considers necessary to ensure the security of the De-
partment’s information infrastructure. 
‘‘(2) LIMITATION ON PUBLIC DISCLOSURES.— 
The Chief Information Officer shall not disclose to 
the public any information provided for purposes of 
such determination, notwithstanding any other pro-
vision of Federal, State, or local law, including sec-
tion 552 of title 5, United States Code. 
‘‘(b) CONTRACT REQUIREMENTS REGARDING SECU-
RITY.—The Secretary shall include in each covered con-
tract provisions requiring the contractor to— 
‘‘(1) implement and regularly update the inter-
nal information systems security policy required 
under subsection (a); 
‘‘(2) maintain the capability to provide con-
tracted services on a continuing and ongoing basis 
to the Department in the event of unplanned or dis-
ruptive event; and 
‘‘(3) deliver timely notice of any internal com-
puter incident, as defined by the National Institute 
of Standards and Technology, that could violate or 
pose an imminent threat of violation of computer se-
curity policies, acceptable use policies, or standard 
security practices at the Department, to the United 
States Computer Emergency Readiness Team and 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
the incident response team established under section 
703(a)(4). 
‘‘(c) CONTRACT REQUIREMENTS REGARDING SUB-
CONTRACTING.—The Secretary shall include in each cov-
ered contract— 
‘‘(1) a requirement that the contractor develop 
and implement a plan for the award of subcontracts, 
as appropriate, to small business concerns and dis-
advantaged business concerns in accordance with 
other applicable requirements, including the terms of 
such plan, as appropriate; and 
‘‘(2) a requirement that the contractor submit 
to the Secretary, during performance of the con-
tract, periodic reports describing the extent to which 
the contractor has complied with such plan, includ-
ing specification (by total dollar amount and by per-
centage of the total dollar value of the contract) of 
the value of subcontracts awarded at all tiers of sub-
contracting to small business concerns, including so-
cially and economically disadvantaged small busi-
nesses concerns, small business concerns owned and 
controlled by service-disabled veterans, HUBZone 
small business concerns, small business concerns eli-
gible to be awarded contracts pursuant to section 
8(a) of the Small Business Act (15 U.S.C. 637(a)), 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
and historically Black colleges and universities and 
Hispanic-serving institutions, tribal colleges and uni-
versities, and other minority institutions. 
‘‘(d) EXISTING CONTRACTS.—The Secretary shall, to 
the extent practicable under the terms of existing con-
tracts, require each contractor who provides covered infor-
mation services under a contract in effect on the date of 
the enactment of the Homeland Security Network Defense 
and Accountability Act of 2008 to comply with the re-
quirements described in subsection (b). 
‘‘(e) DEFINITIONS.—For purposes of this section: 
‘‘(1) SOCIALLY AND ECONOMICALLY DISADVAN-
TAGED SMALL BUSINESSES CONCERN, SMALL BUSI-
NESS CONCERN OWNED AND CONTROLLED BY SERV-
ICE-DISABLED
VETERANS, AND
HUBZONE
SMALL 
BUSINESS CONCERN.—The terms ‘socially and eco-
nomically disadvantaged small businesses concern’, 
‘small business concern owned and controlled by 
service-disabled veterans’, and ‘HUBZone small 
business concern’ have the meanings given such 
terms under the Small Business Act (15 U.S.C. 631 
et seq.). 
‘‘(2) CONTRACTOR.—The term ‘contractor’ in-
cludes each subcontractor of a contractor. 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
‘‘(3) COVERED CONTRACT.—The term ‘covered 
contract’ means a contract entered into or renewed 
after the date of the enactment of the Homeland Se-
curity Network Defense and Accountability Act of 
2008 for the provision of covered information serv-
ices. 
‘‘(4) COVERED INFORMATION SERVICES.—The 
term ‘covered information services’ means creation, 
management, maintenance, control, or operation of 
information networks or Internet Web sites for the 
Department. 
‘‘(5) HISTORICALLY
BLACK
COLLEGES
AND 
UNIVERSITIES.—The term ‘historically Black col-
leges and universities’ means part B institutions 
under title III of the Higher Education Act of 1965 
(20 U.S.C. 1061). 
‘‘(6) 
HISPANIC-SERVING
INSTITUTION.—The 
term ‘Hispanic-serving institution’ has the meaning 
given such term under title V of the Higher Edu-
cation Act of 1965 (20 U.S.C. 1101a(a)(5)). 
‘‘(7) 
INFORMATION
INFRASTRUCTURE.—The 
term ‘information infrastructure’ has the meaning 
that term has under section 703. 
‘‘(8) TRIBAL COLLEGES AND UNIVERSITIES.— 
The term ‘tribal colleges and universities’ has the 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
meaning given such term under the Tribally Con-
trolled College or University Assistance Act of 1978 
(25 U.S.C. 1801 et seq.).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by inserting after 
the item relating to section 835 the following new item: 
‘‘Sec. 836. Requirements for network service providers.’’. 
(c) REPORT.—Within 90 days after the date of enact-
ment of this Act, the Secretary of Homeland Security shall 
transmit to the Committee on Homeland Security of the 
House of Representatives and the Homeland Security and 
Governmental Affairs Committee of the Senate a report 
describing— 
(1) the progress in implementing requirements 
issued by the Office of Management and Budget for 
encryption, authentication, Internet Protocol version 
6, and Trusted Internet Connections, including a 
timeline for completion; 
(2) a plan, including an estimated budget and 
a timeline, to investigate breaches against the De-
partment of Homeland Security’s information infra-
structure for purposes of counterintelligence assess-
ment, attribution, and response; 
(3) a proposal to increase threat information 
sharing with cleared and uncleared contractors and 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS
provide specialized damage assessment training to 
private sector information security professionals; and 
(4) a process to coordinate the Department of 
Homeland Security’s information infrastructure pro-
tection activities. 
Æ 
VerDate Aug 31 2005 
06:12 May 08, 2008
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6301
E:\BILLS\H5983.IH
H5983
erowe on PRODPC61 with BILLS