I 
112TH CONGRESS 
2D SESSION 
H. R. 4257 
To amend chapter 35 of title 44, United States Code, to revise requirements 
relating to Federal information security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 26, 2012 
Mr. ISSA (for himself and Mr. CUMMINGS) introduced the following bill; which 
was referred to the Committee on Oversight and Government Reform 
A BILL 
To amend chapter 35 of title 44, United States Code, to 
revise requirements relating to Federal information secu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Amendments Act of 2012’’. 
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities assets; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information infrastructure; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams and systems through a focus on automated 
and continuous monitoring of agency information 
systems and regular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
lutions, reflecting market solutions for the protection 
of critical information infrastructures important to 
the national defense and economic security of the 
Nation that are designed, built, and operated by the 
private sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) The term ‘adequate security’ means secu-
rity that complies with the regulations and stand-
ards promulgated under section 11331 of title 40. 
‘‘(2) The term ‘automated and continuous mon-
itoring’ means monitoring, with minimal human in-
volvement, through an uninterrupted, ongoing real- 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed 
security controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS
‘‘(3) The term ‘incident’ means an occurrence 
that actually or potentially jeopardizes the confiden-
tiality, integrity, or availability of an information 
system, information infrastructure, or the informa-
tion the system processes, stores, or transmits or 
that constitutes a violation or imminent threat of 
violation of security policies, security procedures, or 
acceptable use policies. 
‘‘(4) The term ‘information infrastructure’ 
means the underlying framework that information 
systems and assets rely on in processing, storing, or 
transmitting information electronically. 
‘‘(5) The term ‘information security’ means 
protecting information and information infrastruc-
ture from unauthorized access, use, disclosure, dis-
ruption, modification, or destruction in order to pro-
vide— 
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; 
VerDate Mar 15 2010 
02:57 Mar 27, 2012
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4257.IH
H4257
jbell on DSK7SPTVN1PROD with BILLS