SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Information 
Security Amendments Act of 2012’’. 
SEC. 2. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities assets; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information systems;
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams and systems through a focus on automated 
and continuous monitoring of agency information 
systems and regular threat assessments; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information systems important to the na-
tional defense and economic security of the Nation 
that are designed, built, and operated by the private 
sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
‘‘(2) AUTOMATED
AND
CONTINUOUS
MONI-
TORING.—The term ‘automated and continuous 
monitoring’ means monitoring, with minimal human 
involvement, through an uninterrupted, ongoing real 
time, or near real-time process used to determine if 
the complete set of planned, required, and deployed 
security controls within an information system con-
tinue to be effective over time with rapidly changing 
information technology and threat development. 
‘‘(3) INCIDENT.—The term ‘incident’ means an 
occurrence that actually or potentially jeopardizes 
the confidentiality, integrity, or availability of an in-
formation system, or the information the system 
processes, stores, or transmits or that constitutes a 
violation or imminent threat of violation of security 
policies, security procedures, or acceptable use poli-
cies. 
‘‘(4) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from unauthorized access, 
use, disclosure, disruption, modification, or destruc-
tion in order to provide—
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; and 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation. 
‘‘(5) INFORMATION SYSTEM.—The term ‘infor-
mation system’ means a discrete set of information 
resources organized for the collection, processing, 
maintenance, use, sharing, dissemination, or disposi-
tion of information and includes— 
‘‘(A) computers and computer networks; 
‘‘(B) ancillary equipment; 
‘‘(C) software, firmware, and related proce-
dures; 
‘‘(D) services, including support services; 
and 
‘‘(E) related resources.
‘‘(6) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given that 
term in section 11101 of title 40. 
‘‘(7) NATIONAL SECURITY SYSTEM.— 
‘‘(A) DEFINITION.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activi-
ties; 
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and 
control of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph 
(B), is critical to the direct fulfillment 
of military or intelligence missions; or
‘‘(D) a summary of, and the views of the 
Director on, the report prepared by the Na-
tional Institute of Standards and Technology 
under section 20(d)(10) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3). 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the 
authorities described in paragraphs (4) and (8) of sub-
section (a), the authorities of the Director under this sec-
tion shall not apply to national security systems. 
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL IN-
TELLIGENCE AGENCY SYSTEMS.—(1) The authorities of 
the Director described in paragraphs (1) and (2) of sub-
section (a) shall be delegated to the Secretary of Defense 
in the case of systems described in paragraph (2) and to 
the Director of Central Intelligence in the case of systems 
described in paragraph (3). 
‘‘(2) The systems described in this paragraph are sys-
tems that are operated by the Department of Defense, a 
contractor of the Department of Defense, or another enti-
ty on behalf of the Department of Defense that processes 
any information the unauthorized access, use, disclosure, 
disruption, modification, or destruction of which would 
have a debilitating impact on the mission of the Depart-
ment of Defense.
propriate levels, to access, send, receive and 
analyze classified information to carry out the 
responsibilities of this subchapter; and 
‘‘(F) ensuring that information security 
performance indicators and measures are in-
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation systems that support the operations and as-
sets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information system; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 11331 of title 40 
and section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C.
278g–3) for information security classifications 
and related requirements; 
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; 
‘‘(D) with a frequency sufficient to support 
risk-based security decisions, testing and evalu-
ating information security controls and tech-
niques to ensure that such controls and tech-
niques are effectively implemented and oper-
ated; and 
‘‘(E) with a frequency sufficient to support 
risk-based security decisions, conducting threat 
assessments by monitoring information systems, 
identifying potential system vulnerabilities, and 
reporting security incidents in accordance with 
paragraph (3)(A)(v); 
‘‘(3) delegate to the Chief Information Officer 
or equivalent (or a senior agency official who reports 
to the Chief Information Officer or equivalent), who 
is designated as the ‘Chief Information Security Of-
ficer’, the authority and primary responsibility to de-
velop, implement, and oversee an agencywide infor-
mation security program to ensure and enforce com-
pliance with the requirements imposed on the agency 
under this subchapter, including— 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
that through automated and continuous moni-
toring, when possible, can— 
‘‘(i) detect, report, respond to, con-
tain, and mitigate incidents that impair in-
formation security and agency information 
systems, in accordance with policy provided 
by the Director; 
‘‘(ii) commensurate with the risk to 
information security, monitor and mitigate 
the vulnerabilities of every information sys-
tem within the agency; 
‘‘(iii) continually evaluate risks posed 
to information collected or maintained by 
or on behalf of the agency and information 
systems and hold senior agency officials 
accountable for ensuring information secu-
rity; 
‘‘(iv) collaborate with the Director and 
appropriate public and private sector secu-
rity operations centers to detect, report, re-
spond to, contain, and mitigate incidents
that impact the security of information 
and information systems that extend be-
yond the control of the agency; and 
‘‘(v) report any incident described 
under clauses (i) and (ii) to the Federal in-
formation security incident center, to other 
appropriate security operations centers, 
and to the Inspector General of the agen-
cy, to the extent practicable, within 24 
hours after discovery of the incident, but 
no later than 48 hours after such dis-
covery; 
‘‘(B) developing, maintaining, and over-
seeing an agencywide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 11331 of title 40; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has a sufficient 
number of trained and cleared personnel to assist 
the agency in complying with the requirements of 
this subchapter, other applicable laws, and related 
policies, procedures, standards, and guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in consultation with other senior agency offi-
cials, reports periodically, but not less than annually, 
to the agency head on— 
‘‘(A) the effectiveness of the agency infor-
mation security program; 
‘‘(B) information derived from automated 
and continuous monitoring, when possible, and 
threat assessments; and 
‘‘(C) the progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer possesses the necessary qualifications, includ-
ing education, training, experience, and the security 
clearance required to administer the functions de-
scribed under this subchapter; and has information 
security duties as the primary duty of that official; 
and
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Of-
ficer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
senior agency officers accountable for the implemen-
tation of appropriate security policies, procedures, 
and controls of agency components. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director and consistent 
with components across and within agencies, to provide 
information security for the information and information 
systems that support the operations and assets of the 
agency, including those provided or managed by another 
agency, contractor, or other source, that includes— 
‘‘(1) automated and continuous monitoring, 
when possible, of the risk and magnitude of the 
harm that could result from the disruption or unau-
thorized access, use, disclosure, modification, or de-
struction of information and information systems 
that support the operations and assets of the agen-
cy; 
‘‘(2) consistent with guidance developed under 
section 11331 of title 40, vulnerability assessments