(d) REVIEW OF PLANS.—Not later than 18 months 
after the date of the enactment of this Act, the Comptroller 
General shall— 
(1) review the adequacy of the agency plans re-
quired by this section; and 
(2) submit to the Committee on Oversight and 
Government Reform of the House of Representatives 
and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report on the results 
of the review, together with any recommendations the 
Comptroller General considers appropriate. 
(e) DEFINITIONS.—In this section: 
(1) PEER-TO-PEER FILE SHARING PROGRAM.— 
The term ‘‘peer-to-peer file sharing program’’ means 
computer software that allows the computer on which 
such software is installed (A) to designate files avail-
able for transmission to another such computer, (B) 
to transmit files directly to another such computer, 
and (C) to request the transmission of files from an-
other such computer. The term does not include the 
use of such software for file sharing between, among, 
or within Federal, State, or local government agencies 
in order to perform official agency business. 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(2) AGENCY.—The term ‘‘agency’’ has the mean-
ing provided by section 3502 of title 44, United 
States Code. 
SEC. 8. ANNUAL INDEPENDENT AUDIT. 
(a) REQUIREMENT FOR AUDIT INSTEAD OF EVALUA-
TION.—Section 3545 of title 44, United States Code, is 
amended— 
(1) in the section heading, by striking ‘‘evalua-
tion’’ and inserting ‘‘audit’’ ; and 
(2) in paragraphs (1) and (2) of subsection (a), 
by striking ‘‘evaluation’’ and inserting ‘‘audit’’ both 
places it appears. 
(b) ADDITIONAL SPECIFIC REQUIREMENTS FOR AU-
DITS.—Section 3545(a) of such title is amended— 
(1) in paragraph (2)— 
(A) in subparagraph (A), by striking ‘‘sub-
set of the agency’s information systems;’’ and in-
serting the following: ‘‘subset of— 
‘‘(i) the information systems used or oper-
ated by the agency; and 
‘‘(ii) the information systems used, oper-
ated, or supported on behalf of the agency by a 
contractor of the agency, any subcontractor (at 
any tier) of such a contractor, or any other enti-
ty;’’; 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(B) in subparagraph (B), by striking ‘‘and’’ 
at the end; 
(C) in subparagraph (C), by striking the 
period and inserting ‘‘; and’’; and 
(D) by adding at the end the following new 
subparagraph: 
‘‘(D) a conclusion whether the agency’s informa-
tion security controls are effective, including an iden-
tification of any significant deficiencies in such con-
trols.’’; and 
(2) by adding at the end the following new para-
graph: 
‘‘(3) Each audit under this section shall conform to 
generally accepted government auditing standards.’’. 
(c) CONFORMING AMENDMENTS.— 
(1) Each of the following provisions of section 
3545 of title 44, United States Code, is amended by 
striking ‘‘evaluation’’ and inserting ‘‘audit’’ each 
place it appears: 
(A) Subsection (b)(1). 
(B) Subsection (b)(2). 
(C) Subsection (c). 
(D) Subsection (e)(1). 
(E) Subsection (e)(2). 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
(2) Section 3545(d) of such title is amended to 
read as follows: 
‘‘(d) EXISTING AUDITS.—The audit required by this 
section may be based in whole or in part on an audit relat-
ing to programs or practices of the applicable agency.’’. 
(3) Section 3545(f) of such title is amended by 
striking ‘‘evaluators’’ and inserting ‘‘auditors’’. 
(4) Section 3545(g)(1) of such title is amended 
by striking ‘‘evaluations’’ and inserting ‘‘audits’’. 
(5) Section 3545(g)(3) of such title is amended 
by striking ‘‘Evaluations’’ and inserting ‘‘Audits’’. 
(6) Section 3543(a)(8)(A) of such title is amend-
ed by striking ‘‘evaluations’’ and inserting ‘‘audits’’. 
(7) Section 3544(b)(5)(D) of such title (as redes-
ignated by section 5(2)(C)) is amended by striking ‘‘a 
evaluation’’ and inserting ‘‘an audit’’. 
SEC. 9. BEST PRACTICES FOR PRIVACY IMPACT ASSESS-
MENTS. 
Section 208(b)(3) of the E-Government Act of 2002 
(Public Law 107–347; 44 U.S.C. 3501 note) is amended— 
(1) in subparagraph (B), by striking ‘‘and’’ at 
the end; 
(2) in subparagraph (C), by striking the period 
and inserting ‘‘; and’’, and 
(3) by adding at the end the following: 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
‘‘(D) develop best practices for agencies to 
follow in conducting privacy impact assess-
ments.’’. 
SEC. 10. IMPLEMENTATION. 
Except as otherwise specifically provided in this Act, 
implementation of this Act and the amendments made by 
this Act shall begin not later than 90 days after the date 
of the enactment of this Act. 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS
Union Calendar No. 417 
110TH CONGRESS 
2D SESSION 
H. R. 4791 
[Report No. 110–664] 
A BILL 
To amend title 44, United States Code, to strength-
en requirements for ensuring the effectiveness of 
information security controls over information re-
sources that support Federal operations and as-
sets, and for other purposes. 
MAY 21, 2008 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Aug 31 2005 
00:05 May 22, 2008
Jkt 069200
PO 00000
Frm 00018
Fmt 6651
Sfmt 6651
E:\BILLS\H4791.RH
H4791
erowe on PRODPC61 with BILLS