effectiveness of the agency information security pro-
gram, including progress of remedial actions; and 
‘‘(6) ensure that the Chief Information Security 
Officer possesses necessary qualifications, including 
education, professional certifications, training, expe-
rience, and the security clearance required to admin-
ister the functions described under this subchapter; 
and has information security duties as the primary 
duty of that official. 
‘‘(b) AGENCY PROGRAM.—Each agency shall develop, 
document, and implement an agencywide information se-
curity program, approved by the Director of the National 
Office for Cyberspace under section 3555(a)(5), to provide 
information security for the information and information 
infrastructure that support the operations and assets of 
the agency, including those provided or managed by an-
other agency, contractor, or other source, that includes— 
‘‘(1) continuous automated technical monitoring 
of information infrastructure used or operated by an 
agency or by a contractor of an agency or other or-
ganization on behalf of an agency to assure conform-
ance with regulations promulgated under section 
3554 and standards promulgated under section 
3558; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(2) testing of the effectiveness of security con-
trols that are commensurate with risk (as defined by 
the National Institute of Standards and Technology 
and the National Office for Cyberspace) for agency 
information infrastructure; 
‘‘(3) policies and procedures that— 
‘‘(A) mitigate and remediate, to the extent 
practicable, information security vulnerabilities 
based on the risk posed to the agency; 
‘‘(B) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(C) ensure that information security is 
addressed throughout the life cycle of each 
agency information system and information in-
frastructure; 
‘‘(D) ensure compliance with— 
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures as may 
be prescribed by the Director of the Na-
tional Office for Cyberspace, and informa-
tion security standards promulgated under 
section 3558; 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
by the Director of the National Office for 
Cyberspace; and 
‘‘(iv) any other applicable require-
ments, including— 
‘‘(I) standards and guidelines for 
national security systems issued in ac-
cordance with law and as directed by 
the President; 
‘‘(II) the policy of the Director of 
the National Office for Cyberspace; 
‘‘(III) the National Institute of 
Standards and Technology guidance; 
and 
‘‘(IV) the Chief Information Offi-
cers 
Council 
recommended 
ap-
proaches; 
‘‘(E) develop, maintain, and oversee infor-
mation security policies, procedures, and control 
techniques to address all applicable require-
ments, including those issued under sections 
3555 and 3558; and 
‘‘(F) ensure the oversight and training of 
personnel with significant responsibilities for in-
formation security with respect to such respon-
sibilities; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(4) ensuring that the agency has trained and 
cleared personnel sufficient to assist the agency in 
complying with the requirements of this subchapter 
and related policies, procedures, standards, and 
guidelines; 
‘‘(5) to the extent practicable, automated and 
continuous technical monitoring for testing, and 
evaluation of the effectiveness and compliance of in-
formation security policies, procedures, and prac-
tices, including— 
‘‘(A) management, operational, and tech-
nical controls of every information infrastruc-
ture identified in the inventory required under 
section 3505(b); and 
‘‘(B) management, operational, and tech-
nical controls relied on for an evaluation under 
section 3556; 
‘‘(6) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(7) to the extent practicable, continuous auto-
mated technical monitoring for detecting, reporting, 
and responding to security incidents, consistent with 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
standards and guidelines issued by the Director of 
the National Office for Cyberspace, including— 
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
‘‘(B) notifying and consulting with the ap-
propriate security operations response center; 
and 
‘‘(C) notifying and consulting with, as ap-
propriate— 
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspectors General; 
‘‘(ii) the National Office for Cyber-
space; and 
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the 
President; and 
‘‘(8) plans and procedures to ensure continuity 
of operations for information infrastructure that 
support the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.—Each agency shall— 
‘‘(1) submit an annual report on the adequacy 
and effectiveness of information security policies, 
procedures, and practices, and compliance with the 
requirements of this subchapter, including compli-
ance with each requirement of subsection (b) to— 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(A) the National Office for Cyberspace; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
‘‘(D) other appropriate authorization and 
appropriations committees of Congress; and 
‘‘(E) the Comptroller General; 
‘‘(2) address the adequacy and effectiveness of 
information security policies, procedures, and prac-
tices in plans and reports relating to— 
‘‘(A) annual agency budgets; 
‘‘(B) information resources management of 
this subchapter; 
‘‘(C) information technology management 
under this chapter; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and 
sections 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576) (and the amendments made by that 
Act); 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(F) financial management systems under 
the Federal Financial Management Improve-
ment Act (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31; and 
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)— 
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512 
note). 
