SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Homeland Security 
Network Defense and Accountability Act of 2008’’. 
SEC. 2. AUTHORITY OF CHIEF INFORMATION OFFICER; 
QUALIFICATIONS FOR APPOINTMENT. 
Section 703(a) of the Homeland Security Act of 2002 
(6 U.S.C. 343(a)) is amended— 
(1) by inserting before the first sentence the 
following: 
‘‘(1) AUTHORITIES
AND
DUTIES.—The Sec-
retary shall delegate to the Chief Information Offi-
cer such authority necessary for the development, 
approval, implementation, integration, and oversight 
of policies, procedures, processes, activities, funding, 
and systems of the Department relating to the man-
agement of information and information infrastruc-
ture for the Department, including the management 
of all related mission applications, information re-
sources, and personnel. 
‘‘(2) LINE AUTHORITY.—’’; and 
(2) by adding at the end the following new 
paragraphs: 
‘‘(3) QUALIFICATIONS FOR APPOINTMENT.—An 
individual may not be appointed as Chief Informa-
tion Officer unless the individual has—
‘‘(A) demonstrated ability in and knowl-
edge of information technology and information 
security; and 
‘‘(B) not less than 5 years of executive 
leadership and management experience in infor-
mation technology and information security in 
the public or private sector. 
‘‘(4) FUNCTIONS.—The Chief Information Offi-
cer shall— 
‘‘(A) establish and maintain an incident re-
sponse team that provides a continuous, real- 
time capability within the Department of 
Homeland Security to— 
‘‘(i) detect, respond to, contain, inves-
tigate, attribute, and mitigate any com-
puter incident, as defined by the National 
Institute of Standards and Technology, 
that could violate or pose an imminent 
threat of violation of computer security 
policies, acceptable use policies, or stand-
ard security practices of the Department; 
and 
‘‘(ii) deliver timely notice of any inci-
dent to individuals responsible for informa-
tion infrastructure of the Department, and
to the United States Computer Emergency 
Readiness Team; 
‘‘(B) establish, maintain, and update a 
network architecture, including a diagram de-
tailing how security controls are positioned 
throughout the information infrastructure of 
the Department to maintain the confidentiality, 
integrity, availability, accountability, and assur-
ance of electronic information; and 
‘‘(C) ensure that vulnerability assessments 
are conducted on a regular basis for any De-
partment information infrastructure connected 
to the Internet or another external network, 
and that vulnerabilities are mitigated in a time-
ly fashion.’’. 
SEC. 3. ATTACK-BASED TESTING PROTOCOLS. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is amended by adding at the end the fol-
lowing new subsection: 
‘‘(c) ATTACK-BASED
TESTING
PROTOCOLS.—The 
Chief Information Officer, in consultation with the Inspec-
tor General, the Assistant Secretary for Cybersecurity, 
and the heads of other appropriate Federal agencies, 
shall—
‘‘(1) establish security control testing protocols 
that ensure that the Department’s information in-
frastructure is effectively protected against known 
attacks against and exploitations of Federal and 
contractor information infrastructure; 
‘‘(2) oversee the deployment of such protocols 
throughout the information infrastructure of the De-
partment; and 
‘‘(3) update such protocols on a regular basis.’’. 
SEC. 4. INSPECTOR GENERAL REVIEWS OF INFORMATION 
INFRASTRUCTURE. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following new subsection: 
‘‘(d) INSPECTOR GENERAL REVIEWS.— 
‘‘(1) IN GENERAL.—The Inspector General of 
the Department shall use authority under the In-
spector General Act of 1978 (5 App. U.S.C.) to con-
duct announced and unannounced performance re-
views and programmatic reviews of the information 
infrastructure of the Department to determine the 
effectiveness of security policies and controls of the 
Department. 
‘‘(2) PERFORMANCE
REVIEWS.—Performance 
reviews under this subsection shall test and validate
a system’s security controls using the protocols cre-
ated under subsection (c), beginning not later than 
270 days after the date of enactment of the Home-
land Security Network Defense and Accountability 
Act of 2008. 
‘‘(3) PROGRAMMATIC REVIEWS.—Programmatic 
reviews under this subsection shall— 
‘‘(A) determine whether an agency of the 
Department is complying with policies, proc-
esses, and procedures established by the Chief 
Information Officer; and 
‘‘(B) focus on risk assessment, risk man-
agement, and risk mitigation, with primary re-
gard to the implementation of best practices 
such as authentication, access control (including 
remote access), intrusion detection and preven-
tion, data protection and integrity, and any 
other controls that the Inspector General con-
siders necessary. 
‘‘(4) INFORMATION
SECURITY
REPORT.—The 
Inspector General shall submit a security report con-
taining the results of each review under this sub-
section and prioritized recommendations for improv-
ing security controls based on that review, including
recommendations regarding funding changes and 
personnel management, to— 
‘‘(A) the Secretary; 
‘‘(B) the Chief Information Officer; and 
‘‘(C) the head of the Department compo-
nent that was the subject of the review, and 
other appropriate individuals responsible for the 
information infrastructure of such agency. 
‘‘(5) CORRECTIVE ACTION REPORT.— 
‘‘(A) IN GENERAL.—Within 60 days after 
receiving a security report under paragraph (4), 
the head of the Department component that 
was the subject of the review and the Chief In-
formation Officer shall jointly submit a correc-
tive action report to the Secretary and the In-
spector General. 
‘‘(B) CONTENTS.—The corrective action 
report— 
‘‘(i) shall contain a plan for address-
ing 
recommendations 
and 
mitigating 
vulnerabilities contained in the security re-
port, including a timeline and budget for 
implementing such plan; and 
‘‘(ii) shall note any matters in dis-
agreement between the head of the Depart-
ment component and the Chief Information 
Officer. 
‘‘(6) REPORTS TO CONGRESS.— 
‘‘(A) ANNUAL
REPORTS.—In conjunction 
with the reporting requirements of section 3545 
of title 44, United States Code, the Inspector 
General shall submit an annual report to the 
Committee on Homeland Security of the House 
of Representatives and the Committee on 
Homeland Security and Governmental Affairs 
of the Senate— 
‘‘(i) summarizing the performance and 
programmatic reviews performed during 
the preceding fiscal year, the results of 
those reviews, and any actions that remain 
to be taken under plans included in correc-
tive action reports under paragraph (5); 
and 
‘‘(ii) describing the effectiveness of 
the testing protocols developed under sub-
section (c) in reducing successful exploi-
tations of the Department’s information 
infrastructure. 
‘‘(B) SECURITY
REPORTS
AND
CORREC-
TIVE ACTION REPORTS.—The Inspector General
shall make all security reports and corrective 
action reports available to any member of the 
Committee on Homeland Security of the House 
of Representatives, any member of the Com-
mittee on Homeland Security and Govern-
mental Affairs of the Senate, and the Comp-
troller General of the United States, upon re-
quest.’’. 
SEC. 5. INFORMATION INFRASTRUCTURE DEFINED. 
Section 703 of the Homeland Security Act of 2002 
(6 U.S.C. 343) is further amended by adding at the end 
the following: 
‘‘(e) INFORMATION INFRASTRUCTURE DEFINED.—In 
this section, the term ‘information infrastructure’ means 
systems and assets used in processing, transmitting, re-
ceiving, or storing information electronically.’’. 
SEC. 6. NETWORK SERVICE PROVIDERS. 
(a) IN GENERAL.—Subtitle D of title VIII of the 
Homeland Security Act of 2002 (6 U.S.C. 391 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 836. REQUIREMENTS FOR NETWORK SERVICE PRO-
VIDERS. 
‘‘(a) COMPATIBILITY DETERMINATION.—Before en-
tering into or renewing a covered contract, the Secretary, 
acting through the Chief Information Officer, must deter-
mine that the contractor has an internal information sys-
tems security policy that complies with the Department’s 
information security requirements for risk assessment, 
risk management, and risk mitigation, with primary re-
gard to the implementation of best practices such as au-
thentication, access control (including remote access), in-
trusion detection and prevention, data protection and in-
tegrity, and any other policies that the Secretary considers 
necessary to ensure the security of the Department’s in-
formation infrastructure. 
‘‘(b) CONTRACT REQUIREMENTS REGARDING SECU-
RITY.—The Secretary shall include in each covered con-
tract provisions requiring the contractor to— 
‘‘(1) implement and regularly update the inter-
nal information systems security policy required 
under subsection (a); 
‘‘(2) maintain the capability to provide con-
tracted services on a continuing and ongoing basis 
to the Department in the event of unplanned or dis-
ruptive event; and 
‘‘(3) deliver timely notice of any internal com-
puter incident, as defined by the National Institute 
of Standards and Technology, that could violate or 
pose an imminent threat of violation of computer se-
curity policies, acceptable use policies, or standard
security practices at the Department, to the United 
States Computer Emergency Readiness Team and 
the incident response team established under section 
703(a)(4). 
‘‘(c) CONTRACT REQUIREMENTS REGARDING SUB-
CONTRACTING.—The Secretary shall include in each cov-
ered contract— 
‘‘(1) a requirement that the contractor develop 
and implement a plan for the award of subcontracts, 
as appropriate, to small business concerns and dis-
advantaged business concerns in accordance with 
other applicable requirements, including the terms of 
such plan, as appropriate; and 
‘‘(2) a requirement that the contractor submit 
to the Secretary, during performance of the con-
tract, periodic reports describing the extent to which 
the contractor has complied with such plan, includ-
ing specification (by total dollar amount and by per-
centage of the total dollar value of the contract) of 
the value of subcontracts awarded at all tiers of sub-
contracting to small business concerns, including so-
cially and economically disadvantaged small busi-
nesses concerns, small business concerns owned and 
controlled by service-disabled veterans, HUBZone 
small business concerns, small business concerns eli-
gible to be awarded contracts pursuant to section 
8(a) of the Small Business Act (15 U.S.C. 637(a)), 
and Historically Black Colleges and Universities and 
Hispanic-serving institutions, tribal colleges and uni-
versities, and other minority institutions. 
‘‘(d) EXISTING CONTRACTS.—The Secretary shall, to 
the extent practicable under the terms of existing con-
tracts, require each contractor who provides covered infor-
mation services under a contract in effect on the date of 
the enactment of the Homeland Security Network Defense 
and Accountability Act of 2008 to comply with the re-
quirements described in subsection (b). 
‘‘(e) DEFINITIONS.—For purposes of this section: 
‘‘(1) SOCIALLY AND ECONOMICALLY DISADVAN-
TAGED SMALL BUSINESSES CONCERN, SMALL BUSI-
NESS CONCERN OWNED AND CONTROLLED BY SERV-
ICE-DISABLED
VETERANS, AND
HUBZONE
SMALL 
BUSINESS CONCERN.—The terms ‘socially and eco-
nomically disadvantaged small businesses concern’, 
‘small business concern owned and controlled by 
service-disabled veterans’, and ‘HUBZone small 
business concern’ have the meanings given such 
terms under the Small Business Act (15 U.S.C. 631 
et seq.).
‘‘(2) CONTRACTOR.—The term ‘contractor’ in-
cludes each subcontractor of a contractor. 
‘‘(3) COVERED CONTRACT.—The term ‘covered 
contract’ means a contract entered into or renewed 
after the date of the enactment of the Homeland Se-
curity Network Defense and Accountability Act of 
2008 for the provision of covered information serv-
ices. 
‘‘(4) COVERED INFORMATION SERVICES.—The 
term ‘covered information services’ means creation, 
management, maintenance, control, or operation of 
information networks or Internet Web sites for the 
Department. 
‘‘(5) HISTORICALLY
BLACK
COLLEGES
AND 
UNIVERSITIES.—The term ‘Historically Black Col-
leges and Universities’ means part B institutions 
under title III of the Higher Education Act of 1965 
(20 U.S.C. 1061). 
‘‘(6) 
HISPANIC-SERVING
INSTITUTION.—The 
term ‘Hispanic-serving institution’ has the meaning 
given such term under title V of the Higher Edu-
cation Act of 1965 (20 U.S.C. 1101a(a)(5)). 
‘‘(7) 
INFORMATION
INFRASTRUCTURE.—The 
term ‘information infrastructure’ has the meaning 
that term has under section 703.
‘‘(8) TRIBAL COLLEGES AND UNIVERSITIES.— 
The term ‘tribal colleges and universities’ has the 
meaning given such term under the Tribally Con-
trolled College or University Assistance Act of 1978 
(25 U.S.C. 1801 et seq.).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by inserting after 
the item relating to section 835 the following new item: 
‘‘Sec. 836. Requirements for network service providers.’’. 
(c) REPORT.—Within 90 days after the date of enact-
ment of this Act, the Secretary of Homeland Security shall 
transmit to the Committee on Homeland Security of the 
House of Representatives and the Homeland Security and 
Governmental Affairs Committee of the Senate a report 
describing— 
(1) the progress in implementing requirements 
issued by the Office of Management and Budget for 
encryption, authentication, Internet Protocol version 
6, and Trusted Internet Connections, including a 
timeline for completion; 
(2) a plan, including an estimated budget and 
a timeline, to investigate breaches against the De-
partment of Homeland Security’s information infra-
structure for purposes of counterintelligence assess-
ment, attribution, and response;
(3) a proposal to increase threat information 
sharing with cleared and uncleared contractors and 
provide specialized damage assessment training to 
private sector information security professionals; and 
(4) a process to coordinate the Department of 
Homeland Security’s information infrastructure pro-
tection activities. 
SEC. 7. RULE OF CONSTRUCTION. 
Nothing in this Act shall be construed as affecting 
in any manner the application of the Federal Information 
Management Security Act of 2002 (44 U.S.C. 3541 et 
seq.), to the Department of Homeland Security, including 
all requirements and deadlines in that Act. 
Passed the House of Representatives July 30, 2008. 
Attest: 
Clerk.
110TH CONGRESS 
2D SESSION 
H. R. 5983 
AN ACT 
To amend the Homeland Security Act of 2002 to 
enhance the information security of the Depart-
ment of Homeland Security, and for other pur-
poses.