,,ib ,union ,calendar ,no4 #bf #aacth ,,congress #ast ,session ,h4 ,r4 #aafc ,report ,no4 #aac-dj ,,in ,,the ,,house ,,of ,,representatives ,march #ad1 #bjac ,mr4 ,issa 7for himself1 ,mr4 ,cummings1 ,mr4 ,mica1 and ,mr4 ,connolly7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform ,april #af1 #bjac ,additional sponsors3 ,mr4 ,chaffetz and ,mr4 ,tierney ,april #af1 #bjac ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed ,omit the part struck through and insert the part printed in italic ,a ,,bill ,to amend chapter #ce of title #dd1 ,united ,states ,code1 to revise requirements relating to ,federal information security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,information ,security ,amendments ,act of #bjac4 #b4 ,coordination of ,federal information policy ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking subchapters ,,ii and ,,iii and inserting the following3 ,,ii ,information ,security #ceea4 ,purposes ,the purposes of this subchapter are to-- 7#a7 provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support ,federal operations and assets2 7#b7 recognize the highly networked nature of the current ,federal computing environment and provide effective ,governmentwide management and oversight of the related information security risks1 including coordination of information security efforts throughout the civilian1 national security1 and law enforcement communities assets2 7#c7 provide for development and maintenance of minimum controls required to protect ,federal information and information systems2 7#d7 provide a mechanism for improved oversight of ,federal agency information security programs and systems through a focus on automated and continuous monitoring of agency information systems and regular threat assessments2 7#e7 acknowledge that commercially developed information security products offer advanced1 dynamic1 robust1 and effective information security solutions1 reflecting market solutions for the protection of critical information systems important to the national defense and economic security of the ,nation that are designed1 built1 and operated by the private sector2 and 7#f7 recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products4 #ceeb4 ,definitions 7a7 ,section #cejb definitions ,except as provided under subsection 7b71 the definitions under section #cejb shall apply to this subchapter4 7b7 ,additional definitions ,in this subchapter3 7#a7 ,adequate security ,the term adequate security means security commensurate with the risk and magnitude of the harm resulting from the unauthorized access to or loss1 misuse1 destruction1 or modification of information4 7#b7 ,automated and continuous monitoring ,the term automated and continuous monitoring means monitoring1 with minimal human involvement1 through an uninterrupted1 ongoing real time1 or near real-time process used to determine if the complete set of planned1 required1 and deployed security controls within an information system continue to be effective over time with rapidly changing information technology and threat development4 7#c7 ,incident ,the term incident means an occurrence that actually or potentially jeopardizes the confidentiality1 integrity1 or availability of an information system1 or the information the system processes1 stores1 or transmits or that constitutes a violation or imminent threat of violation of security policies1 security procedures1 or acceptable use policies4 7#d7 ,information security ,the term information security means protecting information and information systems from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction in order to provide-- 7,a7 integrity1 which means guarding against improper information modification or destruction1 and includes ensuring information nonrepudiation and authenticity2 7,b7 confidentiality1 which means preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 and 7,c7 availability1 which means ensuring timely and reliable access to and use of information4 7#e7 ,information system ,the term information system means a discrete set of information resources organized for the collection1 processing1 maintenance1 use1 sharing1 dissemination1 or disposition of information and includes-- 7,a7 computers and computer networks2 7,b7 ancillary equipment2 7,c7 software1 firmware1 and related procedures2 7,d7 services1 including support services2 and 7,e7 related resources4 7#f7 ,information technology ,the term information technology has the meaning given that term in section #aaaja of title #dj4 7#g7 ,national security system 7,a7 ,definition ,the term national security system means any information system 7including any telecommunications system7 used or operated by an agency or by a contractor of an agency1 or other organization on behalf of an agency-- 7i7 the function1 operation1 or use of which-- 7,i7 involves intelligence activities2 7,,ii7 involves cryptologic activities related to national security2 7,,iii7 involves command and control of military forces2 7,,iv7 involves equipment that is an integral part of a weapon or weapons system2 or 7,v7 subject to subparagraph 7,b71 is critical to the direct fulfillment of military or intelligence missions2 or 7ii7 is protected at all times by procedures established for information that have been specifically authorized under criteria established by an ,executive order or an ,act of ,congress to be kept classified in the interest of national defense or foreign policy4 7,b7 ,exception ,subparagraph 7,a77i77,v7 does not include a system that is to be used for routine administrative and business applications 7including payroll1 finance1 logistics1 and personnel management applications74 7#h7 ,threat assessment ,the term threat assessment means the formal description and evaluation of threat to an information system4 #ceec4 ,authority and functions of the ,director 7a7 ,in general ,the ,director shall oversee agency information security policies and practices1 including-- 7#a7 developing and overseeing the implementation of policies1 principles1 standards1 and guidelines on information security1 including through ensuring timely agency adoption of and compliance with standards promulgated under section #aacca of title #dj2 7#b7 requiring agencies1 consistent with the standards promulgated under such section #aacca and the requirements of this subchapter1 to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7,a7 information collected or maintained by or on behalf of an agency2 or 7,b7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7#c7 coordinating the development of standards and guidelines under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 with agencies and offices operating or exercising control of national security systems 7including the ,national ,security ,agency7 to assure1 to the maximum extent feasible1 that such standards and guidelines are complementary with standards and guidelines developed for national security systems2 7#d7 overseeing agency compliance with the requirements of this subchapter1 including through any authorized action under section #aacjc of title #dj1 to enforce accountability for compliance with such requirements2 7#e7 reviewing at least annually1 and approving or disapproving1 agency information security programs required under section #ceed7;b72 7#f7 coordinating information security policies and procedures with related information resources management policies and procedures2 7#g7 overseeing the operation of the ,federal information security incident center required under section #ceee2 and 7#h7 reporting to ,congress no later than ,march #a of each year on agency compliance with the requirements of this subchapter1 including-- 7,a7 an assessment of the development1 promulgation1 and adoption of1 and compliance with1 standards developed under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 and promulgated under section #aacca of title #dj2 7,b7 significant deficiencies in agency information security practices2 7,c7 planned remedial action to address such deficiencies2 and 7,d7 a summary of1 and the views of the ,director on1 the report prepared by the ,national ,institute of ,standards and ,technology under section #bj7;d77#aj7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7b7 ,national security systems ,except for the authorities described in paragraphs 7#d7 and 7#h7 of subsection 7a71 the authorities of the ,director under this section shall not apply to national security systems4 7c7 ,department of defense and central intelligence agency systems 7#a7 ,the authorities of the ,director described in paragraphs 7#a7 and 7#b7 of subsection 7a7 shall be delegated to the ,secretary of ,defense in the case of systems described in paragraph 7#b7 and to the ,director of ,central ,intelligence in the case of systems described in paragraph 7#c74 7#b7 ,the systems described in this paragraph are systems that are operated by the ,department of ,defense1 a contractor of the ,department of ,defense1 or another entity on behalf of the ,department of ,defense that processes any information the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of which would have a debilitating impact on the mission of the ,department of ,defense4 7#c7 ,the systems described in this paragraph are systems that are operated by the ,central ,intelligence ,agency1 a contractor of the ,central ,intelligence ,agency1 or another entity on behalf of the ,central ,intelligence ,agency that processes any information the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of which would have a debilitating impact on the mission of the ,central ,intelligence ,agency4 #ceed4 ,agency responsibilities 7a7 ,in general ,the head of each agency shall-- 7#a7 be responsible for-- 7,a7 providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7i7 information collected or maintained by or on behalf of the agency2 and 7ii7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7,b7 complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines1 including-- 7i7 information security standards and guidelines promulgated under section #aacca of title #dj and section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c72 7ii7 information security standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 and 7iii7 ensuring the standards implemented for information systems and national security systems of the agency are complementary and uniform1 to the extent practicable2 7,c7 ensuring that information security management processes are integrated with agency strategic and operational planning and budget processes1 including policies1 procedures1 and practices described in subsection 7c77#b72 7,d7 as appropriate1 maintaining secure facilities that have the capability of accessing1 sending1 receiving1 and storing classified information2 7,e7 maintaining a sufficient number of personnel with security clearances1 at the appropriate levels1 to access1 send1 receive and analyze classified information to carry out the responsibilities of this subchapter2 and 7,f7 ensuring that information security performance indicators and measures are included in the annual performance evaluations of all managers1 senior managers1 senior executive service personnel1 and political appointees2 7#b7 ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under their control1 including through-- 7,a7 assessing the risk and magnitude of the harm that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of such information or information system2 7,b7 determining the levels of information security appropriate to protect such information and information systems in accordance with policies1 principles1 standards1 and guidelines promulgated under section #aacca of title #dj and section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 for information security classifications and related requirements2 7,c7 implementing policies and procedures to cost effectively reduce risks to an acceptable level2 7,d7 with a frequency sufficient to support risk-based security decisions1 testing and evaluating information security controls and techniques to ensure that such controls and techniques are effectively implemented and operated2 and 7,e7 with a frequency sufficient to support risk-based security decisions1 conducting threat assessments by monitoring information systems1 identifying potential system vulnerabilities1 and reporting security incidents in accordance with paragraph 7#c77;,a77v72 7#c7 delegate to the ,chief ,information ,officer or equivalent 7or a senior agency official who reports to the ,chief ,information ,officer or equivalent71 who is designated as the ,chief ,information ,security ,officer1 the authority and primary responsibility to develop1 implement1 and oversee an agencywide information security program to ensure and enforce compliance with the requirements imposed on the agency under this subchapter1 including-- 7,a7 overseeing the establishment and maintenance of a security operations capability that through automated and continuous monitoring1 when possible1 can-- 7i7 detect1 report1 respond to1 contain1 and mitigate incidents that impair information security and agency information systems1 in accordance with policy provided by the ,director2 7ii7 commensurate with the risk to information security1 monitor and mitigate the vulnerabilities of every information system within the agency2 7iii7 continually evaluate risks posed to information collected or maintained by or on behalf of the agency and information systems and hold senior agency officials accountable for ensuring information security2 7iv7 collaborate with the ,director and appropriate public and private sector security operations centers to detect1 report1 respond to1 contain1 and mitigate incidents that impact the security of information and information systems that extend beyond the control of the agency2 and 7v7 report any incident described under clauses 7i7 and 7ii7 to the ,federal information security incident center1 to other appropriate security operations centers1 and to the ,inspector ,general of the agency1 to the extent practicable1 within #bd hours after discovery of the incident1 but no later than #dh hours after such discovery2 7,b7 developing1 maintaining1 and overseeing an agencywide information security program as required by subsection 7b72 7,c7 developing1 maintaining1 and overseeing information security policies1 procedures1 and control techniques to address all applicable requirements1 including those issued under section #aacca of title #dj2 7,d7 training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities2 and 7,e7 assisting senior agency officials concerning their responsibilities under paragraph 7#b72 7#d7 ensure that the agency has a sufficient number of trained and cleared personnel to assist the agency in complying with the requirements of this subchapter1 other applicable laws1 and related policies1 procedures1 standards1 and guidelines2 7#e7 ensure that the ,chief ,information ,security ,officer1 in consultation with other senior agency officials1 reports periodically1 but not less than annually1 to the agency head on-- 7,a7 the effectiveness of the agency information security program2 7,b7 information derived from automated and continuous monitoring1 when possible1 and threat assessments2 and 7,c7 the progress of remedial actions2 7#f7 ensure that the ,chief ,information ,security ,officer possesses the necessary qualifications1 including education1 training1 experience1 and the security clearance required to administer the functions described under this subchapter2 and has information security duties as the primary duty of that official2 and 7#g7 ensure that components of that agency establish and maintain an automated reporting mechanism that allows the ,chief ,information ,security ,officer with responsibility for the entire agency1 and all components thereof1 to implement1 monitor1 and hold senior agency officers accountable for the implementation of appropriate security policies1 procedures1 and controls of agency components4 7b7 ,agency program ,each agency shall develop1 document1 and implement an agencywide information security program1 approved by the ,director and consistent with components across and within agencies1 to provide information security for the information and information systems that support the operations and assets of the agency1 including those provided or managed by another agency1 contractor1 or other source1 that includes-- 7#a7 automated and continuous monitoring1 when possible1 of the risk and magnitude of the harm that could result from the disruption or unauthorized access1 use1 disclosure1 modification1 or destruction of information and information systems that support the operations and assets of the agency2 7#b7 consistent with guidance developed under section #aacca of title #dj1 vulnerability assessments and penetration tests commensurate with the risk posed to agency information systems2 7#c7 policies and procedures that-- 7,a7 cost effectively reduce information security risks to an acceptable level2 7,b7 ensure compliance with-- 7i7 the requirements of this subchapter2 7ii7 policies and procedures as may be prescribed by the ,director1 and information security standards promulgated pursuant to section #aacca of title #dj2 7iii7 minimally acceptable system configuration requirements1 as determined by the ,director2 and 7iv7 any other applicable requirements1 including-- 7,i7 standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 and 7,,ii7 the ,national ,institute of ,standards and ,technology standards and guidance2 7,c7 develop1 maintain1 and oversee information security policies1 procedures1 and control techniques to address all applicable requirements1 including those promulgated pursuant section #aacca of title #dj2 and 7,d7 ensure the oversight and training of personnel with significant responsibilities for information security with respect to such responsibilities2 7#d7 with a frequency sufficient to support risk-based security decisions1 automated and continuous monitoring1 when possible1 for testing and evaluation of the effectiveness and compliance of information security policies1 procedures1 and practices1 including-- 7,a7 controls of every information system identified in the inventory required under section #ceje7;c72 and 7,b7 controls relied on for an evaluation under this section2 7#e7 a process for planning1 implementing1 evaluating1 and documenting remedial action to address any deficiencies in the information security policies1 procedures1 and practices of the agency2 7#f7 with a frequency sufficient to support risk-based security decisions1 automated and continuous monitoring1 when possible1 for detecting1 reporting1 and responding to security incidents1 consistent with standards and guidelines issued by the ,national ,institute of ,standards and ,technology1 including-- 7,a7 mitigating risks associated with such incidents before substantial damage is done2 7,b7 notifying and consulting with the ,federal information security incident center and other appropriate security operations response centers2 and 7,c7 notifying and consulting with1 as appropriate-- 7i7 law enforcement agencies and relevant ,offices of ,inspectors ,general2 and 7ii7 any other agency1 office1 or entity1 in accordance with law or as directed by the ,president2 and 7#g7 plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency4 7c7 ,agency reporting ,each agency shall-- 7#a7 submit an annual report on the adequacy and effectiveness of information security policies1 procedures1 and practices1 and compliance with the requirements of this subchapter1 including compliance with each requirement of subsection 7b7 to-- 7,a7 the ,director2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,c7 the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives2 7,d7 other appropriate authorization and appropriations committees of ,congress2 and 7,e7 the ,comptroller ,general2 7#b7 address the adequacy and effectiveness of information security policies1 procedures1 and practices in plans and reports relating to-- 7,a7 annual agency budgets2 7,b7 information resources management of this subchapter2 7,c7 information technology management under this chapter2 7,d7 program performance under sections #aaje and #aaae through #aaai of title #ca1 and sections #bhja and #bhje of title #ci2 7,e7 financial management under chapter #i of title #ca1 and the ,chief ,financial ,officers ,act of #aiij 7#ca ,u4,s4,c4 #eja note2 ,public ,law #aja-egf72 7,f7 financial management systems under the ,federal ,financial ,management ,improvement ,act of #aiif 7#ca ,u4,s4,c4 #ceab note72 and 7,g7 internal accounting and administrative controls under section #ceab of title #ca2 and 7#c7 report any significant deficiency in a policy1 procedure1 or practice identified under paragraph 7#a7 or 7#b7-- 7,a7 as a material weakness in reporting under section #ceab of title #ca2 and 7,b7 if relating to financial management systems1 as an instance of a lack of substantial compliance under the ,federal ,financial ,management ,improvement ,act of #aiif 7#ca ,u4,s4,c4 #ceab note74 #ceee4 ,federal information security incident center 7a7 ,in general ,the ,director shall ensure the operation of a central ,federal information security incident center to-- 7#a7 provide timely technical assistance to operators of agency information systems regarding security incidents1 including guidance on detecting and handling information security incidents2 7#b7 compile and analyze information about incidents that threaten information security2 7#c7 inform operators of agency information systems about current and potential information security threats1 and vulnerabilities2 and 7#d7 consult with the ,national ,institute of ,standards and ,technology1 agencies or offices operating or exercising control of national security systems 7including the ,national ,security ,agency71 and such other agencies or offices in accordance with law and as directed by the ,president regarding information security incidents and related matters4 7b7 ,national security systems ,each agency operating or exercising control of a national security system shall share information about information security incidents1 threats1 and vulnerabilities with the ,federal information security incident center to the extent consistent with standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president4 7c7 ,review and approval ,the ,director shall review and approve the policies1 procedures1 and guidance established in this subchapter to ensure that the incident center has the capability to effectively and efficiently detect1 correlate1 respond to1 contain1 mitigate1 and remediate incidents that impair the adequate security of the information systems of more than one agency4 ,to the extent practicable1 the capability shall be continuous and technically automated4 #ceef4 ,national security systems ,the head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency-- 7#a7 provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of the information contained in such system2 7#b7 implements information security policies and practices as required by standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president2 and 7#c7 complies with the requirements of this subchapter4 4 #c4 ,technical and conforming amendments 7a7 ,table of sections in title #dd ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the matter relating to subchapters ,,ii and ,,iii and inserting the following3 ,,subchapter ,,ii--,,information ,,security ,sec4 #ceea4 ,purposes4 #ceeb4 ,definitions4 #ceec4 ,authority and functions of the ,director4 #ceed4 ,agency responsibilities4 #ceee4 ,federal information security incident center4 #ceef4 ,national security systems4 4 7b7 ,other references 7#a7 ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7;c77#a77;,a77 is amended by striking section #cecb7c7 and inserting section #ceeb7;b74 7#b7 ,section #bbbb7;j77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7#c7 ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended1 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7#d7 ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7#e7 ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7,a7 in subsections 7a77#b7 and 7e77#e7 subsection 7a77#b71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b72 and 7,b7 in subsection 7e7-- 7i7 in paragraph 7#b71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b74 7#f7 ,section #h7;d77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7;d77#a77 is amended by striking section #cecd7;b7 and inserting section #ceed7;b74 #d4 ,no additional funds authorized ,no additional funds are authorized to carry out the requirements of section #ceed of title #dd1 ,united ,states ,code1 as amended by section #b of this ,act4 ,such requirements shall be carried out using amounts otherwise authorized or appropriated4 #e4 ,effective date ,this ,act 7including the amendments made by this ,act7 shall take effect #cj days after the date of the enactment of this ,act4 ,april #af1 #bjac ,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed