I 
113TH CONGRESS 
1ST SESSION H. R. 1163 
To amend chapter 35 of title 44, United States Code, to revise requirements 
relating to Federal information security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 14, 2013 
Mr. ISSA (for himself, Mr. CUMMINGS, Mr. MICA, and Mr. CONNOLLY) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Government Reform 
A BILL 
To amend chapter 35 of title 44, United States Code, to 
revise requirements relating to Federal information secu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Amendments Act of 2013’’. 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities assets; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information systems; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams and systems through a focus on automated 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
and continuous monitoring of agency information 
systems and regular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information systems important to the na-
tional defense and economic security of the Nation 
that are designed, built, and operated by the private 
sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from 
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(2) AUTOMATED
AND
CONTINUOUS
MONI-
TORING.—The term ‘automated and continuous 
monitoring’ means monitoring, with minimal human 
involvement, through an uninterrupted, ongoing real 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed 
security controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
‘‘(3) INCIDENT.—The term ‘incident’ means an 
occurrence that actually or potentially jeopardizes 
the confidentiality, integrity, or availability of an in-
formation system, or the information the system 
processes, stores, or transmits or that constitutes a 
violation or imminent threat of violation of security 
policies, security procedures, or acceptable use poli-
cies. 
‘‘(4) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from unauthorized access, 
use, disclosure, disruption, modification, or destruc-
tion in order to provide— 
‘‘(A) integrity, which means guarding 
against improper information modification or 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; and 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation. 
‘‘(5) INFORMATION SYSTEM.—The term ‘infor-
mation system’ means a discrete set of information 
resources organized for the collection, processing, 
maintenance, use, sharing, dissemination, or disposi-
tion of information and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources. 
‘‘(6) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given that 
term in section 11101 of title 40. 
‘‘(7) NATIONAL SECURITY SYSTEM.— 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(A) DEFINITION.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activi-
ties; 
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and 
control of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph 
(B), is critical to the direct fulfillment 
of military or intelligence missions; or 
‘‘(ii) is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria 
established by an Executive order or an 
Act of Congress to be kept classified in the 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
interest of national defense or foreign pol-
icy. 
‘‘(B) 
EXCEPTION.—Subparagraph 
(A)(i)(V) does not include a system that is to 
be used for routine administrative and business 
applications (including payroll, finance, logis-
tics, and personnel management applications). 
‘‘(8) THREAT ASSESSMENT.—The term ‘threat 
assessment’ means the formal description and eval-
uation of threat to an information system. 
‘‘§ 3553. Authority and functions of the Director 
‘‘(a) IN GENERAL.—The Director shall oversee agen-
cy information security policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
timely agency adoption of and compliance with 
standards promulgated under section 11331 of title 
40; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under such section 11331 
and the requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
‘‘(B) information systems used or operated 
by an agency or by a contractor of an agency 
or other organization on behalf of an agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3554(b); 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(6) coordinating information security policies 
and procedures with related information resources 
management policies and procedures; 
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under 
section 3555; and 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the re-
quirements of this subchapter, including— 
‘‘(A) an assessment of the development, 
promulgation, and adoption of, and compliance 
with, standards developed under section 20 of 
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3) and promul-
gated under section 11331 of title 40; 
‘‘(B) significant deficiencies in agency in-
formation security practices; 
‘‘(C) planned remedial action to address 
such deficiencies; and 
‘‘(D) a summary of, and the views of the 
Director on, the report prepared by the Na-
tional Institute of Standards and Technology 
under section 20(d)(10) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3). 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the 
authorities described in paragraphs (4) and (8) of sub-
section (a), the authorities of the Director under this sec-
tion shall not apply to national security systems. 
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL IN-
TELLIGENCE AGENCY SYSTEMS.—(1) The authorities of 
the Director described in paragraphs (1) and (2) of sub-
section (a) shall be delegated to the Secretary of Defense 
in the case of systems described in paragraph (2) and to 
the Director of Central Intelligence in the case of systems 
described in paragraph (3). 
‘‘(2) The systems described in this paragraph are sys-
tems that are operated by the Department of Defense, a 
contractor of the Department of Defense, or another enti-
ty on behalf of the Department of Defense that processes 
any information the unauthorized access, use, disclosure, 
disruption, modification, or destruction of which would 
have a debilitating impact on the mission of the Depart-
ment of Defense. 
‘‘(3) The systems described in this paragraph are sys-
tems that are operated by the Central Intelligence Agency, 
a contractor of the Central Intelligence Agency, or another 
entity on behalf of the Central Intelligence Agency that 
processes any information the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS