this subchapter, other applicable laws, and related 
policies, procedures, standards, and guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in consultation with other senior agency offi-
cials, reports periodically, but not less than annually, 
to the agency head on— 
‘‘(A) the effectiveness of the agency infor-
mation security program; 
‘‘(B) information derived from automated 
and continuous monitoring, when possible, and 
threat assessments; and 
‘‘(C) the progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer possesses the necessary qualifications, includ-
ing education, training, experience, and the security 
clearance required to administer the functions de-
scribed under this subchapter; and has information 
security duties as the primary duty of that official; 
and 
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Of-
ficer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
senior agency officers accountable for the implemen-
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
tation of appropriate security policies, procedures, 
and controls of agency components. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director and consistent 
with components across and within agencies, to provide 
information security for the information and information 
systems that support the operations and assets of the 
agency, including those provided or managed by another 
agency, contractor, or other source, that includes— 
‘‘(1) automated and continuous monitoring, 
when possible, of the risk and magnitude of the 
harm that could result from the disruption or unau-
thorized access, use, disclosure, modification, or de-
struction of information and information systems 
that support the operations and assets of the agen-
cy; 
‘‘(2) consistent with guidance developed under 
section 11331 of title 40, vulnerability assessments 
and penetration tests commensurate with the risk 
posed to agency information systems; 
‘‘(3) policies and procedures that— 
‘‘(A) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(B) ensure compliance with— 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may 
be prescribed by the Director, and infor-
mation security standards promulgated 
pursuant to section 11331 of title 40; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the Director; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; and 
‘‘(II) the National Institute of 
Standards and Technology standards 
and guidance; 
‘‘(C) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable require-
ments, including those promulgated pursuant 
section 11331 of title 40; and 
‘‘(D) ensure the oversight and training of 
personnel with significant responsibilities for in-
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
formation security with respect to such respon-
sibilities; 
‘‘(4) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for testing and evaluation 
of the effectiveness and compliance of information 
security policies, procedures, and practices, includ-
ing— 
‘‘(A) controls of every information system 
identified in the inventory required under sec-
tion 3505(c); and 
‘‘(B) controls relied on for an evaluation 
under this section; 
‘‘(5) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(6) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for detecting, reporting, 
and responding to security incidents, consistent with 
standards and guidelines issued by the National In-
stitute of Standards and Technology, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(B) notifying and consulting with the 
Federal information security incident center 
and other appropriate security operations re-
sponse centers; and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; and 
‘‘(ii) any other agency, office, or enti-
ty, in accordance with law or as directed 
by the President; and 
‘‘(7) plans and procedures to ensure continuity 
of operations for information systems that support 
the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, 
procedures, and practices, and compliance with the 
requirements of this subchapter, including compli-
ance with each requirement of subsection (b) to— 
‘‘(A) the Director; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of 
information security policies, procedures, and prac-
tices in plans and reports relating to— 
‘‘(A) annual agency budgets; 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and 
sections 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576); 
‘‘(F) financial management systems under 
the Federal Financial Management Improve-
ment Act of 1996 (31 U.S.C. 3512 note); and 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘(4) consult with the National Institute of 
Standards and Technology, agencies or offices oper-
ating or exercising control of national security sys-
tems (including the National Security Agency), and 
such other agencies or offices in accordance with law 
and as directed by the President regarding informa-
tion security incidents and related matters. 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency 
operating or exercising control of a national security sys-
tem shall share information about information security in-
cidents, threats, and vulnerabilities with the Federal infor-
mation security incident center to the extent consistent 
with standards and guidelines for national security sys-
tems, issued in accordance with law and as directed by 
the President. 
‘‘(c) REVIEW AND APPROVAL.—The Director shall 
review and approve the policies, procedures, and guidance 
established in this subchapter to ensure that the incident 
center has the capability to effectively and efficiently de-
tect, correlate, respond to, contain, mitigate, and reme-
diate incidents that impair the adequate security of the 
information systems of more than one agency. To the ex-
tent practicable, the capability shall be continuous and 
technically automated. 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
‘‘§ 3556. National security systems 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and 
‘‘(3) complies with the requirements of this sub-
chapter.’’. 
SEC. 3. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) TABLE OF SECTIONS IN TITLE 44.—The table 
of sections for chapter 35 of title 44, United States Code, 
is amended by striking the matter relating to subchapters 
II and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘Sec. 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. Authority and functions of the Director. 
‘‘3554. Agency responsibilities. 
‘‘3555. Federal information security incident center. 
‘‘3556. National security systems.’’. 
(b) OTHER REFERENCES.— 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
(1) Section 1001(c)(1)(A) of the Homeland Se-
curity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is 
amended by striking ‘‘section 3532(3)’’ and insert-
ing ‘‘section 3552(b)’’. 
(2) Section 2222(j)(5) of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(3) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552(b)’’. 
(4) Section 2315 of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(5) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–3) 
is amended— 
(A) in subsections (a)(2) and (e)(5), by 
striking ‘‘section 3532(b)(2)’’ and inserting 
‘‘section 3552(b)’’; and 
(B) in subsection (e)— 
(i) in paragraph (2), by striking ‘‘sec-
tion 3532(1)’’ and inserting ‘‘section 
3552(b)’’; and 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS
(ii) in paragraph (5), by striking ‘‘sec-
tion 3532(b)(2)’’ and inserting ‘‘section 
3552(b)’’. 
(6) Section 8(d)(1) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7406(d)(1)) 
is amended by striking ‘‘section 3534(b)’’ and in-
serting ‘‘section 3554(b)’’. 
SEC. 4. NO ADDITIONAL FUNDS AUTHORIZED. 
No additional funds are authorized to carry out the 
requirements of section 3554 of title 44, United States 
Code, as amended by section 2 of this Act. Such require-
ments shall be carried out using amounts otherwise au-
thorized or appropriated. 
SEC. 5. EFFECTIVE DATE. 
This Act (including the amendments made by this 
Act) shall take effect 30 days after the date of the enact-
ment of this Act. 
Æ 
VerDate Mar 15 2010 
20:13 Mar 22, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6301
E:\BILLS\H1163.IH
H1163
srobinson on DSK4SPTVN1PROD with BILLS