IIB 
110TH CONGRESS 
2D SESSION 
H. R. 5983 
IN THE SENATE OF THE UNITED STATES 
JULY 31, 2008 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to enhance 
the information security of the Department of Homeland 
Security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Homeland Security 
Network Defense and Accountability Act of 2008’’. 
SEC. 2. AUTHORITY OF CHIEF INFORMATION OFFICER; 
QUALIFICATIONS FOR APPOINTMENT. 
Section 703(a) of the Homeland Security Act of 2002 
(6 U.S.C. 343(a)) is amended— 
(1) by inserting before the first sentence the 
following: 
‘‘(1) AUTHORITIES
AND
DUTIES.—The Sec-
retary shall delegate to the Chief Information Offi-
cer such authority necessary for the development, 
approval, implementation, integration, and oversight 
of policies, procedures, processes, activities, funding, 
and systems of the Department relating to the man-
agement of information and information infrastruc-
ture for the Department, including the management 
of all related mission applications, information re-
sources, and personnel. 
‘‘(2) LINE AUTHORITY.—’’; and 
(2) by adding at the end the following new 
paragraphs: 
‘‘(3) QUALIFICATIONS FOR APPOINTMENT.—An 
individual may not be appointed as Chief Informa-
tion Officer unless the individual has— 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
‘‘(A) demonstrated ability in and knowl-
edge of information technology and information 
security; and 
‘‘(B) not less than 5 years of executive 
leadership and management experience in infor-
mation technology and information security in 
the public or private sector. 
‘‘(4) FUNCTIONS.—The Chief Information Offi-
cer shall— 
‘‘(A) establish and maintain an incident re-
sponse team that provides a continuous, real- 
time capability within the Department of 
Homeland Security to— 
‘‘(i) detect, respond to, contain, inves-
tigate, attribute, and mitigate any com-
puter incident, as defined by the National 
Institute of Standards and Technology, 
that could violate or pose an imminent 
threat of violation of computer security 
policies, acceptable use policies, or stand-
ard security practices of the Department; 
and 
‘‘(ii) deliver timely notice of any inci-
dent to individuals responsible for informa-
tion infrastructure of the Department, and 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
to the United States Computer Emergency 
Readiness Team; 
‘‘(B) establish, maintain, and update a 
network architecture, including a diagram de-
tailing how security controls are positioned 
throughout the information infrastructure of 
the Department to maintain the confidentiality, 
integrity, availability, accountability, and assur-
ance of electronic information; and 
‘‘(C) ensure that vulnerability assessments 
are conducted on a regular basis for any De-
partment information infrastructure connected 
to the Internet or another external network, 
and that vulnerabilities are mitigated in a time-
ly fashion.’’. 
SEC. 3. ATTACK-BASED TESTING PROTOCOLS. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(c) ATTACK-BASED
TESTING
PROTOCOLS.—The 
Chief Information Officer, in consultation with the Inspec-
tor General, the Assistant Secretary for Cybersecurity, 
and the heads of other appropriate Federal agencies, 
shall— 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
‘‘(1) establish security control testing protocols 
that ensure that the Department’s information in-
frastructure is effectively protected against known 
attacks against and exploitations of Federal and 
contractor information infrastructure; 
‘‘(2) oversee the deployment of such protocols 
throughout the information infrastructure of the De-
partment; and 
‘‘(3) update such protocols on a regular basis.’’. 
SEC. 4. INSPECTOR GENERAL REVIEWS OF INFORMATION 
INFRASTRUCTURE. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following new subsection: 
‘‘(d) INSPECTOR GENERAL REVIEWS.— 
‘‘(1) IN GENERAL.—The Inspector General of 
the Department shall use authority under the In-
spector General Act of 1978 (5 App. U.S.C.) to con-
duct announced and unannounced performance re-
views and programmatic reviews of the information 
infrastructure of the Department to determine the 
effectiveness of security policies and controls of the 
Department. 
‘‘(2) PERFORMANCE
REVIEWS.—Performance 
reviews under this subsection shall test and validate 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
a system’s security controls using the protocols cre-
ated under subsection (c), beginning not later than 
270 days after the date of enactment of the Home-
land Security Network Defense and Accountability 
Act of 2008. 
‘‘(3) PROGRAMMATIC REVIEWS.—Programmatic 
reviews under this subsection shall— 
‘‘(A) determine whether an agency of the 
Department is complying with policies, proc-
esses, and procedures established by the Chief 
Information Officer; and 
‘‘(B) focus on risk assessment, risk man-
agement, and risk mitigation, with primary re-
gard to the implementation of best practices 
such as authentication, access control (including 
remote access), intrusion detection and preven-
tion, data protection and integrity, and any 
other controls that the Inspector General con-
siders necessary. 
‘‘(4) INFORMATION
SECURITY
REPORT.—The 
Inspector General shall submit a security report con-
taining the results of each review under this sub-
section and prioritized recommendations for improv-
ing security controls based on that review, including 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
recommendations regarding funding changes and 
personnel management, to— 
‘‘(A) the Secretary; 
‘‘(B) the Chief Information Officer; and 
‘‘(C) the head of the Department compo-
nent that was the subject of the review, and 
other appropriate individuals responsible for the 
information infrastructure of such agency. 
‘‘(5) CORRECTIVE ACTION REPORT.— 
‘‘(A) IN GENERAL.—Within 60 days after 
receiving a security report under paragraph (4), 
the head of the Department component that 
was the subject of the review and the Chief In-
formation Officer shall jointly submit a correc-
tive action report to the Secretary and the In-
spector General. 
‘‘(B) CONTENTS.—The corrective action 
report— 
‘‘(i) shall contain a plan for address-
ing 
recommendations 
and 
mitigating 
vulnerabilities contained in the security re-
port, including a timeline and budget for 
implementing such plan; and 
‘‘(ii) shall note any matters in dis-
agreement between the head of the Depart-
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
ment component and the Chief Information 
Officer. 
‘‘(6) REPORTS TO CONGRESS.— 
‘‘(A) ANNUAL
REPORTS.—In conjunction 
with the reporting requirements of section 3545 
of title 44, United States Code, the Inspector 
General shall submit an annual report to the 
Committee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Affairs 
of the Senate— 
‘‘(i) summarizing the performance and 
programmatic reviews performed during 
the preceding fiscal year, the results of 
those reviews, and any actions that remain 
to be taken under plans included in correc-
tive action reports under paragraph (5); 
and 
‘‘(ii) describing the effectiveness of 
the testing protocols developed under sub-
section (c) in reducing successful exploi-
tations of the Department’s information 
infrastructure. 
‘‘(B) SECURITY
REPORTS
AND
CORREC-
TIVE ACTION REPORTS.—The Inspector General 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
shall make all security reports and corrective 
action reports available to any member of the 
Committee on Homeland Security of the House 
of Representatives, any member of the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate, and the Comp-
troller General of the United States, upon re-
quest.’’. 
SEC. 5. INFORMATION INFRASTRUCTURE DEFINED. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following: 
‘‘(e) INFORMATION INFRASTRUCTURE DEFINED.—In 
this section, the term ‘information infrastructure’ means 
systems and assets used in processing, transmitting, re-
ceiving, or storing information electronically.’’. 
SEC. 6. NETWORK SERVICE PROVIDERS. 
(a) IN GENERAL.—Subtitle D of title VIII of the 
Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 836. REQUIREMENTS FOR NETWORK SERVICE PRO-
VIDERS. 
‘‘(a) COMPATIBILITY DETERMINATION.—Before en-
tering into or renewing a covered contract, the Secretary, 
acting through the Chief Information Officer, must deter-
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
mine that the contractor has an internal information sys-
tems security policy that complies with the Department’s 
information security requirements for risk assessment, 
risk management, and risk mitigation, with primary re-
gard to the implementation of best practices such as au-
thentication, access control (including remote access), in-
trusion detection and prevention, data protection and in-
tegrity, and any other policies that the Secretary considers 
necessary to ensure the security of the Department’s in-
formation infrastructure. 
‘‘(b) CONTRACT REQUIREMENTS REGARDING SECU-
RITY.—The Secretary shall include in each covered con-
tract provisions requiring the contractor to— 
‘‘(1) implement and regularly update the inter-
nal information systems security policy required 
under subsection (a); 
‘‘(2) maintain the capability to provide con-
tracted services on a continuing and ongoing basis 
to the Department in the event of unplanned or dis-
ruptive event; and 
‘‘(3) deliver timely notice of any internal com-
puter incident, as defined by the National Institute 
of Standards and Technology, that could violate or 
pose an imminent threat of violation of computer se-
curity policies, acceptable use policies, or standard 
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS
HR 5983 RFS 
security practices at the Department, to the United 
States Computer Emergency Readiness Team and 
the incident response team established under section 
703(a)(4). 
‘‘(c) CONTRACT REQUIREMENTS REGARDING SUB-
CONTRACTING.—The Secretary shall include in each cov-
ered contract— 
‘‘(1) a requirement that the contractor develop 
and implement a plan for the award of subcontracts, 
as appropriate, to small business concerns and dis-
advantaged business concerns in accordance with 
other applicable requirements, including the terms of 
such plan, as appropriate; and 
‘‘(2) a requirement that the contractor submit 
to the Secretary, during performance of the con-
tract, periodic reports describing the extent to which 
the contractor has complied with such plan, includ-
ing specification (by total dollar amount and by per-
centage of the total dollar value of the contract) of 
the value of subcontracts awarded at all tiers of sub-
contracting to small business concerns, including so-
cially and economically disadvantaged small busi-
nesses concerns, small business concerns owned and 
controlled by service-disabled veterans, HUBZone 
small business concerns, small business concerns eli-
VerDate Aug 31 2005 
23:57 Aug 01, 2008
Jkt 069002
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.RFS
H5983
erowe on PRODPC61 with BILLS