747 
HR 5136 RHUC 
under section 1568 of this title, including a deployable 
Sexual Assault Victim Advocate, shall be treated in the 
same manner as a confidential communication between a 
patient and a psychiatrist for purposes of any privilege 
which may attach to such a communication.’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions at the beginning of such chapter is amended 
by inserting after the item relating to section 1034a 
the following new item: 
‘‘1034b. Privilege against disclosure of certain communications with Sexual As-
sault Victim Advocates.’’. 
(b) APPLICABILITY.—Section 1034b of title 10, 
United States Code, as added by subsection (a), applies 
to communications described in such section whether made 
before, on, or after the date of the enactment of this Act. 
SEC. 1648. EXPEDITED CONSIDERATION AND PRIORITY FOR 
APPLICATION FOR CONSIDERATION OF A 
PERMANENT CHANGE OF STATION OR UNIT 
TRANSFER BASED ON HUMANITARIAN CONDI-
TIONS FOR VICTIM OF SEXUAL ASSAULT. 
(a) IN GENERAL.—Chapter 39 of title 10, United 
States Code, is amended by inserting after section 672 the 
following new section: 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00747
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
748 
HR 5136 RHUC 
‘‘§ 673. Consideration of application for permanent 
change of station or unit transfer for 
members on active duty who are the vic-
tim of a sexual assault 
‘‘(a) EXPEDITED CONSIDERATION
AND PRIORITY 
FOR APPROVAL.—To the maximum extent practicable, the 
Secretary concerned shall provide for the expedited consid-
eration and approval of an application for consideration 
of a permanent change of station or unit transfer sub-
mitted by a member of the armed forces serving on active 
duty who was a victim of a sexual assault or other offense 
covered by section 920 of this title (article 120) so as to 
reduce the possibility of retaliation against the member 
for reporting the sexual assault. 
‘‘(b) REGULATIONS.— The Secretaries of the military 
departments shall issue regulations to carry out this sec-
tion, within guidelines provided by the Secretary of De-
fense.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by inserting 
after the item relating to section 672 the following new 
item: 
‘‘673. Consideration of application for permanent change of station or unit 
transfer for members on active duty who are the victim of a 
sexual assault.’’. 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00748
Fmt 6652
Sfmt 6211
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
749 
HR 5136 RHUC 
Subtitle D—Other Matters 
SEC. 1661. RECRUITER SELECTION AND OVERSIGHT. 
(a) SCREENING, TRAINING, AND OVERSIGHT OF RE-
CRUITERS.—The Secretaries of the military departments 
shall ensure effective recruiter selection and oversight with 
regard to sexual assault prevention and response by ensur-
ing that— 
(1) recruiters are screened and trained under 
the sexual assault prevention and response program; 
(2) sexual assault prevention and response pro-
gram information is disseminated to recruiters and 
potential recruits for the Armed Forces; and 
(3) oversight is in place to preclude the poten-
tial for sexual misconduct by recruiters. 
(b) IMPROVED AWARENESS
OF RECRUITS.—Com-
manders of recruiting organizations and Military Entrance 
Processing Stations shall ensure that sexual assault pre-
vention and response awareness campaign materials are 
available and posted in locations visible to potential and 
actual recruits for the Armed Forces. 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00749
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
750 
HR 5136 RHUC 
SEC. 1662. AVAILABILITY OF SERVICES UNDER SEXUAL AS-
SAULT PREVENTION AND RESPONSE PRO-
GRAM FOR DEPENDENTS OF MEMBERS, MILI-
TARY RETIREES, DEPARTMENT OF DEFENSE 
CIVILIAN EMPLOYEES, AND DEFENSE CON-
TRACTOR EMPLOYEES. 
(a) NOTIFICATION OF EXTENT OF CURRENT SERV-
ICES.—Not later than 90 days after the date of the enact-
ment of this Act, the Secretary of Defense shall revise ma-
terials made available under the sexual assault prevention 
and response program to include information on the extent 
to which dependents of members of the Armed Forces, re-
tired members, Department of Defense civilian employees, 
and employees of defense contractors are eligible for sex-
ual assault prevention and response services under the 
sexual assault prevention and response program. 
(b) REPORT REQUIRED.—Not later than 1 year after 
the date of the enactment of this Act, the Secretary of 
Defense shall submit to the congressional defense commit-
tees a report on the feasibility of extending all sexual as-
sault prevention and response services available for a 
member of the Armed Forces who is the victim of a sexual 
assault to persons referred to in subsection (a). 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00750
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
751 
HR 5136 RHUC 
SEC. 1663. APPLICATION OF SEXUAL ASSAULT PREVENTION 
AND RESPONSE PROGRAM IN TRAINING EN-
VIRONMENTS. 
The Secretaries of the military departments shall en-
sure that a member of the Armed Forces who is a victim 
of a sexual assault in a training environment is provided, 
to the maximum extent possible, with confidential access 
to victim support services and afforded time for recovery. 
The member should not be required to repeat training un-
less the time needed for support services and recovery sig-
nificantly interferes with the progress of the member’s 
training. 
SEC. 1664. APPLICATION OF SEXUAL ASSAULT PREVENTION 
AND RESPONSE PROGRAM IN REMOTE ENVI-
RONMENTS AND JOINT BASING SITUATIONS. 
(a) REMOTE AND DEPLOYED ENVIRONMENTS.—The 
Secretary of Defense and the combatant commanders shall 
ensure that the sexual assault prevention and response 
program continues to operate even in remote environments 
in which members of the Armed Forces are deployed, in-
cluding coalition operations. 