‘‘(d) PERFORMANCE PLAN.—(1) In addition to the 
requirements of subsection (c), each agency, in consulta-
tion with the National Office for Cyberspace, shall include 
as part of the performance plan required under section 
1115 of title 31 a description of the resources, including 
budget, staffing, and training, that are necessary to imple-
ment the program required under subsection (b). 
‘‘(2) The description under paragraph (1) shall be 
based on the risk assessments required under subsection 
(a)(2). 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(e) PUBLIC NOTICE AND COMMENT.—Each agency 
shall provide the public with timely notice and opportuni-
ties for comment on proposed information security policies 
and procedures to the extent that such policies and proce-
dures affect communication with the public. 
‘‘§ 3557. Annual independent audit 
‘‘(a) IN GENERAL.—(1) Each year each agency shall 
have performed an independent audit of the information 
security program and practices of that agency to deter-
mine the effectiveness of such program and practices. 
‘‘(2) Each audit under this section shall include— 
‘‘(A) testing of the effectiveness of the informa-
tion infrastructure of the agency for automated, con-
tinuous monitoring of the state of compliance of its 
information infrastructure with regulations promul-
gated under section 3554 and standards promul-
gated under section 3558 in a representative subset 
of— 
‘‘(i) the information infrastructure used or 
operated by the agency; and 
‘‘(ii) the information infrastructure used, 
operated, or supported on behalf of the agency 
by a contractor of the agency, a subcontractor 
(at any tier) of such contractor, or any other 
entity; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(B) an assessment (made on the basis of the 
results of the testing) of compliance with— 
‘‘(i) the requirements of this subchapter; 
and 
‘‘(ii) related information security policies, 
procedures, standards, and guidelines; 
‘‘(C) separate assessments, as appropriate, re-
garding information security relating to national se-
curity systems; and 
‘‘(D) a conclusion regarding whether the infor-
mation security controls of the agency are effective, 
including an identification of any significant defi-
ciencies in such controls. 
‘‘(3) Each audit under this section shall be performed 
in accordance with applicable generally accepted Govern-
ment auditing standards. 
‘‘(b) INDEPENDENT
AUDITOR.—Subject to sub-
section (c)— 
‘‘(1) for each agency with an Inspector General 
appointed under the Inspector General Act of 1978 
or any other law, the annual audit required by this 
section shall be performed by the Inspector General 
or by an independent external auditor, as deter-
mined by the Inspector General of the agency; and 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(2) for each agency to which paragraph (1) 
does not apply, the head of the agency shall engage 
an independent external auditor to perform the 
audit. 
‘‘(c) NATIONAL
SECURITY
SYSTEMS.—For each 
agency operating or exercising control of a national secu-
rity system, that portion of the audit required by this sec-
tion directly relating to a national security system shall 
be performed— 
‘‘(1) only by an entity designated head; and 
‘‘(2) in such a manner as to ensure appropriate 
protection for information associated with any infor-
mation security vulnerability in such system com-
mensurate with the risk and in accordance with all 
applicable laws. 
‘‘(d) EXISTING AUDITS.—The audit required by this 
section may be based in whole or in part on another audit 
relating to programs or practices of the applicable agency. 
‘‘(e) AGENCY REPORTING.—(1) Each year, not later 
than such date established by the Director of the National 
Office for Cyberspace, the head of each agency shall sub-
mit to the Director the results of the audit required under 
this section. 
‘‘(2) To the extent an audit required under this sec-
tion directly relates to a national security system, the re-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
sults of the audit submitted to the Director of the Na-
tional Office for Cyberspace shall contain only a summary 
and assessment of that portion of the audit directly relat-
ing to a national security system. 
‘‘(f) PROTECTION OF INFORMATION.—Agencies and 
auditors shall take appropriate steps to ensure the protec-
tion of information which, if disclosed, may adversely af-
fect information security. Such protections shall be com-
mensurate with the risk and comply with all applicable 
laws and regulations. 
‘‘(g) NATIONAL OFFICE FOR CYBERSPACE REPORTS 
TO CONGRESS.—(1) The Director of the National Office 
for Cyberspace shall summarize the results of the audits 
conducted under this section in the annual report to Con-
gress required under section 3555(a)(8). 
‘‘(2) The Director’s report to Congress under this 
subsection shall summarize information regarding infor-
mation security relating to national security systems in 
such a manner as to ensure appropriate protection for in-
formation associated with any information security vulner-
ability in such system commensurate with the risk and in 
accordance with all applicable laws. 
‘‘(3) Audits and any other descriptions of information 
infrastructure under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
ligence Programs systems under the authority and control 
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees 
of Congress, in accordance with applicable laws. 
‘‘(h) COMPTROLLER GENERAL.—The Comptroller 
General shall periodically evaluate and report to Congress 
on— 
‘‘(1) the adequacy and effectiveness of agency 
information security policies and practices; and 
‘‘(2) implementation of the requirements of this 
subchapter. 
‘‘(i) CONTRACTOR AUDITS.—Each year each con-
tractor that operates, uses, or supports an information 
system or information infrastructure on behalf of an agen-
cy and each subcontractor of such contractor— 
‘‘(1) shall conduct an audit using an inde-
pendent external auditor in accordance with sub-
section (a), including an assessment of compliance 
with the applicable requirements of this subchapter; 
and 
‘‘(2) shall submit the results of such audit to 
such agency not later than such date established by 
the Agency. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘§ 3558. Responsibilities for Federal information sys-
tems standards 
‘‘(a) REQUIREMENT TO PRESCRIBE STANDARDS.— 
‘‘(1) IN GENERAL.— 
‘‘(A) REQUIREMENT.—Except as provided 
under paragraph (2), the Secretary of Com-
merce shall, on the basis of proposed standards 
developed by the National Institute of Stand-
ards and Technology pursuant to paragraphs 
(2) and (3) of section 20(a) of the National In-
stitute of Standards and Technology Act (15 
U.S.C. 278g–3(a)) and in consultation with the 
Secretary of Homeland Security, promulgate in-
formation security standards pertaining to Fed-
eral information systems. 
‘‘(B) REQUIRED
STANDARDS.—Standards 
promulgated under subparagraph (A) shall in-
clude— 
‘‘(i) standards that provide minimum 
information security requirements as deter-
mined under section 20(b) of the National 
Institute of Standards and Technology Act 
(15 U.S.C. 278g–3(b)); and 
‘‘(ii) such standards that are other-
wise necessary to improve the efficiency of 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
operation or security of Federal informa-
tion systems. 
‘‘(C) REQUIRED
STANDARDS
BINDING.— 
Information security standards described under 
subparagraph (B) shall be compulsory and 
binding. 
‘‘(2) STANDARDS
AND
GUIDELINES
FOR
NA-
TIONAL SECURITY SYSTEMS.—Standards and guide-
lines for national security systems, as defined under 
section 3552(b), shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law 
and as directed by the President. 
‘‘(b) APPLICATION
OF MORE STRINGENT STAND-
ARDS.—The head of an agency may employ standards for 
the cost-effective information security for all operations 
and assets within or under the supervision of that agency 
that are more stringent than the standards promulgated 
by the Secretary of Commerce under this section, if such 
standards— 
‘‘(1) contain, at a minimum, the provisions of 
those applicable standards made compulsory and 
binding by the Secretary; and 
‘‘(2) are otherwise consistent with policies and 
guidelines issued under section 3555. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(c) REQUIREMENTS REGARDING DECISIONS BY THE 
SECRETARY.— 
‘‘(1) DEADLINE.—The decision regarding the 
promulgation of any standard by the Secretary of 
Commerce under subsection (b) shall occur not later 
than 6 months after the submission of the proposed 
standard to the Secretary by the National Institute 
of Standards and Technology, as provided under sec-
tion 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3). 
‘‘(2) NOTICE
AND
COMMENT.—A decision by 
the Secretary of Commerce to significantly modify, 
or not promulgate, a proposed standard submitted to 
the Secretary by the National Institute of Standards 
and Technology, as provided under section 20 of the 
National Institute of Standards and Technology Act 
(15 U.S.C. 278g–3), shall be made after the public 
is given an opportunity to comment on the Sec-
retary’s proposed decision. 
‘‘§ 3559. Federal information security incident center 
‘‘(a) IN GENERAL.—The Director of the National Of-
fice for Cyberspace shall ensure the operation of a central 
Federal information security incident center to— 
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems and information 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
infrastructure regarding security incidents, including 
guidance on detecting and handling information se-
curity incidents; 
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information 
systems and information infrastructure about cur-
rent and potential information security threats, and 
vulnerabilities; and 
‘‘(4) consult with the National Institute of 
Standards and Technology, agencies or offices oper-
ating or exercising control of national security sys-
tems (including the National Security Agency), and 
such other agencies or offices in accordance with law 
and as directed by the President regarding informa-
tion security incidents and related matters. 
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency 
operating or exercising control of a national security sys-
tem shall share information about information security in-
cidents, threats, and vulnerabilities with the Federal infor-
mation security incident center to the extent consistent 
with standards and guidelines for national security sys-
tems, issued in accordance with law and as directed by 
the President. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(c) REVIEW AND APPROVAL.—In coordination with 
the Administrator for Electronic Government and Infor-
mation Technology, the Director of the National Office for 
Cyberspace shall review and approve the policies, proce-
dures, and guidance established in this subchapter to en-
sure that the incident center has the capability to effec-
tively and efficiently detect, correlate, respond to, contain, 
mitigate, and remediate incidents that impair the ade-
quate security of the information systems and information 
infrastructure of more than one agency. To the extent 
practicable, the capability shall be continuous and tech-
nically automated. 
‘‘§ 3560. National security systems 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(3) complies with the requirements of this sub-
chapter.’’. 
SEC. 102. INFORMATION SECURITY ACQUISITION REQUIRE-
MENTS. 
Chapter 113 of title 40, United States Code, is 
amended by adding at the end of subchapter II the fol-
lowing new section: 
‘‘§ 11319. Information security acquisition require-
ments. 
‘‘(a) PROHIBITION.—Notwithstanding any other pro-
vision of law, beginning one year after the date of the en-
actment of the Executive Cyberspace Coordination Act of 
2011, no agency may enter into a contract, an order under 
a contract, or an interagency agreement for— 
‘‘(1) the collection, use, management, storage, 
or dissemination of information on behalf of the 
agency; 
‘‘(2) the use or operation of an information sys-
tem or information infrastructure on behalf of the 
agency; or 
‘‘(3) information technology; 
unless such contract, order, or agreement includes require-
ments to provide effective information security that sup-
ports the operations and assets under the control of the 
agency, in compliance with the policies, standards, and 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
guidance developed under subsection (b), and otherwise 
ensures compliance with this section. 
‘‘(b) COORDINATION OF SECURE ACQUISITION POLI-
CIES.— 
‘‘(1) IN GENERAL.—The Director of the Office 
of Management and Budget, in consultation with the 
Director of the National Institute of Standards and 
Technology, the Director of the National Office for 
Cyberspace, and the Administrator of General Serv-
ices, shall oversee the development and implementa-
tion of policies, standards, and guidance, including 
through revisions to the Federal Acquisition Regula-
tion and the Department of Defense supplement to 
the Federal Acquisition Regulation, to cost effec-
tively enhance agency information security, includ-
ing— 
‘‘(A) minimum information security re-
quirements for agency procurement of informa-
tion technology products and services; and 
‘‘(B) approaches for evaluating and miti-
gating significant supply chain security risks 
associated with products or services to be ac-
quired by agencies. 
‘‘(2) REPORT.—Not later than two years after 
the date of the enactment of the Executive Cyber-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
space Coordination Act of 2011, the Director of the 
Office of Management and Budget shall submit to 
Congress a report describing— 
‘‘(A) actions taken to improve the informa-
tion security associated with the procurement of 
products and services by the Federal Govern-
ment; and 
‘‘(B) plans for overseeing and coordinating 
efforts of agencies to use best practice ap-
proaches for cost-effectively purchasing more 
secure products and services. 
‘‘(c) VULNERABILITY ASSESSMENTS OF MAJOR SYS-
TEMS.— 
‘‘(1) REQUIREMENT
FOR
INITIAL
VULNER-
ABILITY ASSESSMENTS.—The Director of the Office 
of Management and Budget shall require each agen-
cy to conduct an initial vulnerability assessment for 
any major system and its significant items of supply 
prior to the development of the system. The initial 
vulnerability assessment of a major system and its 
significant items of supply shall include use of an 
analysis-based approach to— 
‘‘(A) identify vulnerabilities; 
‘‘(B) define exploitation potential; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(C) examine the system’s potential effec-
tiveness; 
‘‘(D) determine overall vulnerability; and 
‘‘(E) make recommendations for risk re-
duction. 
‘‘(2) SUBSEQUENT
VULNERABILITY
ASSESS-
MENTS.— 
‘‘(A) The Director shall require a subse-
quent vulnerability assessment of each major 
system and its significant items of supply with-
in a program if the Director determines that 
circumstances warrant the issuance of an addi-
tional vulnerability assessment. 
‘‘(B) Upon the request of a congressional 
committee, the Director may require a subse-
quent vulnerability assessment of a particular 
major system and its significant items of supply 
within the program. 
‘‘(C) Any subsequent vulnerability assess-
ment of a major system and its significant 
items of supply shall include use of an analysis- 
based approach and, if applicable, a testing- 
based approach, to monitor the exploitation po-
tential of such system and reexamine the fac-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
tors described in subparagraphs (A) through 
(E) of paragraph (1). 
‘‘(3) CONGRESSIONAL OVERSIGHT.—The Direc-
tor shall provide to the appropriate congressional 
committees a copy of each vulnerability assessment 
conducted under paragraph (1) or (2) not later than 
10 days after the date of the completion of such as-
sessment. 
‘‘(d) DEFINITIONS.—In this section: 
‘‘(1) ITEM OF SUPPLY.—The term ‘item of sup-
ply’— 
‘‘(A) means any individual part, compo-
nent, subassembly, assembly, or subsystem inte-
gral to a major system, and other property 
which may be replaced during the service life of 
the major system, including a spare part or re-
plenishment part; and 
‘‘(B) does not include packaging or label-
ing associated with shipment or identification of 
an item. 
‘‘(2) VULNERABILITY ASSESSMENT.—The term 
‘vulnerability assessment’ means the process of iden-
tifying and quantifying vulnerabilities in a major 
system and its significant items of supply. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(3) MAJOR SYSTEM.—The term ‘major system’ 
has the meaning given that term in section 4 of the 
Office of Federal Procurement Policy Act (41 U.S.C. 
403).’’. 
SEC. 103. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) TABLE OF SECTIONS IN TITLE 44.—The table 
of sections for chapter 35 of title 44, United States Code, 
is amended by striking the matter relating to subchapters 
II and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. National Office for Cyberspace. 
‘‘3554. Federal Cybersecurity Practice Board. 
‘‘3555. Authority and functions of the Director of the National Office for 
Cyberspace. 
‘‘3556. Agency responsibilities. 
‘‘3557. Annual independent audit. 
‘‘3558. Responsibilities for Federal information systems standards. 
‘‘3559. Federal information security incident center. 
‘‘3560. National security systems.’’. 
(b) TABLE OF SECTIONS IN TITLE 40.—The table 
of sections for chapter 113 of title 40, United States Code, 
is amended by inserting after the item relating to section 
11318 the following new item: 
‘‘Sec. 11319. Information security acquisition requirements.’’. 
(c) OTHER REFERENCES.— 
(1) Section 1001(c)(1)(A) of the Homeland Se-
curity Act of 2002 (6 U.S.C. 511(c)(1)(A)) is 
amended by striking ‘‘section 3532(3)’’ and insert-
ing ‘‘section 3552(b)’’. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(2) Section 2222(j)(6) of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2))’’ 
and inserting ‘‘section 3552(b)’’. 
(3) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2))’’ and inserting ‘‘section 3552(b)’’. 
(4) Section 2315 of title 10, United States 
Code, is amended by striking ‘‘section 3542(b)(2))’’ 
and inserting ‘‘section 3552(b)’’. 
(5) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–3) 
is amended— 
(A) in subsections (a)(2) and (e)(5), by 
striking ‘‘section 3532(b)(2)’’ and inserting 
‘‘section 3552(b)’’; 
(B) in subsection (e)(2), by striking ‘‘sec-
tion 3532(1)’’ and inserting ‘‘section 3552(b)’’; 
and 
(C) in subsections (c)(3) and (d)(1), by 
striking ‘‘section 11331 of title 40’’ and insert-
ing ‘‘section 3558 of title 44’’. 
(6) Section 8(d)(1) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7406(d)(1)) 
is amended by striking ‘‘section 3534(b)’’ and in-
serting ‘‘section 3556(b)’’. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(d) REPEAL.— 
(1) Subchapter III of chapter 113 of title 40, 
United States Code, is repealed. 
(2) The table of sections for chapter 113 of 
such title is amended by striking the matter relating 
to subchapter III. 
(e) EXECUTIVE
SCHEDULE
PAY
RATE.—Section 
5314 of title 5, United States Code, is amended by adding 
at the end the following: 
‘‘Director of the National Office for Cyber-
space.’’. 
(f) MEMBERSHIP
ON
THE NATIONAL SECURITY 
COUNCIL.—Section 101(a) of the National Security Act 
of 1947 (50 U.S.C. 402(a)) is amended— 
(1) by redesignating paragraphs (7) and (8) as 
paragraphs (8) and (9), respectively; and 
(2) by inserting after paragraph (6) the fol-
lowing: 
‘‘(7) the Director of the National Office for 
Cyberspace;’’. 
SEC. 104. EFFECTIVE DATE. 
(a) IN GENERAL.—Unless otherwise specified in this 
section, this title (including the amendments made by this 
title) shall take effect 30 days after the date of enactment 
of this Act. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(b) NATIONAL OFFICE FOR CYBERSPACE.—Section 
3553 of title 44, United States Code, as added by section 
101 of this title, shall take effect 180 days after the date 
of enactment of this Act. 
(c) FEDERAL CYBERSECURITY PRACTICE BOARD.— 
Section 3554 of title 44, United States Code, as added 
by section 101 of this title, shall take effect one year after 
the date of enactment of this Act. 
TITLE II—FEDERAL CHIEF 
TECHNOLOGY OFFICER 
SEC. 201. OFFICE OF THE CHIEF TECHNOLOGY OFFICER. 
(a) ESTABLISHMENT AND STAFF.— 
(1) ESTABLISHMENT.— 
(A) IN GENERAL.—There is established in 
the Executive Office of the President an Office 
of the Federal Chief Technology Officer (in this 
section referred to as the ‘‘Office’’). 
(B) HEAD OF THE OFFICE.— 
(i) FEDERAL CHIEF TECHNOLOGY OF-
FICER.—The President shall appoint a 
Federal Chief Technology Officer (in this 
section referred to as the ‘‘Federal CTO’’) 
who shall be the head of the Office. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(ii) COMPENSATION.—Section 5314 of 
title 5, United States Code, is amended by 
adding at the end the following: 
‘‘Federal Chief Technology Officer.’’. 
(2) STAFF
OF
THE
OFFICE.—The President 
may appoint additional staff members to the Office. 
(b) DUTIES OF THE OFFICE.—The functions of the 
Federal CTO are the following: 
(1) Undertake fact-gathering, analysis, and as-
sessment of the Federal Government’s information 
technology infrastructures, information technology 
strategy, and use of information technology, and 
provide advice on such matters to the President, 
heads of Federal departments and agencies, and 
government chief information officers and chief tech-
nology officers. 
(2) Lead an interagency effort, working with 
the chief technology and chief information officers of 
each of the Federal departments and agencies, to de-
velop and implement a planning process to ensure 
that they use best-in-class technologies, share best 
practices, and improve the use of technology in sup-
port of Federal Government requirements. 
(3) Advise the President on information tech-
nology considerations with regard to Federal budg-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
ets and with regard to general coordination of the 
research and development programs of the Federal 
Government for information technology-related mat-
ters. 
(4) Promote technological innovation in the 
Federal Government, and encourage and oversee the 
adoption of robust cross-governmental architectures 
and standards-based information technologies, in 
support of effective operational and management 
policies, practices, and services across Federal de-
partments and agencies and with the public and ex-
ternal entities. 
(5) Establish cooperative public-private sector 
partnership initiatives to achieve knowledge of tech-
nologies available in the marketplace that can be 
used for improving governmental operations and in-
formation technology research and development ac-
tivities. 
(6) Gather timely and authoritative information 
concerning significant developments and trends in 
information technology, and in national priorities, 
both current and prospective, and analyze and inter-
pret the information for the purpose of determining 
whether the developments and trends are likely to 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
affect achievement of the priority goals of the Fed-
eral Government. 
(7) Develop, review, revise, and recommend cri-
teria for determining information technology activi-
ties warranting Federal support, and recommend 
Federal policies designed to advance the develop-
ment and maintenance of effective and efficient in-
formation technology capabilities, including human 
resources, at all levels of government, academia, and 
industry, and the effective application of the capa-
bilities to national needs. 
(8) Any other functions and activities that the 
President may assign to the Federal CTO. 
(c) POLICY PLANNING; ANALYSIS AND ADVICE.—The 
Office shall serve as a source of analysis and advice for 
the President and heads of Federal departments and agen-
cies with respect to major policies, plans, and programs 
of the Federal Government in accordance with the func-
tions described in subsection (b). 
(d) COORDINATION OF THE OFFICE WITH OTHER 
ENTITIES.— 
(1) FEDERAL CTO ON DOMESTIC POLICY COUN-
CIL.—The Federal CTO shall be a member of the 
Domestic Policy Council. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(2) FEDERAL CTO ON CYBER SECURITY PRAC-
TICE BOARD.—The Federal CTO shall be a member 
of the Federal Cybersecurity Practice Board. 
(3) OBTAIN INFORMATION FROM AGENCIES.— 
The Office may secure, directly from any depart-
ment or agency of the United States, information 
necessary to enable the Federal CTO to carry out 
this section. On request of the Federal CTO, the 
head of the department or agency shall furnish the 
information to the Office, subject to any applicable 
limitations of Federal law. 
(4) STAFF
OF
FEDERAL
AGENCIES.—On re-
quest of the Federal CTO, to assist the Office in 
carrying out the duties of the Office, the head of any 
Federal department or agency may detail personnel, 
services, or facilities of the department or agency to 
the Office. 
(e) ANNUAL REPORT.— 
(1) PUBLICATION AND CONTENTS.—The Fed-
eral CTO shall publish, in the Federal Register and 
on a public Internet website of the Federal CTO, an 
annual report that includes the following: 
(A) Information on programs to promote 
the development of technological innovations. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(B) Recommendations for the adoption of 
policies to encourage the generation of techno-
logical innovations. 
(C) Information on the activities and ac-
complishments of the Office in the year covered 
by the report. 
(2) SUBMISSION.—The Federal CTO shall sub-
mit each report under paragraph (1) to— 
(A) the President; 
(B) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; 
(C) the Committee on Science and Tech-
nology of the House of Representatives; and 
(D) the Committee on Commerce, Science, 
and Transportation of the Senate. 
TITLE III—STRENGTHENING CY-
BERSECURITY FOR CRITICAL 
INFRASTRUCTURE 
SEC. 301. DEFINITIONS. 
In this title: 
(1) 
CRITICAL
INFORMATION
INFRASTRUC-
TURE.—The term ‘‘critical information infrastruc-
ture’’ means the electronic information and commu-
nications systems, software, and assets that control, 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
protect, process, transmit, receive, program, or store 
information in any form, including data, voice, and 
video, relied upon by critical infrastructure, indus-
trial control systems such as supervisory control and 
data acquisition systems, and programmable logic 
controllers. This shall also include such systems of 
the Federal Government. 
(2) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Homeland Security. 
SEC. 302. AUTHORITY OF SECRETARY. 
(a) IN GENERAL.—The Secretary shall have primary 
authority, in consultation with the Director of the Na-
tional Office for Cyberspace and the Federal Cyberspace 
Practice Board, in the executive branch of the Federal 
Government in creation, verification, and enforcement of 
measures with respect to the protection of critical informa-
tion infrastructure, including promulgating risk-informed 
information security practices and standards applicable to 
critical information infrastructures that are not owned by 
or under the direct control of the Federal Government. 
The Secretary should consult with appropriate private sec-
tor entities, including private owners and operators of the 
affected infrastructure, to carry out this section. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(b) OTHER FEDERAL AGENCIES.—In establishing 
measures with respect to the protection of critical informa-
tion infrastructure the Secretary shall— 
(1) consult with the Secretary of Commerce, the 
Secretary of Defense, the National Institute of 
Standards and Technology, and other sector specific 
Federal regulatory agencies in exercising the author-
ity referred to in subsection (a); and 
(2) coordinate, though the Executive Office of 
the President, with sector specific Federal regulatory 
agencies, including the Federal Energy Regulatory 
Commission, in establishing enforcement mecha-
nisms under the authority referred to in subsection 
(a). 
(c) AUDITING AUTHORITY.—The Secretary may— 
(1) conduct such audits as are necessary to en-
sure that appropriate measures are taken to secure 
critical information infrastructure; 
(2) issue such subpoenas as are necessary to 
determine compliance with Federal regulatory re-
quirements for securing critical information infra-
structure; and 
(3) authorize sector specific Federal regulatory 
agencies to undertake such audits. 
Æ 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6301
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS