‘‘(II) involves cryptologic activities re-
lated to national security; 
‘‘(III) involves command and control 
of military forces; 
‘‘(IV) involves equipment that is an 
integral part of a weapon or weapons sys-
tem; or 
‘‘(V) subject to subparagraph (B), is 
critical to the direct fulfillment of military 
or intelligence missions; or 
‘‘(ii) is protected at all times by procedures 
established for information that have been spe-
cifically authorized under criteria established by 
an Executive order or an Act of Congress to be 
kept classified in the interest of national de-
fense or foreign policy. 
‘‘(B) Subparagraph (A)(i)(V) does not include a 
system that is to be used for routine administrative 
and business applications (including payroll, finance, 
logistics, and personnel management applications). 
‘‘§ 3553. National Office for Cyberspace 
‘‘(a) ESTABLISHMENT.—There is established within 
the Executive Office of the President an office to be known 
as the National Office for Cyberspace. 
‘‘(b) DIRECTOR.— 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(1) IN GENERAL.—There shall be at the head 
of the National Office for Cyberspace a Director, 
who shall be appointed by the President by and with 
the advice and consent of the Senate. The Director 
of the National Office for Cyberspace shall admin-
ister all functions designated to such Director under 
this subchapter and collaborate to the extent prac-
ticable with the heads of appropriate agencies, the 
private sector, and international partners. The Of-
fice shall serve as the principal office for coordi-
nating issues relating to cyberspace, including 
achieving an assured, reliable, secure, and survivable 
information infrastructure and related capabilities 
for the Federal Government, while promoting na-
tional economic interests, security, and civil liberties. 
‘‘(2) BASIC PAY.—The Director of the National 
Office for Cyberspace shall be paid at the rate of 
basic pay for level III of the Executive Schedule. 
‘‘(c) STAFF.—The Director of the National Office for 
Cyberspace may appoint and fix the pay of additional per-
sonnel as the Director considers appropriate. 
‘‘(d) EXPERTS AND CONSULTANTS.—The Director of 
the National Office for Cyberspace may procure temporary 
and intermittent services under section 3109(b) of title 5. 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘§ 3554. Federal Cybersecurity Practice Board 
‘‘(a) ESTABLISHMENT.—Within the National Office 
for Cyberspace, there shall be established a board to be 
known as the ‘Federal Cybersecurity Practice Board’ (in 
this section referred to as the ‘Board’). 
‘‘(b) MEMBERS.—The Board shall be chaired by the 
Director of the National Office for Cyberspace and consist 
of not more than 10 members, with at least one represent-
ative from— 
‘‘(1) the Office of Management and Budget; 
‘‘(2) civilian agencies; 
‘‘(3) the Department of Defense; 
‘‘(4) the Federal law enforcement community; 
‘‘(5) the Federal Chief Technology Office; and 
‘‘(6) such additional military and civilian agen-
cies as the Director considers appropriate. 
‘‘(c) RESPONSIBILITIES.— 
‘‘(1) DEVELOPMENT OF POLICIES AND PROCE-
DURES.—Subject to the authority, direction, and 
control of the Director of the National Office for 
Cyberspace, the Board shall be responsible for devel-
oping and periodically updating information security 
policies and procedures relating to the matters de-
scribed in paragraph (2). In developing such policies 
and procedures, the Board shall require that all 
matters addressed in the policies and procedures are 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
consistent, to the maximum extent practicable and 
in accordance with applicable law, among the civil-
ian, military, intelligence, and law enforcement com-
munities. 
‘‘(2) SPECIFIC MATTERS COVERED IN POLICIES 
AND PROCEDURES.— 
‘‘(A) MINIMUM
SECURITY
CONTROLS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to minimum se-
curity controls for information technology, in 
order to— 
‘‘(i) provide Governmentwide protec-
tion of Government-networked computers 
against common attacks; and 
‘‘(ii) provide agencywide protection 
against threats, vulnerabilities, and other 
risks to the information infrastructure 
within individual agencies. 
‘‘(B) MEASURES
OF
EFFECTIVENESS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to measure-
ments needed to assess the effectiveness of the 
minimum security controls referred to in sub-
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
paragraph (A). Such measurements shall in-
clude a risk scoring system to evaluate risk to 
information security both Governmentwide and 
within contractors of the Federal Government. 
‘‘(C) PRODUCTS
AND
SERVICES.—The 
Board shall be responsible for developing and 
periodically updating information security poli-
cies, procedures, and minimum security stand-
ards relating to criteria for products and serv-
ices to be used in agency information systems 
and information infrastructure that will meet 
the minimum security controls referred to in 
subparagraph (A). In carrying out this subpara-
graph, the Board shall act in consultation with 
the Office of Management and Budget and the 
General Services Administration. 
‘‘(D) REMEDIES.—The Board shall be re-
sponsible for developing and periodically updat-
ing information security policies and procedures 
relating to methods for providing remedies for 
security deficiencies identified in agency infor-
mation infrastructure. 
‘‘(3) 
ADDITIONAL
CONSIDERATIONS.—The 
Board shall also consider— 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(A) opportunities to engage with the 
international community to set policies, prin-
ciples, training, standards, or guidelines for in-
formation security; 
‘‘(B) opportunities to work with agencies 
and industry partners to increase information 
sharing and policy coordination efforts in order 
to reduce vulnerabilities in the national infor-
mation infrastructure; and 
‘‘(C) options necessary to encourage and 
maintain accountability of any agency, or senior 
agency official, for efforts to secure the infor-
mation infrastructure of such agency. 
‘‘(4) RELATIONSHIP TO OTHER STANDARDS.— 
The policies and procedures developed under para-
graph (1) are supplemental to the standards promul-
gated by the Director of the National Office for 
Cyberspace under section 3558. 
‘‘(5) RECOMMENDATIONS FOR REGULATIONS.— 
The Board shall be responsible for making rec-
ommendations to the Director of the National Office 
for Cyberspace on regulations to carry out the poli-
cies and procedures developed by the Board under 
paragraph (1). 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(d) REGULATIONS.—The Director of the National 
Office for Cyberspace, in consultation with the Director 
of the Office of Management and the Administrator of 
General Services, shall promulgate and periodically update 
regulations to carry out the policies and procedures devel-
oped by the Board under subsection (c). 
‘‘(e) ANNUAL REPORT.—The Director of the Na-
tional Office for Cyberspace shall provide to Congress a 
report containing a summary of agency progress in imple-
menting the regulations promulgated under this section as 
part of the annual report to Congress required under sec-
tion 3555(a)(8). 
‘‘(f) NO DISCLOSURE BY BOARD REQUIRED.—The 
Board is not required to disclose under section 552 of title 
5 information submitted by agencies to the Board regard-
ing threats, vulnerabilities, and risks. 
‘‘§ 3555. Authority and functions of the Director of 
the National Office for Cyberspace 
‘‘(a) IN GENERAL.—The Director of the National Of-
fice for Cyberspace shall oversee agency information secu-
rity policies and practices, including— 
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines 
on information security, including through ensuring 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
timely agency adoption of and compliance with 
standards promulgated under section 3558; 
‘‘(2) requiring agencies, consistent with the 
standards promulgated under section 3558 and 
other requirements of this subchapter, to identify 
and provide information security protections com-
mensurate with the risk and magnitude of the harm 
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
‘‘(B) information infrastructure used or 
operated by an agency or by a contractor of an 
agency or other organization on behalf of an 
agency; 
‘‘(3) coordinating the development of standards 
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including 
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards and 
guidelines developed for national security systems; 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through 
any authorized action under section 11303 of title 
40, to enforce accountability for compliance with 
such requirements; 
‘‘(5) reviewing at least annually, and approving 
or disapproving, agency information security pro-
grams required under section 3556(b); 
‘‘(6) coordinating information security policies 
and procedures of the Federal Government with re-
lated information resources management policies and 
procedures on the security and resiliency of cyber-
space; 
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under 
section 3559; 
‘‘(8) reporting to Congress no later than March 
1 of each year on agency compliance with the re-
quirements of this subchapter, including— 
‘‘(A) a summary of the findings of audits 
required by section 3557; 
‘‘(B) an assessment of the development, 
promulgation, and adoption of, and compliance 
with, standards developed under section 20 of 
the National Institute of Standards and Tech-
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
nology Act (15 U.S.C. 278g–3) and promul-
gated under section 3558; 
‘‘(C) significant deficiencies in agency in-
formation security practices; 
‘‘(D) planned remedial action to address 
such deficiencies; and 
‘‘(E) a summary of, and the views of the 
Director of the National Office for Cyberspace 
on, the report prepared by the National Insti-
tute of Standards and Technology under section 
20(d)(10) of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3); 
‘‘(9) coordinating the defense of information in-
frastructure operated by agencies in the case of a 
large-scale attack on information infrastructure, as 
determined by the Director; 
‘‘(10) establishing a national strategy not later 
than 120 days after the date of the enactment of 
this section; 
‘‘(11) coordinating information security training 
for Federal employees with the Office of Personnel 
Management; 
‘‘(12) ensuring the adequacy of protections for 
privacy and civil liberties in carrying out the respon-
sibilities of the Director under this subchapter; 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(13) making recommendations that the Direc-
tor determines are necessary to ensure risk-based se-
curity of the Federal information infrastructure and 
information infrastructure that is owned, operated, 
controlled, or licensed for use by, or on behalf of, the 
Department of Defense, a military department, or 
another element of the intelligence community to— 
‘‘(A) the Director of the Office of Manage-
ment and Budget; 
‘‘(B) the head of an agency; or 
‘‘(C) to Congress with regard to the re-
programming of funds; 
‘‘(14) ensuring, in consultation with the Admin-
istrator of the Office of Information and Regulatory 
Affairs, that the efforts of agencies relating to the 
development of regulations, rules, requirements, or 
other actions applicable to the national information 
infrastructure are complementary; 
‘‘(15) when directed by the President, carrying 
out the responsibilities for national security and 
emergency preparedness communications described 
in section 706 of the Communications Act of 1934 
(47 U.S.C. 606) to ensure integration and coordina-
tion; and 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(16) as assigned by the President, other duties 
relating to the security and resiliency of cyberspace. 
‘‘(b) RECRUITMENT PROGRAM.—Not later than 1 
year after appointment, the Director of the National Of-
fice for Cyberspace shall establish a national program to 
conduct competitions and challenges that instruct United 
States students in cybersecurity education and computer 
literacy. 
‘‘(c) BUDGET OVERSIGHT
AND REPORTING.—(1) 
The head of each agency shall submit to the Director of 
the National Office for Cyberspace a budget each year for 
the following fiscal year relating to the protection of infor-
mation infrastructure for such agency, by a date deter-
mined by the Director that is before the submission of 
such budget by the head of the agency to the Office of 
Management and Budget. 
‘‘(2) The Director shall review and offer a non-bind-
ing approval or disapproval of each agency’s annual budg-
et to each such agency before the submission of such budg-
et by the head of the agency to the Office of Management 
and Budget. 
‘‘(3) If the Director offers a non-binding disapproval 
of an agency’s budget, the Director shall transmit rec-
ommendations to the head of such agency for strength-
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
ening its proposed budget with regard to the protection 
of such agency’s information infrastructure. 
‘‘(4) Each budget submitted by the head of an agency 
pursuant to paragraph (1) shall include— 
‘‘(A) a review of any threats to information 
technology for such agency; 
‘‘(B) a plan to secure the information infra-
structure for such agency based on threats to infor-
mation technology, using the National Institute of 
Standards and Technology guidelines and rec-
ommendations; 
‘‘(C) a review of compliance by such agency 
with any previous year plan described in subpara-
graph (B); and 
‘‘(D) a report on the development of the 
credentialing process to enable secure authentication 
of identity and authorization for access to the infor-
mation infrastructure of such agency. 
‘‘(5) The Director of the National Office for Cyber-
space may recommend to the President monetary penalties 
or incentives necessary to encourage and maintain ac-
countability of any agency, or senior agency official, for 
efforts to secure the information infrastructure of such 
agency. 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘§ 3556. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) information infrastructure used 
or operated by an agency or by a con-
tractor of an agency or other organization 
on behalf of an agency; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) 
the 
regulations 
promulgated 
under section 3554 and the information se-
curity standards promulgated under sec-
tion 3558; 
‘‘(ii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(iii) ensuring the standards imple-
mented for information infrastructure and 
national security systems under the agency 
head are complementary and uniform, to 
the extent practicable; and 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning proc-
esses; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation infrastructure that support the operations 
and assets under their control, including through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or 
information infrastructure; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information infrastructure in accordance 
with regulations promulgated under section 
3554 and standards promulgated under section 
3558, for information security classifications 
and related requirements; 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; and 
‘‘(D) continuously testing and evaluating 
information security controls and techniques to 
ensure that they are effectively implemented; 
‘‘(3) delegate to an agency official, designated 
as the ‘Chief Information Security Officer’, under 
the authority of the agency Chief Information Offi-
cer the responsibility to oversee agency information 
security and the authority to ensure and enforce 
compliance with the requirements imposed on the 
agency under this subchapter, including— 
‘‘(A) overseeing the establishment and 
maintenance of a security operations capability 
on an automated and continuous basis that 
can— 
‘‘(i) assess the state of compliance of 
all networks and systems with prescribed 
controls issued pursuant to section 3558 
and report immediately any variance there-
from and, where appropriate and with the 
approval of the agency Chief Information 
Officer, shut down systems that are found 
to be non-compliant; 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
‘‘(ii) detect, report, respond to, con-
tain, and mitigate incidents that impair 
adequate security of the information and 
information infrastructure, in accordance 
with policy provided by the Director of the 
National Office for Cyberspace, in con-
sultation with the Chief Information Offi-
cers Council, and guidance from the Na-
tional Institute of Standards and Tech-
nology; 
‘‘(iii) collaborate with the National 
Office for Cyberspace and appropriate pub-
lic and private sector security operations 
centers to address incidents that impact 
the security of information and informa-
tion infrastructure that extend beyond the 
control of the agency; and 
‘‘(iv) not later than 24 hours after 
discovery of any incident described under 
subparagraph (A)(ii), unless otherwise di-
rected by policy of the National Office for 
Cyberspace, provide notice to the appro-
priate security operations center, the Na-
tional Cyber Investigative Joint Task 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS
Force, and the Inspector General of the 
agency; 
‘‘(B) developing, maintaining, and over-
seeing an agency wide information security pro-
gram as required by subsection (b); 
‘‘(C) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tions 3555 and 3558; 
‘‘(D) training and overseeing personnel 
with significant responsibilities for information 
security with respect to such responsibilities; 
and 
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the agency has trained and 
cleared personnel sufficient to assist the agency in 
complying with the requirements of this subchapter 
and related policies, procedures, standards, and 
guidelines; 
‘‘(5) ensure that the Chief Information Security 
Officer, in coordination with other senior agency of-
ficials, reports biannually to the agency head on the 
VerDate Mar 15 2010 
00:48 Aug 10, 2013
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3032.IH
H3032
jbell on DSK7SPTVN1PROD with BILLS