(b) JOINT BASING.—The Secretary of Defense shall 
monitor the implementation of the sexual assault preven-
tion and response program and military justice and juris-
diction issues at joint basing locations. Elements of the 
Armed Forces sharing a joint base location shall closely 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00751
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
752 
HR 5136 RHUC 
collaborate on sexual assault prevention and response 
issues to ensure consistency in approach and messages at 
the joint base location. 
TITLE XVII—FEDERAL 
INFORMATION SECURITY 
Subtitle A—Federal Information 
Security Amendments 
SEC. 1701. COORDINATION OF FEDERAL INFORMATION 
POLICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00752
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
753 
HR 5136 RHUC 
throughout the civilian, national security, and law 
enforcement communities; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information infrastructure; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information infrastructures important to 
the national defense and economic security of the 
Nation that are designed, built, and operated by the 
private sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00753
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
754 
HR 5136 RHUC 
‘‘(1) The term ‘adequate security’ means secu-
rity that complies with the regulations promulgated 
under section 3554 and the standards promulgated 
under section 3558. 
‘‘(2) The term ‘incident’ means an occurrence 
that actually or potentially jeopardizes the confiden-
tiality, integrity, or availability of an information 
system, information infrastructure, or the informa-
tion the system processes, stores, or transmits or 
that constitutes a violation or imminent threat of 
violation of security policies, security procedures, or 
acceptable use policies. 
‘‘(3) The term ‘information infrastructure’ 
means the underlying framework that information 
systems and assets rely on in processing, storing, or 
transmitting information electronically. 
‘‘(4) The term ‘information security’ means 
protecting information and information infrastruc-
ture from unauthorized access, use, disclosure, dis-
ruption, modification, or destruction in order to pro-
vide— 
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00754
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
755 
HR 5136 RHUC 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation; and 
‘‘(D) authentication, which means using 
digital credentials to assure the identity of 
users and validate access of such users. 
‘‘(5) The term ‘information technology’ has the 
meaning given that term in section 11101 of title 
40. 
‘‘(6)(A) The term ‘national security system’ 
means any information infrastructure (including any 
telecommunications system) used or operated by an 
agency or by a contractor of an agency, or other or-
ganization on behalf of an agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activities; 
‘‘(II) involves cryptologic activities re-
lated to national security; 
‘‘(III) involves command and control 
of military forces; 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00755
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
756 
HR 5136 RHUC 
‘‘(IV) involves equipment that is an 
integral part of a weapon or weapons sys-
tem; or 
‘‘(V) subject to subparagraph (B), is 
critical to the direct fulfillment of military 
or intelligence missions; or 
‘‘(ii) is protected at all times by procedures 
established for information that have been spe-
cifically authorized under criteria established by 
an Executive order or an Act of Congress to be 
kept classified in the interest of national de-
fense or foreign policy. 
‘‘(B) Subparagraph (A)(i)(V) does not include a 
system that is to be used for routine administrative 
and business applications (including payroll, finance, 
logistics, and personnel management applications). 
‘‘§ 3553. National Office for Cyberspace 
‘‘(a) ESTABLISHMENT.—There is established within 
the Executive Office of the President an office to be known 
as the National Office for Cyberspace. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—There shall be at the head 
of the Office a Director, who shall be appointed by 
the President by and with the advice and consent of 
the Senate. The Director of the National Office for 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00756
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
757 
HR 5136 RHUC 
Cyberspace shall administer all functions under this 
subchapter and collaborate to the extent practicable 
with the heads of appropriate agencies, the private 
sector, and international partners. The Office shall 
serve as the principal office for coordinating issues 
relating to achieving an assured, reliable, secure, 
and survivable information infrastructure and re-
lated capabilities for the Federal Government. 
‘‘(2) BASIC PAY.—The Director shall be paid at 
the rate of basic pay for level III of the Executive 
Schedule. 
‘‘(c) STAFF.—The Director may appoint and fix the 
pay of additional personnel as the Director considers ap-
propriate. 
‘‘(d) EXPERTS AND CONSULTANTS.—The Director 
may procure temporary and intermittent services under 
section 3109(b) of title 5. 
‘‘§ 3554. Federal Cybersecurity Practice Board 
‘‘(a) ESTABLISHMENT.—Within the National Office 
for Cyberspace, there shall be established a board to be 
known as the ‘Federal Cybersecurity Practice Board’ (in 
this section referred to as the ‘Board’). 
‘‘(b) MEMBERS.—The Board shall be chaired by the 
Director of the National Office for Cyberspace and consist 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00757
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
758 
HR 5136 RHUC 
of not more than 10 members, with at least one represent-
ative from— 
‘‘(1) the Office of Management and Budget; 
‘‘(2) civilian agencies; 
‘‘(3) the Department of Defense; 
‘‘(4) the Federal law enforcement community; 
‘‘(5) the Federal Chief Technology Office; and 
‘‘(6) such additional military and civilian agen-
cies as the Director considers appropriate. 
‘‘(c) RESPONSIBILITIES.— 
‘‘(1) DEVELOPMENT OF POLICIES AND PROCE-
DURES.—Subject to the authority, direction, and 
control of the Director of the National Office for 
Cyberspace, the Board shall be responsible for devel-
oping and periodically updating information security 
policies and procedures relating to the matters de-
scribed in paragraph (2). In developing such policies 
and procedures, the Board shall require that all 
matters addressed in the policies and procedures are 
consistent, to the maximum extent practicable and 
in accordance with applicable law, among the civil-
ian, military, intelligence, and law enforcement com-
munities. 
‘‘(2) SPECIFIC MATTERS COVERED IN POLICIES 
AND PROCEDURES.— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00758
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
759 
HR 5136 RHUC 
‘‘(A) MINIMUM
SECURITY
CONTROLS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to minimum se-
curity controls for information technology, in 
order to— 
‘‘(i) provide Governmentwide protec-
tion of Government-networked computers 
against common attacks; and 
‘‘(ii) provide agencywide protection 
against threats, vulnerabilities, and other 
risks to the information infrastructure 
within individual agencies. 
‘‘(B) MEASURES
OF
EFFECTIVENESS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to measure-
ments needed to assess the effectiveness of the 
minimum security controls referred to in sub-
paragraph (A). Such measurements shall in-
clude a risk scoring system to evaluate risk to 
information security both Governmentwide and 
within contractors of the Federal Government. 
‘‘(C) PRODUCTS
AND
SERVICES.—The 
Board shall be responsible for developing and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00759
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
760 
HR 5136 RHUC 
periodically updating information security poli-
cies, procedures, and minimum security stand-
ards relating to criteria for products and serv-
ices to be used in agency information systems 
and information infrastructure that will meet 
the minimum security controls referred to in 
subparagraph (A). In carrying out this subpara-
graph, the Board shall act in consultation with 
the Office of Management and Budget and the 
General Services Administration. 
‘‘(D) REMEDIES.—The Board shall be re-
sponsible for developing and periodically updat-
ing information security policies and procedures 
relating to methods for providing remedies for 
security deficiencies identified in agency infor-
mation infrastructure. 
‘‘(3) 
ADDITIONAL
CONSIDERATIONS.—The 
Board shall also consider— 
‘‘(A) opportunities to engage with the 
international community to set policies, prin-
ciples, training, standards, or guidelines for in-
formation security; 
‘‘(B) opportunities to work with agencies 
and industry partners to increase information 
sharing and policy coordination efforts in order 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00760
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
761 
HR 5136 RHUC 
to reduce vulnerabilities in the national infor-
mation infrastructure; and 
‘‘(C) options necessary to encourage and 
maintain accountability of any agency, or senior 
agency official, for efforts to secure the infor-
mation infrastructure of such agency. 
‘‘(4) RELATIONSHIP TO OTHER STANDARDS.— 
The policies and procedures developed under para-
graph (1) are supplemental to the standards promul-
gated by the Director of the National Office for 
Cyberspace under section 3558. 
‘‘(5) RECOMMENDATIONS FOR REGULATIONS.— 
The Board shall be responsible for making rec-
ommendations to the Director of the National Office 
for Cyberspace on regulations to carry out the poli-
cies and procedures developed by the Board under 
paragraph (1). 
‘‘(d) REGULATIONS.—The Director of the National 
Office for Cyberspace, in consultation with the Director 
of the Office of Management and the Administrator of 
General Services, shall promulgate and periodically update 
regulations to carry out the policies and procedures devel-
oped by the Board under subsection (c). 
‘‘(e) ANNUAL REPORT.—The Director of the Na-
tional Office for Cyberspace shall provide to Congress a 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00761
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
762 
HR 5136 RHUC 
report containing a summary of agency progress in imple-
menting the regulations promulgated under this section as 
part of the annual report to Congress required under sec-
tion 3555(a)(8). 
‘‘(f) NO DISCLOSURE BY BOARD REQUIRED.—The 
Board is not required to disclose under section 552 of title 
5 information submitted by agencies to the Board regard-
ing threats, vulnerabilities, and risks. 
‘‘§ 3555. Authority and functions of the Director of 
the National Office for Cyberspace 
‘‘(a) IN GENERAL.—The Director of the National Of-
fice for Cyberspace shall oversee agency information secu-
rity policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
timely agency adoption of and compliance with 
standards promulgated under section 3558; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under section 3558 and 
other requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00762
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
763 
HR 5136 RHUC 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
‘‘(B) information infrastructure used or 
operated by an agency or by a contractor of an 
agency or other organization on behalf of an 
agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3556(b); 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00763
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
767 
HR 5136 RHUC 
mined by the Director that is before the submission of 
such budget by the head of the agency to the Office of 
Management and Budget. 
‘‘(2) The Director shall review and offer a non-bind-
ing approval or disapproval of each agency’s annual budg-
et to each agency before the submission of such budget 
by the head of the agency to the Office of Management 
and Budget. 
‘‘(3) If the Director offers a non-binding disapproval 
of an agency’s budget, the Director shall transmit rec-
ommendations to the head of such agency for strength-
ening its proposed budget with regard to the protection 
of such agency’s information infrastructure. 
‘‘(4) Each budget submitted by the head of an agency 
pursuant to paragraph (1) shall include— 
‘‘(A) a review of any threats to information 
technology for such agency; 
‘‘(B) a plan to secure the information infra-
structure for such agency based on threats to infor-
mation technology, using the National Institute of 
Standards and Technology guidelines and rec-
ommendations; 
‘‘(C) a review of compliance by such agency 
with any previous year plan described in subpara-
graph (B); and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00767
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
768 
HR 5136 RHUC 
‘‘(D) a report on the development of the 
credentialing process to enable secure authentication 
of identity and authorization for access to the infor-
mation infrastructure of such agency. 
‘‘(5) The Director of the National Office for Cyber-
space may recommend to the President monetary penalties 
or incentives necessary to encourage and maintain ac-
countability of any agency, or senior agency official, for 
efforts to secure the information infrastructure of such 
agency. 
‘‘§ 3556. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information infrastructure used 
or operated by an agency or by a con-
tractor of an agency or other organization 
on behalf of an agency; 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00768
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
769 
HR 5136 RHUC 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) 
the 
regulations 
promulgated 
under section 3554 and the information se-
curity standards promulgated under sec-
tion 3558; 
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
‘‘(iii) ensuring the standards imple-
mented for information infrastructure and 
national security systems under the agency 
head are complementary and uniform, to 
the extent practicable; and 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning proc-
esses; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation infrastructure that support the operations 
and assets under their control, including through— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00769
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
770 
HR 5136 RHUC 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information infrastructure; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information infrastructure in accordance 
with regulations promulgated under section 
3554 and standards promulgated under section 
3558, for information security classifications 
and related requirements; 
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; and 
‘‘(D) continuously testing and evaluating 
information security controls and techniques to 
ensure that they are effectively implemented; 
‘‘(3) delegate to an agency official, designated 
as the ‘Chief Information Security Officer’, under 
the authority of the agency Chief Information Offi-
cer the responsibility to oversee agency information 
security and the authority to ensure and enforce 
compliance with the requirements imposed on the 
agency under this subchapter, including— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00770
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
771 
HR 5136 RHUC 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
on an automated and continuous basis that 
can— 
‘‘(i) assess the state of compliance of 
all networks and systems with prescribed 
controls issued pursuant to section 3558 
and report immediately any variance there-
from and, where appropriate and with the 
approval of the agency Chief Information 
Officer, shut down systems that are found 
to be non-compliant; 
‘‘(ii) detect, report, respond to, con-
tain, and mitigate incidents that impair 
adequate security of the information and 
information infrastructure, in accordance 
with policy provided by the Director of the 
National Office for Cyberspace, in con-
sultation with the Chief Information Offi-
cers Council, and guidance from the Na-
tional Institute of Standards and Tech-
nology; 
‘‘(iii) collaborate with the National 
Office for Cyberspace and appropriate pub-
lic and private sector security operations 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00771
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
772 
HR 5136 RHUC 
centers to address incidents that impact 
the security of information and informa-
tion infrastructure that extend beyond the 
control of the agency; and 
‘‘(iv) not later than 24 hours after 
discovery of any incident described under 
subparagraph (A)(ii), unless otherwise di-
rected by policy of the National Office for 
Cyberspace, provide notice to the appro-
priate security operations center, the Na-
tional Cyber Investigative Joint Task 
Force, and the Inspector General of the 
agency; 
‘‘(B) developing, maintaining, and over-
seeing an agency wide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tions 3555 and 3558; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00772
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
773 
HR 5136 RHUC 
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has trained and 
cleared personnel sufficient to assist the agency in 
complying with the requirements of this subchapter 
and related policies, procedures, standards, and 
guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in coordination with other senior agency of-
ficials, reports biannually to the agency head on the 
effectiveness of the agency information security pro-
gram, including progress of remedial actions; and 
‘‘(6) ensure that the Chief Information Security 
Officer possesses necessary qualifications, including 
education, professional certifications, training, expe-
rience, and the security clearance required to admin-
ister the functions described under this subchapter; 
and has information security duties as the primary 
duty of that official. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director of the National 
Office for Cyberspace under section 3555(a)(5), to provide 
information security for the information and information 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00773
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
775 
HR 5136 RHUC 
‘‘(D) ensure compliance with— 
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may 
be prescribed by the Director of the Na-
tional Office for Cyberspace, and informa-
tion security standards promulgated under 
section 3558; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the Director of the National Office for 
Cyberspace; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; 
‘‘(II) the policy of the Director of 
the National Office for Cyberspace; 
‘‘(III) the National Institute of 
Standards and Technology guidance; 
and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00775
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
776 
HR 5136 RHUC 
‘‘(IV) the Chief Information Offi-
cers 
Council 
recommended 
ap-
proaches; 
‘‘(E) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable require-
ments, including those issued under sections 
3555 and 3558; and 
‘‘(F) ensure the oversight and training of 
personnel with significant responsibilities for in-
formation security with respect to such respon-
sibilities; 
‘‘(4) ensuring that the agency has trained and 
cleared personnel sufficient to assist the agency in 
complying with the requirements of this subchapter 
and related policies, procedures, standards, and 
guidelines; 
‘‘(5) to the extent practicable, automated and 
continuous technical monitoring for testing, and 
evaluation of the effectiveness and compliance of in-
formation security policies, procedures, and prac-
tices, including— 
‘‘(A) management, operational, and tech-
nical controls of every information infrastruc-
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00776
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
777 
HR 5136 RHUC 
ture identified in the inventory required under 
section 3505(b); and 
‘‘(B) management, operational, and tech-
nical controls relied on for an evaluation under 
section 3556; 
‘‘(6) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(7) to the extent practicable, continuous auto-
mated technical monitoring for detecting, reporting, 
and responding to security incidents, consistent with 
standards and guidelines issued by the Director of 
the National Office for Cyberspace, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
‘‘(B) notifying and consulting with the ap-
propriate security operations response center; 
and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; 
‘‘(ii) the National Office for Cyber-
space; and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00777
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
778 
HR 5136 RHUC 
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the 
President; and 
‘‘(8) plans and procedures to ensure continuity 
of operations for information infrastructure that 
support the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, 
procedures, and practices, and compliance with the 
requirements of this subchapter, including compli-
ance with each requirement of subsection (b) to— 
‘‘(A) the National Office for Cyberspace; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of 
information security policies, procedures, and prac-
tices in plans and reports relating to— 
‘‘(A) annual agency budgets; 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00778
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
779 
HR 5136 RHUC 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and 
sections 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576) (and the amendments made by that 
Act); 
‘‘(F) financial management systems under 
the Federal Financial Management Improve-
ment Act (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31; and 
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)— 
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00779
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
780 
HR 5136 RHUC 
agement Improvement Act (31 U.S.C. 3512 
note). 
‘‘(d) PERFORMANCE PLAN.—(1) In addition to the 
requirements of subsection (c), each agency, in consulta-
tion with the National Office for Cyberspace, shall include 
as part of the performance plan required under section 
1115 of title 31 a description of the resources, including 
budget, staffing, and training, that are necessary to imple-
ment the program required under subsection (b). 
‘‘(2) The description under paragraph (1) shall be 
based on the risk assessments required under subsection 
(a)(2). 
‘‘(e) PUBLIC NOTICE AND COMMENT.—Each agency 
shall provide the public with timely notice and opportuni-
ties for comment on proposed information security policies 
and procedures to the extent that such policies and proce-
dures affect communication with the public. 
‘‘§ 3557. Annual independent audit 
‘‘(a) IN GENERAL.—(1) Each year each agency shall 
have performed an independent audit of the information 
security program and practices of that agency to deter-
mine the effectiveness of such program and practices. 
‘‘(2) Each audit under this section shall include— 
‘‘(A) testing of the effectiveness of the informa-
tion infrastructure of the agency for automated, con-
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00780
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
781 
HR 5136 RHUC 
tinuous monitoring of the state of compliance of its 
information infrastructure with regulations promul-
gated under section 3554 and standards promul-
gated under section 3558 in a representative subset 
of— 
‘‘(i) the information infrastructure used or 
operated by the agency; and 
‘‘(ii) the information infrastructure used, 
operated, or supported on behalf of the agency 
by a contractor of the agency, a subcontractor 
(at any tier) of such contractor, or any other 
entity; 
‘‘(B) an assessment (made on the basis of the 
results of the testing) of compliance with— 
‘‘(i) the requirements of this subchapter; 
and 
‘‘(ii) related information security policies, 
procedures, standards, and guidelines; 
‘‘(C) separate assessments, as appropriate, re-
garding information security relating to national se-
curity systems; and 
‘‘(D) a conclusion regarding whether the infor-
mation security controls of the agency are effective, 
including an identification of any significant defi-
ciencies in such controls. 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00781
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
782 
HR 5136 RHUC 
‘‘(3) Each audit under this section shall be performed 
in accordance with applicable generally accepted Govern-
ment auditing standards. 
‘‘(b) INDEPENDENT
AUDITOR.—Subject to sub-
section (c)— 
‘‘(1) for each agency with an Inspector General 
appointed under the Inspector General Act of 1978 
or any other law, the annual audit required by this 
section shall be performed by the Inspector General 
or by an independent external auditor, as deter-
mined by the Inspector General of the agency; and 
‘‘(2) for each agency to which paragraph (1) 
does not apply, the head of the agency shall engage 
an independent external auditor to perform the 
audit. 
‘‘(c) NATIONAL
SECURITY
SYSTEMS.—For each 
agency operating or exercising control of a national secu-
rity system, that portion of the audit required by this sec-
tion directly relating to a national security system shall 
be performed— 
‘‘(1) only by an entity designated head; and 
‘‘(2) in such a manner as to ensure appropriate 
protection for information associated with any infor-
mation security vulnerability in such system com-
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00782
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
783 
HR 5136 RHUC 
mensurate with the risk and in accordance with all 
applicable laws. 
‘‘(d) EXISTING AUDITS.—The audit required by this 
section may be based in whole or in part on another audit 
relating to programs or practices of the applicable agency. 
‘‘(e) AGENCY REPORTING.—(1) Each year, not later 
than such date established by the Director of the National 
Office for Cyberspace, the head of each agency shall sub-
mit to the Director the results of the audit required under 
this section. 
‘‘(2) To the extent an audit required under this sec-
tion directly relates to a national security system, the re-
sults of the audit submitted to the Director of the Na-
tional Office for Cyberspace shall contain only a summary 
and assessment of that portion of the audit directly relat-
ing to a national security system. 
‘‘(f) PROTECTION OF INFORMATION.—Agencies and 
auditors shall take appropriate steps to ensure the protec-
tion of information which, if disclosed, may adversely af-
fect information security. Such protections shall be com-
mensurate with the risk and comply with all applicable 
laws and regulations. 
‘‘(g) NATIONAL OFFICE FOR CYBERSPACE REPORTS 
TO CONGRESS.—(1) The Director of the National Office 
for Cyberspace shall summarize the results of the audits 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00783
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
784 
HR 5136 RHUC 
conducted under this section in the annual report to Con-
gress required under section 3555(a)(8). 
‘‘(2) The Director’s report to Congress under this 
subsection shall summarize information regarding infor-
mation security relating to national security systems in 
such a manner as to ensure appropriate protection for in-
formation associated with any information security vulner-
ability in such system commensurate with the risk and in 
accordance with all applicable laws. 
