‘‘(A) opportunities to engage with the 
international community to set policies, prin-
ciples, training, standards, or guidelines for in-
formation security; 
‘‘(B) opportunities to work with agencies 
and industry partners to increase information 
sharing and policy coordination efforts in order 
to reduce vulnerabilities in the national infor-
mation infrastructure; and 
‘‘(C) options necessary to encourage and 
maintain accountability of any agency, or senior 
agency official, for efforts to secure the infor-
mation infrastructure of such agency. 
‘‘(4) RELATIONSHIP TO OTHER STANDARDS.— 
The policies and procedures developed under para-
graph (1) are supplemental to the standards promul-
gated by the Director of the National Office for 
Cyberspace under section 3558. 
‘‘(5) RECOMMENDATIONS FOR REGULATIONS.— 
The Board shall be responsible for making rec-
ommendations to the Director of the National Office 
for Cyberspace on regulations to carry out the poli-
cies and procedures developed by the Board under 
paragraph (1). 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(d) REGULATIONS.—The Director of the National 
Office for Cyberspace, in consultation with the Director 
of the Office of Management and the Administrator of 
General Services, shall promulgate and periodically update 
regulations to carry out the policies and procedures devel-
oped by the Board under subsection (c). 
‘‘(e) ANNUAL REPORT.—The Director of the Na-
tional Office for Cyberspace shall provide to Congress a 
report containing a summary of agency progress in imple-
menting the regulations promulgated under this section as 
part of the annual report to Congress required under sec-
tion 3555(a)(8). 
‘‘(f) NO DISCLOSURE BY BOARD REQUIRED.—The 
Board is not required to disclose under section 552 of title 
5 information submitted by agencies to the Board regard-
ing threats, vulnerabilities, and risks. 
‘‘§ 3555. Authority and functions of the Director of 
the National Office for Cyberspace 
‘‘(a) IN GENERAL.—The Director of the National Of-
fice for Cyberspace shall oversee agency information secu-
rity policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
timely agency adoption of and compliance with 
standards promulgated under section 3558; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under section 3558 and 
other requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
‘‘(B) information infrastructure used or 
operated by an agency or by a contractor of an 
agency or other organization on behalf of an 
agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3556(b); 
‘‘(6) coordinating information security policies 
and procedures of the Federal Government with re-
lated information resources management policies and 
procedures on the security and resiliency of cyber-
space; 
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under 
section 3559; 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the re-
quirements of this subchapter, including— 
‘‘(A) a summary of the findings of audits 
required by section 3557; 
‘‘(B) an assessment of the development, 
promulgation, and adoption of, and compliance 
with, standards developed under section 20 of 
the National Institute of Standards and Tech-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
nology Act (15 U.S.C. 278g–3) and promul-
gated under section 3558; 
‘‘(C) significant deficiencies in agency in-
formation security practices; 
‘‘(D) planned remedial action to address 
such deficiencies; and 
‘‘(E) a summary of, and the views of the 
Director of the National Office for Cyberspace 
on, the report prepared by the National Insti-
tute of Standards and Technology under section 
20(d)(10) of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3); 
‘‘(9) coordinating the defense of information in-
frastructure operated by agencies in the case of a 
large-scale attack on information infrastructure, as 
determined by the Director; 
‘‘(10) establishing a national strategy not later 
than 120 days after the date of the enactment of 
this section; 
‘‘(11) coordinating information security training 
for Federal employees with the Office of Personnel 
Management; 
‘‘(12) ensuring the adequacy of protections for 
privacy and civil liberties in carrying out the respon-
sibilities of the Director under this subchapter; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(13) making recommendations that the Direc-
tor determines are necessary to ensure risk-based se-
curity of the Federal information infrastructure and 
information infrastructure that is owned, operated, 
controlled, or licensed for use by, or on behalf of, the 
Department of Defense, a military department, or 
another element of the intelligence community to— 
‘‘(A) the Director of the Office of Manage-
ment and Budget; 
‘‘(B) the head of an agency; or 
‘‘(C) to Congress with regard to the re-
programming of funds; 
‘‘(14) ensuring, in consultation with the Admin-
istrator of the Office of Information and Regulatory 
Affairs, that the efforts of agencies relating to the 
development of regulations, rules, requirements, or 
other actions applicable to the national information 
infrastructure are complementary; 
‘‘(15) when directed by the President, carrying 
out the responsibilities for national security and 
emergency preparedness communications described 
in section 706 of the Communications Act of 1934 
(47 U.S.C. 606) to ensure integration and coordina-
tion; and 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(16) as assigned by the President, other duties 
relating to the security and resiliency of cyberspace. 
‘‘(b) RECRUITMENT PROGRAM.—Not later than 1 
year after appointment, the Director of the National Of-
fice for Cyberspace shall establish a national program to 
conduct competitions and challenges that instruct United 
States students in cybersecurity education and computer 
literacy. 
‘‘(c) BUDGET OVERSIGHT
AND REPORTING.—(1) 
The head of each agency shall submit to the Director of 
the National Office for Cyberspace a budget each year for 
the following fiscal year relating to the protection of infor-
mation infrastructure for such agency, by a date deter-
mined by the Director that is before the submission of 
such budget by the head of the agency to the Office of 
Management and Budget. 
‘‘(2) The Director shall review and offer a non-bind-
ing approval or disapproval of each agency’s annual budg-
et to each such agency before the submission of such budg-
et by the head of the agency to the Office of Management 
and Budget. 
‘‘(3) If the Director offers a non-binding disapproval 
of an agency’s budget, the Director shall transmit rec-
ommendations to the head of such agency for strength-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
ening its proposed budget with regard to the protection 
of such agency’s information infrastructure. 
‘‘(4) Each budget submitted by the head of an agency 
pursuant to paragraph (1) shall include— 
‘‘(A) a review of any threats to information 
technology for such agency; 
‘‘(B) a plan to secure the information infra-
structure for such agency based on threats to infor-
mation technology, using the National Institute of 
Standards and Technology guidelines and rec-
ommendations; 
‘‘(C) a review of compliance by such agency 
with any previous year plan described in subpara-
graph (B); and 
‘‘(D) a report on the development of the 
credentialing process to enable secure authentication 
of identity and authorization for access to the infor-
mation infrastructure of such agency. 
‘‘(5) The Director of the National Office for Cyber-
space may recommend to the President monetary penalties 
or incentives necessary to encourage and maintain ac-
countability of any agency, or senior agency official, for 
efforts to secure the information infrastructure of such 
agency. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘§ 3556. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information infrastructure used 
or operated by an agency or by a con-
tractor of an agency or other organization 
on behalf of an agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) 
the 
regulations 
promulgated 
under section 3554 and the information se-
curity standards promulgated under sec-
tion 3558; 
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(iii) ensuring the standards imple-
mented for information infrastructure and 
national security systems under the agency 
head are complementary and uniform, to 
the extent practicable; and 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning proc-
esses; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation infrastructure that support the operations 
and assets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information infrastructure; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information infrastructure in accordance 
with regulations promulgated under section 
3554 and standards promulgated under section 
3558, for information security classifications 
and related requirements; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; and 
‘‘(D) continuously testing and evaluating 
information security controls and techniques to 
ensure that they are effectively implemented; 
‘‘(3) delegate to an agency official, designated 
as the ‘Chief Information Security Officer’, under 
the authority of the agency Chief Information Offi-
cer the responsibility to oversee agency information 
security and the authority to ensure and enforce 
compliance with the requirements imposed on the 
agency under this subchapter, including— 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
on an automated and continuous basis that 
can— 
‘‘(i) assess the state of compliance of 
all networks and systems with prescribed 
controls issued pursuant to section 3558 
and report immediately any variance there-
from and, where appropriate and with the 
approval of the agency Chief Information 
Officer, shut down systems that are found 
to be non-compliant; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(ii) detect, report, respond to, con-
tain, and mitigate incidents that impair 
adequate security of the information and 
information infrastructure, in accordance 
with policy provided by the Director of the 
National Office for Cyberspace, in con-
sultation with the Chief Information Offi-
cers Council, and guidance from the Na-
tional Institute of Standards and Tech-
nology; 
‘‘(iii) collaborate with the National 
Office for Cyberspace and appropriate pub-
lic and private sector security operations 
centers to address incidents that impact 
the security of information and informa-
tion infrastructure that extend beyond the 
control of the agency; and 
‘‘(iv) not later than 24 hours after 
discovery of any incident described under 
subparagraph (A)(ii), unless otherwise di-
rected by policy of the National Office for 
Cyberspace, provide notice to the appro-
priate security operations center, the Na-
tional Cyber Investigative Joint Task 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS