at the head of the Office a Chief

11 Information Officer of the United States (hereinafter in

12 this chapter referred to as the ‘Chief Information Offi13 cer’), who shall serve as a special assistant to, and report

14 directly to, the President. The Chief Information Officer

15 is appointed by the President, by and with the advice and

16 consent of the Senate, from among persons who have dem17 onstrated through practical experience in the public or pri18 vate sectors knowledge, skills, and leadership abilities in

19 the management and use of information resources nec20 essary for the performance of the functions required under

21 this chapter.

22 ‘‘(c) DEPUTY CHIEF INFORMATION OFFICER OF THE

23 UNITED STATES.—There shall be a Deputy Chief Infor24 mation Officer of the United States (hereinafter in this

25 chapter referred to as the ‘Deputy Chief Information Offi26 cer’), who shall carry out the duties and powers prescribed
13

•HR 5024 IH

1 by the Chief Information Officer, and acts as the Chief

2 Information Officer when the Chief Information Officer

3 is absent or unable to serve or when the office of Chief

4 Information Officer is vacant. The Deputy Chief Informa5 tion Officer is appointed by the President, by and with

6 the advice and consent of the Senate, from among persons

7 who have demonstrated through practical experience in

8 the public or private sectors knowledge, skills, and leader9 ship abilities in the management and use of information

10 resources necessary for the performance of the functions

11 required under this chapter.

12 ‘‘(d) ACTING CHIEF INFORMATION OFFICER.—When

13 the Chief Information Officer and Deputy Chief Informa14 tion Officer are absent or unable to serve or when the of15 fices of Chief Information Officer and Deputy Chief Infor16 mation Officer are vacant, the President may designate

17 an officer of the Office to act as the Chief Information

18 Officer.

19 ‘‘(e) EMPLOYEES.—The Chief Information Officer

20 shall appoint and fix the pay of employees of the Office

21 under regulations prescribed by the President.

22 ‘‘(f) NECESSARY EXPENDITURES.—The Chief Infor23 mation Officer may make necessary expenditures for the

24 Office under regulations prescribed by the President.
14

•HR 5024 IH

1 ‘‘(g) SUPPORT FROM OTHER AGENCIES.—Upon the

2 request of the Chief Information Officer, the head of an

3 agency shall, on a nonreimbursable basis, make services,

4 personnel, or facilities of the agency available to the Office

5 to assist in the performance of functions under this chap6 ter.

7 ‘‘§ 3504. Authority and functions of Chief Information

8 Officer

9 ‘‘(a) ADVISER TO THE PRESIDENT.—The Chief In10 formation Officer shall, to the extent that the President

11 determines appropriate and in the interest of the United

12 States, be the principal adviser to the President on mat13 ters relating to the efficient and effective development,

14 use, and management of information technology and other

15 information resources by the Federal Government.

16 ‘‘(b) OVERSIGHT OF INFORMATION RESOURCES

17 MANAGEMENT.—In addition to such other functions and

18 activities as the President may assign, the Chief Informa19 tion Officer shall oversee the use of information resources

20 to improve the efficiency and effectiveness of governmental

21 operations to serve agency missions. In performing such

22 oversight, the Chief Information Officer shall—

23 ‘‘(1) develop, coordinate, and oversee the imple24 mentation of uniform Federal information resources
15

•HR 5024 IH

1 management policies, principles, standards, and

2 guidelines;

3 ‘‘(2) provide direction and oversee activities of

4 agencies with regard to—

5 ‘‘(A) dissemination of and public access to

6 information;

7 ‘‘(B) statistical activities;

8 ‘‘(C) records management activities;

9 ‘‘(D) privacy, confidentiality, security, dis10 closure, and sharing of information; and

11 ‘‘(E) the acquisition and use of informa12 tion technology;

13 ‘‘(3) provide advice and assistance to agencies

14 and to the Director with respect to the collection of

15 information and control of paperwork burdens on

16 the public, consistent with the requirements of chap17 ter 36;

18 ‘‘(4) review and recommend to the President

19 and the Director changes to the budget and legisla20 tive proposals of agencies to provide more efficient

21 and effective use of information resources;

22 ‘‘(5) serve as the chairperson of the Chief Infor23 mation Officers Council established under section

24 3508;
16

•HR 5024 IH

1 ‘‘(6) notwithstanding any other provision of

2 law, direct and oversee all actions by the Adminis3 trator of General Services with regard to the provi4 sion of any information resources related services for

5 or on behalf of agencies, including the acquisition or

6 management of telecommunications or other infor7 mation technology or services;

8 ‘‘(7) direct, at his discretion, the use by the Ad9 ministrator of General Services of available budget

10 authority in the Information Technology Fund es11 tablished by section 110 of the Federal Property and

12 Administrative Services Act of 1949 (40 U.S.C.

13 757);

14 ‘‘(8) foster greater sharing, dissemination, and

15 access to public information, including through—

16 ‘‘(A) the use of the Government Informa17 tion Locator Service; and

18 ‘‘(B) the development and utilization of

19 common standards for information collection,

20 storage, processing, and communication, includ21 ing standards for security, interconnectivity,

22 and interoperability;

23 ‘‘(9) oversee the development and implementa24 tion of best practices in information resources man25 agement, including training;
17

•HR 5024 IH

1 ‘‘(10) oversee agency integration of program

2 and management functions with information re3 sources management functions; and

4 ‘‘(11)(i) with selected agencies and non-Federal

5 entities on a voluntary basis, conduct pilot projects

6 to test alternative policies, practices, regulations,

7 and procedures to fulfill the purposes of this chap8 ter; and

9 ‘‘(ii) for purposes of any pilot project conducted

10 under clause (i), in his discretion, after consultation

11 with the agency head, waive the application of any

12 administrative directive issued by an agency with

13 which the project is conducted, after giving timely

14 notice to the public and the Congress regarding the

15 need for such waiver.

16 ‘‘(c) INFORMATION COLLECTION.—With respect to

17 the collection of information and the control of paperwork,

18 the Chief Information Officer shall provide advice and as19 sistance to agencies and to the Director to promote effi20 cient and effective management of the collection of infor21 mation and the reduction of paperwork burdens on the

22 public, consistent with the requirements of chapter 36.

23 ‘‘(d) INFORMATION DISSEMINATION.—With respect

24 to information dissemination, the Chief Information Offi-
18

•HR 5024 IH

1 cer shall develop and oversee the implementation of poli2 cies, principles, standards, and guidelines to—

3 ‘‘(1) apply to Federal agency dissemination of

4 public information, regardless of the form or format

5 in which such information is disseminated; and

6 ‘‘(2) promote public access to public informa7 tion and fulfill the purposes of this chapter, includ8 ing through the effective use of information tech9 nology.

10 ‘‘(e) STATISTICS.—With respect to statistical policy

11 and coordination, the Chief Information Officer shall—

12 ‘‘(1) coordinate the activities of the Federal sta13 tistical system to ensure—

14 ‘‘(A) the efficiency and effectiveness of the

15 system; and

16 ‘‘(B) the integrity, objectivity, impartiality,

17 utility, and confidentiality of information col18 lected for statistical purposes;

19 ‘‘(2) consult with the Director to ensure that

20 budget proposals of agencies are consistent with sys21 temwide priorities for maintaining and improving

22 the quality of Federal statistics and prepare an an23 nual report on statistical program funding;
19

•HR 5024 IH

1 ‘‘(3) develop and oversee the implementation of

2 Governmentwide policies, principles, standards, and

3 guidelines concerning—

4 ‘‘(A) statistical collection procedures and

5 methods;

6 ‘‘(B) statistical data classification;

7 ‘‘(C) statistical information presentation

8 and dissemination;

9 ‘‘(D) timely release of statistical data; and

10 ‘‘(E) such statistical data sources as may

11 be required for the administration of Federal

12 programs;

13 ‘‘(4) evaluate statistical program performance

14 and agency compliance with Governmentwide poli15 cies, principles, standards, and guidelines;

16 ‘‘(5) promote the sharing of information col17 lected for statistical purposes consistent with privacy

18 rights and confidentiality pledges;

19 ‘‘(6) coordinate the participation of the United

20 States in international statistical activities, including

21 the development of comparable statistics;

22 ‘‘(7) appoint a chief statistician who is a

23 trained and experienced professional statistician to

24 carry out the functions described under this sub25 section;
20

•HR 5024 IH

1 ‘‘(8) establish an Interagency Council on Statis2 tical Policy to advise and assist the Chief Informa3 tion Officer in carrying out the functions under this

4 subsection that shall—

5 ‘‘(A) be headed by the chief statistician;

6 and

7 ‘‘(B) consist of—

8 ‘‘(i) the heads of the major statistical

9 programs; and

10 ‘‘(ii) representatives of other statis11 tical agencies under rotating membership;

12 and

13 ‘‘(9) provide opportunities for training in statis14 tical policy functions to employees of the Federal

15 Government under which—

16 ‘‘(A) each trainee shall be selected at the

17 discretion of the Chief Information Officer

18 based on agency requests and shall serve under

19 the chief statistician for at least 6 months and

20 not more than 1 year; and

21 ‘‘(B) all costs of the training shall be paid

22 by the agency requesting training.

23 ‘‘(f) RECORDS MANAGEMENT.—With respect to

24 records management, the Chief Information Officer

25 shall—
21

•HR 5024 IH

1 ‘‘(1) provide advice and assistance to the Archi2 vist of the United States and the Administrator of

3 General Services to promote coordination in the ad4 ministration of chapters 29, 31, and 33 of this title

5 with the information resources management policies,

6 principles, standards, and guidelines established

7 under this chapter;

8 ‘‘(2) review compliance by agencies with—

9 ‘‘(A) the requirements of chapters 29, 31,

10 and 33 of this title; and

11 ‘‘(B) regulations promulgated by the Ar12 chivist of the United States and the Adminis13 trator of General Services; and

14 ‘‘(3) oversee the application of records manage15 ment policies, principles, standards, and guidelines,

16 including requirements for archiving information

17 maintained in electronic format, in the planning and

18 design of information systems.

19 ‘‘(g) PRIVACY AND SECURITY.—With respect to pri20 vacy and security, the Chief Information Officer shall—

21 ‘‘(1) develop and oversee the implementation of

22 policies, principles, standards, and guidelines on pri23 vacy, confidentiality, security, disclosure, and shar24 ing of information collected or maintained by or for

25 agencies;
22

•HR 5024 IH

1 ‘‘(2) oversee and coordinate compliance with

2 sections 552 and 552a of title 5, sections 20 and 21

3 of the National Institute of Standards and Tech4 nology Act (15 U.S.C. 278g–3 and 278g–4), sections

5 5 and 6 of the Computer Security Act of 1987 (40

6 U.S.C. 759 note), chapters 37 and 38 of this title,

7 and related information management laws; and

8 ‘‘(3) require Federal agencies, consistent with

9 the standards and guidelines promulgated under sec10 tion 3812 of this title, sections 5 and 6 of the Com11 puter Security Act of 1987 (40 U.S.C. 759 note),

12 and chapter 37 of this title, to identify and afford

13 security protections commensurate with the risk and

14 magnitude of the harm resulting from the loss, mis15 use, or unauthorized access to or modification of in16 formation collected or maintained by or on behalf of

17 an agency.

18 ‘‘(h) INFORMATION TECHNOLOGY.—With respect to

19 Federal information technology, the Chief Information Of20 ficer shall—

21 ‘‘(1) in consultation with the Secretary of Com22 merce and the Chief Information Officers Council,

23 develop and oversee the implementation of policies,

24 principles, standards, and guidelines for information

25 technology functions and activities of the Federal
23

•HR 5024 IH

1 Government, as provided in this chapter and in

2 chapters 37 and 38 of this title, including through

3 periodic evaluations of major information systems;

4 and

5 ‘‘(2) oversee the effectiveness of, and compli6 ance with, directives issued under section 110 of the

7 Federal Property and Administrative Services Act of

8 1949 (40 U.S.C. 757);

9 ‘‘(3) provide advice and assistance to the Ad10 ministrator of the Office of Federal Procurement

11 Policy in the Office of Management and Budget to

12 ensure coordination of policies associated with Fed13 eral procurement and acquisition of information

14 technology with policies under this chapter;

15 ‘‘(4) ensure, through the review of agency budg16 et proposals, information resources management

17 plans and other means—

18 ‘‘(A) agency integration of information re19 sources management plans, program plans, and

20 budgets for acquisition and use of information

21 technology; and

22 ‘‘(B) the efficiency and effectiveness of

23 inter-agency information technology initiatives

24 to improve agency performance and the accom25 plishment of agency missions;
24

•HR 5024 IH

1 ‘‘(5) promote the use of information technology

2 by the Federal Government to improve the produc3 tivity, efficiency, and effectiveness of Federal pro4 grams, including through dissemination of public in5 formation and the reduction of information collection

6 burdens on the public;

7 ‘‘(6) provide leadership in innovative uses of in8 formation technology by agencies through support of

9 experimentation, testing, and adoption of innovative

10 concepts and technologies, particularly with regard

11 to multiagency initiatives and efforts to improve

12 communication and data exchange among all levels

13 of government and with the public, including by pro14 viding consolidated points of public access to govern15 ment services; and

16 ‘‘(7) consult with the heads of agencies that op17 erate national security systems to ensure effective

18 communication among all agencies concerning best

19 practices experiences in the development, use, and

20 management of information technology.

21 ‘‘(i) REQUIREMENTS OF LAW.—The authority of the

22 Chief Information Officer under this chapter shall be exer23 cised consistent with applicable law.
25

•HR 5024 IH

1 ‘‘§ 3505. Assignment of tasks and deadlines

2 ‘‘(a) STRATEGIC INFORMATION RESOURCES MAN3 AGEMENT PLAN.—In consultation with the Director, the

4 Administrator of General Services, the Director of the Na5 tional Institute of Standards and Technology, the Archi6 vist of the United States, the Director of the Office of

7 Personnel Management, and the Chief Information Officer

8 Council, the Chief Information Officer shall develop and

9 maintain a Governmentwide strategic plan for information

10 resources management, that shall include—

11 ‘‘(1) a description of the objectives and the

12 means by which the Federal Government shall apply

13 information resources to improve agency and pro14 gram performance;

15 ‘‘(2) plans for—

16 ‘‘(A) reducing information burdens on the

17 public, including reducing such burdens through

18 the elimination of duplication and meeting

19 shared data needs with shared resources, in ac20 cordance with the purposes of chapter 36 of

21 this title;

22 ‘‘(B) enhancing public access to and dis23 semination of, information, using electronic and

24 other formats; and

25 ‘‘(C) meeting the information technology

26 needs of the Federal Government in accordance
26

•HR 5024 IH

1 with the purposes of this chapter and chapter

2 38 of this title; and

3 ‘‘(3) a description of progress in applying infor4 mation resources management to improve agency

5 performance and the accomplishment of missions.

6 ‘‘(b) GOVERNMENT PAPERWORK ELIMINATION.—

7 ‘‘(1) USE AND ACCEPTANCE OF ELECTRONIC

8 SIGNATURES BY EXECUTIVE AGENCIES.—

9 ‘‘(A) DEVELOPMENT OF PROCEDURES.—

10 The Chief Information Officer shall, in con11 sultation with the Director and the Adminis12 trator of the National Telecommunications and

13 Information Administration and not later than

14 October 1, 2000, develop and implement proce15 dures for the use and acceptance of electronic

16 signatures by agencies.

17 ‘‘(B) REQUIREMENTS FOR PROCEDURES.—

18 ‘‘(i) The procedures developed under

19 subparagraph (A)—

20 ‘‘(I) shall be compatible with

21 standards and technology for elec22 tronic signatures that are generally

23 used in commerce and industry and

24 by State governments;
27

•HR 5024 IH

1 ‘‘(II) may not inappropriately

2 favor one industry or technology;

3 ‘‘(III) shall ensure that electronic

4 signatures are as reliable as is appro5 priate for the purpose in question and

6 keep intact the information submitted;

7 ‘‘(IV) shall provide for the elec8 tronic acknowledgment of electronic

9 forms that are successfully submitted;

10 and

11 ‘‘(V) shall, to the extent feasible

12 and appropriate, require an executive

13 agency that anticipates receipt by

14 electronic means of 50,000 or more

15 submittals of a particular form to

16 take all steps necessary to ensure that

17 multiple methods of electronic signa18 tures are available for the submittal of

19 such form.

20 ‘‘(ii) The Director shall ensure the

21 compatibility of the procedures under

22 clause (i)(I) in consultation with appro23 priate private bodies and State government

24 entities that set standards for the use and

25 acceptance of electronic signatures.
28

•HR 5024 IH

1 ‘‘(C) DEADLINE FOR USE AND ACCEPT2 ANCE OF ELECTRONIC SIGNATURES.—The Chief

3 Information Officer shall ensure that, com4 mencing not later than October 1, 2003, agen5 cies provide—

6 ‘‘(i) for the option of the electronic

7 maintenance, submission, or disclosure of

8 information, when practicable as a sub9 stitute for paper; and

10 ‘‘(ii) for the use and acceptance of

11 electronic signatures, when practicable.

12 ‘‘(2) ELECTRONIC STORAGE AND FILING OF

13 EMPLOYMENT FORMS.—The Chief Information Offi14 cer shall, in consultation with the Director and not

15 later than October 1, 2000, develop and implement

16 procedures to permit private employers to store and

17 file electronically with agencies forms containing in18 formation pertaining to the employees of such em19 ployers.

20 ‘‘(3) STUDY ON USE OF ELECTRONIC SIGNA21 TURES.—The Chief Information Officer shall, in

22 consultation with the Director and the Administrator

23 of the National Telecommunications and Informa24 tion Administration, conduct an ongoing study of,
29

•HR 5024 IH

1 and periodically report to Congress on, the use of

2 electronic signatures under this subsection on—

3 ‘‘(A) paperwork reduction and electronic

4 commerce;

5 ‘‘(B) individual privacy; and

6 ‘‘(C) the security and authenticity of trans7 actions.

8 ‘‘(4) ENFORCEABILITY AND LEGAL EFFECT OF

9 ELECTRONIC RECORDS.—Electronic records sub10 mitted or maintained in accordance with procedures

11 developed under this subsection, or electronic signa12 tures or other forms of electronic authentication

13 used in accordance with such procedures, shall not

14 be denied legal effect, validity, or enforceability be15 cause such records are in electronic form.

16 ‘‘(5) DISCLOSURE OF INFORMATION.—Except

17 as provided by law, information collected in the pro18 vision of electronic signature services for commu19 nications with an agency, as provided by this sub20 section shall only be used or disclosed by persons

21 who obtain, collect, or maintain such information as

22 a business or government practice, for the purpose

23 of facilitating such communications, or with the

24 prior affirmative consent of the person about whom

25 the information pertains.
30

•HR 5024 IH

1 ‘‘(6) APPLICATION WITH INTERNAL REVENUE

2 LAWS.—No provision of this subsection shall apply

3 to the Department of the Treasury or the Internal

4 Revenue Service to the extent that such provision—

5 ‘‘(A) involves the administration of the in6 ternal revenue laws; or

7 ‘‘(B) conflicts with any provision of the In8 ternal Revenue Service Restructuring and Re9 form Act of 1998 or the Internal Revenue Code

10 of 1986.

11 ‘‘(7) DEFINITION.—For purposes of this sub12 section, the term ‘electronic signature’ means a

13 method of signing an electronic message that—

14 ‘‘(A) identifies and authenticates a par15 ticular person as the source of the electronic

16 message; and

17 ‘‘(B) indicates such person’s approval of

18 the information contained in the electronic mes19 sage.

20 ‘‘(c) ELECTRONIC GOVERNMENT.—The Chief Infor21 mation Officer shall, assisted by the Chief Information Of22 ficers Council and other interested persons as selected by

23 the Chief Information Officer, monitor the implementation

24 of the requirements of subsection (b), the Electronic Sig-
31

•HR 5024 IH

1 natures in Global and National Commerce Act, and re2 lated laws to ensure that the Federal Government—

3 ‘‘(1) develops and maintains an efficient and ef4 fective information infrastructure for undertaking

5 government operations using electronic information

6 processes;

7 ‘‘(2) provides efficient and effective means for

8 members of the public to interact with the Federal

9 Government by means other than electronic informa10 tion processes; and

11 ‘‘(3) manages its increasing reliance on infor12 mation technology in a manner consistent with the

13 purposes and requirements of this chapter.

14 ‘‘(d) STUDY OF STANDARD SETTING PROCESS.—The

15 Chief Information Officer shall, in consultation with the

16 Secretary of Commerce, review the Federal information

17 systems standards setting process, established under sec18 tions 20 and 21 of the National Institute of Standards

19 and Technology Act (15 U.S.C. 278g–3 and 278g–4) and

20 section 3812 of this title, and report to the President on

21 the efficiency and effectiveness of the process and any rec22 ommendations for improving the process.

23 ‘‘(e) EVALUATION OF INFORMATION TECHNOLOGY

24 MANAGEMENT PROCESSES.—
32

•HR 5024 IH

1 ‘‘(1) The Chief Information Officer shall, not

2 later than one year after enactment of this chapter,

3 establish minimum evaluation criteria to be used for

4 independent evaluations of—

5 ‘‘(A) agency implementation of information

6 technology management processes and capabili7 ties required under sections 3805 and 3806 of

8 this title;

9 ‘‘(B) cost, schedule, risk, and return status

10 of major information management and tech11 nology initiatives; and

12 ‘‘(C) results of major information tech13 nology investments and programs in achieving

14 progress toward improvements in mission per15 formance and programmatic outcomes.

16 ‘‘(2) The head of each agency shall, not later

17 than two years after enactment of this chapter, have

18 performed an independent evaluation of the agency’s

19 information technology management processes and

20 capabilities, using criteria required under paragraph

21 (1).

22 ‘‘(3) Results of agency assessments required

23 under paragraph (2) shall be submitted not later

24 than October 1 of each year to the Chief Informa25 tion Officer, the Director, and the Congress.
33

•HR 5024 IH

1 ‘‘§ 3506. Federal agency responsibilities

2 ‘‘(a) GENERAL RESPONSIBILITIES.—

3 ‘‘(1) The head of each agency shall be respon4 sible for—

5 ‘‘(A) carrying out the agency’s information

6 resources management activities to improve

7 agency productivity, efficiency, and effective8 ness; and

9 ‘‘(B) complying with the requirements of

10 this chapter and related policies established by

11 the Chief Information Officer.

12 ‘‘(b) INFORMATION RESOURCES MANAGEMENT.—

13 With respect to general information resources manage14 ment, each agency shall—

15 ‘‘(1) manage information resources to—

16 ‘‘(A) reduce information collection burdens

17 on the public;

18 ‘‘(B) increase program efficiency and effec19 tiveness; and

20 ‘‘(C) improve the integrity, quality, and

21 utility of information to all users within and

22 outside the agency, including capabilities for en23 suring dissemination of public information, pub24 lic access to government information, and pro25 tections for privacy and security;
34

•HR 5024 IH

1 ‘‘(2) in accordance with guidance by the Chief

2 Information Officer, develop and maintain a stra3 tegic information resources management plan that

4 shall describe how information resources manage5 ment activities help accomplish agency missions;

6 ‘‘(3) develop and maintain an ongoing process

7 to—

8 ‘‘(A) ensure that information resources

9 management operations and decisions are inte10 grated with organizational planning, budget, fi11 nancial management, human resources manage12 ment, and program decisions;

13 ‘‘(B) in cooperation with the agency Chief

14 Financial Officer (or comparable official), de15 velop a full and accurate accounting of informa16 tion technology expenditures, related expenses,

17 and results; and

18 ‘‘(C) establish goals for improving informa19 tion resources management’s contribution to

20 program productivity, efficiency, and effective21 ness, methods for measuring progress toward

22 those goals, and clear roles and responsibilities

23 for achieving those goals;

24 ‘‘(4) in consultation with the Chief Information

25 Officer, the Director, the Administrator of General
35

•HR 5024 IH

1 Services, and the Archivist of the United States,

2 maintain a current and complete inventory of the

3 agency’s information resources, including directories

4 necessary to fulfill the requirements of section 3509;

5 and

6 ‘‘(5) in consultation with the Chief Information

7 Officer and the Director of the Office of Personnel

8 Management, conduct formal training programs to

9 educate agency program and management officials

10 about information resources management.

11 ‘‘(c) INFORMATION COLLECTION.—With respect to

12 information collection and the control of paperwork, each

13 agency shall comply with the requirements of chapter 36

14 and ensure that information resources are managed to

15 maximize efficiency and effectiveness while reducing pa16 perwork burdens on the public.

17 ‘‘(d) INFORMATION DISSEMINATION.—With respect

18 to information dissemination, each agency shall—

19 ‘‘(1) ensure that the public has timely and equi20 table access to the agency’s public information, in21 cluding ensuring such access through—

22 ‘‘(A) encouraging a diversity of public and

23 private sources for information based on gov24 ernment public information;
36

•HR 5024 IH

1 ‘‘(B) in cases in which the agency provides

2 public information maintained in electronic for3 mat, providing timely and equitable access to

4 the underlying data (in whole or in part); and

5 ‘‘(C) agency dissemination of public infor6 mation in an efficient, effective, and economical

7 manner;

8 ‘‘(2) regularly solicit and consider public input

9 on the agency’s information dissemination activities;

10 ‘‘(3) provide adequate notice when initiating,

11 substantially modifying, or terminating significant

12 information dissemination products; and

13 ‘‘(4) not, except where specifically authorized by

14 statute—

15 ‘‘(A) establish an exclusive, restricted, or

16 other distribution arrangement that interferes

17 with timely and equitable availability of public

18 information to the public;

19 ‘‘(B) restrict or regulate the use, resale, or

20 redissemination of public information by the

21 public;

22 ‘‘(C) charge fees or royalties for resale or

23 redissemination of public information; or

24 ‘‘(D) establish user fees for public informa25 tion that exceed the cost of dissemination.
37

•HR 5024 IH

1 ‘‘(e) STATISTICS.—With respect to statistical policy

2 and coordination, each agency shall—

3 ‘‘(1) ensure the relevance, accuracy, timeliness,

4 integrity, and objectivity of information collected or

5 created for statistical purposes;

6 ‘‘(2) inform respondents fully and accurately

7 about the sponsors, purposes, and uses of statistical

8 surveys and studies;

9 ‘‘(3) protect respondents’ privacy and ensure

10 that disclosure policies fully honor pledges of con11 fidentiality;

12 ‘‘(4) observe Federal standards and practices

13 for data collection, analysis, documentation, sharing,

14 and dissemination of information;

15 ‘‘(5) ensure the timely publication of the results

16 of statistical surveys and studies, including informa17 tion about the quality and limitations of the surveys

18 and studies; and

19 ‘‘(6) make data available to statistical agencies

20 and readily accessible to the public.

21 ‘‘(f) RECORDS MANAGEMENT.—With respect to

22 records management, each agency shall implement and en23 force applicable policies and procedures, including require24 ments for archiving information maintained in electronic
38

•HR 5024 IH

1 format, particularly in the planning, design, and operation

2 of information systems.

3 ‘‘(g) PRIVACY AND SECURITY.—With respect to pri4 vacy and security, each agency shall—

5 ‘‘(1) implement and enforce applicable policies,

6 procedures, standards, and guidelines on privacy,

7 confidentiality, security, disclosure, and sharing of

8 information collected or maintained by or for the

9 agency;

10 ‘‘(2) assume responsibility and accountability

11 for compliance with and coordinated management of

12 sections 552 and 552a of title 5, the Computer Se13 curity Act of 1987 (40 U.S.C. 759 note), chapter 37

14 of this title, and related information management

15 laws; and

16 ‘‘(3) consistent with the Computer Security Act

17 of 1987 (40 U.S.C. 759 note) and chapter 37 of this

18 title, identify and afford security protections com19 mensurate with the risk and magnitude of the harm

20 resulting from the loss, misuse, or unauthorized ac21 cess to or modification of information collected or

22 maintained by or on behalf of an agency.

23 ‘‘(h) INFORMATION TECHNOLOGY.—With respect to

24 Federal information technology, each agency shall—
39

•HR 5024 IH

1 ‘‘(1) implement and enforce applicable Govern2 mentwide and agency information technology man3 agement policies, principles, standards, and guide4 lines;

5 ‘‘(2) assume responsibility and accountability

6 for information technology investments;

7 ‘‘(3) promote the use of information technology

8 by the agency to improve the productivity, efficiency,

9 and effectiveness of agency programs, including the

10 reduction of information collection burdens on the

11 public and improved dissemination of public infor12 mation;

13 ‘‘(4) propose changes in legislation, regulations,

14 and agency procedures to improve information tech15 nology practices, including changes that improve the

16 ability of the agency to use technology to reduce

17 burden;

18 ‘‘(5) assume responsibility for maximizing the

19 value and assessing and managing the risks of major

20 information systems initiatives through a process

21 that is—

22 ‘‘(A) integrated with budget, financial, and

23 program management decisions; and
40

•HR 5024 IH

1 ‘‘(B) used to select, control, and evaluate

2 the results of major information systems initia3 tives; and

4 ‘‘(6) comply with the requirements of chapter

5 38 of this title.

6 ‘‘§ 3507. Agency chief information officers

7 ‘‘(a) DESIGNATION.—(1) Except as provided under

8 paragraph (2), the head of each agency shall designate

9 a chief information officer who shall report directly to such

10 agency head to carry out the responsibilities of the agency

11 under this chapter.

12 ‘‘(2) The Secretary of the Department of Defense

13 and the Secretary of each military department may each

14 designate chief information officers who shall report di15 rectly to such Secretary to carry out the responsibilities

16 of the department under this chapter. If more than one

17 chief information officer is designated, the respective du18 ties of the chief information officers shall be clearly delin19 eated.

20 ‘‘(b) GENERAL RESPONSIBILITIES.—(1) The chief in21 formation officer designated under subsection (a) shall

22 head an office responsible for ensuring agency compliance

23 with and prompt, efficient, and effective implementation

24 of the information policies and information resources man25 agement responsibilities established under this chapter, in-
41

•HR 5024 IH

1 cluding the reduction of information collection burdens on

2 the public. The chief information officer and employees of

3 such office shall be selected with special attention to the

4 professional qualifications required to administer the func5 tions described under this chapter.

6 ‘‘(2) Each agency program official shall be respon7 sible and accountable for information resources assigned

8 to and supporting the programs under such official. In

9 consultation with the chief information officer designated

10 under subsection (a) and the agency chief financial officer

11 (or comparable official), each agency program official shall

12 define program information needs and develop strategies,

13 systems, and capabilities to meet those needs.

14 ‘‘(3) The chief information officer designated under

15 subsection (a) shall be responsible for—

16 ‘‘(A) providing advice and other assistance to

17 the head of the agency and other senior management

18 personnel of the agency to ensure that information

19 technology is acquired and information resources are

20 managed for the agency in a manner that imple21 ments the policies and procedures of this chapter,

22 chapters 36, 37, and 38 of this title, and the prior23 ities established by the head of the agency;
42

•HR 5024 IH

1 ‘‘(B) developing, maintaining, and facilitating

2 the implementation of a sound and integrated infor3 mation technology architecture for the agency; and

4 ‘‘(C) promoting the effective and efficient de5 sign and operation of all major information re6 sources management processes for the agency, in7 cluding improvements to work processes of the agen8 cy.

9 ‘‘(c) DUTIES AND QUALIFICATIONS.—The chief infor10 mation officer of an agency that is listed in section 901(b)

11 of title 31 shall—

12 ‘‘(1) have information resources management

13 duties as that official’s primary duty;

14 ‘‘(2) monitor the performance of information

15 technology programs of the agency, evaluate the per16 formance of those programs on the basis of the ap17 plicable performance measurements, and advise the

18 head of the agency regarding whether to continue,

19 modify, or terminate a program or project; and

20 ‘‘(3) annually, as part of the strategic planning

21 and performance evaluation process required (sub22 ject to section 1117 of title 31) under section 306

23 of title 5 and sections 1105(a)(29), 1115, 1116,

24 1117, and 9703 of title 31—
43

•HR 5024 IH

1 ‘‘(A) assess the requirements established

2 for agency personnel regarding knowledge and

3 skill in information resources management and

4 the adequacy of such requirements for facili5 tating the achievement of the performance goals

6 established for information resources manage7 ment;

8 ‘‘(B) assess the extent to which the posi9 tions and personnel at the executive level of the

10 agency and the positions and personnel at man11 agement level of the agency below the executive

12 level meet those requirements;

13 ‘‘(C) in order to rectify any deficiency in

14 meeting those requirements, develop strategies

15 and specific plans for hiring, training, and pro16 fessional development; and

17 ‘‘(D) report to the head of the agency on

18 the progress made in improving information re19 sources management capability.

20 ‘‘§ 3508. Chief Information Officers Council

21 ‘‘(a) ESTABLISHMENT.—There is established in the

22 executive branch a ‘Chief Information Officers Council.’

23 ‘‘(b) MEMBERSHIP.—The members of the Chief In24 formation Officers Council are as follows:
44

•HR 5024 IH

1 ‘‘(1) The chief information officer of each agen2 cy that is listed in section 901(b) of title 31.

3 ‘‘(2) The chief information officer of each agen4 cy who is designated as a member of the Council by

5 the Chief Information Officer.

6 ‘‘(3) The Administrator of the Office of Infor7 mation and Regulatory Affairs in the Office of Man8 agement and Budget.

9 ‘‘(4) Other officers or employees of the Federal

10 Government designated by the Chief Information Of11 ficer.

12 ‘‘(c) ADMINISTRATIVE PROVISIONS.—

13 ‘‘(1) CHAIRMAN.—The Chief Information Offi14 cer is the Chairman of the Chief Information Offi15 cers Council.

16 ‘‘(2) DEPUTY CHAIRMAN.—

17 ‘‘(A) The Deputy Chairman of the Council

18 shall be selected by the Council from among its

19 members.

20 ‘‘(B) The Deputy Chairman shall serve a

21 one year term, and may serve multiple terms.

22 ‘‘(3) SUPPORT.—The Administrator of General

23 Services shall provide administrative and other sup24 port for the Council, including resources provided

25 through the Information Technology Fund estab-
45

•HR 5024 IH

1 lished by section 110 of the Federal Property and

2 Administrative Services Act of 1949 (40 U.S.C.

3 757).

4 ‘‘(d) FUNCTIONS.—The Chief Information Officers

5 Council shall—

6 ‘‘(1) assist and advise in the development and

7 implementation of Federal policies and practices

8 with regard to agency development, use, and man9 agement of information resources;

10 ‘‘(2) assist and advise the Chief Information

11 Officer in developing and maintaining the Govern12 mentwide strategic information resources manage13 ment plan required by section 3505(a);

14 ‘‘(3) assist and advise the Chief Information

15 Officer in the selection and coordination of—

16 ‘‘(A) multiagency initiatives to improve the

17 performance of agency missions through the use

18 of information technology and other information

19 resources; and

20 ‘‘(B) pilot projects to test alternative ap21 proaches for agencies to plan for, acquire, and

22 manage information technology and other infor23 mation resources;
46

•HR 5024 IH

1 ‘‘(4) coordinate and monitor the development

2 and use of common performance measures for agen3 cy information resources management activities;

4 ‘‘(5) coordinate the acquisition and provision of

5 common infrastructure services to facilitate commu6 nication and data exchange among agencies and

7 with State, local, and tribal governments;

8 ‘‘(6) review and make recommendations to ad9 dress the hiring, training, classification, and profes10 sional development needs of agencies with regard to

11 the development, use, and management of informa12 tion resources;

13 ‘‘(7) review and make recommendations with

14 regard to information systems standards, including

15 those developed under section 20 of the National In16 stitute of Standards and Technology Act (15 U.S.C.

17 278g–3) and section 3812 of this title;

18 ‘‘(8) consult with appropriate individuals and

19 organizations at all levels of government and the pri20 vate sector to enhance understanding of opportuni21 ties to improve the development, application, and

22 management of information resources to serve public

23 needs; and

24 ‘‘(9) consult with appropriate agencies to facili25 tate effective participation by the Federal Govern-
47

•HR 5024 IH

1 ment in international information-related activities

2 and organizations.

3 ‘‘§ 3509. Establishment and operation of Government

4 Information Locator Service

5 ‘‘(a) In order to assist agencies and the public in lo6 cating information and to promote information sharing

7 and equitable access by the public, the Chief Information

8 Officer shall—

9 ‘‘(1) cause to be established and maintained a

10 distributed agency-based electronic Government In11 formation Locator Service (hereafter in this section

12 referred to as the ‘Service’), which shall identify the

13 major information systems, holdings, and dissemina14 tion products of each agency;

15 ‘‘(2) require each agency to establish and main16 tain an agency information locator service as a com17 ponent of, and to support the establishment and op18 eration of the Service;

19 ‘‘(3) in cooperation with the Director, the Ar20 chivist of the United States, the Administrator of

21 General Services, the Public Printer, and the Librar22 ian of Congress, establish an interagency committee

23 to advise the Secretary of Commerce on the develop24 ment of technical standards for the Service to ensure
48

•HR 5024 IH

1 compatibility, promote information sharing, and uni2 form access by the public;

3 ‘‘(4) consider public access and other user

4 needs in the establishment and operation of the

5 Service;

6 ‘‘(5) ensure the security and integrity of the

7 Service, including measures to ensure that only in8 formation which is intended to be disclosed to the

9 public is disclosed through the Service; and

10 ‘‘(6) periodically review the development and ef11 fectiveness of the Service and make recommenda12 tions for improvement, including other mechanisms

13 for improving public access to Federal agency public

14 information.

15 ‘‘(b) This section shall not apply to operational files

16 as defined by the Central Intelligence Agency Information

17 Act (50 U.S.C. 431 et seq.).

18 ‘‘§ 3510. Chief Information Officer review of agency

19 activities; reporting; agency response

20 ‘‘(a) In consultation with the Director, the Adminis21 trator of General Services, the Archivist of the United

22 States, the Director of the National Institute of Standards

23 and Technology, and the Director of the Office of Per24 sonnel Management, the Chief Information Officer shall

25 periodically review selected agency information resources
49

•HR 5024 IH

1 management activities to ascertain the efficiency and ef2 fectiveness of such activities to improve agency perform3 ance and the accomplishment of agency missions.

4 ‘‘(b) Each agency having an activity reviewed under

5 subsection (a) shall, within 60 days after receipt of a re6 port on the review, provide a written plan to the Chief

7 Information Officer describing steps (including mile8 stones) to—

9 ‘‘(1) be taken to address information resources

10 management problems identified in the report; and

11 ‘‘(2) improve agency performance and the ac12 complishment of agency missions.

13 ‘‘§ 3511. Report to Congress

14 The Chief Information Officer shall submit an annual

15 report to the President and the Congress describing—

16 ‘‘(1) efforts undertaken by the Chief Informa17 tion Officer to improve the development, application,

18 and management of information resources,

19 including—

20 ‘‘(A) the results of major information tech21 nology initiatives, including those funded by the

22 Information Technology Fund; and

23 ‘‘(B) recommendations to improve Federal

24 policies and practices with regard to the devel-
50

•HR 5024 IH

1 opment, use, and management of information

2 resources; and

3 ‘‘(2) the results of major activities undertaken

4 by the Chief Information Officers Council to carry

5 out the functions under section 3508.

6 ‘‘§ 3512. Rules and regulations

7 ‘‘(a) The Chief Information Officer shall promulgate

8 rules, regulations, or procedures necessary to exercise the

9 authority provided by this chapter.

10 ‘‘(b) In developing information resources manage11 ment policies, plans, rules, regulations, procedures, and

12 guidelines, the Chief Information Officer shall provide in13 terested agencies and persons early and meaningful oppor14 tunity to comment.

15 ‘‘§ 3513. Effect on existing laws and regulations

16 ‘‘Except as otherwise provided in this chapter, the au17 thority of an agency under any other law to prescribe poli18 cies, rules, regulations, and procedures for Federal infor19 mation resources management activities is subject to the

20 authority of the Chief Information Officer under this

21 chapter.

22 ‘‘§ 3514. Access to information

23 ‘‘Under the conditions and procedures prescribed in

24 section 716 of title 31, the Director and personnel in the

25 Office of Information and Regulatory Affairs shall furnish
51

•HR 5024 IH

1 such information as the Comptroller General may require

2 for the discharge of the responsibilities of the Comptroller

3 General. For the purpose of obtaining such information,

4 the Comptroller General or representatives thereof shall

5 have access to all books, documents, papers, and records,

6 regardless of form or format, of the Office.

7 ‘‘§ 3515. Application to national security systems

8 ‘‘Notwithstanding the exemption of national security

9 systems from the term ‘information technology,’ the head

10 of an agency responsible for a national security system

11 shall—

12 ‘‘(1) comply with the provisions of this chapter

13 with regard to information technology other than

14 such national security system; and

15 ‘‘(2) consult with the Chief Information Officer

16 to ensure effective communication concerning best

17 practices experiences in the development, use, and

18 management of information technology, including

19 national security systems.

20 ‘‘§ 3516. Authorization of appropriations

21 ‘‘There are authorized to be appropriated to carry out

22 the provisions of this chapter, to remain available until

23 expended, such sums as may be necessary for each of fis24 cal years 2001 through 2005.’’.
52

•HR 5024 IH

1 SEC. 4. PAPERWORK REDUCTION.

2 Title 44, United States Code, is amended by inserting

3 after chapter 35 the following:

4 ‘‘CHAPTER 36—PAPERWORK REDUCTION

‘‘Sec.

‘‘3601. Purposes.

‘‘3602. Definitions.

‘‘3603. Office of Information and Regulatory Affairs.

‘‘3604. Authority and functions of Director.

‘‘3605. Assignment of tasks and deadlines.

‘‘3606. Federal agency responsibilities.

‘‘3607. Public information collection activities; submission to Director; approval

and delegation.

‘‘3608. Determination of necessity for information; hearing.

‘‘3609. Designation of central collection agency.

‘‘3610. Cooperation of agencies in making information available.

‘‘3611. Use of the Government Information Locator Service.

‘‘3612. Public protection.

‘‘3613. Director review of agency activities; reporting; agency response.

‘‘3614. Responsiveness to Congress.

‘‘3615. Administrative powers.

‘‘3616. Rules and regulations.

‘‘3617. Consultation with other agencies and the public.

‘‘3618. Effect on existing laws and regulations.

‘‘3619. Access to information.

‘‘3620. Authorization of appropriations.

5 ‘‘CHAPTER 36—PAPERWORK REDUCTION

6 ‘‘§ 3601. Purposes

7 ‘‘The purposes of this chapter are to—

8 ‘‘(1) minimize the paperwork burden for indi9 viduals, small businesses, educational and nonprofit

10 institutions, Federal contractors, State, local, and

11 tribal governments, and other persons resulting from

12 the collection of information by or for the Federal

13 Government;
53

•HR 5024 IH

1 ‘‘(2) ensure the greatest possible public benefit

2 from and maximize the utility of information col3 lected by or for the Federal Government;

4 ‘‘(3) coordinate agency information collection

5 activities with other information resources manage6 ment activities as a means to improve the produc7 tivity, efficiency, and effectiveness of Government

8 programs, including the reduction of information col9 lection burdens on the public and the improvement

10 of service delivery to the public;

11 ‘‘(4) improve the quality and use of Federal in12 formation to strengthen decisionmaking, account13 ability, and openness in Government and society;

14 ‘‘(5) minimize the cost to the Federal Govern15 ment of the collection of information;

16 ‘‘(6) strengthen the partnership between the

17 Federal Government and State, local, and tribal gov18 ernments by minimizing the burden and maximizing

19 the utility of information collected and retained by

20 or for the Federal Government;

21 ‘‘(7) ensure that the collection of information

22 by or for the Federal Government is consistent with

23 applicable laws, including laws relating to—

24 ‘‘(A) privacy and confidentiality, including

25 section 552a of title 5;
54

•HR 5024 IH

1 ‘‘(B) security of information, including the

2 Computer Security Act of 1987 (Public Law

3 100–235); and

4 ‘‘(C) access to information, including sec5 tion 552 of title 5;

6 ‘‘(8) ensure the integrity, quality, and utility of

7 information collected for statistical purposes; and

8 ‘‘(9) improve the responsibility and account9 ability of the Office of Management and Budget and

10 all other Federal agencies to Congress and to the

11 public for implementing the information collection

12 review process, and related policies and guidelines

13 established under this chapter.

14 ‘‘§ 3602. Definitions

15 ‘‘(a) The definitions in section 3502 of this title shall

16 apply to this chapter.

17 ‘‘(b) As used in this chapter—

18 ‘‘(1) the term ‘burden’ means time, effort, or fi19 nancial resources expended by persons to generate,

20 maintain, or provide information to or for a Federal

21 agency, including the resources expended for—

22 ‘‘(A) reviewing instructions;

23 ‘‘(B) acquiring, installing, and utilizing

24 technology and systems;
55

•HR 5024 IH

1 ‘‘(C) adjusting the existing ways to comply

2 with any previously applicable instructions and

3 requirements;

4 ‘‘(D) searching data sources;

5 ‘‘(E) completing and reviewing the collec6 tion of information; and

7 ‘‘(F) transmitting, or otherwise disclosing

8 the information;

9 ‘‘(2) the term ‘collection of information’—

10 ‘‘(A) means the obtaining, causing to be

11 obtained, soliciting, or requiring the disclosure

12 to third parties or the public, of facts or opin13 ions by or for an agency, regardless of form or

14 format, calling for either—

15 ‘‘(i) answers to identical questions

16 posed to, or identical reporting or record17 keeping requirements imposed on, ten or

18 more persons, other than agencies, instru19 mentalities, or employees of the United

20 States; or

21 ‘‘(ii) answers to questions posed to

22 agencies, instrumentalities, or employees of

23 the United States which are to be used for

24 general statistical purposes; and
56

•HR 5024 IH

1 ‘‘(B) shall not include a collection of infor2 mation described under section 3618(c)(1);

3 ‘‘(3) the term ‘practical utility’ means the abil4 ity of an agency to use information, particularly the

5 capability to process such information in a timely

6 and useful fashion;

7 ‘‘(4) the term ‘recordkeeping requirement’

8 means a requirement imposed by or for an agency

9 on persons to maintain specified records, including a

10 requirement to—

11 ‘‘(A) retain such records;

12 ‘‘(B) notify third parties, the Federal Gov13 ernment, or the public of the existence of such

14 records;

15 ‘‘(C) disclose such records to third parties,

16 the Federal Government, or the public; or

17 ‘‘(D) report to third parties, the Federal

18 Government, or the public regarding such

19 records; and

20 ‘‘(5) the term ‘penalty’ includes the imposition

21 by an agency or court of a fine or other punishment;

22 a judgment for monetary damages or equitable re23 lief; or the revocation, suspension, reduction, or de24 nial of a license, privilege, right, grant, or benefit.
57

•HR 5024 IH

1 ‘‘§ 3603. Office of Information and Regulatory Affairs

2 ‘‘(a) There is established in the Office of Manage3 ment and Budget an office to be known as the Office of

4 Information and Regulatory Affairs.

5 ‘‘(b) There shall be at the head of the Office an Ad6 ministrator who shall be appointed by the President, by

7 and with the advice and consent of the Senate. The Direc8 tor shall delegate to the Administrator the authority to

9 administer all functions under this chapter, except that

10 any such delegation shall not relieve the Director of re11 sponsibility for the administration of such functions.