‘‘(3) Audits and any other descriptions of information 
infrastructure under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
ligence Programs systems under the authority and control 
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees 
of Congress, in accordance with applicable laws. 
‘‘(h) COMPTROLLER GENERAL.—The Comptroller 
General shall periodically evaluate and report to Congress 
on— 
‘‘(1) the adequacy and effectiveness of agency 
information security policies and practices; and 
‘‘(2) implementation of the requirements of this 
subchapter. 
‘‘(i) CONTRACTOR AUDITS.—Each year each con-
tractor that operates, uses, or supports an information 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00784
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
785 
HR 5136 RHUC 
system or information infrastructure on behalf of an agen-
cy and each subcontractor of such contractor— 
‘‘(1) shall conduct an audit using an inde-
pendent external auditor in accordance with sub-
section (a), including an assessment of compliance 
with the applicable requirements of this subchapter; 
and 
‘‘(2) shall submit the results of such audit to 
such agency not later than such date established by 
the Agency. 
‘‘§ 3558. Responsibilities for Federal information sys-
tems standards 
‘‘(a) REQUIREMENT TO PRESCRIBE STANDARDS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Except as provided 
under paragraph (2), the Secretary of Com-
merce shall, on the basis of proposed standards 
developed by the National Institute of Stand-
ards and Technology pursuant to paragraphs 
(2) and (3) of section 20(a) of the National In-
stitute of Standards and Technology Act (15 
U.S.C. 278g–3(a)) and in consultation with the 
Secretary of Homeland Security, promulgate in-
formation security standards pertaining to Fed-
eral information systems. 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00785
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
786 
HR 5136 RHUC 
‘‘(B) REQUIRED
STANDARDS.—Standards 
promulgated under subparagraph (A) shall in-
clude— 
‘‘(i) standards that provide minimum 
information security requirements as deter-
mined under section 20(b) of the National 
Institute of Standards and Technology Act 
(15 U.S.C. 278g–3(b)); and 
‘‘(ii) such standards that are other-
wise necessary to improve the efficiency of 
operation or security of Federal informa-
tion systems. 
‘‘(C) REQUIRED
STANDARDS
BINDING.— 
Information security standards described under 
subparagraph (B) shall be compulsory and 
binding. 
‘‘(2) STANDARDS
AND
GUIDELINES
FOR
NA-
TIONAL SECURITY SYSTEMS.—Standards and guide-
lines for national security systems, as defined under 
section 3552(b), shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law 
and as directed by the President. 
‘‘(b) APPLICATION
OF MORE STRINGENT STAND-
ARDS.—The head of an agency may employ standards for 
the cost-effective information security for all operations 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00786
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
787 
HR 5136 RHUC 
and assets within or under the supervision of that agency 
that are more stringent than the standards promulgated 
by the Secretary of Commerce under this section, if such 
standards— 
‘‘(1) contain, at a minimum, the provisions of 
those applicable standards made compulsory and 
binding by the Secretary; and 
‘‘(2) are otherwise consistent with policies and 
guidelines issued under section 3555. 
‘‘(c) REQUIREMENTS REGARDING DECISIONS BY THE 
SECRETARY.— 
‘‘(1) DEADLINE.—The decision regarding the 
promulgation of any standard by the Secretary of 
Commerce under subsection (b) shall occur not later 
than 6 months after the submission of the proposed 
standard to the Secretary by the National Institute 
of Standards and Technology, as provided under sec-
tion 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3). 
‘‘(2) NOTICE
AND
COMMENT.—A decision by 
the Secretary of Commerce to significantly modify, 
or not promulgate, a proposed standard submitted to 
the Secretary by the National Institute of Standards 
and Technology, as provided under section 20 of the 
National Institute of Standards and Technology Act 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00787
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
788 
HR 5136 RHUC 
(15 U.S.C. 278g–3), shall be made after the public 
is given an opportunity to comment on the Sec-
retary’s proposed decision. 
‘‘§ 3559. Federal information security incident center 
‘‘(a) IN GENERAL.—The Director of the National Of-
fice for Cyberspace shall ensure the operation of a central 
Federal information security incident center to— 
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems and information 
infrastructure regarding security incidents, including 
guidance on detecting and handling information se-
curity incidents; 
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information 
systems and information infrastructure about cur-
rent and potential information security threats, and 
vulnerabilities; and 
‘‘(4) consult with the National Institute of 
Standards and Technology, agencies or offices oper-
ating or exercising control of national security sys-
tems (including the National Security Agency), and 
such other agencies or offices in accordance with law 
and as directed by the President regarding informa-
tion security incidents and related matters. 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00788
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
789 
HR 5136 RHUC 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency 
operating or exercising control of a national security sys-
tem shall share information about information security in-
cidents, threats, and vulnerabilities with the Federal infor-
mation security incident center to the extent consistent 
with standards and guidelines for national security sys-
tems, issued in accordance with law and as directed by 
the President. 
‘‘(c) REVIEW AND APPROVAL.—In coordination with 
the Administrator for Electronic Government and Infor-
mation Technology, the Director of the National Office for 
Cyberspace shall review and approve the policies, proce-
dures, and guidance established in this subchapter to en-
sure that the incident center has the capability to effec-
tively and efficiently detect, correlate, respond to, contain, 
mitigate, and remediate incidents that impair the ade-
quate security of the information systems and information 
infrastructure of more than one agency. To the extent 
practicable, the capability shall be continuous and tech-
nically automated. 
‘‘§ 3560. National security systems 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00789
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
790 
HR 5136 RHUC 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and 
‘‘(3) complies with the requirements of this sub-
chapter.’’. 
SEC. 1702. INFORMATION SECURITY ACQUISITION RE-
QUIREMENTS. 
(a) IN GENERAL.—Chapter 113 of title 40, United 
States Code, is amended by adding at the end of sub-
chapter II the following new section: 
‘‘§ 11319. Information security acquisition require-
ments 
‘‘(a) PROHIBITION.—Notwithstanding any other pro-
vision of law, beginning one year after the date of the en-
actment of the Federal Information Security Amendments 
Act of 2010, no agency may enter into a contract, an order 
under a contract, or an interagency agreement for— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00790
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
791 
HR 5136 RHUC 
‘‘(1) the collection, use, management, storage, 
or dissemination of information on behalf of the 
agency; 
‘‘(2) the use or operation of an information sys-
tem or information infrastructure on behalf of the 
agency; or 
‘‘(3) information technology; 
unless such contract, order, or agreement includes require-
ments to provide effective information security that sup-
ports the operations and assets under the control of the 
agency, in compliance with the policies, standards, and 
guidance developed under subsection (b), and otherwise 
ensures compliance with this section. 
‘‘(b) COORDINATION OF SECURE ACQUISITION POLI-
CIES.— 
‘‘(1) IN GENERAL.—The Director, in consulta-
tion with the Director of the National Institute of 
Standards and Technology, the Director of the Na-
tional Office for Cyberspace, and the Administrator 
of General Services, shall oversee the development 
and implementation of policies, standards, and guid-
ance, including through revisions to the Federal Ac-
quisition Regulation and the Department of Defense 
supplement to the Federal Acquisition Regulation, to 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00791
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
792 
HR 5136 RHUC 
cost effectively enhance agency information security, 
including— 
‘‘(A) minimum information security re-
quirements for agency procurement of informa-
tion technology products and services; and 
‘‘(B) approaches for evaluating and miti-
gating significant supply chain security risks 
associated with products or services to be ac-
quired by agencies. 
‘‘(2) REPORT.—Not later than two years after 
the date of the enactment of the Federal Informa-
tion Security Amendments Act of 2010, the Director 
shall submit to Congress a report describing— 
‘‘(A) actions taken to improve the informa-
tion security associated with the procurement of 
products and services by the Federal Govern-
ment; and 
‘‘(B) plans for overseeing and coordinating 
efforts of agencies to use best practice ap-
proaches for cost-effectively purchasing more 
secure products and services. 
‘‘(c) VULNERABILITY ASSESSMENTS OF MAJOR SYS-
TEMS.— 
‘‘(1) REQUIREMENT
FOR
INITIAL
VULNER-
ABILITY ASSESSMENTS.—The Director shall require 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00792
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
793 
HR 5136 RHUC 
each agency to conduct an initial vulnerability as-
sessment for any major system and its significant 
items of supply prior to the development of the sys-
tem. The initial vulnerability assessment of a major 
system and its significant items of supply shall in-
clude use of an analysis-based approach to— 
‘‘(A) identify vulnerabilities; 
‘‘(B) define exploitation potential; 
‘‘(C) examine the system’s potential effec-
tiveness; 
‘‘(D) determine overall vulnerability; and 
‘‘(E) make recommendations for risk re-
duction. 
‘‘(2) SUBSEQUENT
VULNERABILITY
ASSESS-
MENTS.— 
‘‘(A) The Director shall require a subse-
quent vulnerability assessment of each major 
system and its significant items of supply with-
in a program if the Director determines that 
circumstances warrant the issuance of an addi-
tional vulnerability assessment. 
‘‘(B) Upon the request of a congressional 
committee, the Director may require a subse-
quent vulnerability assessment of a particular 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00793
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
794 
HR 5136 RHUC 
major system and its significant items of supply 
within the program. 
‘‘(C) Any subsequent vulnerability assess-
ment of a major system and its significant 
items of supply shall include use of an analysis- 
based approach and, if applicable, a testing- 
based approach, to monitor the exploitation po-
tential of such system and reexamine the fac-
tors described in subparagraphs (A) through 
(E) of paragraph (1). 
‘‘(3) CONGRESSIONAL OVERSIGHT.—The Direc-
tor shall provide to the appropriate congressional 
committees a copy of each vulnerability assessment 
conducted under paragraph (1) or (2) not later than 
10 days after the date of the completion of such as-
sessment. 
‘‘(d) DEFINITIONS.—In this section: 
‘‘(1) ITEM OF SUPPLY.—The term ‘item of sup-
ply’— 
‘‘(A) means any individual part, compo-
nent, subassembly, assembly, or subsystem inte-
gral to a major system, and other property 
which may be replaced during the service life of 
the major system, including a spare part or re-
plenishment part; and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00794
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
795 
HR 5136 RHUC 
‘‘(B) does not include packaging or label-
ing associated with shipment or identification of 
an item. 
‘‘(2) VULNERABILITY ASSESSMENT.—The term 
‘vulnerability assessment’ means the process of iden-
tifying and quantifying vulnerabilities in a major 
system and its significant items of supply. 
‘‘(3) MAJOR SYSTEM.—The term ‘major system’ 
has the meaning given that term in section 4 of the 
Office of Federal Procurement Policy Act (41 U.S.C. 
403).’’. 
SEC. 1703. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) TABLE OF SECTIONS IN TITLE 44.—The table 
of sections for chapter 35 of title 44, United States Code, 
is amended by striking the matter relating to subchapters 
II and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. National Office for Cyberspace. 
