IB 
Union Calendar No. 318 
112TH CONGRESS 
2D SESSION 
H. R. 4257 
[Report No. 112–455] 
To amend chapter 35 of title 44, United States Code, to revise requirements 
relating to Federal information security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 26, 2012 
Mr. ISSA (for himself and Mr. CUMMINGS) introduced the following bill; which 
was referred to the Committee on Oversight and Government Reform 
APRIL 26, 2012 
Additional sponsor: Mr. VAN HOLLEN 
APRIL 26, 2012 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on March 26, 2012] 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
A BILL 
To amend chapter 35 of title 44, United States Code, to 
revise requirements relating to Federal information secu-
rity, and for other purposes. 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information Se-
curity Amendments Act of 2012’’. 
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amended 
by striking subchapters II and III and inserting the fol-
lowing: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Federal 
operations and assets; 
‘‘(2) recognize the highly networked nature of the 
current Federal computing environment and provide 
effective Governmentwide management and oversight 
of the related information security risks, including co-
ordination of information security efforts throughout 
the civilian, national security, and law enforcement 
communities assets; 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(3) provide for development and maintenance of 
minimum controls required to protect Federal infor-
mation and information systems; 
‘‘(4) provide a mechanism for improved oversight 
of Federal agency information security programs and 
systems through a focus on automated and continuous 
monitoring of agency information systems and reg-
ular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security solu-
tions, reflecting market solutions for the protection of 
critical information systems important to the na-
tional defense and economic security of the Nation 
that are designed, built, and operated by the private 
sector; and 
‘‘(6) recognize that the selection of specific tech-
nical hardware and software information security so-
lutions should be left to individual agencies from 
among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(1) ADEQUATE SECURITY.—The term ‘adequate 
security’ means security commensurate with the risk 
and magnitude of the harm resulting from the unau-
thorized access to or loss, misuse, destruction, or 
modification of information. 
‘‘(2) 
AUTOMATED
AND
CONTINUOUS
MONI-
TORING.—The term ‘automated and continuous moni-
toring’ means monitoring, with minimal human in-
volvement, through an uninterrupted, ongoing real 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed se-
curity controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
‘‘(3) INCIDENT.—The term ‘incident’ means an 
occurrence that actually or potentially jeopardizes the 
confidentiality, integrity, or availability of an infor-
mation system, or the information the system proc-
esses, stores, or transmits or that constitutes a viola-
tion or imminent threat of violation of security poli-
cies, security procedures, or acceptable use policies. 
‘‘(4) INFORMATION SECURITY.—The term ‘infor-
mation security’ means protecting information and 
information systems from unauthorized access, use, 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS
disclosure, disruption, modification, or destruction in 
order to provide— 
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and dis-
closure, including means for protecting personal 
privacy and proprietary information; and 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of informa-
tion. 
‘‘(5) INFORMATION SYSTEM.—The term ‘informa-
tion system’ means a discrete set of information re-
sources organized for the collection, processing, main-
tenance, use, sharing, dissemination, or disposition of 
information and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources. 
VerDate Mar 15 2010 
00:49 Apr 27, 2012
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4257.RH
H4257
jbell on DSK7SPTVN1PROD with BILLS