107TH CONGRESS
2D SESSION
H. R. 2458
AN ACT
To enhance the management and promotion of electronic
Government services and processes by establishing a Fed-
eral Chief Information Officer within the Office of Man-
agement and Budget, and by establishing a broad frame-
work of measures that require using Internet-based infor-
mation technology to enhance citizen access to Govern-
ment information and services, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the ‘‘E-
Government Act of 2002’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
TITLE I—OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC
GOVERNMENT SERVICES
Sec. 101. Management and promotion of electronic government services.
Sec. 102. Conforming amendments.
TITLE II—FEDERAL MANAGEMENT AND PROMOTION OF
ELECTRONIC GOVERNMENT SERVICES
Sec. 201. Definitions.
Sec. 202. Federal agency responsibilities.
Sec. 203. Compatibility of executive agency methods for use and acceptance of
electronic signatures.
Sec. 204. Federal Internet portal.
Sec. 205. Federal courts.
Sec. 206. Regulatory agencies.
Sec. 207. Accessibility, usability, and preservation of government information.
Sec. 208. Privacy provisions.
Sec. 209. Federal information technology workforce development.
Sec. 210. Share-in-savings initiatives.
Sec. 211. Authorization for acquisition of information technology by State and
local governments through Federal supply schedules.
Sec. 212. Integrated reporting study and pilot projects.
Sec. 213. Community technology centers.
Sec. 214. Enhancing crisis management through advanced information tech-
nology.
Sec. 215. Disparities in access to the Internet.
Sec. 216. Common protocols for geographic information systems.
TITLE III—INFORMATION SECURITY
Sec. 301. Information security.
Sec. 302. Management of information technology.
Sec. 303. National Institute of Standards and Technology.
Sec. 304. Information Security and Privacy Advisory Board.
Sec. 305. Technical and conforming amendments.
(3) Most Internet-based services of the Federal
Government are developed and presented separately,
according to the jurisdictional boundaries of an indi-
vidual department or agency, rather than being inte-
grated cooperatively according to function or topic.
(4) Internet-based Government services involv-
ing interagency cooperation are especially difficult to
develop and promote, in part because of a lack of
sufficient funding mechanisms to support such inter-
agency cooperation.
(5) Electronic Government has its impact
through improved Government performance and out-
comes within and across agencies.
(6) Electronic Government is a critical element
in the management of Government, to be imple-
mented as part of a management framework that
also addresses finance, procurement, human capital,
and other challenges to improve the performance of
Government.
(7) To take full advantage of the improved Gov-
ernment performance that can be achieved through
the use of Internet-based technology requires strong
leadership, better organization, improved interagency
collaboration, and more focused oversight of agency
compliance with statutes related to information re-
source management.
(b) PURPOSES.—The purposes of this Act are the fol-
lowing:
(1) To provide effective leadership of Federal
Government efforts to develop and promote elec-
tronic Government services and processes by estab-
lishing an Administrator of a new Office of Elec-
tronic Government within the Office of Management
and Budget.
(2) To promote use of the Internet and other
information technologies to provide increased oppor-
tunities for citizen participation in Government.
(3) To promote interagency collaboration in
providing electronic Government services, where this
collaboration would improve the service to citizens by
integrating related functions, and in the use of inter-
nal electronic Government processes, where this col-
laboration would improve the efficiency and effec-
tiveness of the processes.
(4) To improve the ability of the Government to
achieve agency missions and program performance
goals.
(5) To promote the use of the Internet and
emerging technologies within and across Government
agencies to provide citizen-centric Government infor-
mation and services.
(6) To reduce costs and burdens for businesses
and other Government entities.
(7) To promote better informed decisionmaking
by policy makers.
(8) To promote access to high quality Govern-
ment information and services across multiple chan-
nels.
(9) To make the Federal Government more
transparent and accountable.
(10) To transform agency operations by uti-
lizing, where appropriate, best practices from public
and private sector organizations.
(11) To provide enhanced access to Government
information and services in a manner consistent with
laws regarding protection of personal privacy, na-
tional security, records retention, access for persons
with disabilities, and other relevant laws.
TITLE I—OFFICE OF MANAGE-
MENT 
AND 
BUDGET 
ELEC-
TRONIC GOVERNMENT SERV-
ICES
SEC. 101. MANAGEMENT AND PROMOTION OF ELECTRONIC
GOVERNMENT SERVICES.
(a) IN GENERAL.—Title 44, United States Code, is
amended by inserting after chapter 35 the following:
‘‘CHAPTER 36—MANAGEMENT AND PRO-
MOTION OF ELECTRONIC GOVERN-
MENT SERVICES
‘‘Sec.
‘‘3601. Definitions.
‘‘3602. Office of Electronic Government.
‘‘3603. Chief Information Officers Council.
‘‘3604. E-Government Fund.
‘‘3605. Program to encourage innovative solutions to enhance electronic Govern-
ment services and processes.
‘‘3606. E-Government report.
‘‘§ 3601. Definitions
‘‘In this chapter, the definitions under section 3502
shall apply, and the term—
‘‘(1) ‘Administrator’ means the Administrator
of the Office of Electronic Government established
under section 3602;
‘‘(2) ‘Council’ means the Chief Information Of-
ficers Council established under section 3603;
‘‘(3) ‘electronic Government’ means the use by
the Government of web-based Internet applications
and other information technologies, combined with
processes that implement these technologies, to—
‘‘(A) enhance the access to and delivery of
Government information and services to the
public, other agencies, and other Government
entities; or
‘‘(B) bring about improvements in Govern-
ment operations that may include effectiveness,
efficiency, service quality, or transformation;
‘‘(4) ‘enterprise architecture’—
‘‘(A) means—
‘‘(i) a strategic information asset
base, which defines the mission;
‘‘(ii) the information necessary to per-
form the mission;
‘‘(iii) the technologies necessary to
perform the mission; and
‘‘(iv) the transitional processes for im-
plementing new technologies in response to
changing mission needs; and
‘‘(B) includes—
‘‘(i) a baseline architecture;
‘‘(ii) a target architecture; and
‘‘(iii) a sequencing plan;
‘‘(5) ‘Fund’ means the E-Government Fund es-
tablished under section 3604;
‘‘(6) ‘interoperability’ means the ability of dif-
ferent operating and software systems, applications,
and services to communicate and exchange data in
an accurate, effective, and consistent manner;
‘‘(7) ‘integrated service delivery’ means the pro-
vision of Internet-based Federal Government infor-
mation or services integrated according to function
or topic rather than separated according to the
boundaries of agency jurisdiction; and
‘‘(8) ‘tribal government’ means—
‘‘(A) the governing body of any Indian
tribe, band, nation, or other organized group or
community located in the continental United
States (excluding the State of Alaska) that is
recognized as eligible for the special programs
and services provided by the United States to
Indians because of their status as Indians, and
‘‘(B) any Alaska Native regional or village
corporation established pursuant to the Alaska
Native Claims Settlement Act (43 U.S.C. 1601
et seq.).
‘‘(2) Recommend to the Director changes relat-
ing to Governmentwide strategies and priorities for
electronic Government.
‘‘(3) Provide overall leadership and direction to
the executive branch on electronic Government.
‘‘(4) Promote innovative uses of information
technology by agencies, particularly initiatives in-
volving multiagency collaboration, through support
of pilot projects, research, experimentation, and the
use of innovative technologies.
‘‘(5) Oversee the distribution of funds from,
and ensure appropriate administration and coordina-
tion of, the E-Government Fund established under
section 3604.
‘‘(6) Coordinate with the Administrator of Gen-
eral Services regarding programs undertaken by the
General Services Administration to promote elec-
tronic government and the efficient use of informa-
tion technologies by agencies.
‘‘(7) Lead the activities of the Chief Informa-
tion Officers Council established under section 3603
on behalf of the Deputy Director for Management,
who shall chair the council.
‘‘(8) Assist the Director in establishing policies
which shall set the framework for information tech-
nology standards for the Federal Government devel-
oped by the National Institute of Standards and
Technology and promulgated by the Secretary of
Commerce under section 11331 of title 40, taking
into account, if appropriate, recommendations of the
Chief Information Officers Council, experts, and in-
terested parties from the private and nonprofit sec-
tors and State, local, and tribal governments, and
maximizing the use of commercial standards as ap-
propriate, including the following:
‘‘(A) 
Standards 
and 
guidelines 
for
interconnectivity and interoperability as de-
scribed under section 3504.
‘‘(B) Consistent with the process under
section 207(d) of the E-Government Act of
2002, standards and guidelines for categorizing
Federal Government electronic information to
enable efficient use of technologies, such as
through the use of extensible markup language.
‘‘(C) Standards and guidelines for Federal
Government computer system efficiency and se-
curity.
‘‘(9) Sponsor ongoing dialogue that—
‘‘(A) shall be conducted among Federal,
State, local, and tribal government leaders on
electronic Government in the executive, legisla-
tive, and judicial branches, as well as leaders in
the private and nonprofit sectors, to encourage
collaboration and enhance understanding of
best practices and innovative approaches in ac-
quiring, using, and managing information re-
sources;
‘‘(B) is intended to improve the perform-
ance of governments in collaborating on the use
of information technology to improve the deliv-
ery of Government information and services;
and
‘‘(C) may include—
‘‘(i) 
development 
of 
innovative
models—
‘‘(I) for electronic Government
management and Government infor-
mation technology contracts; and
‘‘(II) that may be developed
through focused discussions or using
separately sponsored research;
‘‘(ii) identification of opportunities for
public-private collaboration in using Inter-
net-based technology to increase the effi-
ciency of Government-to-business trans-
actions;
‘‘(iii) identification of mechanisms for
providing incentives to program managers
and other Government employees to de-
velop and implement innovative uses of in-
formation technologies; and
‘‘(iv) identification of opportunities for
public, private, and intergovernmental col-
laboration in addressing the disparities in
access to the Internet and information
technology.
‘‘(10) Sponsor activities to engage the general
public in the development and implementation of
policies and programs, particularly activities aimed
at fulfilling the goal of using the most effective cit-
izen-centered strategies and those activities which
engage multiple agencies providing similar or related
information and services.
‘‘(11) Oversee the work of the General Services
Administration and other agencies in developing the
integrated Internet-based system under section 204
of the E-Government Act of 2002.
‘‘(12) Coordinate with the Administrator for
Federal Procurement Policy to ensure effective im-
plementation of electronic procurement initiatives.
‘‘(13) Assist Federal agencies, including the
General Services Administration, the Department of
Justice, and the United States Access Board in—
‘‘(A) implementing accessibility standards
under section 508 of the Rehabilitation Act of
1973 (29 U.S.C. 794d); and
‘‘(B) ensuring compliance with those
standards through the budget review process
and other means.
‘‘(14) Oversee the development of enterprise ar-
chitectures within and across agencies.
‘‘(15) Assist the Director and the Deputy Di-
rector for Management in overseeing agency efforts
to ensure that electronic Government activities incor-
porate adequate, risk-based, and cost-effective secu-
rity compatible with business processes.
‘‘(16) Administer the Office of Electronic Gov-
ernment established under this section.
‘‘(17) Assist the Director in preparing the E-
Government report established under section 3606.
‘‘(g) The Director shall ensure that the Office of
Management and Budget, including the Office of Elec-
tronic Government, the Office of Information and Regu-
latory Affairs, and other relevant offices, have adequate
staff and resources to properly fulfill all functions under
the E-Government Act of 2002.
‘‘§ 3603. Chief Information Officers Council
‘‘(a) There is established in the executive branch a
Chief Information Officers Council.
‘‘(b) The members of the Council shall be as follows:
‘‘(1) The Deputy Director for Management of
the Office of Management and Budget, who shall act
as chairperson of the Council.
‘‘(2) The Administrator of the Office of Elec-
tronic Government.
‘‘(3) The Administrator of the Office of Infor-
mation and Regulatory Affairs.
‘‘(4) The chief information officer of each agen-
cy described under section 901(b) of title 31.
‘‘(5) The chief information officer of the Cen-
tral Intelligence Agency.
‘‘(6) The chief information officer of the De-
partment of the Army, the Department of the Navy,
and the Department of the Air Force, if chief infor-
mation officers have been designated for such de-
partments under section 3506(a)(2)(B).
‘‘(B) Consistent with the process under
section 207(d) of the E-Government Act of
2002, standards and guidelines for categorizing
Federal Government electronic information to
enable efficient use of technologies, such as
through the use of extensible markup language.
‘‘(C) Standards and guidelines for Federal
Government computer system efficiency and se-
curity.
‘‘(6) Work with the Office of Personnel Man-
agement to assess and address the hiring, training,
classification, and professional development needs of
the Government related to information resources
management.
‘‘(7) Work with the Archivist of the United
States to assess how the Federal Records Act can be
addressed effectively by Federal information re-
sources management activities.
‘‘§ 3604. E-Government Fund
‘‘(a)(1) There is established in the Treasury of the
United States the E-Government Fund.
‘‘(2) The Fund shall be administered by the Adminis-
trator of the General Services Administration to support
projects approved by the Director, assisted by the Admin-
istrator of the Office of Electronic Government, that en-
able the Federal Government to expand its ability, through
the development and implementation of innovative uses of
the Internet or other electronic methods, to conduct activi-
ties electronically.
‘‘(3) Projects under this subsection may include ef-
forts to—
‘‘(A) make Federal Government information
and services more readily available to members of
the public (including individuals, businesses, grant-
ees, and State and local governments);
‘‘(B) make it easier for the public to apply for
benefits, receive services, pursue business opportuni-
ties, submit information, and otherwise conduct
transactions with the Federal Government; and
‘‘(C) enable Federal agencies to take advantage
of information technology in sharing information
and conducting transactions with each other and
with State and local governments.
‘‘(b)(1) The Administrator shall—
‘‘(A) establish procedures for accepting and re-
viewing proposals for funding;
‘‘(B) consult with interagency councils, includ-
ing the Chief Information Officers Council, the Chief
Financial Officers Council, and other interagency
management councils, in establishing procedures and
reviewing proposals; and
‘‘(C) assist the Director in coordinating re-
sources that agencies receive from the Fund with
other resources available to agencies for similar pur-
poses.
‘‘(2) When reviewing proposals and managing the
Fund, the Administrator shall observe and incorporate the
following procedures:
‘‘(A) A project requiring substantial involve-
ment or funding from an agency shall be approved
by a senior official with agencywide authority on be-
half of the head of the agency, who shall report di-
rectly to the head of the agency.
‘‘(B) Projects shall adhere to fundamental cap-
ital planning and investment control processes.
‘‘(C) Agencies shall identify in their proposals
resource commitments from the agencies involved
and how these resources would be coordinated with
support from the Fund, and include plans for poten-
tial continuation of projects after all funds made
available from the Fund are expended.
‘‘(D) After considering the recommendations of
the interagency councils, the Director, assisted by
the Administrator, shall have final authority to de-
termine which of the candidate projects shall be
funded from the Fund.
‘‘(E) Agencies shall assess the results of funded
projects.
‘‘(c) In determining which proposals to recommend
for funding, the Administrator—
‘‘(1) shall consider criteria that include whether
a proposal—
‘‘(A) identifies the group to be served, in-
cluding citizens, businesses, the Federal Gov-
ernment, or other governments;
‘‘(B) indicates what service or information
the project will provide that meets needs of
groups identified under subparagraph (A);
‘‘(C) ensures proper security and protects
privacy;
‘‘(D) is interagency in scope, including
projects implemented by a primary or single
agency that—
‘‘(i) could confer benefits on multiple
agencies; and
‘‘(ii) have the support of other agen-
cies; and
‘‘(E) has performance objectives that tie to
agency missions and strategic goals, and in-
terim results that relate to the objectives; and
‘‘(2) may also rank proposals based on criteria
that include whether a proposal—
‘‘(A) has Governmentwide application or
implications;
‘‘(B) has demonstrated support by the
public to be served;
‘‘(C) integrates Federal with State, local,
or tribal approaches to service delivery;
‘‘(D) identifies resource commitments from
nongovernmental sectors;
‘‘(E) identifies resource commitments from
the agencies involved;
‘‘(F) 
uses 
web-based 
technologies 
to
achieve objectives;
‘‘(G) identifies records management and
records access strategies;
‘‘(H) supports more effective citizen par-
ticipation in and interaction with agency activi-
ties that further progress toward a more cit-
izen-centered Government;
‘‘(I) directly delivers Government informa-
tion and services to the public or provides the
infrastructure for delivery;
‘‘(J) supports integrated service delivery;
‘‘(K) describes how business processes
across agencies will reflect appropriate trans-
formation simultaneous to technology imple-
mentation; and
‘‘(L) is new or innovative and does not
supplant existing funding streams within agen-
cies.
‘‘(d) The Fund may be used to fund the integrated
Internet-based system under section 204 of the E-Govern-
ment Act of 2002.
‘‘(e) None of the funds provided from the Fund may
be transferred to any agency until 15 days after the Ad-
ministrator of the General Services Administration has
submitted to the Committees on Appropriations of the
Senate and the House of Representatives, the Committee
on Governmental Affairs of the Senate, the Committee on
Government Reform of the House of Representatives, and
the appropriate authorizing committees of the Senate and
the House of Representatives, a notification and descrip-
tion of how the funds are to be allocated and how the ex-
penditure will further the purposes of this chapter.
‘‘(f)(1) The Director shall report annually to Con-
gress on the operation of the Fund, through the report
established under section 3606.
‘‘(2) The report under paragraph (1) shall describe—
‘‘(A) all projects which the Director has ap-
proved for funding from the Fund; and
‘‘(B) the results that have been achieved to date
for these funded projects.
‘‘(g)(1) There are authorized to be appropriated to
the Fund—
‘‘(A) $45,000,000 for fiscal year 2003;
‘‘(B) $50,000,000 for fiscal year 2004;
‘‘(C) $100,000,000 for fiscal year 2005;
‘‘(D) $150,000,000 for fiscal year 2006; and
‘‘(E) such sums as are necessary for fiscal year
2007.
‘‘(2) Funds appropriated under this subsection shall
remain available until expended.
‘‘§ 3605. Program to encourage innovative solutions
to enhance electronic Government serv-
ices and processes
‘‘(a) ESTABLISHMENT OF PROGRAM.—The Adminis-
trator shall establish and promote a Governmentwide pro-
gram to encourage contractor innovation and excellence in
facilitating the development and enhancement of electronic
Government services and processes.
‘‘(b) ISSUANCE OF ANNOUNCEMENTS SEEKING INNO-
VATIVE SOLUTIONS.—Under the program, the Adminis-
trator, in consultation with the Council and the Adminis-
trator for Federal Procurement Policy, shall issue an-
nouncements seeking unique and innovative solutions to
facilitate the development and enhancement of electronic
Government services and processes.
‘‘(c) 
MULTIAGENCY
TECHNICAL
ASSISTANCE
TEAM.—(1) The Administrator, in consultation with the
Council and the Administrator for Federal Procurement
Policy, shall convene a multiagency technical assistance
team to assist in screening proposals submitted to the Ad-
ministrator to provide unique and innovative solutions to
facilitate the development and enhancement of electronic
Government services and processes. The team shall be
composed of employees of the agencies represented on the
Council who have expertise in scientific and technical dis-
ciplines that would facilitate the assessment of the feasi-
bility of the proposals.
‘‘(2) The technical assistance team shall—
‘‘(A) assess the feasibility, scientific and tech-
nical merits, and estimated cost of each proposal;
and
‘‘(B) submit each proposal, and the assessment
of the proposal, to the Administrator.
‘‘(3) The technical assistance team shall not consider
or evaluate proposals submitted in response to a solicita-
tion for offers for a pending procurement or for a specific
agency requirement.
‘‘(4) After receiving proposals and assessments from
the technical assistance team, the Administrator shall con-
sider recommending appropriate proposals for funding
under the E-Government Fund established under section
3604 or, if appropriate, forward the proposal and the as-
sessment of it to the executive agency whose mission most
coincides with the subject matter of the proposal.
‘‘§ 3606. E-Government report
‘‘(a) Not later than March 1 of each year, the Direc-
tor shall submit an E-Government status report to the
Committee on Governmental Affairs of the Senate and the
Committee on Government Reform of the House of Rep-
resentatives.
‘‘(b) The report under subsection (a) shall contain—
‘‘(1) a summary of the information reported by
agencies under section 202(f) of the E-Government
Act of 2002;
‘‘(2) the information required to be reported by
section 3604(f); and
‘‘(3) a description of compliance by the Federal
Government with other goals and provisions of the
E-Government Act of 2002.’’.
(b) TECHNICAL AND CONFORMING AMENDMENT.—
The table of chapters for title 44, United States Code,
is amended by inserting after the item relating to chapter
35 the following:
‘‘36. Management and Promotion of Electronic Govern-
ment Services .......................................................... 3601’’.
SEC. 102. CONFORMING AMENDMENTS.
(a) ELECTRONIC GOVERNMENT AND INFORMATION
TECHNOLOGIES.—
(1) IN GENERAL.—Chapter 3 of title 40, United
States Code, is amended by inserting after section
304 the following new section:
‘‘§ 305. Electronic Government and information tech-
nologies
‘‘The Administrator of General Services shall consult
with the Administrator of the Office of Electronic Govern-
ment on programs undertaken by the General Services Ad-
ministration to promote electronic Government and the ef-
ficient use of information technologies by Federal agen-
cies.’’.
(2) TECHNICAL
AND
CONFORMING
AMEND-
MENT.—The table of sections for chapter 3 of such
title is amended by inserting after the item relating
to section 304 the following:
‘‘305. Electronic Government and information technologies.’’.
(b) MODIFICATION OF DEPUTY DIRECTOR FOR MAN-
AGEMENT FUNCTIONS.—Section 503(b) of title 31, United
States Code, is amended—
(1) by redesignating paragraphs (5), (6), (7),
(8), and (9), as paragraphs (6), (7), (8), (9), and
(10), respectively; and
(2) by inserting after paragraph (4) the fol-
lowing:
‘‘(5) Chair the Chief Information Officers
Council established under section 3603 of title 44.’’.
(c) OFFICE OF ELECTRONIC GOVERNMENT.—
(1) IN GENERAL.—Chapter 5 of title 31, United
States Code, is amended by inserting after section
506 the following:
‘‘§ 507. Office of Electronic Government
‘‘The Office of Electronic Government, established
under section 3602 of title 44, is an office in the Office
of Management and Budget.’’.
(2) TECHNICAL
AND
CONFORMING
AMEND-
MENT.—The table of sections for chapter 5 of title
31, United States Code, is amended by inserting
after the item relating to section 506 the following:
‘‘507. Office of Electronic Government.’’.
TITLE 
II—FEDERAL 
MANAGE-
MENT AND PROMOTION OF
ELECTRONIC 
GOVERNMENT
SERVICES
SEC. 201. DEFINITIONS.
Except as otherwise provided, in this title the defini-
tions under sections 3502 and 3601 of title 44, United
States Code, shall apply.
SEC. 202. FEDERAL AGENCY RESPONSIBILITIES.
(a) IN GENERAL.—The head of each agency shall be
responsible for—
(1) complying with the requirements of this Act
(including the amendments made by this Act), the
related information resource management policies
and guidance established by the Director of the Of-
fice of Management and Budget, and the related in-
formation technology standards promulgated by the
Secretary of Commerce;
(2) ensuring that the information resource
management policies and guidance established under
this Act by the Director, and the related information
technology standards promulgated by the Secretary
of Commerce are communicated promptly and effec-
tively to all relevant officials within their agency;
and
(3) supporting the efforts of the Director and
the Administrator of the General Services Adminis-
tration to develop, maintain, and promote an inte-
grated Internet-based system of delivering Federal
Government information and services to the public
under section 204.
(b) PERFORMANCE INTEGRATION.—
(1) Agencies shall develop performance meas-
ures that demonstrate how electronic government en-
ables progress toward agency objectives, strategic
goals, and statutory mandates.
(2) In measuring performance under this sec-
tion, agencies shall rely on existing data collections
to the extent practicable.
(3) Areas of performance measurement that
agencies should consider include—
(A) customer service;
(B) agency productivity; and
(C) adoption of innovative information
technology, including the appropriate use of
commercial best practices.
(4) Agencies shall link their performance goals,
as appropriate, to key groups, including citizens,
businesses, and other governments, and to internal
Federal Government operations.
(5) As appropriate, agencies shall work collec-
tively in linking their performance goals to groups
identified under paragraph (4) and shall use infor-
mation technology in delivering Government infor-
mation and services to those groups.
(c) AVOIDING DIMINISHED ACCESS.—When promul-
gating policies and implementing programs regarding the
provision of Government information and services over the
Internet, agency heads shall consider the impact on per-
sons without access to the Internet, and shall, to the ex-
tent practicable—
(1) ensure that the availability of Government
information and services has not been diminished for
individuals who lack access to the Internet; and
(2) pursue alternate modes of delivery that
make Government information and services more ac-
cessible to individuals who do not own computers or
lack access to the Internet.
(d) ACCESSIBILITY
TO PEOPLE WITH DISABIL-
ITIES.—All actions taken by Federal departments and
agencies under this Act shall be in compliance with section
508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).
(e) SPONSORED ACTIVITIES.—Agencies shall sponsor
activities that use information technology to engage the
public in the development and implementation of policies
and programs.
(f) CHIEF INFORMATION OFFICERS.—The Chief In-
formation Officer of each of the agencies designated under
chapter 36 of title 44, United States Code (as added by
this Act) shall be responsible for—
(1) participating in the functions of the Chief
Information Officers Council; and
(2) monitoring the implementation, within their
respective agencies, of information technology stand-
ards promulgated by the Secretary of Commerce, in-
cluding common standards for interconnectivity and
interoperability, categorization of Federal Govern-
ment electronic information, and computer system
efficiency and security.
(g) E-GOVERNMENT STATUS REPORT.—
(1) IN GENERAL.—Each agency shall compile
and submit to the Director an annual E-Government
Status Report on—
(A) the status of the implementation by
the agency of electronic government initiatives;
(B) compliance by the agency with this
Act; and
(C) how electronic Government initiatives
of the agency improve performance in delivering
programs to constituencies.
(2) SUBMISSION.—Each agency shall submit an
annual report under this subsection—
(A) to the Director at such time and in
such manner as the Director requires;
(B) consistent with related reporting re-
quirements; and
(C) which addresses any section in this
title relevant to that agency.
(h) USE OF TECHNOLOGY.—Nothing in this Act su-
persedes the responsibility of an agency to use or manage
information technology to deliver Government information
and services that fulfill the statutory mission and pro-
grams of the agency.
(i) NATIONAL SECURITY SYSTEMS.—
(1) INAPPLICABILITY.—Except as provided
under paragraph (2), this title does not apply to na-
tional security systems as defined in section 11103
of title 40, United States Code.
(2) APPLICABILITY.—This section, section 203,
and section 214 do apply to national security sys-
tems to the extent practicable and consistent with
law.
SEC. 203. COMPATIBILITY OF EXECUTIVE AGENCY METH-
ODS FOR USE AND ACCEPTANCE OF ELEC-
TRONIC SIGNATURES.
(a) PURPOSE.—The purpose of this section is to
achieve interoperable implementation of electronic signa-
tures for appropriately secure electronic transactions with
Government.
(b) ELECTRONIC SIGNATURES.—In order to fulfill
the objectives of the Government Paperwork Elimination
Act (Public Law 105–277; 112 Stat. 2681–749 through
2681–751), each Executive agency (as defined under sec-
tion 105 of title 5, United States Code) shall ensure that
its methods for use and acceptance of electronic signatures
are compatible with the relevant policies and procedures
issued by the Director.
(c) AUTHORITY FOR ELECTRONIC SIGNATURES.—
The Administrator of General Services shall support the
Director by establishing a framework to allow efficient
interoperability among Executive agencies when using
electronic signatures, including processing of digital signa-
tures.
(d) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the General Services
Administration, to ensure the development and operation
of a Federal bridge certification authority for digital sig-
nature compatibility, and for other activities consistent
with this section, $8,000,000 or such sums as are nec-
essary in fiscal year 2003, and such sums as are necessary
for each fiscal year thereafter.
SEC. 204. FEDERAL INTERNET PORTAL.
(a) IN GENERAL.—
(1) PUBLIC ACCESS.—The Director shall work
with the Administrator of the General Services Ad-
ministration and other agencies to maintain and pro-
mote an integrated Internet-based system of pro-
viding the public with access to Government infor-
mation and services.
(2) CRITERIA.—To the extent practicable, the
integrated system shall be designed and operated ac-
cording to the following criteria:
(A) The provision of Internet-based Gov-
ernment information and services directed to
key groups, including citizens, business, and
other governments, and integrated according to
function or topic rather than separated accord-
ing to the boundaries of agency jurisdiction.
(B) An ongoing effort to ensure that Inter-
net-based Government services relevant to a
given citizen activity are available from a single
point.
(C) Access to Federal Government infor-
mation and services consolidated, as appro-
priate, with Internet-based information and
services provided by State, local, and tribal gov-
ernments.
(D) Access to Federal Government infor-
mation held by 1 or more agencies shall be
made available in a manner that protects pri-
vacy, consistent with law.
(b) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated to the General Services
Administration $15,000,000 for the maintenance, im-
provement, and promotion of the integrated Internet-
based system for fiscal year 2003, and such sums as are
necessary for fiscal years 2004 through 2007.
SEC. 205. FEDERAL COURTS.
(a) INDIVIDUAL COURT WEBSITES.—The Chief Jus-
tice of the United States, the chief judge of each circuit
and district and of the Court of Federal Claims, and the
chief bankruptcy judge of each district shall cause to be
established and maintained, for the court of which the
judge is chief justice or judge, a website that contains the
following information or links to websites with the fol-
lowing information:
(1) Location and contact information for the
courthouse, including the telephone numbers and
contact names for the clerk’s office and justices’ or
judges’ chambers.
(2) Local rules and standing or general orders
of the court.
(3) Individual rules, if in existence, of each jus-
tice or judge in that court.
(4) Access to docket information for each case.
(5) Access to the substance of all written opin-
ions issued by the court, regardless of whether such
opinions are to be published in the official court re-
porter, in a text searchable format.
(6) Access to documents filed with the court-
house in electronic form, to the extent provided
under subsection (c).
(7) Any other information (including forms in
a format that can be downloaded) that the court de-
termines useful to the public.
(b) MAINTENANCE OF DATA ONLINE.—
(1) UPDATE OF INFORMATION.—The informa-
tion and rules on each website shall be updated reg-
ularly and kept reasonably current.
(2) CLOSED CASES.—Electronic files and docket
information for cases closed for more than 1 year
are not required to be made available online, except
all written opinions with a date of issuance after the
effective date of this section shall remain available
online.
(c) ELECTRONIC FILINGS.—
(1) IN GENERAL.—Except as provided under
paragraph (2) or in the rules prescribed under para-
graph (3), each court shall make any document that
is filed electronically publicly available online. A
court may convert any document that is filed in
paper form to electronic form. To the extent such
conversions are made, all such electronic versions of
the document shall be made available online.
(2) EXCEPTIONS.—Documents that are filed
that are not otherwise available to the public, such
as documents filed under seal, shall not be made
available online.
(3) PRIVACY AND SECURITY CONCERNS.—(A)(i)
The Supreme Court shall prescribe rules, in accord-
ance with sections 2072 and 2075 of title 28, United
States Code, to protect privacy and security con-
cerns relating to electronic filing of documents and
the public availability under this subsection of docu-
ments filed electronically.
(ii) Such rules shall provide to the extent prac-
ticable for uniform treatment of privacy and security
issues throughout the Federal courts.
(iii) Such rules shall take into consideration
best practices in Federal and State courts to protect
private information or otherwise maintain necessary
information security.
(iv) To the extent that such rules provide for
the redaction of certain categories of information in
order to protect privacy and security concerns, such
rules shall provide that a party that wishes to file
an otherwise proper document containing such infor-
mation may file an unredacted document under seal,
which shall be retained by the court as part of the
record, and which, at the discretion of the court and
subject to any applicable rules issued in accordance
with chapter 131 of title 28, United States Code,
shall be either in lieu of, or in addition, to, a re-
dacted copy in the public file.
(B)(i) Subject to clause (ii), the Judicial Con-
ference of the United States may issue interim rules,
and interpretive statements relating to the applica-
tion of such rules, which conform to the require-
ments of this paragraph and which shall cease to
have effect upon the effective date of the rules re-
quired under subparagraph (A).
(ii) Pending issuance of the rules required
under subparagraph (A), any rule or order of any
court, or of the Judicial Conference, providing for
the redaction of certain categories of information in
order to protect privacy and security concerns aris-
ing from electronic filing shall comply with, and be
construed in conformity with, subparagraph (A)(iv).
(C) Not later than 1 year after the rules pre-
scribed under subparagraph (A) take effect, and
every 2 years thereafter, the Judicial Conference
shall submit to Congress a report on the adequacy
of those rules to protect privacy and security.
(d) DOCKETS WITH LINKS TO DOCUMENTS.—The
Judicial Conference of the United States shall explore the
feasibility of technology to post online dockets with links
allowing all filings, decisions, and rulings in each case to
be obtained from the docket sheet of that case.
(e) COST OF PROVIDING ELECTRONIC DOCKETING
INFORMATION.—Section 303(a) of the Judiciary Appro-
priations Act, 1992 (28 U.S.C. 1913 note) is amended in
the first sentence by striking ‘‘shall hereafter’’ and insert-
ing ‘‘may, only to the extent necessary,’’.
(f) TIME REQUIREMENTS.—Not later than 2 years
after the effective date of this title, the websites under
subsection (a) shall be established, except that access to
documents filed in electronic form shall be established not
later than 4 years after that effective date.
(g) DEFERRAL.—
(1) IN GENERAL.—
(A) ELECTION.—
(i) NOTIFICATION.—The Chief Justice
of the United States, a chief judge, or
chief bankruptcy judge may submit a noti-
fication to the Administrative Office of the
United States Courts to defer compliance
with any requirement of this section with
respect to the Supreme Court, a court of
appeals, district, or the bankruptcy court
of a district.
(ii) CONTENTS.—A notification sub-
mitted under this subparagraph shall
state—
(I) the reasons for the deferral;
and
(II) the online methods, if any,
or any alternative methods, such court
or district is using to provide greater
public access to information.
(B) EXCEPTION.—To the extent that the
Supreme Court, a court of appeals, district, or
bankruptcy court of a district maintains a
website under subsection (a), the Supreme
Court or that court of appeals or district shall
comply with subsection (b)(1).
(2) REPORT.—Not later than 1 year after the
effective date of this title, and every year thereafter,
the Judicial Conference of the United States shall
submit a report to the Committees on Governmental
Affairs and the Judiciary of the Senate and the
Committees on Government Reform and the Judici-
ary of the House of Representatives that—
(A) contains all notifications submitted to
the Administrative Office of the United States
Courts under this subsection; and
(B) summarizes and evaluates all notifica-
tions.
SEC. 206. REGULATORY AGENCIES.