‘‘3554. Federal Cybersecurity Practice Board. 
‘‘3555. Authority and functions of the Director of the National Office for 
Cyberspace. 
‘‘3556. Agency responsibilities. 
‘‘3557. Annual independent audit. 
‘‘3558. Responsibilities for Federal information systems standards. 
‘‘3559. Federal information security incident center. 
‘‘3560. National security systems.’’. 
(b) TABLE OF SECTIONS IN TITLE 40.—The table 
of sections for chapter 113 of title 40, United States Code, 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00795
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
796 
HR 5136 RHUC 
is amended by inserting after the item relating to section 
11318 the following new item: 
‘‘Sec. 11319. Information security acquisition requirements.’’. 
(c) OTHER REFERENCES.— 
(1) Section 1001(c)(1)(A) of the Homeland Se-
curity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is 
amended by striking ‘‘section 3532(3)’’ and insert-
ing ‘‘section 3552(b)’’. 
(2) Section 2222(j)(6) of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2))’’ 
and inserting ‘‘section 3552(b)’’. 
(3) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2))’’ and inserting ‘‘section 3552(b)’’. 
(4) Section 2315 of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2))’’ 
and inserting ‘‘section 3552(b)’’. 
(5) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–3) 
is amended— 
(A) in subsections (a)(2) and (e)(5), by 
striking ‘‘section 3532(b)(2)’’ and inserting 
‘‘section 3552(b)’’; 
(B) in subsection (e)(2), by striking ‘‘sec-
tion 3532(1)’’ and inserting ‘‘section 3552(b)’’; 
and 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00796
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
797 
HR 5136 RHUC 
(C) in subsections (c)(3) and (d)(1), by 
striking ‘‘section 11331 of title 40’’ and insert-
ing ‘‘section 3558 of title 44’’. 
(6) Section 8(d)(1) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7406(d)(1)) 
is amended by striking ‘‘section 3534(b)’’ and in-
serting ‘‘section 3556(b)’’. 
(d) REPEAL.— 
(1) Subchapter III of chapter 113 of title 40, 
United States Code, is repealed. 
(2) The table of sections for chapter 113 of 
such title is amended by striking the matter relating 
to subchapter III. 
(e) EXECUTIVE
SCHEDULE
PAY
RATE.—Section 
5314 of title 5, United States Code, is amended by adding 
at the end the following: 
‘‘Director of the National Office for Cyber-
space.’’. 
(f) MEMBERSHIP
ON
THE NATIONAL SECURITY 
COUNCIL.—Section 101(a) of the National Security Act 
of 1947 (50 U.S.C. 402(a)) is amended— 
(1) by redesignating paragraphs (7) and (8) as 
paragraphs (8) and (9), respectively; and 
(2) by inserting after paragraph (6) the fol-
lowing: 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00797
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
798 
HR 5136 RHUC 
‘‘(7) the Director of the National Office for 
Cyberspace;’’. 
SEC. 1704. EFFECTIVE DATE. 
(a) IN GENERAL.—Unless otherwise specified in this 
section, this subtitle (including the amendments made by 
this subtitle) shall take effect 30 days after the date of 
enactment of this Act. 
(b) NATIONAL OFFICE FOR CYBERSPACE.—Section 
3553 of title 44, United States Code, as added by section 
1701 of this division, shall take effect 180 days after the 
date of enactment of this Act. 
(c) FEDERAL CYBERSECURITY PRACTICE BOARD.— 
Section 3554 of title 44, United States Code, as added 
by section 1701 of this division, shall take effect 1 year 
after the date of enactment of this Act. 
Subtitle B—Federal Chief 
Technology Officer 
SEC. 1711. OFFICE OF THE CHIEF TECHNOLOGY OFFICER. 
(a) ESTABLISHMENT AND STAFF.— 
(1) ESTABLISHMENT.— 
(A) IN GENERAL.—There is established in 
the Executive Office of the President an Office 
of the Federal Chief Technology Officer (in this 
section referred to as the ‘‘Office’’). 
(B) HEAD OF THE OFFICE.— 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00798
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS
799 
HR 5136 RHUC 
(i) FEDERAL CHIEF TECHNOLOGY OF-
FICER.—The President shall appoint a 
Federal Chief Technology Officer (in this 
section referred to as the ‘‘Federal CTO’’) 
who shall be the head of the Office. 
(ii) COMPENSATION.—Section 5314 of 
title 5, United States Code, is amended by 
adding at the end the following: 
‘‘Federal Chief Technology Officer.’’. 
(2) STAFF
OF
THE
OFFICE.—The President 
may appoint additional staff members to the Office. 
(b) DUTIES OF THE OFFICE.—The functions of the 
Federal CTO are the following: 
(1) Undertake fact-gathering, analysis, and as-
sessment of the Federal Government’s information 
technology infrastructures, information technology 
strategy, and use of information technology, and 
provide advice on such matters to the President, 
heads of Federal departments and agencies, and 
government chief information officers and chief tech-
nology officers. 
(2) Lead an interagency effort, working with 
the chief technology and chief information officers of 
each of the Federal departments and agencies, to de-
velop and implement a planning process to ensure 
VerDate Mar 15 2010 
00:09 Jun 26, 2010
Jkt 089200
PO 00000
Frm 00799
Fmt 6652
Sfmt 6201
E:\BILLS\H5136.RHUC
H5136
mmaher on DSKD5P82C1PROD with BILLS