12 ‘‘§ 3604. The authority and functions of the Director

13 ‘‘(a) With respect to the collection of information and

14 the control of paperwork, the Director shall—

15 ‘‘(1) review and approve proposed agency collec16 tions of information;

17 ‘‘(2) minimize the Federal information collec18 tion burden, with particular emphasis on those indi19 viduals and entities most adversely affected;

20 ‘‘(3) maximize the practical utility of and public

21 benefit from information collected by or for the Fed22 eral Government;

23 ‘‘(4) establish and oversee standards and guide24 lines by which agencies are to estimate the burden

25 to comply with a proposed collection of information;
58

•HR 5024 IH

1 ‘‘(5) coordinate activities under this chapter

2 with the activities of the Chief Information Officer

3 under chapter 35;

4 ‘‘(6) coordinate the review of the collection of

5 information associated with Federal procurement

6 and acquisition by the Office of Information and

7 Regulatory Affairs with the Office of Federal Pro8 curement Policy, with particular emphasis on apply9 ing information technology to improve the efficiency

10 and effectiveness of Federal procurement, acquisi11 tion, and payment, and to reduce information collec12 tion burdens on the public; and

13 ‘‘(7) initiate and review proposals for changes

14 in legislation, regulations, and agency procedures to

15 improve information collection practices and reduce

16 information collection burdens on the public.

17 ‘‘(b) The authority of the Director under this chapter

18 shall be exercised consistent with applicable law.

19 ‘‘§ 3605. Assignment of tasks and deadlines

20 ‘‘(a) In carrying out the functions under this chapter,

21 the Director shall—

22 ‘‘(1) in consultation with agency heads, set an

23 annual Governmentwide goal for the reduction of in24 formation collection burdens by at least 5 percent

25 during each of fiscal years 2001, 2002, 2003, 2004,
59

•HR 5024 IH

1 and 2005, and set annual agency goals to reduce

2 information collection burdens imposed on the public

3 that—

4 ‘‘(A) represent the maximum practicable

5 opportunity in each agency; and

6 ‘‘(B) are consistent with improving agency

7 management of the process for the review of

8 collections of information established under sec9 tion 3606; and

10 ‘‘(2) with selected agencies and non-Federal en11 tities on a voluntary basis, conduct pilot projects to

12 test alternative policies, practices, regulations, and

13 procedures to fulfill the purposes of this chapter;

14 and

15 ‘‘(3) assist the Chief Information Officer to de16 velop and maintain a Governmentwide strategic plan

17 for information resources management, particularly

18 with regards to reducing information burdens on the

19 public, including reducing such burdens through the

20 elimination of duplication and meeting shared data

21 needs with shared resources.

22 ‘‘(b) For purposes of any pilot project conducted

23 under subsection (a)(2), the Director may, after consulta24 tion with the agency head, waive the application of any

25 administrative directive issued by an agency with which
60

•HR 5024 IH

1 the project is conducted, including any directive requiring

2 a collection of information, after giving timely notice to

3 the public and the Congress regarding the need for such

4 waiver.

5 ‘‘§ 3606. Federal agency responsibilities

6 ‘‘(a) Each agency shall establish a process within the

7 office headed by the chief information officer designated

8 under section 3507 of this title, that is sufficiently inde9 pendent of program responsibility to evaluate fairly wheth10 er proposed collections of information should be approved

11 under this chapter, to—

12 ‘‘(1) review each collection of information before

13 submission to the Director for review under this

14 chapter, including—

15 ‘‘(A) an evaluation of the need for the col16 lection of information;

17 ‘‘(B) a functional description of the infor18 mation to be collected;

19 ‘‘(C) a plan for the collection of the infor20 mation;

21 ‘‘(D) a specific, objectively supported esti22 mate of burden;

23 ‘‘(E) a test of the collection of information

24 through a pilot program, if appropriate; and
61

•HR 5024 IH

1 ‘‘(F) a plan for the efficient and effective

2 management and use of the information to be

3 collected, including necessary resources;

4 ‘‘(2) ensure that each information collection—

5 ‘‘(A) is inventoried, displays a control

6 number and, if appropriate, an expiration date;

7 ‘‘(B) indicates the collection is in accord8 ance with the clearance requirements of section

9 3607; and

10 ‘‘(C) informs the person receiving the col11 lection of information of—

12 ‘‘(i) the reasons the information is

13 being collected;

14 ‘‘(ii) the way such information is to be

15 used;

16 ‘‘(iii) an estimate, to the extent prac17 ticable, of the burden of the collection;

18 ‘‘(iv) whether responses to the collec19 tion of information are voluntary, required

20 to obtain a benefit, or mandatory; and

21 ‘‘(v) the fact that an agency may not

22 conduct or sponsor, and a person is not re23 quired to respond to, a collection of infor24 mation unless it displays a valid control

25 number; and
62

•HR 5024 IH

1 ‘‘(3) assess the information collection burden of

2 proposed legislation affecting the agency.

3 ‘‘(b) Each agency shall—

4 ‘‘(1) except as provided under paragraph (2) or

5 section 3607(j), provide a 60-day notice in the Fed6 eral Register, and otherwise consult with members of

7 the public and affected agencies concerning each

8 proposed collection of information, to solicit com9 ment to—

10 ‘‘(A) evaluate whether the proposed collec11 tion of information is necessary for the proper

12 performance of the functions of the agency, in13 cluding whether the information shall have

14 practical utility;

15 ‘‘(B) evaluate the accuracy of the agency’s

16 estimate of the burden of the proposed collec17 tion of information;

18 ‘‘(C) enhance the quality, utility, and clar19 ity of the information to be collected; and

20 ‘‘(D) minimize the burden of the collection

21 of information on those who are to respond, in22 cluding through the use of automated collection

23 techniques or other forms of information tech24 nology; and
63

•HR 5024 IH

1 ‘‘(2) for any proposed collection of information

2 contained in a proposed rule (to be reviewed by the

3 Director under section 3607(d)), provide notice and

4 comment through the notice of proposed rulemaking

5 for the proposed rule and such notice shall have the

6 same purposes specified under paragraph (1)(A) and

7 (B).

8 ‘‘(c) Each agency shall certify (and provide a record

9 supporting such certification, including public comments

10 received by the agency) that each collection of information

11 submitted to the Director for review under section 3607—

12 ‘‘(1) is necessary for the proper performance of

13 the functions of the agency, including that the infor14 mation has practical utility;

15 ‘‘(2) is not unnecessarily duplicative of informa16 tion otherwise reasonably accessible to the agency;

17 ‘‘(3) reduces to the extent practicable and ap18 propriate the burden on persons who shall provide

19 information to or for the agency, including with re20 spect to small entities, as defined under section

21 601(6) of title 5, the use of such techniques as—

22 ‘‘(A) establishing differing compliance or

23 reporting requirements or timetables that take

24 into account the resources available to those

25 who are to respond;
64

•HR 5024 IH

1 ‘‘(B) the clarification, consolidation, or

2 simplification of compliance and reporting re3 quirements; or

4 ‘‘(C) an exemption from coverage of the

5 collection of information, or any part thereof;

6 ‘‘(i) is written using plain, coherent,

7 and unambiguous terminology and is un8 derstandable to those who are to respond;

9 ‘‘(ii) is to be implemented in ways

10 consistent and compatible, to the max11 imum extent practicable, with the existing

12 reporting and recordkeeping practices of

13 those who are to respond;

14 ‘‘(iii) indicates for each recordkeeping

15 requirement the length of time persons are

16 required to maintain the records specified;

17 ‘‘(iv) contains the statement required

18 under subsection (a)(2)(C);

19 ‘‘(v) has been developed by an office

20 that has planned and allocated resources

21 for the efficient and effective management

22 and use of the information to be collected,

23 including the processing of the information

24 in a manner which shall enhance, where
65

•HR 5024 IH

1 appropriate, the utility of the information

2 to agencies and the public;

3 ‘‘(vi) uses effective and efficient sta4 tistical survey methodology appropriate to

5 the purpose for which the information is to

6 be collected; and

7 ‘‘(vii) to the maximum extent prac8 ticable, uses information technology to re9 duce burden and improve data quality,

10 agency efficiency and responsiveness to the

11 public.

12 ‘‘§ 3607. Public information collection activities; sub13 mission to Director; approval and delega14 tion

15 ‘‘(a) An agency shall not conduct or sponsor the col16 lection of information unless in advance of the adoption

17 or revision of the collection of information—

18 ‘‘(1) the agency has—

19 ‘‘(A) conducted the review established

20 under section 3606(a);

21 ‘‘(B) evaluated the public comments re22 ceived under section 3606(b);

23 ‘‘(C) submitted to the Director the certifi24 cation required under section 3606(c), the pro25 posed collection of information, copies of perti-
66

•HR 5024 IH

1 nent statutory authority, regulations, and other

2 related materials as the Director may specify;

3 and

4 ‘‘(D) published a notice in the Federal

5 Register—

6 ‘‘(i) stating that the agency has made

7 such submission; and

8 ‘‘(ii) setting forth—

9 ‘‘(I) a title for the collection of

10 information;

11 ‘‘(II) a summary of the collection

12 of information;

13 ‘‘(III) a brief description of the

14 need for the information and the pro15 posed use of the information;

16 ‘‘(IV) a description of the likely

17 respondents and proposed frequency

18 of response to the collection of infor19 mation;

20 ‘‘(V) an estimate of the burden

21 that shall result from the collection of

22 information; and

23 ‘‘(VI) notice that comments may

24 be submitted to the agency and the

25 Director;
67

•HR 5024 IH

1 ‘‘(2) the Director has approved the proposed

2 collection of information or approval has been in3 ferred, under the provisions of this section; and

4 ‘‘(3) the agency has obtained from the Director

5 a control number to be displayed upon the collection

6 of information.

7 ‘‘(b) The Director shall provide at least 30 days for

8 public comment prior to making a decision under sub9 section (c), (d), or (h), except as provided under sub10 section (j).

11 ‘‘(c)(1) For any proposed collection of information

12 not contained in a proposed rule, the Director shall notify

13 the agency involved of the decision to approve or dis14 approve the proposed collection of information.

15 ‘‘(2) The Director shall provide the notification under

16 paragraph (1), within 60 days after receipt or publication

17 of the notice under subsection (a)(1)(D), whichever is

18 later.

19 ‘‘(3) If the Director does not notify the agency of a

20 denial or approval within the 60-day period described

21 under paragraph (2)—

22 ‘‘(A) the approval may be inferred;

23 ‘‘(B) a control number shall be assigned with24 out further delay; and
68

•HR 5024 IH

1 ‘‘(C) the agency may collect the information for

2 not more than 1 year.

3 ‘‘(d)(1) For any proposed collection of information

4 contained in a proposed rule—

5 ‘‘(A) as soon as practicable, but no later than

6 the date of publication of a notice of proposed rule7 making in the Federal Register, each agency shall

8 forward to the Director a copy of any proposed rule

9 which contains a collection of information and any

10 information requested by the Director necessary to

11 make the determination required under this sub12 section; and

13 ‘‘(B) within 60 days after the notice of pro14 posed rulemaking is published in the Federal Reg15 ister, the Director may file public comments pursu16 ant to the standards set forth in section 3608 on the

17 collection of information contained in the proposed

18 rule.

19 ‘‘(2) When a final rule is published in the Federal

20 Register, the agency shall explain—

21 ‘‘(A) how any collection of information con22 tained in the final rule responds to the comments,

23 if any, filed by the Director or the public; or

24 ‘‘(B) the reasons such comments were rejected.
69

•HR 5024 IH

1 ‘‘(3) If the Director has received notice and failed to

2 comment on an agency rule within 60 days after the notice

3 of proposed rulemaking, the Director may not disapprove

4 any collection of information specifically contained in an

5 agency rule.

6 ‘‘(4) No provision in this section shall be construed

7 to prevent the Director, in the Director’s discretion—

8 ‘‘(A) from disapproving any collection of infor9 mation which was not specifically required by an

10 agency rule;

11 ‘‘(B) from disapproving any collection of infor12 mation contained in an agency rule, if the agency

13 failed to comply with the requirements of paragraph

14 (1);

15 ‘‘(C) from disapproving any collection of infor16 mation contained in a final agency rule, if the Direc17 tor finds within 60 days after the publication of the

18 final rule that the agency’s response to the Direc19 tor’s comments filed under paragraph (2) was un20 reasonable; or

21 ‘‘(D) from disapproving any collection of infor22 mation contained in a final rule, if—

23 ‘‘(i) the Director determines that the agen24 cy has substantially modified in the final rule
70

•HR 5024 IH

1 the collection of information contained in the

2 proposed rule; and

3 ‘‘(ii) the agency has not given the Director

4 the information required under paragraph (1)

5 with respect to the modified collection of infor6 mation, at least 60 days before the issuance of

7 the final rule.

8 ‘‘(5) This subsection shall apply only when an agency

9 publishes a notice of proposed rulemaking and requests

10 public comments.

11 ‘‘(6) The decision by the Director to approve or not

12 act upon a collection of information contained in an agen13 cy rule shall not be subject to judicial review.

14 ‘‘(e)(1) Any decision by the Director under subsection

15 (c), (d), (h), or (j) to disapprove a collection of informa16 tion, or to instruct the agency to make substantive or ma17 terial change to a collection of information, shall be pub18 licly available and include an explanation of the reasons

19 for such decision.

20 ‘‘(2) Any written communication between the Admin21 istrator of the Office of Information and Regulatory Af22 fairs, or any employee of the Office of Information and

23 Regulatory Affairs, and an agency or person not employed

24 by the Federal Government concerning a proposed collec25 tion of information shall be made available to the public.
71

•HR 5024 IH

1 ‘‘(3) This subsection shall not require the disclosure

2 of—

3 ‘‘(A) any information which is protected at all

4 times by procedures established for information

5 which has been specifically authorized under criteria

6 established by an Executive order or an Act of Con7 gress to be kept secret in the interest of national de8 fense or foreign policy; or

9 ‘‘(B) any communication relating to a collection

10 of information which is not approved under this

11 chapter, the disclosure of which could lead to retalia12 tion or discrimination against the communicator.

13 ‘‘(f)(1) An independent regulatory agency which is

14 administered by 2 or more members of a commission,

15 board, or similar body, may by majority vote void—

16 ‘‘(A) any disapproval by the Director, in whole

17 or in part, of a proposed collection of information of

18 that agency; or

19 ‘‘(B) an exercise of authority under subsection

20 (d) of section 3607 concerning that agency.

21 ‘‘(2) The agency shall certify each vote to void such

22 disapproval or exercise to the Director, and explain the

23 reasons for such vote. The Director shall without further

24 delay assign a control number to such collection of infor-
72

•HR 5024 IH

1 mation, and such vote to void the disapproval or exercise

2 shall be valid for a period of 3 years.

3 ‘‘(g) The Director may not approve a collection of in4 formation for a period in excess of 3 years.

5 ‘‘(h)(1) If an agency decides to seek extension of the

6 Director’s approval granted for a currently approved col7 lection of information, the agency shall—

8 ‘‘(A) conduct the review established under sec9 tion 3606(c), including the seeking of comment from

10 the public on the continued need for, and burden im11 posed by the collection of information; and

12 ‘‘(B) after having made a reasonable effort to

13 seek public comment, but no later than 60 days be14 fore the expiration date of the control number as15 signed by the Director for the currently approved

16 collection of information, submit the collection of in17 formation for review and approval under this sec18 tion, which shall include an explanation of how the

19 agency has used the information that it has col20 lected.

21 ‘‘(2) If under the provisions of this section, the Direc22 tor disapproves a collection of information contained in an

23 existing rule, or recommends or instructs the agency to

24 make a substantive or material change to a collection of
73

•HR 5024 IH

1 information contained in an existing rule, the Director

2 shall—

3 ‘‘(A) publish an explanation thereof in the Fed4 eral Register; and

5 ‘‘(B) instruct the agency to undertake a rule6 making within a reasonable time limited to consider7 ation of changes to the collection of information con8 tained in the rule and thereafter to submit the col9 lection of information for approval or disapproval

10 under this chapter.

11 ‘‘(3) An agency may not make a substantive or mate12 rial modification to a collection of information after such

13 collection has been approved by the Director, unless the

14 modification has been submitted to the Director for review

15 and approval under this chapter.

16 ‘‘(i)(1) If the Director finds that a chief information

17 officer of an agency designated under section 3507 is suf18 ficiently independent of program responsibility to evaluate

19 fairly whether proposed collections of information should

20 be approved and has sufficient resources to carry out this

21 responsibility effectively, the Director may, by rule in ac22 cordance with the notice and comment provisions of chap23 ter 5 of title 5, delegate to such official the authority to

24 approve proposed collections of information in specific pro-
74

•HR 5024 IH

1 gram areas, for specific purposes, or for all agency pur2 poses.

3 ‘‘(2) A delegation by the Director under this section

4 shall not preclude the Director from reviewing individual

5 collections of information if the Director determines that

6 circumstances warrant such a review. The Director shall

7 retain authority to revoke such delegations, both in gen8 eral and with regard to any specific matter. In acting for

9 the Director, any official to whom approval authority has

10 been delegated under this section shall comply fully with

11 the rules and regulations promulgated by the Director.

12 ‘‘(j)(1) The agency head may request the Director to

13 authorize a collection of information, if an agency head

14 determines that—

15 ‘‘(A) a collection of information—

16 ‘‘(i) is needed prior to the expiration of

17 time periods established under this chapter; and

18 ‘‘(ii) is essential to the mission of the agen19 cy; and

20 ‘‘(B) the agency cannot reasonably comply with

21 the provisions of this chapter because—

22 ‘‘(i) public harm is reasonably likely to re23 sult if normal clearance procedures are fol24 lowed;
75

•HR 5024 IH

1 ‘‘(ii) an unanticipated event has occurred;

2 or

3 ‘‘(iii) the use of normal clearance proce4 dures is reasonably likely to prevent or disrupt

5 the collection of information or is reasonably

6 likely to cause a statutory or court ordered

7 deadline to be missed.

8 ‘‘(2) The Director shall approve or disapprove any

9 such authorization request within the time requested by

10 the agency head and, if approved, shall assign the collec11 tion of information a control number. Any collection of

12 information conducted under this subsection may be con13 ducted without compliance with the provisions of this

14 chapter for a maximum of 90 days after the date on which

15 the Director received the request to authorize such collec16 tion.

17 ‘‘§ 3608. Determination of necessity for information;

18 hearing

19 ‘‘Before approving a proposed collection of informa20 tion, the Director shall determine whether the collection

21 of information by the agency is necessary for the proper

22 performance of the functions of the agency, including

23 whether the information shall have practical utility. Before

24 making a determination the Director may give the agency

25 and other interested persons an opportunity to be heard
76

•HR 5024 IH

1 or to submit statements in writing. To the extent, if any,

2 that the Director determines that the collection of infor3 mation by an agency is unnecessary for any reason, the

4 agency may not engage in the collection of information.

5 ‘‘§ 3609. Designation of central collection agency

6 ‘‘The Director may designate a central collection

7 agency to obtain information for two or more agencies if

8 the Director determines that the needs of such agencies

9 for information will be adequately served by a single collec10 tion agency, and such sharing of data is not inconsistent

11 with applicable law. In such cases the Director shall pre12 scribe (with reference to the collection of information) the

13 duties and functions of the collection agency so designated

14 and of the agencies for which it is to act as agent (includ15 ing reimbursement for costs). While the designation is in

16 effect, an agency covered by the designation may not ob17 tain for itself information for the agency which is the duty

18 of the collection agency to obtain. The Director may mod19 ify the designation from time to time as circumstances re20 quire. The authority to designate under this section is sub21 ject to the provisions of section 3607(f).

22 ‘‘§ 3610. Cooperation of agencies in making informa23 tion available

24 ‘‘(a) The Director may direct an agency to make

25 available to another agency, or an agency may make avail-
77

•HR 5024 IH

1 able to another agency, information obtained by a collec2 tion of information if the disclosure is not inconsistent

3 with applicable law.

4 ‘‘(b)(1) If information obtained by an agency is re5 leased by that agency to another agency, all the provisions

6 of law (including penalties) that relate to the unlawful dis7 closure of information apply to the officers and employees

8 of the agency to which information is released to the same

9 extent and in the same manner as the provisions apply

10 to the officers and employees of the agency which origi11 nally obtained the information.

12 ‘‘(2) The officers and employees of the agency to

13 which the information is released, in addition, shall be

14 subject to the same provisions of law, including penalties,

15 relating to the unlawful disclosure of information as if the

16 information had been collected directly by that agency.

17 ‘‘§ 3611. Use of the Government Information Locator

18 Service

19 ‘‘In consultation with the Chief Information Officer,

20 the Director shall encourage the use of the Government

21 Information Locator Service to provide information to

22 agencies and the public regarding agency information col23 lection activities and opportunities to maximize the effi24 ciency and effectiveness of agency collections of informa25 tion and the reduction of paperwork burdens on the public.
78

•HR 5024 IH

1 ‘‘§ 3612. Public protection

2 ‘‘(a) Notwithstanding any other provision of law, no

3 person shall be subject to any penalty for failing to comply

4 with a collection of information that is subject to this

5 chapter if—

6 ‘‘(1) the collection of information does not dis7 play a valid control number assigned by the Director

8 in accordance with this chapter; or

9 ‘‘(2) the agency fails to inform the person who

10 is to respond to the collection of information that

11 such person is not required to respond to the collec12 tion of information unless it displays a valid control

13 number.

14 ‘‘(b) The protection provided by this section may be

15 raised in the form of a complete defense, bar, or otherwise

16 at any time during the agency administrative process or

17 judicial action applicable thereto.

18 ‘‘§ 3613. Director review of agency activities; report19 ing; agency response

20 ‘‘(a) In consultation with the Chief Information Offi21 cer, the Administrator of General Services, the Archivist

22 of the United States, the Director of the National Insti23 tute of Standards and Technology, and the Director of the

24 Office of Personnel Management, the Director shall peri25 odically review selected agency information collection ac26 tivities to ascertain the efficiency and effectiveness of such
79

•HR 5024 IH

1 activities to improve agency performance and the accom2 plishment of agency missions.

3 ‘‘(b) Each agency having an activity reviewed under

4 subsection (a) shall, within 60 days after receipt of a re5 port on the review, provide a written plan to the Director

6 describing steps (including milestones) to—

7 ‘‘(1) be taken to address information resources

8 management problems identified in the report; and

9 ‘‘(2) improve agency performance and the ac10 complishment of agency missions.

11 ‘‘§ 3614. Responsiveness to Congress

12 ‘‘(a)(1) The Director shall—

13 ‘‘(A) keep the Congress and congressional com14 mittees fully and currently informed of the major ac15 tivities under this chapter; and

16 ‘‘(B) submit a report on such activities to the

17 President of the Senate and the Speaker of the

18 House of Representatives annually and at such other

19 times as the Director determines necessary.

20 ‘‘(2) The Director shall include in any such report

21 a description of the extent to which agencies have—

22 ‘‘(A) reduced information collection burdens on

23 the public, including—
80

•HR 5024 IH

1 ‘‘(i) a summary of accomplishments and

2 planned initiatives to reduce collection of infor3 mation burdens;

4 ‘‘(ii) a list of all violations of this chapter

5 and of any rules, guidelines, policies, and proce6 dures issued pursuant to this chapter;

7 ‘‘(iii) a list of any increase in the collection

8 of information burden, including the authority

9 for each such collection; and

10 ‘‘(iv) a list of agencies that in the pre11 ceding year did not reduce information collec12 tion burdens in accordance with section

13 3605(a)(1), a list of the programs and statu14 tory responsibilities of those agencies that pre15 cluded that reduction, and recommendations to

16 assist those agencies to reduce information col17 lection burdens in accordance with that section;

18 ‘‘(B) improved the quality and utility of statis19 tical information;

20 ‘‘(C) improved public access to Government in21 formation; and

22 ‘‘(D) improved program performance and the

23 accomplishment of agency missions through activi24 ties under this chapter.
81

•HR 5024 IH

1 ‘‘(b) The preparation of any report required by this

2 section shall be based on performance results reported by

3 the agencies and shall not increase the collection of infor4 mation burden on persons outside the Federal Govern5 ment.

6 ‘‘§ 3615. Administrative powers

7 ‘‘Upon the request of the Director, each agency

8 (other than an independent regulatory agency) shall, to

9 the extent practicable, make its services, personnel, and

10 facilities available to the Director for the performance of

11 functions under this chapter.

12 ‘‘§ 3616. Rules and regulations

13 ‘‘The Director shall promulgate rules, regulations, or

14 procedures necessary to exercise the authority provided by

15 this chapter.

16 ‘‘§ 3617. Consultation with other agencies and the

17 public

18 ‘‘(a) In developing management policies, plans, rules,

19 regulations, procedures, and guidelines under this chapter

20 and in reviewing collections of information, the Director

21 shall provide interested agencies and persons early and

22 meaningful opportunity to comment.

23 ‘‘(b) Any person may request the Director to review

24 any collection of information conducted by or for an agen25 cy to determine, if, under this chapter, a person shall
82

•HR 5024 IH

1 maintain, provide, or disclose the information to or for the

2 agency. Unless the request is frivolous, the Director shall,

3 in coordination with the agency responsible for the collec4 tion of information—

5 ‘‘(1) respond to the request within 60 days

6 after receiving the request, unless such period is ex7 tended by the Director to a specified date and the

8 person making the request is given notice of such ex9 tension; and

10 ‘‘(2) take appropriate remedial action, if nec11 essary.

12 ‘‘§ 3618. Effect on existing laws and regulations

13 ‘‘(a) Except as otherwise provided in this chapter, the

14 authority of an agency under any other law to prescribe

15 policies, rules, regulations, and procedures for Federal in16 formation resources management activities is subject to

17 the authority of the Director under this chapter.

18 ‘‘(b) Nothing in this chapter shall be deemed to affect

19 or reduce the authority of the Secretary of Commerce or

20 the Director of the Office of Management and Budget pur21 suant to Reorganization Plan No. 1 of 1977 (as amended)

22 and Executive order, relating to telecommunications and

23 information policy, procurement and management of tele24 communications and information systems, spectrum use,

25 and related matters.
83

•HR 5024 IH

1 ‘‘(c)(1) Except as provided in paragraph (2), this

2 chapter shall not apply to the collection of information—

3 ‘‘(A) during the conduct of a Federal criminal

4 investigation or prosecution, or during the disposi5 tion of a particular criminal matter;

6 ‘‘(B) during the conduct of—

7 ‘‘(i) a civil action to which the United

8 States or any official or agency thereof is a

9 party; or

10 ‘‘(ii) an administrative action or investiga11 tion involving an agency against specific indi12 viduals or entities;

13 ‘‘(C) by compulsory process pursuant to the

14 Antitrust Civil Process Act and section 13 of the

15 Federal Trade Commission Improvements Act of

16 1980; or

17 ‘‘(D) during the conduct of intelligence activi18 ties as defined in section 3.4(e) of Executive Order

19 No. 12333, issued December 4, 1981, or successor

20 orders, or during the conduct of cryptologic activities

21 that are communications security activities.

22 ‘‘(2) This chapter applies to the collection of informa23 tion during the conduct of general investigations (other

24 than information collected in an antitrust investigation to

25 the extent provided in subparagraph (C) of paragraph (1))
84

•HR 5024 IH

1 undertaken with reference to a category of individuals or

2 entities such as a class of licensees or an entire industry.

3 ‘‘(d) Nothing in this chapter shall be interpreted as

4 increasing or decreasing the authority conferred by Public

5 Law 89–306 on the Administrator of General Services, the

6 Secretary of Commerce, or the Director of the Office of

7 Management and Budget.

8 ‘‘(e) Nothing in this chapter shall be interpreted as

9 increasing or decreasing the authority of the President,

10 the Office of Management and Budget or the Director

11 thereof, under the laws of the United States, with respect

12 to the substantive policies and programs of department,

13 agencies and offices, including the substantive authority

14 of any Federal agency to enforce the civil rights laws.

15 ‘‘§ 3619. Access to information

16 ‘‘Under the conditions and procedures prescribed in

17 section 716 of title 31, the Director and personnel in the

18 Office of Information and Regulatory Affairs shall furnish

19 such information as the Comptroller General may require

20 for the discharge of the responsibilities of the Comptroller

21 General. For the purpose of obtaining such information,

22 the Comptroller General or representatives thereof shall

23 have access to all books, documents, papers, and records,

24 regardless of form or format, of the Office.
85

•HR 5024 IH

1 ‘‘§ 3620. Authorization of appropriations

2 ‘‘There are authorized to be appropriated to the Of3 fice of Information and Regulatory Affairs to carry out

4 the provisions of this chapter, and for no other purpose,

5 $5,000,000 for each of the fiscal years 2001, 2002, 2003,

6 2004, and 2005.’’.

7 SEC. 5. INFORMATION SECURITY.

8 Title 44, United States Code, is amended by inserting

9 after chapter 36 the following:

10 ‘‘CHAPTER 37—INFORMATION SECURITY

‘‘Sec.

‘‘3701. Purposes.

‘‘3702. Definitions.

‘‘3703. Office of Information Security and Technical Protection.

‘‘3704. Authorities and functions of the Chief Information Officer.

‘‘3705. Federal agency responsibilities.

‘‘3706. Annual independent evaluation.

‘‘3707. Authorization of appropriations.

11 ‘‘CHAPTER 37—INFORMATION SECURITY

12 ‘‘§ 3701. Purposes

13 ‘‘The purposes of this chapter are to—

14 ‘‘(1) provide a comprehensive framework for es15 tablishing and ensuring the effectiveness of controls

16 over information resources that support Federal op17 erations and assets;

18 ‘‘(2)(A) recognize the highly networked nature

19 of the Federal computing environment including the

20 need for Federal Government interoperability and, in

21 the implementation of improved security manage-
86

•HR 5024 IH

1 ment measures, assure that opportunities for inter2 operability are not adversely affected; and

3 ‘‘(B) provide effective Governmentwide manage4 ment and oversight of the related information secu5 rity risks, including coordination of information se6 curity efforts throughout the civilian, national secu7 rity, and law enforcement communities;

8 ‘‘(3) provide for development and maintenance

9 of minimum controls required to protect Federal in10 formation and information systems; and

11 ‘‘(4) provide a mechanism for improved over12 sight of Federal agency information security pro13 grams.

