I
107TH CONGRESS
2D SESSION
H. R. 3844
To strengthen Federal Government information security, including through
the requirement for the development of mandatory information security
risk management standards.
IN THE HOUSE OF REPRESENTATIVES
MARCH 5, 2002
Mr. TOM DAVIS of Virginia (for himself and Mr. HORN) introduced the fol-
lowing bill; which was referred to the Committee on Government Reform,
and in addition to the Committee on Science, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such
provisions as fall within the jurisdiction of the committee concerned
A BILL
To strengthen Federal Government information security, in-
cluding through the requirement for the development of
mandatory information security risk management stand-
ards.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. INFORMATION SECURITY.
(a) SHORT TITLE.—The amendments made by this
section may be cited as the ‘‘Federal Information Security
Management Act of 2002’’.
(b) INFORMATION SECURITY.—
(1) IN GENERAL.—Subchapter II of chapter 35
of title 44, United States Code, is amended to read
as follows:
‘‘SUBCHAPTER II—INFORMATION
SECURITY
‘‘§ 3531. Purposes
‘‘The purposes of this subchapter are to—
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets;
‘‘(2) recognize the highly networked nature of
the current Federal computing environment and pro-
vide effective governmentwide management and over-
sight of the related information security risks, in-
cluding coordination of information security efforts
throughout the civilian, national security, and law
enforcement communities;
‘‘(3) provide for development and maintenance
of minimum controls required to protect Federal in-
formation and information systems; and
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams.
‘‘§ 3532. Definitions
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under section 3502 shall apply
to this subchapter.
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this
subchapter—
‘‘(1) the term ‘information security’ means pro-
tecting information and information systems from
unauthorized use, disclosure, disruption, modifica-
tion, or destruction in order to provide—
‘‘(A) integrity, which means guarding
against improper information modification or
destruction, and includes ensuring information
nonrepudiation and authenticity;
‘‘(B) confidentiality, which means pre-
serving an appropriate level of information se-
crecy; and
‘‘(C) availability, which means ensuring
timely and reliable access to and use of infor-
mation;
‘‘(2) the term ‘national security system’ means
any information system (including any telecommuni-
cations system) used or operated by an agency or by
a contractor of an agency, or other organization on
behalf of an agency—
‘‘(A) the function, operation, or use of
which—
‘‘(i) involves intelligence activities;
‘‘(ii) involves cryptologic activities re-
lated to national security;
‘‘(iii) involves command and control of
military forces;
‘‘(iv) involves equipment that is an in-
tegral part of a weapon or weapons sys-
tem; or
‘‘(v) is critical to the direct fulfillment
of military or intelligence missions pro-
vided that this definition does not apply to
a system that is used for routine adminis-
trative and business applications (including
payroll, finance, logistics, and personnel
management applications); or
‘‘(B) is protected at all times by proce-
dures established for information that have
been specifically authorized under criteria es-
tablished by an Executive order or an Act of
Congress to be kept secret in the interest of na-
tional defense or foreign policy; and
‘‘(B) determining the levels of information
security appropriate to protect such information
and information systems in accordance with
standards and guidelines promulgated under
section 5131 of the Clinger-Cohen Act of 1996
(40 U.S.C. 1441) for information security clas-
sifications and related requirements;
‘‘(C) implementing policies and procedures
to cost-effectively reduce risks to an acceptable
level; and
‘‘(D) periodically testing and evaluating in-
formation security controls and techniques to
ensure that they are effectively implemented;
‘‘(3) delegate to the agency Chief Information
Officer established under section 3506 (or com-
parable official in an agency not covered by such
section) the authority to ensure compliance with the
requirements imposed on the agency under this sub-
chapter, including—
‘‘(A) designating a senior agency informa-
tion security officer who shall—
‘‘(i) carry out the Chief Information
Officer’s responsibilities under this section;
‘‘(ii) possess professional qualifica-
tions, including training and experience,
required to administer the functions de-
scribed under this section;
‘‘(iii) have information security duties
as that official’s primary duty; and
‘‘(iv) head an office with the mission
and resources to assist in ensuring agency
compliance with this section;
‘‘(B) developing and maintaining an agen-
cywide information security program as re-
quired by subsection (b);
‘‘(C) developing and maintaining informa-
tion security policies, procedures, and control
techniques to address all applicable require-
ments, including those issued under section
3533 of this title, and section 5131 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1441);
‘‘(D) training and overseeing personnel
with significant responsibilities for information
security with respect to such responsibilities;
and
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under subpara-
graph (2);
‘‘(4) ensure that the agency has trained per-
sonnel sufficient to assist the agency in complying
with the requirements of this subchapter and related
policies, procedures, standards, and guidelines; and
‘‘(5) ensure that the agency Chief Information
Officer, in coordination with other senior agency of-
ficials, reports annually to the agency head on the
effectiveness of the agency information security pro-
gram, including progress of remedial actions.
‘‘(b) Each agency shall develop, document, and imple-
ment an agencywide information security program to pro-
vide information security for the information and informa-
tion systems that support the operations and assets of the
agency, including those provided or managed by another
agency, contractor, or other source, that includes—
‘‘(1) periodic assessments of the risk and mag-
nitude of the harm that could result from the unau-
thorized use, disclosure, disruption, modification, or
destruction of information and information systems
that support the operations and assets of the agen-
cy;
‘‘(2) policies and procedures that—
‘‘(A) are based on the risk assessments re-
quired by subparagraph (1);
‘‘(B) cost-effectively reduce information se-
curity risks to an acceptable level;
‘‘(C) ensure that information security is
addressed throughout the life cycle of each
agency information system; and
‘‘(D) ensure compliance with—
‘‘(i) the requirements of this sub-
chapter;
‘‘(ii) policies and procedures as may
be prescribed by the Director, including in-
formation security standards and guide-
lines promulgated under section 5131 of
the Clinger-Cohen Act of 1996 (40 U.S.C.
1441); and
‘‘(iii) any other applicable require-
ments, including standards and guidelines
for national security systems issued in ac-
cordance with law and as directed by the
President;
‘‘(3) subordinate plans for providing adequate
information security for networks, facilities, and sys-
tems or groups of information systems, as appro-
priate;
‘‘(4) security awareness training to inform per-
sonnel, including contractors and other users of in-
formation systems that support the operations and
assets of the agency, of—
‘‘(A) information security risks associated
with their activities; and
‘‘(B) their responsibilities in complying
with agency policies and procedures designed to
reduce these risks;
‘‘(5) periodic testing and evaluation of the ef-
fectiveness of information security policies, proce-
dures, and practices, to be performed with a fre-
quency depending on risk, but no less than annually;
‘‘(6) a process for ensuring remedial action to
address any deficiencies in the information security
policies, procedures, and practices of the agency;
‘‘(7) procedures for detecting, reporting, and re-
sponding to security incidents, consistent with guid-
ance issued under section 3536, including—
‘‘(A) mitigating risks associated with such
incidents before substantial damage is done;
‘‘(B) notifying and consulting with the
Federal information security incident center es-
tablished under section 3536; and
‘‘(C) notifying and consulting with, as
appropriate—
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspector General;
‘‘(ii) an office designated by the Presi-
dent for any incident involving a national
security system; and
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the
President; and
‘‘(8) plans and procedures to ensure continuity
of operations for information systems that support
the operations and assets of the agency.
‘‘(c) Each agency shall—
‘‘(1) report annually to the Director and the
Comptroller General on the adequacy and effective-
ness of information security policies, procedures, and
practices, including compliance with the require-
ments of this subchapter;
‘‘(2) address the adequacy and effectiveness of
information security policies, procedures, and prac-
tices in plans and reports relating to—
‘‘(A) annual agency budgets;
‘‘(B) information resources management
under subchapter 1 of this chapter;
‘‘(C) information technology management
under the Clinger-Cohen Act of 1996 (40
U.S.C. 1401 et seq.);
‘‘(D) program performance under sections
1105 and 1115 through 1119 of title 31, and
sections 2801 and 2805 of title 39;
‘‘(E) financial management under chapter
9 of title 31, and the Chief Financial Officers
Act of 1990 (31 U.S.C. 501 note; Public Law
101–576) (and the amendments made by that
Act);
‘‘(F) financial management systems under
the Federal Financial Management Improve-
ment Act (31 U.S.C. 3512 note); and
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31,
United States Code, (known as the ‘Federal
Managers Financial Integrity Act’); and
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)—
‘‘(A) as a material weakness in reporting
under section 3512 of title 31, United States
Code; and
‘‘(B) if relating to financial management
systems, as an instance of a lack of substantial
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512
note).
‘‘(d)(1) In addition to the requirements of subsection
(c), each agency, in consultation with the Director, shall
include as part of the performance plan required under
section 1115 of title 31 a description of—
‘‘(A) the time periods, and
‘‘(B) the resources, including budget, staffing,
and training,
that are necessary to implement the program required
under subsection (b).
‘‘(2) The description under paragraph (1) shall be
based on the risk assessments required under subsection
(b)(2)(1).
‘‘(e) Each agency shall provide the public with timely
notice and opportunities for comment on proposed infor-
mation security policies and procedures to the extent that
such policies and procedures affect communication with
the public.
‘‘§ 3535. Annual independent evaluation
‘‘(a)(1) Each year each agency shall have performed
an independent evaluation of the information security pro-
gram and practices of that agency to determine the effec-
tiveness of such program and practices.
‘‘(2) Each evaluation by an agency under this section
shall include—
‘‘(A) testing of the effectiveness of information
security policies, procedures, and practices of a rep-
resentative subset of the agency’s information sys-
tems;
‘‘(B) an assessment (made on the basis of the
results of the testing) of compliance with—
‘‘(i) the requirements of this subchapter;
and
‘‘(ii) related information security policies,
procedures, standards, and guidelines; and
‘‘(C) separate presentations, as appropriate, re-
garding information security relating to national se-
curity systems.
‘‘(b) Subject to subsection (c)—
‘‘(1) for each agency with an Inspector General
appointed under the Inspector General Act of 1978,
the annual evaluation required by this section shall
be performed by the Inspector General or by an
independent external auditor, as determined by the
Inspector General of the agency; and
‘‘(2) for each agency to which paragraph (1)
does not apply, the head of the agency shall engage
an independent external auditor to perform the eval-
uation.
‘‘(c) For each agency operating or exercising control
of a national security system, that portion of the evalua-
tion required by this section directly relating to a national
security system shall be performed—
‘‘(1) only by an entity designated by the agency
head; and
‘‘(2) in such a manner as to ensure appropriate
protection for information associated with any infor-
mation security vulnerability in such system com-
mensurate with the risk and in accordance with all
applicable laws.
‘‘(d) The evaluation required by this section—
‘‘(1) shall be performed in accordance with gen-
erally accepted government auditing standards; and
‘‘(2) may be based in whole or in part on an
audit, evaluation, or report relating to programs or
practices of the applicable agency.
‘‘(e) The results of an evaluation required by this sec-
tion shall be submitted to the Director no later than
March 1, 2003, and every March 1 thereafter.
‘‘(f) Agencies and evaluators shall take appropriate
steps to ensure the protection of information which, if dis-
closed, may adversely affect information security. Such
protections shall be commensurate with the risk and com-
ply with all applicable laws and regulations.
‘‘(g)(1) The Director shall summarize the results of
the evaluations conducted under this section in a report
to Congress.
‘‘(2) The Director’s report to Congress under this
subsection shall summarize information regarding infor-
mation security relating to national security systems in
such a manner as to ensure appropriate protection for in-
formation associated with any information security vulner-
ability in such system commensurate with the risk and in
accordance with all applicable laws.
‘‘(3) Evaluations and any other descriptions of infor-
mation systems under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
ligence Programs systems under the authority and control
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees
of Congress, in accordance with applicable laws.
‘‘(h) The Comptroller General shall periodically
evaluate and report to Congress on—
‘‘(1) the adequacy and effectiveness of agency
information security policies and practices; and
‘‘(2) implementation of the requirements of this
subchapter.
‘‘§ 3536. Federal information security incident center
‘‘(a) The Director shall cause to be established and
operated a central Federal information security incident
center to—
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems regarding secu-
rity incidents, including guidance on detecting and
handling information security incidents;
‘‘(2) compile and analyze information about in-
cidents that threaten information security;
‘‘(3) inform operators of agency information
systems about current and potential information se-
curity threats, and vulnerabilities; and
‘‘(4) consult with agencies or offices operating
or exercising control of national security systems (in-
cluding the National Security Agency) and such
other agencies or offices in accordance with law and
as directed by the President regarding information
security incidents and related matters.
‘‘(b) Each agency operating or exercising control of
a national security system shall share information about
information security incidents, threats, and vulnerabilities
with the Federal information security incident center to
the extent consistent with standards and guidelines for na-
tional security systems, issued in accordance with law and
as directed by the President.
‘‘§ 3537. National security systems
‘‘The head of each agency operating or exercising
control of a national security system shall be responsible
for ensuring that the agency—
‘‘(1) provides information security protections
commensurate with the risk and magnitude of the
harm resulting from the unauthorized use, disclo-
sure, disruption, modification, or destruction of the
information contained in such system;
‘‘(2) implements information security policies
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and
‘‘(3) complies with the requirements of this sub-
chapter.
‘‘§ 3538. Authorization of appropriations
‘‘There are authorized to be appropriated to carry out
the provisions of this subchapter such sums as may be
necessary for each of fiscal years 2003 through 2007.’’.
(2) CLERICAL AMENDMENT.—The items in the
table of sections at the beginning of such chapter 35
under the heading ‘‘SUBCHAPTER II’’ are amend-
ed to read as follows:
‘‘3531. Purposes.
‘‘3532. Definitions.
‘‘3533. Authority and functions of the Director.
‘‘3534. Federal agency responsibilities.
‘‘3535. Annual independent evaluation.
‘‘3536. Federal information security incident center.
‘‘3537. National security systems.
‘‘3538. Authorization of appropriations.’’.
(c) INFORMATION SECURITY RESPONSIBILITIES OF
CERTAIN AGENCIES.—
(1) NATIONAL SECURITY RESPONSIBILITIES.—
(A) Nothing in this Act (including any amendment
made by this Act) shall supersede any authority of
the Secretary of Defense, the Director of Central In-
telligence, or other agency head, as authorized by
law and as directed by the President, with regard to
the operation, control, or management of national
security systems, as defined by section 3532(3) of
title 44, United States Code.
(B) Section 2224 of title 10, United States
Code, is amended—
(i) in subsection 2224(b), by striking ‘‘(b)
OBJECTIVES AND MINIMUM REQUIREMENTS.—
(1)’’ and inserting ‘‘(b) OBJECTIVES OF THE
PROGRAM.—’’;
(ii) in subsection 2224(b), by striking ‘‘(2)
the program shall at a minimum meet the re-
quirements of section 3534 and 3535 of title
44, United States Code.’’; and
(iii) in subsection 2224(c), by inserting
‘‘, including through compliance with subtitle II