IIB 
113TH CONGRESS 
1ST SESSION H. R. 1163 
IN THE SENATE OF THE UNITED STATES 
APRIL 17, 2013 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend chapter 35 of title 44, United States Code, to 
revise requirements relating to Federal information secu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Mar 15 2010 
00:22 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RFS
H1163
smartinez on DSK6TPTVN1PROD with BILLS
HR 1163 RFS 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Amendments Act of 2013’’. 
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities assets; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information systems; 
VerDate Mar 15 2010 
00:22 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RFS
H1163
smartinez on DSK6TPTVN1PROD with BILLS
HR 1163 RFS 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams and systems through a focus on automated 
and continuous monitoring of agency information 
systems and regular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information systems important to the na-
tional defense and economic security of the Nation 
that are designed, built, and operated by the private 
sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from 
VerDate Mar 15 2010 
00:22 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RFS
H1163
smartinez on DSK6TPTVN1PROD with BILLS
HR 1163 RFS 
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
‘‘(2) AUTOMATED
AND
CONTINUOUS
MONI-
TORING.—The term ‘automated and continuous 
monitoring’ means monitoring, with minimal human 
involvement, through an uninterrupted, ongoing real 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed 
security controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
‘‘(3) INCIDENT.—The term ‘incident’ means an 
occurrence that actually or potentially jeopardizes 
the confidentiality, integrity, or availability of an in-
formation system, or the information the system 
processes, stores, or transmits or that constitutes a 
violation or imminent threat of violation of security 
policies, security procedures, or acceptable use poli-
cies. 
‘‘(4) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from unauthorized access, 
use, disclosure, disruption, modification, or destruc-
tion in order to provide— 
VerDate Mar 15 2010 
00:22 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RFS
H1163
smartinez on DSK6TPTVN1PROD with BILLS
HR 1163 RFS 
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; and 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation. 
‘‘(5) INFORMATION SYSTEM.—The term ‘infor-
mation system’ means a discrete set of information 
resources organized for the collection, processing, 
maintenance, use, sharing, dissemination, or disposi-
tion of information and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources. 
VerDate Mar 15 2010 
00:22 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RFS
H1163
smartinez on DSK6TPTVN1PROD with BILLS