IIB 
110TH CONGRESS 
2D SESSION 
H. R. 4791 
IN THE SENATE OF THE UNITED STATES 
JUNE 4, 2008 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend title 44, United States Code, to strengthen re-
quirements for ensuring the effectiveness of information 
security controls over information resources that support 
Federal operations and assets, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Federal Agency Data Protection Act’’. 
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Purpose. 
Sec. 3. Definitions. 
Sec. 4. Authority of Director of Office of Management and Budget to establish 
information security policies and procedures. 
Sec. 5. Responsibilities of Federal agencies for information security. 
Sec. 6. Federal agency data breach notification requirements. 
Sec. 7. Protection of government computers from risks of peer-to-peer file shar-
ing. 
Sec. 8. Annual independent audit. 
Sec. 9. Best practices for privacy impact assessments. 
Sec. 10. Implementation. 
SEC. 2. PURPOSE. 
The purpose of this Act is to protect personally iden-
tifiable information of individuals that is maintained in or 
transmitted by Federal agency information systems. 
SEC. 3. DEFINITIONS. 
(a) PERSONALLY IDENTIFIABLE INFORMATION AND 
MOBILE
DIGITAL
DEVICE
DEFINITIONS.—Section 
3542(b) of title 44, United States Code, is amended by 
adding at the end the following new paragraphs: 
‘‘(4) The term ‘personally identifiable informa-
tion’, with respect to an individual, means any infor-
mation about the individual maintained by an agen-
cy, including information— 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
‘‘(A) about the individual’s education, fi-
nances, or medical, criminal, or employment 
history; 
‘‘(B) that can be used to distinguish or 
trace the individual’s identity, including name, 
social security number, date and place of birth, 
mother’s maiden name, or biometric records; or 
‘‘(C) that is otherwise linked or linkable to 
the individual. 
‘‘(5) The term ‘mobile digital device’ includes 
any device that can store or process information 
electronically and is designed to be used in a manner 
not limited to a fixed location, including— 
‘‘(A) processing devices such as laptop 
computers, communication devices, and other 
hand-held computing devices; and 
‘‘(B) storage devices such as portable hard 
drives, CD–ROMs, DVDs, and other portable 
electronic media.’’. 
(b) CONFORMING AMENDMENTS.—Section 208 of the 
E-Government Act of 2002 (Public Law 107–347; 44 
U.S.C. 3501 note) is amended— 
(1) in subsection (b)(1)(A)— 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(1) by inserting before the semicolon at the end 
of paragraph (5) the following: ‘‘, including plans 
and schedules, developed by the agency on the basis 
of priorities for addressing levels of identified risk, 
for conducting— 
‘‘(A) testing and evaluation, as required 
under section 3544(b)(5); and 
‘‘(B) remedial action, as required under 
section 3544(b)(6), to address deficiencies iden-
tified by such testing and evaluation’’; and 
(2) by adding at the end the following: 
‘‘(9) establishing minimum requirements re-
garding the protection of personally identifiable in-
formation maintained in or transmitted by mobile 
digital devices, including requirements for the use of 
technologies that efficiently and effectively render in-
formation unusable by unauthorized persons; 
‘‘(10) requiring agencies to comply with— 
‘‘(A) minimally acceptable system configu-
ration requirements consistent with best prac-
tices, including checklists developed under sec-
tion 8(c) of the Cyber Security Research and 
Development Act (Public Law 107–305; 116 
Stat. 2378) by the Director of the National In-
stitute of Standards and Technology; and 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
‘‘(B) minimally acceptable requirements 
for periodic testing and evaluation of the imple-
mentation of such configuration requirements; 
‘‘(11) ensuring that agency contracts for (or in-
volving or including) the provision of information 
technology products or services include requirements 
for contractors to meet minimally acceptable con-
figuration requirements, as required under para-
graph (10); 
‘‘(12) ensuring the establishment through regu-
lation and guidance of contract requirements to en-
sure compliance with this subchapter with regard to 
providing information security for information and 
information systems used or operated by a con-
tractor of an agency or other organization on behalf 
of the agency; and’’. 
SEC. 5. RESPONSIBILITIES OF FEDERAL AGENCIES FOR IN-
FORMATION SECURITY. 
Section 3544(b) of title 44, United States Code, is 
amended— 
(1) in paragraph (2)(D)(iii), by striking ‘‘as de-
termined by the agency’’ and inserting ‘‘as required 
by the Director under section 3543(a)(10)’’; 
(2) in paragraph (5)— 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(A) by inserting after ‘‘annually’’ the fol-
lowing: ‘‘and as approved by the Director’’; 
(B) by striking ‘‘and’’ at the end of sub-
paragraph (A); 
(C) by redesignating subparagraph (B) as 
subparagraph (D); and 
(D) by inserting after subparagraph (A) 
the following: 
‘‘(B) shall include testing and evaluation of 
system configuration requirements as required 
under section 3543(a)(10); 
‘‘(C) shall include testing of systems oper-
ated by a contractor of the agency or other or-
ganization on behalf of the agency, which test-
ing requirement may be satisfied by inde-
pendent testing, evaluation, or audit of such 
systems; and’’; 
(3) by striking ‘‘and’’ at the end of paragraph 
(7); 
(4) by striking the period at the end of para-
graph (8) and inserting a semicolon; and 
(5) by adding at the end the following: 
‘‘(9) plans and procedures for ensuring the ade-
quacy of information security protections for sys-
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
tems maintaining or transmitting personally identifi-
able information, including requirements for— 
‘‘(A) maintaining a current inventory of 
systems maintaining or transmitting such infor-
mation; 
‘‘(B) implementing information security re-
quirements for mobile digital devices maintain-
ing or transmitting such information, as re-
quired by the Director (including the use of 
technologies rendering data unusable by unau-
thorized persons); and 
‘‘(C) developing, implementing, and over-
seeing 
remediation 
plans 
to 
address 
vulnerabilities in information security protec-
tions for such information;’’. 
SEC. 6. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, as amended by section 4, is further amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) in paragraph (8)— 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(A) by striking ‘‘and’’ at the end of sub-
paragraph (D); 
(B) by striking the period and inserting ‘‘; 
and’’ at the end of subparagraph (E); and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(F) a summary of the breaches of infor-
mation security reported by agencies to the Di-
rector and the Federal information security in-
cident center pursuant to paragraph (13);’’; and 
(3) by adding at the end the following: 
‘‘(13) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
personally identifiable information, specifically in-
cluding— 
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose personally 
identifiable information could be compromised 
as a result of such breach, except no notice 
shall be required if the breach does not create 
a reasonable risk— 
‘‘(i) of identity theft, fraud, or other 
unlawful conduct regarding such indi-
vidual; or 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
‘‘(ii) of other harm to the individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; 
‘‘(C) guidance regarding whether addi-
tional special actions are necessary and appro-
priate, including data breach analysis, fraud 
resolution services, identify theft insurance, and 
credit protection or monitoring services; and 
‘‘(D) a requirement for timely reporting by 
the agencies of such breaches to the Director 
and Federal information security center.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO DEVELOP
AND MAINTAIN INVENTORIES.—Section 
3544(a)(3) of title 44, United States Code, is amended— 
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent de-
termined necessary and explicitly authorized by the 
head of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
other hardware containing personally identifi-
able information;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION.— 
Section 3544(b) of title 44, United States Code, as amend-
ed by section 5, is further amended by adding at the end 
the following: 
‘‘(10) procedures for notifying individuals 
whose personally identifiable information may have 
been compromised or accessed following a breach of 
information security; and 
‘‘(11) procedures for timely reporting of infor-
mation security breaches involving personally identi-
fiable information to the Director and the Federal 
information security incident center.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 
Section 1402(a) of title 5, United States Code, is amend-
ed— 
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
SEC. 7. PROTECTION OF GOVERNMENT COMPUTERS FROM 
RISKS OF PEER-TO-PEER FILE SHARING. 
(a) PLANS REQUIRED.—As part of the Federal agen-
cy responsibilities set forth in sections 3544 and 3545 of 
title 44, United States Code, the head of each agency shall 
develop and implement a plan to ensure the security and 
privacy of information collected or maintained by or on 
behalf of the agency from the risks posed by certain peer- 
to-peer file sharing programs. 
(b) CONTENTS OF PLANS.—Such plans shall set forth 
appropriate methods, including both technological (such as 
the use of software and hardware) and nontechnological 
methods (such as employee policies and user training), to 
achieve the goal of securing and protecting such informa-
tion from the risks posed by peer-to-peer file sharing pro-
grams. 
(c) IMPLEMENTATION OF PLANS.—The head of each 
agency shall— 
(1) develop and implement the plan required 
under this section as expeditiously as possible, but in 
no event later than six months after the date of the 
enactment of this Act; and 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(2) review and revise the plan periodically as 
necessary. 
(d) REVIEW OF PLANS.—Not later than 18 months 
after the date of the enactment of this Act, the Comp-
troller General shall— 
(1) review the adequacy of the agency plans re-
quired by this section; and 
(2) submit to the Committee on Oversight and 
Government Reform of the House of Representatives 
and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report on the re-
sults of the review, together with any recommenda-
tions the Comptroller General considers appropriate. 
(e) DEFINITIONS.—In this section: 
(1) PEER-TO-PEER FILE SHARING PROGRAM.— 
The term ‘‘peer-to-peer file sharing program’’ means 
computer software that allows the computer on 
which such software is installed (A) to designate 
files available for transmission to another such com-
puter, (B) to transmit files directly to another such 
computer, and (C) to request the transmission of 
files from another such computer. The term does not 
include the use of such software for file sharing be-
tween, among, or within Federal, State, or local gov-
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
ernment agencies in order to perform official agency 
business. 
(2) AGENCY.—The term ‘‘agency’’ has the 
meaning provided by section 3502 of title 44, United 
States Code. 
SEC. 8. ANNUAL INDEPENDENT AUDIT. 
(a) REQUIREMENT FOR AUDIT INSTEAD OF EVALUA-
TION.—Section 3545 of title 44, United States Code, is 
amended— 
(1) in the section heading, by striking ‘‘eval-
uation’’ and inserting ‘‘audit’’ ; and 
(2) in paragraphs (1) and (2) of subsection (a), 
by striking ‘‘evaluation’’ and inserting ‘‘audit’’ both 
places it appears. 
(b) ADDITIONAL SPECIFIC REQUIREMENTS FOR AU-
DITS.—Section 3545(a) of such title is amended— 
(1) in paragraph (2)— 
(A) in subparagraph (A), by striking ‘‘sub-
set of the agency’s information systems;’’ and 
inserting the following: ‘‘subset of— 
‘‘(i) the information systems used or oper-
ated by the agency; and 
‘‘(ii) the information systems used, oper-
ated, or supported on behalf of the agency by 
a contractor of the agency, any subcontractor 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(at any tier) of such a contractor, or any other 
entity;’’; 
(B) in subparagraph (B), by striking 
‘‘and’’ at the end; 
(C) in subparagraph (C), by striking the 
period and inserting ‘‘; and’’; and 
(D) by adding at the end the following new 
subparagraph: 
‘‘(D) a conclusion whether the agency’s infor-
mation security controls are effective, including an 
identification of any significant deficiencies in such 
controls.’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(3) Each audit under this section shall conform to 
generally accepted government auditing standards.’’. 
(c) CONFORMING AMENDMENTS.— 
(1) Each of the following provisions of section 
3545 of title 44, United States Code, is amended by 
striking ‘‘evaluation’’ and inserting ‘‘audit’’ each 
place it appears: 
(A) Subsection (b)(1). 
(B) Subsection (b)(2). 
(C) Subsection (c). 
(D) Subsection (e)(1). 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(E) Subsection (e)(2). 
(2) Section 3545(d) of such title is amended to 
read as follows: 
‘‘(d) EXISTING AUDITS.—The audit required by this 
section may be based in whole or in part on an audit relat-
ing to programs or practices of the applicable agency.’’. 
(3) Section 3545(f) of such title is amended by 
striking ‘‘evaluators’’ and inserting ‘‘auditors’’. 
(4) Section 3545(g)(1) of such title is amended 
by striking ‘‘evaluations’’ and inserting ‘‘audits’’. 
(5) Section 3545(g)(3) of such title is amended 
by striking ‘‘Evaluations’’ and inserting ‘‘Audits’’. 
(6) Section 3543(a)(8)(A) of such title is 
amended by striking ‘‘evaluations’’ and inserting 
‘‘audits’’. 
(7) Section 3544(b)(5)(D) of such title (as re-
designated by section 5(2)(C)) is amended by strik-
ing ‘‘a evaluation’’ and inserting ‘‘an audit’’. 
SEC. 9. BEST PRACTICES FOR PRIVACY IMPACT ASSESS-
MENTS. 
Section 208(b)(3) of the E-Government Act of 2002 
(Public Law 107–347; 44 U.S.C. 3501 note) is amend-
ed— 
(1) in subparagraph (B), by striking ‘‘and’’ at 
the end; 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS
HR 4791 RFS 
(2) in subparagraph (C), by striking the period 
and inserting ‘‘; and’’, and 
(3) by adding at the end the following: 
‘‘(D) develop best practices for agencies to 
follow in conducting privacy impact assess-
ments.’’. 
SEC. 10. IMPLEMENTATION. 
Except as otherwise specifically provided in this Act, 
implementation of this Act and the amendments made by 
this Act shall begin not later than 90 days after the date 
of the enactment of this Act. 
Passed the House of Representatives June 3, 2008. 
Attest: 
LORRAINE C. MILLER, 
Clerk. 
VerDate Aug 31 2005 
06:47 Jun 05, 2008
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4791.RFS
H4791
jbell on PROD1PC69 with BILLS