II 

110TH CONGRESS 

2D SESSION S. 3474 

To amend title 44, United States Code, to enhance information security 

of the Federal Government, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 11, 2008 

Mr. CARPER (for himself and Mr. LIEBERMAN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend title 44, United States Code, to enhance information security of the Federal Government, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Information 

5 Security Management Act of 2008’’ or the ‘‘FISMA Act 

6 of 2008’’. 

7 SEC. 2. DEFINITIONS. 

8 Section 3542(b) of title 44, United States Code, is 

9 amended by adding at the end the following: 


jbell on PROD1PC69 with BILLS
2 

•S 3474 IS

1 ‘‘(4) The term ‘adequate security’ means secu2 rity commensurate with the risk and magnitude of 

3 harm resulting from the loss, misuse, or unauthor4 ized access to or modification of information. 

5 ‘‘(5) The term ‘incident’ means an occurrence 

6 that actually or potentially jeopardizes the confiden7 tiality, integrity, or availability of an information 

8 system or the information the system processes, 

9 stores, or transmits or that constitutes a violation or 

10 imminent threat of violation of security policies, se11 curity procedures, or acceptable use policies. 

12 ‘‘(6) The term ‘information infrastructure’ 

13 means the underlying framework that information 

14 systems and assets rely on in processing, transmit15 ting, receiving, or storing information electroni16 cally.’’. 

17 SEC. 3. ANNUAL INDEPENDENT AUDIT. 

18 (a) REQUIREMENT FOR AUDIT INSTEAD OF EVALUA19 TION.—Section 3545 of title 44, United States Code, is 

20 amended— 

21 (1) in the section heading, by striking ‘‘EVAL22 UATION’’ and inserting ‘‘AUDIT’’ ; and 

23 (2) in paragraphs (1) and (2) of subsection (a), 

24 by striking ‘‘evaluation’’ and inserting ‘‘audit’’ both 

25 places that term appears. 


jbell on PROD1PC69 with BILLS
3 

•S 3474 IS

1 (b) ADDITIONAL SPECIFIC REQUIREMENTS FOR AU2 DITS.—Section 3545(a) of such title is amended— 

3 (1) in paragraph (2)— 

4 (A) in subparagraph (A), by striking ‘‘sub5 set of the agency’s information systems;’’ and 

6 inserting the following: ‘‘subset of— 

7 ‘‘(i) the information systems used or 

8 operated by the agency; and 

9 ‘‘(ii) the information systems used, 

10 operated, or supported on behalf of the 

11 agency by a contractor of the agency, any 

12 subcontractor (at any tier) of such a con13 tractor, or any other entity;’’; 

14 (B) in subparagraph (B), by striking 

15 ‘‘and’’ at the end; 

16 (C) in subparagraph (C), by striking the 

17 period and inserting ‘‘; and’’; and 

18 (D) by adding at the end the following new 

19 subparagraph: 

20 ‘‘(D) a conclusion as to whether the agen21 cy’s information security controls are effective, 

22 including an identification of any significant de23 ficiencies identified in such controls.’’; and 

24 (2) by adding at the end the following: 


jbell on PROD1PC69 with BILLS
4 

•S 3474 IS

1 ‘‘(3) Each audit under this section shall con2 form to generally accepted government auditing 

3 standards.’’. 

4 (c) TECHNICAL AND CONFORMING AMENDMENTS.— 

5 (1) Each of the following provisions of section 

6 3545 of title 44, United States Code, is amended by 

7 striking ‘‘evaluation’’ and inserting ‘‘audit’’ each 

8 place it appears: 

9 (A) Subsection (b)(1). 

10 (B) Subsection (b)(2). 

11 (C) Subsection (c). 

12 (D) Subsection (e)(1). 

13 (E) Subsection (e)(2). 

14 (2) Section 3545(d) of such title is amended to 

15 read as follows: 

16 ‘‘(d) EXISTING INFORMATION.—The audit required 

17 by this section may include consideration of relevant au18 dits, evaluations, reports, or other information relating to 

19 programs or practices of the applicable agency.’’. 

20 (3) Section 3545(f) of such title is amended by 

21 striking ‘‘evaluators’’ and inserting ‘‘auditors’’. 

22 (4) Section 3545(g)(1) of such title is amended 

23 by striking ‘‘evaluations’’ and inserting ‘‘audits’’. 

24 (5) Section 3545(g)(3) of such title is amended 

25 by striking ‘‘Evaluations’’ and inserting ‘‘Audits’’. 


jbell on PROD1PC69 with BILLS
5 

•S 3474 IS

1 (6) Section 3543(a)(8)(A) of such title is 

2 amended by striking ‘‘evaluations’’ and inserting 

3 ‘‘audits’’. 

4 (7) Section 3544(b)(5)(B) of such title is 

5 amended by striking ‘‘a evaluation’’ and inserting 

6 ‘‘an audit, evaluation, report, or other information 

7 relating to programs or practices of the applicable 

8 agency’’. 

9 SEC. 4. CHIEF INFORMATION SECURITY OFFICER AND 

10 CHIEF INFORMATION SECURITY OFFICER 

11 COUNCIL. 

12 (a) DELEGATIONS TO CHIEF INFORMATION SECU13 RITY OFFICER.—Section 3544(a) of title 44, United 

14 States Code, is amended— 

15 (1) in paragraph (3)— 

16 (A) in the matter preceding subparagraph 

17 (A)— 

18 (i) by striking ‘‘Chief Information Of19 ficer established under section 3506’’ and 

20 inserting ‘‘Chief Information Security Offi21 cer designated under section 3548’’; and 

22 (ii) by striking ‘‘ensure compliance’’ 

23 and inserting ‘‘enforce compliance’’; 

24 (B) by striking subparagraph (A); and 


jbell on PROD1PC69 with BILLS
6 

•S 3474 IS

1 (C) by redesignating subparagraphs (B) 

2 through (E) as subparagraphs (A) through (D), 

3 respectively; 

4 (2) in paragraph (4), by inserting ‘‘and 

5 cleared’’ after ‘‘trained’’; and 

6 (3) in paragraph (5), by striking ‘‘Chief Infor7 mation Officer’’ and inserting ‘‘Chief Information 

8 Security Officer’’. 

9 (b) CHIEF INFORMATION SECURITY OFFICER AND

10 CHIEF INFORMATION SECURITY OFFICER COUNCIL.— 

11 Chapter 35 of title 44, United States Code, is amended— 

12 (1) by redesignating sections 3548 and 3549 as 

13 sections 3553 and 3554, respectively; and 

14 (2) by inserting after section 3547 the fol15 lowing: 

16 ‘‘§ 3548. Chief Information Security Officers 

17 ‘‘(a) DESIGNATIONS.—(1) Except as provided under 

18 paragraph (2), the head of each agency shall designate 

19 a Chief Information Security Officer who with such agency 

20 head shall carry out the responsibilities of the agency 

21 under this subchapter. An individual may not serve as the 

22 Chief Information Officer and the Chief Information Secu23 rity Officer for an agency at the same time. The Chief 

24 Information Security Officer shall report directly to the 


jbell on PROD1PC69 with BILLS
7 

•S 3474 IS

1 Chief Information Officer to carry out such responsibil2 ities. 

3 ‘‘(2) The Secretary of Defense and the Secretary of 

4 each military department may each designate Chief Infor5 mation Security Officers who with the Secretary making 

6 the designation shall carry out the responsibilities of the 

7 applicable department under this subchapter. An indi8 vidual may not serve as the Chief Information Officer and 

9 the Chief Information Security Officer for a department 

10 at the same time. The Secretary shall provide for the Chief 

11 Information Security Officer to report to the applicable 

12 Chief Information Officer to carry out such responsibil13 ities. If more than 1 Chief Information Security Officer 

14 is designated, the respective duties of the Chief Informa15 tion Security Officers shall be clearly delineated. 

16 ‘‘(b) QUALIFICATIONS AND GENERAL DUTIES.—A 

17 Chief Information Security Officer shall— 

18 ‘‘(1) possess necessary qualifications, including 

19 education, professional certifications, training, expe20 rience, and the security clearance required to admin21 ister the functions described under this subchapter; 

22 and 

23 ‘‘(2) have information security duties as the 

24 primary duty of that official. 


jbell on PROD1PC69 with BILLS
8 

•S 3474 IS

1 ‘‘(c) RESPONSIBILITIES.—A Chief Information Secu2 rity Officer for an agency shall have the mission, budget, 

3 resources, and authority necessary to— 

4 ‘‘(1) oversee the establishment and maintenance 

5 of an incident response capability that on a contin6 uous basis can— 

7 ‘‘(A) detect, report, respond to, contain, in8 vestigate, attribute, and mitigate any network, 

9 computer, or data security incident that impairs 

10 adequate security, in accordance with policy 

11 provided by the Office of Management and 

12 Budget, in consultation with the Chief Informa13 tion Security Officer Council, and guidance 

14 from the National Institute of Standards and 

15 Technology; 

16 ‘‘(B) collaborate with other public and pri17 vate sector incident response resources to ad18 dress incidents that extend beyond the agency; 

19 and 

20 ‘‘(C) not later than 24 hours after dis21 covery of any incident described under subpara22 graph (A) unless otherwise directed by policy of 

23 the Office of Management and Budget, provide 

24 notice to the appropriate supporting informa25 tion security operating center, inspector genVerDate Aug 31 2005 04:22 Sep 12, 2008 Jkt 069200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3474.IS S3474

jbell on PROD1PC69 with BILLS
9 

•S 3474 IS

1 eral, and the United States Computer Emer2 gency Readiness Team; 

3 ‘‘(2) collaborate with the Chief Information Of4 ficer to establish, maintain, and update an enter5 prise network, system, storage, and security archi6 tecture framework documentation to be submitted 

7 quarterly to the United States Computer Emergency 

8 Readiness Team, that includes— 

9 ‘‘(A) documentation of how technical, man10 agerial, and operational security controls are 

11 implemented throughout the agency’s informa12 tion infrastructure; and 

13 ‘‘(B) documentation of how the controls 

14 described under subparagraph (A) maintain the 

15 appropriate level of confidentiality, integrity, 

16 and availability of electronic information and 

17 information systems based on National Insti18 tute of Standards and Technology guidance and 

19 Chief Information Security Officers Council rec20 ommended approaches; 

21 ‘‘(3) ensure that— 

22 ‘‘(A) risk assessments are conducted on a 

23 periodic basis; 

24 ‘‘(B) penetration tests are conducted com25 mensurate with risk (as defined by the National 


jbell on PROD1PC69 with BILLS
10 

•S 3474 IS

1 Institute of Standards and Technology) for an 

2 agency’s information infrastructure; and 

3 ‘‘(C) information security vulnerabilities 

4 are mitigated in a timely fashion; 

5 ‘‘(4) ensure that annual information technology 

6 security awareness and role-based training for agen7 cy employees and contractors is conducted; 

8 ‘‘(5) create, maintain, and manage an informa9 tion security performance measurement system that 

10 aligns with agency goals and budget process; and 

11 ‘‘(6) direct and manage information technology 

12 security programs and functions within all subordi13 nate agency organizations (including components, 

14 bureaus, offices, and other organizations within the 

15 agency). 

16 ‘‘(d) CONTINUOUS TECHNICAL MONITORING FOR

17 MALICIOUS ACTIVITY OF AGENCY NETWORK AND INFOR18 MATION SYSTEM.—(1) Each agency shall establish a 

19 mechanism that allows the Chief Information Security Of20 ficer of the agency to detect, monitor, correlate, and ana21 lyze, the security of any information system that is con22 nected to the agency’s information infrastructure on a 

23 continuous basis through automated monitoring. 

24 ‘‘(2) The Chief Information Security Officer of an 

25 agency shall be responsible for and have the authority to 


jbell on PROD1PC69 with BILLS
11 

•S 3474 IS

1 assure that any information system connected to the net2 work (directly or indirectly) that does not comply with se3 curity policies and standards, or has been compromised, 

4 is denied access and use of the agency network until the 

5 information system meets or exceeds accepted security 

6 policies and standards established by— 

7 ‘‘(A) the National Institute of Standards and 

8 Technology; 

9 ‘‘(B) the Office of Management and Budget; 

10 and 

11 ‘‘(C) the applicable agency. 

12 ‘‘(3) After notification to the applicable agency’s 

13 Chief Information Officer, the Chief Information Security 

14 Officer of an agency may prevent access to any informa15 tion system or individual that is using or attempts to use 

16 the agency information infrastructure if information secu17 rity policies and procedures have not been followed or im18 plemented. 

19 ‘‘(4) If the Chief Information Security Officer recog20 nizes a network, computer, or data security incident that 

21 impairs adequate security of an interagency information 

22 system, the Chief Information Security Officer shall notify 

23 the managing agency, agency inspector general, and the 

24 United States Computer Emergency Readiness Team 


jbell on PROD1PC69 with BILLS
12 

•S 3474 IS

1 within 24 hours after discovery of an incident as defined 

2 by policy of the Office of Management and Budget. 

3 ‘‘(e) OPERATIONAL EVALUATION.—(1) The Chief In4 formation Security Officer of an agency in consultation 

5 with the agency Chief Information Officer, with rec6 ommendations from the Chief Information Security Offi7 cers Council and in consultation with the Secretary of 

8 Homeland Security and the heads of other appropriate 

9 Federal agencies, shall— 

10 ‘‘(A) establish security control testing protocols 

11 that ensure that the information infrastructure of 

12 the agency, including contractor information systems 

13 operating on behalf of the agency are effectively pro14 tected against known vulnerabilities, attacks, and ex15 ploitations; 

16 ‘‘(B) oversee the deployment of such protocols 

17 throughout the information infrastructure of the 

18 agency; and 

19 ‘‘(C) update and test such protocols on a recur20 ring basis. 

21 ‘‘(2) After consideration of best practices and rec22 ommendations for operational evaluations established by 

23 the Chief Information Security Officer Council and in con24 sultation with the heads of appropriate agencies, the DeVerDate Aug 31 2005 04:22 Sep 12, 2008 Jkt 069200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S3474.IS S3474

jbell on PROD1PC69 with BILLS
13 

•S 3474 IS

1 partment of Homeland Security shall no less than annu2 ally— 

3 ‘‘(A) conduct an operational evaluation of the 

4 information infrastructure of each agency for known 

5 vulnerabilities, attacks, and exploitations of Federal 

6 networks on a frequent and recurring basis; 

7 ‘‘(B) evaluate the ability of each agency to 

8 monitor, detect, correlate, analyze, report, and re9 spond to breaches in information security policies 

10 and practices; 

11 ‘‘(C) report to the agency head, the Chief Infor12 mation Officer, and the Chief Information Security 

13 Officer of the applicable agency the findings of the 

14 operational evaluation; and 

15 ‘‘(D) in consultation with the Chief Information 

16 Officer and the Chief Information Security Officer 

17 of the applicable agency, assist with mitigating ex18 ploited vulnerabilities, attacks, and exploitations. 

19 ‘‘(3) Not later than 30 days after receiving an oper20 ational evaluation under paragraph (2), the Chief Infor21 mation Security Officer of an agency shall provide the 

22 Chief Information Officer and the agency head a plan for 

23 addressing recommendations and mitigating 

24 vulnerabilities contained in the security reports identified 


jbell on PROD1PC69 with BILLS
14 

•S 3474 IS

1 under paragraph (2), including a timeline and budget for 

2 implementing such plan. 

3 ‘‘(f) NATIONAL SECURITY SYSTEMS.—Subsections 

4 (c), (d), and (e) shall not apply to any national security 

5 system as defined under section 3542(b)(2) so long as that 

6 system is evaluated in a manner consistent with processes 

7 described under subsection (e)(2) (A) through (D) of this 

8 section. 

9 ‘‘§ 3549. Chief Information Security Officer Council 

10 ‘‘(a) ESTABLISHMENT.—There is established in the 

11 executive branch a Chief Information Security Officers 

12 Council (in this section referred to as the ‘Council’). 

13 ‘‘(b) MEMBERSHIP.—The members of the Council 

14 shall be full-time senior government employees. The mem15 bers shall be as follows: 

16 ‘‘(1) The Administrator of the Office of Elec17 tronic Government of the Office of Management and 

18 Budget. 

19 ‘‘(2) The Chief Information Security Officer of 

20 each agency described under section 901(b) of title 

21 31. 

22 ‘‘(3) The Chief Information Security Officer of 

23 the Department of the Army, the Department of the 

24 Navy, and the Department of the Air Force, if chief 


jbell on PROD1PC69 with BILLS
15 

•S 3474 IS

1 information officers have been designated for such 

2 departments under section 3506(a)(2)(B). 

3 ‘‘(4) A representative from the Office of the Di4 rector of National Intelligence. 

5 ‘‘(5) A representative from the United States 

6 Strategic Command. 

7 ‘‘(6) A representative from the United States 

8 Computer Emergency Readiness Team. 

9 ‘‘(7) A representative from the Intelligence 

10 Community Incident Response Center. 

11 ‘‘(8) A representative from the Committee on 

12 National Security Systems. 

13 ‘‘(9) Any other officer or employee of the 

14 United States designated by the chairperson. 

15 ‘‘(c) CO-CHAIRPERSONS AND VICE CHAIRPERSONS.— 

16 (1) The Director of the National Cyber Security Center 

17 shall act as chairperson of the Council. The Administrator 

18 of the Office of Electronic Government of the Office of 

19 Management and Budget shall act as co-chairperson of the 

20 Council. 

21 ‘‘(2) The vice chairperson of the Council shall be se22 lected by the Council from among its members. The vice 

23 chairperson shall serve a 1-year term and may serve mul24 tiple terms. The vice chairperson shall serve as a liaison 

25 to the Chief Information Officer, Council Committee on 


jbell on PROD1PC69 with BILLS
16 

•S 3474 IS

1 National Security Systems, and other councils or commit2 tees as appointed by the chairperson. 

3 ‘‘(d) FUNCTIONS.—(1) The Council shall be the prin4 cipal interagency forum for establishing best practices and 

5 recommendations for operational evaluations that use at6 tack-based testing protocols established under section 

7 3548(e). 

8 ‘‘(2) The Council shall— 

9 ‘‘(A) share experiences and innovative ap10 proaches relating to information sharing and infor11 mation security best practices, penetration testing 

12 regimes, and incident response mitigation; 

13 ‘‘(B) promote the development and use of 

14 standard performance measures for agency informa15 tion security that— 

16 ‘‘(i) are outcome-based; 

17 ‘‘(ii) focus on risk management; 

18 ‘‘(iii) align with the business and program 

19 goals of the agency; 

20 ‘‘(iv) measure improvements in the agency 

21 security posture over time; and 

22 ‘‘(v) reduce burdensome compliance meas23 ures; 

24 ‘‘(C) develop and recommend to the Office of 

25 Management and Budget the necessary qualificaVerDate Aug 31 2005 04:22 Sep 12, 2008 Jkt 069200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S3474.IS S3474

jbell on PROD1PC69 with BILLS
17 

•S 3474 IS

1 tions to be established for Chief Information Secu2 rity Officers to be capable of administering the func3 tions described under this subchapter including edu4 cation, training, and experience; 

5 ‘‘(D) enhance information system certification 

6 and accreditation processes by establishing a 

7 prioritized baseline of information security measures 

8 and controls that can be continuously monitored 

9 through automated mechanisms; and 

10 ‘‘(E) submit proposed enhancements to the Of11 fice of Management and Budget. 

12 ‘‘§ 3550. Requirements for contracts relating to agen13 cy information and information systems 

14 ‘‘(a) IN GENERAL.—(1) Not later than 180 days 

15 after the date of enactment of the Federal Information 

16 Security Management Act of 2008, the Director of the Of17 fice of Management and Budget, in consultation with the 

18 Director of the National Institutes of Standards and Tech19 nology, shall promulgate information security regulations 

20 governing contracts (including task or delivery orders 

21 issued pursuant to contracts) between the Federal Govern22 ment and any individual, corporation, partnership, organi23 zation, or other entity that interfaces with an information 

24 system of an agency or collects, stores, operates, or main25 tains information on behalf of the agency. 


jbell on PROD1PC69 with BILLS
18 

•S 3474 IS

1 ‘‘(2) Regulations promulgated under this subsection 

2 shall specify requirements concerning— 

3 ‘‘(A) adequacy and effectiveness of the security 

4 of information systems; 

5 ‘‘(B) the collection and transmission of infor6 mation, including personally identifiable information; 

7 and 

8 ‘‘(C) procedures in the event of a security inci9 dent. 

10 ‘‘(b) COMPLIANCE.—Notwithstanding any other pro11 vision of law, effective 180 days after the issuance of regu12 lations under subsection (a), no agency may enter into a 

13 contract (or issue a task or delivery orders under a con14 tract), or otherwise enter into an agreement, with an indi15 vidual, corporation, partnership, organization, or other en16 tity that interfaces with an information system of an agen17 cy or collects, stores, operates, or maintains information 

18 on behalf of the agency, unless the requirements of the 

19 contract or agreement are in compliance with such regula20 tions. 

21 ‘‘(c) SECURITY REQUIREMENTS.—Notwithstanding 

22 any other provision of law, effective 3 years after the 

23 issuance of regulations under subsection (a), no agency 

24 may enter into a contract (or issue a task or delivery order 

25 under contract), or otherwise enter into an agreement, 


jbell on PROD1PC69 with BILLS
19 

•S 3474 IS

1 with an individual, corporation, partnership, organization, 

2 or other entity for commercial off the shelf items, includ3 ing hardware and software that does not conform to the 

4 security requirements in such regulations. 

5 ‘‘§ 3551. Reports to Congress 

6 ‘‘(a) ANNUAL REPORTS.—(1) On March 1 of each 

7 year, the Department of Homeland Security shall submit 

8 a report on operational evaluations and testing protocols 

9 to— 

10 ‘‘(A) the Committee on Homeland Security and 

11 Governmental Affairs of the Senate; 

12 ‘‘(B) the Committee on Oversight and Govern13 ment Reform and the Committee on Homeland Se14 curity of the House of Representatives; 

15 ‘‘(C) the Select Committee on Intelligence of 

16 the Senate; 

17 ‘‘(D) the Permanent Select Committee on Intel18 ligence of the House of Representatives; 

19 ‘‘(E) the Government Accountability Office; and 

20 ‘‘(F) the President’s Council on Integrity and 

21 Efficiency and the Executive Council on Integrity 

22 and Efficiency. 

23 ‘‘(2) Each report submitted under this subsection 

24 shall— 


jbell on PROD1PC69 with BILLS
20 

•S 3474 IS

1 ‘‘(A) provide detailed information on the oper2 ational evaluations of each agency performed during 

3 the preceding fiscal year, the results of such evalua4 tions, and any actions that remain to be taken under 

5 plans included in corrective action reports under sec6 tion 3548(e)(3); 

7 ‘‘(B) describe the effectiveness of the testing 

8 protocols developed under section 3548(e)(1) in miti9 gating the risks associated with known 

10 vulnerabilities, attacks, and exploitations of the in11 formation infrastructure of each agency; 

12 ‘‘(C) describe the information security posture 

13 of the Federal Government, including— 

14 ‘‘(i) the risks to the confidentiality, integ15 rity, and availability of information government16 wide; and 

17 ‘‘(ii) a plan of action and milestones to 

18 mitigate the risks governmentwide; 

19 ‘‘(D) include any recommendations for relevant 

20 executive branch action and congressional oversight; 

21 and 

22 ‘‘(E) include an unclassified and classified re23 port of the operational evaluation. 

24 ‘‘(b) SECURITY REPORTS AND CORRECTIVE ACTION

25 REPORTS.—The agency head and inspector general of 


jbell on PROD1PC69 with BILLS
21 

•S 3474 IS

1 each agency shall make all information security reports 

2 and information security corrective action reports avail3 able upon request to— 

4 ‘‘(1) the Secretary of Homeland Security for 

5 purposes of completing the requirements under sub6 section (a); and 

7 ‘‘(2) the Comptroller General of the United 

8 States.’’. 

9 (c) TECHNICAL AND CONFORMING AMENDMENTS.— 

10 The table of sections for chapter 35 of title 44, United 

11 States Code, is amended by striking the items relating to 

12 sections 3548 and 3549 and inserting the following: 

‘‘Sec. 

‘‘3548. Chief Information Security Officers. 

‘‘3549. Chief Information Security Officer Council. 

‘‘3550. Requirements for contracts relating to agency information and information systems. 

‘‘3551. Reports to Congress. 

‘‘3552. Authorization of appropriations. 

‘‘3553. Effect on existing law.’’. 

Æ 


jbell on PROD1PC69 with BILLS