II 

113TH CONGRESS 

2D SESSION S. 2521 

To amend chapter 35 of title 44, United States Code, to provide for reform 

to Federal information security. 

IN THE SENATE OF THE UNITED STATES 

JUNE 24, 2014 

Mr. CARPER (for himself and Mr. COBURN) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend chapter 35 of title 44, United States Code, to 

provide for reform to Federal information security. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Information 

5 Security Modernization Act of 2014’’. 

6 SEC. 2. FISMA REFORM. 

7 (a) IN GENERAL.—Chapter 35 of title 44, United 

8 States Code, is amended by striking subchapters II and 

9 III and inserting the following: 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
2 

•S 2521 IS

1 ‘‘SUBCHAPTER II—INFORMATION SECURITY 

2 ‘‘§ 3551. Purposes 

3 ‘‘The purposes of this subchapter are to— 

4 ‘‘(1) provide a comprehensive framework for en5 suring the effectiveness of information security con6 trols over information resources that support Fed7 eral operations and assets; 

8 ‘‘(2) recognize the highly networked nature of 

9 the current Federal computing environment and pro10 vide effective governmentwide management and over11 sight of the related information security risks, in12 cluding coordination of information security efforts 

13 throughout the civilian, national security, and law 

14 enforcement communities; 

15 ‘‘(3) provide for development and maintenance 

16 of minimum controls required to protect Federal in17 formation and information systems; 

18 ‘‘(4) provide a mechanism for improved over19 sight of Federal agency information security pro20 grams; 

21 ‘‘(5) acknowledge that commercially developed 

22 information security products offer advanced, dy23 namic, robust, and effective information security so24 lutions, reflecting market solutions for the protection 

25 of critical information infrastructures important to 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
3 

•S 2521 IS

1 the national defense and economic security of the 

2 nation that are designed, built, and operated by the 

3 private sector; and 

4 ‘‘(6) recognize that the selection of specific 

5 technical hardware and software information secu6 rity solutions should be left to individual agencies 

7 from among commercially developed products. 

8 ‘‘§ 3552. Definitions 

9 ‘‘(a) IN GENERAL.—Except as provided under sub10 section (b), the definitions under section 3502 shall apply 

11 to this subchapter. 

12 ‘‘(b) ADDITIONAL DEFINITIONS.—As used in this 

13 subchapter: 

14 ‘‘(1) The term ‘binding operational directive’ 

15 means a compulsory direction to an agency that is 

16 in accordance with policies, principles, standards, 

17 and guidelines issued by the Director. 

18 ‘‘(2) The term ‘incident’ means an occurrence 

19 that— 

20 ‘‘(A) actually or imminently jeopardizes, 

21 without lawful authority, the integrity, con22 fidentiality, or availability of information or an 

23 information system; or 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
4 

•S 2521 IS

1 ‘‘(B) constitutes a violation or imminent 

2 threat of violation of law, security policies, secu3 rity procedures, or acceptable use policies. 

4 ‘‘(3) The term ‘information security’ means 

5 protecting information and information systems 

6 from unauthorized access, use, disclosure, disrup7 tion, modification, or destruction in order to pro8 vide— 

9 ‘‘(A) integrity, which means guarding 

10 against improper information modification or 

11 destruction, and includes ensuring information 

12 nonrepudiation and authenticity; 

13 ‘‘(B) confidentiality, which means pre14 serving authorized restrictions on access and 

15 disclosure, including means for protecting per16 sonal privacy and proprietary information; and 

17 ‘‘(C) availability, which means ensuring 

18 timely and reliable access to and use of infor19 mation. 

20 ‘‘(4) The term ‘information technology’ has the 

21 meaning given that term in section 11101 of title 

22 40. 

23 ‘‘(5) The term ‘intelligence community’ has the 

24 meaning given that term in section 3(4) of the Na25 tional Security Act of 1947 (50 U.S.C. 3003(4)). 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
5 

•S 2521 IS

1 ‘‘(6)(A) The term ‘national security system’ 

2 means any information system (including any tele3 communications system) used or operated by an 

4 agency or by a contractor of an agency, or other or5 ganization on behalf of an agency— 

6 ‘‘(i) the function, operation, or use of 

7 which— 

8 ‘‘(I) involves intelligence activities; 

9 ‘‘(II) involves cryptologic activities re10 lated to national security; 

11 ‘‘(III) involves command and control 

12 of military forces; 

13 ‘‘(IV) involves equipment that is an 

14 integral part of a weapon or weapons sys15 tem; or 

16 ‘‘(V) subject to subparagraph (B), is 

17 critical to the direct fulfillment of military 

18 or intelligence missions; or 

19 ‘‘(ii) is protected at all times by procedures 

20 established for information that have been spe21 cifically authorized under criteria established by 

22 an Executive order or an Act of Congress to be 

23 kept classified in the interest of national de24 fense or foreign policy. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
6 

•S 2521 IS

1 ‘‘(B) Subparagraph (A)(i)(V) does not include a 

2 system that is to be used for routine administrative 

3 and business applications (including payroll, finance, 

4 logistics, and personnel management applications). 

5 ‘‘(7) The term ‘Secretary’ means the Secretary 

6 of Homeland Security. 

7 ‘‘§ 3553. Authority and functions of the Director and 

8 the Secretary 

9 ‘‘(a) DIRECTOR.—The Director shall oversee agency 

10 information security policies, including— 

11 ‘‘(1) developing and overseeing the implementa12 tion of policies, principles, standards, and guidelines 

13 on information security, including through ensuring 

14 timely agency adoption of and compliance with 

15 standards promulgated under section 11331 of title 

16 40; 

17 ‘‘(2) requiring agencies, consistent with the 

18 standards promulgated under such section 11331 

19 and the requirements of this subchapter, to identify 

20 and provide information security protections com21 mensurate with the risk and magnitude of the harm 

22 resulting from the unauthorized access, use, disclo23 sure, disruption, modification, or destruction of— 

24 ‘‘(A) information collected or maintained 

25 by or on behalf of an agency; or 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
7 

•S 2521 IS

1 ‘‘(B) information systems used or operated 

2 by an agency or by a contractor of an agency 

3 or other organization on behalf of an agency; 

4 ‘‘(3) ensuring that the Secretary carries out the 

5 authorities and functions under subsection (b); 

6 ‘‘(4) coordinating the development of standards 

7 and guidelines under section 20 of the National In8 stitute of Standards and Technology Act (15 U.S.C. 

9 278g–3) with agencies and offices operating or exer10 cising control of national security systems (including 

11 the National Security Agency) to assure, to the max12 imum extent feasible, that such standards and 

13 guidelines are complementary with standards and 

14 guidelines developed for national security systems; 

15 ‘‘(5) overseeing agency compliance with the re16 quirements of this subchapter, including through 

17 any authorized action under section 11303 of title 

18 40, to enforce accountability for compliance with 

19 such requirements; 

20 ‘‘(6) coordinating information security policies 

21 and procedures with related information resources 

22 management policies and procedures; and 

23 ‘‘(7) consulting with the Secretary in carrying 

24 out the authorities and functions under this sub25 section. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
8 

•S 2521 IS

1 ‘‘(b) SECRETARY.—The Secretary, in consultation 

2 with the Director, shall oversee the operational aspects of 

3 agency information security policies and practices for in4 formation systems, except for national security systems 

5 and information systems described in paragraph (2) or (3) 

6 of subsection (e), including— 

7 ‘‘(1) assisting the Director in carrying out the 

8 authorities and functions under subsection (a); 

9 ‘‘(2) developing and overseeing the implementa10 tion of binding operational directives to agencies to 

11 implement the policies, principles, standards, and 

12 guidelines developed by the Director under sub13 section (a)(1) and the requirements of this sub14 chapter, which may be repealed by the Director if 

15 the operational directives issued on behalf of the Di16 rector are not in accordance with policies, principles, 

17 standards, and guidelines developed by the Director, 

18 including— 

19 ‘‘(A) requirements for reporting security 

20 incidents to the Federal information security in21 cident center established under section 3556; 

22 ‘‘(B) requirements for the contents of the 

23 annual reports required to be submitted under 

24 section 3554(c)(1); 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
9 

•S 2521 IS

1 ‘‘(C) requirements for the mitigation of ex2 igent risks to information systems; and 

3 ‘‘(D) other operational requirements as the 

4 Director or Secretary may determine necessary; 

5 ‘‘(3) monitoring agency implementation of in6 formation security policies and practices; 

7 ‘‘(4) convening meetings with senior agency of8 ficials to help ensure effective implementation of in9 formation security policies and practices; 

10 ‘‘(5) coordinating Government-wide efforts on 

11 information security policies and practices, including 

12 consultation with the Chief Information Officers 

13 Council established under section 3603; 

14 ‘‘(6) providing operational and technical assist15 ance to agencies in implementing policies, principles, 

16 standards, and guidelines on information security, 

17 including implementation of standards promulgated 

18 under section 11331 of title 40, including by— 

19 ‘‘(A) operating the Federal information se20 curity incident center established under section 

21 3556; 

22 ‘‘(B) upon request by an agency, deploying 

23 technology to assist the agency to continuously 

24 diagnose and mitigate against cyber threats and 

25 vulnerabilities, with or without reimbursement; 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
10 

•S 2521 IS

1 ‘‘(C) compiling and analyzing data on 

2 agency information security; and 

3 ‘‘(D) developing and conducting targeted 

4 operational evaluations, including threat and 

5 vulnerability assessments, on the information 

6 systems; and 

7 ‘‘(7) other actions as the Secretary may deter8 mine necessary to carry out this subsection on behalf 

9 of the Director. 

10 ‘‘(c) REPORT.—Not later than March 1 of each year, 

11 the Director, in consultation with the Secretary, shall sub12 mit to Congress a report on the effectiveness of informa13 tion security policies and practices during the preceding 

14 year, including— 

15 ‘‘(1) a summary of the incidents described in 

16 the annual reports required to be submitted under 

17 section 3554(c)(1), including a summary of the in18 formation required under section 3554(c)(1)(A)(iii); 

19 ‘‘(2) a description of the threshold for reporting 

20 major information security incidents; 

21 ‘‘(3) a summary of the results of evaluations re22 quired to be performed under section 3555; 

23 ‘‘(4) an assessment of agency compliance with 

24 standards promulgated under section 11331 of title 

25 40; and 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
11 

•S 2521 IS

1 ‘‘(5) an assessment of agency compliance with 

2 the policies and procedures established under section 

3 3559(a). 

4 ‘‘(d) NATIONAL SECURITY SYSTEMS.—Except for the 

5 authorities and functions described in subsection (a)(4) 

6 and subsection (c), the authorities and functions of the 

7 Director and the Secretary under this section shall not 

8 apply to national security systems. 

9 ‘‘(e) DEPARTMENT OF DEFENSE AND INTELLIGENCE

10 COMMUNITY SYSTEMS.—(1) The authorities of the Direc11 tor described in paragraphs (1) and (2) of subsection (a) 

12 shall be delegated to the Secretary of Defense in the case 

13 of systems described in paragraph (2) and to the Director 

14 of National Intelligence in the case of systems described 

15 in paragraph (3). 

16 ‘‘(2) The systems described in this paragraph are sys17 tems that are operated by the Department of Defense, a 

18 contractor of the Department of Defense, or another enti19 ty on behalf of the Department of Defense that processes 

20 any information the unauthorized access, use, disclosure, 

21 disruption, modification, or destruction of which would 

22 have a debilitating impact on the mission of the Depart23 ment of Defense. 

24 ‘‘(3) The systems described in this paragraph are sys25 tems that are operated by an element of the intelligence 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
12 

•S 2521 IS

1 community, a contractor of an element of the intelligence 

2 community, or another entity on behalf of an element of 

3 the intelligence community that processes any information 

4 the unauthorized access, use, disclosure, disruption, modi5 fication, or destruction of which would have a debilitating 

6 impact on the mission of an element of the intelligence 

7 community. 

8 ‘‘§ 3554. Federal agency responsibilities 

9 ‘‘(a) IN GENERAL.—The head of each agency shall— 

10 ‘‘(1) be responsible for— 

11 ‘‘(A) providing information security protec12 tions commensurate with the risk and mag13 nitude of the harm resulting from unauthorized 

14 access, use, disclosure, disruption, modification, 

15 or destruction of— 

16 ‘‘(i) information collected or main17 tained by or on behalf of the agency; and 

18 ‘‘(ii) information systems used or op19 erated by an agency or by a contractor of 

20 an agency or other organization on behalf 

21 of an agency; 

22 ‘‘(B) complying with the requirements of 

23 this subchapter and related policies, procedures, 

24 standards, and guidelines, including— 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
13 

•S 2521 IS

1 ‘‘(i) information security standards 

2 promulgated under section 11331 of title 

3 40; 

4 ‘‘(ii) operational directives developed 

5 by the Secretary under section 3553(b); 

6 ‘‘(iii) policies and procedures issued 

7 by the Director under section 3559; and 

8 ‘‘(iv) information security standards 

9 and guidelines for national security sys10 tems issued in accordance with law and as 

11 directed by the President; and 

12 ‘‘(C) ensuring that information security 

13 management processes are integrated with 

14 agency strategic and operational planning proc15 esses; 

16 ‘‘(2) ensure that senior agency officials provide 

17 information security for the information and infor18 mation systems that support the operations and as19 sets under their control, including through— 

20 ‘‘(A) assessing the risk and magnitude of 

21 the harm that could result from the unauthor22 ized access, use, disclosure, disruption, modi23 fication, or destruction of such information or 

24 information systems; 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
14 

•S 2521 IS

1 ‘‘(B) determining the levels of information 

2 security appropriate to protect such information 

3 and information systems in accordance with 

4 standards promulgated under section 11331 of 

5 title 40, for information security classifications 

6 and related requirements; 

7 ‘‘(C) implementing policies and procedures 

8 to cost-effectively reduce risks to an acceptable 

9 level; and 

10 ‘‘(D) periodically testing and evaluating in11 formation security controls and techniques to 

12 ensure that they are effectively implemented; 

13 ‘‘(3) delegate to the agency Chief Information 

14 Officer established under section 3506 (or com15 parable official in an agency not covered by such 

16 section) the authority to ensure compliance with the 

17 requirements imposed on the agency under this sub18 chapter, including— 

19 ‘‘(A) designating a senior agency informa20 tion security officer who shall— 

21 ‘‘(i) carry out the Chief Information 

22 Officer’s responsibilities under this section; 

23 ‘‘(ii) possess professional qualifica24 tions, including training and experience, 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
15 

•S 2521 IS

1 required to administer the functions de2 scribed under this section; 

3 ‘‘(iii) have information security duties 

4 as that official’s primary duty; and 

5 ‘‘(iv) head an office with the mission 

6 and resources to assist in ensuring agency 

7 compliance with this section; 

8 ‘‘(B) developing and maintaining an agen9 cywide information security program as re10 quired by subsection (b); 

11 ‘‘(C) developing and maintaining informa12 tion security policies, procedures, and control 

13 techniques to address all applicable require14 ments, including those issued under section 

15 3553 of this title and section 11331 of title 40; 

16 ‘‘(D) training and overseeing personnel 

17 with significant responsibilities for information 

18 security with respect to such responsibilities; 

19 and 

20 ‘‘(E) assisting senior agency officials con21 cerning their responsibilities under paragraph 

22 (2); 

23 ‘‘(4) ensure that the agency has trained per24 sonnel sufficient to assist the agency in complying 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
16 

•S 2521 IS

1 with the requirements of this subchapter and related 

2 policies, procedures, standards, and guidelines; 

3 ‘‘(5) ensure that the agency Chief Information 

4 Officer, in coordination with other senior agency of5 ficials, reports annually to the agency head on the 

6 effectiveness of the agency information security pro7 gram, including progress of remedial actions; 

8 ‘‘(6) ensure that senior agency officials, includ9 ing chief information officers of component agencies 

10 or equivalent officials, carry out responsibilities 

11 under this subchapter as directed by the official del12 egated authority under paragraph (3); and 

13 ‘‘(7) ensure that all personnel are held account14 able for complying with the agency-wide information 

15 security program implemented under subsection (b). 

16 ‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 

17 document, and implement an agency-wide information se18 curity program to provide information security for the in19 formation and information systems that support the oper20 ations and assets of the agency, including those provided 

21 or managed by another agency, contractor, or other 

22 source, that includes— 

23 ‘‘(1) periodic assessments of the risk and mag24 nitude of the harm that could result from the unau25 thorized access, use, disclosure, disruption, modificaVerDate Mar 15 2010 03:10 Jul 01, 2014 Jkt 039200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6201 E:\BILLS\S2521.IS S2521

tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
17 

•S 2521 IS

1 tion, or destruction of information and information 

2 systems that support the operations and assets of 

3 the agency; 

4 ‘‘(2) policies and procedures that— 

5 ‘‘(A) are based on the risk assessments re6 quired by paragraph (1); 

7 ‘‘(B) cost-effectively reduce information se8 curity risks to an acceptable level; 

9 ‘‘(C) ensure that information security is 

10 addressed throughout the life cycle of each 

11 agency information system; and 

12 ‘‘(D) ensure compliance with— 

13 ‘‘(i) the requirements of this sub14 chapter; 

15 ‘‘(ii) policies and procedures as may 

16 be prescribed by the Director, and infor17 mation security standards promulgated 

18 under section 11331 of title 40; 

19 ‘‘(iii) minimally acceptable system 

20 configuration requirements, as determined 

21 by the agency; and 

22 ‘‘(iv) any other applicable require23 ments, including standards and guidelines 

24 for national security systems issued in acVerDate Mar 15 2010 03:10 Jul 01, 2014 Jkt 039200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\S2521.IS S2521

tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
18 

•S 2521 IS

1 cordance with law and as directed by the 

2 President; 

3 ‘‘(3) subordinate plans for providing adequate 

4 information security for networks, facilities, and sys5 tems or groups of information systems, as appro6 priate; 

7 ‘‘(4) security awareness training to inform per8 sonnel, including contractors and other users of in9 formation systems that support the operations and 

10 assets of the agency, of— 

11 ‘‘(A) information security risks associated 

12 with their activities; and 

13 ‘‘(B) their responsibilities in complying 

14 with agency policies and procedures designed to 

15 reduce these risks; 

16 ‘‘(5) periodic testing and evaluation of the ef17 fectiveness of information security policies, proce18 dures, and practices, to be performed with a fre19 quency depending on risk, but no less than annually, 

20 of which such testing— 

21 ‘‘(A) shall include testing of management, 

22 operational, and technical controls of every in23 formation system identified in the inventory re24 quired under section 3505(c); and 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
19 

•S 2521 IS

1 ‘‘(B) may include testing relied on in an 

2 evaluation under section 3555; 

3 ‘‘(6) a process for planning, implementing, eval4 uating, and documenting remedial action to address 

5 any deficiencies in the information security policies, 

6 procedures, and practices of the agency; 

7 ‘‘(7) procedures for detecting, reporting, and re8 sponding to security incidents, consistent with stand9 ards and guidelines described in section 3556(b), in10 cluding— 

11 ‘‘(A) mitigating risks associated with such 

12 incidents before substantial damage is done; 

13 ‘‘(B) notifying and consulting with the 

14 Federal information security incident center es15 tablished in section 3556; and 

16 ‘‘(C) notifying and consulting with, as ap17 propriate— 

18 ‘‘(i) law enforcement agencies and rel19 evant Offices of Inspector General; 

20 ‘‘(ii) an office designated by the Presi21 dent for any incident involving a national 

22 security system; 

23 ‘‘(iii) the committees of Congress de24 scribed in subsection (c)(1)— 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
20 

•S 2521 IS

1 ‘‘(I) not later than 7 days after 

2 the date on which the incident is dis3 covered; and 

4 ‘‘(II) after the initial notification 

5 under subclause (I), within a reason6 able period of time after additional in7 formation relating to the incident is 

8 discovered; and 

9 ‘‘(iv) any other agency or office, in ac10 cordance with law or as directed by the 

11 President; and 

12 ‘‘(8) plans and procedures to ensure continuity 

13 of operations for information systems that support 

14 the operations and assets of the agency. 

15 ‘‘(c) AGENCY REPORTING.— 

16 ‘‘(1) ANNUAL REPORT.— 

17 ‘‘(A) IN GENERAL.—Each agency shall 

18 submit to the Director, the Secretary, the Com19 mittee on Government Reform, the Committee 

20 on Homeland Security, and the Committee on 

21 Science of the House of Representatives, the 

22 Committee on Homeland Security and Govern23 mental Affairs and the Committee on Com24 merce, Science, and Transportation of the Sen25 ate, the appropriate authorization and approVerDate Mar 15 2010 03:10 Jul 01, 2014 Jkt 039200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6201 E:\BILLS\S2521.IS S2521

tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
21 

•S 2521 IS

1 priations committees of Congress, and the 

2 Comptroller General a report on the adequacy 

3 and effectiveness of information security poli4 cies, procedures, and practices, including— 

5 ‘‘(i) a description of each major infor6 mation security incident or related sets of 

7 incidents, including summaries of— 

8 ‘‘(I) the threats and threat ac9 tors, vulnerabilities, and impacts re10 lating to the incident; 

11 ‘‘(II) the risk assessments con12 ducted under section 3554(a)(2)(A) of 

13 the affected information systems be14 fore the date on which the incident oc15 curred; and 

16 ‘‘(III) the detection, response, 

17 and remediation actions; 

18 ‘‘(ii) the total number of information 

19 security incidents, including a description 

20 of incidents resulting in significant com21 promise of information security, system 

22 impact levels, types of incident, and loca23 tions of affected systems; 

24 ‘‘(iii) a description of each major in25 formation security incident that involved a 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
22 

•S 2521 IS

1 breach of personally identifiable informa2 tion, including— 

3 ‘‘(I) the number of individuals 

4 whose information was affected by the 

5 major information security incident; 

6 and 

7 ‘‘(II) a description of the infor8 mation that was breached or exposed; 

9 and 

10 ‘‘(iv) any other information as the 

11 Secretary may require. 

12 ‘‘(B) UNCLASSIFIED REPORT.— 

13 ‘‘(i) IN GENERAL.—Each report sub14 mitted under subparagraph (A) shall be in 

15 unclassified form, but may include a classi16 fied annex. 

17 ‘‘(ii) ACCESS TO INFORMATION.—The 

18 head of an agency shall ensure that, to the 

19 greatest extent practicable, information is 

20 included in the unclassified version of the 

21 reports submitted by the agency under 

22 subparagraph (A). 

23 ‘‘(2) OTHER PLANS AND REPORTS.—Each 

24 agency shall address the adequacy and effectiveness 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
23 

•S 2521 IS

1 of information security policies, procedures, and 

2 practices in management plans and reports. 

3 ‘‘(d) PERFORMANCE PLAN.—(1) In addition to the 

4 requirements of subsection (c), each agency, in consulta5 tion with the Director, shall include as part of the per6 formance plan required under section 1115 of title 31 a 

7 description of— 

8 ‘‘(A) the time periods; and 

9 ‘‘(B) the resources, including budget, staffing, 

10 and training, 

11 that are necessary to implement the program required 

12 under subsection (b). 

13 ‘‘(2) The description under paragraph (1) shall be 

14 based on the risk assessments required under subsection 

15 (b)(1). 

16 ‘‘(e) PUBLIC NOTICE AND COMMENT.—Each agency 

17 shall provide the public with timely notice and opportuni18 ties for comment on proposed information security policies 

19 and procedures to the extent that such policies and proce20 dures affect communication with the public. 

21 ‘‘§ 3555. Annual independent evaluation 

22 ‘‘(a) IN GENERAL.—(1) Each year each agency shall 

23 have performed an independent evaluation of the informa24 tion security program and practices of that agency to de25 termine the effectiveness of such program and practices. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
24 

•S 2521 IS

1 ‘‘(2) Each evaluation under this section shall in2 clude— 

3 ‘‘(A) testing of the effectiveness of information 

4 security policies, procedures, and practices of a rep5 resentative subset of the agency’s information sys6 tems; 

7 ‘‘(B) an assessment of the effectiveness of the 

8 information security policies, procedures, and prac9 tices of the agency; and 

10 ‘‘(C) separate presentations, as appropriate, re11 garding information security relating to national se12 curity systems. 

13 ‘‘(b) INDEPENDENT AUDITOR.—Subject to sub14 section (c)— 

15 ‘‘(1) for each agency with an Inspector General 

16 appointed under the Inspector General Act of 1978, 

17 the annual evaluation required by this section shall 

18 be performed by the Inspector General or by an 

19 independent external auditor, as determined by the 

20 Inspector General of the agency; and 

21 ‘‘(2) for each agency to which paragraph (1) 

22 does not apply, the head of the agency shall engage 

23 an independent external auditor to perform the eval24 uation. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
25 

•S 2521 IS

1 ‘‘(c) NATIONAL SECURITY SYSTEMS.—For each 

2 agency operating or exercising control of a national secu3 rity system, that portion of the evaluation required by this 

4 section directly relating to a national security system shall 

5 be performed— 

6 ‘‘(1) only by an entity designated by the agency 

7 head; and 

8 ‘‘(2) in such a manner as to ensure appropriate 

9 protection for information associated with any infor10 mation security vulnerability in such system com11 mensurate with the risk and in accordance with all 

12 applicable laws. 

13 ‘‘(d) EXISTING EVALUATIONS.—The evaluation re14 quired by this section may be based in whole or in part 

15 on an audit, evaluation, or report relating to programs or 

16 practices of the applicable agency. 

17 ‘‘(e) AGENCY REPORTING.—(1) Each year, not later 

18 than such date established by the Director, the head of 

19 each agency shall submit to the Director the results of 

20 the evaluation required under this section. 

21 ‘‘(2) To the extent an evaluation required under this 

22 section directly relates to a national security system, the 

23 evaluation results submitted to the Director shall contain 

24 only a summary and assessment of that portion of the 

25 evaluation directly relating to a national security system. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
26 

•S 2521 IS

1 ‘‘(f) PROTECTION OF INFORMATION.—Agencies and 

2 evaluators shall take appropriate steps to ensure the pro3 tection of information which, if disclosed, may adversely 

4 affect information security. Such protections shall be com5 mensurate with the risk and comply with all applicable 

6 laws and regulations. 

7 ‘‘(g) OMB REPORTS TO CONGRESS.—(1) The Direc8 tor shall summarize the results of the evaluations con9 ducted under this section in the report to Congress re10 quired under section 3553(c). 

11 ‘‘(2) The Director’s report to Congress under this 

12 subsection shall summarize information regarding infor13 mation security relating to national security systems in 

14 such a manner as to ensure appropriate protection for in15 formation associated with any information security vulner16 ability in such system commensurate with the risk and in 

17 accordance with all applicable laws. 

18 ‘‘(3) Evaluations and any other descriptions of infor19 mation systems under the authority and control of the Di20 rector of Central Intelligence or of National Foreign Intel21 ligence Programs systems under the authority and control 

22 of the Secretary of Defense shall be made available to Con23 gress only through the appropriate oversight committees 

24 of Congress, in accordance with applicable laws. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
27 

•S 2521 IS

1 ‘‘(h) COMPTROLLER GENERAL.—The Comptroller 

2 General shall periodically evaluate and report to Congress 

3 on— 

4 ‘‘(1) the adequacy and effectiveness of agency 

5 information security policies and practices; and 

6 ‘‘(2) implementation of the requirements of this 

7 subchapter. 

8 ‘‘(i) ASSESSMENT TECHNICAL ASSISTANCE.—The 

9 Comptroller General may provide technical assistance to 

10 an Inspector General or the head of an agency, as applica11 ble, to assist the Inspector General or head of an agency 

12 in carrying out the duties under this section, including by 

13 testing information security controls and procedures. 

14 ‘‘§ 3556. Federal information security incident center 

15 ‘‘(a) IN GENERAL.—The Secretary shall ensure the 

16 operation of a central Federal information security inci17 dent center to— 

18 ‘‘(1) provide timely technical assistance to oper19 ators of agency information systems regarding secu20 rity incidents, including guidance on detecting and 

21 handling information security incidents; 

22 ‘‘(2) compile and analyze information about in23 cidents that threaten information security; 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
28 

•S 2521 IS

1 ‘‘(3) inform operators of agency information 

2 systems about current and potential information se3 curity threats, and vulnerabilities; 

4 ‘‘(4) provide, as appropriate, intelligence and 

5 other information about cyber threats, 

6 vulnerabilities, and incidents to agencies to assist in 

7 risk assessments conducted under section 3554(b); 

8 and 

9 ‘‘(5) consult with the National Institute of 

10 Standards and Technology, agencies or offices oper11 ating or exercising control of national security sys12 tems (including the National Security Agency), and 

13 such other agencies or offices in accordance with law 

14 and as directed by the President regarding informa15 tion security incidents and related matters. 

16 ‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency 

17 operating or exercising control of a national security sys18 tem shall share information about information security in19 cidents, threats, and vulnerabilities with the Federal infor20 mation security incident center to the extent consistent 

21 with standards and guidelines for national security sys22 tems, issued in accordance with law and as directed by 

23 the President. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
29 

•S 2521 IS

1 ‘‘§ 3557. National security systems 

2 ‘‘The head of each agency operating or exercising 

3 control of a national security system shall be responsible 

4 for ensuring that the agency— 

5 ‘‘(1) provides information security protections 

6 commensurate with the risk and magnitude of the 

7 harm resulting from the unauthorized access, use, 

8 disclosure, disruption, modification, or destruction of 

9 the information contained in such system; 

10 ‘‘(2) implements information security policies 

11 and practices as required by standards and guide12 lines for national security systems, issued in accord13 ance with law and as directed by the President; and 

14 ‘‘(3) complies with the requirements of this sub15 chapter. 

16 ‘‘§ 3558. Effect on existing law 

17 ‘‘Nothing in this subchapter, section 11331 of title 

18 40, or section 20 of the National Standards and Tech19 nology Act (15 U.S.C. 278g–3) may be construed as af20 fecting the authority of the President, the Office of Man21 agement and Budget or the Director thereof, the National 

22 Institute of Standards and Technology, or the head of any 

23 agency, with respect to the authorized use or disclosure 

24 of information, including with regard to the protection of 

25 personal privacy under section 552a of title 5, the disclo26 sure of information under section 552 of title 5, the manVerDate Mar 15 2010 03:10 Jul 01, 2014 Jkt 039200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6201 E:\BILLS\S2521.IS S2521

tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
30 

•S 2521 IS

1 agement and disposition of records under chapters 29, 31, 

2 or 33 of title 44, the management of information resources 

3 under subchapter I of chapter 35 of this title, or the dis4 closure of information to the Congress or the Comptroller 

5 General of the United States.’’. 

6 (b) TECHNICAL AND CONFORMING AMENDMENTS.— 

7 (1) TABLE OF SECTIONS.—The table of sections 

8 for chapter 35 of title 44, United States Code is 

9 amended by striking the matter relating to sub10 chapters II and III and inserting the following: 

‘‘SUBCHAPTER II—INFORMATION SECURITY

‘‘3551. Purposes. 

‘‘3552. Definitions. 

‘‘3553. Authority and functions of the Director and the Secretary. 

‘‘3554. Federal agency responsibilities. 

‘‘3555. Annual independent evaluation. 

‘‘3556. Federal information security incident center. 

‘‘3557. National security systems. 

‘‘3558. Effect on existing law.’’. 

11 (2) CYBERSECURITY RESEARCH AND DEVELOP12 MENT ACT.—Section 8(d)(1) of the Cybersecurity 

13 Research and Development Act (15 U.S.C. 7406) is 

14 amended by striking ‘‘section 3534’’ and inserting 

15 ‘‘section 3554’’. 

16 (3) HOMELAND SECURITY ACT OF 2002.—Sec17 tion 1001(c)(1)(A) of the Homeland Security Act of 

18 2002 (6 U.S.C. 511) by striking ‘‘section 3532(3)’’ 

19 and inserting ‘‘section 3552(b)(5)’’. 

20 (4) NATIONAL INSTITUTE OF STANDARDS AND

21 TECHNOLOGY ACT.—Section 20 of the National InVerDate Mar 15 2010 03:10 Jul 01, 2014 Jkt 039200 PO 00000 Frm 00030 Fmt 6652 Sfmt 6201 E:\BILLS\S2521.IS S2521

tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
31 

•S 2521 IS

1 stitute of Standards and Technology Act (15 U.S.C. 

2 278g–3) is amended— 

3 (A) in subsection (a)(2), by striking ‘‘sec4 tion 3532(b)(2)’’ and inserting ‘‘section 

5 3552(b)(5)’’; and 

6 (B) in subsection (e)— 

7 (i) in paragraph (2), by striking ‘‘sec8 tion 3532(1)’’ and inserting ‘‘section 

9 3552(b)(2)’’; and 

10 (ii) in paragraph (5), by striking ‘‘sec11 tion 3532(b)(2)’’ and inserting ‘‘section 

12 3552(b)(5)’’. 

13 (5) TITLE 10.—Title 10, United States Code, is 

14 amended— 

15 (A) in section 2222(j)(5), by striking ‘‘sec16 tion 3542(b)(2)’’ and inserting ‘‘section 

17 3552(b)(5)’’; 

18 (B) in section 2223(c)(3), by striking ‘‘sec19 tion 3542(b)(2)’’ and inserting ‘‘section 

20 3552(b)(5)’’; and 

21 (C) in section 2315, by striking ‘‘section 

22 3542(b)(2)’’ and inserting ‘‘section 

23 3552(b)(5)’’. 

24 (c) OTHER PROVISIONS.— 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
32 

•S 2521 IS

1 (1) CIRCULAR A–130.—Not later than 180 days 

2 after the date of enactment of this Act, the Director 

3 of the Office of Management and Budget shall revise 

4 Office of Management and Budget Circular A–130 

5 to eliminate inefficient or wasteful reporting. 

6 (2) ISPAB.—Section 21(b) of the National In7 stitute of Standards and Technology Act (15 U.S.C. 

8 278g–4(b)) is amended— 

9 (A) in paragraph (2), by inserting ‘‘, the 

10 Secretary of Homeland Security,’’ after ‘‘the 

11 Institute’’; and 

12 (B) in paragraph (3), by inserting ‘‘the 

13 Secretary of Homeland Security,’’ after ‘‘the 

14 Secretary of Commerce,’’. 

15 SEC. 3. FEDERAL DATA BREACH RESPONSE GUIDELINES. 

16 (a) IN GENERAL.—Subchapter II of chapter 35 of 

17 title 44, United States Code, as added by this Act, is 

18 amended by adding at the end the following: 

19 ‘‘§ 3559. Privacy breach requirements 

20 ‘‘(a) POLICIES AND PROCEDURES.—The Director, in 

21 consultation with the Secretary, shall establish and over22 see policies and procedures for agencies to follow in the 

23 event of a breach of information security involving the dis24 closure of personally identifiable information, including re25 quirements for— 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
33 

•S 2521 IS

1 ‘‘(1) timely notice to affected individuals based 

2 on a determination of the level of risk and consistent 

3 with law enforcement and national security consider4 ations; 

5 ‘‘(2) timely reporting to the Federal informa6 tion security incident center established under sec7 tion 3556 or other Federal cybersecurity center, as 

8 designated by the Director; 

9 ‘‘(3) timely notice to committees of Congress 

10 with jurisdiction over cybersecurity; and 

11 ‘‘(4) such additional actions as the Director 

12 may determine necessary and appropriate, including 

13 the provision of risk mitigation measures to affected 

14 individuals. 

15 ‘‘(b) CONSIDERATIONS.—In carrying out subsection 

16 (a), the Director shall consider recommendations made by 

17 the Government Accountability Office, including rec18 ommendations in the December 2013 Government Ac19 countability Office report entitled ‘Information Security: 

20 Agency Responses to Breaches of Personally Identifiable 

21 Information Need to Be More Consistent’ (GAO–14–34). 

22 ‘‘(c) REQUIRED AGENCY ACTION.—The head of each 

23 agency shall ensure that actions taken in response to a 

24 breach of information security involving the disclosure of 

25 personally identifiable information under the authority or 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
34 

•S 2521 IS

1 control of the agency comply with policies and procedures 

2 established under subsection (a). 

3 ‘‘(d) TIMELINESS.— 

4 ‘‘(1) IN GENERAL.—Except as provided in para5 graph (2), the policies and procedures established 

6 under subsection (a) shall require that the notice to 

7 affected individuals required under subsection (a)(1) 

8 be made without unreasonable delay and with con9 sideration of the likely risk of harm and the level of 

10 impact, but not later than 60 days after the date on 

11 which the head of an agency discovers the breach of 

12 information security involving the disclosure of per13 sonally identifiable information. 

14 ‘‘(2) DELAY.—The Attorney General, the head 

15 of an element of the intelligence community (as such 

16 term is defined under section 3(4) of the National 

17 Security Act of 1947 (50 U.S.C. 3003(4)), or the 

18 Secretary may delay the notice to affected individ19 uals under subsection (a)(1) for not more than 180 

20 days, if the notice would disrupt a law enforcement 

21 investigation, endanger national security, or hamper 

22 security remediation actions from the breach of in23 formation security involving the disclosure of person24 ally identifiable information.’’. 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS
35 

•S 2521 IS

1 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

2 The table of sections for subchapter II for chapter 35 of 

3 title 44, United States Code, as added by this Act, is 

4 amended by inserting after the item relating to section 

5 3558 the following: 

‘‘3559. Privacy breach requirements.’’. 

Æ 


tjames@gpo.gov on DSK5VPTVN1PROD with BILLS