(a) PURPOSES.—The purposes of this section are
to—
(1) improve performance in the development
and issuance of agency regulations by using infor-
mation technology to increase access, accountability,
and transparency; and
(2) enhance public participation in Government
by electronic means, consistent with requirements
under subchapter II of chapter 5 of title 5, United
States Code, (commonly referred to as the ‘‘Admin-
istrative Procedures Act’’).
(b) INFORMATION PROVIDED
BY AGENCIES ON-
LINE.—To the extent practicable as determined by the
agency in consultation with the Director, each agency (as
defined under section 551 of title 5, United States Code)
shall ensure that a publicly accessible Federal Government
website includes all information about that agency re-
quired to be published in the Federal Register under para-
graphs (1) and (2) of section 552(a) of title 5, United
States Code.
(c) SUBMISSIONS BY ELECTRONIC MEANS.—To the
extent practicable, agencies shall accept submissions under
section 553(c) of title 5, United States Code, by electronic
means.
(d) ELECTRONIC DOCKETING.—
(1) IN GENERAL.—To the extent practicable, as
determined by the agency in consultation with the
Director, agencies shall ensure that a publicly acces-
sible Federal Government website contains electronic
dockets for rulemakings under section 553 of title 5,
United States Code.
(2) INFORMATION
AVAILABLE.—Agency elec-
tronic dockets shall make publicly available online to
the extent practicable, as determined by the agency
in consultation with the Director—
(A) all submissions under section 553(c) of
title 5, United States Code; and
(B) other materials that by agency rule or
practice are included in the rulemaking docket
under section 553(c) of title 5, United States
Code, whether or not submitted electronically.
(e) TIME LIMITATION.—Agencies shall implement the
requirements of this section consistent with a timetable
established by the Director and reported to Congress in
the first annual report under section 3606 of title 44 (as
added by this Act).
SEC. 207. ACCESSIBILITY, USABILITY, AND PRESERVATION
OF GOVERNMENT INFORMATION.
(a) PURPOSE.—The purpose of this section is to im-
prove the methods by which Government information, in-
cluding information on the Internet, is organized, pre-
served, and made accessible to the public.
(b) DEFINITIONS.—In this section, the term—
(1) ‘‘Committee’’ means the Interagency Com-
mittee on Government Information established under
subsection (c); and
(2) ‘‘directory’’ means a taxonomy of subjects
linked to websites that—
(A) organizes Government information on
the Internet according to subject matter; and
(B) may be created with the participation
of human editors.
(c) INTERAGENCY COMMITTEE.—
(1) ESTABLISHMENT.—Not later than 180 days
after the date of enactment of this title, the Director
shall establish the Interagency Committee on Gov-
ernment Information.
(2) MEMBERSHIP.—The Committee shall be
chaired by the Director or the designee of the Direc-
tor and—
(A) shall include representatives from—
(i) the National Archives and Records
Administration;
(ii) the offices of the Chief Informa-
tion Officers from Federal agencies; and
(iii) other relevant officers from the
executive branch; and
(B) may include representatives from the
Federal legislative and judicial branches.
(3) FUNCTIONS.—The Committee shall—
(A) engage in public consultation to the
maximum extent feasible, including consultation
with interested communities such as public ad-
vocacy organizations;
(B) conduct studies and submit rec-
ommendations, as provided under this section,
to the Director and Congress; and
(C) share effective practices for access to,
dissemination of, and retention of Federal in-
formation.
(4) TERMINATION.—The Committee may be
terminated on a date determined by the Director, ex-
cept the Committee may not terminate before the
Committee submits all recommendations required
under this section.
(d) CATEGORIZING OF INFORMATION.—
(1) COMMITTEE FUNCTIONS.—Not later than 2
years after the date of enactment of this Act, the
Committee shall submit recommendations to the Di-
rector on—
(A) the adoption of standards, which are
open to the maximum extent feasible, to enable
the organization and categorization of Govern-
ment information—
(i) in a way that is searchable elec-
tronically, including by searchable identi-
fiers; and
(iii) in ways that are interoperable
across agencies;
(B) the definition of categories of Govern-
ment information which should be classified
under the standards; and
(C) determining priorities and developing
schedules for the initial implementation of the
standards by agencies.
(2) FUNCTIONS OF THE DIRECTOR.—Not later
than 1 year after the submission of recommenda-
tions under paragraph (1), the Director shall issue
policies—
(A) requiring that agencies use standards,
which are open to the maximum extent feasible,
to enable the organization and categorization of
Government information—
(i) in a way that is searchable elec-
tronically, including by searchable identi-
fiers;
(ii) in ways that are interoperable
across agencies; and
(iii) that are, as appropriate, con-
sistent with the provisions under section
3602(f)(8) of title 44, United States Code;
(B) defining categories of Government in-
formation which shall be required to be classi-
fied under the standards; and
(C) determining priorities and developing
schedules for the initial implementation of the
standards by agencies.
(3) MODIFICATION
OF
POLICIES.—After the
submission of agency reports under paragraph (4),
the Director shall modify the policies, as needed, in
consultation with the Committee and interested par-
ties.
(4) AGENCY
FUNCTIONS.—Each agency shall
report annually to the Director, in the report estab-
lished under section 202(g), on compliance of that
agency with the policies issued under paragraph
(2)(A).
(e) PUBLIC ACCESS
TO ELECTRONIC INFORMA-
TION.—
(1) COMMITTEE FUNCTIONS.—Not later than 2
years after the date of enactment of this Act, the
Committee shall submit recommendations to the Di-
rector and the Archivist of the United States on—
(A) the adoption by agencies of policies
and procedures to ensure that chapters 21, 25,
27, 29, and 31 of title 44, United States Code,
are applied effectively and comprehensively to
Government information on the Internet and to
other electronic records; and
(B) the imposition of timetables for the
implementation of the policies and procedures
by agencies.
(2) FUNCTIONS OF THE ARCHIVIST.—Not later
than 1 year after the submission of recommenda-
tions by the Committee under paragraph (1), the
Archivist of the United States shall issue policies—
(A) requiring the adoption by agencies of
policies and procedures to ensure that chapters
21, 25, 27, 29, and 31 of title 44, United
States Code, are applied effectively and com-
prehensively to Government information on the
Internet and to other electronic records; and
(B) imposing timetables for the implemen-
tation of the policies, procedures, and tech-
nologies by agencies.
(3) MODIFICATION
OF
POLICIES.—After the
submission of agency reports under paragraph (4),
the Archivist of the United States shall modify the
policies, as needed, in consultation with the Com-
mittee and interested parties.
(4) AGENCY
FUNCTIONS.—Each agency shall
report annually to the Director, in the report estab-
lished under section 202(g), on compliance of that
agency with the policies issued under paragraph
(2)(A).
(f) AGENCY WEBSITES.—
(1) STANDARDS FOR AGENCY WEBSITES.—Not
later than 2 years after the effective date of this
title, the Director shall promulgate guidance for
agency websites that includes—
(A) requirements that websites include di-
rect links to—
(i) descriptions of the mission and
statutory authority of the agency;
(ii) information made available to the
public under subsections (a)(1) and (b) of
section 552 of title 5, United States Code
(commonly referred to as the ‘‘Freedom of
Information Act’’);
(iii) information about the organiza-
tional structure of the agency; and
(iv) the strategic plan of the agency
developed under section 306 of title 5,
United States Code; and
(B) minimum agency goals to assist public
users to navigate agency websites, including—
(i) speed of retrieval of search results;
(ii) the relevance of the results;
(iii) 
tools 
to 
aggregate 
and
disaggregate data; and
(iv) security protocols to protect infor-
mation.
(2) AGENCY
REQUIREMENTS.—(A) Not later
than 2 years after the date of enactment of this Act,
each agency shall—
(i) consult with the Committee and solicit
public comment;
(ii) establish a process for determining
which Government information the agency in-
tends to make available and accessible to the
public on the Internet and by other means;
(iii) develop priorities and schedules for
making Government information available and
accessible;
(iv) make such final determinations, prior-
ities, and schedules available for public com-
ment;
(v) post such final determinations, prior-
ities, and schedules on the Internet; and
(vi) submit such final determinations, pri-
orities, and schedules to the Director, in the re-
port established under section 202(g).
(B) Each agency shall update determinations,
priorities, and schedules of the agency, as needed,
after consulting with the Committee and soliciting
public comment, if appropriate.
(3) PUBLIC
DOMAIN
DIRECTORY
OF
PUBLIC
FEDERAL GOVERNMENT WEBSITES.—
(A) ESTABLISHMENT.—Not later than 2
years after the effective date of this title, the
Director and each agency shall—
(i) develop and establish a public do-
main directory of public Federal Govern-
ment websites; and
(ii) post the directory on the Internet
with a link to the integrated Internet-based
system established under section 204.
(B) DEVELOPMENT.—With the assistance
of each agency, the Director shall—
(i) direct the development of the direc-
tory through a collaborative effort, includ-
ing input from—
(I) agency librarians;
(II) information technology man-
agers;
(III) program managers;
(IV) records managers;
(V) Federal depository librarians;
and
(VI) other interested parties; and
(ii) develop a public domain taxonomy
of subjects used to review and categorize
public Federal Government websites.
(C) UPDATE.—With the assistance of each
agency, the Administrator of the Office of Elec-
tronic Government shall—
(i) update the directory as necessary,
but not less than every 6 months; and
(ii) solicit interested persons for im-
provements to the directory.
(g) ACCESS TO FEDERALLY FUNDED RESEARCH AND
DEVELOPMENT.—
(1) DEVELOPMENT AND MAINTENANCE OF GOV-
ERNMENTWIDE REPOSITORY AND WEBSITE.—
(A) REPOSITORY AND WEBSITE.—The Di-
rector of the Office of Management and Budget
(or the Director’s delegate), in consultation
with the Director of the Office of Science and
Technology Policy and other relevant agencies,
shall ensure the development and maintenance
of—
(i) a repository that fully integrates,
to the maximum extent feasible, informa-
tion about research and development fund-
ed by the Federal Government, and the re-
pository shall—
(I) include information about re-
search and development funded by the
Federal Government, consistent with
any relevant protections for the infor-
mation under section 552 of title 5,
United States Code, and performed
by—
(aa) institutions not a part
of the Federal Government, in-
cluding State, local, and foreign
governments; 
industrial 
firms;
educational institutions; not-for-
profit 
organizations; 
federally
funded research and development
centers; and private individuals;
and
(bb) entities of the Federal
Government, including research
and 
development 
laboratories,
centers, and offices; and
(II) integrate information about each
separate research and development task or
award, including—
(aa) the dates upon which
the task or award is expected to
start and end;
(bb) a brief summary de-
scribing the objective and the sci-
entific and technical focus of the
task or award;
(cc) the entity or institution
performing the task or award
and its contact information;
(dd) the total amount of
Federal funds expected to be pro-
vided to the task or award over
its lifetime and the amount of
funds expected to be provided in
each fiscal year in which the
work of the task or award is on-
going;
(ee) 
any 
restrictions 
at-
tached to the task or award that
would prevent the sharing with
the general public of any or all of
the information required by this
subsection, and the reasons for
such restrictions; and
(ff) such other information
as may be determined to be ap-
propriate; and
(ii) 1 or more websites upon which all
or part of the repository of Federal re-
search and development shall be made
available to and searchable by Federal
agencies and non-Federal entities, includ-
ing the general public, to facilitate—
(I) the coordination of Federal
research and development activities;
(II) collaboration among those
conducting Federal research and de-
velopment;
(III) the transfer of technology
among Federal agencies and between
Federal agencies and non-Federal en-
tities; and
(IV) access by policymakers and
the public to information concerning
Federal research and development ac-
tivities.
(B) OVERSIGHT.—The Director of the Of-
fice of Management and Budget shall issue any
guidance determined necessary to ensure that
agencies provide all information requested
under this subsection.
(2) AGENCY
FUNCTIONS.—Any agency that
funds Federal research and development under this
subsection shall provide the information required to
populate the repository in the manner prescribed by
the Director of the Office of Management and Budg-
et.
(3) COMMITTEE
FUNCTIONS.—Not later than
18 months after the date of enactment of this Act,
working with the Director of the Office of Science
and Technology Policy, and after consultation with
interested parties, the Committee shall submit rec-
ommendations to the Director on—
(A) policies to improve agency reporting of
information for the repository established under
this subsection; and
(B) policies to improve dissemination of
the results of research performed by Federal
agencies and federally funded research and de-
velopment centers.
(4) FUNCTIONS OF THE DIRECTOR.—After sub-
mission of recommendations by the Committee under
paragraph (3), the Director shall report on the rec-
ommendations of the Committee and Director to
Congress, in the E-Government report under section
3606 of title 44 (as added by this Act).
(5) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated for the de-
velopment, maintenance, and operation of the Gov-
ernmentwide repository and website under this
subsection—
(A) $2,000,000 in each of the fiscal years
2003 through 2005; and
(B) such sums as are necessary in each of
the fiscal years 2006 and 2007.
SEC. 208. PRIVACY PROVISIONS.
(a) PURPOSE.—The purpose of this section is to en-
sure sufficient protections for the privacy of personal in-
formation as agencies implement citizen-centered elec-
tronic Government.
(b) PRIVACY IMPACT ASSESSMENTS.—
(1) RESPONSIBILITIES OF AGENCIES.—
(A) IN GENERAL.—An agency shall take
actions described under subparagraph (B)
before—
(i) developing or procuring informa-
tion technology that collects, maintains, or
disseminates information that is in an
identifiable form; or
(ii) initiating a new collection of infor-
mation that—
(I) will be collected, maintained,
or disseminated using information
technology; and
(II) includes any information in
an identifiable form permitting the
physical or online contacting of a spe-
cific individual, if identical questions
have been posed to, or identical re-
porting requirements imposed on, 10
or more persons, other than agencies,
instrumentalities, or employees of the
Federal Government.
(B) AGENCY ACTIVITIES.—To the extent
required under subparagraph (A), each agency
shall—
(i) conduct a privacy impact assess-
ment;
(ii) ensure the review of the privacy
impact assessment by the Chief Informa-
tion Officer, or equivalent official, as deter-
mined by the head of the agency; and
(iii) if practicable, after completion of
the review under clause (ii), make the pri-
vacy impact assessment publicly available
through the website of the agency, publica-
tion in the Federal Register, or other
means.
(C) SENSITIVE
INFORMATION.—Subpara-
graph (B)(iii) may be modified or waived for se-
curity reasons, or to protect classified, sensitive,
or private information contained in an assess-
ment.
(D) COPY TO DIRECTOR.—Agencies shall
provide the Director with a copy of the privacy
impact assessment for each system for which
funding is requested.
(2) CONTENTS OF A PRIVACY IMPACT ASSESS-
MENT.—
(A) IN
GENERAL.—The Director shall
issue guidance to agencies specifying the re-
quired contents of a privacy impact assessment.
(B) GUIDANCE.—The guidance shall—
(i) ensure that a privacy impact as-
sessment is commensurate with the size of
the information system being assessed, the
sensitivity of information that is in an
identifiable form in that system, and the
risk of harm from unauthorized release of
that information; and
(ii) require that a privacy impact as-
sessment address—
(I) what information is to be col-
lected;
(II) why the information is being
collected;
(III) the intended use of the
agency of the information;
(IV) with whom the information
will be shared;
(V) what notice or opportunities
for consent would be provided to indi-
viduals regarding what information is
collected and how that information is
shared;
(VI) how the information will be
secured; and
(VII) 
whether 
a 
system 
of
records is being created under section
552a of title 5, United States Code,
(commonly referred to as the ‘‘Privacy
Act’’).
(3) RESPONSIBILITIES
OF
THE
DIRECTOR.—
The Director shall—
(A) develop policies and guidelines for
agencies on the conduct of privacy impact as-
sessments;
(B) oversee the implementation of the pri-
vacy impact assessment process throughout the
Government; and
(C) require agencies to conduct privacy im-
pact assessments of existing information sys-
tems or ongoing collections of information that
is in an identifiable form as the Director deter-
mines appropriate.
(c) 
PRIVACY
PROTECTIONS
ON
AGENCY
WEBSITES.—
(1) PRIVACY POLICIES ON WEBSITES.—
(A) GUIDELINES FOR NOTICES.—The Di-
rector shall develop guidance for privacy notices
on agency websites used by the public.
(B) CONTENTS.—The guidance shall re-
quire that a privacy notice address, consistent
with section 552a of title 5, United States
Code—
(i) what information is to be collected;
(ii) why the information is being col-
lected;
(iii) the intended use of the agency of
the information;
(iv) with whom the information will be
shared;
(v) what notice or opportunities for
consent would be provided to individuals
regarding what information is collected
and how that information is shared;
(vi) how the information will be se-
cured; and
(vii) the rights of the individual under
section 552a of title 5, United States Code
(commonly referred to as the ‘‘Privacy
Act’’), and other laws relevant to the pro-
tection of the privacy of an individual.
(2) PRIVACY POLICIES IN MACHINE-READABLE
FORMATS.—The Director shall issue guidance re-
quiring agencies to translate privacy policies into a
standardized machine-readable format.
(d) DEFINITION.—In this section, the term ‘‘identifi-
able form’’ means any representation of information that
permits the identity of an individual to whom the informa-
tion applies to be reasonably inferred by either direct or
indirect means.
SEC. 209. FEDERAL INFORMATION TECHNOLOGY WORK-
FORCE DEVELOPMENT.
(a) PURPOSE.—The purpose of this section is to im-
prove the skills of the Federal workforce in using informa-
tion technology to deliver Government information and
services.
(b) WORKFORCE DEVELOPMENT.—
(1) IN GENERAL.—In consultation with the Di-
rector of the Office of Management and Budget, the
Chief Information Officers Council, and the Admin-
istrator of General Services, the Director of the Of-
fice of Personnel Management shall—
(A) analyze, on an ongoing basis, the per-
sonnel needs of the Federal Government related
to information technology and information re-
source management;
(B) identify where current information
technology and information resource manage-
ment training do not satisfy the personnel
needs described in subparagraph (A);
(C) oversee the development of curricula,
training methods, and training priorities that
correspond to the projected personnel needs of
the Federal Government related to information
technology and information resource manage-
ment; and
(D) assess the training of Federal employ-
ees in information technology disciplines in
order to ensure that the information resource
management needs of the Federal Government
are addressed.
(2) INFORMATION TECHNOLOGY TRAINING PRO-
GRAMS.—The head of each Executive agency, after
consultation with the Director of the Office of Per-
sonnel Management, the Chief Information Officers
Council, and the Administrator of General Services,
shall establish and operate information technology
training programs consistent with the requirements
of this subsection. Such programs shall—
(A) have curricula covering a broad range
of 
information 
technology 
disciplines 
cor-
responding to the specific information tech-
nology and information resource management
needs of the agency involved;
(B) be developed and applied according to
rigorous standards; and
(C) be designed to maximize efficiency,
through the use of self-paced courses, online
courses, on-the-job training, and the use of re-
mote instructors, wherever such features can be
applied without reducing the effectiveness of the
training or negatively impacting academic
standards.
(3) GOVERNMENTWIDE POLICIES AND EVALUA-
TION.—The Director of the Office of Personnel
Management, in coordination with the Director of
the Office of Management and Budget, shall issue
policies to promote the development of performance
standards for training and uniform implementation
of this subsection by Executive agencies, with due
regard for differences in program requirements
among agencies that may be appropriate and war-
ranted in view of the agency mission. The Director
of the Office of Personnel Management shall evalu-
ate the implementation of the provisions of this sub-
section by Executive agencies.
(4) CHIEF
INFORMATION
OFFICER
AUTHORI-
TIES
AND
RESPONSIBILITIES.—Subject to the au-
thority, direction, and control of the head of an Ex-
ecutive agency, the chief information officer of such
agency shall carry out all powers, functions, and du-
ties of the head of the agency with respect to imple-
mentation of this subsection. The chief information
officer shall ensure that the policies of the agency
head established in accordance with this subsection
are implemented throughout the agency.
(5) INFORMATION TECHNOLOGY TRAINING RE-
PORTING.—The Director of the Office of Manage-
ment and Budget shall ensure that the heads of Ex-
ecutive agencies collect and maintain standardized
information on the information technology and infor-
mation resources management workforce related to
the implementation of this subsection.
(6) AUTHORITY
TO
DETAIL
EMPLOYEES
TO
NON-FEDERAL
EMPLOYERS.—In carrying out the
preceding provisions of this subsection, the Director
of the Office of Personnel Management may provide
for a program under which a Federal employee may
be detailed to a non-Federal employer. The Director
of the Office of Personnel Management shall pre-
scribe regulations for such program, including the
conditions for service and duties as the Director con-
siders necessary.
(7) COORDINATION PROVISION.—An assignment
described in section 3703 of title 5, United States
Code, may not be made unless a program under
paragraph (6) is established, and the assignment is
made in accordance with the requirements of such
program.
(8) EMPLOYEE PARTICIPATION.—Subject to in-
formation resource management needs and the limi-
tations imposed by resource needs in other occupa-
tional areas, and consistent with their overall work-
force development strategies, agencies shall encour-
age employees to participate in occupational infor-
mation technology training.
(9) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated to the Of-
fice of Personnel Management for the implementa-
tion of this subsection, $15,000,000 in fiscal year
2003, and such sums as are necessary for each fiscal
year thereafter.
(10) EXECUTIVE AGENCY DEFINED.—For pur-
poses of this subsection, the term ‘‘Executive agen-
cy’’ has the meaning given the term ‘‘agency’’ under
section 3701 of title 5, United States Code (as
added by subsection (c)).
(c) INFORMATION TECHNOLOGY EXCHANGE PRO-
GRAM.—
(1) IN GENERAL.—Subpart B of part III of
title 5, United States Code, is amended by adding
at the end the following:
‘‘CHAPTER 37—INFORMATION
TECHNOLOGY EXCHANGE PROGRAM
‘‘Sec.
‘‘3701. Definitions.
‘‘3702. General provisions.
‘‘3703. Assignment of employees to private sector organizations.
‘‘3704. Assignment of employees from private sector organizations.
‘‘3705. Application to Office of the Chief Technology Officer of the District of
Columbia.
‘‘3706. Reporting requirement.
‘‘3707. Regulations.
‘‘§ 3701. Definitions
‘‘For purposes of this chapter—
‘‘(1) the term ‘agency’ means an Executive
agency, but does not include the General Accounting
Office; and
‘‘(2) the term ‘detail’ means—
‘‘(A) the assignment or loan of an em-
ployee of an agency to a private sector organi-
zation without a change of position from the
agency that employs the individual, or
‘‘(B) the assignment or loan of an em-
ployee of a private sector organization to an
agency without a change of position from the
private sector organization that employs the in-
dividual,
whichever is appropriate in the context in which
such term is used.
‘‘§ 3702. General provisions
‘‘(a) ASSIGNMENT AUTHORITY.—On request from or
with the agreement of a private sector organization, and
with the consent of the employee concerned, the head of
an agency may arrange for the assignment of an employee
of the agency to a private sector organization or an em-
ployee of a private sector organization to the agency. An
eligible employee is an individual who—
‘‘(1) works in the field of information tech-
nology management;
‘‘(2) is considered an exceptional performer by
the individual’s current employer; and
‘‘(3) is expected to assume increased informa-
tion technology management responsibilities in the
future.
An employee of an agency shall be eligible to participate
in this program only if the employee is employed at the
GS–11 level or above (or equivalent) and is serving under
a career or career-conditional appointment or an appoint-
ment of equivalent tenure in the excepted service, and ap-
plicable requirements of section 209(b) of the E-Govern-
ment Act of 2002 are met with respect to the proposed
assignment of such employee.
‘‘(b) AGREEMENTS.—Each agency that exercises its
authority under this chapter shall provide for a written
agreement between the agency and the employee con-
cerned regarding the terms and conditions of the employ-
ee’s assignment. In the case of an employee of the agency,
the agreement shall—
‘‘(1) require the employee to serve in the civil
service, upon completion of the assignment, for a pe-
riod equal to the length of the assignment; and
‘‘(2) provide that, in the event the employee
fails to carry out the agreement (except for good and
sufficient reason, as determined by the head of the
agency from which assigned) the employee shall be
liable to the United States for payment of all ex-
penses of the assignment.
An amount under paragraph (2) shall be treated as a debt
due the United States.
‘‘(c) TERMINATION.—Assignments may be termi-
nated by the agency or private sector organization con-
cerned for any reason at any time.
‘‘(d) DURATION.—Assignments under this chapter
shall be for a period of between 3 months and 1 year,
and may be extended in 3-month increments for a total
of not more than 1 additional year, except that no assign-
ment under this chapter may commence after the end of
the 5-year period beginning on the date of the enactment
of this chapter.
‘‘(e) ASSISTANCE.—The Chief Information Officers
Council, by agreement with the Office of Personnel Man-
agement, may assist in the administration of this chapter,
including by maintaining lists of potential candidates for
assignment under this chapter, establishing mentoring re-
lationships for the benefit of individuals who are given as-
signments under this chapter, and publicizing the pro-
gram.
‘‘(f) CONSIDERATIONS.—In exercising any authority
under 
this 
chapter, 
an 
agency 
shall 
take 
into
consideration—
‘‘(1) the need to ensure that small business con-
cerns are appropriately represented with respect to
the assignments described in sections 3703 and
3704, respectively; and
‘‘(2) how assignments described in section 3703
might best be used to help meet the needs of the
agency for the training of employees in information
technology management.
‘‘§ 3703. Assignment of employees to private sector or-
ganizations
‘‘(a) IN GENERAL.—An employee of an agency as-
signed to a private sector organization under this chapter
is deemed, during the period of the assignment, to be on
detail to a regular work assignment in his agency.
‘‘(b) COORDINATION WITH CHAPTER 81.—Notwith-
standing any other provision of law, an employee of an
agency assigned to a private sector organization under this
chapter is entitled to retain coverage, rights, and benefits
under subchapter I of chapter 81, and employment during
the assignment is deemed employment by the United
States, except that, if the employee or the employee’s de-
pendents receive from the private sector organization any
payment under an insurance policy for which the premium
is wholly paid by the private sector organization, or other
benefit of any kind on account of the same injury or death,
then, the amount of such payment or benefit shall be cred-
ited against any compensation otherwise payable under
subchapter I of chapter 81.
‘‘(c) REIMBURSEMENTS.—The assignment of an em-
ployee to a private sector organization under this chapter
may be made with or without reimbursement by the pri-
vate sector organization for the travel and transportation
expenses to or from the place of assignment, subject to
the same terms and conditions as apply with respect to
an employee of a Federal agency or a State or local gov-
ernment under section 3375, and for the pay, or a part
thereof, of the employee during assignment. Any reim-
bursements shall be credited to the appropriation of the
agency used for paying the travel and transportation ex-
penses or pay.
‘‘(d) TORT LIABILITY; SUPERVISION.—The Federal
Tort Claims Act and any other Federal tort liability stat-
ute apply to an employee of an agency assigned to a pri-
vate sector organization under this chapter. The super-
vision of the duties of an employee of an agency so as-
signed to a private sector organization may be governed
by an agreement between the agency and the organization.
‘‘(e) SMALL BUSINESS CONCERNS.—
‘‘(1) IN GENERAL.—The head of each agency
shall take such actions as may be necessary to en-
sure that, of the assignments made under this chap-
ter from such agency to private sector organizations
in each year, at least 20 percent are to small busi-
ness concerns.
‘‘(2) DEFINITIONS.—For purposes of this
subsection—
‘‘(A) the term ‘small business concern’
means a business concern that satisfies the
definitions and standards specified by the Ad-
ministrator of the Small Business Administra-
tion under section 3(a)(2) of the Small Busi-
ness Act (as from time to time amended by the
Administrator);
‘‘(B) the term ‘year’ refers to the 12-
month period beginning on the date of the en-
actment of this chapter, and each succeeding
12-month period in which any assignments
under this chapter may be made; and
‘‘(C) the assignments ‘made’ in a year are
those commencing in such year.
‘‘(3) REPORTING
REQUIREMENT.—An agency
which fails to comply with paragraph (1) in a year
shall, within 90 days after the end of such year, sub-
mit a report to the Committees on Government Re-
form and Small Business of the House of Represent-
atives and the Committees on Governmental Affairs
and Small Business of the Senate. The report shall
include—
‘‘(A) the total number of assignments
made under this chapter from such agency to
private sector organizations in the year;
‘‘(B) of that total number, the number
(and percentage) made to small business con-
cerns; and
‘‘(C) the reasons for the agency’s non-
compliance with paragraph (1).
‘‘(4) EXCLUSION.—This subsection shall not
apply to an agency in any year in which it makes
fewer than 5 assignments under this chapter to pri-
vate sector organizations.
‘‘§ 3704. Assignment of employees from private sector
organizations
‘‘(a) IN GENERAL.—An employee of a private sector
organization assigned to an agency under this chapter is
deemed, during the period of the assignment, to be on de-
tail to such agency.
‘‘(b) TERMS AND CONDITIONS.—An employee of a
private sector organization assigned to an agency under
this chapter—
‘‘(1) may continue to receive pay and benefits
from the private sector organization from which he
is assigned;
‘‘(2) is deemed, notwithstanding subsection (a),
to be an employee of the agency for the purposes
of—
‘‘(A) chapter 73;
‘‘(B) sections 201, 203, 205, 207, 208,
209, 603, 606, 607, 643, 654, 1905, and 1913
of title 18;
‘‘(C) sections 1343, 1344, and 1349(b) of
title 31;
‘‘(D) the Federal Tort Claims Act and any
other Federal tort liability statute;
‘‘(E) the Ethics in Government Act of
1978;
‘‘(F) section 1043 of the Internal Revenue
Code of 1986; and
‘‘(G) section 27 of the Office of Federal
Procurement Policy Act;
‘‘(3) may not have access to any trade secrets
or to any other nonpublic information which is of
commercial value to the private sector organization
from which he is assigned; and
‘‘(4) is subject to such regulations as the Presi-
dent may prescribe.
The supervision of an employee of a private sector organi-
zation assigned to an agency under this chapter may be
governed by agreement between the agency and the private
sector organization concerned. Such an assignment may
be made with or without reimbursement by the agency for
the pay, or a part thereof, of the employee during the pe-
riod of assignment, or for any contribution of the private
sector organization to employee benefit systems.
‘‘(c) COORDINATION WITH CHAPTER 81.—An em-
ployee of a private sector organization assigned to an
agency under this chapter who suffers disability or dies
as a result of personal injury sustained while performing
duties during the assignment shall be treated, for the pur-
pose of subchapter I of chapter 81, as an employee as de-
fined by section 8101 who had sustained the injury in the
performance of duty, except that, if the employee or the
employee’s dependents receive from the private sector or-
ganization any payment under an insurance policy for
which the premium is wholly paid by the private sector
organization, or other benefit of any kind on account of
the same injury or death, then, the amount of such pay-
ment or benefit shall be credited against any compensation
otherwise payable under subchapter I of chapter 81.
‘‘(d) PROHIBITION AGAINST CHARGING CERTAIN
COSTS TO THE FEDERAL GOVERNMENT.—A private sec-
tor organization may not charge the Federal Government,
as direct or indirect costs under a Federal contract, the
costs of pay or benefits paid by the organization to an
employee assigned to an agency under this chapter for the
period of the assignment.
‘‘§ 3705. Application to Office of the Chief Technology
Officer of the District of Columbia
‘‘(a) IN GENERAL.—The Chief Technology Officer of
the District of Columbia may arrange for the assignment
of an employee of the Office of the Chief Technology Offi-
cer to a private sector organization, or an employee of a
private sector organization to such Office, in the same
manner as the head of an agency under this chapter.
‘‘(b) TERMS
AND
CONDITIONS.—An assignment
made pursuant to subsection (a) shall be subject to the
same terms and conditions as an assignment made by the
head of an agency under this chapter, except that in apply-
ing such terms and conditions to an assignment made pur-
suant to subsection (a), any reference in this chapter to
a provision of law or regulation of the United States shall
be deemed to be a reference to the applicable provision
of law or regulation of the District of Columbia, including
the applicable provisions of the District of Columbia Gov-
ernment Comprehensive Merit Personnel Act of 1978 (sec.
1–601.01 et seq., D.C. Official Code) and section 601 of
the District of Columbia Campaign Finance Reform and
Conflict of Interest Act (sec. 1–1106.01, D.C. Official
Code).
‘‘(c) DEFINITION.—For purposes of this section, the
term ‘Office of the Chief Technology Officer’ means the
office established in the executive branch of the govern-
ment of the District of Columbia under the Office of the
Chief Technology Officer Establishment Act of 1998 (sec.
1–1401 et seq., D.C. Official Code).
‘‘§ 3706. Reporting requirement
‘‘(a) IN GENERAL.—The Office of Personnel Manage-
ment shall, not later than April 30 and October 31 of each
year, prepare and submit to the Committee on Govern-
ment Reform of the House of Representatives and the
Committee on Governmental Affairs of the Senate a semi-
annual report summarizing the operation of this chapter
during the immediately preceding 6-month period ending
on March 31 and September 30, respectively.
‘‘(b) CONTENT.—Each report shall include, with re-
spect to the 6-month period to which such report relates—
‘‘(1) the total number of individuals assigned
to, and the total number of individuals assigned
from, each agency during such period;
‘‘(2) a brief description of each assignment in-
cluded under paragraph (1), including—
‘‘(A) the name of the assigned individual,
as well as the private sector organization and
the agency (including the specific bureau or
other agency component) to or from which such
individual was assigned;
‘‘(B) the respective positions to and from
which the individual was assigned, including the
duties and responsibilities and the pay grade or
level associated with each; and
‘‘(C) the duration and objectives of the in-
dividual’s assignment; and
‘‘(3) such other information as the Office con-
siders appropriate.
‘‘(c) PUBLICATION.—A copy of each report submitted
under subsection (a)—
‘‘(1) shall be published in the Federal Register;
and
‘‘(2) shall be made publicly available on the
Internet.
‘‘(d) AGENCY COOPERATION.—On request of the Of-
fice, agencies shall furnish such information and reports
as the Office may require in order to carry out this sec-
tion.
‘‘§ 3707. Regulations
‘‘The Director of the Office of Personnel Manage-
ment shall prescribe regulations for the administration of
this chapter.’’.
(2) REPORT.—Not later than 4 years after the
date of the enactment of this Act, the General Ac-
counting Office shall prepare and submit to the
Committee on Government Reform of the House of
Representatives and the Committee on Govern-
mental Affairs of the Senate a report on the oper-
ation of chapter 37 of title 5, United States Code
(as added by this subsection). Such report shall
include—
(A) an evaluation of the effectiveness of
the program established by such chapter; and
(B) a recommendation as to whether such
program should be continued (with or without
modification) or allowed to lapse.
(3) CLERICAL AMENDMENT.—The analysis for
part III of title 5, United States Code, is amended
by inserting after the item relating to chapter 35 the
following:
‘‘37. Information Technology Exchange Program .................................... 3701’’.
(d) ETHICS PROVISIONS.—
(1) ONE-YEAR RESTRICTION ON CERTAIN COM-
MUNICATIONS.—Section 207(c)(2)(A) of title 18,
United States Code, is amended—
(A) by striking ‘‘or’’ at the end of clause
(iii);
(B) by striking the period at the end of
clause (iv) and inserting ‘‘; or’’; and
(C) by adding at the end the following:
‘‘(v) assigned from a private sector organi-
zation to an agency under chapter 37 of title
5.’’.
(2) DISCLOSURE OF CONFIDENTIAL INFORMA-
TION.—Section 1905 of title 18, United States Code,
is amended by inserting ‘‘or being an employee of a
private sector organization who is or was assigned to
an agency under chapter 37 of title 5,’’ after ‘‘(15
U.S.C. 1311–1314),’’.
(3) CONTRACT ADVICE.—Section 207 of title
18, United States Code, is amended by adding at
the end the following:
‘‘(l) CONTRACT ADVICE
BY FORMER DETAILS.—
Whoever, being an employee of a private sector organiza-
tion assigned to an agency under chapter 37 of title 5,
within one year after the end of that assignment, know-
ingly represents or aids, counsels, or assists in rep-
resenting any other person (except the United States) in
connection with any contract with that agency shall be
punished as provided in section 216 of this title.’’.
(4) RESTRICTION
ON
DISCLOSURE
OF
PRO-
CUREMENT INFORMATION.—Section 27 of the Office
of Federal Procurement Policy Act (41 U.S.C. 423)
is amended in subsection (a)(1) by adding at the end
the following new sentence: ‘‘In the case of an em-
ployee of a private sector organization assigned to
an agency under chapter 37 of title 5, United States
Code, in addition to the restriction in the preceding
sentence, such employee shall not, other than as pro-
vided by law, knowingly disclose contractor bid or
proposal information or source selection information
during the three-year period after the end of the as-
signment of such employee.’’.
(e) REPORT ON EXISTING EXCHANGE PROGRAMS.—
(1) EXCHANGE PROGRAM DEFINED.—For pur-
poses of this subsection, the term ‘‘exchange pro-
gram’’ means an executive exchange program, the
program under subchapter VI of chapter 33 of title
5, United States Code, and any other program which
allows for—
(A) the assignment of employees of the
Federal Government to non-Federal employers;
(B) the assignment of employees of non-
Federal employers to the Federal Government;
or
(C) both.
(2) REPORTING REQUIREMENT.—Not later than
1 year after the date of the enactment of this Act,
the Office of Personnel Management shall prepare
and submit to the Committee on Government Re-
form of the House of Representatives and the Com-
mittee on Governmental Affairs of the Senate a re-
port identifying all existing exchange programs.
(3) SPECIFIC INFORMATION.—The report shall,
for each such program, include—
(A) a brief description of the program, in-
cluding its size, eligibility requirements, and
terms or conditions for participation;
(B) specific citation to the law or other au-
thority under which the program is established;
(C) the names of persons to contact for
more information, and how they may be
reached; and
(D) any other information which the Office
considers appropriate.
(f) REPORT ON THE ESTABLISHMENT OF A GOVERN-
MENTWIDE INFORMATION TECHNOLOGY TRAINING PRO-
GRAM.—
(1) IN GENERAL.—Not later January 1, 2003,
the Office of Personnel Management, in consultation
with the Chief Information Officers Council and the
Administrator of General Services, shall review and
submit to the Committee on Government Reform of
the House of Representatives and the Committee on
Governmental Affairs of the Senate a written report
on the following:
(A) The adequacy of any existing informa-
tion technology training programs available to
Federal employees on a Governmentwide basis.
(B)(i) If one or more such programs al-
ready exist, recommendations as to how they
might be improved.
(ii) If no such program yet exists, rec-
ommendations as to how such a program might
be designed and established.
(C) With respect to any recommendations
under subparagraph (B), how the program
under chapter 37 of title 5, United States Code,
might be used to help carry them out.
(2) COST ESTIMATE.—The report shall, for any
recommended program (or improvements) under
paragraph (1)(B), include the estimated costs associ-
ated with the implementation and operation of such
program as so established (or estimated difference in
costs of any such program as so improved).
(g) TECHNICAL AND CONFORMING AMENDMENTS.—
(1) AMENDMENTS TO TITLE 5, UNITED STATES
CODE.—Title 5, United States Code, is amended—
(A) in section 3111, by adding at the end
the following:
‘‘(d) Notwithstanding section 1342 of title 31, the
head of an agency may accept voluntary service for the
United States under chapter 37 of this title and regula-
tions of the Office of Personnel Management.’’;
(B) in section 4108, by striking subsection
(d); and
(C) in section 7353(b), by adding at the
end the following:
‘‘(4) Nothing in this section precludes an employee
of a private sector organization, while assigned to an agen-
cy under chapter 37, from continuing to receive pay and
benefits from such organization in accordance with such
chapter.’’.
(2) AMENDMENT TO TITLE 18, UNITED STATES
CODE.—Section 209 of title 18, United States Code,
is amended by adding at the end the following:
‘‘(g)(1) This section does not prohibit an employee
of a private sector organization, while assigned to an agen-
cy under chapter 37 of title 5, from continuing to receive
pay and benefits from such organization in accordance
with such chapter.
‘‘(2) For purposes of this subsection, the term ‘agen-
cy’ means an agency (as defined by section 3701 of title
5) and the Office of the Chief Technology Officer of the
District of Columbia.’’.
(3) OTHER AMENDMENTS.—Section 125(c)(1)
of Public Law 100–238 (5 U.S.C. 8432 note) is
amended—
(A) in subparagraph (B), by striking ‘‘or’’
at the end;
(B) in subparagraph (C), by striking
‘‘and’’ at the end and inserting ‘‘or’’; and
(C) by adding at the end the following:
‘‘(D) an individual assigned from a Fed-
eral agency to a private sector organization
under chapter 37 of title 5, United States Code;
and’’.
SEC. 210. SHARE-IN-SAVINGS INITIATIVES.
(a) DEFENSE CONTRACTS.—(1) Chapter 137 of title
10, United States Code, is amended by adding at the end
the following new section:
‘‘§ 2332. Share-in-savings contracts
‘‘(a) AUTHORITY TO ENTER INTO SHARE-IN-SAV-
INGS CONTRACTS.—(1) The head of an agency may enter
into a share-in-savings contract for information technology
(as defined in section 11101(6) of title 40) in which the
Government awards a contract to improve mission-related
or administrative processes or to accelerate the achieve-
ment of its mission and share with the contractor in sav-
ings achieved through contract performance.
‘‘(2)(A) Except as provided in subparagraph (B), a
share-in-savings contract shall be awarded for a period of
not more than five years.
‘‘(B) A share-in-savings contract may be awarded for
a period greater than five years, but not more than 10
years, if the head of the agency determines in writing prior
to award of the contract that—
‘‘(i) the level of risk to be assumed and the in-
vestment to be undertaken by the contractor is likely
to inhibit the government from obtaining the needed
information technology competitively at a fair and
reasonable price if the contract is limited in duration
to a period of five years or less; and
‘‘(ii) usage of the information technology to be
acquired is likely to continue for a period of time
sufficient to generate reasonable benefit for the gov-
ernment.
‘‘(3) Contracts awarded pursuant to the authority of
this section shall, to the maximum extent practicable, be
performance-based contracts that identify objective out-
comes and contain performance standards that will be
used to measure achievement and milestones that must
be met before payment is made.
‘‘(4) Contracts awarded pursuant to the authority of
this section shall include a provision containing a quantifi-
able baseline that is to be the basis upon which a savings
share ratio is established that governs the amount of pay-
ment a contractor is to receive under the contract. Before
commencement of performance of such a contract, the sen-
ior procurement executive of the agency shall determine
in writing that the terms of the provision are quantifiable
and will likely yield value to the Government.
‘‘(5)(A) The head of the agency may retain savings
realized through the use of a share-in-savings contract
under this section that are in excess of the total amount
of savings paid to the contractor under the contract, but
may not retain any portion of such savings that is attrib-
utable to a decrease in the number of civilian employees
of the Federal Government performing the function. Ex-
cept as provided in subparagraph (B), savings shall be
credited to the appropriation or fund against which
charges were made to carry out the contract and shall be
used for information technology.
‘‘(B) Amounts retained by the agency under this sub-
section shall—
‘‘(i) without further appropriation, remain
available until expended; and
‘‘(ii) be applied first to fund any contingent li-
abilities associated with share-in-savings procure-
ments that are not fully funded.
‘‘(b) CANCELLATION
AND TERMINATION.—(1) If
funds are not made available for the continuation of a
share-in-savings contract entered into under this section
in a subsequent fiscal year, the contract shall be canceled
or terminated. The costs of cancellation or termination
may be paid out of—
‘‘(A) appropriations available for the perform-
ance of the contract;
‘‘(B) appropriations available for acquisition of
the information technology procured under the con-
tract, and not otherwise obligated; or
‘‘(C) funds subsequently appropriated for pay-
ments of costs of cancellation or termination, subject
to the limitations in paragraph (3).
‘‘(2) The amount payable in the event of cancellation
or termination of a share-in-savings contract shall be ne-
gotiated with the contractor at the time the contract is
entered into.
‘‘(3)(A) Subject to subparagraph (B), the head of an
agency may enter into share-in-savings contracts under
this section in any given fiscal year even if funds are not
made specifically available for the full costs of cancellation
or termination of the contract if funds are available and
sufficient to make payments with respect to the first fiscal
year of the contract and the following conditions are met
regarding the funding of cancellation and termination li-
ability:
‘‘(i) The amount of unfunded contingent liabil-
ity for the contract does not exceed the lesser of—
‘‘(I) 25 percent of the estimated costs of a
cancellation or termination; or
‘‘(II) $5,000,000.
‘‘(ii) Unfunded contingent liability in excess of
$1,000,000 has been approved by the Director of the
Office of Management and Budget or the Director’s
designee.
‘‘(B) The aggregate number of share-in-savings con-
tracts that may be entered into under subparagraph (A)
by all agencies to which this chapter applies in a fiscal
year may not exceed 5 in each of fiscal years 2003, 2004,
and 2005.
‘‘(c) DEFINITIONS.—In this section:
‘‘(1) The term ‘contractor’ means a private en-
tity that enters into a contract with an agency.
‘‘(2) The term ‘savings’ means—
‘‘(A) monetary savings to an agency; or
‘‘(B) savings in time or other benefits real-
ized by the agency, including enhanced revenues
(other than enhanced revenues from the collec-
tion of fees, taxes, debts, claims, or other
amounts owed the Federal Government).
‘‘(3) The term ‘share-in-savings contract’ means
a contract under which—
‘‘(A) a contractor provides solutions for—
‘‘(i) improving the agency’s mission-
related or administrative processes; or
‘‘(ii) accelerating the achievement of
agency missions; and
‘‘(B) the head of the agency pays the con-
tractor an amount equal to a portion of the sav-
ings derived by the agency from—
‘‘(i) any improvements in mission-re-
lated or administrative processes that re-
sult from implementation of the solution;
or
‘‘(ii) acceleration of achievement of
agency missions.
‘‘(d) TERMINATION.—No share-in-savings contracts
may be entered into under this section after September
30, 2005.’’.
(2) The table of sections at the beginning of such
chapter is amended by adding at the end of the following
new item:
‘‘2332. Share-in-savings contracts.’’.
(b) OTHER CONTRACTS.—Title III of the Federal
Property and Administrative Services Act of 1949 is
amended by adding at the end the following:
‘‘SEC. 317. SHARE-IN-SAVINGS CONTRACTS.
‘‘(a) AUTHORITY TO ENTER INTO SHARE-IN-SAV-
INGS CONTRACTS.—(1) The head of an executive agency
may enter into a share-in-savings contract for information
technology (as defined in section 11101(6) of title 40,
United States Code) in which the Government awards a
contract to improve mission-related or administrative
processes or to accelerate the achievement of its mission
and share with the contractor in savings achieved through
contract performance.
‘‘(2)(A) Except as provided in subparagraph (B), a
share-in-savings contract shall be awarded for a period of
not more than five years.
‘‘(B) A share-in-savings contract may be awarded for
a period greater than five years, but not more than 10
years, if the head of the agency determines in writing prior
to award of the contract that—
‘‘(i) the level of risk to be assumed and the in-
vestment to be undertaken by the contractor is likely
to inhibit the government from obtaining the needed
information technology competitively at a fair and
reasonable price if the contract is limited in duration
to a period of five years or less; and
‘‘(ii) usage of the information technology to be
acquired is likely to continue for a period of time
sufficient to generate reasonable benefit for the gov-
ernment.
‘‘(3) Contracts awarded pursuant to the authority of
this section shall, to the maximum extent practicable, be
performance-based contracts that identify objective out-
comes and contain performance standards that will be
used to measure achievement and milestones that must
be met before payment is made.
‘‘(4) Contracts awarded pursuant to the authority of
this section shall include a provision containing a quantifi-
able baseline that is to be the basis upon which a savings
share ratio is established that governs the amount of pay-
ment a contractor is to receive under the contract. Before
commencement of performance of such a contract, the sen-
ior procurement executive of the agency shall determine
in writing that the terms of the provision are quantifiable
and will likely yield value to the Government.
‘‘(5)(A) The head of the agency may retain savings
realized through the use of a share-in-savings contract
under this section that are in excess of the total amount
of savings paid to the contractor under the contract, but
may not retain any portion of such savings that is attrib-
utable to a decrease in the number of civilian employees
of the Federal Government performing the function. Ex-
cept as provided in subparagraph (B), savings shall be
credited to the appropriation or fund against which
charges were made to carry out the contract and shall be
used for information technology.
‘‘(B) Amounts retained by the agency under this sub-
section shall—
‘‘(i) without further appropriation, remain
available until expended; and
‘‘(ii) be applied first to fund any contingent li-
abilities associated with share-in-savings procure-
ments that are not fully funded.
‘‘(b) CANCELLATION
AND TERMINATION.—(1) If
funds are not made available for the continuation of a
share-in-savings contract entered into under this section
in a subsequent fiscal year, the contract shall be canceled
or terminated. The costs of cancellation or termination
may be paid out of—
‘‘(A) appropriations available for the perform-
ance of the contract;
‘‘(B) appropriations available for acquisition of
the information technology procured under the con-
tract, and not otherwise obligated; or
‘‘(C) funds subsequently appropriated for pay-
ments of costs of cancellation or termination, subject
to the limitations in paragraph (3).
‘‘(2) The amount payable in the event of cancellation
or termination of a share-in-savings contract shall be ne-
gotiated with the contractor at the time the contract is
entered into.
‘‘(3)(A) Subject to subparagraph (B), the head of an
executive agency may enter into share-in-savings contracts
under this section in any given fiscal year even if funds
are not made specifically available for the full costs of can-
cellation or termination of the contract if funds are avail-
able and sufficient to make payments with respect to the
first fiscal year of the contract and the following condi-
tions are met regarding the funding of cancellation and
termination liability:
‘‘(i) The amount of unfunded contingent liabil-
ity for the contract does not exceed the lesser of—
‘‘(I) 25 percent of the estimated costs of a
cancellation or termination; or
‘‘(II) $5,000,000.
100
‘‘(ii) Unfunded contingent liability in excess of
$1,000,000 has been approved by the Director of the
Office of Management and Budget or the Director’s
designee.
‘‘(B) The aggregate number of share-in-savings con-
tracts that may be entered into under subparagraph (A)
by all executive agencies to which this chapter applies in
a fiscal year may not exceed 5 in each of fiscal years 2003,
2004, and 2005.
‘‘(c) DEFINITIONS.—In this section:
‘‘(1) The term ‘contractor’ means a private en-
tity that enters into a contract with an agency.
‘‘(2) The term ‘savings’ means—
‘‘(A) monetary savings to an agency; or
‘‘(B) savings in time or other benefits real-
ized by the agency, including enhanced revenues
(other than enhanced revenues from the collec-
tion of fees, taxes, debts, claims, or other
amounts owed the Federal Government).
‘‘(3) The term ‘share-in-savings contract’ means
a contract under which—
‘‘(A) a contractor provides solutions for—
‘‘(i) improving the agency’s mission-
related or administrative processes; or
101
‘‘(ii) accelerating the achievement of
agency missions; and
‘‘(B) the head of the agency pays the con-
tractor an amount equal to a portion of the sav-
ings derived by the agency from—
‘‘(i) any improvements in mission-re-
lated or administrative processes that re-
sult from implementation of the solution;
or
‘‘(ii) acceleration of achievement of
agency missions.
‘‘(d) TERMINATION.—No share-in-savings contracts
may be entered into under this section after September
30, 2005.’’.
(c) DEVELOPMENT OF INCENTIVES.—The Director
of the Office of Management and Budget shall, in con-
sultation with the Committee on Governmental Affairs of
the Senate, the Committee on Government Reform of the
House of Representatives, and executive agencies, develop
techniques to permit an executive agency to retain a por-
tion of the savings (after payment of the contractor’s
share of the savings) derived from share-in-savings con-
tracts as funds are appropriated to the agency in future
fiscal years.
102
(d) REGULATIONS.—Not later than 270 days after
the date of the enactment of this Act, the Federal Acquisi-
tion Regulation shall be revised to implement the provi-
sions enacted by this section. Such revisions shall—
(1) provide for the use of competitive proce-
dures in the selection and award of share-in-savings
contracts to—
(A) ensure the contractor’s share of sav-
ings reflects the risk involved and market condi-
tions; and
(B) otherwise yield greatest value to the
government; and
(2) allow appropriate regulatory flexibility to fa-
cilitate the use of share-in-savings contracts by exec-
utive agencies, including the use of innovative provi-
sions for technology refreshment and nonstandard
Federal Acquisition Regulation contract clauses.
(e) ADDITIONAL GUIDANCE.—The Administrator of
General Services shall—
(1) identify potential opportunities for the use
of share-in-savings contracts; and
(2) in consultation with the Director of the Of-
fice of Management and Budget, provide guidance to
executive agencies for determining mutually bene-
103
ficial savings share ratios and baselines from which
savings may be measured.
(f) OMB REPORT TO CONGRESS.—In consultation
with executive agencies, the Director of the Office of Man-
agement and Budget shall, not later than 2 years after
the date of the enactment of this Act, submit to Congress
a report containing—
(1) a description of the number of share-in-sav-
ings contracts entered into by each executive agency
under by this section and the amendments made by
this section, and, for each contract identified—
(A) the information technology acquired;
(B) the total amount of payments made to
the contractor; and
(C) the total amount of savings or other
measurable benefits realized;
(2) a description of the ability of agencies to de-
termine the baseline costs of a project against which
savings can be measured; and
(3) any recommendations, as the Director
deems appropriate, regarding additional changes in
law that may be necessary to ensure effective use of
share-in-savings contracts by executive agencies.
(g) GAO REPORT TO CONGRESS.—The Comptroller
General shall, not later than 6 months after the report
104
required under subsection (f) is submitted to Congress,
conduct a review of that report and submit to Congress
a report containing—
(1) the results of the review;
(2) an independent assessment by the Comp-
troller General of the effectiveness of the use of
share-in-savings contracts in improving the mission-
related and administrative processes of the executive
agencies and the achievement of agency missions;
and
(3) a recommendation on whether the authority
to enter into share-in-savings contracts should be
continued.
(h) REPEAL
OF SHARE-IN-SAVINGS PILOT PRO-
GRAM.—
(1) REPEAL.—Section 11521 of title 40, United
States Code, is repealed.
(2) CONFORMING AMENDMENTS TO PILOT PRO-
GRAM AUTHORITY.—
(A) Section 11501 of title 40, United
States Code, is amended—
(i) in the section heading, by striking
‘‘PROGRAMS’’ 
and 
inserting 
‘‘PRO-
GRAM’’;
105
(ii) in subsection (a)(1), by striking
‘‘conduct pilot programs’’ and inserting
‘‘conduct a pilot program pursuant to the
requirements of section 11521 of this
title’’;
(iii) in subsection (a)(2), by striking
‘‘each pilot program’’ and inserting ‘‘the
pilot program’’;
(iv) in subsection (b), by striking
‘‘LIMITATIONS.—’’ and all that follows
through ‘‘$750,000,000.’’ and inserting the
following: ‘‘LIMITATION
ON
AMOUNT.—
The total amount obligated for contracts
entered into under the pilot program con-
ducted under this chapter may not exceed
$375,000,000.’’; and
(v) in subsection (c)(1), by striking ‘‘a
pilot’’ and inserting ‘‘the pilot’’.
(B) The following provisions of chapter
115 of such title are each amended by striking
‘‘a pilot’’ each place it appears and inserting
‘‘the pilot’’:
(i) Section 11502(a).
(ii) Section 11502(b).
(iii) Section 11503(a).
106
(iv) Section 11504.
(C) Section 11505 of such chapter is
amended by striking ‘‘programs’’ and inserting
‘‘program’’.
(3) ADDITIONAL CONFORMING AMENDMENTS.—
(A) Section 11522 of title 40, United
States Code, is redesignated as section 11521.
(B) The chapter heading for chapter 115
of such title is amended by striking ‘‘PRO-
GRAMS’’ and inserting ‘‘PROGRAM’’.
(C) The subchapter heading for subchapter
I and for subchapter II of such chapter are
each amended by striking ‘‘PROGRAMS’’ and
inserting ‘‘PROGRAM’’.
(D) The item relating to subchapter I in
the table of sections at the beginning of such
chapter is amended to read as follows:
‘‘SUBCHAPTER I—CONDUCT OF PILOT PROGRAM’’.
(E) The item relating to subchapter II in
the table of sections at the beginning of such
chapter is amended to read as follows:
‘‘SUBCHAPTER II—SPECIFIC PILOT PROGRAM’’.
(F) The item relating to section 11501 in
the table of sections at the beginning of such is
107
amended by striking ‘‘programs’’ and inserting
‘‘program’’.
(G) The table of sections at the beginning
of such chapter is amended by striking the item
relating to section 11521 and redesignating the
item relating to section 11522 as section
11521.
(H) The item relating to chapter 115 in
the table of chapters for subtitle III of title 40,
United States Code, is amended to read as fol-
lows:
‘‘115. INFORMATION TECHNOLOGY ACQUISITION PILOT
PROGRAM ................................................................... 11501’’.
(i) DEFINITIONS.—In this section, the terms ‘‘con-
tractor’’, ‘‘savings’’, and ‘‘share-in-savings contract’’ have
the meanings given those terms in section 317 of the Fed-
eral Property and Administrative Services Act of 1949 (as
added by subsection (b)).
SEC. 211. AUTHORIZATION FOR ACQUISITION OF INFORMA-
TION TECHNOLOGY BY STATE AND LOCAL
GOVERNMENTS THROUGH FEDERAL SUPPLY
SCHEDULES.
(a) AUTHORITY TO USE CERTAIN SUPPLY SCHED-
ULES.—Section 502 of title 40, United States Code, is
amended by adding at the end the following new sub-
section:
108
‘‘(c) USE OF CERTAIN SUPPLY SCHEDULES.—
‘‘(1) IN
GENERAL.—The Administrator may
provide for the use by State or local governments of
Federal supply schedules of the General Services Ad-
ministration for automated data processing equip-
ment (including firmware), software, supplies, sup-
port equipment, and services (as contained in Fed-
eral supply classification code group 70).
‘‘(2) VOLUNTARY USE.—In any case of the use
by a State or local government of a Federal supply
schedule pursuant to paragraph (1), participation by
a firm that sells to the Federal Government through
the supply schedule shall be voluntary with respect
to a sale to the State or local government through
such supply schedule.
‘‘(3) DEFINITIONS.—In this subsection:
‘‘(A) The term ‘State or local government’
includes any State, local, regional, or tribal gov-
ernment, or any instrumentality thereof (includ-
ing any local educational agency or institution
of higher education).
‘‘(B) 
The 
term 
‘tribal 
government’
means—
‘‘(i) the governing body of any Indian
tribe, band, nation, or other organized
109
group or community located in the conti-
nental United States (excluding the State
of Alaska) that is recognized as eligible for
the special programs and services provided
by the United States to Indians because of
their status as Indians, and
‘‘(ii) any Alaska Native regional or
village corporation established pursuant to
the Alaska Native Claims Settlement Act
(43 U.S.C. 1601 et seq.).
‘‘(C) The term ‘local educational agency’
has the meaning given that term in section
8013 of the Elementary and Secondary Edu-
cation Act of 1965 (20 U.S.C. 7713).
‘‘(D) The term ‘institution of higher edu-
cation’ has the meaning given that term in sec-
tion 101(a) of the Higher Education Act of
1965 (20 U.S.C. 1001(a)).’’.
(b) PROCEDURES.—Not later than 30 days after the
date of the enactment of this Act, the Administrator of
General Services shall establish procedures to implement
section 501(c) of title 40, United States Code (as added
by subsection (a)).
(c) REPORT.—Not later than December 31, 2004, the
Administrator shall submit to the Committee on Govern-
110
ment Reform of the House of Representatives and the
Committee on Governmental Affairs of the Senate a report
on the implementation and effects of the amendment made
by subsection (a).
SEC. 212. INTEGRATED REPORTING STUDY AND PILOT
PROJECTS.
(a) PURPOSES.—The purposes of this section are
to—
(1) enhance the interoperability of Federal in-
formation systems;
(2) assist the public, including the regulated
community, in electronically submitting information
to agencies under Federal requirements, by reducing
the burden of duplicate collection and ensuring the
accuracy of submitted information; and
(3) enable any person to integrate and obtain
similar information held by 1 or more agencies
under 1 or more Federal requirements without vio-
lating the privacy rights of an individual.
(b) DEFINITIONS.—In this section, the term—
(1) ‘‘agency’’ means an Executive agency as de-
fined under section 105 of title 5, United States
Code; and
(2) ‘‘person’’ means any individual, trust, firm,
joint stock company, corporation (including a gov-
111
ernment 
corporation), 
partnership, 
association,
State, municipality, commission, political subdivision
of a State, interstate body, or agency or component
of the Federal Government.
(c) REPORT.—
(1) IN GENERAL.—Not later than 3 years after
the date of enactment of this Act, the Director shall
oversee a study, in consultation with agencies, the
regulated community, public interest organizations,
and the public, and submit a report to the Com-
mittee on Governmental Affairs of the Senate and
the Committee on Government Reform of the House
of Representatives on progress toward integrating
Federal information systems across agencies.
(2) CONTENTS.—The report under this section
shall—
(A) address the integration of data ele-
ments used in the electronic collection of infor-
mation within databases established under Fed-
eral statute without reducing the quality, acces-
sibility, scope, or utility of the information con-
tained in each database;
(B) address the feasibility of developing, or
enabling the development of, software, including
Internet-based tools, for use by reporting per-
112
sons in assembling, documenting, and validating
the accuracy of information electronically sub-
mitted to agencies under nonvoluntary, statu-
tory, and regulatory requirements;
(C) address the feasibility of developing a
distributed information system involving, on a
voluntary basis, at least 2 agencies, that—
(i) provides consistent, dependable,
and timely public access to the information
holdings of 1 or more agencies, or some
portion of such holdings, without requiring
public users to know which agency holds
the information; and
(ii) allows the integration of public in-
formation held by the participating agen-
cies;
(D) address the feasibility of incorporating
other elements related to the purposes of this
section at the discretion of the Director; and
(E) make any recommendations that the
Director deems appropriate on the use of inte-
grated reporting and information systems, to
reduce the burden on reporting and strengthen
public access to databases within and across
agencies.
113
(d) PILOT PROJECTS TO ENCOURAGE INTEGRATED
COLLECTION AND MANAGEMENT OF DATA AND INTER-
OPERABILITY OF FEDERAL INFORMATION SYSTEMS.—
(1) IN GENERAL.—In order to provide input to
the study under subsection (c), the Director shall
designate, in consultation with agencies, a series of
no more than 5 pilot projects that integrate data ele-
ments. The Director shall consult with agencies, the
regulated community, public interest organizations,
and the public on the implementation of the pilot
projects.
(2) GOALS OF PILOT PROJECTS.—
(A) IN
GENERAL.—Each goal described
under subparagraph (B) shall be addressed by
at least 1 pilot project each.
(B) GOALS.—The goals under this para-
graph are to—
(i) reduce information collection bur-
dens by eliminating duplicative data ele-
ments within 2 or more reporting require-
ments;
(ii) create interoperability between or
among public databases managed by 2 or
more agencies using technologies and tech-
niques that facilitate public access; and
114
(iii) develop, or enable the develop-
ment of, software to reduce errors in elec-
tronically submitted information.
(3) INPUT.—Each pilot project shall seek input
from users on the utility of the pilot project and
areas for improvement. To the extent practicable,
the Director shall consult with relevant agencies and
State, tribal, and local governments in carrying out
the report and pilot projects under this section.
(e) PROTECTIONS.—The activities authorized under
this section shall afford protections for—
(1) confidential business information consistent
with section 552(b)(4) of title 5, United States
Code, and other relevant law;
(2) personal privacy information under sections
552(b) (6) and (7)(C) and 552a of title 5, United
States Code, and other relevant law;
(3) other information consistent with section
552(b)(3) of title 5, United States Code, and other
relevant law; and
(4) confidential statistical information collected
under a confidentiality pledge, solely for statistical
purposes, consistent with the Office of Management
and Budget’s Federal Statistical Confidentiality
Order, and other relevant law.
115
SEC. 213. COMMUNITY TECHNOLOGY CENTERS.
(a) PURPOSES.—The purposes of this section are
to—
(1) study and enhance the effectiveness of com-
munity technology centers, public libraries, and
other institutions that provide computer and Inter-
net access to the public; and
(2) promote awareness of the availability of on-
line government information and services, to users of
community technology centers, public libraries, and
other public facilities that provide access to com-
puter technology and Internet access to the public.
(b) STUDY AND REPORT.—Not later than 2 years
after the effective date of this title, the Administrator
shall—
(1) ensure that a study is conducted to evaluate
the best practices of community technology centers
that have received Federal funds; and
(2) submit a report on the study to—
(A) the Committee on Governmental Af-
fairs of the Senate;
(B) the Committee on Health, Education,
Labor, and Pensions of the Senate;
(C) the Committee on Government Reform
of the House of Representatives; and
116
(D) the Committee on Education and the
Workforce of the House of Representatives.
(c) CONTENTS.—The report under subsection (b)
may consider—
(1) an evaluation of the best practices being
used by successful community technology centers;
(2) a strategy for—
(A) continuing the evaluation of best prac-
tices used by community technology centers;
and
(B) establishing a network to share infor-
mation and resources as community technology
centers evolve;
(3) the identification of methods to expand the
use of best practices to assist community technology
centers, public libraries, and other institutions that
provide computer and Internet access to the public;
(4) a database of all community technology cen-
ters that have received Federal funds, including—
(A) each center’s name, location, services
provided, director, other points of contact, num-
ber of individuals served; and
(B) other relevant information;
117
(5) an analysis of whether community tech-
nology centers have been deployed effectively in
urban and rural areas throughout the Nation; and
(6) recommendations of how to—
(A) enhance the development of community
technology centers; and
(B) establish a network to share informa-
tion and resources.
(d) COOPERATION.—All agencies that fund commu-
nity technology centers shall provide to the Administrator
any information and assistance necessary for the comple-
tion of the study and the report under this section.
(e) ASSISTANCE.—
(1) IN GENERAL.—The Administrator, in con-
sultation with the Secretary of Education, shall work
with other relevant Federal agencies, and other in-
terested persons in the private and nonprofit sectors
to—
(A) assist in the implementation of rec-
ommendations; and
(B) identify other ways to assist commu-
nity technology centers, public libraries, and
other institutions that provide computer and
Internet access to the public.
118
(2) TYPES OF ASSISTANCE.—Assistance under
this subsection may include—
(A) contribution of funds;
(B) donations of equipment, and training
in the use and maintenance of the equipment;
and
(C) the provision of basic instruction or
training material in computer skills and Inter-
net usage.
(f) ONLINE TUTORIAL.—
(1) IN GENERAL.—The Administrator, in con-
sultation with the Secretary of Education, the Direc-
tor of the Institute of Museum and Library Services,
other relevant agencies, and the public, shall develop
an online tutorial that—
(A) explains how to access Government in-
formation and services on the Internet; and
(B) provides a guide to available online re-
sources.
(2) DISTRIBUTION.—The Administrator, with
assistance from the Secretary of Education, shall
distribute information on the tutorial to community
technology centers, public libraries, and other insti-
tutions that afford Internet access to the public.
119
(g) PROMOTION OF COMMUNITY TECHNOLOGY CEN-
TERS.—The Administrator, with assistance from the De-
partment of Education and in consultation with other
agencies and organizations, shall promote the availability
of community technology centers to raise awareness within
each community where such a center is located.
(h) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated for the study of best
practices at community technology centers, for the devel-
opment and dissemination of the online tutorial, and for
the promotion of community technology centers under this
section—
(1) $2,000,000 in fiscal year 2003;
(2) $2,000,000 in fiscal year 2004; and
(3) such sums as are necessary in fiscal years
2005 through 2007.
SEC. 214. ENHANCING CRISIS MANAGEMENT THROUGH AD-
VANCED INFORMATION TECHNOLOGY.
(a) PURPOSE.—The purpose of this section is to im-
prove how information technology is used in coordinating
and facilitating information on disaster preparedness, re-
sponse, and recovery, while ensuring the availability of
such information across multiple access channels.
(b) IN GENERAL.—
120
(1) STUDY ON ENHANCEMENT OF CRISIS RE-
SPONSE.—Not later than 90 days after the date of
enactment of this Act, the Administrator, in con-
sultation with the Federal Emergency Management
Agency, shall ensure that a study is conducted on
using information technology to enhance crisis pre-
paredness, response, and consequence management
of natural and manmade disasters.
(2) CONTENTS.—The study under this sub-
section shall address—
(A) a research and implementation strat-
egy for effective use of information technology
in crisis response and consequence manage-
ment, including the more effective use of tech-
nologies, management of information technology
research initiatives, and incorporation of re-
search advances into the information and com-
munications systems of—
(i) the Federal Emergency Manage-
ment Agency; and
(ii) other Federal, State, and local
agencies responsible for crisis prepared-
ness, response, and consequence manage-
ment; and
121
(B) opportunities for research and develop-
ment on enhanced technologies into areas of po-
tential improvement as determined during the
course of the study.
(3) REPORT.—Not later than 2 years after the
date on which a contract is entered into under para-
graph (1), the Administrator shall submit a report
on the study, including findings and recommenda-
tions to—
(A) the Committee on Governmental Af-
fairs of the Senate; and
(B) the Committee on Government Reform
of the House of Representatives.
(4) INTERAGENCY COOPERATION.—Other Fed-
eral departments and agencies with responsibility for
disaster relief and emergency assistance shall fully
cooperate with the Administrator in carrying out
this section.
(5) AUTHORIZATION
OF
APPROPRIATIONS.—
There are authorized to be appropriated for research
under this subsection, such sums as are necessary
for fiscal year 2003.
(c) PILOT PROJECTS.—Based on the results of the
research conducted under subsection (b), the Adminis-
trator, in consultation with the Federal Emergency Man-
122
agement Agency, shall initiate pilot projects or report to
Congress on other activities that further the goal of maxi-
mizing the utility of information technology in disaster
management. The Administrator shall cooperate with
other relevant agencies, and, if appropriate, State, local,
and tribal governments, in initiating such pilot projects.
SEC. 215. DISPARITIES IN ACCESS TO THE INTERNET.
(a) STUDY AND REPORT.—
(1) STUDY.—Not later than 90 days after the
date of enactment of this Act, the Administrator of
General Services shall request that the National
Academy of Sciences, acting through the National
Research Council, enter into a contract to conduct
a study on disparities in Internet access for online
Government services.
(2) REPORT.—Not later than 2 years after the
date of enactment of this Act, the Administrator of
General Services shall submit to the Committee on
Governmental Affairs of the Senate and the Com-
mittee on Government Reform of the House of Rep-
resentatives a final report of the study under this
section, which shall set forth the findings, conclu-
sions, and recommendations of the National Re-
search Council.
123
(b) CONTENTS.—The report under subsection (a)
shall include a study of—
(1) how disparities in Internet access influence
the effectiveness of online Government services, in-
cluding a review of—
(A) the nature of disparities in Internet
access;
(B) the affordability of Internet service;
(C) the incidence of disparities among dif-
ferent groups within the population; and
(D) changes in the nature of personal and
public Internet access that may alleviate or ag-
gravate effective access to online Government
services;
(2) how the increase in online Government serv-
ices is influencing the disparities in Internet access
and how technology development or diffusion trends
may offset such adverse influences; and
(3) related societal effects arising from the
interplay of disparities in Internet access and the in-
crease in online Government services.
(c) RECOMMENDATIONS.—The report shall include
recommendations on actions to ensure that online Govern-
ment initiatives shall not have the unintended result of
124
increasing any deficiency in public access to Government
services.
(d) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated $950,000 in fiscal year
2003 to carry out this section.
SEC. 216. COMMON PROTOCOLS FOR GEOGRAPHIC INFOR-
MATION SYSTEMS.
(a) PURPOSES.—The purposes of this section are
to—
(1) reduce redundant data collection and infor-
mation; and
(2) promote collaboration and use of standards
for government geographic information.
(b) DEFINITION.—In this section, the term ‘‘geo-
graphic information’’ means information systems that in-
volve locational data, such as maps or other geospatial in-
formation resources.
(c) IN GENERAL.—
(1) COMMON PROTOCOLS.—The Administrator,
in consultation with the Secretary of the Interior,
working with the Director and through an inter-
agency group, and working with private sector ex-
perts, State, local, and tribal governments, commer-
cial and international standards groups, and other
interested parties, shall facilitate the development of
125
common protocols for the development, acquisition,
maintenance, distribution, and application of geo-
graphic information. If practicable, the Adminis-
trator shall incorporate intergovernmental and public
private geographic information partnerships into ef-
forts under this subsection.
(2) INTERAGENCY
GROUP.—The interagency
group referred to under paragraph (1) shall include
representatives of the National Institute of Stand-
ards and Technology and other agencies.
(d) DIRECTOR.—The Director shall oversee—
(1) the interagency initiative to develop common
protocols;
(2) the coordination with State, local, and tribal
governments, public private partnerships, and other
interested persons on effective and efficient ways to
align geographic information and develop common
protocols; and
(3) the adoption of common standards relating
to the protocols.
(e) COMMON PROTOCOLS.—The common protocols
shall be designed to—
(1) maximize the degree to which unclassified
geographic information from various sources can be
made electronically compatible and accessible; and
126
(2) promote the development of interoperable
geographic information systems technologies that
shall—
(A) allow widespread, low-cost use and
sharing of geographic data by Federal agencies,
State, local, and tribal governments, and the
public; and
(B) enable the enhancement of services
using geographic data.
(f) AUTHORIZATION
OF APPROPRIATIONS.—There
are authorized to be appropriated such sums as are nec-
essary to carry out this section, for each of the fiscal years
2003 through 2007.
TITLE III—INFORMATION
SECURITY
SEC. 301. INFORMATION SECURITY.
(a) SHORT TITLE.—This title may be cited as the
‘‘Federal Information Security Management Act of 2002’’.
(b) INFORMATION SECURITY.—
(1) IN
GENERAL.—Chapter 35 of title 44,
United States Code, is amended by adding at the
end the following new subchapter:
‘‘SUBCHAPTER III—INFORMATION SECURITY
‘‘§ 3541. Purposes
‘‘The purposes of this subchapter are to—
127
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support Fed-
eral operations and assets;
‘‘(2) recognize the highly networked nature of
the current Federal computing environment and pro-
vide effective governmentwide management and over-
sight of the related information security risks, in-
cluding coordination of information security efforts
throughout the civilian, national security, and law
enforcement communities;
‘‘(3) provide for development and maintenance
of minimum controls required to protect Federal in-
formation and information systems;
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams;
‘‘(5) acknowledge that commercially developed
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection
of critical information infrastructures important to
the national defense and economic security of the
nation that are designed, built, and operated by the
private sector; and
128
‘‘(6) recognize that the selection of specific
technical hardware and software information secu-
rity solutions should be left to individual agencies
from among commercially developed products.
‘‘§ 3542. Definitions
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under section 3502 shall apply
to this subchapter.
‘‘(b) ADDITIONAL DEFINITIONS.—As used in this
subchapter:
‘‘(1) The term ‘information security’ means
protecting information and information systems
from unauthorized access, use, disclosure, disrup-
tion, modification, or destruction in order to
provide—
‘‘(A) integrity, which means guarding
against improper information modification or
destruction, and includes ensuring information
nonrepudiation and authenticity;
‘‘(B) confidentiality, which means pre-
serving authorized restrictions on access and
disclosure, including means for protecting per-
sonal privacy and proprietary information; and
129
‘‘(C) availability, which means ensuring
timely and reliable access to and use of infor-
mation.
‘‘(2)(A) The term ‘national security system’
means any information system (including any tele-
communications system) used or operated by an
agency or by a contractor of an agency, or other or-
ganization on behalf of an agency—
‘‘(i) the function, operation, or use of
which—
‘‘(I) involves intelligence activities;
‘‘(II) involves cryptologic activities re-
lated to national security;
‘‘(III) involves command and control
of military forces;
‘‘(IV) involves equipment that is an
integral part of a weapon or weapons sys-
tem; or
‘‘(V) subject to subparagraph (B), is
critical to the direct fulfillment of military
or intelligence missions; or
‘‘(ii) is protected at all times by procedures
established for information that have been spe-
cifically authorized under criteria established by
an Executive order or an Act of Congress to be
130
kept classified in the interest of national de-
fense or foreign policy.
‘‘(B) Subparagraph (A)(i)(V) does not include a
system that is to be used for routine administrative
and business applications (including payroll, finance,
logistics, and personnel management applications).
‘‘(3) The term ‘information technology’ has the
meaning given that term in section 11101 of title
40.
‘‘§ 3543. Authority and functions of the Director
‘‘(a) IN GENERAL.—The Director shall oversee agen-
cy information security policies and practices, including—
‘‘(1) developing and overseeing the implementa-
tion of policies, principles, standards, and guidelines
on information security, including through ensuring
timely agency adoption of and compliance with
standards promulgated under section 11331 of title
40;
‘‘(2) requiring agencies, consistent with the
standards promulgated under such section 11331
and the requirements of this subchapter, to identify
and provide information security protections com-
mensurate with the risk and magnitude of the harm
resulting from the unauthorized access, use, disclo-
sure, disruption, modification, or destruction of—
131
‘‘(A) information collected or maintained
by or on behalf of an agency; or
‘‘(B) information systems used or operated
by an agency or by a contractor of an agency
or other organization on behalf of an agency;
‘‘(3) coordinating the development of standards
and guidelines under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C.
278g–3) with agencies and offices operating or exer-
cising control of national security systems (including
the National Security Agency) to assure, to the max-
imum extent feasible, that such standards and
guidelines are complementary with standards and
guidelines developed for national security systems;
‘‘(4) overseeing agency compliance with the re-
quirements of this subchapter, including through
any authorized action under section 11303 of title
40, to enforce accountability for compliance with
such requirements;
‘‘(5) reviewing at least annually, and approving
or disapproving, agency information security pro-
grams required under section 3544(b);
‘‘(6) coordinating information security policies
and procedures with related information resources
management policies and procedures;
132
‘‘(7) overseeing the operation of the Federal in-
formation security incident center required under
section 3546; and
‘‘(8) reporting to Congress no later than March
1 of each year on agency compliance with the re-
quirements of this subchapter, including—
‘‘(A) a summary of the findings of evalua-
tions required by section 3545;
‘‘(B) an assessment of the development,
promulgation, and adoption of, and compliance
with, standards developed under section 20 of
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g-3) and promul-
gated under section 11331 of title 40;
‘‘(C) significant deficiencies in agency in-
formation security practices;
‘‘(D) planned remedial action to address
such deficiencies; and
‘‘(E) a summary of, and the views of the
Director on, the report prepared by the Na-
tional Institute of Standards and Technology
under section 20(d)(10) of the National Insti-
tute of Standards and Technology Act (15
U.S.C. 278g–3).
133
‘‘(b) NATIONAL SECURITY SYSTEMS.—Except for the
authorities described in paragraphs (4) and (8) of sub-
section (a), the authorities of the Director under this sec-
tion shall not apply to national security systems.
‘‘(c) DEPARTMENT OF DEFENSE AND CENTRAL IN-
TELLIGENCE AGENCY SYSTEMS.—(1) The authorities of
the Director described in paragraphs (1) and (2) of sub-
section (a) shall be delegated to the Secretary of Defense
in the case of systems described in paragraph (2) and to
the Director of Central Intelligence in the case of systems
described in paragraph (3).
‘‘(2) The systems described in this paragraph are sys-
tems that are operated by the Department of Defense, a
contractor of the Department of Defense, or another enti-
ty on behalf of the Department of Defense that processes
any information the unauthorized access, use, disclosure,
disruption, modification, or destruction of which would
have a debilitating impact on the mission of the Depart-
ment of Defense.
‘‘(3) The systems described in this paragraph are sys-
tems that are operated by the Central Intelligence Agency,
a contractor of the Central Intelligence Agency, or another
entity on behalf of the Central Intelligence Agency that
processes any information the unauthorized access, use,
disclosure, disruption, modification, or destruction of
134
which would have a debilitating impact on the mission of
the Central Intelligence Agency.
‘‘§ 3544. Federal agency responsibilities
‘‘(a) IN GENERAL.—The head of each agency shall—
‘‘(1) be responsible for—
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized
access, use, disclosure, disruption, modification,
or destruction of—
‘‘(i) information collected or main-
tained by or on behalf of the agency; and
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of
an agency or other organization on behalf
of an agency;
‘‘(B) complying with the requirements of
this subchapter and related policies, procedures,
standards, and guidelines, including—
‘‘(i) information security standards
promulgated under section 11331 of title
40; and
‘‘(ii) information security standards
and guidelines for national security sys-
135
tems issued in accordance with law and as
directed by the President; and
‘‘(C) ensuring that information security
management processes are integrated with
agency strategic and operational planning proc-
esses;
‘‘(2) ensure that senior agency officials provide
information security for the information and infor-
mation systems that support the operations and as-
sets under their control, including through—
‘‘(A) assessing the risk and magnitude of
the harm that could result from the unauthor-
ized access, use, disclosure, disruption, modi-
fication, or destruction of such information or
information systems;
‘‘(B) determining the levels of information
security appropriate to protect such information
and information systems in accordance with
standards promulgated under section 11331 of
title 40, for information security classifications
and related requirements;
‘‘(C) implementing policies and procedures
to cost-effectively reduce risks to an acceptable
level; and
136
‘‘(D) periodically testing and evaluating in-
formation security controls and techniques to
ensure that they are effectively implemented;
‘‘(3) delegate to the agency Chief Information
Officer established under section 3506 (or com-
parable official in an agency not covered by such
section) the authority to ensure compliance with the
requirements imposed on the agency under this sub-
chapter, including—
‘‘(A) designating a senior agency informa-
tion security officer who shall—
‘‘(i) carry out the Chief Information
Officer’s responsibilities under this section;
‘‘(ii) possess professional qualifica-
tions, including training and experience,
required to administer the functions de-
scribed under this section;
‘‘(iii) have information security duties
as that official’s primary duty; and
‘‘(iv) head an office with the mission
and resources to assist in ensuring agency
compliance with this section;
‘‘(B) developing and maintaining an agen-
cywide information security program as re-
quired by subsection (b);
137
‘‘(C) developing and maintaining informa-
tion security policies, procedures, and control
techniques to address all applicable require-
ments, including those issued under section
3543 of this title, and section 11331 of title 40;
‘‘(D) training and overseeing personnel
with significant responsibilities for information
security with respect to such responsibilities;
and
‘‘(E) assisting senior agency officials con-
cerning their responsibilities under paragraph
(2);
‘‘(4) ensure that the agency has trained per-
sonnel sufficient to assist the agency in complying
with the requirements of this subchapter and related
policies, procedures, standards, and guidelines; and
‘‘(5) ensure that the agency Chief Information
Officer, in coordination with other senior agency of-
ficials, reports annually to the agency head on the
effectiveness of the agency information security pro-
gram, including progress of remedial actions.
‘‘(b) AGENCY PROGRAM.—Each agency shall develop,
document, and implement an agencywide information se-
curity program, approved by the Director under section
3543(a)(5), to provide information security for the infor-
138
mation and information systems that support the oper-
ations and assets of the agency, including those provided
or managed by another agency, contractor, or other
source, that includes—
‘‘(1) periodic assessments of the risk and mag-
nitude of the harm that could result from the unau-
thorized access, use, disclosure, disruption, modifica-
tion, or destruction of information and information
systems that support the operations and assets of
the agency;
‘‘(2) policies and procedures that—
‘‘(A) are based on the risk assessments re-
quired by paragraph (1);
‘‘(B) cost-effectively reduce information se-
curity risks to an acceptable level;
‘‘(C) ensure that information security is
addressed throughout the life cycle of each
agency information system; and
‘‘(D) ensure compliance with—
‘‘(i) the requirements of this sub-
chapter;
‘‘(ii) policies and procedures as may
be prescribed by the Director, and infor-
mation security standards promulgated
under section 11331 of title 40;
139
‘‘(iii) minimally acceptable system
configuration requirements, as determined
by the agency; and
‘‘(iv) any other applicable require-
ments, including standards and guidelines
for national security systems issued in ac-
cordance with law and as directed by the
President;
‘‘(3) subordinate plans for providing adequate
information security for networks, facilities, and sys-
tems or groups of information systems, as appro-
priate;
‘‘(4) security awareness training to inform per-
sonnel, including contractors and other users of in-
formation systems that support the operations and
assets of the agency, of—
‘‘(A) information security risks associated
with their activities; and
‘‘(B) their responsibilities in complying
with agency policies and procedures designed to
reduce these risks;
‘‘(5) periodic testing and evaluation of the ef-
fectiveness of information security policies, proce-
dures, and practices, to be performed with a fre-
140
quency depending on risk, but no less than annually,
of which such testing—
‘‘(A) shall include testing of management,
operational, and technical controls of every in-
formation system identified in the inventory re-
quired under section 3505(c); and
‘‘(B) may include testing relied on in a
evaluation under section 3545;
‘‘(6) a process for planning, implementing, eval-
uating, and documenting remedial action to address
any deficiencies in the information security policies,
procedures, and practices of the agency;
‘‘(7) procedures for detecting, reporting, and re-
sponding to security incidents, consistent with stand-
ards and guidelines issued pursuant to section
3546(b), including—
‘‘(A) mitigating risks associated with such
incidents before substantial damage is done;
‘‘(B) notifying and consulting with the
Federal information security incident center re-
ferred to in section 3546; and
‘‘(C) notifying and consulting with, as
appropriate—
‘‘(i) law enforcement agencies and rel-
evant Offices of Inspector General;
141
‘‘(ii) an office designated by the Presi-
dent for any incident involving a national
security system; and
‘‘(iii) any other agency or office, in ac-
cordance with law or as directed by the
President; and
‘‘(8) plans and procedures to ensure continuity
of operations for information systems that support
the operations and assets of the agency.
‘‘(c) AGENCY REPORTING.—Each agency shall—
‘‘(1) report annually to the Director, the Com-
mittees on Government Reform and Science of the
House of Representatives, the Committees on Gov-
ernmental Affairs and Commerce, Science, and
Transportation of the Senate, the appropriate au-
thorization and appropriations committees of Con-
gress, and the Comptroller General on the adequacy
and effectiveness of information security policies,
procedures, and practices, and compliance with the
requirements of this subchapter, including compli-
ance with each requirement of subsection (b);
‘‘(2) address the adequacy and effectiveness of
information security policies, procedures, and prac-
tices in plans and reports relating to—
‘‘(A) annual agency budgets;
142
‘‘(B) information resources management
under subchapter 1 of this chapter;
‘‘(C) information technology management
under subtitle III of title 40;
‘‘(D) program performance under sections
1105 and 1115 through 1119 of title 31, and
sections 2801 and 2805 of title 39;
‘‘(E) financial management under chapter
9 of title 31, and the Chief Financial Officers
Act of 1990 (31 U.S.C. 501 note; Public Law
101–576) (and the amendments made by that
Act);
‘‘(F) financial management systems under
the Federal Financial Management Improve-
ment Act (31 U.S.C. 3512 note); and
‘‘(G) internal accounting and administra-
tive controls under section 3512 of title 31,
(known as the ‘Federal Managers Financial In-
tegrity Act’); and
‘‘(3) report any significant deficiency in a pol-
icy, procedure, or practice identified under para-
graph (1) or (2)—
‘‘(A) as a material weakness in reporting
under section 3512 of title 31; and
143
‘‘(B) if relating to financial management
systems, as an instance of a lack of substantial
compliance under the Federal Financial Man-
agement Improvement Act (31 U.S.C. 3512
note).
‘‘(d) PERFORMANCE PLAN.—(1) In addition to the
requirements of subsection (c), each agency, in consulta-
tion with the Director, shall include as part of the per-
formance plan required under section 1115 of title 31 a
description of—
‘‘(A) the time periods, and
‘‘(B) the resources, including budget, staffing,
and training,
that are necessary to implement the program required
under subsection (b).
‘‘(2) The description under paragraph (1) shall be
based on the risk assessments required under subsection
(b)(2)(1).
‘‘(e) PUBLIC NOTICE AND COMMENT.—Each agency
shall provide the public with timely notice and opportuni-
ties for comment on proposed information security policies
and procedures to the extent that such policies and proce-
dures affect communication with the public.
144
‘‘§ 3545. Annual independent evaluation
‘‘(a) IN GENERAL.—(1) Each year each agency shall
have performed an independent evaluation of the informa-
tion security program and practices of that agency to de-
termine the effectiveness of such program and practices.
‘‘(2) Each evaluation under this section shall
include—
‘‘(A) testing of the effectiveness of information
security policies, procedures, and practices of a rep-
resentative subset of the agency’s information sys-
tems;
‘‘(B) an assessment (made on the basis of the
results of the testing) of compliance with—
‘‘(i) the requirements of this subchapter;
and
‘‘(ii) related information security policies,
procedures, standards, and guidelines; and
‘‘(C) separate presentations, as appropriate, re-
garding information security relating to national se-
curity systems.
‘‘(b) INDEPENDENT
AUDITOR.—Subject to sub-
section (c)—
‘‘(1) for each agency with an Inspector General
appointed under the Inspector General Act of 1978,
the annual evaluation required by this section shall
be performed by the Inspector General or by an
145
independent external auditor, as determined by the
Inspector General of the agency; and
‘‘(2) for each agency to which paragraph (1)
does not apply, the head of the agency shall engage
an independent external auditor to perform the eval-
uation.
‘‘(c) NATIONAL
SECURITY
SYSTEMS.—For each
agency operating or exercising control of a national secu-
rity system, that portion of the evaluation required by this
section directly relating to a national security system shall
be performed—
‘‘(1) only by an entity designated by the agency
head; and
‘‘(2) in such a manner as to ensure appropriate
protection for information associated with any infor-
mation security vulnerability in such system com-
mensurate with the risk and in accordance with all
applicable laws.
‘‘(d) EXISTING EVALUATIONS.—The evaluation re-
quired by this section may be based in whole or in part
on an audit, evaluation, or report relating to programs or
practices of the applicable agency.
‘‘(e) AGENCY REPORTING.—(1) Each year, not later
than such date established by the Director, the head of
146
each agency shall submit to the Director the results of
the evaluation required under this section.
‘‘(2) To the extent an evaluation required under this
section directly relates to a national security system, the
evaluation results submitted to the Director shall contain
only a summary and assessment of that portion of the
evaluation directly relating to a national security system.
‘‘(f) PROTECTION OF INFORMATION.—Agencies and
evaluators shall take appropriate steps to ensure the pro-
tection of information which, if disclosed, may adversely
affect information security. Such protections shall be com-
mensurate with the risk and comply with all applicable
laws and regulations.
‘‘(g) OMB REPORTS TO CONGRESS.—(1) The Direc-
tor shall summarize the results of the evaluations con-
ducted under this section in the report to Congress re-
quired under section 3543(a)(8).
‘‘(2) The Director’s report to Congress under this
subsection shall summarize information regarding infor-
mation security relating to national security systems in
such a manner as to ensure appropriate protection for in-
formation associated with any information security vulner-
ability in such system commensurate with the risk and in
accordance with all applicable laws.
147
‘‘(3) Evaluations and any other descriptions of infor-
mation systems under the authority and control of the Di-
rector of Central Intelligence or of National Foreign Intel-
ligence Programs systems under the authority and control
of the Secretary of Defense shall be made available to Con-
gress only through the appropriate oversight committees
of Congress, in accordance with applicable laws.
‘‘(h) COMPTROLLER GENERAL.—The Comptroller
General shall periodically evaluate and report to Congress
on—
‘‘(1) the adequacy and effectiveness of agency
information security policies and practices; and
‘‘(2) implementation of the requirements of this
subchapter.
‘‘§ 3546. Federal information security incident center
‘‘(a) IN GENERAL.—The Director shall ensure the
operation of a central Federal information security inci-
dent center to—
‘‘(1) provide timely technical assistance to oper-
ators of agency information systems regarding secu-
rity incidents, including guidance on detecting and
handling information security incidents;
‘‘(2) compile and analyze information about in-
cidents that threaten information security;
148
‘‘(3) inform operators of agency information
systems about current and potential information se-
curity threats, and vulnerabilities; and
‘‘(4) consult with the National Institute of
Standards and Technology, agencies or offices oper-
ating or exercising control of national security sys-
tems (including the National Security Agency), and
such other agencies or offices in accordance with law
and as directed by the President regarding informa-
tion security incidents and related matters.
‘‘(b) NATIONAL SECURITY SYSTEMS.—Each agency
operating or exercising control of a national security sys-
tem shall share information about information security in-
cidents, threats, and vulnerabilities with the Federal infor-
mation security incident center to the extent consistent
with standards and guidelines for national security sys-
tems, issued in accordance with law and as directed by
the President.
‘‘§ 3547. National security systems
‘‘The head of each agency operating or exercising
control of a national security system shall be responsible
for ensuring that the agency—
‘‘(1) provides information security protections
commensurate with the risk and magnitude of the
harm resulting from the unauthorized access, use,
149
disclosure, disruption, modification, or destruction of
the information contained in such system;
‘‘(2) implements information security policies
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President; and
‘‘(3) complies with the requirements of this sub-
chapter.
‘‘§ 3548. Authorization of appropriations
‘‘There are authorized to be appropriated to carry out
the provisions of this subchapter such sums as may be
necessary for each of fiscal years 2003 through 2007.
‘‘§ 3549. Effect on existing law
‘‘Nothing in this subchapter, section 11331 of title
40, or section 20 of the National Standards and Tech-
nology Act (15 U.S.C. 278g–3) may be construed as af-
fecting the authority of the President, the Office of Man-
agement and Budget or the Director thereof, the National
Institute of Standards and Technology, or the head of any
agency, with respect to the authorized use or disclosure
of information, including with regard to the protection of
personal privacy under section 552a of title 5, the disclo-
sure of information under section 552 of title 5, the man-
agement and disposition of records under chapters 29, 31,
or 33 of title 44, the management of information resources
150
under subchapter I of chapter 35 of this title, or the dis-
closure of information to the Congress or the Comptroller
General of the United States. While this subchapter is in
effect, subchapter II of this chapter shall not apply.’’.
(2) CLERICAL AMENDMENT.—The table of sec-
tions at the beginning of such chapter 35 is amend-
ed by adding at the end the following:
‘‘SUBCHAPTER III—INFORMATION SECURITY
‘‘Sec.
‘‘3541. Purposes.
‘‘3542. Definitions.
‘‘3543. Authority and functions of the Director.
‘‘3544. Federal agency responsibilities.
‘‘3545. Annual independent evaluation.
‘‘3546. Federal information security incident center.
‘‘3547. National security systems.
‘‘3548. Authorization of appropriations.
‘‘3549. Effect on existing law.’’.
(c) INFORMATION SECURITY RESPONSIBILITIES OF
CERTAIN AGENCIES.—
(1) NATIONAL SECURITY RESPONSIBILITIES.—
(A) Nothing in this Act (including any amendment
made by this Act) shall supersede any authority of
the Secretary of Defense, the Director of Central In-
telligence, or other agency head, as authorized by
law and as directed by the President, with regard to
the operation, control, or management of national
security systems, as defined by section 3542(b)(2) of
title 44, United States Code.
151
(B) Section 2224 of title 10, United States
Code, is amended—
(i) in subsection (b), by striking ‘‘(b) OB-
JECTIVES
AND
MINIMUM
REQUIREMENTS.—
(1)’’ and inserting ‘‘(b) OBJECTIVES OF THE
PROGRAM.—’’;
(ii) in subsection (b), by striking para-
graph (2); and
(iii) in subsection (c), in the matter pre-
ceding paragraph (1), by inserting ‘‘, including
through compliance with subchapter III of
chapter 35 of title 44’’ after ‘‘infrastructure’’.
(2) ATOMIC ENERGY ACT OF 1954.—Nothing in
this Act shall supersede any requirement made by or
under the Atomic Energy Act of 1954 (42 U.S.C.
2011 et seq.). Restricted data or formerly restricted
data shall be handled, protected, classified, down-
graded, and declassified in conformity with the
Atomic Energy Act of 1954 (42 U.S.C. 2011 et
seq.).
SEC. 302. MANAGEMENT OF INFORMATION TECHNOLOGY.
(a) IN GENERAL.—Section 11331 of title 40, United
States Code, is amended to read as follows:
152
‘‘§ 11331. Responsibilities for Federal information sys-
tems standards
‘‘(a) STANDARDS AND GUIDELINES.—
‘‘(1) AUTHORITY
TO
PRESCRIBE.—Except as
provided under paragraph (2), the Secretary of
Commerce shall, on the basis of standards and
guidelines developed by the National Institute of
Standards and Technology pursuant to paragraphs
(2) and (3) of section 20(a) of the National Institute
of Standards and Technology Act (15 U.S.C. 278g–
3(a)), prescribe standards and guidelines pertaining
to Federal information systems.
‘‘(2) NATIONAL
SECURITY
SYSTEMS.—Stand-
ards and guidelines for national security systems (as
defined under this section) shall be developed, pre-
scribed, enforced, and overseen as otherwise author-
ized by law and as directed by the President.
‘‘(b) MANDATORY REQUIREMENTS.—
‘‘(1) AUTHORITY TO MAKE MANDATORY.—Ex-
cept as provided under paragraph (2), the Secretary
shall make standards prescribed under subsection
(a)(1) compulsory and binding to the extent deter-
mined necessary by the Secretary to improve the ef-
ficiency of operation or security of Federal informa-
tion systems.
153
‘‘(2) REQUIRED MANDATORY STANDARDS.—(A)
Standards prescribed under subsection (a)(1) shall
include information security standards that—
‘‘(i) provide minimum information security
requirements as determined under section 20(b)
of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3(b)); and
‘‘(ii) are otherwise necessary to improve
the security of Federal information and infor-
mation systems.
‘‘(B) Information security standards described
in subparagraph (A) shall be compulsory and bind-
ing.
‘‘(c) AUTHORITY TO DISAPPROVE OR MODIFY.—The
President may disapprove or modify the standards and
guidelines referred to in subsection (a)(1) if the President
determines such action to be in the public interest. The
President’s authority to disapprove or modify such stand-
ards and guidelines may not be delegated. Notice of such
disapproval or modification shall be published promptly in
the Federal Register. Upon receiving notice of such dis-
approval or modification, the Secretary of Commerce shall
immediately rescind or modify such standards or guide-
lines as directed by the President.
154
‘‘(d) EXERCISE OF AUTHORITY.—To ensure fiscal
and policy consistency, the Secretary shall exercise the au-
thority conferred by this section subject to direction by
the President and in coordination with the Director of the
Office of Management and Budget.
‘‘(e) APPLICATION
OF MORE STRINGENT STAND-
ARDS.—The head of an executive agency may employ
standards for the cost-effective information security for in-
formation systems within or under the supervision of that
agency that are more stringent than the standards the
Secretary prescribes under this section if the more strin-
gent standards—
‘‘(1) contain at least the applicable standards
made compulsory and binding by the Secretary; and
‘‘(2) are otherwise consistent with policies and
guidelines issued under section 3543 of title 44.
‘‘(f) DECISIONS
ON PROMULGATION
OF STAND-
ARDS.—The decision by the Secretary regarding the pro-
mulgation of any standard under this section shall occur
not later than 6 months after the submission of the pro-
posed standard to the Secretary by the National Institute
of Standards and Technology, as provided under section
20 of the National Institute of Standards and Technology
Act (15 U.S.C. 278g–3).
‘‘(g) DEFINITIONS.—In this section:
155
‘‘(1) FEDERAL
INFORMATION
SYSTEM.—The
term ‘Federal information system’ means an infor-
mation system used or operated by an executive
agency, by a contractor of an executive agency, or by
another organization on behalf of an executive agen-
cy.
‘‘(2) INFORMATION SECURITY.—The term ‘in-
formation security’ has the meaning given that term
in section 3542(b)(1) of title 44.
‘‘(3) NATIONAL SECURITY SYSTEM.—The term
‘national security system’ has the meaning given
that term in section 3542(b)(2) of title 44.’’.
(b) CLERICAL AMENDMENT.—The item relating to
section 11331 in the table of sections at the beginning of
chapter 113 of such title is amended to read as follows:
‘‘11331. Responsibilities for Federal information systems standards.’’.
SEC. 303. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), is amended by strik-
ing the text and inserting the following:
‘‘(a) IN GENERAL.—The Institute shall—
‘‘(1) have the mission of developing standards,
guidelines, and associated methods and techniques
for information systems;
156
‘‘(2) develop standards and guidelines, includ-
ing minimum requirements, for information systems
used or operated by an agency or by a contractor of
an agency or other organization on behalf of an
agency, other than national security systems (as de-
fined in section 3542(b)(2) of title 44, United States
Code); and
‘‘(3) develop standards and guidelines, includ-
ing minimum requirements, for providing adequate
information security for all agency operations and
assets, but such standards and guidelines shall not
apply to national security systems.
‘‘(b) MINIMUM REQUIREMENTS
FOR STANDARDS
AND GUIDELINES.—The standards and guidelines re-
quired by subsection (a) shall include, at a minimum—
‘‘(1)(A) standards to be used by all agencies to
categorize all information and information systems
collected or maintained by or on behalf of each agen-
cy based on the objectives of providing appropriate
levels of information security according to a range of
risk levels;
‘‘(B) guidelines recommending the types of in-
formation and information systems to be included in
each such category; and
157
‘‘(C) minimum information security require-
ments for information and information systems in
each such category;
‘‘(2) a definition of and guidelines concerning
detection and handling of information security inci-
dents; and
‘‘(3) guidelines developed in conjunction with
the Department of Defense, including the National
Security Agency, for identifying an information sys-
tem as a national security system consistent with ap-
plicable requirements for national security systems,
issued in accordance with law and as directed by the
President.
‘‘(c) DEVELOPMENT
OF STANDARDS
AND GUIDE-
LINES.—In developing standards and guidelines required
by subsections (a) and (b), the Institute shall—
‘‘(1) consult with other agencies and offices and
the private sector (including the Director of the Of-
fice of Management and Budget, the Departments of
Defense and Energy, the National Security Agency,
the General Accounting Office, and the Secretary of
Homeland Security) to assure—
‘‘(A) use of appropriate information secu-
rity policies, procedures, and techniques, in
order to improve information security and avoid
158
unnecessary and costly duplication of effort;
and
‘‘(B) that such standards and guidelines
are complementary with standards and guide-
lines employed for the protection of national se-
curity systems and information contained in
such systems;
‘‘(2) provide the public with an opportunity to
comment on proposed standards and guidelines;
‘‘(3) submit to the Secretary of Commerce for
promulgation under section 11331 of title 40,
United States Code—
‘‘(A) standards, as required under sub-
section (b)(1)(A), no later than 12 months after
the date of the enactment of this section; and
‘‘(B) minimum information security re-
quirements for each category, as required under
subsection (b)(1)(C), no later than 36 months
after the date of the enactment of this section;
‘‘(4) issue guidelines as required under sub-
section (b)(1)(B), no later than 18 months after the
date of the enactment of this section;
‘‘(5) to the maximum extent practicable, ensure
that such standards and guidelines do not require
159
the use or procurement of specific products, includ-
ing any specific hardware or software;
‘‘(6) to the maximum extent practicable, ensure
that such standards and guidelines provide for suffi-
cient flexibility to permit alternative solutions to pro-
vide equivalent levels of protection for identified in-
formation security risks; and
‘‘(7) to the maximum extent practicable, use
flexible, performance-based standards and guidelines
that permit the use of off-the-shelf commercially de-
veloped information security products.
‘‘(d) INFORMATION SECURITY FUNCTIONS.—The In-
stitute shall—
‘‘(1) submit standards developed pursuant to
subsection (a), along with recommendations as to
the extent to which these should be made compul-
sory and binding, to the Secretary of Commerce for
promulgation under section 11331 of title 40,
United States Code;
‘‘(2) provide technical assistance to agencies,
upon request, regarding—
‘‘(A) compliance with the standards and
guidelines developed under subsection (a);
‘‘(B) detecting and handling information
security incidents; and
160
‘‘(C) information security policies, proce-
dures, and practices;
‘‘(3) conduct research, as needed, to determine
the nature and extent of information security
vulnerabilities and techniques for providing cost-ef-
fective information security;
‘‘(4) develop and periodically revise performance
indicators and measures for agency information se-
curity policies and practices;
‘‘(5) evaluate private sector information secu-
rity policies and practices and commercially available
information technologies to assess potential applica-
tion by agencies to strengthen information security;
‘‘(6) assist the private sector, upon request, in
using and applying the results of activities under
this section;
‘‘(7) evaluate security policies and practices de-
veloped for national security systems to assess po-
tential application by agencies to strengthen infor-
mation security;
‘‘(8) periodically assess the effectiveness of
standards and guidelines developed under this sec-
tion and undertake revisions as appropriate;
‘‘(9) solicit and consider the recommendations
of the Information Security and Privacy Advisory