14 ‘‘§ 3702. Definitions

15 ‘‘(a) Except as provided under subsection (b), the

16 definitions under section 3502 shall apply to this chapter.

17 ‘‘(b) As used in this chapter, the term ‘mission crit18 ical system’ means any telecommunications or information

19 system used or operated by an agency or by a contractor

20 of an agency, or other organization on behalf of an agency,

21 that—

22 ‘‘(1) is defined as a national security system

23 under section 3502;

24 ‘‘(2) is protected at all times by procedures es25 tablished for information which has been specifically
87

•HR 5024 IH

1 authorized under criteria established by an Execu2 tive order or an Act of Congress to be classified in

3 the interest of national defense or foreign policy; or

4 ‘‘(3) processes any information, the loss, mis5 use, disclosure, or unauthorized access to or modi6 fication of, would have a debilitating impact on the

7 mission of an agency.

8 ‘‘§ 3703. Office of Information Security and Technical

9 Protection

10 ‘‘There is established in the Office of Information

11 Policy, established under section 3503, an Office of Infor12 mation Security and Technical Protection. The head of the

13 Office is the Director of Information Security and Tech14 nical Protection, who shall report directly to the Chief In15 formation Officer of the United States. The Chief Infor16 mation Officer shall delegate to the Director authority to

17 administer all functions under this chapter, except that

18 such delegation shall not relieve the Chief Information Of19 ficer of responsibility for the administration of such func20 tions. The Director shall serve as the principal adviser to

21 the Chief Information Officer on Federal Government in22 formation security.
88

•HR 5024 IH

1 ‘‘§ 3704. Authority and functions of the Chief Infor2 mation Officer

3 ‘‘(a)(1) The Chief Information Officer shall establish

4 Governmentwide policies for the management of programs

5 that—

6 ‘‘(A) support the cost-effective security of Fed7 eral information systems by promoting security as

8 an integral component of each agency’s business op9 erations; and

10 ‘‘(B) include information technology architec11 tures.

12 ‘‘(2) Policies under this subsection shall—

13 ‘‘(A) be founded on a continuing risk manage14 ment cycle that recognizes the need to—

15 ‘‘(i) identify, assess, and understand risk;

16 and

17 ‘‘(ii) determine security needs commensu18 rate with the level of risk;

19 ‘‘(B) implement controls that adequately ad20 dress the risk;

21 ‘‘(C) promote continuing awareness of informa22 tion security risk; and

23 ‘‘(D) continually monitor and evaluate policy

24 and control effectiveness of information security

25 practices.
89

•HR 5024 IH

1 ‘‘(b) The authority under subsection (a) includes the

2 authority to—

3 ‘‘(1) oversee and develop policies, principles,

4 standards, and guidelines for the handling of Fed5 eral information and information resources to im6 prove the efficiency and effectiveness of govern7 mental operations, including principles, policies, and

8 guidelines for the implementation of agency respon9 sibilities under applicable law for ensuring the pri10 vacy, confidentiality, and security of Federal infor11 mation;

12 ‘‘(2) consistent with the standards and guide13 lines promulgated under section 3812 of this title,

14 sections 20 and 21 of the National Institute of

15 Standards and Technology Act (15 U.S.C. 278g–3

16 and 278g–4), and sections 5 and 6 of the Computer

17 Security Act of 1987 (40 U.S.C. 1441 note; Public

18 Law 100–235; 101 Stat. 1729), require Federal

19 agencies to identify and afford security protections

20 commensurate with the risk and magnitude of the

21 harm resulting from the loss, misuse, or unauthor22 ized access to or modification of information col23 lected or maintained by or on behalf of an agency;

24 ‘‘(3) direct the heads of agencies to—
90

•HR 5024 IH

1 ‘‘(A) identify, use, and share best security

2 practices;

3 ‘‘(B) develop an agencywide information

4 security plan;

5 ‘‘(C) incorporate information security prin6 ciples and practices throughout the life cycles of

7 the agency’s information systems; and

8 ‘‘(D) ensure that the agency’s information

9 security plan is practiced throughout all life cy10 cles of the agency’s information systems;

11 ‘‘(4) oversee the development and implementa12 tion of standards and guidelines relating to security

13 controls for Federal computer systems by the Sec14 retary of Commerce through the National Institute

15 of Standards and Technology under section 3812 of

16 this title and section 20 of the National Institute of

17 Standards and Technology Act (15 U.S.C. 278g–3);

18 ‘‘(5) oversee and coordinate compliance with

19 this section in a manner consistent with—

20 ‘‘(A) sections 552 and 552a of title 5;

21 ‘‘(B) sections 20 and 21 of the National

22 Institute of Standards and Technology Act (15

23 U.S.C. 278g–3 and 278g–4);

24 ‘‘(C) chapters 35 and 38 of this title;
91

•HR 5024 IH

1 ‘‘(D) sections 5 and 6 of the Computer Se2 curity Act of 1987 (40 U.S.C. 1441 note; Pub3 lic Law 100–235; 101 Stat. 1729); and

4 ‘‘(E) related information management

5 laws; and

6 ‘‘(6) request that the Director take any author7 ized action under section 3803(b)(5) of this title

8 that the Chief Information Officer considers appro9 priate, including any action involving the budgetary

10 process or appropriations management process, to

11 enforce accountability of the head of an agency for

12 information resources management, including the re13 quirements of this subchapter, and for the invest14 ments made by the agency in information tech15 nology, including recommending to the Director—

16 ‘‘(A) a reduction or an increase in any

17 amount for information resources that the head

18 of the agency proposes for the budget submitted

19 to Congress under section 1105(a) of title 31;

20 ‘‘(B) a reduction or other adjustment of

21 apportionments and reapportionments of appro22 priations for information resources; or

23 ‘‘(C) the use of other authorized adminis24 trative controls over appropriations to restrict
92

•HR 5024 IH

1 the availability of funds for information re2 sources.

3 ‘‘§ 3705. Federal agency responsibilities

4 ‘‘(a) The head of each agency shall—

5 ‘‘(1) be responsible for—

6 ‘‘(A) adequately ensuring the integrity,

7 confidentiality, authenticity, availability, and

8 nonrepudiation of information and information

9 systems supporting agency operations and as10 sets;

11 ‘‘(B) developing and implementing infor12 mation security policies, procedures, and control

13 techniques sufficient to afford security protec14 tions commensurate with the risk and mag15 nitude of the harm resulting from unauthorized

16 disclosure, disruption, modification, or destruc17 tion of information collected or maintained by

18 or for the agency; and

19 ‘‘(C) ensuring that the agency’s informa20 tion security plan is practiced throughout the

21 life cycle of each agency system;

22 ‘‘(2) ensure that appropriate senior agency offi23 cials are responsible for—

24 ‘‘(A) assessing the information security

25 risks associated with the operations and assets
93

•HR 5024 IH

1 for programs and systems over which such offi2 cials have control;

3 ‘‘(B) determining the levels of information

4 security appropriate to protect such operations

5 and assets; and

6 ‘‘(C) periodically testing and evaluating in7 formation security controls and techniques;

8 ‘‘(3) delegate to the agency chief information

9 officer established under section 3507, or a com10 parable official in an agency not covered by such

11 section, the authority to administer all functions

12 under this subchapter including—

13 ‘‘(A) designating a senior agency informa14 tion security official who shall report to the

15 chief information officer or a comparable offi16 cial;

17 ‘‘(B) developing and maintaining an agen18 cywide information security program as re19 quired under subsection (b);

20 ‘‘(C) ensuring that the agency effectively

21 implements and maintains information security

22 policies, procedures, and control techniques;

23 ‘‘(D) training and overseeing personnel

24 with significant responsibilities for information
94

•HR 5024 IH

1 security with respect to such responsibilities;

2 and

3 ‘‘(E) assisting senior agency officials con4 cerning responsibilities under paragraph (2);

5 ‘‘(4) ensure that the agency has trained per6 sonnel sufficient to assist the agency in complying

7 with the requirements of this subchapter and related

8 policies, procedures, standards, and guidelines; and

9 ‘‘(5) ensure that the agency chief information

10 officer, in coordination with senior agency officials,

11 periodically—

12 ‘‘(A)(i) evaluates the effectiveness of the

13 agency information security program, including

14 testing control techniques; and

15 ‘‘(ii) implements appropriate remedial ac16 tions based on that evaluation; and

17 ‘‘(B) reports to the agency head on—

18 ‘‘(i) the results of such tests and eval19 uations; and

20 ‘‘(ii) the progress of remedial actions.

21 ‘‘(b)(1) Each agency shall develop and implement an

22 agencywide information security program to provide infor23 mation security for the operations and assets of the agen24 cy, including operations and assets provided or managed

25 by another agency.
95

•HR 5024 IH

1 ‘‘(2) Each program under this subsection shall

2 include—

3 ‘‘(A) periodic risk assessments that consider in4 ternal and external threats to—

5 ‘‘(i) the integrity, confidentiality, and

6 availability of systems; and

7 ‘‘(ii) data supporting critical operations

8 and assets;

9 ‘‘(B) policies and procedures that—

10 ‘‘(i) are based on the risk assessments re11 quired under subparagraph (A) that cost-effec12 tively reduce information security risks to an

13 acceptable level; and

14 ‘‘(ii) ensure compliance with—

15 ‘‘(I) the requirements of this chapter;

16 ‘‘(II) policies and procedures as may

17 be prescribed by the Chief Information Of18 ficer; and

19 ‘‘(III) any other applicable require20 ments;

21 ‘‘(C) security awareness training to inform per22 sonnel of—

23 ‘‘(i) information security risks associated

24 with the activities of personnel; and
96

•HR 5024 IH

1 ‘‘(ii) responsibilities of personnel in com2 plying with agency policies and procedures de3 signed to reduce such risks;

4 ‘‘(D)(i) periodic management testing and eval5 uation of the effectiveness of information security

6 policies and procedures; and

7 ‘‘(ii) a process for ensuring remedial action to

8 address any significant deficiencies; and

9 ‘‘(E) procedures for detecting, reporting, and

10 responding to security incidents, including—

11 ‘‘(i) mitigating risks associated with such

12 incidents before substantial damage occurs;

13 ‘‘(ii) notifying and consulting with law en14 forcement officials and other offices and au15 thorities;

16 ‘‘(iii) notifying and consulting with an of17 fice designated by the Administrator of General

18 Services within the General Services Adminis19 tration; and

20 ‘‘(iv) notifying and consulting with an of21 fice designated by the Secretary of Defense and

22 the Director of Central Intelligence for inci23 dents involving systems described under section

24 3702(b)(1) and (2).
97

•HR 5024 IH

1 ‘‘(3) Each program under this subsection is subject

2 to the approval of the Chief Information Officer and is

3 required to be reviewed at least annually by agency pro4 gram officials in consultation with the Chief Information

5 Officer.

6 ‘‘(c)(1) Each agency shall examine the adequacy and

7 effectiveness of information security policies, procedures,

8 and practices in plans and reports relating to—

9 ‘‘(A) annual agency budgets;

10 ‘‘(B) information resources management re11 quirements under chapter 35 of this title;

12 ‘‘(C) information technology performance and

13 results based management under chapter 38 of this

14 title;

15 ‘‘(D) program performance under sections 1105

16 and 1115 through 1119 of title 31, and sections

17 2801 through 2805 of title 39; and

18 ‘‘(E) financial management under—

19 ‘‘(i) chapter 9 of title 31, and the Chief Fi20 nancial Officers Act of 1990 (31 U.S.C. 501

21 note; Public Law 101–576) (and the amend22 ments made by that Act);

23 ‘‘(ii) the Federal Financial Management

24 Improvement Act of 1996 (31 U.S.C. 3512
98

•HR 5024 IH

1 note) (and the amendments made by that Act);

2 and

3 ‘‘(iii) the internal controls conducted under

4 section 3512 of title 31.

5 ‘‘(2) Any significant deficiency in a policy, procedure,

6 or practice identified under paragraph (1) shall be re7 ported as a material weakness in reporting required under

8 the applicable provision of law under paragraph (1).

9 ‘‘(d)(1) In addition to the requirements of subsection

10 (c), each agency, in consultation with the Chief Informa11 tion Officer, shall include as part of the performance plan

12 required under section 1115 of title 31 a description of—

13 ‘‘(A) the time periods; and

14 ‘‘(B) the resources, including budget, staffing,

15 and training, which are necessary to implement the

16 program required under subsection (b)(1).

17 ‘‘(2) The description under paragraph (1) shall be

18 based on the risk assessment required under subsection

19 (b)(2)(A).

20 ‘‘§ 3706. Annual independent evaluation

21 ‘‘(a)(1) REQUIREMENT.—Each year each agency

22 shall have performed an independent evaluation of the in23 formation security program and practices of that agency.

24 ‘‘(2) INFORMATION TO BE INCLUDED.—Each eval25 uation under this section shall include—
99

•HR 5024 IH

1 ‘‘(A) an assessment of compliance with—

2 ‘‘(i) the requirements of this Act; and

3 ‘‘(ii) related information security policies,

4 procedures, standards, and guidelines; and

5 ‘‘(B) tests of the effectiveness of information

6 security control techniques.

7 ‘‘(3) USE OF INFORMATION.—The Inspector General

8 or the independent evaluator performing an evaluation

9 under this subsection including the Comptroller General

10 may use any audit, evaluation, or report relating to pro11 grams or practices of the applicable agency.

12 ‘‘(4) PERSON OR ENTITY RESPONSIBLE FOR PER13 FORMING EVALUATION.—

14 ‘‘(A) For agencies with Inspectors General ap15 pointed under the Inspector General Act of 1978 (5

16 U.S.C. App.) or any other law, the annual evaluation

17 required under this section shall be performed by the

18 Inspector General or by an independent evaluator,

19 as determined by the Inspector General of the agen20 cy.

21 ‘‘(B) For any agency to which subparagraph

22 (A) does not apply, the head of the agency shall con23 tract with an independent evaluator to perform the

24 evaluation.
100

•HR 5024 IH

1 ‘‘(C) An evaluation of agency information secu2 rity programs and practices performed by the Comp3 troller General may be in lieu of the evaluation re4 quired under this section.

5 ‘‘(5) SUBMISSION OF RESULTS.—Not later than 1

6 year after the date of enactment of this chapter, and on

7 that date every year thereafter, the applicable agency head

8 shall submit to the Chief Information Officer the results

9 of each evaluation required under this section.

10 ‘‘§ 3707. Authorization of appropriations

11 ‘‘There are authorized to be appropriated to carry out

12 the provisions of this chapter such sums as may be nec13 essary for each of fiscal years 2001 through 2005.’’.

14 SEC. 6. INFORMATION SECURITY RESPONSIBILITIES OF

15 CERTAIN AGENCIES.

16 (a) DEPARTMENT OF COMMERCE.—Notwithstanding

17 section 20 of the National Institute of Standards and

18 Technology Act (15 U.S.C. 278g–3) and except as pro19 vided under subsection (b), the Secretary of Commerce,

20 in consultation with the Chief Information Officer,

21 through the National Institute of Standards and Tech22 nology and with technical assistance from the National Se23 curity Agency, as required or when requested by the Chief

24 Information Officer, shall—
101

•HR 5024 IH

1 (1) develop, issue, review, and update standards

2 and guidance for the security of Federal information

3 systems, including development of methods and tech4 niques for security systems and validation programs;

5 (2) develop, issue, review, and update guidelines

6 for training in computer security awareness and ac7 cepted computer security practices, with assistance

8 from the Office of Personnel Management;

9 (3) provide agencies with guidance for security

10 planning to assist in the development of applications

11 and system security plans for such agencies;

12 (4) provide guidance and assistance to agencies

13 concerning cost-effective controls when inter14 connecting with other systems; and

15 (5) evaluate information technologies to assess

16 security vulnerabilities and alert Federal agencies of

17 such vulnerabilities as soon as those vulnerabilities

18 are known.

19 (b) DEPARTMENT OF DEFENSE AND THE INTEL20 LIGENCE COMMUNITY.—

21 (1) IN GENERAL.—Notwithstanding section

22 3704 of title 44, United States Code (as added by

23 section 5 of this Act), the Secretary of Defense, and

24 the Director of Central Intelligence, shall, consistent

25 with their respective authorities—
102

•HR 5024 IH

1 (A) develop and issue information security

2 policies, standards, and guidelines for systems

3 described under section 3702(b)(1) and (2) of

4 title 44, United States Code, that provide more

5 stringent protection than the policies, prin6 ciples, standards, and guidelines required under

7 section 3704 of title 44, United States Code;

8 and

9 (B) ensure the implementation of the in10 formation security policies, principles, stand11 ards, and guidelines described under subpara12 graph (A).

13 (2) MEASURES ADDRESSED.—The policies,

14 principles, standards, and guidelines developed by

15 the Secretary of Defense and the Director of Central

16 Intelligence under paragraph (1) shall address the

17 full range of information assurance measures needed

18 to protect and defend Federal information and infor19 mation systems by ensuring their integrity, confiden20 tiality, authenticity, availability, and nonrepudiation.

21 (c) DEPARTMENT OF JUSTICE.—The Department of

22 Justice shall review and update guidance to agencies on—

23 (1) legal remedies regarding security incidents

24 and ways to report to and work with law enforce25 ment agencies concerning such incidents; and
103

•HR 5024 IH

1 (2) lawful uses of security techniques and tech2 nologies.

3 (d) GENERAL SERVICES ADMINISTRATION.—The

4 General Services Administration shall—

5 (1) review and update General Services Admin6 istration guidance to agencies on addressing security

7 considerations when acquiring information tech8 nology; and

9 (2) assist agencies in—

10 (A) fulfilling agency responsibilities under

11 section 3705(b)(2)(E) of title 44, United States

12 Code (as added by section 5 of this Act); and

13 (B) the acquisition of cost-effective secu14 rity products, services, and incident response

15 capabilities.

16 (e) OFFICE OF PERSONNEL MANAGEMENT.—The Of17 fice of Personnel Management shall—

18 (1) review and update Office of Personnel Man19 agement regulations concerning computer security

20 training for Federal civilian employees;

21 (2) assist the Department of Commerce in up22 dating and maintaining guidelines for training in

23 computer security awareness and computer security

24 best practices; and
104

•HR 5024 IH

1 (3) work with the National Science Foundation

2 and other agencies on personnel and training initia3 tives (including scholarships and fellowships, as au4 thorized by law) as necessary to ensure that the

5 Federal Government—

6 (A) has adequate sources of continuing in7 formation security education and training avail8 able for employees; and

9 (B) has an adequate supply of qualified in10 formation security professionals to meet agency

11 needs.

12 (f) INFORMATION SECURITY POLICIES, PRINCIPLES,

13 STANDARDS, AND GUIDELINES.—

14 (1) IN GENERAL.—Notwithstanding any provi15 sion of this act (including any amendment made by

16 this Act)—

17 (A) the Secretary of Defense, the Director

18 of Central Intelligence, and other agency heads

19 as designated by the President shall develop

20 such policies, principles, standards, and guide21 lines for mission critical systems subject to

22 their control;

23 (B) the policies, principles, standards, and

24 guidelines developed by the Secretary of De25 fense, the Director of Central Intelligence, and
105

•HR 5024 IH

1 other agency heads as designated by the Presi2 dent may be adopted, to the extent that such

3 policies are consistent with policies and guid4 ance developed by the Chief Information Officer

5 and the Secretary of Commerce—

6 (i) by the Chief Information Officer,

7 as appropriate, to the mission critical sys8 tems of all agencies; or

9 (ii) by an agency head, as appro10 priate, to the mission critical systems of

11 that agency; and

12 (C) to the extent that such policies are

13 consistent with policies and guidance developed

14 by the Chief Information Officer and the Sec15 retary of Commerce, an agency may develop

16 and implement information security policies,

17 principles, standards, and guidelines that pro18 vide more stringent protection than those re19 quired under section 3702(b)(1) and (2) of title

20 44, United States Code (as added by section 5

21 of this Act), or subsection (a) of this section.

22 (2) MEASURES ADDRESSED.—The policies,

23 principles, standards, and guidelines developed by

24 the Secretary of Defense and the Director of Central

25 Intelligence under paragraph (1) shall address the
106

•HR 5024 IH

1 full range of information assurance measures needed

2 to protect and defend Federal information and infor3 mation systems by ensuring their integrity, confiden4 tiality, authenticity, availability, and nonrepudiation.

5 (g) ATOMIC ENERGY ACT OF 1954.—Nothing in this

6 Act shall supersede any requirement made by or under

7 the Atomic Energy Act of 1954 (42 U.S.C. 2011 et seq.).

8 Restricted Data or Formerly Restricted Data shall be han9 dled, protected, classified, downgraded, and declassified in

10 conformity with the Atomic Energy Act of 1954 (42

11 U.S.C. 2011 et seq.).

12 SEC. 7. MANAGEMENT OF INFORMATION TECHNOLOGY.

13 Title 44, United States Code, is amended by inserting

14 after chapter 37 the following:

15 ‘‘CHAPTER 38—MANAGEMENT OF INFORMATION

16 TECHNOLOGY

‘‘Sec.

‘‘3801. Responsibility of Chief Information Officer.

‘‘3802. Capital planning and investment control.

‘‘3803. Performance-based and results-based management.

‘‘3804. Responsibilities of Federal agencies.

‘‘3805. Agency capital planning and investment control.

‘‘3806. Agency performance and results-based management.

‘‘3807. Acquisitions of information technology.

‘‘3808. Accountability.

‘‘3809. Significant deviations.

‘‘3810. Interagency support.

‘‘3811. Application to national security systems.

‘‘3812. Responsibilities for Federal information system standards.
107

•HR 5024 IH

1 ‘‘CHAPTER 38—MANAGEMENT OF

2 INFORMATION TECHNOLOGY

3 ‘‘§ 3801. Responsibility of the Chief Information

4 Officer

5 ‘‘In fulfilling the responsibility to administer the

6 functions assigned under chapter 35 of this title, the Chief

7 Information Officer shall comply with this chapter with

8 respect to the specific matters covered by this chapter.

9 ‘‘§ 3802. Capital planning and investment control

10 ‘‘(a) FEDERAL INFORMATION TECHNOLOGY.—The

11 Chief Information Officer shall perform the responsibil12 ities set forth in this section in fulfilling the responsibil13 ities under section 3504(h) of this title.

14 ‘‘(b) USE OF INFORMATION TECHNOLOGY IN FED15 ERAL PROGRAMS.—The Chief Information Officer shall

16 promote and be responsible for improving the acquisition,

17 use, and disposal of information technology by the Federal

18 Government to improve the productivity, efficiency, and

19 effectiveness of Federal programs, including through dis20 semination of public information and the reduction of in21 formation collection burdens on the public.

22 ‘‘(c) USE OF BUDGET PROCESS.—The Chief Infor23 mation shall advise and assist the Director to develop, as

24 part of the budget process, a process for analyzing, track25 ing, and evaluating the risks and results of all major cap-
108

•HR 5024 IH

1 ital investments made by an executive agency for informa2 tion systems. The process shall cover the life of each sys3 tem and shall include explicit criteria for analyzing the

4 projected and actual costs, benefits, and risks associated

5 with the investments. At the same time that the President

6 submits the budget for a fiscal year to Congress under

7 section 1105(a) of title 31, the Chief Information Officer

8 shall submit to Congress a report on the net program per9 formance benefits achieved as a result of major capital in10 vestments made by executive agencies in information sys11 tems and how the benefits relate to the accomplishment

12 of the goals of the executive agencies.

13 ‘‘(d) INFORMATION TECHNOLOGY STANDARDS.—The

14 Chief Information Officer shall oversee the development

15 and implementation of standards and guidelines per16 taining to Federal information systems, as provided under

17 section 3812.

18 ‘‘(e) DESIGNATION OF EXECUTIVE AGENTS FOR AC19 QUISITIONS.—The Chief Information Officer shall des20 ignate (as the Chief Information Officer considers appro21 priate) one or more heads of agencies as executive agent

22 for Governmentwide acquisitions of information tech23 nology.

24 ‘‘(f) USE OF BEST PRACTICES IN ACQUISITIONS.—

25 The Chief Information Officer shall encourage the heads
109

•HR 5024 IH

1 of agencies to develop and use the best practices in the

2 acquisition of information technology.

3 ‘‘(g) ASSESSMENT OF OTHER MODELS FOR MAN4 AGING INFORMATION TECHNOLOGY.—The Chief Informa5 tion Officer shall assess, on a continuing basis, the experi6 ences of agencies, State and local governments, inter7 national organizations, and the private sector in managing

8 information technology.

9 ‘‘(h) COMPARISON OF AGENCY USES OF INFORMA10 TION TECHNOLOGY.—The Chief Information Officer shall

11 compare the performances of agencies in using informa12 tion technology and shall disseminate the comparisons to

13 the heads of agencies.

14 ‘‘(i) TRAINING.—The Chief Information Officer shall

15 monitor the development and implementation of training

16 in information resources management for agency per17 sonnel.

18 ‘‘(j) INFORMING CONGRESS.—The Chief Information

19 Officer shall keep Congress fully informed on the extent

20 to which agencies are improving the performance of agen21 cy programs and the accomplishment of agency missions

22 through the use of the best practices in information re23 sources management.

24 ‘‘(k) PROCUREMENT POLICY AND ACQUISITIONS OF

25 INFORMATION TECHNOLOGY.—The Chief Information Of-
110

•HR 5024 IH

1 ficer shall coordinate the development and review policy

2 associated with Federal acquisition of information tech3 nology with the Office of Federal Procurement Policy in

4 the Office of Management and Budget.

5 ‘‘§ 3803. Performance-based and results-based man6 agement

7 ‘‘(a) IN GENERAL.—The Chief Information Officer

8 shall encourage the use of performance-based and results9 based management in fulfilling the responsibilities as10 signed under section 3504(h) of this title.

11 ‘‘(b) EVALUATION OF AGENCY PROGRAMS AND IN12 VESTMENTS.—

13 ‘‘(1) REQUIREMENT.—The Chief Information

14 Officer shall evaluate the information resources

15 management practices of agencies with respect to

16 the performance and results of the investments

17 made by agencies in information technology.

18 ‘‘(2) DIRECTION FOR AGENCY ACTION.—The

19 Chief Information Officer shall issue to the head of

20 each agency clear and concise direction that the

21 head of such agency shall—

22 ‘‘(A) establish effective and efficient cap23 ital planning processes for selecting, managing,

24 and evaluating the results of all of its major in25 vestments in information systems;
111

•HR 5024 IH

1 ‘‘(B) determine, before making an invest2 ment in a new information system—

3 ‘‘(i) whether the function to be sup4 ported by the system should be performed

5 by the private sector and, if so, whether

6 any component of the agency performing

7 that function should be converted from a

8 governmental organization to a private sec9 tor organization; or

10 ‘‘(ii) whether the function should be

11 performed by agency and, if so, whether

12 the function should be performed by a pri13 vate sector source under contract or by

14 agency personnel;

15 ‘‘(C) analyze the missions of the agency

16 and, based on the analysis, revise the agency’s

17 mission-related processes and administrative

18 processes, as appropriate, before making signifi19 cant investments in information technology to

20 be used in support of those missions; and

21 ‘‘(D) ensure that information security poli22 cies, procedures, and practices are adequate.

23 ‘‘(3) GUIDANCE FOR MULTIAGENCY INVEST24 MENTS.—The direction issued under paragraph (2)

25 shall include guidance for undertaking efficiently
112

•HR 5024 IH

1 and effectively interagency and Governmentwide in2 vestments in information technology to improve the

3 accomplishment of missions that are common to

4 agencies.

5 ‘‘(4) PERIODIC REVIEWS.—The Chief Informa6 tion Officer shall advise and assist the Director in

7 implementing through the budget process periodic

8 reviews of information resources management activi9 ties of selected agencies in order to ascertain the ef10 ficiency and effectiveness of information technology

11 in improving agency performance and the accom12 plishment of agency missions.

13 ‘‘(5) ENFORCEMENT OF ACCOUNTABILITY.—

14 ‘‘(A) IN GENERAL.—The Chief Informa15 tion Officer may take any authorized action

16 that the Chief Information Officer considers ap17 propriate, including an action coordinated with

18 the Director involving the budgetary process or

19 appropriations management process, to enforce

20 accountability of the head of an agency for in21 formation resources management and for the

22 investments made by the agency in information

23 technology.

24 ‘‘(B) SPECIFIC ACTIONS.—Actions taken

25 by the Chief Information Officer, including
113

•HR 5024 IH

1 those coordinated with the Director where ap2 propriate, in the case of an agency may

3 include—

4 ‘‘(i) recommending a reduction or an

5 increase in any amount for information re6 sources that the head of the agency pro7 poses for the budget submitted to Congress

8 under section 1105(a) of title 31;

9 ‘‘(ii) recommending reducing or other10 wise adjusting apportionments and re11 apportionments of appropriations for infor12 mation resources;

13 ‘‘(iii) using other authorized adminis14 trative controls over appropriations to re15 strict the availability of funds for informa16 tion resources; and

17 ‘‘(iv) designating for the agency an

18 executive agent to contract with private

19 sector sources for the performance of infor20 mation resources management or the ac21 quisition of information technology.

22 ‘‘§ 3804. Agency responsibilities

23 ‘‘In fulfilling the responsibilities assigned under chap24 ter 35 of this title, the head of each agency shall comply
114

•HR 5024 IH

1 with this chapter with respect to the specific matters cov2 ered by this chapter.

3 ‘‘§ 3805. Capital planning and investment control

4 ‘‘(a) DESIGN OF PROCESS.—In fulfilling the respon5 sibilities assigned under section 3506(h) of this title, the

6 head of each agency shall design and implement in the

7 agency a process for maximizing the value and assessing

8 and managing the risks of the information technology ac9 quisitions of the agency.

10 ‘‘(b) CONTENT OF PROCESS.—The process of an

11 agency shall—

12 ‘‘(1) provide for the selection of information

13 technology investments to be made by the agency,

14 the management of such investments, and the eval15 uation of the results of such investments;

16 ‘‘(2) be integrated with the processes for mak17 ing budget, financial, and program management de18 cisions within the agency;

19 ‘‘(3) include minimum criteria to be applied in

20 considering whether to undertake a particular in21 vestment in information systems, including criteria

22 related to the quantitatively expressed projected net,

23 risk-adjusted return on investment and specific

24 quantitative and qualitative criteria for comparing
115

•HR 5024 IH

1 and prioritizing alternative information systems in2 vestment projects;

3 ‘‘(4) provide for identifying information systems

4 investments that would result in shared benefits or

5 costs for other Federal agencies or State or local

6 governments;

7 ‘‘(5) provide for identifying for a proposed in8 vestment quantifiable measurements for determining

9 the net benefits and risks of the investment; and

10 ‘‘(6) provide the means for senior management

11 personnel of the agency to obtain timely information

12 regarding the progress of an investment in an infor13 mation system, including a system of milestones for

14 measuring progress, on an independently verifiable

15 basis, in terms of cost, capability of the system to

16 meet specified requirements, timeliness, and quality.

