‘‘(V) subject to subparagraph (B), is 
critical to the direct fulfillment of military 
or intelligence missions; or 
‘‘(ii) is protected at all times by procedures 
established for information that have been spe-
cifically authorized under criteria established by 
an Executive order or an Act of Congress to be 
kept classified in the interest of national de-
fense or foreign policy. 
‘‘(B) Subparagraph (A)(i)(V) does not include a 
system that is to be used for routine administrative 
and business applications (including payroll, finance, 
logistics, and personnel management applications). 
‘‘(8) The term ‘information system’ means any 
equipment or interconnected system or subsystem of 
equipment that is used in the automatic acquisition, 
storage, manipulation, management, movement, con-
trol, display, switching, interchange, transmission, or 
reception of data or information, and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(E) related resources. 
‘‘(9) The term ‘threat assessment’ means the 
real-time or near real-time process of formally evalu-
ating the degree of threat to an information system 
or information technology enterprise and describing 
the nature of the threat. 
‘‘§ 3553. Authority and functions of the Director 
‘‘(a) IN GENERAL.—The Director shall oversee agen-
cy information security policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
timely agency adoption of and compliance with 
standards promulgated under section 11331 of title 
40; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under such section 11331 
and the requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) information systems used or operated 
by an agency or by a contractor of an agency 
or other organization on behalf of an agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3554(b); 
‘‘(6) coordinating information security policies 
and procedures with related information resources 
management policies and procedures; 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under 
section 3555; and 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the re-
quirements of this subchapter, including— 
‘‘(A) an assessment of the development, 
promulgation, and adoption of, and compliance 
with, standards developed under section 20 of 
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3) and promul-
gated under section 11331 of title 40; 
‘‘(B) significant deficiencies in agency in-
formation security practices; 
‘‘(C) planned remedial action to address 
such deficiencies; and 
‘‘(D) a summary of, and the views of the 
Director on, the report prepared by the Na-
tional Institute of Standards and Technology 
under section 20(d)(10) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3). 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the 
authorities described in paragraphs (4) and (8) of sub-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
section (a), the authorities of the Director under this sec-
tion shall not apply to national security systems. 
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL IN-
TELLIGENCE AGENCY SYSTEMS.—(1) The authorities of 
the Director described in paragraphs (1) and (2) of sub-
section (a) shall be delegated to the Secretary of Defense 
in the case of systems described in paragraph (2) and to 
the Director of Central Intelligence in the case of systems 
described in paragraph (3). 
‘‘(2) The systems described in this paragraph 
are systems that are operated by the Department of 
Defense, a contractor of the Department of Defense, 
or another entity on behalf of the Department of 
Defense that processes any information the unau-
thorized access, use, disclosure, disruption, modifica-
tion, or destruction of which would have a debili-
tating impact on the mission of the Department of 
Defense. 
‘‘(3) The systems described in this paragraph 
are systems that are operated by the Central Intel-
ligence Agency, a contractor of the Central Intel-
ligence Agency, or another entity on behalf of the 
Central Intelligence Agency that processes any infor-
mation the unauthorized access, use, disclosure, dis-
ruption, modification, or destruction of which would 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
have a debilitating impact on the mission of the Cen-
tral Intelligence Agency. 
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information infrastructure used 
or operated by an agency or by a con-
tractor of an agency or other organization 
on behalf of an agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) 
information 
security 
policies, 
principles, standards, and guidelines pro-
mulgated under section 11331 of title 40 
and section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3); 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
‘‘(iii) ensuring the standards imple-
mented for information systems and na-
tional security systems of the agency are 
complementary and uniform, to the extent 
practicable; 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning and 
budget processes, including policies, procedures, 
and practices described in subsection (c)(2); 
‘‘(D) as appropriate, maintaining secure 
facilities that have the capability of accessing, 
sending, receiving, and storing classified infor-
mation; 
‘‘(E) maintaining a sufficient number of 
personnel with security clearances, at the ap-
propriate levels, to access, send, receive and 
analyze classified information to carry out the 
responsibilities of this subchapter; and 
‘‘(F) ensuring that information security 
performance indicators and measures are in-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation infrastructure that support the operations 
and assets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information infrastructure; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 11331 of title 40 
and section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3) for information security classifications 
and related requirements; 
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(D) with a frequency commensurate with 
the risk to information security, continuously 
testing and evaluating information security con-
trols and techniques to ensure that such con-
trols and techniques are effectively implemented 
and operated; and 
‘‘(E) with a frequency commensurate with 
the risk to information security, continuously 
conducting threat assessments by monitoring 
information infrastructure, identifying potential 
system vulnerabilities, and reporting security 
incidents 
in 
accordance 
with 
paragraph 
(3)(A)(v); 
‘‘(3) delegate to the Chief Information Officer 
or equivalent (or a senior agency official who reports 
to the Chief Information Officer or equivalent), who 
is designated as the ‘Chief Information Security Of-
ficer’, the authority and primary responsibility to de-
velop, implement, and oversee an agencywide infor-
mation security program to ensure and enforce com-
pliance with the requirements imposed on the agency 
under this subchapter, including— 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
that through automated and continuous moni-
toring can— 
‘‘(i) detect, report, respond to, con-
tain, and mitigate incidents that impair in-
formation security, information systems, 
and agency information infrastructure, in 
accordance with policy provided by the Di-
rector; 
‘‘(ii) commensurate with the risk to 
information security, monitor and mitigate 
the vulnerabilities of every information sys-
tem within the agency information infra-
structure; 
‘‘(iii) continually evaluate risks posed 
to information collected or maintained by 
or on behalf of the agency and information 
systems and hold senior agency officials 
accountable for ensuring information secu-
rity; 
‘‘(iv) collaborate with the Director and 
appropriate public and private sector secu-
rity operations centers to detect, report, re-
spond to, contain, and mitigate incidents 
that impact the security of information 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
and information systems that extend be-
yond the control of the agency; and 
‘‘(v) report any incident described 
under clauses (i) and (ii) to the appro-
priate security operations center and the 
Inspector General of the agency, to the ex-
tent practicable, within 24 hours after dis-
covery of the incident, but no later than 48 
hours after such discovery; 
‘‘(B) developing, maintaining, and over-
seeing an agencywide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 11331 of title 40; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and 
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(4) ensure that the agency has a sufficient 
number of trained and cleared personnel to assist 
the agency in complying with the requirements of 
this subchapter, other applicable laws, and related 
policies, procedures, standards, and guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in consultation with other senior agency offi-
cials, reports periodically, but not less than annually, 
to the agency head on— 
‘‘(A) the effectiveness of the agency infor-
mation security program; 
‘‘(B) information derived from automated 
and continuous monitoring and threat assess-
ments; and 
‘‘(C) the progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer possesses the necessary qualifications, includ-
ing education, professional certifications, training, 
experience, and the security clearance required to 
administer the functions described under this sub-
chapter; and has information security duties as the 
primary duty of that official; 
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Of-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
ficer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
senior agency officers accountable for the implemen-
tation of appropriate security policies, procedures, 
and controls of agency components; and 
‘‘(8) delegate to agency officials who are re-
sponsible for particular agency systems or sub-
systems the responsibility to ensure and enforce 
compliance with all requirements of the agency’s in-
formation security program in consultation with the 
Chief Information Security Officer designated under 
paragraph (3). 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director and consistent 
with components across and within agencies, to provide 
information security for the information and information 
infrastructure that support the operations and assets of 
the agency, including those provided or managed by an-
other agency, contractor, or other source, that includes— 
‘‘(1) automated and continuous monitoring— 
‘‘(A) of the risk and magnitude of the 
harm that could result from the disruption or 
unauthorized access, use, disclosure, modifica-
tion, or destruction of information and informa-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
tion systems that support the operations and 
assets of the agency; and 
‘‘(B) that assesses whether information or 
information systems should be removed or mi-
grated to more secure networks or standards 
and make recommendations to the head of the 
agency and the Director based on that assess-
ment; 
‘‘(2) consistent with guidance developed under 
section 11331 of title 40, vulnerability assessments 
and penetration tests commensurate with the risk 
posed to an agency information infrastructure; 
‘‘(3) policies and procedures that— 
‘‘(A) mitigate and, to the extent prac-
ticable, 
remediate 
information 
security 
vulnerabilities based on the risk posed to the 
agency; 
‘‘(B) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(C) ensure compliance with— 
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may 
be prescribed by the Director, and infor-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
mation security standards promulgated 
pursuant to section 11331 of title 40; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the Director; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; 
‘‘(II) the National Institute of 
Standards and Technology guidance; 
and 
‘‘(III) the Chief Information Offi-
cers 
Council 
recommended 
ap-
proaches; 
‘‘(D) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable require-
ments, including those promulgated pursuant 
section 11331 of title 40; and 
‘‘(E) ensure the oversight and training of 
personnel with significant responsibilities for in-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
formation security with respect to such respon-
sibilities; 
‘‘(4) consistent with the risk to information se-
curity, automated and continuous monitoring for 
testing, and evaluation of the effectiveness and com-
pliance of information security policies, procedures, 
and practices, including— 
‘‘(A) management, operational, and tech-
nical controls of every information system iden-
tified in the inventory required under section 
3505(c); and 
‘‘(B) management, operational, and tech-
nical controls relied on for an evaluation under 
this section; 
‘‘(5) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(6) consistent with the risk to information se-
curity, automated and continuous monitoring for de-
tecting, reporting, and responding to security inci-
dents, consistent with standards and guidelines 
issued by the Director, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) notifying and consulting with the ap-
propriate security operations response center; 
and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; and 
‘‘(ii) any other agency, office, or enti-
ty, in accordance with law or as directed 
by the President; and 
‘‘(7) plans and procedures to ensure continuity 
of operations for information infrastructure that 
support the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, 
procedures, and practices, and compliance with the 
requirements of this subchapter, including compli-
ance with each requirement of subsection (b) to— 
‘‘(A) the Director; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of 
information security policies, procedures, and prac-
tices in plans and reports relating to— 
‘‘(A) annual agency budgets; 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and 
sections 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576); 
‘‘(F) financial management systems under 
the Federal Financial Management Improve-
ment Act of 1996 (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31; and 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)— 
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
agement Improvement Act of 1996 (31 U.S.C. 
3512 note). 
‘‘§ 3555. Federal information security incident center 
‘‘(a) IN GENERAL.—The Director shall ensure the 
operation of a central Federal information security inci-
dent center to— 
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems and information 
infrastructure regarding security incidents, including 
guidance on detecting and handling information se-
curity incidents; 
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information 
systems and information infrastructure about cur-
rent and potential information security threats, and 
vulnerabilities; and 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS