I 
110TH CONGRESS 
2D SESSION 
H. R. 5983 
To amend the Homeland Security Act of 2002 to enhance the information 
security of the Department of Homeland Security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 7, 2008 
Mr. LANGEVIN (for himself and Mr. THOMPSON of Mississippi) introduced the 
following bill; which was referred to the Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to enhance 
the information security of the Department of Homeland 
Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Homeland Security 
Network Defense and Accountability Act of 2008’’. 
SEC. 2. AUTHORITY OF CHIEF INFORMATION OFFICER; 
QUALIFICATIONS FOR APPOINTMENT. 
Section 703(a) of the Homeland Security Act of 2002 
(6 U.S.C. 343(a)) is amended— 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
(1) by inserting before the first sentence the 
following: 
‘‘(1) AUTHORITIES
AND
DUTIES.—The Sec-
retary shall delegate to the Chief Information Offi-
cer such authority necessary for the development, 
approval, implementation, integration, and oversight 
of policies, procedures, processes, activities, funding, 
and systems of the Department relating to the man-
agement of information and information infrastruc-
ture for the Department, including the management 
of all related mission applications, information re-
sources, and personnel. 
‘‘(2) LINE AUTHORITY.—’’; and 
(2) by adding at the end the following new 
paragraphs: 
‘‘(3) QUALIFICATIONS FOR APPOINTMENT.—An 
individual may not be appointed as Chief Informa-
tion Officer unless the individual has— 
‘‘(A) demonstrated ability in and knowl-
edge of information technology and information 
security; and 
‘‘(B) not less than 5 years of executive 
leadership and management experience in infor-
mation technology and information security in 
the public or private sector. 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
‘‘(4) FUNCTIONS.—The Chief Information Offi-
cer shall— 
‘‘(A) establish and maintain an incident re-
sponse team that provides a continuous, real- 
time capability within the Department of 
Homeland Security to— 
‘‘(i) detect, respond to, contain, inves-
tigate, attribute, and mitigate any com-
puter incident, as defined by the National 
Institute of Standards and Technology, 
that could violate or pose an imminent 
threat of violation of computer security 
policies, acceptable use policies, or stand-
ard security practices of the Department; 
and 
‘‘(ii) deliver timely notice of any inci-
dent to individuals responsible for informa-
tion infrastructure of the Department, and 
to the United States Computer Emergency 
Readiness Team; 
‘‘(B) establish, maintain, and update a 
network architecture, including a diagram de-
tailing how security controls are positioned 
throughout the information infrastructure of 
the Department to maintain the confidentiality, 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
integrity, availability, accountability, and assur-
ance of electronic information; and 
‘‘(C) ensure that vulnerability assessments 
are conducted on a regular basis for any De-
partment information infrastructure connected 
to the Internet or another external network, 
and that vulnerabilities are mitigated in a time-
ly fashion.’’. 
SEC. 3. ATTACK-BASED TESTING PROTOCOLS. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(c) ATTACK-BASED
TESTING
PROTOCOLS.—The 
Chief Information Officer, in consultation with the Inspec-
tor General, the Assistant Secretary for Cybersecurity, 
and the heads of other appropriate Federal agencies, 
shall— 
‘‘(1) establish security control testing protocols 
that ensure that the Department’s information in-
frastructure is effectively protected against known 
attacks against and exploitations of Federal and 
contractor information infrastructure; 
‘‘(2) oversee the deployment of such protocols 
throughout the information infrastructure of the De-
partment; and 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
‘‘(3) update such protocols on a regular basis.’’. 
SEC. 4. INSPECTOR GENERAL REVIEWS OF INFORMATION 
INFRASTRUCTURE. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following new subsection: 
‘‘(d) INSPECTOR GENERAL REVIEWS.— 
‘‘(1) IN GENERAL.—The Inspector General of 
the Department shall use authority under the In-
spector General Act of 1978 (5 App. U.S.C.) to con-
duct announced and unannounced performance re-
views and programmatic reviews of the information 
infrastructure of the Department to determine the 
effectiveness of security policies and controls of the 
Department. 
‘‘(2) PERFORMANCE
REVIEWS.—Performance 
reviews under this subsection shall test and validate 
a system’s security controls using the protocols cre-
ated under subsection (c), beginning not later than 
270 days after the date of enactment of the Home-
land Security Network Defense and Accountability 
Act of 2008. 
‘‘(3) PROGRAMMATIC REVIEWS.—Programmatic 
reviews under this subsection shall— 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
‘‘(A) determine whether an agency of the 
Department is complying with policies, proc-
esses, and procedures established by the Chief 
Information Officer; and 
‘‘(B) focus primarily on authentication, ac-
cess control, risk management, intrusion detec-
tion and prevention, incident response, risk as-
sessment, remote access, and any other controls 
the Inspector General considers necessary. 
‘‘(4) INFORMATION
SECURITY
REPORT.—The 
Inspector General shall submit a security report con-
taining the results of each review under this sub-
section and prioritized recommendations for improv-
ing security controls based on that review, including 
recommendations regarding funding changes and 
personnel management, to— 
‘‘(A) the Secretary; 
‘‘(B) the Chief Information Officer; and 
‘‘(C) the head of the Department compo-
nent that was the subject of the review, and 
other appropriate individuals responsible for the 
information infrastructure of such agency. 
‘‘(5) CORRECTIVE ACTION REPORT.— 
‘‘(A) IN GENERAL.—Within 60 days after 
receiving a security report under paragraph (4), 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
the head of the Department component that 
was the subject of the review and the Chief In-
formation Officer shall jointly submit a correc-
tive action report to the Secretary and the In-
spector General. 
‘‘(B) CONTENTS.—The corrective action 
report— 
‘‘(i) shall contain a plan for address-
ing 
recommendations 
and 
mitigating 
vulnerabilities contained in the security re-
port, including a timeline and budget for 
implementing such plan; and 
‘‘(ii) shall note any matters in dis-
agreement between the head of the Depart-
ment component and the Chief Information 
Officer. 
‘‘(6) REPORTS TO CONGRESS.— 
‘‘(A) ANNUAL
REPORTS.—In conjunction 
with the reporting requirements of section 3545 
of title 44, United States Code, the Inspector 
General shall submit an annual report to the 
Committee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Affairs 
of the Senate— 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
‘‘(i) summarizing the performance and 
programmatic reviews performed during 
the preceding fiscal year, the results of 
those reviews, and any actions that remain 
to be taken under plans included in correc-
tive action reports under paragraph (5); 
and 
‘‘(ii) describing the effectiveness of 
the testing protocols developed under sub-
section (c) in reducing successful exploi-
tations of the Department’s information 
infrastructure. 
‘‘(B) SECURITY
REPORTS
AND
CORREC-
TIVE ACTION REPORTS.—The Inspector General 
shall make all security reports and corrective 
action reports available to any member of the 
Committee on Homeland Security of the House 
of Representatives, any member of the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate, and the Comp-
troller General of the United States, upon re-
quest.’’. 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
SEC. 5. INFORMATION INFRASTRUCTURE DEFINED. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following: 
‘‘(e) INFORMATION INFRASTRUCTURE DEFINED.—In 
this section, the term ‘information infrastructure’ means 
systems and assets used in processing, transmitting, re-
ceiving, or storing information electronically.’’. 
SEC. 6. NETWORK SERVICE PROVIDERS. 
(a) IN GENERAL.—Subtitle D of title VIII of the 
Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 836. REQUIREMENTS FOR NETWORK SERVICE PRO-
VIDERS. 
‘‘(a) COMPATIBILITY DETERMINATION.— 
‘‘(1) IN GENERAL.—Before entering into or re-
newing a covered contract, the Secretary, acting 
through the Chief Information Officer, must deter-
mine that the contractor has an internal information 
systems security policy that complies with the De-
partment’s information security requirements, in-
cluding with regard to authentication, access control, 
risk management, intrusion detection and preven-
tion, incident response, risk assessment, and remote 
access, and any other policies that the Secretary 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS