```

[Congressional Bills 110th Congress]
[From the U.S. Government Publishing Office]
[H.R. 4791 Referred in Senate (RFS)]

  2d Session
                                H. R. 4791

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                              June 4, 2008

Received; read twice and referred to the Committee on Homeland Security 
                        and Governmental Affairs

_______________________________________________________________________

                                 AN ACT

 
 To amend title 44, United States Code, to strengthen requirements for 
   ensuring the effectiveness of information security controls over 
 information resources that support Federal operations and assets, and 
                          for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Federal Agency 
Data Protection Act''.
    (b) Table of Contents.--The table of contents of this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Purpose.
Sec. 3. Definitions.
Sec. 4. Authority of Director of Office of Management and Budget to 
                            establish information security policies and 
                            procedures.
Sec. 5. Responsibilities of Federal agencies for information security.
Sec. 6. Federal agency data breach notification requirements.
Sec. 7. Protection of government computers from risks of peer-to-peer 
                            file sharing.
Sec. 8. Annual independent audit.
Sec. 9. Best practices for privacy impact assessments.
Sec. 10. Implementation.

SEC. 2. PURPOSE.

    The purpose of this Act is to protect personally identifiable 
information of individuals that is maintained in or transmitted by 
Federal agency information systems.

SEC. 3. DEFINITIONS.

    (a) Personally Identifiable Information and Mobile Digital Device 
Definitions.--Section 3542(b) of title 44, United States Code, is 
amended by adding at the end the following new paragraphs:
            ``(4) The term `personally identifiable information', with 
        respect to an individual, means any information about the 
        individual maintained by an agency, including information--
                    ``(A) about the individual's education, finances, 
                or medical, criminal, or employment history;
                    ``(B) that can be used to distinguish or trace the 
                individual's identity, including name, social security 
                number, date and place of birth, mother's maiden name, 
                or biometric records; or
                    ``(C) that is otherwise linked or linkable to the 
                individual.
            ``(5) The term `mobile digital device' includes any device 
        that can store or process information electronically and is 
        designed to be used in a manner not limited to a fixed 
        location, including--
                    ``(A) processing devices such as laptop computers, 
                communication devices, and other hand-held computing 
                devices; and
                    ``(B) storage devices such as portable hard drives, 
                CD-ROMs, DVDs, and other portable electronic media.''.
    (b) Conforming Amendments.--Section 208 of the E-Government Act of 
2002 (Public Law 107-347; 44 U.S.C. 3501 note) is amended--
            (1) in subsection (b)(1)(A)--
                    (A) in clause (i), by striking ``information that 
                is in an identifiable form'' and inserting ``personally 
                identifiable information''; and
                    (B) in clause (ii)(II), by striking ``information 
                in an identifiable form permitting the physical or 
                online contacting of a specific individual'' and 
                inserting ``personally identifiable information'';
            (2) in subsection (b)(2)(B)(i), by striking ``information 
        that is in an identifiable form'' and inserting ``personally 
        identifiable information'';
            (3) in subsection (b)(3)(C), by striking ``information that 
        is in an identifiable form'' and inserting ``personally 
        identifiable information''; and
            (4) in subsection (d), by striking the text and inserting 
        ``In this section, the term `personally identifiable 
        information' has the meaning given that term in section 
        3542(b)(4) of title 44, United States Code.''.

SEC. 4. AUTHORITY OF DIRECTOR OF OFFICE OF MANAGEMENT AND BUDGET TO 
              ESTABLISH INFORMATION SECURITY POLICIES AND PROCEDURES.

    Section 3543(a) of title 44, United States Code, is amended--
            (1) by inserting before the semicolon at the end of 
        paragraph (5) the following: ``, including plans and schedules, 
        developed by the agency on the basis of priorities for 
        addressing levels of identified risk, for conducting--
                    ``(A) testing and evaluation, as required under 
                section 3544(b)(5); and
                    ``(B) remedial action, as required under section 
                3544(b)(6), to address deficiencies identified by such 
                testing and evaluation''; and
            (2) by adding at the end the following:
            ``(9) establishing minimum requirements regarding the 
        protection of personally identifiable information maintained in 
        or transmitted by mobile digital devices, including 
        requirements for the use of technologies that efficiently and 
        effectively render information unusable by unauthorized 
        persons;
            ``(10) requiring agencies to comply with--
                    ``(A) minimally acceptable system configuration 
                requirements consistent with best practices, including 
                checklists developed under section 8(c) of the Cyber 
                Security Research and Development Act (Public Law 107-
                305; 116 Stat. 2378) by the Director of the National 
                Institute of Standards and Technology; and
                    ``(B) minimally acceptable requirements for 
                periodic testing and evaluation of the implementation 
                of such configuration requirements;
            ``(11) ensuring that agency contracts for (or involving or 
        including) the provision of information technology products or 
        services include requirements for contractors to meet minimally 
        acceptable configuration requirements, as required under 
        paragraph (10);
            ``(12) ensuring the establishment through regulation and 
        guidance of contract requirements to ensure compliance with 
        this subchapter with regard to providing information security 
        for information and information systems used or operated by a 
        contractor of an agency or other organization on behalf of the 
        agency; and''.

SEC. 5. RESPONSIBILITIES OF FEDERAL AGENCIES FOR INFORMATION SECURITY.

    Section 3544(b) of title 44, United States Code, is amended--
            (1) in paragraph (2)(D)(iii), by striking ``as determined 
        by the agency'' and inserting ``as required by the Director 
        under section 3543(a)(10)'';
            (2) in paragraph (5)--
                    (A) by inserting after ``annually'' the following: 
                ``and as approved by the Director'';
                    (B) by striking ``and'' at the end of subparagraph 
                (A);
                    (C) by redesignating subparagraph (B) as 
                subparagraph (D); and
                    (D) by inserting after subparagraph (A) the 
                following:
                    ``(B) shall include testing and evaluation of 
                system configuration requirements as required under 
                section 3543(a)(10);
                    ``(C) shall include testing of systems operated by 
                a contractor of the agency or other organization on 
                behalf of the agency, which testing requirement may be 
                satisfied by independent testing, evaluation, or audit 
                of such systems; and'';
            (3) by striking ``and'' at the end of paragraph (7);
            (4) by striking the period at the end of paragraph (8) and 
        inserting a semicolon; and
            (5) by adding at the end the following:
            ``(9) plans and procedures for ensuring the adequacy of 
        information security protections for systems maintaining or 
        transmitting personally identifiable information, including 
        requirements for--
                    ``(A) maintaining a current inventory of systems 
                maintaining or transmitting such information;
                    ``(B) implementing information security 
                requirements for mobile digital devices maintaining or 
                transmitting such information, as required by the 
                Director (including the use of technologies rendering 
                data unusable by unauthorized persons); and
                    ``(C) developing, implementing, and overseeing 
                remediation plans to address vulnerabilities in 
                information security protections for such 
                information;''.

SEC. 6. FEDERAL AGENCY DATA BREACH NOTIFICATION REQUIREMENTS.

    (a) Authority of Director of Office of Management and Budget To 
Establish Data Breach Policies.--Section 3543(a) of title 44, United 
States Code, as amended by section 4, is further amended--
            (1) by striking ``and'' at the end of paragraph (7);
            (2) in paragraph (8)--
                    (A) by striking ``and'' at the end of subparagraph 
                (D);
                    (B) by striking the period and inserting ``; and'' 
                at the end of subparagraph (E); and
                    (C) by adding at the end the following new 
                subparagraph:
                    ``(F) a summary of the breaches of information 
                security reported by agencies to the Director and the 
                Federal information security incident center pursuant 
                to paragraph (13);''; and
            (3) by adding at the end the following:
            ``(13) establishing policies, procedures, and standards for 
        agencies to follow in the event of a breach of data security 
        involving the disclosure of personally identifiable 
        information, specifically including--
                    ``(A) a requirement for timely notice to be 
                provided to those individuals whose personally 
                identifiable information could be compromised as a 
                result of such breach, except no notice shall be 
                required if the breach does not create a reasonable 
                risk--
                            ``(i) of identity theft, fraud, or other 
                        unlawful conduct regarding such individual; or
                            ``(ii) of other harm to the individual;
                    ``(B) guidance on determining how timely notice is 
                to be provided;
                    ``(C) guidance regarding whether additional special 
                actions are necessary and appropriate, including data 
                breach analysis, fraud resolution services, identify 
                theft insurance, and credit protection or monitoring 
                services; and
                    ``(D) a requirement for timely reporting by the 
                agencies of such breaches to the Director and Federal 
                information security center.''.
    (b) Authority of Chief Information Officer To Develop and Maintain 
Inventories.--Section 3544(a)(3) of title 44, United States Code, is 
amended--
            (1) by inserting after ``authority to ensure compliance 
        with'' the following: ``and, to the extent determined necessary 
        and explicitly authorized by the head of the agency, to 
        enforce'';
            (2) by striking ``and'' at the end of subparagraph (D);
            (3) by inserting ``and'' at the end of subparagraph (E); 
        and
            (4) by adding at the end the following:
                    ``(F) developing and maintaining an inventory of 
                all personal computers, laptops, or any other hardware 
                containing personally identifiable information;''.
    (c) Inclusion of Data Breach Notification.--Section 3544(b) of 
title 44, United States Code, as amended by section 5, is further 
amended by adding at the end the following:
            ``(10) procedures for notifying individuals whose 
        personally identifiable information may have been compromised 
        or accessed following a breach of information security; and
            ``(11) procedures for timely reporting of information 
        security breaches involving personally identifiable information 
        to the Director and the Federal information security incident 
        center.''.
    (d) Authority of Agency Chief Human Capital Officers To Assess 
Federal Personal Property.--Section 1402(a) of title 5, United States 
Code, is amended--
            (1) by striking ``, and'' at the end of paragraph (5) and 
        inserting a semicolon;
            (2) by striking the period and inserting ``; and'' at the 
        end of paragraph (6); and
            (3) by adding at the end the following:
            ``(7) prescribing policies and procedures for exit 
        interviews of employees, including a full accounting of all 
        Federal personal property that was assigned to the employee 
        during the course of employment.''.

SEC. 7. PROTECTION OF GOVERNMENT COMPUTERS FROM RISKS OF PEER-TO-PEER 
              FILE SHARING.

    (a) Plans Required.--As part of the Federal agency responsibilities 
set forth in sections 3544 and 3545 of title 44, United States Code, 
the head of each agency shall develop and implement a plan to ensure 
the security and privacy of information collected or maintained by or 
on behalf of the agency from the risks posed by certain peer-to-peer 
file sharing programs.
    (b) Contents of Plans.--Such plans shall set forth appropriate 
methods, including both technological (such as the use of software and 
hardware) and nontechnological methods (such as employee policies and 
user training), to achieve the goal of securing and protecting such 
information from the risks posed by peer-to-peer file sharing programs.
    (c) Implementation of Plans.--The head of each agency shall--
            (1) develop and implement the plan required under this 
        section as expeditiously as possible, but in no event later 
        than six months after the date of the enactment of this Act; 
        and
            (2) review and revise the plan periodically as necessary.
    (d) Review of Plans.--Not later than 18 months after the date of 
the enactment of this Act, the Comptroller General shall--
            (1) review the adequacy of the agency plans required by 
        this section; and
            (2) submit to the Committee on Oversight and Government 
        Reform of the House of Representatives and the Committee on 
        Homeland Security and Governmental Affairs of the Senate a 
        report on the results of the review, together with any 
        recommendations the Comptroller General considers appropriate.
    (e) Definitions.--In this section:
            (1) Peer-to-peer file sharing program.--The term ``peer-to-
        peer file sharing program'' means computer software that allows 
        the computer on which such software is installed (A) to 
        designate files available for transmission to another such 
        computer, (B) to transmit files directly to another such 
        computer, and (C) to request the transmission of files from 
        another such computer. The term does not include the use of 
        such software for file sharing between, among, or within 
        Federal, State, or local government agencies in order to 
        perform official agency business.
            (2) Agency.--The term ``agency'' has the meaning provided 
        by section 3502 of title 44, United States Code.

SEC. 8. ANNUAL INDEPENDENT AUDIT.

    (a) Requirement for Audit Instead of Evaluation.--Section 3545 of 
title 44, United States Code, is amended--
            (1) in the section heading, by striking ``evaluation'' and 
        inserting ``audit'' ; and
            (2) in paragraphs (1) and (2) of subsection (a), by 
        striking ``evaluation'' and inserting ``audit'' both places it 
        appears.
    (b) Additional Specific Requirements for Audits.--Section 3545(a) 
of such title is amended--
            (1) in paragraph (2)--
                    (A) in subparagraph (A), by striking ``subset of 
                the agency's information systems;'' and inserting the 
                following: ``subset of--
                    ``(i) the information systems used or operated by 
                the agency; and
                    ``(ii) the information systems used, operated, or 
                supported on behalf of the agency by a contractor of 
                the agency, any subcontractor (at any tier) of such a 
                contractor, or any other entity;'';
                    (B) in subparagraph (B), by striking ``and'' at the 
                end;
                    (C) in subparagraph (C), by striking the period and 
                inserting ``; and''; and
                    (D) by adding at the end the following new 
                subparagraph:
            ``(D) a conclusion whether the agency's information 
        security controls are effective, including an identification of 
        any significant deficiencies in such controls.''; and
            (2) by adding at the end the following new paragraph:
    ``(3) Each audit under this section shall conform to generally 
accepted government auditing standards.''.
    (c) Conforming Amendments.--
            (1) Each of the following provisions of section 3545 of 
        title 44, United States Code, is amended by striking 
        ``evaluation'' and inserting ``audit'' each place it appears:
                    (A) Subsection (b)(1).
                    (B) Subsection (b)(2).
                    (C) Subsection (c).
                    (D) Subsection (e)(1).
                    (E) Subsection (e)(2).
            (2) Section 3545(d) of such title is amended to read as 
        follows:
    ``(d) Existing Audits.--The audit required by this section may be 
based in whole or in part on an audit relating to programs or practices 
of the applicable agency.''.
            (3) Section 3545(f) of such title is amended by striking 
        ``evaluators'' and inserting ``auditors''.
            (4) Section 3545(g)(1) of such title is amended by striking 
        ``evaluations'' and inserting ``audits''.
            (5) Section 3545(g)(3) of such title is amended by striking 
        ``Evaluations'' and inserting ``Audits''.
            (6) Section 3543(a)(8)(A) of such title is amended by 
        striking ``evaluations'' and inserting ``audits''.
            (7) Section 3544(b)(5)(D) of such title (as redesignated by 
        section 5(2)(C)) is amended by striking ``a evaluation'' and 
        inserting ``an audit''.

SEC. 9. BEST PRACTICES FOR PRIVACY IMPACT ASSESSMENTS.

    Section 208(b)(3) of the E-Government Act of 2002 (Public Law 107-
347; 44 U.S.C. 3501 note) is amended--
            (1) in subparagraph (B), by striking ``and'' at the end;
            (2) in subparagraph (C), by striking the period and 
        inserting ``; and'', and
            (3) by adding at the end the following:
                    ``(D) develop best practices for agencies to follow 
                in conducting privacy impact assessments.''.

SEC. 10. IMPLEMENTATION.

    Except as otherwise specifically provided in this Act, 
implementation of this Act and the amendments made by this Act shall 
begin not later than 90 days after the date of the enactment of this 
Act.

            Passed the House of Representatives June 3, 2008.

            Attest:

                                            LORRAINE C. MILLER,

                                                                 Clerk.
```