of chapter 35 of title 44’’ after ‘‘infrastruc-
ture’’.
(2) ATOMIC ENERGY ACT OF 1954.—Nothing in
this Act shall supersede any requirement made by or
under the Atomic Energy Act of 1954 (42 U.S.C.
2011 et seq.). Restricted Data or Formerly Re-
stricted Data shall be handled, protected, classified,
downgraded, and declassified in conformity with the
Atomic Energy Act of 1954 (42 U.S.C. 2011 et
seq.).
SEC. 2. MANAGEMENT OF INFORMATION TECHNOLOGY.
Section 5131 of the Clinger-Cohen Act of 1996 (40
U.S.C. 1441) is amended to read as follows:
‘‘SEC. 5131. RESPONSIBILITIES FOR FEDERAL INFORMA-
TION SYSTEMS STANDARDS.
‘‘(a)(1)(A) Except as provided under paragraph (3),
the Director of the Office of Management and Budget
shall, on the basis of standards and guidelines developed
by the National Institute of Standards and Technology
pursuant to paragraphs (2) and (3) of section 20(a) of
the National Institute of Standards and Technology Act
(15 U.S.C. 278g–3(a)) and in consultation with the Sec-
retary of Commerce, promulgate standards and guidelines
pertaining to Federal information systems.
‘‘(B) Standards promulgated under subparagraph
(A) shall include—
‘‘(i) standards that provide minimum informa-
tion security requirements as determined under sec-
tion 20(b) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(b)); and
‘‘(ii) such standards that are otherwise nec-
essary to improve the efficiency of operation or secu-
rity of Federal information systems.
‘‘(C) Standards described under subparagraph (B)
shall be compulsory and binding.
‘‘(D) The President may disapprove or modify such
standards and guidelines if the President determines such
action to be in the public interest. The President’s author-
ity to disapprove or modify such standards and guidelines
may not be delegated. Notice of such disapproval or modi-
fication shall be published promptly in the Federal Reg-
ister. Upon receiving notice of such disapproval or modi-
fication, the Director shall immediately rescind or modify
such standards or guidelines as directed by the President.
‘‘(2) Standards and guidelines for national security
systems, as defined under section 3532(3) of title 44,
United States Code, shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law and
as directed by the President.
‘‘(b) The head of an agency may employ standards
for the cost-effective information security for all oper-
ations and assets within or under the supervision of that
agency that are more stringent than the standards pro-
mulgated by the Director under this section, if such
standards—
‘‘(1) contain, at a minimum, the provisions of
those applicable standards made compulsory and
binding by the Director; and
‘‘(2) are otherwise consistent with policies and
guidelines issued under section 3533 of title 44,
United States Code.
‘‘(c) The promulgation of any standard or guideline
by the Director under subsection (a), and the disapproval
of any standard or guideline by the President under sub-
section (a)(1)(C), shall occur no later than 6 months after
the submission of such standard or guideline to the Direc-
tor by the National Institute of Standards and Tech-
nology, as provided under section 20 of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 278g–
3).’’.
SEC. 3. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), is amended by strik-
ing the text and inserting the following:
‘‘(a) The Institute shall—
‘‘(1) have the mission of developing standards,
guidelines, and associated methods and techniques
for information systems;
‘‘(2) develop standards and guidelines, includ-
ing minimum requirements, for information systems
used or operated by an agency or by a contractor of
an agency or other organization on behalf of an
agency, other than national security systems (as de-
fined in section 3532(b)(2) of title 44, United States
Code); and
‘‘(3) develop standards and guidelines, includ-
ing minimum requirements, for providing adequate
information security for all agency operations and
assets, but such standards and guidelines shall not
apply to national security systems.
‘‘(b) The standards and guidelines required by sub-
section (a) shall include, at a minimum—
‘‘(1)(A) standards to be used by all agencies to
categorize all information and information systems
collected or maintained by or on behalf of each agen-
cy based on the objectives of providing appropriate
levels of information integrity, confidentiality, and
availability according to a range of risk levels;
‘‘(B) guidelines recommending the types of in-
formation and information systems to be included in
each such category; and
‘‘(C) minimum information security require-
ments for information and information systems in
each such category;
‘‘(2) a definition of and guidelines concerning
detection and handling of information security inci-
dents; and
‘‘(3) guidelines for identifying an information
system as a national security system.
‘‘(c) In developing standards and guidelines required
by subsection (a), the Institute shall—
‘‘(1) consult with other agencies and offices (in-
cluding, but not limited to, the Director of the Office
of Management and Budget, the Departments of
Defense and Energy, the National Security Agency,
and the General Accounting Office) to assure—
‘‘(A) use of appropriate information secu-
rity policies, procedures, and techniques, in
order to improve information security and avoid
unnecessary and costly duplication of effort;
and
‘‘(B) that such standards and guidelines
are complementary with standards and guide-
lines employed for the protection of national se-
curity systems and information contained in
such systems;
‘‘(2) submit to the Director of the Office of
Management and Budget for promulgation under
section 5131 of the Clinger-Cohen Act of 1996 (40
U.S.C. 1441)—
‘‘(A) standards, as required under sub-
section (b)(1)(A), no later than 12 months after
the date of the enactment of this section;
‘‘(B) guidelines, as required under sub-
section (b)(1)(B), no later than 18 months after
the date of the enactment of this Act; and
‘‘(C) minimum information security re-
quirements for each category, as required under
subsection (b)(1)(C), no later than 36 months
after the date of the enactment of this section;
and
‘‘(3) emphasize the development of policies and
procedures that do not require specific technical so-
lutions or products.
