(A) by inserting after ‘‘annually’’ the fol-
lowing: ‘‘and as approved by the Director’’; 
(B) by striking ‘‘and’’ at the end of sub-
paragraph (A); 
(C) by redesignating subparagraph (B) as 
subparagraph (D); and 
(D) by inserting after subparagraph (A) 
the following: 
‘‘(B) shall include testing and evaluation of 
system configuration requirements as required 
under section 3543(a)(10); 
‘‘(C) shall include testing of systems oper-
ated by a contractor of the agency or other or-
ganization on behalf of the agency, which test-
ing requirement may be satisfied by inde-
pendent testing, evaluation, or audit of such 
systems; and’’; 
(3) by striking ‘‘and’’ at the end of paragraph 
(7); 
(4) by striking the period at the end of para-
graph (8) and inserting a semicolon; and 
(5) by adding at the end the following: 
‘‘(9) plans and procedures for ensuring the ade-
quacy of information security protections for sys-
tems maintaining or transmitting personally identifi-
able information, including requirements for— 
‘‘(A) maintaining a current inventory of 
systems maintaining or transmitting such infor-
mation; 
‘‘(B) implementing information security re-
quirements for mobile digital devices maintain-
ing or transmitting such information, as re-
quired by the Director (including the use of 
technologies rendering data unusable by unau-
thorized persons); and 
‘‘(C) developing, implementing, and over-
seeing 
remediation 
plans 
to 
address 
vulnerabilities in information security protec-
tions for such information;’’. 
SEC. 6. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, as amended by section 4, is further amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) in paragraph (8)—
(A) by striking ‘‘and’’ at the end of sub-
paragraph (D); 
(B) by striking the period and inserting ‘‘; 
and’’ at the end of subparagraph (E); and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(F) a summary of the breaches of infor-
mation security reported by agencies to the Di-
rector and the Federal information security in-
cident center pursuant to paragraph (13);’’; and 
(3) by adding at the end the following: 
‘‘(13) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
personally identifiable information, specifically in-
cluding— 
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose personally 
identifiable information could be compromised 
as a result of such breach, except no notice 
shall be required if the breach does not create 
a reasonable risk— 
‘‘(i) of identity theft, fraud, or other 
unlawful conduct regarding such indi-
vidual; or
‘‘(ii) of other harm to the individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; 
‘‘(C) guidance regarding whether addi-
tional special actions are necessary and appro-
priate, including data breach analysis, fraud 
resolution services, identify theft insurance, and 
credit protection or monitoring services; and 
‘‘(D) a requirement for timely reporting by 
the agencies of such breaches to the Director 
and Federal information security center.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO DEVELOP
AND MAINTAIN INVENTORIES.—Section 
3544(a)(3) of title 44, United States Code, is amended— 
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent de-
termined necessary and explicitly authorized by the 
head of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any
other hardware containing personally identifi-
able information;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION.— 
Section 3544(b) of title 44, United States Code, as amend-
ed by section 5, is further amended by adding at the end 
the following: 
‘‘(10) procedures for notifying individuals 
whose personally identifiable information may have 
been compromised or accessed following a breach of 
information security; and 
‘‘(11) procedures for timely reporting of infor-
mation security breaches involving personally identi-
fiable information to the Director and the Federal 
information security incident center.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 
Section 1402(a) of title 5, United States Code, is amend-
ed— 
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
SEC. 7. PROTECTION OF GOVERNMENT COMPUTERS FROM 
RISKS OF PEER-TO-PEER FILE SHARING. 
(a) PLANS REQUIRED.—As part of the Federal agen-
cy responsibilities set forth in sections 3544 and 3545 of 
title 44, United States Code, the head of each agency shall 
develop and implement a plan to ensure the security and 
privacy of information collected or maintained by or on 
behalf of the agency from the risks posed by certain peer- 
to-peer file sharing programs. 
(b) CONTENTS OF PLANS.—Such plans shall set forth 
appropriate methods, including both technological (such as 
the use of software and hardware) and nontechnological 
methods (such as employee policies and user training), to 
achieve the goal of securing and protecting such informa-
tion from the risks posed by peer-to-peer file sharing pro-
grams. 
(c) IMPLEMENTATION OF PLANS.—The head of each 
agency shall— 
(1) develop and implement the plan required 
under this section as expeditiously as possible, but in 
no event later than six months after the date of the 
enactment of this Act; and
ernment agencies in order to perform official agency 
business. 
(2) AGENCY.—The term ‘‘agency’’ has the 
meaning provided by section 3502 of title 44, United 
States Code. 
SEC. 8. ANNUAL INDEPENDENT AUDIT. 
(a) REQUIREMENT FOR AUDIT INSTEAD OF EVALUA-
TION.—Section 3545 of title 44, United States Code, is 
amended— 
(1) in the section heading, by striking ‘‘eval-
uation’’ and inserting ‘‘audit’’ ; and 
(2) in paragraphs (1) and (2) of subsection (a), 
by striking ‘‘evaluation’’ and inserting ‘‘audit’’ both 
places it appears. 
(b) ADDITIONAL SPECIFIC REQUIREMENTS FOR AU-
DITS.—Section 3545(a) of such title is amended— 
(1) in paragraph (2)— 
(A) in subparagraph (A), by striking ‘‘sub-
set of the agency’s information systems;’’ and 
inserting the following: ‘‘subset of— 
‘‘(i) the information systems used or oper-
ated by the agency; and 
‘‘(ii) the information systems used, oper-
ated, or supported on behalf of the agency by 
a contractor of the agency, any subcontractor
(at any tier) of such a contractor, or any other 
entity;’’; 
(B) in subparagraph (B), by striking 
‘‘and’’ at the end; 
(C) in subparagraph (C), by striking the 
period and inserting ‘‘; and’’; and 
(D) by adding at the end the following new 
subparagraph: 
‘‘(D) a conclusion whether the agency’s infor-
mation security controls are effective, including an 
identification of any significant deficiencies in such 
controls.’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(3) Each audit under this section shall conform to 
generally accepted government auditing standards.’’. 
(c) CONFORMING AMENDMENTS.— 
(1) Each of the following provisions of section 
3545 of title 44, United States Code, is amended by 
striking ‘‘evaluation’’ and inserting ‘‘audit’’ each 
place it appears: 
(A) Subsection (b)(1). 
(B) Subsection (b)(2). 
(C) Subsection (c). 
(D) Subsection (e)(1).
(E) Subsection (e)(2). 
(2) Section 3545(d) of such title is amended to 
read as follows: 
‘‘(d) EXISTING AUDITS.—The audit required by this 
section may be based in whole or in part on an audit relat-
ing to programs or practices of the applicable agency.’’. 
(3) Section 3545(f) of such title is amended by 
striking ‘‘evaluators’’ and inserting ‘‘auditors’’. 
(4) Section 3545(g)(1) of such title is amended 
by striking ‘‘evaluations’’ and inserting ‘‘audits’’. 
(5) Section 3545(g)(3) of such title is amended 
by striking ‘‘Evaluations’’ and inserting ‘‘Audits’’. 
(6) Section 3543(a)(8)(A) of such title is 
amended by striking ‘‘evaluations’’ and inserting 
‘‘audits’’. 
(7) Section 3544(b)(5)(D) of such title (as re-
designated by section 5(2)(C)) is amended by strik-
ing ‘‘a evaluation’’ and inserting ‘‘an audit’’. 
SEC. 9. BEST PRACTICES FOR PRIVACY IMPACT ASSESS-
MENTS. 
Section 208(b)(3) of the E-Government Act of 2002 
(Public Law 107–347; 44 U.S.C. 3501 note) is amend-
ed— 
(1) in subparagraph (B), by striking ‘‘and’’ at 
the end;
(2) in subparagraph (C), by striking the period 
and inserting ‘‘; and’’, and 
(3) by adding at the end the following: 
‘‘(D) develop best practices for agencies to 
follow in conducting privacy impact assess-
ments.’’. 
SEC. 10. IMPLEMENTATION. 
Except as otherwise specifically provided in this Act, 
implementation of this Act and the amendments made by 
this Act shall begin not later than 90 days after the date 
of the enactment of this Act. 
Passed the House of Representatives June 3, 2008. 
Attest: 
Clerk.
110TH CONGRESS 
2D SESSION 
H. R. 4791 
AN ACT 
To amend title 44, United States Code, to strength-
en requirements for ensuring the effectiveness of 
information security controls over information re-
sources that support Federal operations and as-
sets, and for other purposes.