17 ‘‘§ 3806. Performance and results-based management

18 ‘‘In fulfilling the responsibilities under section

19 3506(h) of this title, the head of an agency shall—

20 ‘‘(1) establish goals for improving the efficiency

21 and effectiveness of agency operations and, as ap22 propriate, the delivery of services to the public

23 through the effective use of information technology;
116

•HR 5024 IH

1 ‘‘(2) prepare an annual report, to be included

2 in the agency’s budget submission to Congress, on

3 the progress in achieving the goals;

4 ‘‘(3) ensure that performance measurements

5 are prescribed for information technology used by or

6 to be acquired for, the agency and that the perform7 ance measurements measure how well the informa8 tion technology supports programs of the agency;

9 ‘‘(4) where comparable processes and organiza10 tions in the public or private sectors exist, quan11 titatively benchmark agency process performance

12 against such processes in terms of cost, speed, pro13 ductivity, and quality of outputs and outcomes;

14 ‘‘(5) analyze the missions of the agency and,

15 based on the analysis, revise the agency’s mission-re16 lated processes and administrative processes as ap17 propriate before making significant investments in

18 information technology that is to be used in support

19 of the performance of those missions; and

20 ‘‘(6) ensure that the information security poli21 cies, procedures, and practices of the agency are

22 adequate.
117

•HR 5024 IH

1 ‘‘§ 3807. Acquisitions of information technology

2 ‘‘The authority of the head of an agency to conduct

3 an acquisition of information technology includes the fol4 lowing authorities:

5 ‘‘(1) To acquire information technology as au6 thorized by law.

7 ‘‘(2) To enter into a contract that provides for

8 multiagency acquisitions of information technology

9 in accordance with guidance issued by Chief Infor10 mation Officer.

11 ‘‘(3) If the Chief Information Officer finds that

12 it would be advantageous for the Federal Govern13 ment to do so, to enter into a multiagency contract

14 for procurement of commercial items of information

15 technology that requires each agency covered by the

16 contract, when procuring such items, either to pro17 cure the items under that contract or to justify an

18 alternative procurement of the items.

19 ‘‘§ 3808. Accountability

20 ‘‘The head of each agency, in consultation with the

21 Chief Information Officer and the chief financial officer

22 of that agency (or, in the case of an agency without a

23 chief financial officer, any comparable official), shall es24 tablish policies and procedures that—

25 ‘‘(1) ensure that the accounting, financial, and

26 asset management systems and other information
118

•HR 5024 IH

1 systems of the agency are designed, developed, main2 tained, and used effectively to provide financial or

3 program performance data for financial statements

4 of the executive agency;

5 ‘‘(2) ensure that financial and related program

6 performance data are provided on a reliable, con7 sistent, and timely basis to agency financial manage8 ment systems; and

9 ‘‘(3) ensure that financial statements support—

10 ‘‘(A) assessments and revisions of mission11 related processes and administrative processes

12 of the agency; and

13 ‘‘(B) performance measurement of the per14 formance in the case of investments made by

15 the agency in information systems.

16 ‘‘§ 3809. Significant deviations

17 ‘‘The head of an agency shall identify in the strategic

18 information resources management plan required under

19 section 3505(a)(2) of this title any major information

20 technology acquisition program, or any phase or increment

21 of such a program, that has significantly deviated from

22 the cost, performance, or schedule goals established for

23 the program.
119

•HR 5024 IH

1 ‘‘§ 3810. Interagency support

2 ‘‘Funds available for an agency for oversight, acquisi3 tion, and procurement of information technology may be

4 used by the head of the agency to support jointly with

5 other agencies the activities of interagency groups that are

6 established to advise the Chief Information Officer in car7 rying out the Chief Information Officer’s responsibilities

8 under this chapter. The use of such funds for that purpose

9 shall be subject to such requirements and limitations on

10 uses and amounts as the Director may prescribe, in con11 sultation with the Chief Information Officer. The Director

12 shall, in consultation with the Chief Information Officer,

13 prescribe any such requirements and limitations during

14 the Director’s review of the agency’s proposed budget sub15 mitted to the Director by the head of the agency for pur16 poses of section 1105 of title 31, United States Code.

17 ‘‘§ 3811. Applicability to national security systems

18 ‘‘(a) IN GENERAL.—Except as provided in subsection

19 (b), this chapter does not apply to national security sys20 tems.

21 ‘‘(b) EXCEPTIONS.—

22 ‘‘(1) IN GENERAL.—Sections 3806, 3808, and

23 3809 of this chapter apply to national security sys24 tems.

25 ‘‘(2) CAPITAL PLANNING AND INVESTMENT

26 CONTROL.—The heads of agencies shall apply sec-
120

•HR 5024 IH

1 tions 3802 and 3805 of this chapter to national se2 curity systems to the extent practicable.

3 ‘‘(3) PERFORMANCE AND RESULTS OF INFOR4 MATION TECHNOLOGY INVESTMENTS.—

5 ‘‘(A) Subject to subparagraph (B), the

6 heads of executive agencies shall apply section

7 3803 of this chapter to national security sys8 tems to the extent practicable.

9 ‘‘(B) National security systems shall be

10 subject to section 3803(b)(5) of this title except

11 for subparagraph (B)(iv) of that section.

12 ‘‘§ 3812. Responsibilities for Federal information sys13 tem standards

14 ‘‘(a) STANDARDS AND GUIDELINES.—

15 ‘‘(1) AUTHORITY.—The Chief Information Offi16 cer shall, on the basis of standards and guidelines

17 developed by the National Institute of Standards

18 and Technology pursuant to paragraphs (2) and (3)

19 of section 278g–3(a) of title 15 and in consultation

20 with the Secretary of Commerce, promulgate stand21 ards and guidelines pertaining to Federal informa22 tion systems. The Chief Information Officer shall

23 make such standards compulsory and binding to the

24 extent to which the Chief Information Officer Sec25 retary determines necessary to improve the efficiency
121

•HR 5024 IH

1 of operation or security and privacy of Federal infor2 mation systems. The President may disapprove or

3 modify such standards and guidelines if the Presi4 dent determines such action to be in the public in5 terest. The President’s authority to disapprove or

6 modify such standards and guidelines may not be

7 delegated. Notice of such disapproval or modification

8 shall be published promptly in the Federal Register.

9 Upon receiving notice of such disapproval or modi10 fication, the Chief Information Officer shall imme11 diately rescind or modify such standards or guide12 lines as directed by the President.

13 ‘‘(2) EXERCISE OF AUTHORITY.—The authority

14 conferred upon the Chief Information Officer by this

15 section shall be exercised subject to direction by the

16 President and in coordination with the Director to

17 ensure fiscal and policy consistency.

18 ‘‘(b) APPLICATION OF MORE STRINGENT STAND19 ARDS.—The head of an agency may employ standards for

20 the cost-effective security and privacy of sensitive informa21 tion in an information system within or under the super22 vision of that agency that are more stringent than the

23 standards promulgated by the Chief Information Officer

24 under this section, if such standards contain, at a min-
122

•HR 5024 IH

1 imum, the provisions of those applicable standards made

2 compulsory and binding by the Chief Information Officer.

3 ‘‘(c) WAIVER OF STANDARDS.—The standards deter4 mined under subsection (a) to be compulsory and binding

5 may be waived by the Chief Information Officer in writing

6 upon a determination that compliance would adversely af7 fect the accomplishment of the mission of an agency oper8 ating an information system, or cause a major adverse fi9 nancial impact on the agency which is not offset by Gov10 ernmentwide savings. The Chief Information Officer may

11 delegate to the head of one or more agencies authority

12 to waive such standards to the extent to which the Chief

13 Information Officer determines such action to be nec14 essary and desirable to allow for timely and effective im15 plementation of information system standards. The head

16 of such agency may redelegate such authority only to a

17 chief information officer designated pursuant to section

18 3507 of this title. Notice of each such waiver and delega19 tion shall be transmitted promptly to Congress and shall

20 be published promptly in the Federal Register.

21 ‘‘(d) DEFINITIONS.—In this section, the term ‘infor22 mation system’ has the meaning given ‘Federal computer

23 system’ in section 278g–3(d) of Title 15.’’

24 SEC. 8. TECHNICAL AND CONFORMING AMENDMENTS.

25 (a) EXECUTIVE LEVEL POSITIONS.—
123

•HR 5024 IH

1 (1) EXECUTIVE LEVEL I.—Section 5312 of title

2 5, United States Code, is amended by adding at the

3 end the following:

4 ‘‘Chief Information Officer of the United States.’’.

5 (2) EXECUTIVE LEVEL II.—Section 5313 of

6 title 5, United States Code, is amended by adding

7 at the end the following:

8 ‘‘Deputy Chief Information Officer of the United

9 States.’’.

10 (3) EXECUTIVE LEVEL III.—Section 5314 of

11 title 5, United States Code, is amended by adding

12 at the end the following:

13 ‘‘Director of Information Security and Technical Pro14 tection.’’.

15 (b) PRIVACY ACT.—Section 552a of title 5, United

16 States Code, is amended as follows—

17 (1) in section 552a(a)(8)(B)(iv), by striking

18 ‘‘Director of the Office of Management and Budget’’

19 and inserting ‘‘Chief Information Officer of the

20 United States’’ in lieu thereof;

21 (2) in section 552a(a)(8)(B)(v)(I), by striking

22 ‘‘Director of the Office of Management and Budget’’

23 and inserting ‘‘Chief Information Officer of the

24 United States’’ in lieu thereof;
124

•HR 5024 IH

1 (3) in section 552a(o)(1)(D), by striking ‘‘Di2 rector of the Office of Management and Budget’’

3 and inserting ‘‘Chief Information Officer of the

4 United States’’ in lieu thereof;

5 (4) in section 552a(p)(1)(A)(ii), by striking

6 ‘‘Director of the Office of Management and Budget’’

7 and inserting ‘‘Chief Information Officer of the

8 United States’’ in lieu thereof;

9 (5) in section 552a(r), by striking ‘‘Office of

10 Management and Budget’’ and inserting ‘‘Chief In11 formation Officer of the United States’’ in lieu

12 thereof;

13 (6) in section 552a(s)(1), by striking ‘‘Director

14 of the Office of Management and Budget’’ and in15 serting ‘‘Chief Information Officer of the United

16 States’’ in lieu thereof;

17 (7) in section 552a(u)(3)(D), by striking ‘‘Of18 fice of Management and Budget’’ and inserting

19 ‘‘Chief Information Officer of the United States’’ in

20 lieu thereof;

21 (8) in section 552a(u)(3)(D)(vi), by striking

22 ‘‘Director of the Office of Management and Budget’’

23 and inserting ‘‘Chief Information Officer of the

24 United States’’ in lieu thereof;
125

•HR 5024 IH

1 (9) in section 552a(u)(4)(B), by striking ‘‘Di2 rector of the Office of Management and Budget’’

3 and inserting ‘‘Chief Information Officer of the

4 United States’’ in lieu thereof;

5 (10) in section 552a(u)(5)(A), by striking ‘‘Di6 rector of the Office of Management and Budget’’

7 each time it appears, and inserting ‘‘Chief Informa8 tion Officer of the United States’’ in lieu thereof;

9 (11) in section 552a(u)(5)(B), by striking ‘‘Di10 rector of the Office of Management and Budget’’

11 and ‘‘Director’’ and inserting ‘‘Chief Information

12 Officer of the United States’’ in lieu thereof;

13 (12) in section 552a(u)(5)(C), by striking ‘‘Di14 rector’’ and inserting ‘‘Chief Information Officer of

15 the United States’’ in lieu thereof;

16 (13) in section 552a(u)(5)(D), by striking ‘‘Di17 rector of the Office of Management and Budget’’

18 and inserting ‘‘Chief Information Officer of the

19 United States’’ in lieu thereof;

20 (14) in section 552a(u)(6), by striking ‘‘Direc21 tor of the Office of Management and Budget’’ and

22 inserting ‘‘Chief Information Officer of the United

23 States’’ in lieu thereof; and

24 (15) in section 552a(v)—
126

•HR 5024 IH

1 (A) by striking ‘‘OFFICE OF MANAGEMENT

2 AND BUDGET’’ in the heading and inserting

3 ‘‘CHIEF INFORMATION OFFICER OF THE

4 UNITED STATES’’ in lieu thereof; and

5 (B) by striking ‘‘Director of the Office of

6 Management and Budget’’ and inserting ‘‘Chief

7 Information Officer of the United States’’ in

8 lieu thereof.

9 (c) COMPUTER SECURITY ACT.—

10 (1) Section 20(b)(5) of the National Institute of

11 Standards and Technology Act (15 U.S.C. 278g–

12 3(b)(5)) is amended by striking ‘‘Office of Manage13 ment and Budget’’ and inserting ‘‘Chief Information

14 Officer of the United States’’ in lieu thereof.

15 (2) Section 21(b)(3) of the National Institute of

16 Standards and Technology Act (15 U.S.C. 278g–

17 4(b)(3)) is amended by striking ‘‘Director of the Of18 fice of Management and Budget’’ and inserting

19 ‘‘Chief Information Officer of the United States’’ in

20 lieu thereof.

21 (3) Section 6(b) of the Computer Security Act

22 of 1987 (40 U.S.C. 1441 note) is amended by strik23 ing ‘‘Director of the Office of Management and

24 Budget’’ and inserting ‘‘Chief Information Officer of

25 the United States’’ in lieu thereof.
127

•HR 5024 IH

1 (d) INFORMATION TECHNOLOGY FUND.—Section

2 757(a) of title 40, United States Code, is amended by in3 serting at the end the following:

4 ‘‘(3) The Administrator’s decisions with regard

5 to obligations of and expenditures from the Fund

6 shall be subject to direction by the Chief Informa7 tion Officer of the United States.’’.

8 (e) GOVERNMENT PAPERWORK ELIMINATION ACT.—

9 Title XVII of Public Law 105–277 is repealed.

10 (f) CLINGER-COHEN ACT.—The Clinger-Cohen Act

11 (Public Law 104–106; 110 Stat. 679–703) is amended as

12 follows:

13 (1) Sections 5111, 5112, 5113, 5121, 5123,

14 5124, 5125(b), (c), and (d), 5126, 5127, 5128,

15 5131, 5132, 5141, 5142, 5201 are repealed.

16 (2) Section 5301(a)(1) is amended by striking

17 ‘‘Administrator for the Office of Information and

18 Regulatory Affairs’’ and inserting ‘‘Chief Informa19 tion Officer’’ in lieu thereof.

20 (3) Section 5303(a)(1) is amended by inserting

21 ‘‘and the Chief Information Officer’’ after ‘‘Direc22 tor’’.

23 (4) Section 5304 is amended by striking all and

24 inserting in lieu thereof: ‘‘If the Director and the

25 Chief Information Officer determine that the results
128

•HR 5024 IH

1 and findings under a pilot program under this title

2 indicate that legislation is necessary or desirable in

3 order to improve the process for acquisition of infor4 mation technology, the Director and the Chief Infor5 mation Officer shall transmit recommendations for

6 such legislation to Congress.’’.

7 (5) Section 5311(c) is amended by striking

8 ‘‘Administrator for the Office of Information and

9 Regulatory Affairs’’ and inserting ‘‘Chief Informa10 tion Officer’’ in lieu thereof.

11 (6) Section 5312(d)(1) is amended by striking

12 ‘‘Administrator for the Office of Information and

13 Regulatory Affairs’’ and inserting ‘‘Chief Informa14 tion Officer’’ in lieu thereof.

15 SEC. 9. EFFECTIVE DATE.

16 This Act and the amendments made by the Act shall

17 take effect 60 days after the date of the enactment of this

18 Act.

Æ