‘‘(d)(1) There is established in the Institute an Office
for Information Security Programs.
‘‘(2) The Office for Information Security Programs
shall be headed by a Director, who shall be a senior execu-
tive and shall be compensated at a level in the Senior Ex-
ecutive Service under section 5382 of title 5, United
States Code, as determined by the Secretary of Commerce.
‘‘(3) The Director of the Institute shall delegate to
the Director of the Office of Information Security Pro-
grams the authority to administer all functions under this
section, except that any such delegation shall not relieve
the Director of the Institute of responsibility for the ad-
ministration of such functions. The Director of the Office
of Information Security Programs shall serve as principal
adviser to the Director of the Institute on all functions
under this section.
‘‘(e) The Institute shall—
‘‘(1) submit standards and guidelines developed
pursuant to subsection (a), along with recommenda-
tions as to the extent to which these should be made
compulsory and binding, to the Director of the Of-
fice of Management and Budget for promulgation
under section 5131 of the Clinger-Cohen Act of
1996 (40 U.S.C. 1441);
‘‘(2) provide assistance to agencies regarding—
agement and Budget with such standards and guide-
lines submitted to the Director; and
‘‘(7) report annually to the Director of the Of-
fice of Management and Budget on—
‘‘(A) compliance with the requirements of
this section, the Clinger-Cohen Act of 1996 (40
U.S.C. 1401 et seq.), and other related require-
ments;
‘‘(B) major deficiencies in Federal infor-
mation security; and
‘‘(C) recommendations to improve Federal
information security.
‘‘(f) As used in this section—
‘‘(1) the term ‘agency’ has the same meaning as
provided in section 3502(1) of title 44, United
States Code;
‘‘(2) the term ‘information security’ has the
same meaning as provided in section 3532(1) of
such title;
‘‘(3) the term ‘information system’ has the
same meaning as provided in section 3502(8) of
such title;
‘‘(4) the term ‘information technology’ has the
same meaning as provided in section 5002 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1401); and
‘‘(5) the term ‘national security system’ has the
same meaning as provided in section 3532(b)(2) of
such title.
‘‘(g) There are authorized to be appropriated to the
Secretary of Commerce $20,000,000 for each of fiscal
years 2003, 2004, 2005, 2006, and 2007 to enable the
National Institute of Standards and Technology to carry
out the provisions of this section.’’.
SEC. 4. INFORMATION SECURITY ADVISORY BOARD.
Section 21 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–4), is amended—
(1) in subsection (a), by striking ‘‘Computer
System Security and Privacy Advisory Board’’ and
inserting ‘‘Information Security Advisory Board’’;
(2) in subsection (a)(1), by striking ‘‘computer
or telecommunications’’ and inserting ‘‘information
technology’’;
(3) in subsection (a)(2)—
(A) by striking ‘‘computer or telecommuni-
cations technology’’ and inserting ‘‘information
technology’’; and
(B) by striking ‘‘computer or telecommuni-
cations equipment’’ and inserting ‘‘information
technology’’;
(4) in subsection (a)(3)—
(A) by striking ‘‘computer systems’’ and
inserting ‘‘information system’’; and
(B) by striking ‘‘computer systems security
and privacy’’ and inserting ‘‘information secu-
rity’’;
(5) in subsection (b)(1) by striking ‘‘computer
systems security and privacy’’ and inserting ‘‘infor-
mation security’’;
(6) in subsection (b) by striking paragraph (2)
and inserting the following:
‘‘(2) to advise the Institute and the Director of
the Office of Management and Budget on informa-
tion security issues pertaining to Federal Govern-
ment information systems, including through review
of proposed standards and guidelines developed by
the Director of the National Institute of Standards
and Technology under section 20; and’’;
(7) in subsection (b)(3) by inserting ‘‘annually’’
after ‘‘report’’;
(8) by inserting after subsection (e) the fol-
lowing new subsection:
‘‘(f) The Board shall hold meetings at such locations
and at such time and place as determined by a majority
of the Board.’’;
(9) by redesignating subsections (f) and (g) as
subsections (g) and (h), respectively;
(10) by striking subsection (h), as redesignated
by paragraph (9), and inserting the following:
‘‘(h) As used in this section, the terms ‘‘information
system’’ and ‘‘information technology’’ have the meanings
given in section 20.’’; and
(11) by inserting at the end the following:
‘‘(i) There are authorized to be appropriated to the
Secretary of Commerce $1,250,000 for each of fiscal years
2003, 2004, 2005, 2006, and 2007 to enable the Informa-
tion Security Advisory Board to identify emerging issues
related to information security, and to convene public
meetings on those subjects, receive presentations, and
publish reports and recommendations for public distribu-
tion.’’.
SEC. 5. TECHNICAL AND CONFORMING AMENDMENTS.
(a) COMPUTER SECURITY ACT.—Sections 5 and 6 of
the Computer Security Act of 1987 (40 U.S.C. 1441 note)
are repealed.
(b) FLOYD D. SPENCE NATIONAL DEFENSE AU-
THORIZATION ACT FOR FISCAL YEAR 2001.—The Floyd
D. Spence National Defense Authorization Act for Fiscal
Year 2001 (Public Law 106–398) is amended by striking
subtitle G of title X.