126
ards and guidelines issued pursuant to section 
3536(b), including—
‘‘(A) mitigating risks associated with such 
incidents before substantial damage is done; 
‘‘(B) notifying and consulting with the Fed-
eral information security incident center referred 
to in section 3536; and 
‘‘(C) notifying and consulting with, as ap-
propriate—
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspector General; 
‘‘(ii) an office designated by the Presi-
dent for any incident involving a national 
security system; and 
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the 
President; and 
‘‘(8) plans and procedures to ensure continuity 
of operations for information systems that support the 
operations and assets of the agency. 
‘‘(c) Each agency shall—
‘‘(1) report annually to the Director, the Com-
mittees on Government Reform and Science of the 
House of Representatives, the Committees on Govern-
mental Affairs and Commerce, Science, and Trans-
127
portation of the Senate, the appropriate authorization 
and appropriations committees of Congress, and the 
Comptroller General on the adequacy and effectiveness 
of information security policies, procedures, and prac-
tices, and compliance with the requirements of this 
subchapter, including compliance with each require-
ment of subsection (b); 
‘‘(2) address the adequacy and effectiveness of in-
formation security policies, procedures, and practices 
in plans and reports relating to—
‘‘(A) annual agency budgets; 
‘‘(B) information resources management 
under subchapter 1 of this chapter;
‘‘(C) information technology management 
under subtitle III of title 40; 
‘‘(D) program performance under sections 
1105 and 1115 through 1119 of title 31, and sec-
tions 2801 and 2805 of title 39; 
‘‘(E) financial management under chapter 
9 of title 31, and the Chief Financial Officers 
Act of 1990 (31 U.S.C. 501 note; Public Law 
101–576) (and the amendments made by that 
Act);
128
‘‘(F) financial management systems under 
the Federal Financial Management Improvement 
Act (31 U.S.C. 3512 note); and 
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31, 
(known as the ‘Federal Managers Financial In-
tegrity Act’); and 
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under paragraph 
(1) or (2)—
‘‘(A) as a material weakness in reporting 
under section 3512 of title 31; and 
‘‘(B) if relating to financial management 
systems, as an instance of a lack of substantial 
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512 
note). 
‘‘(d)(1) In addition to the requirements of subsection 
(c), each agency, in consultation with the Director, shall 
include as part of the performance plan required under sec-
tion 1115 of title 31 a description of—
‘‘(A) the time periods, and 
‘‘(B) the resources, including budget, staffing, 
and training,
129
that are necessary to implement the program required 
under subsection (b). 
‘‘(2) The description under paragraph (1) shall be 
based on the risk assessments required under subsection 
(b)(2)(1). 
‘‘(e) Each agency shall provide the public with timely 
notice and opportunities for comment on proposed informa-
tion security policies and procedures to the extent that such 
policies and procedures affect communication with the pub-
lic. 
‘‘§ 3535. Annual independent evaluation 
‘‘(a)(1) Each year each agency shall have performed 
an independent evaluation of the information security pro-
gram and practices of that agency to determine the effective-
ness of such program and practices. 
‘‘(2) Each evaluation by an agency under this section 
shall include—
‘‘(A) testing of the effectiveness of information se-
curity policies, procedures, and practices of a rep-
resentative subset of the agency’s information systems; 
‘‘(B) an assessment (made on the basis of the re-
sults of the testing) of compliance with—
‘‘(i) the requirements of this subchapter; 
and
130
‘‘(ii) related information security policies, 
procedures, standards, and guidelines; and 
‘‘(C) separate presentations, as appropriate, re-
garding information security relating to national se-
curity systems. 
‘‘(b) Subject to subsection (c)—
‘‘(1) for each agency with an Inspector General 
appointed under the Inspector General Act of 1978, 
the annual evaluation required by this section shall be
performed by the Inspector General or by an inde-
pendent external auditor, as determined by the In-
spector General of the agency; and 
‘‘(2) for each agency to which paragraph (1) does 
not apply, the head of the agency shall engage an 
independent external auditor to perform the evalua-
tion. 
‘‘(c) For each agency operating or exercising control 
of a national security system, that portion of the evaluation 
required by this section directly relating to a national secu-
rity system shall be performed—
‘‘(1) only by an entity designated by the agency 
head; and 
‘‘(2) in such a manner as to ensure appropriate 
protection for information associated with any infor-
mation security vulnerability in such system com-
131
mensurate with the risk and in accordance with all 
applicable laws. 
‘‘(d) The evaluation required by this section may be 
based in whole or in part on an audit, evaluation, or report 
relating to programs or practices of the applicable agency. 
‘‘(e)(1) Each year, not later than such date established 
by the Director, the head of each agency shall submit to 
the Director the results of the evaluation required under this 
section. 
‘‘(2) To the extent an evaluation required under this 
section directly relates to a national security system, the 
evaluation results submitted to the Director shall contain 
only a summary and assessment of that portion of the eval-
uation directly relating to a national security system. 
‘‘(f) Agencies and evaluators shall take appropriate 
steps to ensure the protection of information which, if dis-
closed, may adversely affect information security. Such pro-
tections shall be commensurate with the risk and comply 
with all applicable laws and regulations. 
‘‘(g)(1) The Director shall summarize the results of the 
evaluations conducted under this section in the report to 
Congress required under section 3533(a)(8). 
‘‘(2) The Director’s report to Congress under this sub-
section shall summarize information regarding information 
security relating to national security systems in such a
132
manner as to ensure appropriate protection for information 
associated with any information security vulnerability in 
such system commensurate with the risk and in accordance 
with all applicable laws. 
‘‘(3) Evaluations and any other descriptions of infor-
mation systems under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
ligence Programs systems under the authority and control 
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees of 
Congress, in accordance with applicable laws. 
‘‘(h) The Comptroller General shall periodically evalu-
ate and report to Congress on—
‘‘(1) the adequacy and effectiveness of agency in-
formation security policies and practices; and 
‘‘(2) implementation of the requirements of this 
subchapter. 
‘‘§ 3536. Federal information security incident center 
‘‘(a) The Director shall ensure the operation of a cen-
tral Federal information security incident center to—
‘‘(1) provide timely technical assistance to opera-
tors of agency information systems regarding security 
incidents, including guidance on detecting and han-
dling information security incidents;
133
‘‘(2) compile and analyze information about in-
cidents that threaten information security; 
‘‘(3) inform operators of agency information sys-
tems about current and potential information secu-
rity threats, and vulnerabilities; and 
‘‘(4) consult with agencies or offices operating or 
exercising control of national security systems 
(including the National Security Agency) and such 
other agencies or offices in accordance with law and 
as directed by the President regarding information se-
curity incidents and related matters. 
‘‘(b) Each agency operating or exercising control of a 
national security system shall share information about in-
formation security incidents, threats, and vulnerabilities 
with the Federal information security incident center to the 
extent consistent with standards and guidelines for national 
security systems, issued in accordance with law and as di-
rected by the President. 
‘‘§ 3537. National security systems 
‘‘The head of each agency operating or exercising con-
trol of a national security system shall be responsible for 
ensuring that the agency—
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, dis-
134
closure, disruption, modification, or destruction of the 
information contained in such system; 
‘‘(2) implements information security policies 
and practices as required by standards and guidelines 
for national security systems, issued in accordance 
with law and as directed by the President; and 
‘‘(3) complies with the requirements of this sub-
chapter.
‘‘§ 3538. Authorization of appropriations 
‘‘There are authorized to be appropriated to carry out 
the provisions of this subchapter such sums as may be nec-
essary for each of fiscal years 2003 through 2007. 
‘‘§ 3539. Effect on existing law 
‘‘Nothing in this subchapter, section 11331 of title 40, 
or section 20 of the National Standards and Technology Act 
(15 U.S.C. 278g–3) may be construed as affecting the au-
thority of the President, the Office of Management and 
Budget or the Director thereof, the National Institute of 
Standards and Technology, or the head of any agency, with 
respect to the authorized use or disclosure of information, 
including with regard to the protection of personal privacy 
under section 552a of title 5, the disclosure of information 
under section 552 of title 5, the management and disposi-
tion of records under chapters 29, 31, or 33 of title 44, the 
management of information resources under subchapter I
135
of chapter 35 of this title, or the disclosure of information 
to the Congress or the Comptroller General of the United 
States.’’. 
(2) CLERICAL AMENDMENT.—The items in the 
table of sections at the beginning of such chapter 35 
under the heading ‘‘SUBCHAPTER II—INFORMA-
TION SECURITY’’ are amended to read as follows:
‘‘3531. Purposes. 
‘‘3532. Definitions. 
‘‘3533. Authority and functions of the Director. 
‘‘3534. Federal agency responsibilities. 
‘‘3535. Annual independent evaluation. 
‘‘3536. Federal information security incident center. 
‘‘3537. National security systems. 
‘‘3538. Authorization of appropriations. 
‘‘3539. Effect on existing law.’’.
(c) INFORMATION SECURITY RESPONSIBILITIES
OF 
CERTAIN AGENCIES.—
(1) NATIONAL
SECURITY
RESPONSIBILITIES.—
(A) Nothing in this Act (including any amendment 
made by this Act) shall supersede any authority of the 
Secretary of Defense, the Director of Central Intel-
ligence, or other agency head, as authorized by law 
and as directed by the President, with regard to the 
operation, control, or management of national secu-
rity systems, as defined by section 3532(b)(2) of title 
44, United States Code. 
(B) Section 2224 of title 10, United States Code, 
is amended—
136
(i) in subsection (b), by striking ‘‘(b) 
OBJECTIVES
AND MINIMUM REQUIREMENTS.—
(1)’’ and inserting ‘‘(b) OBJECTIVES
OF
THE 
PROGRAM.—’’; 
(ii) in subsection (b), by striking paragraph 
(2); and 
(iii) in subsection (c), in the matter pre-
ceding paragraph (1), by inserting ‘‘, including 
through compliance with subtitle II of chapter 35 
of title 44’’ after ‘‘infrastructure’’. 
(2) ATOMIC ENERGY ACT OF 1954.—Nothing in 
this Act shall supersede any requirement made by or 
under the Atomic Energy Act of 1954 (42 U.S.C. 
2011 et seq.). Restricted data or formerly restricted 
data shall be handled, protected, classified, down-
graded, and declassified in conformity with the Atom-
ic Energy Act of 1954 (42 U.S.C. 2011 et seq.). 
SEC. 302. MANAGEMENT OF INFORMATION TECHNOLOGY. 
(a) IN GENERAL.—Section 11331 of title 40, United 
States Code, is amended to read as follows: 
‘‘§ 11331. Responsibilities for federal information sys-
tems standards 
‘‘(a) INFORMATION SECURITY STANDARDS.—
‘‘(1) IN
GENERAL.—(A) Except as provided 
under paragraph (2), the Director of the Office of
137
Management and Budget shall, on the basis of pro-
posed standards developed by the National Institute of 
Standards and Technology pursuant to paragraph (3) 
of section 20(a) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–3(a)), promul-
gate information security standards pertaining to 
Federal information systems. 
‘‘(B) Standards promulgated under subpara-
graph (A) shall include—
‘‘(i) standards that provide minimum infor-
mation security requirements as determined 
under section 20(b) of the National Institute of 
Standards and Technology Act (15 U.S.C. 278g–
3(b)); and 
‘‘(ii) such standards that are otherwise nec-
essary to improve the efficiency of operation or 
security of Federal information systems. 
‘‘(C) Information security standards described 
under subparagraph (B) shall be compulsory and 
binding.
‘‘(2) NATIONAL SECURITY SYSTEMS.—Standards 
and guidelines for national security systems under 
this subsection shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law 
and as directed by the President.
