‘‘(1) to provide a comprehensive framework for 
ensuring the effectiveness of information security 
controls over information resources that support 
Federal operations and assets; 
‘‘(2) to recognize the highly networked nature 
of the current Federal computing environment and 
provide effective government-wide management of 
policies, directives, standards, and guidelines, as well 
as effective and nimble oversight of and response to 
information security risks, including coordination of 
information security efforts throughout the Federal 
civilian, national security, and law enforcement com-
munities; 
‘‘(3) to provide for development and mainte-
nance of controls required to protect agency infor-
mation and information systems and contribute to 
the overall improvement of agency information secu-
rity posture; 
‘‘(4) to provide for the development of tools and 
methods to assess and respond to real-time situa-
tional risk for Federal information system operations 
and assets; and 
‘‘(5) to provide a mechanism for improving 
agency information security programs through con-
tinuous monitoring of agency information systems 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
and streamlined reporting requirements rather than 
overly prescriptive manual reporting. 
‘‘§ 3552. Definitions 
‘‘In this subchapter: 
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from 
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
‘‘(2) AGENCY.—The term ‘agency’ has the 
meaning given the term in section 3502 of title 44. 
‘‘(3) CYBERSECURITY CENTER.—The term ‘cy-
bersecurity center’ means the Department of De-
fense Cyber Crime Center, the Intelligence Commu-
nity Incident Response Center, the United States 
Cyber Command Joint Operations Center, the Na-
tional Cyber Investigative Joint Task Force, the Na-
tional Security Agency/Central Security Service 
Threat Operations Center, the National Cybersecu-
rity and Communications Integration Center, and 
any successor center. 
‘‘(4) CYBER THREAT INFORMATION.—The term 
‘cyber threat information’ means information that 
indicates or describes— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) a technical or operation vulnerability 
or a cyber threat mitigation measure; 
‘‘(B) an action or operation to mitigate a 
cyber threat; 
‘‘(C) malicious reconnaissance, including 
anomalous patterns of network activity that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat; 
‘‘(D) a method of defeating a technical 
control; 
‘‘(E) a method of defeating an operational 
control; 
‘‘(F) network activity or protocols known 
to be associated with a malicious cyber actor or 
that signify malicious cyber intent; 
‘‘(G) a method of causing a user with le-
gitimate access to an information system or in-
formation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(H) any other attribute of a cybersecurity 
threat or cyber defense information that would 
foster situational awareness of the United 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
States cybersecurity posture, if disclosure of 
such attribute or information is not otherwise 
prohibited by law; 
‘‘(I) the actual or potential harm caused by 
a 
cyber 
incident, 
including 
information 
exfiltrated when it is necessary in order to iden-
tify or describe a cybersecurity threat; or 
‘‘(J) any combination of subparagraphs 
(A) through (I). 
‘‘(5) DIRECTOR.—The term ‘Director’ means 
the Director of the Office of Management and Budg-
et unless otherwise specified. 
‘‘(6) ENVIRONMENT OF OPERATION.—The term 
‘environment of operation’ means the information 
system and environment in which those systems op-
erate, including changing threats, vulnerabilities, 
technologies, and missions and business practices. 
‘‘(7) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ means an infor-
mation system used or operated by an executive 
agency, by a contractor of an executive agency, or by 
another organization on behalf of an executive agen-
cy. 
‘‘(8) INCIDENT.—The term ‘incident’ means an 
occurrence that— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) actually or imminently jeopardizes 
the integrity, confidentiality, or availability of 
an information system or the information that 
system controls, processes, stores, or transmits; 
or 
‘‘(B) constitutes a violation of law or an 
imminent threat of violation of a law, a security 
policy, a security procedure, or an acceptable 
use policy. 
‘‘(9) INFORMATION RESOURCES.—The term ‘in-
formation resources’ has the meaning given the term 
in section 3502 of title 44. 
‘‘(10) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from disruption or unau-
thorized access, use, disclosure, modification, or de-
struction in order to provide— 
‘‘(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
‘‘(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; or 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(C) availability, by ensuring timely and 
reliable access to and use of information. 
‘‘(11) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 3502 of title 44. 
‘‘(12) INFORMATION TECHNOLOGY.—The term 
‘information technology’ has the meaning given the 
term in section 11101 of title 40. 
‘‘(13) MALICIOUS RECONNAISSANCE.—The term 
‘malicious reconnaissance’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning technical 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat. 
‘‘(14) NATIONAL SECURITY SYSTEM.— 
‘‘(A) IN GENERAL.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(I) involves intelligence activi-
ties; 
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and 
control of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph 
(B), is critical to the direct fulfillment 
of military or intelligence missions; or 
‘‘(ii) is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria 
established by an Executive order or an 
Act of Congress to be kept classified in the 
interest of national defense or foreign pol-
icy. 
‘‘(B) 
LIMITATION.—Subparagraph 
(A)(i)(V) does not include a system that is to 
be used for routine administrative and business 
applications (including payroll, finance, logis-
tics, and personnel management applications). 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS