107TH CONGRESS
1ST SESSION
H. R. 1259
AN ACT
To amend the National Institute of Standards and Tech-
nology Act to enhance the ability of the National Insti-
tute of Standards and Technology to improve computer
security, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Computer Security En-
hancement Act of 2001’’.
SEC. 2. FINDINGS AND PURPOSES.
(a) FINDINGS.—The Congress finds the following:
(1) The National Institute of Standards and
Technology has responsibility for developing stand-
ards and guidelines needed to ensure the cost-effec-
tive security and privacy of sensitive information in
Federal computer systems.
(2) The Federal Government has an important
role in ensuring the protection of sensitive, but un-
classified, information controlled by Federal agen-
cies.
(3) Technology that is based on the application
of cryptography exists and can be readily provided
by private sector companies to ensure the confiden-
tiality, authenticity, and integrity of information as-
sociated with public and private activities.
(4) The development and use of encryption
technologies by industry should be driven by market
forces rather than by Government imposed require-
ments.
(b) PURPOSES.—The purposes of this Act are to—
(1) reinforce the role of the National Institute
of Standards and Technology in ensuring the secu-
rity of unclassified information in Federal computer
systems; and
(2) promote technology solutions based on pri-
vate sector offerings to protect the security of Fed-
eral computer systems.
SEC. 3. SECURITY OF FEDERAL COMPUTERS AND NET-
WORKS.
Section 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)) is amended—
(1) by redesignating paragraphs (4) and (5) as
paragraphs (7) and (8), respectively; and
(2) by inserting after paragraph (3) the fol-
lowing new paragraphs:
‘‘(4) except for national security systems, as de-
fined in section 5142 of Public Law 104-106 (40
U.S.C. 1452), to provide guidance and assistance to
Federal agencies for protecting the security and pri-
vacy of sensitive information in interconnected Fed-
eral computer systems, including identification of
significant risks thereto;
‘‘(5) to promote compliance by Federal agencies
with existing Federal computer information security
and privacy guidelines;
‘‘(6) in consultation with appropriate Federal
agencies, assist Federal response efforts related to
unauthorized access to Federal computer systems;’’.
SEC. 4. COMPUTER SECURITY IMPLEMENTATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is further amended—
(1) by redesignating subsections (c) and (d) as
subsections (e) and (f), respectively; and
(2) by inserting after subsection (b) the fol-
lowing new subsection:
‘‘(c)(1) In carrying out subsection (a)(2) and (3), the
Institute shall—
‘‘(A) emphasize the development of technology-
neutral policy guidelines for computer security and
electronic authentication practices by the Federal
agencies;
‘‘(B) promote the use of commercially available
products, which appear on the list required by para-
graph (2), to provide for the security and privacy of
sensitive information in Federal computer systems;
‘‘(C) develop qualitative and quantitative meas-
ures appropriate for assessing the quality and effec-
tiveness of information security and privacy pro-
grams at Federal agencies;
‘‘(D) upon the request of a Federal agency, per-
form evaluations to assess its existing information
security and privacy programs;
‘‘(E) promote development of accreditation pro-
cedures for Federal agencies based on the measures
developed under subparagraph (C);
‘‘(F) if requested, consult with and provide as-
sistance to Federal agencies regarding the selection
by agencies of security technologies and products
and the implementation of security practices; and
‘‘(G)(i) develop uniform testing procedures suit-
able for determining the conformance of commer-
cially available security products to the guidelines
and standards developed under subsection (a)(2) and
(3);
‘‘(ii) establish procedures for certification of
private sector laboratories to perform the tests and
evaluations of commercially available security prod-
ucts developed in accordance with clause (i); and
‘‘(iii) promote the testing of commercially avail-
able security products for their conformance with
guidelines and standards developed under subsection
(a)(2) and (3).
‘‘(2) The Institute shall maintain and make available
to Federal agencies and to the public a list of commercially
available security products that have been tested by pri-
vate sector laboratories certified in accordance with proce-
dures established under paragraph (1)(G)(ii), and that
have been found to be in conformance with the guidelines
and standards developed under subsection (a)(2) and (3).
‘‘(3) The Institute shall annually transmit to the
Congress, in an unclassified format, a report containing—
‘‘(A) the findings of the evaluations and tests of
Federal computer systems conducted under this sec-
tion during the 12 months preceding the date of the
report, including the frequency of the use of com-
mercially available security products included on the
list required by paragraph (2);
‘‘(B) the planned evaluations and tests under
this section for the 12 months following the date of
the report; and
‘‘(C) any recommendations by the Institute to
Federal agencies resulting from the findings de-
scribed in subparagraph (A), and the response by
the agencies to those recommendations.’’.
SEC. 5. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this
Act, is further amended by inserting after subsection (c),