138
‘‘(3) AGENCY HEAD AUTHORITY.—The head of an 
agency may employ standards for the cost-effective in-
formation security for all operations and assets with-
in or under the supervision of that agency that are 
more stringent than the standards promulgated by the 
Director under this subsection, if such standards—
‘‘(A) contain, at a minimum, the provisions 
of those applicable standards made compulsory 
and binding by the Director; and 
‘‘(B) are otherwise consistent with policies 
and guidelines issued under section 3533 of title 
44. 
‘‘(4) DECISIONS ON PROMULGATION OF STAND-
ARDS.—(A) The decision regarding the promulgation 
of any standard by the Director under paragraphs (1) 
and (2) shall occur not later than 6 months after the 
submission of the proposed standard to the Director 
by the National Institute of Standards and Tech-
nology, as provided under section 20 of the National 
Institute of Standards and Technology Act (15 U.S.C. 
278g–3). 
‘‘(B) A decision by the Director to significantly 
modify, or not promulgate, a proposed standard sub-
mitted to the Director by the National Institute of 
Standards and Technology, as provided under section
139
20 of the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3), shall be made after 
the public is given an opportunity to comment on the 
Director’s proposed decision. 
‘‘(b) ADDITIONAL STANDARDS RELATING TO FEDERAL 
INFORMATION SYSTEMS.—
‘‘(1) IN GENERAL.—Except as provided under 
paragraph (2), the Secretary of Commerce shall, on 
the basis of proposed standards developed by the Na-
tional Institute of Standards and Technology pursu-
ant to paragraph (2) of section 20(a) of the National 
Institute of Standards and Technology Act (15 U.S.C. 
278g–3(a)) and in consultation with the Director of 
the Office of Management and Budget, promulgate 
standards pertaining to Federal information systems. 
The Secretary shall make such standards compulsory 
and binding to the extent that the Secretary deter-
mines necessary to improve the efficiency and effec-
tiveness of the operation of Federal information sys-
tems. 
‘‘(2) NATIONAL SECURITY SYSTEMS.—Standards 
and guidelines for national security systems under 
this subsection shall be developed, promulgated, en-
forced, and overseen as otherwise authorized by law 
and as directed by the President.
140
‘‘(3) AUTHORITY OF SECRETARY.—The authority 
conferred upon the Secretary of Commerce by this 
subsection shall be exercised subject to direction by the 
President and in coordination with the Director of 
the Office of Management and Budget to ensure fiscal 
and policy consistency. 
‘‘(4) AGENCY HEAD AUTHORITY.—The head of an 
agency may employ standards for information sys-
tems that are more stringent than the standards pro-
mulgated by the Secretary of Commerce under this 
subsection, if such standards contain, at a minimum, 
the provisions of those applicable standards made 
compulsory and binding by the Secretary of Com-
merce. 
‘‘(c) DEFINITIONS.—In this section: 
‘‘(1) FEDERAL INFORMATION SYSTEM.—The term 
‘Federal information system’ means an information 
system used or operated by an agency, by a con-
tractor of an agency, or by another organization on 
behalf of an agency. 
‘‘(2) 
INFORMATION
SECURITY.—The 
term 
‘information security’ has the meaning given that 
term in section 3532(b)(1) of title 44.
141
‘‘(3) NATIONAL
SECURITY
SYSTEM.—The term 
‘national security system’ has the meaning given that 
term in section 3532(b)(2) of title 44.’’. 
(b) CLERICAL AMENDMENT.—The item relating to sec-
tion 11331 in the table of sections at the beginning of chap-
ter 113 of such title is amended to read as follows:
‘‘11331. Responsibilities for Federal information systems standards.’’.
SEC. 303. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3), is amended by striking 
the text and inserting the following: 
‘‘(a) The Institute shall—
‘‘(1) have the mission of developing standards, 
guidelines, and associated methods and techniques for 
information systems; 
‘‘(2) develop standards and guidelines, including 
minimum requirements, for information systems used 
or operated by an agency or by a contractor of an 
agency or other organization on behalf of an agency, 
other than national security systems (as defined in 
section 3532(b)(2) of title 44, United States Code); 
and 
‘‘(3) develop standards and guidelines, including 
minimum requirements, for providing adequate infor-
mation security for all agency operations and assets,
142
but such standards and guidelines shall not apply to 
national security systems. 
‘‘(b) The standards and guidelines required by sub-
section (a) shall include, at a minimum—
‘‘(1)(A) standards to be used by all agencies to 
categorize all information and information systems 
collected or maintained by or on behalf of each agency 
based on the objectives of providing appropriate levels 
of information security according to a range of risk 
levels; 
‘‘(B) guidelines recommending the types of infor-
mation and information systems to be included in 
each such category; and 
‘‘(C) minimum information security require-
ments for information and information systems in 
each such category; 
‘‘(2) a definition of and guidelines concerning 
detection and handling of information security inci-
dents; and 
‘‘(3) guidelines developed in coordination with 
the National Security Agency for identifying an in-
formation system as a national security system con-
sistent with applicable requirements for national se-
curity systems, issued in accordance with law and as 
directed by the President.
143
‘‘(c) In developing standards and guidelines required 
by subsections (a) and (b), the Institute shall—
‘‘(1) consult with other agencies and offices and 
the private sector (including the Director of the Office 
of Management and Budget, the Departments of De-
fense and Energy, the National Security Agency, the 
General Accounting Office, and the Secretary of 
Homeland Security) to assure—
‘‘(A) use of appropriate information secu-
rity policies, procedures, and techniques, in 
order to improve information security and avoid 
unnecessary and costly duplication of effort; and 
‘‘(B) that such standards and guidelines are 
complementary with standards and guidelines 
employed for the protection of national security 
systems and information contained in such sys-
tems; 
‘‘(2) provide the public with an opportunity to 
comment on proposed standards and guidelines; 
‘‘(3) submit to the Director of the Office of Man-
agement and Budget for promulgation under section 
11331 of title 40, United States Code—
‘‘(A) standards, as required under sub-
section (b)(1)(A), no later than 12 months after 
the date of the enactment of this section; and
144
‘‘(B) minimum information security re-
quirements for each category, as required under 
subsection (b)(1)(C), no later than 36 months 
after the date of the enactment of this section;
‘‘(4) issue guidelines as required under sub-
section (b)(1)(B), no later than 18 months after the 
date of the enactment of this section; 
‘‘(5) ensure that such standards and guidelines 
do not specify the use or procurement of certain prod-
ucts, including any specific hardware or software; 
‘‘(6) ensure that such standards and guidelines 
provide for sufficient flexibility to permit alternative 
solutions to provide equivalent levels of protection for 
identified information security risks; and 
‘‘(7) use flexible, performance-based standards 
and guidelines that, to the greatest extent possible, 
permit the use of off-the-shelf commercially developed 
information security products. 
‘‘(d)(1) There is established in the Institute an Office 
for Information Security Programs. 
‘‘(2) The Office for Information Security Programs 
shall be headed by a Director, who shall be a senior execu-
tive and shall be compensated at a level in the Senior Exec-
utive Service under section 5382 of title 5, United States 
Code, as determined by the Secretary of Commerce.
145
‘‘(3) The Director of the Institute shall delegate to the 
Director of the Office of Information Security Programs the 
authority to administer all functions under this section, ex-
cept that any such delegation shall not relieve the Director 
of the Institute of responsibility for the administration of 
such functions. The Director of the Office of Information 
Security Programs shall serve as principal adviser to the 
Director of the Institute on all functions under this section. 
‘‘(e) The Institute shall—
‘‘(1) submit standards developed pursuant to 
subsection (a), along with recommendations as to the 
extent to which these should be made compulsory and 
binding, to the Director of the Office of Management 
and Budget for promulgation under section 11331 of 
title 40, United States Code; 
‘‘(2) provide assistance to agencies regarding—
‘‘(A) compliance with the standards and 
guidelines developed under subsection (a); 
‘‘(B) detecting and handling information 
security incidents; and 
‘‘(C) information security policies, proce-
dures, and practices; 
‘‘(3) conduct research, as needed, to determine 
the nature and extent of information security
146
vulnerabilities and techniques for providing cost-effec-
tive information security; 
‘‘(4) develop and periodically revise performance 
indicators and measures for agency information secu-
rity policies and practices; 
‘‘(5) evaluate private sector information security 
policies and practices and commercially available in-
formation technologies to assess potential application 
by agencies to strengthen information security; 
‘‘(6) evaluate security policies and practices de-
veloped for national security systems to assess poten-
tial application by agencies to strengthen information 
security; 
‘‘(7) periodically assess the effectiveness of stand-
ards and guidelines developed under this section and 
undertake revisions as appropriate; 
‘‘(8) solicit and consider the recommendations of 
the Information Security and Privacy Advisory 
Board, established by section 21, regarding standards 
and guidelines developed under subsection (a) and 
submit such recommendations to the Director of the 
Office of Management and Budget with such stand-
ards submitted to the Director; and 
‘‘(9) prepare an annual public report on activi-
ties undertaken in the previous year, and planned for
147
the coming year, to carry out responsibilities under 
this section. 
‘‘(f) As used in this section—
‘‘(1) the term ‘agency’ has the same meaning as 
provided in section 3502(1) of title 44, United States 
Code; 
‘‘(2) the term ‘information security’ has the same 
meaning as provided in section 3532(b)(1) of such 
title; 
‘‘(3) the term ‘information system’ has the same 
meaning as provided in section 3502(8) of such title; 
‘‘(4) the term ‘information technology’ has the 
same meaning as provided in section 11101 of title 
40, United States Code; and 
‘‘(5) the term ‘national security system’ has the 
same meaning as provided in section 3532(b)(2) of 
title 44, United States Code. 
‘‘(g) There are authorized to be appropriated to the 
Secretary of Commerce $20,000,000 for each of fiscal years 
2003, 2004, 2005, 2006, and 2007 to enable the National 
Institute of Standards and Technology to carry out the pro-
visions of this section.’’.
148
SEC. 304. INFORMATION SECURITY AND PRIVACY ADVISORY 
BOARD. 
Section 21 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–4), is amended—
(1) in subsection (a), by striking ‘‘Computer 
System Security and Privacy Advisory Board’’ and 
inserting ‘‘Information Security and Privacy Advi-
sory Board’’; 
(2) in subsection (a)(1), by striking ‘‘computer 
or telecommunications’’ and inserting ‘‘information 
technology’’; 
(3) in subsection (a)(2)—
(A) by striking ‘‘computer or telecommuni-
cations technology’’ and inserting ‘‘information 
technology’’; and
(B) by striking ‘‘computer or telecommuni-
cations equipment’’ and inserting ‘‘information 
technology’’; 
(4) in subsection (a)(3)—
(A) by striking ‘‘computer systems’’ and in-
serting ‘‘information system’’; and 
(B) by striking ‘‘computer systems security’’ 
and inserting ‘‘information security’’; 
(5) in subsection (b)(1) by striking ‘‘computer 
systems security’’ and inserting ‘‘information secu-
rity’’;
149
(6) in subsection (b) by striking paragraph (2) 
and inserting the following: 
‘‘(2) to advise the Institute and the Director of 
the Office of Management and Budget on information 
security and privacy issues pertaining to Federal
Government information systems, including through 
review of proposed standards and guidelines developed 
under section 20; and’’; 
(7) in subsection (b)(3) by inserting ‘‘annually’’ 
after ‘‘report’’; 
(8) by inserting after subsection (e) the following 
new subsection: 
‘‘(f) The Board shall hold meetings at such locations 
and at such time and place as determined by a majority 
of the Board.’’; 
(9) by redesignating subsections (f) and (g) as 
subsections (g) and (h), respectively; and 
(10) by striking subsection (h), as redesignated 
by paragraph (9), and inserting the following: 
‘‘(h) As used in this section, the terms ‘information 
system’ and ‘information technology’ have the meanings 
given in section 20.’’.
150
SEC. 305. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) COMPUTER SECURITY ACT.—Subsections (b) and 
(c) of section 11332 of title 40, United States Code, are re-
pealed. 
(b) FLOYD D. SPENCE NATIONAL DEFENSE AUTHOR-
IZATION ACT
FOR FISCAL YEAR 2001.—The Floyd D. 
Spence National Defense Authorization Act for Fiscal Year 
2001 (Public Law 106–398) is amended by striking section 
1062 (44 U.S.C. 3531 note). 
(c) 
PAPERWORK
REDUCTION
ACT.—(1) 
Section 
3504(g) of title 44, United States Code, is amended—
(A) by adding ‘‘and’’ at the end of paragraph 
(1); 
(B) in paragraph (2)—
(i) 
by 
striking 
‘‘sections 
11331 
and 
11332(b) and (c) of title 40’’ and inserting 
‘‘section 11331 of title 40 and subchapter II of 
this chapter’’; and 
(ii) by striking ‘‘; and’’ and inserting a pe-
riod; and 
(C) by striking paragraph (3). 
(2) Section 3505 of such title is amended by adding 
at the end—
‘‘(c)(1) The head of each agency shall develop and 
maintain an inventory of major information systems
151
(including major national security systems) operated by or 
under the control of such agency. 
‘‘(2) The identification of information systems in an 
inventory under this subsection shall include an identifica-
tion of the interfaces between each such system and all other 
systems or networks, including those not operated by or 
under the control of the agency. 
‘‘(3) Such inventory shall be—
‘‘(A) updated at least annually; 
‘‘(B) made available to the Comptroller General; 
and 
‘‘(C) used to support information resources man-
agement, including—
‘‘(i) preparation and maintenance of the in-
ventory of information resources under section 
3506(b)(4); 
‘‘(ii) 
information 
technology 
planning, 
budgeting, acquisition, and management under 
section 3506(h), subtitle III of title 40, and re-
lated laws and guidance; 
‘‘(iii) monitoring, testing, and evaluation of 
information security controls under subchapter 
II;
152
‘‘(iv) preparation of the index of major in-
formation systems required under section 552(g) 
of title 5, United States Code; and 
‘‘(v) preparation of information system in-
ventories required for records management under 
chapters 21, 29, 31, and 33. 
‘‘(4) The Director shall issue guidance for and oversee 
the implementation of the requirements of this subsection.’’. 
(3) Section 3506(g) of such title is amended—
(A) by adding ‘‘and’’ at the end of paragraph 
(1); 
(B) in paragraph (2)—
(i) by striking ‘‘section 11332 of title 40’’ 
and inserting ‘‘subchapter II of this chapter’’; 
and 
(ii) by striking ‘‘; and’’ and inserting a pe-
riod; and 
(C) by striking paragraph (3). 
SEC. 306. CONSTRUCTION. 
Nothing in this title, or the amendments made by this 
title, affects the authority of the National Institute of 
Standards and Technology or the Department of Commerce 
relating to the development and promulgation of standards 
or guidelines under paragraphs (1) and (2) of section 20(a)
153
of the National Institute of Standards and Technology Act 
(15 U.S.C. 278g–3(a)). 
TITLE IV—AUTHORIZATION OF 
APPROPRIATIONS 
AND 
EF-
FECTIVE DATES 
SEC. 401. AUTHORIZATION OF APPROPRIATIONS. 
Except for those purposes for which an authorization 
of appropriations is specifically provided in title I or II, 
including the amendments made by such titles, there are 
authorized to be appropriated such sums as are necessary 
to carry out titles I and II for each of fiscal years 2003 
through 2007. 
SEC. 402. EFFECTIVE DATES. 
(a) TITLES I AND II.—
(1) IN
GENERAL.—Except as provided under 
paragraph (2), titles I and II and the amendments 
made by such titles shall take effect 120 days after the 
date of enactment of this Act. 
(2) IMMEDIATE ENACTMENT.—Sections 207, 214, 
and 215 shall take effect on the date of enactment of 
this Act. 
(b) TITLES III AND IV.—Title III and this title shall 
take effect on the date of enactment of this Act.
154
TITLE V—CONFIDENTIAL INFOR-
MATION 
PROTECTION 
AND 
STATISTICAL EFFICIENCY 
SEC. 501. SHORT TITLE. 
This title may be cited as the ‘‘Confidential Informa-
tion Protection and Statistical Efficiency Act of 2002’’. 
SEC. 502. DEFINITIONS. 
As used in this title: 
(1) The term ‘‘agency’’ means any entity that 
falls within the definition of the term ‘‘executive agen-
cy’’ as defined in section 102 of title 31, United
States Code, or ‘‘agency’’, as defined in section 3502 
of title 44, United States Code. 
(2) The term ‘‘agent’’—
(A) means an employee of a private organi-
zation or a researcher affiliated with an institu-
tion of higher learning (including a person 
granted special sworn status by the Bureau of 
the Census under section 23(c) of title 13, United 
States Code) with whom a contract or other 
agreement is executed, on a temporary basis, by 
an executive agency to perform exclusively statis-
tical activities under the control and supervision 
of an officer or employee of that agency; or
155
(B) means an individual who is working 
under the authority of a government entity with 
which a contract or other agreement is executed 
by an executive agency to perform exclusively 
statistical activities under the control of an offi-
cer or employee of that agency; or 
(C) means an individual who is a self-em-
ployed researcher, a consultant, or a contractor, 
or who is an employee of a contractor and with 
whom a contract or other agreement is executed 
by an executive agency to perform a statistical 
activity under the control of an officer or em-
ployee of that agency; or 
(D) means an individual who is a con-
tractor or who is an employee of a contractor en-
gaged by the agency to design or maintain the 
systems for handling or storage of data received 
under this title; and 
(E) who agrees in writing to comply with 
all provisions of law that affect information ac-
quired by that agency. 
(3) The term ‘‘business data’’ means operating 
and financial data and information about businesses, 
tax-exempt organizations, and government entities.
156
(4) The term ‘‘identifiable form’’ means any rep-
resentation of information that permits the identity of 
the respondent to whom the information applies to be 
reasonably inferred by either direct or indirect means. 
(5) The term ‘‘nonstatistical purpose’’—
(A) means the use of data in identifiable 
form for any purpose that is not a statistical 
purpose, including any administrative, regu-
latory, law enforcement, adjudicatory, or other 
purpose that affects the rights, privileges, or ben-
efits of a particular identifiable respondent; and 
(B) includes the disclosure under section 
552 of title 5, United States Code (popularly 
known as the Freedom of Information Act) of 
data that are acquired for exclusively statistical 
purposes under a pledge of confidentiality. 
(6) The term ‘‘respondent’’ means a person who, 
or organization that, is requested or required to sup-
ply information to an agency, is the subject of infor-
mation requested or required to be supplied to an 
agency, or provides that information to an agency. 
(7) The term ‘‘statistical activities’’—
(A) means the collection, compilation, proc-
essing, or analysis of data for the purpose of de-
scribing or making estimates concerning the
157
whole, or relevant groups or components within, 
the economy, society, or the natural environment; 
and 
(B) includes the development of methods or 
resources that support those activities, such as 
measurement methods, models, statistical classi-
fications, or sampling frames. 
(8) The term ‘‘statistical agency or unit’’ means 
an agency or organizational unit of the executive 
branch whose activities are predominantly the collec-
tion, compilation, processing, or analysis of informa-
tion for statistical purposes. 
(9) The term ‘‘statistical purpose’’—
(A) means the description, estimation, or 
analysis of the characteristics of groups, without 
identifying the individuals or organizations that 
comprise such groups; and 
(B) includes the development, implementa-
tion, or maintenance of methods, technical or ad-
ministrative procedures, or information resources 
that support the purposes described in subpara-
graph (A). 
SEC. 503. COORDINATION AND OVERSIGHT OF POLICIES. 
(a) IN GENERAL.—The Director of the Office of Man-
agement and Budget shall coordinate and oversee the con-