‘‘(6) INFORMATION TECHNOLOGY.—The term ‘in-
formation technology’ has the meaning given that 
term in section 11101 of title 40. 
‘‘(7) NATIONAL SECURITY SYSTEM.— 
‘‘(A) DEFINITION.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activi-
ties; 
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and con-
trol of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph (B), 
is critical to the direct fulfillment of 
military or intelligence missions; or 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(ii) is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria 
established by an Executive order or an Act 
of Congress to be kept classified in the inter-
est of national defense or foreign policy. 
‘‘(B) EXCEPTION.—Subparagraph (A)(i)(V) 
does not include a system that is to be used for 
routine administrative and business applications 
(including payroll, finance, logistics, and per-
sonnel management applications). 
‘‘(8) THREAT
ASSESSMENT.—The term ‘threat 
assessment’ means the formal description and evalua-
tion of threat to an information system. 
‘‘§ 3553. Authority and functions of the Director 
‘‘(a) IN GENERAL.—The Director shall oversee agency 
information security policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
timely agency adoption of and compliance with 
standards promulgated under section 11331 of title 
40; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under such section 11331 and 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
the requirements of this subchapter, to identify and 
provide information security protections commensu-
rate with the risk and magnitude of the harm result-
ing from the unauthorized access, use, disclosure, dis-
ruption, modification, or destruction of— 
‘‘(A) information collected or maintained by 
or on behalf of an agency; or 
‘‘(B) information systems used or operated 
by an agency or by a contractor of an agency or 
other organization on behalf of an agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 
278g-3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and guide-
lines are complementary with standards and guide-
lines developed for national security systems; 
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through any 
authorized action under section 11303 of title 40, to 
enforce accountability for compliance with such re-
quirements; 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3554(b); 
‘‘(6) coordinating information security policies 
and procedures with related information resources 
management policies and procedures; 
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under sec-
tion 3555; and 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the require-
ments of this subchapter, including— 
‘‘(A) an assessment of the development, pro-
mulgation, and adoption of, and compliance 
with, standards developed under section 20 of the 
National Institute of Standards and Technology 
Act (15 U.S.C. 278g-3) and promulgated under 
section 11331 of title 40; 
‘‘(B) significant deficiencies in agency in-
formation security practices; 
‘‘(C) planned remedial action to address 
such deficiencies; and 
‘‘(D) a summary of, and the views of the 
Director on, the report prepared by the National 
Institute of Standards and Technology under 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
section 20(d)(10) of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g- 
3). 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the 
authorities described in paragraphs (4) and (8) of sub-
section (a), the authorities of the Director under this section 
shall not apply to national security systems. 
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL INTEL-
LIGENCE AGENCY SYSTEMS.—(1) The authorities of the Di-
rector described in paragraphs (1) and (2) of subsection (a) 
shall be delegated to the Secretary of Defense in the case 
of systems described in paragraph (2) and to the Director 
of Central Intelligence in the case of systems described in 
paragraph (3). 
‘‘(2) The systems described in this paragraph are sys-
tems that are operated by the Department of Defense, a con-
tractor of the Department of Defense, or another entity on 
behalf of the Department of Defense that processes any in-
formation the unauthorized access, use, disclosure, disrup-
tion, modification, or destruction of which would have a 
debilitating impact on the mission of the Department of De-
fense. 
‘‘(3) The systems described in this paragraph are sys-
tems that are operated by the Central Intelligence Agency, 
a contractor of the Central Intelligence Agency, or another 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
entity on behalf of the Central Intelligence Agency that 
processes any information the unauthorized access, use, dis-
closure, disruption, modification, or destruction of which 
would have a debilitating impact on the mission of the Cen-
tral Intelligence Agency. 
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and magnitude 
of the harm resulting from unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information systems used or oper-
ated by an agency or by a contractor of an 
agency or other organization on behalf of an 
agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) information security standards 
and guidelines promulgated under section 
11331 of title 40 and section 20 of the Na-
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS