308
of Management and Budget, the Departments of
Defense and Energy, the National Security Agency,
the General Accounting Office, and the Secretary of
Homeland Security) to assure—
‘‘(A) use of appropriate information secu-
rity policies, procedures, and techniques, in
order to improve information security and avoid
unnecessary and costly duplication of effort;
and
‘‘(B) that such standards and guidelines
are complementary with standards and guide-
lines employed for the protection of national se-
curity systems and information contained in
such systems;
‘‘(2) provide the public with an opportunity to
comment on proposed standards and guidelines;
‘‘(3) submit to the Director of the Office of
Management and Budget for promulgation under
section 5131 of the Clinger-Cohen Act of 1996 (40
U.S.C. 1441)—
‘‘(A) standards, as required under sub-
section (b)(1)(A), no later than 12 months after
the date of the enactment of this section; and
‘‘(B) minimum information security re-
quirements for each category, as required under
309
subsection (b)(1)(C), no later than 36 months
after the date of the enactment of this section;
‘‘(4) issue guidelines as required under sub-
section (b)(1)(B), no later than 18 months after the
date of the enactment of this Act;
‘‘(5) ensure that such standards and guidelines
do not require specific technological solutions or
products, including any specific hardware or soft-
ware security solutions;
‘‘(6) ensure that such standards and guidelines
provide for sufficient flexibility to permit alternative
solutions to provide equivalent levels of protection
for identified information security risks; and
‘‘(7) use flexible, performance-based standards
and guidelines that, to the greatest extent possible,
permit the use of off-the-shelf commercially devel-
oped information security products.
‘‘(d) The Institute shall—
‘‘(1) submit standards developed pursuant to
subsection (a), along with recommendations as to
the extent to which these should be made compul-
sory and binding, to the Director of the Office of
Management and Budget for promulgation under
section 5131 of the Clinger-Cohen Act of 1996 (40
U.S.C. 1441);
310
‘‘(2) provide assistance to agencies regarding—
‘‘(A) compliance with the standards and
guidelines developed under subsection (a);
‘‘(B) detecting and handling information
security incidents; and
‘‘(C) information security policies, proce-
dures, and practices;
‘‘(3) conduct research, as needed, to determine
the nature and extent of information security
vulnerabilities and techniques for providing cost-ef-
fective information security;
‘‘(4) develop and periodically revise performance
indicators and measures for agency information se-
curity policies and practices;
‘‘(5) evaluate private sector information secu-
rity policies and practices and commercially available
information technologies to assess potential applica-
tion by agencies to strengthen information security;
‘‘(6) evaluate security policies and practices de-
veloped for national security systems to assess po-
tential application by agencies to strengthen infor-
mation security;
‘‘(7) periodically assess the effectiveness of
standards and guidelines developed under this sec-
tion and undertake revisions as appropriate;
311
‘‘(8) solicit and consider the recommendations
of the Information Security and Privacy Advisory
Board, established by section 21, regarding stand-
ards and guidelines developed under subsection (a)
and submit such recommendations to the Director of
the Office of Management and Budget with such
standards submitted to the Director; and
‘‘(9) prepare an annual public report on activi-
ties undertaken in the previous year, and planned
for the coming year, to carry out responsibilities
under this section.
‘‘(e) As used in this section—
‘‘(1) the term ‘agency’ has the same meaning as
provided in section 3502(1) of title 44, United
States Code;
‘‘(2) the term ‘information security’ has the
same meaning as provided in section 3532(1) of
such title;
‘‘(3) the term ‘information system’ has the
same meaning as provided in section 3502(8) of
such title;
‘‘(4) the term ‘information technology’ has the
same meaning as provided in section 5002 of the
Clinger-Cohen Act of 1996 (40 U.S.C. 1401); and
312
‘‘(5) the term ‘national security system’ has the
same meaning as provided in section 3532(b)(2) of
such title.’’.
SEC. 1104. INFORMATION SECURITY AND PRIVACY ADVI-
SORY BOARD.
Section 21 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–4), is amended—
(1) in subsection (a), by striking ‘‘Computer
System Security and Privacy Advisory Board’’ and
inserting ‘‘Information Security and Privacy Advi-
sory Board’’;
(2) in subsection (a)(1), by striking ‘‘computer
or telecommunications’’ and inserting ‘‘information
technology’’;
(3) in subsection (a)(2)—
(A) by striking ‘‘computer or telecommuni-
cations technology’’ and inserting ‘‘information
technology’’; and
(B) by striking ‘‘computer or telecommuni-
cations equipment’’ and inserting ‘‘information
technology’’;
(4) in subsection (a)(3)—
(A) by striking ‘‘computer systems’’ and
inserting ‘‘information system’’; and
313
(B) by striking ‘‘computer systems secu-
rity’’ and inserting ‘‘information security’’;
(5) in subsection (b)(1) by striking ‘‘computer
systems security’’ and inserting ‘‘information secu-
rity’’;
(6) in subsection (b) by striking paragraph (2)
and inserting the following:
‘‘(2) to advise the Institute and the Director of
the Office of Management and Budget on informa-
tion security and privacy issues pertaining to Fed-
eral Government information systems, including
through review of proposed standards and guidelines
developed under section 20; and’’;
(7) in subsection (b)(3) by inserting ‘‘annually’’
after ‘‘report’’;
(8) by inserting after subsection (e) the fol-
lowing new subsection:
‘‘(f) The Board shall hold meetings at such locations
and at such time and place as determined by a majority
of the Board.’’;
(9) by redesignating subsections (f) and (g) as
subsections (g) and (h), respectively; and
(10) by striking subsection (h), as redesignated
by paragraph (9), and inserting the following:
314
‘‘(h) As used in this section, the terms ‘‘information
system’’ and ‘‘information technology’’ have the meanings
given in section 20.’’.
SEC. 1105. TECHNICAL AND CONFORMING AMENDMENTS.
(a) COMPUTER SECURITY ACT.—Sections 5 and 6 of
the Computer Security Act of 1987 (40 U.S.C. 1441 note)
are repealed.
(b) FLOYD D. SPENCE NATIONAL DEFENSE AU-
THORIZATION ACT FOR FISCAL YEAR 2001.—The Floyd
D. Spence National Defense Authorization Act for Fiscal
Year 2001 (Public Law 106–398) is amended by striking
subtitle G of title X.
(c) PAPERWORK
REDUCTION
ACT.—(1) Section
3504(g) of title 44, United States Code, is amended—
(A) by adding ‘‘and’’ at the end of paragraph
(1);
(B) in paragraph (2)—
(i) by striking ‘‘sections 5 and 6 of the
Computer Security Act of 1987 (40 U.S.C. 759
note)’’ and inserting ‘‘subchapter II of this
title’’; and
(ii) by striking the semicolon and inserting
a period; and
(C) by striking paragraph (3).
315
(2) Section 3505 of such title is amended by adding
at the end—
‘‘(c)(1) The head of each agency shall develop and
maintain an inventory of the information systems (includ-
ing national security systems) operated by or under the
control of such agency;
‘‘(2) The identification of information systems in an
inventory under this subsection shall include an identifica-
tion of the interfaces between each such system and all
other systems or networks, including those not operated
by or under the control of the agency;
‘‘(3) Such inventory shall be—
‘‘(A) updated at least annually;
‘‘(B) made available to the Comptroller Gen-
eral; and
‘‘(C) used to support information resources
management, including—
‘‘(i) preparation and maintenance of the
inventory of information resources under sec-
tion 3506(b)(4);
‘‘(ii) 
information 
technology 
planning,
budgeting, acquisition, and management under
section 3506(h), the Clinger-Cohen Act of
1996, and related laws and guidance;
316
‘‘(iii) monitoring, testing, and evaluation of
information security controls under subchapter
II;
‘‘(iv) preparation of the index of major in-
formation systems required under section
552(g) of title 5, United States Code; and
‘‘(v) preparation of information system in-
ventories required for records management
under chapters 21, 29, 31, and 33.
‘‘(4) The Director shall issue guidance for and over-
see the implementation of the requirements of this sub-
section.’’.
(3) Section 3506(g) of such title is amended—
(A) by adding ‘‘and’’ at the end of paragraph
(1);
(B) in paragraph (2)—
(i) by striking ‘‘the Computer Security Act
of 1987 (40 U.S.C. 759 note)’’ and inserting
‘‘subchapter II of this title’’; and
(ii) by striking the semicolon and inserting
a period; and
(C) by striking paragraph (3).
SEC. 1106. CONSTRUCTION.
Nothing in this Act, or the amendments made by this
Act, affects the authority of the National Institute of
317
Standards and Technology or the Department of Com-
merce relating to the development and promulgation of
standards or guidelines under paragraphs (1) and (2) of
section 20(a) of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3(a)).
Passed the House of Representatives July 26, 2002.
Attest:
Clerk.
107TH CONGRESS
2D SESSION
H. R. 5005
AN ACT
To establish the Department of Homeland Security,
and for other purposes.