which would have a debilitating impact on the mission of 
the Central Intelligence Agency. 
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) information security standards 
and guidelines promulgated under section 
11331 of title 40 and section 20 of the Na-
tional Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3); 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
‘‘(iii) ensuring the standards imple-
mented for information systems and na-
tional security systems of the agency are 
complementary and uniform, to the extent 
practicable; 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning and 
budget processes, including policies, procedures, 
and practices described in subsection (c)(2); 
‘‘(D) as appropriate, maintaining secure 
facilities that have the capability of accessing, 
sending, receiving, and storing classified infor-
mation; 
‘‘(E) maintaining a sufficient number of 
personnel with security clearances, at the ap-
propriate levels, to access, send, receive and 
analyze classified information to carry out the 
responsibilities of this subchapter; and 
‘‘(F) ensuring that information security 
performance indicators and measures are in-
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation systems that support the operations and as-
sets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information system; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 11331 of title 40 
and section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3) for information security classifications 
and related requirements; 
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(D) with a frequency sufficient to support 
risk-based security decisions, testing and evalu-
ating information security controls and tech-
niques to ensure that such controls and tech-
niques are effectively implemented and oper-
ated; and 
‘‘(E) with a frequency sufficient to support 
risk-based security decisions, conducting threat 
assessments by monitoring information systems, 
identifying potential system vulnerabilities, and 
reporting security incidents in accordance with 
paragraph (3)(A)(v); 
‘‘(3) delegate to the Chief Information Officer 
or equivalent (or a senior agency official who reports 
to the Chief Information Officer or equivalent), who 
is designated as the ‘Chief Information Security Of-
ficer’, the authority and primary responsibility to de-
velop, implement, and oversee an agencywide infor-
mation security program to ensure and enforce com-
pliance with the requirements imposed on the agency 
under this subchapter, including— 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
that through automated and continuous moni-
toring, when possible, can— 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(i) detect, report, respond to, con-
tain, and mitigate incidents that impair in-
formation security and agency information 
systems, in accordance with policy provided 
by the Director; 
‘‘(ii) commensurate with the risk to 
information security, monitor and mitigate 
the vulnerabilities of every information sys-
tem within the agency; 
‘‘(iii) continually evaluate risks posed 
to information collected or maintained by 
or on behalf of the agency and information 
systems and hold senior agency officials 
accountable for ensuring information secu-
rity; 
‘‘(iv) collaborate with the Director and 
appropriate public and private sector secu-
rity operations centers to detect, report, re-
spond to, contain, and mitigate incidents 
that impact the security of information 
and information systems that extend be-
yond the control of the agency; and 
‘‘(v) report any incident described 
under clauses (i) and (ii) to the Federal in-
formation security incident center, to other 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
appropriate security operations centers, 
and to the Inspector General of the agen-
cy, to the extent practicable, within 24 
hours after discovery of the incident, but 
no later than 48 hours after such dis-
covery; 
‘‘(B) developing, maintaining, and over-
seeing an agencywide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 11331 of title 40; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and 
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has a sufficient 
number of trained and cleared personnel to assist 
the agency in complying with the requirements of 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS