II 

108TH CONGRESS 

1ST SESSION S. 187

To provide for the elimination of significant vulnerabilities in the information 

technology of the Federal Government, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JANUARY 16, 2003

Mr. EDWARDS introduced the following bill; which was read twice and referred 

to the Committee on Governmental Affairs 

A BILL

To provide for the elimination of significant vulnerabilities 

in the information technology of the Federal Government, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Cyber Secu5 rity Leadership Act of 2003’’. 

6 SEC. 2. FINDINGS. 

7 Congress makes the following findings: 

8 (1) Federal agencies rely on networked com9 puter systems to deliver critical services and infor10 mation to the American people, including operations 
2

•S 187 IS 

1 related to national defense, emergency services, tax 

2 collection, and the payment of benefits. 

3 (2) There has been an astonishing increase in 

4 cyber threats to government and industry in recent 

5 years. The number of cyber attacks on Federal Gov6 ernment systems in 2001 was 71 percent greater 

7 than the number of such attacks on such systems in 

8 2000. 

9 (3) Cyber attacks can cause irreparable harm in 

10 network systems, including the loss or dissemination 

11 of sensitive and important data. Cyber attacks can 

12 also reduce the confidence of the American people in 

13 the integrity and security of the Internet. 

14 (4) There is mounting evidence to suggest that 

15 terrorists view the Internet as a tool to achieve their 

16 goals. Government investigators found that al Qaeda 

17 operatives browsed Internet sites that offered soft18 ware describing the digital switches that control 

19 power, water, transport, and communications grids. 

20 (5) The Bush Administration has recognized in 

21 its draft National Strategy to Secure Cyberspace 

22 ‘‘the pressing need to make federal cyberspace secu23 rity a model for the nation’’. 
3

•S 187 IS 

1 (6) All but a few Federal agencies continue to 

2 receive failing grades for their cyber security pro3 grams. 

4 (7) Federal agencies must take significant steps 

5 to better protect themselves against cyber attacks, 

6 including—

7 (A) identifying significant vulnerabilities in 

8 their computer networks and the tools needed 

9 to detect such vulnerabilities; 

10 (B) monitoring for new vulnerabilities in 

11 their computer networks, and assessing risks of 

12 cyber attacks; 

13 (C) testing computers against identified 

14 vulnerabilities; and 

15 (D) ensuring that computers and networks 

16 are adequately protected against such 

17 vulnerabilities. 

18 SEC. 3. DEFINITIONS. 

19 In this Act: 

20 (1) CHIEF INFORMATION OFFICER.—The term 

21 ‘‘Chief Information Officer’’, with respect to an 

22 agency, means the official designated as the Chief 

23 Information Officer of the agency pursuant to sec24 tion 3506(a)(2) of title 44, United States Code. 
4

•S 187 IS 

1 (2) VULNERABILITY.—The term ‘‘vulner2 ability’’, in the case of information technology, 

3 means an error or defect in coding, configuration, or 

4 installation of such information technology that in5 creases its susceptibility to a cyber threat. 

6 (3) OTHER DEFINITIONS.—Except as otherwise 

7 provided in this section, any term used in this Act 

8 which is defined in section 3502 of title 44, United 

9 States Code, shall have the meaning given that term 

10 in such section 3502. 

11 SEC. 4. ELIMINATION OF SIGNIFICANT VULNERABILITIES 

12 OF FEDERAL GOVERNMENT INFORMATION 

13 TECHNOLOGY. 

14 (a) IN GENERAL.—The Chief Information Officer of 

15 each agency shall—

16 (1) identify the significant vulnerabilities of the 

17 information technology of such agency, including—

18 (A) vulnerabilities of such classes of infor19 mation technology of such agency as the Chief 

20 Information Officer shall designate for purposes 

21 of this section; and 

22 (B) vulnerabilities of the information tech23 nology of such agency as a whole; 

24 (2) establish performance goals for eliminating 

25 the significant vulnerabilities of the information 
5

•S 187 IS 

1 technology of such agency identified under para2 graph (1), with such performance goals—

3 (A) to be established utilizing the current 

4 state of the information technology of such 

5 agency as a baseline; 

6 (B) to be stated both for particular classes 

7 of information technology of such agency (as 

8 determined under paragraph (1)(A)) and for 

9 the information technology of such agency as a 

10 whole; and 

11 (C) to be expressed as target ratios of 

12 vulnerabilities per information technology; 

13 (3) procure or develop tools to identify and 

14 eliminate the vulnerabilities identified under para15 graph (1) in order to achieve the performance goals 

16 established under paragraph (2); 

17 (4) train personnel of such agency in the utili18 zation of tools procured or developed under para19 graph (3); 

20 (5) not less often than once each quarter, test 

21 the information technology of such agency to deter22 mine the extent of the compliance of the information 

23 technology with the performance goals established 

24 under paragraph (3); and
6

•S 187 IS 

1 (6) to the extent that the information tech2 nology of such agency does not comply with the per3 formance goals established under paragraph (3), 

4 promptly develop and implement a plan to eliminate 

5 significant vulnerabilities in the information tech6 nology in order to achieve compliance with such per7 formance goals. 

8 (b) ANNUAL REPORT ON ACTIVITIES.—

9 (1) REQUIREMENT.—The Chief Information Of10 ficer of each agency shall include information on its 

11 activities under subsection (a) in each annual report 

12 submitted to the Director of the Office of Manage13 ment and Budget under section 3545(e) of title 44, 

14 United States Code (as amended by section 301(b) 

15 of the Federal Information Security Management 

16 Act of 2002 (title III of Public Law 107–347)). 

17 (2) FORM.—The form of information submitted 

18 under paragraph (1) shall be specified by the Direc19 tor of the Office of Management and Budget. 

20 (c) GOVERNMENTWIDE STANDARDS.—

21 (1) REVIEW BY NIST.—The Director of the Of22 fice of Management and Budget shall ensure the re23 view by the Director of the National Institute of 

24 Standards and Technology of the annual reports 
7

•S 187 IS 

1 submitted under subsection (b) in the first year 

2 after the date of the enactment of this Act. 

3 (2) GUIDELINES.—Not later than 180 days 

4 after receiving annual reports for review under para5 graph (1), the Director of the National Institute of 

6 Standards and Technology shall develop and make 

7 available to the Chief Information Officers of the 

8 agencies governmentwide guidelines for use in com9 plying with subsection (a). The guidelines shall—

10 (A) identify vulnerabilities of information 

11 technology common to the agencies; and 

12 (B) describe means of eliminating such 

13 vulnerabilities, including the use of checklists 

14 pursuant to section 8(c) of the Cyber Security 

15 Research and Development Act (Public Law 

16 107–305). 

17 (3) MANDATORY USE.—

18 (A) DESIGNATION OF VULNERABILITIES.—

19 The Director of the National Institute of 

20 Standards and Technology shall designate as a 

21 result of the review under paragraph (1) any 

22 significant vulnerabilities of information tech23 nology of such broad applicability and severity 

24 so as to warrant the mandatory use of the 
8

•S 187 IS 

1 guidelines developed under paragraph (2) with 

2 respect to such vulnerabilities. 

3 (B) MANDATORY USE.—The Secretary of 

4 Commerce shall, using the authority available 

5 to the Secretary under section 11331(b) of title 

6 40, United States Code, mandate the use by the 

7 agencies of guidelines developed under para8 graph (2) with respect to vulnerabilities des9 ignated under subparagraph (A). 

10 (C) USE AND EXCEPTION.—Each agency 

11 shall use a standard mandated under subpara12 graph (B) unless the Chief Information Officer 

13 of such agency determines, with the concur14 rence of the Director of the National Institute 

15 of Standards and Technology, that the use of 

16 such guideline by such agency would not in17 crease the security of the information tech18 nology covered by such standard. 

19 SEC. 5. AUTHORIZATION OF APPROPRIATIONS. 

20 (a) AUTHORIZATION OF APPROPRIATIONS.—There is 

21 authorized to be appropriated to carry out the provisions 

22 of this Act amounts as follows: 

23 (1) For the Department of Commerce for the 

24 National Institute of Standards and Technology, 
9

•S 187 IS 

1 $1,000,000 for fiscal year 2004 to develop the 

2 guidelines required by section 4(c). 

3 (2) For each agency, such sums as may be nec4 essary for such agency for fiscal years 2004 through 

5 2008 to carry out the provisions of this Act. 

6 (b) AVAILABILITY.—The amount authorized to be ap7 propriated by subsection (a)(1) shall remain available until 

8 expended. 

9 SEC. 6. EFFECTIVE DATE. 

10 This Act shall take effect 180 days after the date of 

11 the enactment of this Act.

Æ