292
‘‘(C) ensure that information security is
addressed throughout the life cycle of each
agency information system; and
‘‘(D) ensure compliance with—
‘‘(i) the requirements of this sub-
chapter;
‘‘(ii) policies and procedures as may
be prescribed by the Director, and infor-
mation security standards promulgated
under section 5131 of the Clinger-Cohen
Act of 1996 (40 U.S.C. 1441);
‘‘(iii) minimally acceptable system
configuration requirements, as determined
by the agency; and
‘‘(iv) any other applicable require-
ments, including standards and guidelines
for national security systems issued in ac-
cordance with law and as directed by the
President;
‘‘(3) subordinate plans for providing adequate
information security for networks, facilities, and sys-
tems or groups of information systems, as appro-
priate;
‘‘(4) security awareness training to inform per-
sonnel, including contractors and other users of in-
293
formation systems that support the operations and
assets of the agency, of—
‘‘(A) information security risks associated
with their activities; and
‘‘(B) their responsibilities in complying
with agency policies and procedures designed to
reduce these risks;
‘‘(5) periodic testing and evaluation of the ef-
fectiveness of information security policies, proce-
dures, and practices, to be performed with a fre-
quency depending on risk, but no less than annually,
of which such testing—
‘‘(A) shall include testing of management,
operational, and technical controls of every in-
formation system identified in the inventory re-
quired under section 3505(c); and
‘‘(B) may include testing relied on in a
evaluation under section 3535;
‘‘(6) a process for planning, implementing, eval-
uating, and documenting remedial action to address
any deficiencies in the information security policies,
procedures, and practices of the agency;
‘‘(7) procedures for detecting, reporting, and re-
sponding to security incidents, including—
294
‘‘(A) mitigating risks associated with such
incidents before substantial damage is done;
and
‘‘(B) notifying and consulting with, as
appropriate—
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspector General;
‘‘(ii) an office designated by the Presi-
dent for any incident involving a national
security system; and
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the
President; and
‘‘(8) plans and procedures to ensure continuity
of operations for information systems that support
the operations and assets of the agency.
‘‘(c) Each agency shall—
‘‘(1) report annually to the Director, the Com-
mittees on Government Reform and Science of the
House of Representatives, the Committees on Gov-
ernmental Affairs and Commerce, Science, and
Transportation of the Senate, the appropriate au-
thorization and appropriations committees of Con-
gress, and the Comptroller General on the adequacy
and effectiveness of information security policies,
295
procedures, and practices, and compliance with the
requirements of this subchapter, including compli-
ance with each requirement of subsection (b);
‘‘(2) address the adequacy and effectiveness of
information security policies, procedures, and prac-
tices in plans and reports relating to—
‘‘(A) annual agency budgets;
‘‘(B) information resources management
under subchapter 1 of this chapter;
‘‘(C) information technology management
under the Clinger-Cohen Act of 1996 (40
U.S.C. 1401 et seq.);
‘‘(D) program performance under sections
1105 and 1115 through 1119 of title 31, and
sections 2801 and 2805 of title 39;
‘‘(E) financial management under chapter
9 of title 31, and the Chief Financial Officers
Act of 1990 (31 U.S.C. 501 note; Public Law
101–576) (and the amendments made by that
Act);
‘‘(F) financial management systems under
the Federal Financial Management Improve-
ment Act (31 U.S.C. 3512 note); and
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31,
296
United States Code, (known as the ‘Federal
Managers Financial Integrity Act’); and
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)—
‘‘(A) as a material weakness in reporting
under section 3512 of title 31, United States
Code; and
‘‘(B) if relating to financial management
systems, as an instance of a lack of substantial
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512
note).
‘‘(d)(1) In addition to the requirements of subsection
(c), each agency, in consultation with the Director, shall
include as part of the performance plan required under
section 1115 of title 31 a description of—
‘‘(A) the time periods, and
‘‘(B) the resources, including budget, staffing,
and training,
that are necessary to implement the program required
under subsection (b).
‘‘(2) The description under paragraph (1) shall be
based on the risk assessments required under subsection
(b)(2)(1).
297
‘‘(e) Each agency shall provide the public with timely
notice and opportunities for comment on proposed infor-
mation security policies and procedures to the extent that
such policies and procedures affect communication with
the public.
‘‘§ 3535. Annual independent evaluation
‘‘(a)(1) Each year each agency shall have performed
an independent evaluation of the information security pro-
gram and practices of that agency to determine the effec-
tiveness of such program and practices.
‘‘(2) Each evaluation by an agency under this section
shall include—
‘‘(A) testing of the effectiveness of information
security policies, procedures, and practices of a rep-
resentative subset of the agency’s information sys-
tems;
‘‘(B) an assessment (made on the basis of the
results of the testing) of compliance with—
‘‘(i) the requirements of this subchapter;
and
‘‘(ii) related information security policies,
procedures, standards, and guidelines; and
‘‘(C) separate presentations, as appropriate, re-
garding information security relating to national se-
curity systems.
298
‘‘(b) Subject to subsection (c)—
‘‘(1) for each agency with an Inspector General
appointed under the Inspector General Act of 1978,
the annual evaluation required by this section shall
be performed by the Inspector General or by an
independent external auditor, as determined by the
Inspector General of the agency; and
‘‘(2) for each agency to which paragraph (1)
does not apply, the head of the agency shall engage
an independent external auditor to perform the eval-
uation.
‘‘(c) For each agency operating or exercising control
of a national security system, that portion of the evalua-
tion required by this section directly relating to a national
security system shall be performed—
‘‘(1) only by an entity designated by the agency
head; and
‘‘(2) in such a manner as to ensure appropriate
protection for information associated with any infor-
mation security vulnerability in such system com-
mensurate with the risk and in accordance with all
applicable laws.
‘‘(d) The evaluation required by this section—
‘‘(1) shall be performed in accordance with gen-
erally accepted government auditing standards; and
299
‘‘(2) may be based in whole or in part on an
audit, evaluation, or report relating to programs or
practices of the applicable agency.
‘‘(e) Each year, not later than such date established
by the Director, the head of each agency shall submit to
the Director the results of the evaluation required under
this section.
‘‘(f) Agencies and evaluators shall take appropriate
steps to ensure the protection of information which, if dis-
closed, may adversely affect information security. Such
protections shall be commensurate with the risk and com-
ply with all applicable laws and regulations.
‘‘(g)(1) The Director shall summarize the results of
the evaluations conducted under this section in the report
to Congress required under section 3533(a)(8).
‘‘(2) The Director’s report to Congress under this
subsection shall summarize information regarding infor-
mation security relating to national security systems in
such a manner as to ensure appropriate protection for in-
formation associated with any information security vulner-
ability in such system commensurate with the risk and in
accordance with all applicable laws.
‘‘(3) Evaluations and any other descriptions of infor-
mation systems under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
300
ligence Programs systems under the authority and control
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees
of Congress, in accordance with applicable laws.
‘‘(h) The Comptroller General shall periodically
evaluate and report to Congress on—
‘‘(1) the adequacy and effectiveness of agency
information security policies and practices; and
‘‘(2) implementation of the requirements of this
subchapter.
‘‘§ 3536. National security systems
‘‘The head of each agency operating or exercising
control of a national security system shall be responsible
for ensuring that the agency—
‘‘(1) provides information security protections
commensurate with the risk and magnitude of the
harm resulting from the unauthorized access, use,
disclosure, disruption, modification, or destruction of
the information contained in such system;
‘‘(2) implements information security policies
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and
‘‘(3) complies with the requirements of this sub-
chapter.
301
‘‘§ 3537. Authorization of appropriations
‘‘There are authorized to be appropriated to carry out
the provisions of this subchapter such sums as may be
necessary for each of fiscal years 2003 through 2007.
‘‘§ 3538. Effect on existing law
‘‘Nothing in this subchapter, section 5131 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1441), or section
20 of the National Standards and Technology Act (15
U.S.C. 278g–3) may be construed as affecting the author-
ity of the President, the Office of Management and Budg-
et or the Director thereof, the National Institute of Stand-
ards and Technology, or the head of any agency, with re-
spect to the authorized use or disclosure of information,
including with regard to the protection of personal privacy
under section 552a of title 5, the disclosure of information
under section 552 of title 5, the management and disposi-
tion of records under chapters 29, 31, or 33 of title 44,
the management of information resources under sub-
chapter I of chapter 35 of this title, or the disclosure of
information to the Congress or the Comptroller General
of the United States.’’.
(2) CLERICAL AMENDMENT.—The items in the
table of sections at the beginning of such chapter 35
under the heading ‘‘SUBCHAPTER II’’ are amend-
ed to read as follows:
‘‘3531. Purposes.
302
‘‘3532. Definitions.
‘‘3533. Authority and functions of the Director.
‘‘3534. Federal agency responsibilities.
‘‘3535. Annual independent evaluation.
‘‘3536. National security systems.
‘‘3537. Authorization of appropriations.
‘‘3538. Effect on existing law.’’.
(c) INFORMATION SECURITY RESPONSIBILITIES OF
CERTAIN AGENCIES.—
(1) NATIONAL SECURITY RESPONSIBILITIES.—
(A) Nothing in this Act (including any amendment
made by this Act) shall supersede any authority of
the Secretary of Defense, the Director of Central In-
telligence, or other agency head, as authorized by
law and as directed by the President, with regard to
the operation, control, or management of national
security systems, as defined by section 3532(3) of
title 44, United States Code.
(B) Section 2224 of title 10, United States
Code, is amended—
(i) in subsection 2224(b), by striking ‘‘(b)
OBJECTIVES AND MINIMUM REQUIREMENTS.—
(1)’’ and inserting ‘‘(b) OBJECTIVES OF THE
PROGRAM.—’’;
(ii) in subsection 2224(b), by striking ‘‘(2)
the program shall at a minimum meet the re-
quirements of section 3534 and 3535 of title
44, United States Code.’’; and
303
(iii) in subsection 2224(c), by inserting
‘‘, including through compliance with subtitle II
of chapter 35 of title 44’’ after ‘‘infrastruc-
ture’’.
(2) ATOMIC ENERGY ACT OF 1954.—Nothing in
this Act shall supersede any requirement made by or
under the Atomic Energy Act of 1954 (42 U.S.C.
2011 et seq.). Restricted Data or Formerly Re-
stricted Data shall be handled, protected, classified,
downgraded, and declassified in conformity with the
Atomic Energy Act of 1954 (42 U.S.C. 2011 et
seq.).
SEC. 1102. MANAGEMENT OF INFORMATION TECHNOLOGY.
Section 5131 of the Clinger-Cohen Act of 1996 (40
U.S.C. 1441) is amended to read as follows:
‘‘SEC. 5131. RESPONSIBILITIES FOR FEDERAL INFORMA-
TION SYSTEMS STANDARDS.
‘‘(a)(1)(A) Except as provided under paragraph (2),
the Director of the Office of Management and Budget
shall, on the basis of proposed standards developed by the
National Institute of Standards and Technology pursuant
to paragraphs (2) and (3) of section 20(a) of the National
Institute of Standards and Technology Act (15 U.S.C.
278g–3(a)) and in consultation with the Secretary of
304
Homeland Security, promulgate information security
standards pertaining to Federal information systems.
‘‘(B) Standards promulgated under subparagraph
(A) shall include—
‘‘(i) standards that provide minimum informa-
tion security requirements as determined under sec-
tion 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)); and
‘‘(ii) such standards that are otherwise nec-
essary to improve the efficiency of operation or secu-
rity of Federal information systems.
‘‘(C) Information security standards described under
subparagraph (B) shall be compulsory and binding.
‘‘(2) Standards and guidelines for national security
systems, as defined under section 3532(3) of title 44,
United States Code, shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law and
as directed by the President.
‘‘(b) The head of an agency may employ standards
for the cost-effective information security for all oper-
ations and assets within or under the supervision of that
agency that are more stringent than the standards pro-
mulgated by the Director under this section, if such
standards—
305
‘‘(1) contain, at a minimum, the provisions of
those applicable standards made compulsory and
binding by the Director; and
‘‘(2) are otherwise consistent with policies and
guidelines issued under section 3533 of title 44,
United States Code.
‘‘(c)(1) The decision regarding the promulgation of
any standard by the Director under subsection (a) shall
occur not later than 6 months after the submission of the
proposed standard to the Director by the National Insti-
tute of Standards and Technology, as provided under sec-
tion 20 of the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3).
‘‘(2) A decision by the Director to significantly mod-
ify, or not promulgate, a proposed standard submitted to
the Director by the National Institute of Standards and
Technology, as provided under section 20 of the National
Institute of Standards and Technology Act (15 U.S.C.
278g–3), shall be made after the public is given an oppor-
tunity to comment on the Director’s proposed decision.’’.
‘‘(d) In this section, the term ‘information security’
has the meaning given that term in section 3532(b)(1) of
title 44, United States Code.’’.
306
SEC. 1103. NATIONAL INSTITUTE OF STANDARDS AND
TECHNOLOGY.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), is amended by strik-
ing the text and inserting the following:
‘‘(a) The Institute shall—
‘‘(1) have the mission of developing standards,
guidelines, and associated methods and techniques
for information systems;
‘‘(2) develop standards and guidelines, includ-
ing minimum requirements, for information systems
used or operated by an agency or by a contractor of
an agency or other organization on behalf of an
agency, other than national security systems (as de-
fined in section 3532(b)(2) of title 44, United States
Code);
‘‘(3) develop standards and guidelines, includ-
ing minimum requirements, for providing adequate
information security for all agency operations and
assets, but such standards and guidelines shall not
apply to national security systems; and
‘‘(4) carry out the responsibilities described in
paragraph (3) through the Computer Security Divi-
sion.
‘‘(b) The standards and guidelines required by sub-
section (a) shall include, at a minimum—