653
mation security efforts throughout the civilian, na-
tional security, and law enforcement communities.
‘‘(3) To provide for development and mainte-
nance of minimum controls required to protect Fed-
eral information and information systems.
‘‘(4) To provide a mechanism for improved
oversight of Federal agency information security
programs.
‘‘§ 3532. Definitions
‘‘(a) Except as provided under subsection (b), the
definitions under section 3502 shall apply to this sub-
chapter.
‘‘(b) In this subchapter:
‘‘(1) The term ‘information technology’ has the
meaning given that term in section 5002 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1401).
‘‘(2) The term ‘mission critical system’ means
any telecommunications or information system used
or operated by an agency or by a contractor of an
agency, or other organization on behalf of an agen-
cy, that—
‘‘(A) is defined as a national security sys-
tem under section 5142 of the Clinger-Cohen
Act of 1996 (40 U.S.C. 1452);
654
‘‘(B) is protected at all times by proce-
dures established for information which has
been specifically authorized under criteria es-
tablished by an Executive order or an Act of
Congress to be classified in the interest of na-
tional defense or foreign policy; or
‘‘(C) processes any information, the loss,
misuse, disclosure, or unauthorized access to or
modification of, would have a debilitating im-
pact on the mission of an agency.
‘‘§ 3533. Authority and functions of the Director
‘‘(a)(1) The Director shall establish Government-wide
policies for the management of programs that—
‘‘(A) support the cost-effective security of Fed-
eral information systems by promoting security as
an integral component of each agency’s business op-
erations; and
‘‘(B) include information technology architec-
tures as defined under section 5125 of the Clinger-
Cohen Act of 1996 (40 U.S.C. 1425).
‘‘(2) Policies under this subsection shall—
‘‘(A) be founded on a continuing risk manage-
ment cycle that recognizes the need to—
‘‘(i) identify, assess, and understand risk;
and
655
‘‘(ii) determine security needs commensu-
rate with the level of risk;
‘‘(B) implement controls that adequately ad-
dress the risk;
‘‘(C) promote continuing awareness of informa-
tion security risk; and
‘‘(D) continually monitor and evaluate policy
and control effectiveness of information security
practices.
‘‘(b) The authority under subsection (a) includes the
authority to—
‘‘(1) oversee and develop policies, principles,
standards, and guidelines for the handling of Fed-
eral information and information resources to im-
prove the efficiency and effectiveness of govern-
mental operations, including principles, policies, and
guidelines for the implementation of agency respon-
sibilities under applicable law for ensuring the pri-
vacy, confidentiality, and security of Federal infor-
mation;
‘‘(2) consistent with the standards and guide-
lines promulgated under section 5131 of the Clinger-
Cohen Act of 1996 (40 U.S.C. 1441) and sections
5 and 6 of the Computer Security Act of 1987 (40
U.S.C. 1441 note; Public Law 100–235; 101 Stat.
656
1729), require Federal agencies to identify and af-
ford security protections commensurate with the risk
and magnitude of the harm resulting from the loss,
misuse, or unauthorized access to or modification of
information collected or maintained by or on behalf
of an agency;
‘‘(3) direct the heads of agencies to—
‘‘(A) identify, use, and share best security
practices;
‘‘(B) develop an agency-wide information
security plan;
‘‘(C) incorporate information security prin-
ciples and practices throughout the life cycles of
the agency’s information systems; and
‘‘(D) ensure that the agency’s information
security plan is practiced throughout all life cy-
cles of the agency’s information systems;
‘‘(4) oversee the development and implementa-
tion of standards and guidelines relating to security
controls for Federal computer systems by the Sec-
retary of Commerce through the National Institute
of Standards and Technology under section 5131 of
the Clinger-Cohen Act of 1996 (40 U.S.C. 1441)
and section 20 of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3);
657
‘‘(5) oversee and coordinate compliance with
this section in a manner consistent with—
‘‘(A) sections 552 and 552a of title 5;
‘‘(B) sections 20 and 21 of the National
Institute of Standards and Technology Act (15
U.S.C. 278g–3 and 278g–4);
‘‘(C) section 5131 of the Clinger-Cohen
Act of 1996 (40 U.S.C. 1441);
‘‘(D) sections 5 and 6 of the Computer Se-
curity Act of 1987 (40 U.S.C. 1441 note; Pub-
lic Law 100–235; 101 Stat. 1729); and
‘‘(E) 
related 
information 
management
laws; and
‘‘(6) take any authorized action under section
5113(b)(5) of the Clinger-Cohen Act of 1996 (40
U.S.C. 1413(b)(5)) that the Director considers ap-
propriate, including any action involving the budg-
etary process or appropriations management process,
to enforce accountability of the head of an agency
for information resources management, including the
requirements of this subchapter, and for the invest-
ments made by the agency in information tech-
nology, including—
‘‘(A) recommending a reduction or an in-
crease in any amount for information resources
658
that the head of the agency proposes for the
budget submitted to Congress under section
1105(a) of title 31;
‘‘(B) reducing or otherwise adjusting ap-
portionments and reapportionments of appro-
priations for information resources; and
‘‘(C) using other authorized administrative
controls over appropriations to restrict the
availability of funds for information resources.
‘‘(c) The authorities of the Director under this sec-
tion (other than the authority described in subsection
(b)(6))—
‘‘(1) shall be delegated to the Secretary of De-
fense, the Director of Central Intelligence, and an-
other agency head as designated by the President in
the case of systems described under subparagraphs
(A) and (B) of section 3532(b)(2);
‘‘(2) shall be delegated to the Secretary of De-
fense in the case of systems described under sub-
paragraph (C) of section 3532(b)(2) that are oper-
ated by the Department of Defense, a contractor of
the Department of Defense, or another entity on be-
half of the Department of Defense; and
‘‘(3) in the case of all other Federal informa-
tion systems, may be delegated only to the Deputy
659
Director for Management of the Office of Manage-
ment and Budget.
‘‘§ 3534. Federal agency responsibilities
‘‘(a) The head of each agency shall—
‘‘(1) be responsible for—
‘‘(A) adequately ensuring the integrity,
confidentiality, authenticity, availability, and
nonrepudiation of information and information
systems supporting agency operations and as-
sets;
‘‘(B) developing and implementing infor-
mation security policies, procedures, and control
techniques sufficient to afford security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized
disclosure, disruption, modification, or destruc-
tion of information collected or maintained by
or for the agency; and
‘‘(C) ensuring that the agency’s informa-
tion security plan is practiced throughout the
life cycle of each agency system;
‘‘(2) ensure that appropriate senior agency offi-
cials are responsible for—
‘‘(A) assessing the information security
risks associated with the operations and assets
660
for programs and systems over which such offi-
cials have control;
‘‘(B) determining the levels of information
security appropriate to protect such operations
and assets; and
‘‘(C) periodically testing and evaluating in-
formation security controls and techniques;
‘‘(3) delegate to the agency Chief Information
Officer established under section 3506, or a com-
parable official in an agency not covered by such
section, the authority to administer all functions
under this subchapter including—
‘‘(A) designating a senior agency informa-
tion security official who shall report to the
Chief Information Officer or a comparable offi-
cial;
‘‘(B) developing and maintaining an agen-
cywide information security program as re-
quired under subsection (b);
‘‘(C) ensuring that the agency effectively
implements and maintains information security
policies, procedures, and control techniques;
‘‘(D) training and overseeing personnel
with significant responsibilities for information
662
‘‘(2) Each program under this subsection shall
include—
‘‘(A) periodic risk assessments that consider in-
ternal and external threats to—
‘‘(i) the integrity, confidentiality, and
availability of systems; and
‘‘(ii) data supporting critical operations
and assets;
‘‘(B) policies and procedures that—
‘‘(i) are based on the risk assessments re-
quired under subparagraph (A) that cost-effec-
tively reduce information security risks to an
acceptable level; and
‘‘(ii) ensure compliance with—
‘‘(I) the requirements of this sub-
chapter;
‘‘(II) policies and procedures as may
be prescribed by the Director; and
‘‘(III) any other applicable require-
ments;
‘‘(C) security awareness training to inform per-
sonnel of—
‘‘(i) information security risks associated
with the activities of personnel; and
663
‘‘(ii) responsibilities of personnel in com-
plying with agency policies and procedures de-
signed to reduce such risks;
‘‘(D) periodic management testing and evalua-
tion of the effectiveness of information security poli-
cies and procedures;
‘‘(E) a process for ensuring remedial action to
address any significant deficiencies; and
‘‘(F) procedures for detecting, reporting, and
responding to security incidents, including—
‘‘(i) mitigating risks associated with such
incidents before substantial damage occurs;
‘‘(ii) notifying and consulting with law en-
forcement officials and other offices and au-
thorities;
‘‘(iii) notifying and consulting with an of-
fice designated by the Administrator of General
Services within the General Services Adminis-
tration; and
‘‘(iv) notifying and consulting with an of-
fice designated by the Secretary of Defense, the
Director of Central Intelligence, and another
agency head as designated by the President for
incidents involving systems described under
664
subparagraphs 
(A) 
and 
(B) 
of 
section
3532(b)(2).
‘‘(3) Each program under this subsection is subject
to the approval of the Director and is required to be re-
viewed at least annually by agency program officials in
consultation with the Chief Information Officer. In the
case of systems described under subparagraphs (A) and
(B) of section 3532(b)(2), the Director shall delegate ap-
proval authority under this paragraph to the Secretary of
Defense, the Director of Central Intelligence, and another
agency head as designated by the President.
‘‘(c)(1) Each agency shall examine the adequacy and
effectiveness of information security policies, procedures,
and practices in plans and reports relating to—
‘‘(A) annual agency budgets;
‘‘(B) information resources management under
subchapter I of this chapter;
‘‘(C) performance and results based manage-
ment under the Clinger-Cohen Act of 1996 (40
U.S.C. 1401 et seq.);
‘‘(D) program performance under sections 1105
and 1115 through 1119 of title 31, and sections
2801 through 2805 of title 39; and
‘‘(E) financial management under—
665
‘‘(i) chapter 9 of title 31, United States
Code, and the Chief Financial Officers Act of
1990 (31 U.S.C. 501 note; Public Law 101–
576) (and the amendments made by that Act);
‘‘(ii) the Federal Financial Management
Improvement Act of 1996 (31 U.S.C. 3512
note) (and the amendments made by that Act);
and
‘‘(iii) the internal controls conducted under
section 3512 of title 31.
‘‘(2) Any significant deficiency in a policy, procedure,
or practice identified under paragraph (1) shall be re-
ported as a material weakness in reporting required under
the applicable provision of law under paragraph (1).
‘‘(d)(1) In addition to the requirements of subsection
(c), each agency, in consultation with the Chief Informa-
tion Officer, shall include as part of the performance plan
required under section 1115 of title 31 a description of—
‘‘(A) the time periods, and
‘‘(B) the resources, including budget, staffing,
and training,
which are necessary to implement the program required
under subsection (b)(1).
666
‘‘(2) The description under paragraph (1) shall be
based on the risk assessment required under subsection
(b)(2)(A).
‘‘§ 3535. Annual independent evaluation
‘‘(a)(1) Each year each agency shall have performed
an independent evaluation of the information security pro-
gram and practices of that agency.
‘‘(2) Each evaluation by an agency under this section
shall include—
‘‘(A) testing of the effectiveness of information
security control techniques for an appropriate subset
of the agency’s information systems; and
‘‘(B) an assessment (made on the basis of the
results of the testing) of the compliance with—
‘‘(i) the requirements of this subchapter;
and
‘‘(ii) related information security policies,
procedures, standards, and guidelines.
‘‘(3) The Inspector General or the independent eval-
uator performing an evaluation under this section may use
an audit, evaluation, or report relating to programs or
practices of the applicable agency.
‘‘(b)(1)(A) Subject to subparagraph (B), for agencies
with Inspectors General appointed under the Inspector
General Act of 1978 (5 U.S.C. App.) or any other law,
667
the annual evaluation required under this section or, in
the case of systems described under subparagraphs (A)
and (B) of section 3532(b)(2), an audit of the annual eval-
uation required under this section, shall be performed by
the Inspector General or by an independent evaluator, as
determined by the Inspector General of the agency.
‘‘(B) For systems described under subparagraphs (A)
and (B) of section 3532(b)(2), the evaluation required
under this section shall be performed only by an entity
designated by the Secretary of Defense, the Director of
Central Intelligence, or another agency head as designated
by the President.
‘‘(2) For any agency to which paragraph (1) does not
apply, the head of the agency shall contract with an inde-
pendent evaluator to perform the evaluation.
‘‘(c) Each year, not later than the anniversary of the
date of the enactment of this subchapter, the applicable
agency head shall submit to the Director—
‘‘(1) the results of each evaluation required
under this section, other than an evaluation of a sys-
tem described under subparagraph (A) or (B) of sec-
tion 3532(b)(2); and
‘‘(2) the results of each audit of an evaluation
required under this section of a system described