IB 
Union Calendar No. 26 
113TH CONGRESS 
1ST SESSION H. R. 1163 
[Report No. 113–40] 
To amend chapter 35 of title 44, United States Code, to revise requirements 
relating to Federal information security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 14, 2013 
Mr. ISSA (for himself, Mr. CUMMINGS, Mr. MICA, and Mr. CONNOLLY) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Government Reform 
APRIL 16, 2013 
Additional sponsors: Mr. CHAFFETZ and Mr. TIERNEY 
APRIL 16, 2013 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Omit the part struck through and insert the part printed in italic] 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
A BILL 
To amend chapter 35 of title 44, United States Code, to 
revise requirements relating to Federal information secu-
rity, and for other purposes. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Amendments Act of 2013’’. 
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities assets; 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information systems; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams and systems through a focus on automated 
and continuous monitoring of agency information 
systems and regular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information systems important to the na-
tional defense and economic security of the Nation 
that are designed, built, and operated by the private 
sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from 
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
‘‘(2) AUTOMATED
AND
CONTINUOUS
MONI-
TORING.—The term ‘automated and continuous 
monitoring’ means monitoring, with minimal human 
involvement, through an uninterrupted, ongoing real 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed 
security controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
‘‘(3) INCIDENT.—The term ‘incident’ means an 
occurrence that actually or potentially jeopardizes 
the confidentiality, integrity, or availability of an in-
formation system, or the information the system 
processes, stores, or transmits or that constitutes a 
violation or imminent threat of violation of security 
policies, security procedures, or acceptable use poli-
cies. 
‘‘(4) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from unauthorized access, 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
use, disclosure, disruption, modification, or destruc-
tion in order to provide— 
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; and 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation. 
‘‘(5) INFORMATION SYSTEM.—The term ‘infor-
mation system’ means a discrete set of information 
resources organized for the collection, processing, 
maintenance, use, sharing, dissemination, or disposi-
tion of information and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(6) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given that 
term in section 11101 of title 40. 
‘‘(7) NATIONAL SECURITY SYSTEM.— 
‘‘(A) DEFINITION.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activi-
ties; 
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and 
control of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph 
(B), is critical to the direct fulfillment 
of military or intelligence missions; or 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(ii) is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria 
established by an Executive order or an 
Act of Congress to be kept classified in the 
interest of national defense or foreign pol-
icy. 
‘‘(B) 
EXCEPTION.—Subparagraph 
(A)(i)(V) does not include a system that is to 
be used for routine administrative and business 
applications (including payroll, finance, logis-
tics, and personnel management applications). 
‘‘(8) THREAT ASSESSMENT.—The term ‘threat 
assessment’ means the formal description and eval-
uation of threat to an information system. 
‘‘§ 3553. Authority and functions of the Director 
‘‘(a) IN GENERAL.—The Director shall oversee agen-
cy information security policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
timely agency adoption of and compliance with 
standards promulgated under section 11331 of title 
40; 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(2) requiring agencies, consistent with the 
standards promulgated under such section 11331 
and the requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
‘‘(B) information systems used or operated 
by an agency or by a contractor of an agency 
or other organization on behalf of an agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3554(b); 
‘‘(6) coordinating information security policies 
and procedures with related information resources 
management policies and procedures; 
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under 
section 3555; and 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the re-
quirements of this subchapter, including— 
‘‘(A) an assessment of the development, 
promulgation, and adoption of, and compliance 
with, standards developed under section 20 of 
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3) and promul-
gated under section 11331 of title 40; 
‘‘(B) significant deficiencies in agency in-
formation security practices; 
‘‘(C) planned remedial action to address 
such deficiencies; and 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(D) a summary of, and the views of the 
Director on, the report prepared by the Na-
tional Institute of Standards and Technology 
under section 20(d)(10) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3). 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the 
authorities described in paragraphs (4) and (8) of sub-
section (a), the authorities of the Director under this sec-
tion shall not apply to national security systems. 
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL IN-
TELLIGENCE AGENCY SYSTEMS.—(1) The authorities of 
the Director described in paragraphs (1) and (2) of sub-
section (a) shall be delegated to the Secretary of Defense 
in the case of systems described in paragraph (2) and to 
the Director of Central Intelligence in the case of systems 
described in paragraph (3). 
‘‘(2) The systems described in this paragraph are sys-
tems that are operated by the Department of Defense, a 
contractor of the Department of Defense, or another enti-
ty on behalf of the Department of Defense that processes 
any information the unauthorized access, use, disclosure, 
disruption, modification, or destruction of which would 
have a debilitating impact on the mission of the Depart-
ment of Defense. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(3) The systems described in this paragraph are sys-
tems that are operated by the Central Intelligence Agency, 
a contractor of the Central Intelligence Agency, or another 
entity on behalf of the Central Intelligence Agency that 
processes any information the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
which would have a debilitating impact on the mission of 
the Central Intelligence Agency. 
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(i) information security standards 
and guidelines promulgated under section 
11331 of title 40 and section 20 of the Na-
tional Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3); 
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
‘‘(iii) ensuring the standards imple-
mented for information systems and na-
tional security systems of the agency are 
complementary and uniform, to the extent 
practicable; 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning and 
budget processes, including policies, procedures, 
and practices described in subsection (c)(2); 
‘‘(D) as appropriate, maintaining secure 
facilities that have the capability of accessing, 
sending, receiving, and storing classified infor-
mation; 
‘‘(E) maintaining a sufficient number of 
personnel with security clearances, at the ap-
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
propriate levels, to access, send, receive and 
analyze classified information to carry out the 
responsibilities of this subchapter; and 
‘‘(F) ensuring that information security 
performance indicators and measures are in-
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation systems that support the operations and as-
sets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information system; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 11331 of title 40 
and section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
that impact the security of information 
and information systems that extend be-
yond the control of the agency; and 
‘‘(v) report any incident described 
under clauses (i) and (ii) to the Federal in-
formation security incident center, to other 
appropriate security operations centers, 
and to the Inspector General of the agen-
cy, to the extent practicable, within 24 
hours after discovery of the incident, but 
no later than 48 hours after such dis-
covery; 
‘‘(B) developing, maintaining, and over-
seeing an agencywide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 11331 of title 40; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has a sufficient 
number of trained and cleared personnel to assist 
the agency in complying with the requirements of 
this subchapter, other applicable laws, and related 
policies, procedures, standards, and guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in consultation with other senior agency offi-
cials, reports periodically, but not less than annually, 
to the agency head on— 
‘‘(A) the effectiveness of the agency infor-
mation security program; 
‘‘(B) information derived from automated 
and continuous monitoring, when possible, and 
threat assessments; and 
‘‘(C) the progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer possesses the necessary qualifications, includ-
ing education, training, experience, and the security 
clearance required to administer the functions de-
scribed under this subchapter; and has information 
security duties as the primary duty of that official; 
and 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Of-
ficer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
senior agency officers accountable for the implemen-
tation of appropriate security policies, procedures, 
and controls of agency components. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director and consistent 
with components across and within agencies, to provide 
information security for the information and information 
systems that support the operations and assets of the 
agency, including those provided or managed by another 
agency, contractor, or other source, that includes— 
‘‘(1) automated and continuous monitoring, 
when possible, of the risk and magnitude of the 
harm that could result from the disruption or unau-
thorized access, use, disclosure, modification, or de-
struction of information and information systems 
that support the operations and assets of the agen-
cy; 
‘‘(2) consistent with guidance developed under 
section 11331 of title 40, vulnerability assessments 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
and penetration tests commensurate with the risk 
posed to agency information systems; 
‘‘(3) policies and procedures that— 
‘‘(A) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(B) ensure compliance with— 
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may 
be prescribed by the Director, and infor-
mation security standards promulgated 
pursuant to section 11331 of title 40; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the Director; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; and 
‘‘(II) the National Institute of 
Standards and Technology standards 
and guidance; 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(C) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable require-
ments, including those promulgated pursuant 
section 11331 of title 40; and 
‘‘(D) ensure the oversight and training of 
personnel with significant responsibilities for in-
formation security with respect to such respon-
sibilities; 
‘‘(4) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for testing and evaluation 
of the effectiveness and compliance of information 
security policies, procedures, and practices, includ-
ing— 
‘‘(A) controls of every information system 
identified in the inventory required under sec-
tion 3505(c); and 
‘‘(B) controls relied on for an evaluation 
under this section; 
‘‘(5) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(6) with a frequency sufficient to support risk- 
based security decisions, automated and continuous 
monitoring, when possible, for detecting, reporting, 
and responding to security incidents, consistent with 
standards and guidelines issued by the National In-
stitute of Standards and Technology, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
‘‘(B) notifying and consulting with the 
Federal information security incident center 
and other appropriate security operations re-
sponse centers; and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; and 
‘‘(ii) any other agency, office, or enti-
ty, in accordance with law or as directed 
by the President; and 
‘‘(7) plans and procedures to ensure continuity 
of operations for information systems that support 
the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
procedures, and practices, and compliance with the 
requirements of this subchapter, including compli-
ance with each requirement of subsection (b) to— 
‘‘(A) the Director; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of 
information security policies, procedures, and prac-
tices in plans and reports relating to— 
‘‘(A) annual agency budgets; 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and 
sections 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576); 
‘‘(F) financial management systems under 
the Federal Financial Management Improve-
ment Act of 1996 (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31; and 
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)— 
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
agement Improvement Act of 1996 (31 U.S.C. 
3512 note). 
‘‘§ 3555. Federal information security incident center 
‘‘(a) IN GENERAL.—The Director shall ensure the 
operation of a central Federal information security inci-
dent center to— 
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems regarding secu-
rity incidents, including guidance on detecting and 
handling information security incidents; 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information 
systems about current and potential information se-
curity threats, and vulnerabilities; and 
‘‘(4) consult with the National Institute of 
Standards and Technology, agencies or offices oper-
ating or exercising control of national security sys-
tems (including the National Security Agency), and 
such other agencies or offices in accordance with law 
and as directed by the President regarding informa-
tion security incidents and related matters. 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency 
operating or exercising control of a national security sys-
tem shall share information about information security in-
cidents, threats, and vulnerabilities with the Federal infor-
mation security incident center to the extent consistent 
with standards and guidelines for national security sys-
tems, issued in accordance with law and as directed by 
the President. 
‘‘(c) REVIEW AND APPROVAL.—The Director shall 
review and approve the policies, procedures, and guidance 
established in this subchapter to ensure that the incident 
center has the capability to effectively and efficiently de-
tect, correlate, respond to, contain, mitigate, and reme-
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
diate incidents that impair the adequate security of the 
information systems of more than one agency. To the ex-
tent practicable, the capability shall be continuous and 
technically automated. 
‘‘§ 3556. National security systems 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and 
‘‘(3) complies with the requirements of this sub-
chapter.’’. 
SEC. 3. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) TABLE OF SECTIONS IN TITLE 44.—The table 
of sections for chapter 35 of title 44, United States Code, 
is amended by striking the matter relating to subchapters 
II and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘Sec. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6211
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. Authority and functions of the Director. 
‘‘3554. Agency responsibilities. 
‘‘3555. Federal information security incident center. 
‘‘3556. National security systems.’’. 
(b) OTHER REFERENCES.— 
(1) Section 1001(c)(1)(A) of the Homeland Se-
curity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is 
amended by striking ‘‘section 3532(3)’’ and insert-
ing ‘‘section 3552(b)’’. 
(2) Section 2222(j)(5) of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(3) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552(b)’’. 
(4) Section 2315 of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2)’’ 
and inserting ‘‘section 3552(b)’’. 
(5) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–3) 
is amended— 
(A) in subsections (a)(2) and (e)(5) sub-
section (a)(2), by striking ‘‘section 3532(b)(2)’’ 
and inserting ‘‘section 3552(b)’’; and 
(B) in subsection (e)— 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
(i) in paragraph (2), by striking ‘‘sec-
tion 3532(1)’’ and inserting ‘‘section 
3552(b)’’; and 
(ii) in paragraph (5), by striking ‘‘sec-
tion 3532(b)(2)’’ and inserting ‘‘section 
3552(b)’’. 
(6) Section 8(d)(1) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7406(d)(1)) 
is amended by striking ‘‘section 3534(b)’’ and in-
serting ‘‘section 3554(b)’’. 
SEC. 4. NO ADDITIONAL FUNDS AUTHORIZED. 
No additional funds are authorized to carry out the 
requirements of section 3554 of title 44, United States 
Code, as amended by section 2 of this Act. Such require-
ments shall be carried out using amounts otherwise au-
thorized or appropriated. 
SEC. 5. EFFECTIVE DATE. 
This Act (including the amendments made by this 
Act) shall take effect 30 days after the date of the enact-
ment of this Act. 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS
Union Calendar No. 26 
113TH CONGRESS 
1ST SESSION 
H. R. 1163 
[Report No. 113–40] 
A BILL 
To amend chapter 35 of title 44, United States 
Code, to revise requirements relating to Federal 
information security, and for other purposes. 
APRIL 16, 2013 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
20:42 Apr 16, 2013
Jkt 029200
PO 00000
Frm 00030
Fmt 6651
Sfmt 6651
E:\BILLS\H1163.RH
H1163
mstockstill on DSK4VPTVN1PROD with BILLS