#aac? ,,congress #a/ ,session ,h4 ,r4 #aafc ,,an ,,act ,to am5d *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 to revise requirem5ts relat+ to ,f$]al in=mation security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,in=mation ,security ,am5dm5ts ,act ( #bjac4 #b4 ,coord9ation ( ,f$]al in=mation policy ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ sub*apt]s ,,ii & ,,iii & ins]t+ ! foll[+3 ,,ii ,in=mation ,security #ceea4 ,purposes ,! purposes ( ?is sub*apt] are to-- 7#a7 provide a compreh5sive framework = ensur+ ! effectiv5ess ( in=mation security controls ov] in=mation res\rces t support ,f$]al op]ations & assets2 7#b7 recognize ! highly network$ nature ( ! curr5t ,f$]al comput+ environm5t & provide effective ,gov]nm5twide managem5t & ov]sight ( ! relat$ in=mation security risks1 includ+ coord9ation ( in=mation security ef=ts ?r\gh\t ! civilian1 national security1 & law en=cem5t communities assets2 7#c7 provide = developm5t & ma9t5ance ( m9imum controls requir$ to protect ,f$]al in=mation & in=mation sy/ems2 7#d7 provide a me*anism = improv$ ov]sight ( ,f$]al ag5cy in=mation security programs & sy/ems ?r\gh a focus on automat$ & cont9u\s monitor+ ( ag5cy in=mation sy/ems & regul> ?reat assessm5ts2 7#e7 ackn[l$ge t comm]cially develop$ in=mation security products (f] advanc$1 dynamic1 robu/1 & effective in=mation security solutions1 reflect+ m>ket solutions = ! protection ( critical in=mation sy/ems important to ! national def5se & economic security ( ! ,nation t are design$1 built1 & op]at$ by ! private sector2 & 7#f7 recognize t ! selection ( specific te*nical h>dw>e & s(tw>e in=mation security solutions %\ld be left to individual ag5cies f among comm]cially develop$ products4 #ceeb4 ,def9itions 7a7 ,section #cejb def9itions ,except z provid$ "u subsection 7b71 ! def9itions "u section #cejb %all apply to ?is sub*apt]4 7b7 ,additional def9itions ,9 ?is sub*apt]3 7#a7 ,adequate security ,! t]m adequate security means security comm5surate ) ! risk & magnitude ( ! h>m result+ f ! unau?oriz$ access to or loss1 misuse1 de/ruction1 or modification ( in=mation4 7#b7 ,automat$ & cont9u\s monitor+ ,! t]m automat$ & cont9u\s monitor+ means monitor+1 ) m9imal human involvem5t1 ?r\gh an un9t]rupt$1 ongo+ real "t1 or ne> real-"t process us$ to det]m9e if ! complete set ( plann$1 requir$1 & deploy$ security controls )9 an in=mation sy/em cont9ue to be effective ov] "t ) rapidly *ang+ in=mation te*nology & ?reat developm5t4 7#c7 ,incid5t ,! t]m incid5t means an occurr5ce t actually or pot5tially jeop>dizes ! confid5tiality1 integrity1 or availability ( an in=mation sy/em1 or ! in=mation ! sy/em processes1 /ores1 or transmits or t con/itutes a violation or imm95t ?reat ( violation ( security policies1 security proc$ures1 or acceptable use policies4 7#d7 ,in=mation security ,! t]m in=mation security means protect+ in=mation & in=mation sy/ems f unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction 9 ord] to provide-- 7,a7 integrity1 :i* means gu>d+ aga9/ improp] in=mation modification or de/ruction1 & includes ensur+ in=mation nonrepudiation & au!nticity2 7,b7 confid5tiality1 :i* means pres]v+ au?oriz$ re/rictions on access & disclosure1 includ+ means = protect+ p]sonal privacy & propriet>y in=mation2 & 7,c7 availability1 :i* means ensur+ timely & reliable access to & use ( in=mation4 7#e7 ,in=mation sy/em ,! t]m in=mation sy/em means a discrete set ( in=mation res\rces organiz$ = ! collection1 process+1 ma9t5ance1 use1 %>+1 dissem9ation1 or disposition ( in=mation & includes-- 7,a7 comput]s & comput] networks2 7,b7 ancill>y equipm5t2 7,c7 s(tw>e1 firmw>e1 & relat$ proc$ures2 7,d7 s]vices1 includ+ support s]vices2 & 7,e7 relat$ res\rces4 7#f7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 t t]m 9 section #aaaja ( title #dj4 7#g7 ,national security sy/em 7,a7 ,def9ition ,! t]m national security sy/em means any in=mation sy/em 7includ+ any telecommunications sy/em7 us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy1 or o!r organization on behalf ( an ag5cy-- 7i7 ! function1 op]ation1 or use ( :i*-- 7,i7 involves intellig5ce activities2 7,,ii7 involves cryptologic activities relat$ to national security2 7,,iii7 involves comm& & control ( milit>y =ces2 7,,iv7 involves equipm5t t is an integral "p ( a weapon or weapons sy/em2 or 7,v7 subject to subp>agraph 7,b71 is critical to ! direct fulfillm5t ( milit>y or intellig5ce missions2 or 7ii7 is protect$ at all times by proc$ures e/abli%$ = in=mation t h be5 specifically au?oriz$ "u crit]ia e/abli%$ by an ,executive ord] or an ,act ( ,congress to be kept classifi$ 9 ! int]e/ ( national def5se or =eign policy4 7,b7 ,exception ,subp>agraph 7,a77i77,v7 does n include a sy/em t is to be us$ = r\t9e adm9i/rative & bus9ess applications 7includ+ payroll1 f9ance1 logi/ics1 & p]sonnel managem5t applications74 7#h7 ,?reat assessm5t ,! t]m ?reat assessm5t means ! =mal description & evaluation ( ?reat to an in=mation sy/em4 #ceec4 ,au?ority & functions ( ! ,director 7a7 ,9 g5]al ,! ,director %all ov]see ag5cy in=mation security policies & practices1 includ+-- 7#a7 develop+ & ov]see+ ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on in=mation security1 includ+ ?r\gh ensur+ timely ag5cy adoption ( & compliance ) /&>ds promulgat$ "u section #aacca ( title #dj2 7#b7 requir+ ag5cies1 consi/5t ) ! /&>ds promulgat$ "u su* section #aacca & ! requirem5ts ( ?is sub*apt]1 to id5tify & provide in=mation security protections comm5surate ) ! risk & magnitude ( ! h>m result+ f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction (-- 7,a7 in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy2 or 7,b7 in=mation sy/ems us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or o!r organization on behalf ( an ag5cy2 7#c7 coord9at+ ! developm5t ( /&>ds & guidel9es "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 ) ag5cies & (fices op]at+ or ex]cis+ control ( national security sy/ems 7includ+ ! ,national ,security ,ag5cy7 to assure1 to ! maximum ext5t feasible1 t su* /&>ds & guidel9es are complem5t>y ) /&>ds & guidel9es develop$ = national security sy/ems2 7#d7 ov]see+ ag5cy compliance ) ! requirem5ts ( ?is sub*apt]1 includ+ ?r\gh any au?oriz$ action "u section #aacjc ( title #dj1 to en=ce acc\ntability = compliance ) su* requirem5ts2 7#e7 review+ at lea/ annually1 & approv+ or disapprov+1 ag5cy in=mation security programs requir$ "u section #ceed7;b72 7#f7 coord9at+ in=mation security policies & proc$ures ) relat$ in=mation res\rces managem5t policies & proc$ures2 7#g7 ov]see+ ! op]ation ( ! ,f$]al in=mation security incid5t c5t] requir$ "u section #ceee2 & 7#h7 report+ to ,congress no lat] ?an ,m>* #a ( ea* ye> on ag5cy compliance ) ! requirem5ts ( ?is sub*apt]1 includ+-- 7,a7 an assessm5t ( ! developm5t1 promulgation1 & adoption (1 & compliance )1 /&>ds develop$ "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 & promulgat$ "u section #aacca ( title #dj2 7,b7 significant defici5cies 9 ag5cy in=mation security practices2 7,c7 plann$ rem$ial action to address su* defici5cies2 & 7,d7 a summ>y (1 & ! views ( ! ,director on1 ! report prep>$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u section #bj7;d77#aj7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7b7 ,national security sy/ems ,except = ! au?orities describ$ 9 p>agraphs 7#d7 & 7#h7 ( subsection 7a71 ! au?orities ( ! ,director "u ?is section %all n apply to national security sy/ems4 7c7 ,dep>tm5t ( def5se & c5tral intellig5ce ag5cy sy/ems 7#a7 ,! au?orities ( ! ,director describ$ 9 p>agraphs 7#a7 & 7#b7 ( subsection 7a7 %all be delegat$ to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 p>agraph 7#b7 & to ! ,director ( ,c5tral ,intellig5ce 9 ! case ( sy/ems describ$ 9 p>agraph 7#c74 7#b7 ,! sy/ems describ$ 9 ?is p>agraph are sy/ems t are op]at$ by ! ,dep>tm5t ( ,def5se1 a contractor ( ! ,dep>tm5t ( ,def5se1 or ano!r entity on behalf ( ! ,dep>tm5t ( ,def5se t processes any in=mation ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( :i* w\ld h a debilitat+ impact on ! mission ( ! ,dep>tm5t ( ,def5se4 7#c7 ,! sy/ems describ$ 9 ?is p>agraph are sy/ems t are op]at$ by ! ,c5tral ,intellig5ce ,ag5cy1 a contractor ( ! ,c5tral ,intellig5ce ,ag5cy1 or ano!r entity on behalf ( ! ,c5tral ,intellig5ce ,ag5cy t processes any in=mation ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( :i* w\ld h a debilitat+ impact on ! mission ( ! ,c5tral ,intellig5ce ,ag5cy4 #ceed4 ,ag5cy responsibilities 7a7 ,9 g5]al ,! head ( ea* ag5cy %all-- 7#a7 be responsible =-- 7,a7 provid+ in=mation security protections comm5surate ) ! risk & magnitude ( ! h>m result+ f unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction (-- 7i7 in=mation collect$ or ma9ta9$ by or on behalf ( ! ag5cy2 & 7ii7 in=mation sy/ems us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or o!r organization on behalf ( an ag5cy2 7,b7 comply+ ) ! requirem5ts ( ?is sub*apt] & relat$ policies1 proc$ures1 /&>ds1 & guidel9es1 includ+-- 7i7 in=mation security /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj & section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c72 7ii7 in=mation security /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t2 & 7iii7 ensur+ ! /&>ds implem5t$ = in=mation sy/ems & national security sy/ems ( ! ag5cy are complem5t>y & uni=m1 to ! ext5t practicable2 7,c7 ensur+ t in=mation security managem5t processes are integrat$ ) ag5cy /rategic & op]ational plann+ & budget processes1 includ+ policies1 proc$ures1 & practices describ$ 9 subsection 7c77#b72 7,d7 z appropriate1 ma9ta9+ secure facilities t h ! capability ( access+1 s5d+1 receiv+1 & /or+ classifi$ in=mation2 7,e7 ma9ta9+ a suffici5t numb] ( p]sonnel ) security cle>ances1 at ! appropriate levels1 to access1 s5d1 receive & analyze classifi$ in=mation to c>ry out ! responsibilities ( ?is sub*apt]2 & 7,f7 ensur+ t in=mation security p]=mance indicators & measures are includ$ 9 ! annual p]=mance evaluations ( all manag]s1 s5ior manag]s1 s5ior executive s]vice p]sonnel1 & political appo9tees2 7#b7 ensure t s5ior ag5cy (ficials provide in=mation security = ! in=mation & in=mation sy/ems t support ! op]ations & assets "u _! control1 includ+ ?r\gh-- 7,a7 assess+ ! risk & magnitude ( ! h>m t c\ld result f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( su* in=mation or in=mation sy/em2 7,b7 det]m9+ ! levels ( in=mation security appropriate to protect su* in=mation & in=mation sy/ems 9 accordance ) policies1 pr9ciples1 /&>ds1 & guidel9es promulgat$ "u section #aacca ( title #dj & section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 = in=mation security classifications & relat$ requirem5ts2 7,c7 implem5t+ policies & proc$ures to co/ effectively r$uce risks to an acceptable level2 7,d7 ) a frequ5cy suffici5t to support risk-bas$ security decisions1 te/+ & evaluat+ in=mation security controls & te*niques to ensure t su* controls & te*niques are effectively implem5t$ & op]at$2 & 7,e7 ) a frequ5cy suffici5t to support risk-bas$ security decisions1 conduct+ ?reat assessm5ts by monitor+ in=mation sy/ems1 id5tify+ pot5tial sy/em vuln]abilities1 & report+ security incid5ts 9 accordance ) p>agraph 7#c77;,a77v72 7#c7 delegate to ! ,*ief ,in=mation ,(fic] or equival5t 7or a s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t71 :o is designat$ z ! ,*ief ,in=mation ,security ,(fic]1 ! au?ority & prim>y responsibility to develop1 implem5t1 & ov]see an ag5cywide in=mation security program to ensure & en=ce compliance ) ! requirem5ts impos$ on ! ag5cy "u ?is sub*apt]1 includ+-- 7,a7 ov]see+ ! e/abli%m5t & ma9t5ance ( a security op]ations capability t ?r\gh automat$ & cont9u\s monitor+1 :5 possible1 c-- 7i7 detect1 report1 respond to1 conta91 & mitigate incid5ts t impair in=mation security & ag5cy in=mation sy/ems1 9 accordance ) policy provid$ by ! ,director2 7ii7 comm5surate ) ! risk to in=mation security1 monitor & mitigate ! vuln]abilities ( e in=mation sy/em )9 ! ag5cy2 7iii7 cont9ually evaluate risks pos$ to in=mation collect$ or ma9ta9$ by or on behalf ( ! ag5cy & in=mation sy/ems & hold s5ior ag5cy (ficials acc\ntable = ensur+ in=mation security2 7iv7 collaborate ) ! ,director & appropriate public & private sector security op]ations c5t]s to detect1 report1 respond to1 conta91 & mitigate incid5ts t impact ! security ( in=mation & in=mation sy/ems t ext5d beyond ! control ( ! ag5cy2 & 7v7 report any incid5t describ$ "u clauses 7i7 & 7ii7 to ! ,f$]al in=mation security incid5t c5t]1 to o!r appropriate security op]ations c5t]s1 & to ! ,inspector ,g5]al ( ! ag5cy1 to ! ext5t practicable1 )9 #bd h\rs aft] discov]y ( ! incid5t1 b no lat] ?an #dh h\rs aft] su* discov]y2 7,b7 develop+1 ma9ta9+1 & ov]see+ an ag5cywide in=mation security program z requir$ by subsection 7b72 7,c7 develop+1 ma9ta9+1 & ov]see+ in=mation security policies1 proc$ures1 & control te*niques to address all applicable requirem5ts1 includ+ ^? issu$ "u section #aacca ( title #dj2 7,d7 tra9+ & ov]see+ p]sonnel ) significant responsibilities = in=mation security ) respect to su* responsibilities2 & 7,e7 assi/+ s5ior ag5cy (ficials conc]n+ _! responsibilities "u p>agraph 7#b72 7#d7 ensure t ! ag5cy has a suffici5t numb] ( tra9$ & cle>$ p]sonnel to assi/ ! ag5cy 9 comply+ ) ! requirem5ts ( ?is sub*apt]1 o!r applicable laws1 & relat$ policies1 proc$ures1 /&>ds1 & guidel9es2 7#e7 ensure t ! ,*ief ,in=mation ,security ,(fic]1 9 consultation ) o!r s5ior ag5cy (ficials1 reports p]iodically1 b n less ?an annually1 to ! ag5cy head on-- 7,a7 ! effectiv5ess ( ! ag5cy in=mation security program2 7,b7 in=mation d]iv$ f automat$ & cont9u\s monitor+1 :5 possible1 & ?reat assessm5ts2 & 7,c7 ! progress ( rem$ial actions2 7#f7 ensure t ! ,*ief ,in=mation ,security ,(fic] possesses ! necess>y qualifications1 includ+ education1 tra9+1 exp]i5ce1 & ! security cle>ance requir$ to adm9i/] ! functions describ$ "u ?is sub*apt]2 & has in=mation security duties z ! prim>y duty ( t (ficial2 & 7#g7 ensure t compon5ts ( t ag5cy e/abli% & ma9ta9 an automat$ report+ me*anism t all[s ! ,*ief ,in=mation ,security ,(fic] ) responsibility = ! entire ag5cy1 & all compon5ts !re(1 to implem5t1 monitor1 & hold s5ior ag5cy (fic]s acc\ntable = ! implem5tation ( appropriate security policies1 proc$ures1 & controls ( ag5cy compon5ts4 7b7 ,ag5cy program ,ea* ag5cy %all develop1 docum5t1 & implem5t an ag5cywide in=mation security program1 approv$ by ! ,director & consi/5t ) compon5ts across & )9 ag5cies1 to provide in=mation security = ! in=mation & in=mation sy/ems t support ! op]ations & assets ( ! ag5cy1 includ+ ^? provid$ or manag$ by ano!r ag5cy1 contractor1 or o!r s\rce1 t includes-- 7#a7 automat$ & cont9u\s monitor+1 :5 possible1 ( ! risk & magnitude ( ! h>m t c\ld result f ! disruption or unau?oriz$ access1 use1 disclosure1 modification1 or de/ruction ( in=mation & in=mation sy/ems t support ! op]ations & assets ( ! ag5cy2 7#b7 consi/5t ) guidance develop$ "u section #aacca ( title #dj1 vuln]ability assessm5ts & p5etration te/s comm5surate ) ! risk pos$ to ag5cy in=mation sy/ems2 7#c7 policies & proc$ures t-- 7,a7 co/ effectively r$uce in=mation security risks to an acceptable level2 7,b7 ensure compliance )-- 7i7 ! requirem5ts ( ?is sub*apt]2 7ii7 policies & proc$ures z may be prescrib$ by ! ,director1 & in=mation security /&>ds promulgat$ pursuant to section #aacca ( title #dj2 7iii7 m9imally acceptable sy/em configuration requirem5ts1 z det]m9$ by ! ,director2 & 7iv7 any o!r applicable requirem5ts1 includ+-- 7,i7 /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t2 & 7,,ii7 ! ,national ,in/itute ( ,/&>ds & ,te*nology /&>ds & guidance2 7,c7 develop1 ma9ta91 & ov]see in=mation security policies1 proc$ures1 & control te*niques to address all applicable requirem5ts1 includ+ ^? promulgat$ pursuant section #aacca ( title #dj2 & 7,d7 ensure ! ov]sight & tra9+ ( p]sonnel ) significant responsibilities = in=mation security ) respect to su* responsibilities2 7#d7 ) a frequ5cy suffici5t to support risk-bas$ security decisions1 automat$ & cont9u\s monitor+1 :5 possible1 = te/+ & evaluation ( ! effectiv5ess & compliance ( in=mation security policies1 proc$ures1 & practices1 includ+-- 7,a7 controls ( e in=mation sy/em id5tifi$ 9 ! inv5tory requir$ "u section #ceje7;c72 & 7,b7 controls reli$ on = an evaluation "u ?is section2 7#e7 a process = plann+1 implem5t+1 evaluat+1 & docum5t+ rem$ial action to address any defici5cies 9 ! in=mation security policies1 proc$ures1 & practices ( ! ag5cy2 7#f7 ) a frequ5cy suffici5t to support risk-bas$ security decisions1 automat$ & cont9u\s monitor+1 :5 possible1 = detect+1 report+1 & respond+ to security incid5ts1 consi/5t ) /&>ds & guidel9es issu$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 includ+-- 7,a7 mitigat+ risks associat$ ) su* incid5ts be=e sub/antial damage is done2 7,b7 notify+ & consult+ ) ! ,f$]al in=mation security incid5t c5t] & o!r appropriate security op]ations response c5t]s2 & 7,c7 notify+ & consult+ )1 z appropriate-- 7i7 law en=cem5t ag5cies & relevant ,(fices ( ,inspectors ,g5]al2 & 7ii7 any o!r ag5cy1 (fice1 or entity1 9 accordance ) law or z direct$ by ! ,presid5t2 & 7#g7 plans & proc$ures to ensure cont9uity ( op]ations = in=mation sy/ems t support ! op]ations & assets ( ! ag5cy4 7c7 ,ag5cy report+ ,ea* ag5cy %all-- 7#a7 submit an annual report on ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices1 & compliance ) ! requirem5ts ( ?is sub*apt]1 includ+ compliance ) ea* requirem5t ( subsection 7b7 to-- 7,a7 ! ,director2 7,b7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,c7 ! ,committee on ,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( ,repres5tatives2 7,d7 o!r appropriate au?orization & appropriations committees ( ,congress2 & 7,e7 ! ,comptroll] ,g5]al2 7#b7 address ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices 9 plans & reports relat+ to-- 7,a7 annual ag5cy budgets2 7,b7 in=mation res\rces managem5t ( ?is sub*apt]2 7,c7 in=mation te*nology managem5t "u ?is *apt]2 7,d7 program p]=mance "u sections #aaje & #aaae ?r\gh #aaai ( title #ca1 & sections #bhja & #bhje ( title #ci2 7,e7 f9ancial managem5t "u *apt] #i ( title #ca1 & ! ,*ief ,f9ancial ,(fic]s ,act ( #aiij 7#ca ,u4,s4,c4 #eja note2 ,public ,law #aja-egf72 7,f7 f9ancial managem5t sy/ems "u ! ,f$]al ,f9ancial ,managem5t ,improvem5t ,act ( #aiif 7#ca ,u4,s4,c4 #ceab note72 & 7,g7 int]nal acc\nt+ & adm9i/rative controls "u section #ceab ( title #ca2 & 7#c7 report any significant defici5cy 9 a policy1 proc$ure1 or practice id5tifi$ "u p>agraph 7#a7 or 7#b7-- 7,a7 z a mat]ial weakness 9 report+ "u section #ceab ( title #ca2 & 7,b7 if relat+ to f9ancial managem5t sy/ems1 z an in/ance ( a lack ( sub/antial compliance "u ! ,f$]al ,f9ancial ,managem5t ,improvem5t ,act ( #aiif 7#ca ,u4,s4,c4 #ceab note74 #ceee4 ,f$]al in=mation security incid5t c5t] 7a7 ,9 g5]al ,! ,director %all ensure ! op]ation ( a c5tral ,f$]al in=mation security incid5t c5t] to-- 7#a7 provide timely te*nical assi/ance to op]ators ( ag5cy in=mation sy/ems reg>d+ security incid5ts1 includ+ guidance on detect+ & h&l+ in=mation security incid5ts2 7#b7 compile & analyze in=mation ab\t incid5ts t ?reat5 in=mation security2 7#c7 in=m op]ators ( ag5cy in=mation sy/ems ab\t curr5t & pot5tial in=mation security ?reats1 & vuln]abilities2 & 7#d7 consult ) ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ag5cies or (fices op]at+ or ex]cis+ control ( national security sy/ems 7includ+ ! ,national ,security ,ag5cy71 & su* o!r ag5cies or (fices 9 accordance ) law & z direct$ by ! ,presid5t reg>d+ in=mation security incid5ts & relat$ matt]s4 7b7 ,national security sy/ems ,ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all %>e in=mation ab\t in=mation security incid5ts1 ?reats1 & vuln]abilities ) ! ,f$]al in=mation security incid5t c5t] to ! ext5t consi/5t ) /&>ds & guidel9es = national security sy/ems1 issu$ 9 accordance ) law & z direct$ by ! ,presid5t4 7c7 ,review & approval ,! ,director %all review & approve ! policies1 proc$ures1 & guidance e/abli%$ 9 ?is sub*apt] to ensure t ! incid5t c5t] has ! capability to effectively & effici5tly detect1 correlate1 respond to1 conta91 mitigate1 & rem$iate incid5ts t impair ! adequate security ( ! in=mation sy/ems ( m ?an "o ag5cy4 ,to ! ext5t practicable1 ! capability %all be cont9u\s & te*nically automat$4 #ceef4 ,national security sy/ems ,! head ( ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all be responsible = ensur+ t ! ag5cy-- 7#a7 provides in=mation security protections comm5surate ) ! risk & magnitude ( ! h>m result+ f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( ! in=mation conta9$ 9 su* sy/em2 7#b7 implem5ts in=mation security policies & practices z requir$ by /&>ds & guidel9es = national security sy/ems1 issu$ 9 accordance ) law & z direct$ by ! ,presid5t2 & 7#c7 complies ) ! requirem5ts ( ?is sub*apt]4 4 #c4 ,te*nical & con=m+ am5dm5ts 7a7 ,table ( sections 9 title #dd ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! matt] relat+ to sub*apt]s ,,ii & ,,iii & ins]t+ ! foll[+3 ,,sub*apt] ,,ii--,,in=mation ,,security ,sec4 #ceea4 ,purposes4 #ceeb4 ,def9itions4 #ceec4 ,au?ority & functions ( ! ,director4 #ceed4 ,ag5cy responsibilities4 #ceee4 ,f$]al in=mation security incid5t c5t]4 #ceef4 ,national security sy/ems4 4 7b7 ,o!r ref]5ces 7#a7 ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7;c77#a77;,a77 is am5d$ by /rik+ section #cecb7c7 & ins]t+ section #ceeb7;b74 7#b7 ,section #bbbb7;j77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7#c7 ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$1 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7#d7 ,section #bcae ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7#e7 ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7,a7 9 subsections 7a77#b7 & 7e77#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b72 & 7,b7 9 subsection 7e7-- 7i7 9 p>agraph 7#b71 by /rik+ section #cecb7a7 & ins]t+ section #ceeb7;b72 & 7ii7 9 p>agraph 7#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b74 7#f7 ,section #h7;d77#a7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjf7;d77#a77 is am5d$ by /rik+ section #cecd7;b7 & ins]t+ section #ceed7;b74 #d4 ,no additional funds au?oriz$ ,no additional funds are au?oriz$ to c>ry out ! requirem5ts ( section #ceed ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #b ( ?is ,act4 ,su* requirem5ts %all be c>ri$ out us+ am\nts o!rwise au?oriz$ or appropriat$4 #e4 ,effective date ,?is ,act 7includ+ ! am5dm5ts made by ?is ,act7 %all take effect #cj days aft] ! date ( ! enactm5t ( ?is ,act4 ,pass$ ! ,h\se ( ,repres5tatives ,april #af1 #bjac4;,cl]k4