tional Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3); 
‘‘(ii) information security standards 
and guidelines for national security systems 
issued in accordance with law and as di-
rected by the President; and 
‘‘(iii) ensuring the standards imple-
mented for information systems and na-
tional security systems of the agency are 
complementary and uniform, to the extent 
practicable; 
‘‘(C) ensuring that information security 
management processes are integrated with agen-
cy strategic and operational planning and budg-
et processes, including policies, procedures, and 
practices described in subsection (c)(2); 
‘‘(D) as appropriate, maintaining secure fa-
cilities that have the capability of accessing, 
sending, receiving, and storing classified infor-
mation; 
‘‘(E) maintaining a sufficient number of 
personnel with security clearances, at the appro-
priate levels, to access, send, receive and analyze 
classified information to carry out the respon-
sibilities of this subchapter; and 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(F) ensuring that information security 
performance indicators and measures are in-
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation systems that support the operations and assets 
under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of such information or informa-
tion system; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 11331 of title 40 and 
section 20 of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3) for in-
formation security classifications and related re-
quirements; 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; 
‘‘(D) with a frequency sufficient to support 
risk-based security decisions, testing and evalu-
ating information security controls and tech-
niques to ensure that such controls and tech-
niques are effectively implemented and operated; 
and 
‘‘(E) with a frequency sufficient to support 
risk-based security decisions, conducting threat 
assessments by monitoring information systems, 
identifying potential system vulnerabilities, and 
reporting security incidents in accordance with 
paragraph (3)(A)(v); 
‘‘(3) delegate to the Chief Information Officer or 
equivalent (or a senior agency official who reports to 
the Chief Information Officer or equivalent), who is 
designated as the ‘Chief Information Security Officer’, 
the authority and primary responsibility to develop, 
implement, and oversee an agencywide information 
security program to ensure and enforce compliance 
with the requirements imposed on the agency under 
this subchapter, including— 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(A) overseeing the establishment and main-
tenance of a security operations capability that 
through automated and continuous monitoring, 
when possible, can— 
‘‘(i) detect, report, respond to, contain, 
and mitigate incidents that impair infor-
mation security and agency information 
systems, in accordance with policy provided 
by the Director; 
‘‘(ii) commensurate with the risk to in-
formation security, monitor and mitigate 
the vulnerabilities of every information sys-
tem within the agency; 
‘‘(iii) continually evaluate risks posed 
to information collected or maintained by 
or on behalf of the agency and information 
systems and hold senior agency officials ac-
countable for ensuring information security; 
‘‘(iv) collaborate with the Director and 
appropriate public and private sector secu-
rity operations centers to detect, report, re-
spond to, contain, and mitigate incidents 
that impact the security of information and 
information systems that extend beyond the 
control of the agency; and 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(v) report any incident described 
under clauses (i) and (ii) to the Federal in-
formation security incident center, to other 
appropriate security operations centers, and 
to the Inspector General of the agency, to 
the extent practicable, within 24 hours after 
discovery of the incident, but no later than 
48 hours after such discovery; 
‘‘(B) developing, maintaining, and over-
seeing an agencywide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 11331 of title 40; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; and 
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has a sufficient num-
ber of trained and cleared personnel to assist the 
agency in complying with the requirements of this 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
subchapter, other applicable laws, and related poli-
cies, procedures, standards, and guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in consultation with other senior agency offi-
cials, reports periodically, but not less than annually, 
to the agency head on— 
‘‘(A) the effectiveness of the agency informa-
tion security program; 
‘‘(B) information derived from automated 
and continuous monitoring, when possible, and 
threat assessments; and 
‘‘(C) the progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer possesses the necessary qualifications, includ-
ing education, training, experience, and the security 
clearance required to administer the functions de-
scribed under this subchapter; and has information 
security duties as the primary duty of that official; 
and 
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Offi-
cer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
senior agency officers accountable for the implementa-
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
tion of appropriate security policies, procedures, and 
controls of agency components. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information secu-
rity program, approved by the Director and consistent with 
components across and within agencies, to provide informa-
tion security for the information and information systems 
that support the operations and assets of the agency, includ-
ing those provided or managed by another agency, con-
tractor, or other source, that includes— 
‘‘(1) automated and continuous monitoring, 
when possible, of the risk and magnitude of the harm 
that could result from the disruption or unauthorized 
access, use, disclosure, modification, or destruction of 
information and information systems that support 
the operations and assets of the agency; 
‘‘(2) consistent with guidance developed under 
section 11331 of title 40, vulnerability assessments 
and penetration tests commensurate with the risk 
posed to agency information systems; 
‘‘(3) policies and procedures that— 
‘‘(A) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(B) ensure compliance with— 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may be 
prescribed by the Director, and information 
security standards promulgated pursuant to 
section 11331 of title 40; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the Director; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; and 
‘‘(II) the National Institute of 
Standards and Technology standards 
and guidance; 
‘‘(C) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable requirements, 
including those promulgated pursuant section 
11331 of title 40; and 
‘‘(D) ensure the oversight and training of 
personnel with significant responsibilities for in-
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
formation security with respect to such respon-
sibilities; 
‘‘(4) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for testing and evaluation 
of the effectiveness and compliance of information se-
curity policies, procedures, and practices, including— 
‘‘(A) controls of every information system 
identified in the inventory required under sec-
tion 3505(c); and 
‘‘(B) controls relied on for an evaluation 
under this section; 
‘‘(5) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(6) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for detecting, reporting, 
and responding to security incidents, consistent with 
standards and guidelines issued by the National In-
stitute of Standards and Technology, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) notifying and consulting with the Fed-
eral information security incident center and 
other appropriate security operations response 
centers; and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; and 
‘‘(ii) any other agency, office, or enti-
ty, in accordance with law or as directed by 
the President; and 
‘‘(7) plans and procedures to ensure continuity 
of operations for information systems that support the 
operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, pro-
cedures, and practices, and compliance with the re-
quirements of this subchapter, including compliance 
with each requirement of subsection (b) to— 
‘‘(A) the Director; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representatives; 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of in-
formation security policies, procedures, and practices 
in plans and reports relating to— 
‘‘(A) annual agency budgets; 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and sec-
tions 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576); 
‘‘(F) financial management systems under 
the Federal Financial Management Improvement 
Act of 1996 (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31; and 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under paragraph 
(1) or (2)— 
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
agement Improvement Act of 1996 (31 U.S.C. 
3512 note). 
‘‘§ 3555. Federal information security incident center 
‘‘(a) IN GENERAL.—The Director shall ensure the oper-
ation of a central Federal information security incident 
center to— 
‘‘(1) provide timely technical assistance to opera-
tors of agency information systems regarding security 
incidents, including guidance on detecting and han-
dling information security incidents; 
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information sys-
tems about current and potential information secu-
rity threats, and vulnerabilities; and 
‘‘(4) consult with the National Institute of 
Standards and Technology, agencies or offices oper-
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
ating or exercising control of national security sys-
tems (including the National Security Agency), and 
such other agencies or offices in accordance with law 
and as directed by the President regarding informa-
tion security incidents and related matters. 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency op-
erating or exercising control of a national security system 
shall share information about information security inci-
dents, threats, and vulnerabilities with the Federal informa-
tion security incident center to the extent consistent with 
standards and guidelines for national security systems, 
issued in accordance with law and as directed by the Presi-
dent. 
‘‘(c) REVIEW AND APPROVAL.—The Director shall re-
view and approve the policies, procedures, and guidance es-
tablished in this subchapter to ensure that the incident cen-
ter has the capability to effectively and efficiently detect, 
correlate, respond to, contain, mitigate, and remediate inci-
dents that impair the adequate security of the information 
systems of more than one agency. To the extent practicable, 
the capability shall be continuous and technically auto-
mated. 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘§ 3556. National security systems 
‘‘The head of each agency operating or exercising con-
trol of a national security system shall be responsible for 
ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, dis-
closure, disruption, modification, or destruction of the 
information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guidelines 
for national security systems, issued in accordance 
with law and as directed by the President; and 
‘‘(3) complies with the requirements of this sub-
chapter.’’. 
SEC. 3. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) TABLE OF SECTIONS IN TITLE 44.—The table of 
sections for chapter 35 of title 44, United States Code, is 
amended by striking the matter relating to subchapters II 
and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘Sec. 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. Authority and functions of the Director. 
‘‘3554. Agency responsibilities. 
‘‘3555. Federal information security incident center. 
‘‘3556. National security systems.’’. 
(b) OTHER REFERENCES.— 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
(1) Section 1001(c)(1)(A) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended 
by striking ‘‘section 3532(3)’’ and inserting ‘‘section 
3552(b)’’. 
(2) Section 2222(j)(5) of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(3) Section 2223(c)(3) of title 10, United States 
Code, is amended, by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(4) Section 2315 of title 10, United States Code, 
is amended by striking ‘‘section 3542(b)(2)’’ and in-
serting ‘‘section 3552(b)’’. 
(5) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–3) is 
amended— 
(A) in subsections (a)(2) and (e)(5), by 
striking ‘‘section 3532(b)(2)’’ and inserting ‘‘sec-
tion 3552(b)’’; and 
(B) in subsection (e)(2), by striking ‘‘section 
3532(1)’’ and inserting ‘‘section 3552(b)’’. 
(6) Section 8(d)(1) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7406(d)(1)) is 
amended by striking ‘‘section 3534(b)’’ and inserting 
‘‘section 3554(b)’’. 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
SEC. 4. EFFECTIVE DATE. 
This Act (including the amendments made by this Act) 
shall take effect 30 days after the date of the enactment of 
this Act. 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
Union Calendar No. 318 
112TH CONGRESS 
2D SESSION 
H. R. 4257 
[Report No. 112–455] 
A BILL 
To amend chapter 35 of title 44, United States 
Code, to revise requirements relating to Federal 
information security, and for other purposes. 
APRIL 26, 2012 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00030
Fmt 6651
Sfmt 6651
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS