I 
112TH CONGRESS 
1ST SESSION H. R. 1136 
To amend chapter 35 of title 44, United States Code, to create the National 
Office for Cyberspace, to revise requirements relating to Federal informa-
tion security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 16, 2011 
Mr. LANGEVIN (for himself, Mr. BARTLETT, Mr. RUPPERSBERGER, Ms. LO-
RETTA SANCHEZ of California, Mr. ANDREWS, and Mr. DICKS) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Government Reform, and in addition to the Committee on 
Homeland Security, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To amend chapter 35 of title 44, United States Code, to 
create the National Office for Cyberspace, to revise re-
quirements relating to Federal information security, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Executive Cyberspace Coordination Act of 2011’’. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title. 
TITLE I—FEDERAL INFORMATION SECURITY AMENDMENTS 
Sec. 101. Coordination of Federal information policy. 
Sec. 102. Information security acquisition requirements. 
Sec. 103. Technical and conforming amendments. 
Sec. 104. Effective date. 
TITLE II—FEDERAL CHIEF TECHNOLOGY OFFICER 
Sec. 201. Office of the Chief Technology Officer. 
TITLE III—STRENGTHENING CYBERSECURITY FOR CRITICAL 
INFRASTRUCTURE 
Sec. 301. Definitions. 
Sec. 302. Authority of Secretary. 
TITLE 
I—FEDERAL 
INFORMA-
TION 
SECURITY 
AMEND-
MENTS 
SEC. 101. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
Chapter 35 of title 44, United States Code, is amend-
ed by striking subchapters II and III and inserting the 
following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(2) recognize the highly networked nature of 
the current Federal computing environment and pro-
vide effective Governmentwide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities; 
‘‘(3) provide for development and maintenance 
of minimum controls required to protect Federal in-
formation and information infrastructure; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information infrastructures important to 
the national defense and economic security of the 
Nation that are designed, built, and operated by the 
private sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
rity solutions should be left to individual agencies 
from among commercially developed products. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘§ 3552. Definitions 
‘‘(a) SECTION 3502 DEFINITIONS.—Except as pro-
vided under subsection (b), the definitions under section 
3502 shall apply to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) The term ‘adequate security’ means secu-
rity that complies with the regulations promulgated 
under section 3554 and the standards promulgated 
under section 3558. 
‘‘(2) The term ‘incident’ means an occurrence 
that actually or potentially jeopardizes the confiden-
tiality, integrity, or availability of an information 
system, information infrastructure, or the informa-
tion the system processes, stores, or transmits or 
that constitutes a violation or imminent threat of 
violation of security policies, security procedures, or 
acceptable use policies. 
‘‘(3) The term ‘information infrastructure’ 
means the underlying framework that information 
systems and assets rely on in processing, storing, or 
transmitting information electronically. 
‘‘(4) The term ‘information security’ means 
protecting information and information infrastruc-
ture from unauthorized access, use, disclosure, dis-
ruption, modification, or destruction in order to pro-
vide— 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(A) integrity, which means guarding 
against improper information modification or 
destruction, and includes ensuring information 
nonrepudiation and authenticity; 
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and 
disclosure, including means for protecting per-
sonal privacy and proprietary information; 
‘‘(C) availability, which means ensuring 
timely and reliable access to and use of infor-
mation; and 
‘‘(D) authentication, which means using 
digital credentials to assure the identity of 
users and validate access of such users. 
‘‘(5) The term ‘information technology’ has the 
meaning given that term in section 11101 of title 
40. 
‘‘(6)(A) The term ‘national security system’ 
means any information infrastructure (including any 
telecommunications system) used or operated by an 
agency or by a contractor of an agency, or other or-
ganization on behalf of an agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activities; 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(II) involves cryptologic activities re-
lated to national security; 
‘‘(III) involves command and control 
of military forces; 
‘‘(IV) involves equipment that is an 
integral part of a weapon or weapons sys-
tem; or 
‘‘(V) subject to subparagraph (B), is 
critical to the direct fulfillment of military 
or intelligence missions; or 
‘‘(ii) is protected at all times by procedures 
established for information that have been spe-
cifically authorized under criteria established by 
an Executive order or an Act of Congress to be 
kept classified in the interest of national de-
fense or foreign policy. 
‘‘(B) Subparagraph (A)(i)(V) does not include a 
system that is to be used for routine administrative 
and business applications (including payroll, finance, 
logistics, and personnel management applications). 
‘‘§ 3553. National Office for Cyberspace 
‘‘(a) ESTABLISHMENT.—There is established within 
the Executive Office of the President an office to be known 
as the National Office for Cyberspace. 
‘‘(b) DIRECTOR.— 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(1) IN GENERAL.—There shall be at the head 
of the National Office for Cyberspace a Director, 
who shall be appointed by the President by and with 
the advice and consent of the Senate. The Director 
of the National Office for Cyberspace shall admin-
ister all functions designated to such Director under 
this subchapter and collaborate to the extent prac-
ticable with the heads of appropriate agencies, the 
private sector, and international partners. The Of-
fice shall serve as the principal office for coordi-
nating issues relating to cyberspace, including 
achieving an assured, reliable, secure, and survivable 
information infrastructure and related capabilities 
for the Federal Government, while promoting na-
tional economic interests, security, and civil liberties. 
‘‘(2) BASIC PAY.—The Director of the National 
Office for Cyberspace shall be paid at the rate of 
basic pay for level III of the Executive Schedule. 
‘‘(c) STAFF.—The Director of the National Office for 
Cyberspace may appoint and fix the pay of additional per-
sonnel as the Director considers appropriate. 
‘‘(d) EXPERTS AND CONSULTANTS.—The Director of 
the National Office for Cyberspace may procure temporary 
and intermittent services under section 3109(b) of title 5. 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
‘‘§ 3554. Federal Cybersecurity Practice Board 
‘‘(a) ESTABLISHMENT.—Within the National Office 
for Cyberspace, there shall be established a board to be 
known as the ‘Federal Cybersecurity Practice Board’ (in 
this section referred to as the ‘Board’). 
‘‘(b) MEMBERS.—The Board shall be chaired by the 
Director of the National Office for Cyberspace and consist 
of not more than 10 members, with at least one represent-
ative from— 
‘‘(1) the Office of Management and Budget; 
‘‘(2) civilian agencies; 
‘‘(3) the Department of Defense; 
‘‘(4) the Federal law enforcement community; 
‘‘(5) the Federal Chief Technology Office; and 
‘‘(6) such additional military and civilian agen-
cies as the Director considers appropriate. 
‘‘(c) RESPONSIBILITIES.— 
‘‘(1) DEVELOPMENT OF POLICIES AND PROCE-
DURES.—Subject to the authority, direction, and 
control of the Director of the National Office for 
Cyberspace, the Board shall be responsible for devel-
oping and periodically updating information security 
policies and procedures relating to the matters de-
scribed in paragraph (2). In developing such policies 
and procedures, the Board shall require that all 
matters addressed in the policies and procedures are 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
consistent, to the maximum extent practicable and 
in accordance with applicable law, among the civil-
ian, military, intelligence, and law enforcement com-
munities. 
‘‘(2) SPECIFIC MATTERS COVERED IN POLICIES 
AND PROCEDURES.— 
‘‘(A) MINIMUM
SECURITY
CONTROLS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to minimum se-
curity controls for information technology, in 
order to— 
‘‘(i) provide Governmentwide protec-
tion of Government-networked computers 
against common attacks; and 
‘‘(ii) provide agencywide protection 
against threats, vulnerabilities, and other 
risks to the information infrastructure 
within individual agencies. 
‘‘(B) MEASURES
OF
EFFECTIVENESS.— 
The Board shall be responsible for developing 
and periodically updating information security 
policies and procedures relating to measure-
ments needed to assess the effectiveness of the 
minimum security controls referred to in sub-
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS
paragraph (A). Such measurements shall in-
clude a risk scoring system to evaluate risk to 
information security both Governmentwide and 
within contractors of the Federal Government. 
‘‘(C) PRODUCTS
AND
SERVICES.—The 
Board shall be responsible for developing and 
periodically updating information security poli-
cies, procedures, and minimum security stand-
ards relating to criteria for products and serv-
ices to be used in agency information systems 
and information infrastructure that will meet 
the minimum security controls referred to in 
subparagraph (A). In carrying out this subpara-
graph, the Board shall act in consultation with 
the Office of Management and Budget and the 
General Services Administration. 
‘‘(D) REMEDIES.—The Board shall be re-
sponsible for developing and periodically updat-
ing information security policies and procedures 
relating to methods for providing remedies for 
security deficiencies identified in agency infor-
mation infrastructure. 
‘‘(3) 
ADDITIONAL
CONSIDERATIONS.—The 
Board shall also consider— 
VerDate Mar 15 2010 
23:06 Mar 17, 2011
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1136.IH
H1136
srobinson on DSKHWCL6B1PROD with BILLS