,i #aacth ,,congress #ast ,session ,h4 ,r4 #cjcb ,,in ,,the ,,house ,,of ,,representatives ,august #b1 #bjac ,mr4 ,langevin 7for himself1 ,mr4 ,castro of ,texas1 ,mr4 ,ruppersberger1 ,ms4 ,loretta ,sanchez of ,california1 ,mr4 ,pocan1 ,mr4 ,andrews1 ,mr4 ,larsen of ,washington1 and ,mrs4 ,davis of ,california7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform1 and in addition to the ,committee on ,homeland ,security1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to amend chapter #ce of title #dd1 ,united ,states ,code1 to create the ,national ,office for ,cyberspace1 to revise requirements relating to ,federal information security1 and for other purposes4 #a4 ,short title 7a7 ,short title ,this ,act may be cited as the ,executive ,cyberspace ,coordination ,act of #bjac4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4 ,title ,i--,federal information security amendments ,sec4 #aja4 ,coordination of ,federal information policy4 ,sec4 #ajb4 ,information security acquisition requirements4 ,sec4 #ajc4 ,technical and conforming amendments4 ,sec4 #ajd4 ,effective date4 ,title ,,ii--,federal ,chief ,technology ,officer ,sec4 #bja4 ,office of the ,chief ,technology ,officer4 ,title ,,iii--,strengthening ,cybersecurity for ,critical ,infrastructure ,sec4 #cja4 ,definitions4 ,sec4 #cjb4 ,authority of ,secretary4 ,i ,federal information security amendments #aja4 ,coordination of ,federal information policy ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking subchapters ,,ii and ,,iii and inserting the following3 ,,ii ,information security #ceea4 ,purposes ,the purposes of this subchapter are to-- 7#a7 provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support ,federal operations and assets2 7#b7 recognize the highly networked nature of the current ,federal computing environment and provide effective ,governmentwide management and oversight of the related information security risks1 including coordination of information security efforts throughout the civilian1 national security1 and law enforcement communities2 7#c7 provide for development and maintenance of minimum controls required to protect ,federal information and information infrastructure2 7#d7 provide a mechanism for improved oversight of ,federal agency information security programs2 7#e7 acknowledge that commercially developed information security products offer advanced1 dynamic1 robust1 and effective information security solutions1 reflecting market solutions for the protection of critical information infrastructures important to the national defense and economic security of the ,nation that are designed1 built1 and operated by the private sector2 and 7#f7 recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products4 #ceeb4 ,definitions 7a7 ,section #cejb definitions ,except as provided under subsection 7b71 the definitions under section #cejb shall apply to this subchapter4 7b7 ,additional definitions ,in this subchapter3 7#a7 ,the term adequate security means security that complies with the regulations promulgated under section #ceed and the standards promulgated under section #ceeh4 7#b7 ,the term incident means an occurrence that actually or potentially jeopardizes the confidentiality1 integrity1 or availability of an information system1 information infrastructure1 or the information the system processes1 stores1 or transmits or that constitutes a violation or imminent threat of violation of security policies1 security procedures1 or acceptable use policies4 7#c7 ,the term information infrastructure means the underlying framework that information systems and assets rely on in processing1 storing1 or transmitting information electronically4 7#d7 ,the term information security means protecting information and information infrastructure from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction in order to provide-- 7,a7 integrity1 which means guarding against improper information modification or destruction1 and includes ensuring information nonrepudiation and authenticity2 7,b7 confidentiality1 which means preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 7,c7 availability1 which means ensuring timely and reliable access to and use of information2 and 7,d7 authentication1 which means using digital credentials to assure the identity of users and validate access of such users4 7#e7 ,the term information technology has the meaning given that term in section #aaaja of title #dj4 7#f7 7,a7 ,the term national security system means any information infrastructure 7including any telecommunications system7 used or operated by an agency or by a contractor of an agency1 or other organization on behalf of an agency-- 7i7 the function1 operation1 or use of which-- 7,i7 involves intelligence activities2 7,,ii7 involves cryptologic activities related to national security2 7,,iii7 involves command and control of military forces2 7,,iv7 involves equipment that is an integral part of a weapon or weapons system2 or 7,v7 subject to subparagraph 7,b71 is critical to the direct fulfillment of military or intelligence missions2 or 7ii7 is protected at all times by procedures established for information that have been specifically authorized under criteria established by an ,executive order or an ,act of ,congress to be kept classified in the interest of national defense or foreign policy4 7,b7 ,subparagraph 7,a77i77,v7 does not include a system that is to be used for routine administrative and business applications 7including payroll1 finance1 logistics1 and personnel management applications74 #ceec4 ,national ,office for ,cyberspace 7a7 ,establishment ,there is established within the ,executive ,office of the ,president an office to be known as the ,national ,office for ,cyberspace4 7b7 ,director 7#a7 ,in general ,there shall be at the head of the ,national ,office for ,cyberspace a ,director1 who shall be appointed by the ,president by and with the advice and consent of the ,senate4 ,the ,director of the ,national ,office for ,cyberspace shall administer all functions designated to such ,director under this subchapter and collaborate to the extent practicable with the heads of appropriate agencies1 the private sector1 and international partners4 ,the ,office shall serve as the principal office for coordinating issues relating to cyberspace1 including achieving an assured1 reliable1 secure1 and survivable information infrastructure and related capabilities for the ,federal ,government1 while promoting national economic interests1 security1 and civil liberties4 7#b7 ,basic pay ,the ,director of the ,national ,office for ,cyberspace shall be paid at the rate of basic pay for level ,,iii of the ,executive ,schedule4 7c7 ,staff ,the ,director of the ,national ,office for ,cyberspace may appoint and fix the pay of additional personnel as the ,director considers appropriate4 7d7 ,experts and consultants ,the ,director of the ,national ,office for ,cyberspace may procure temporary and intermittent services under section #caji7;b7 of title #e4 #ceed4 ,federal ,cybersecurity ,practice ,board 7a7 ,establishment ,within the ,national ,office for ,cyberspace1 there shall be established a board to be known as the ,federal ,cybersecurity ,practice ,board 7in this section referred to as the ,board74 7b7 ,members ,the ,board shall be chaired by the ,director of the ,national ,office for ,cyberspace and consist of not more than #aj members1 with at least one representative from-- 7#a7 the ,office of ,management and ,budget2 7#b7 civilian agencies2 7#c7 the ,department of ,defense2 7#d7 the ,federal law enforcement community2 7#e7 the ,federal ,chief ,technology ,office2 and 7#f7 such additional military and civilian agencies as the ,director considers appropriate4 7c7 ,responsibilities 7#a7 ,development of policies and procedures ,subject to the authority1 direction1 and control of the ,director of the ,national ,office for ,cyberspace1 the ,board shall be responsible for developing and periodically updating information security policies and procedures relating to the matters described in paragraph 7#b74 ,in developing such policies and procedures1 the ,board shall require that all matters addressed in the policies and procedures are consistent1 to the maximum extent practicable and in accordance with applicable law1 among the civilian1 military1 intelligence1 and law enforcement communities4 7#b7 ,specific matters covered in policies and procedures 7,a7 ,minimum security controls ,the ,board shall be responsible for developing and periodically updating information security policies and procedures relating to minimum security controls for information technology1 in order to-- 7i7 provide ,governmentwide protection of ,government-networked computers against common attacks2 and 7ii7 provide agencywide protection against threats1 vulnerabilities1 and other risks to the information infrastructure within individual agencies4 7,b7 ,measures of effectiveness ,the ,board shall be responsible for developing and periodically updating information security policies and procedures relating to measurements needed to assess the effectiveness of the minimum security controls referred to in subparagraph 7,a74 ,such measurements shall include a risk scoring system to evaluate risk to information security both ,governmentwide and within contractors of the ,federal ,government4 7,c7 ,products and services ,the ,board shall be responsible for developing and periodically updating information security policies1 procedures1 and minimum security standards relating to criteria for products and services to be used in agency information systems and information infrastructure that will meet the minimum security controls referred to in subparagraph 7,a74 ,in carrying out this subparagraph1 the ,board shall act in consultation with the ,office of ,management and ,budget and the ,general ,services ,administration4 7,d7 ,remedies ,the ,board shall be responsible for developing and periodically updating information security policies and procedures relating to methods for providing remedies for security deficiencies identified in agency information infrastructure4 7#c7 ,additional considerations ,the ,board shall also consider-- 7,a7 opportunities to engage with the international community to set policies1 principles1 training1 standards1 or guidelines for information security2 7,b7 opportunities to work with agencies and industry partners to increase information sharing and policy coordination efforts in order to reduce vulnerabilities in the national information infrastructure2 and 7,c7 options necessary to encourage and maintain accountability of any agency1 or senior agency official1 for efforts to secure the information infrastructure of such agency4 7#d7 ,relationship to other standards ,the policies and procedures developed under paragraph 7#a7 are supplemental to the standards promulgated by the ,director of the ,national ,office for ,cyberspace under section #ceeh4 7#e7 ,recommendations for regulations ,the ,board shall be responsible for making recommendations to the ,director of the ,national ,office for ,cyberspace on regulations to carry out the policies and procedures developed by the ,board under paragraph 7#a74 7d7 ,regulations ,the ,director of the ,national ,office for ,cyberspace1 in consultation with the ,director of the ,office of ,management and the ,administrator of ,general ,services1 shall promulgate and periodically update regulations to carry out the policies and procedures developed by the ,board under subsection 7c74 7e7 ,annual ,report ,the ,director of the ,national ,office for ,cyberspace shall provide to ,congress a report containing a summary of agency progress in implementing the regulations promulgated under this section as part of the annual report to ,congress required under section #ceee7;a77#h74 7f7 ,no disclosure by ,board required ,the ,board is not required to disclose under section #eeb of title #e information submitted by agencies to the ,board regarding threats1 vulnerabilities1 and risks4 #ceee4 ,authority and functions of the ,director of the ,national ,office for ,cyberspace 7a7 ,in ,general ,the ,director of the ,national ,office for ,cyberspace shall oversee agency information security policies and practices1 including-- 7#a7 developing and overseeing the implementation of policies1 principles1 standards1 and guidelines on information security1 including through ensuring timely agency adoption of and compliance with standards promulgated under section #ceeh2 7#b7 requiring agencies1 consistent with the standards promulgated under section #ceeh and other requirements of this subchapter1 to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7,a7 information collected or maintained by or on behalf of an agency2 or 7,b7 information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7#c7 coordinating the development of standards and guidelines under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 with agencies and offices operating or exercising control of national security systems 7including the ,national ,security ,agency7 to assure1 to the maximum extent feasible1 that such standards and guidelines are complementary with standards and guidelines developed for national security systems2 7#d7 overseeing agency compliance with the requirements of this subchapter1 including through any authorized action under section #aacjc of title #dj1 to enforce accountability for compliance with such requirements2 7#e7 reviewing at least annually1 and approving or disapproving1 agency information security programs required under section #ceef7;b72 7#f7 coordinating information security policies and procedures of the ,federal ,government with related information resources management policies and procedures on the security and resiliency of cyberspace2 7#g7 overseeing the operation of the ,federal information security incident center required under section #ceei2 7#h7 reporting to ,congress no later than ,march #a of each year on agency compliance with the requirements of this subchapter1 including-- 7,a7 a summary of the findings of audits required by section #ceeg2 7,b7 an assessment of the development1 promulgation1 and adoption of1 and compliance with1 standards developed under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 and promulgated under section #ceeh2 7,c7 significant deficiencies in agency information security practices2 7,d7 planned remedial action to address such deficiencies2 and 7,e7 a summary of1 and the views of the ,director of the ,national ,office for ,cyberspace on1 the report prepared by the ,national ,institute of ,standards and ,technology under section #bj7;d77#aj7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c72 7#i7 coordinating the defense of information infrastructure operated by agencies in the case of a large-scale attack on information infrastructure1 as determined by the ,director2 7#aj7 establishing a national strategy not later than #abj days after the date of the enactment of this section2 7#aa7 coordinating information security training for ,federal employees with the ,office of ,personnel ,management2 7#ab7 ensuring the adequacy of protections for privacy and civil liberties in carrying out the responsibilities of the ,director under this subchapter2 7#ac7 making recommendations that the ,director determines are necessary to ensure risk-based security of the ,federal information infrastructure and information infrastructure that is owned1 operated1 controlled1 or licensed for use by1 or on behalf of1 the ,department of ,defense1 a military department1 or another element of the intelligence community to-- 7,a7 the ,director of the ,office of ,management and ,budget2 7,b7 the head of an agency2 or 7,c7 to ,congress with regard to the reprogramming of funds2 7#ad7 ensuring1 in consultation with the ,administrator of the ,office of ,information and ,regulatory ,affairs1 that the efforts of agencies relating to the development of regulations1 rules1 requirements1 or other actions applicable to the national information infrastructure are complementary2 7#ae7 when directed by the ,president1 carrying out the responsibilities for national security and emergency preparedness communications described in section #gjf of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #fjf7 to ensure integration and coordination2 and 7#af7 as assigned by the ,president1 other duties relating to the security and resiliency of cyberspace4 7b7 ,recruitment program ,not later than #a year after appointment1 the ,director of the ,national ,office for ,cyberspace shall establish a national program to conduct competitions and challenges that instruct ,united ,states students in cybersecurity education and computer literacy4 7c7 ,budget oversight and reporting 7#a7 ,the head of each agency shall submit to the ,director of the ,national ,office for ,cyberspace a budget each year for the following fiscal year relating to the protection of information infrastructure for such agency1 by a date determined by the ,director that is before the submission of such budget by the head of the agency to the ,office of ,management and ,budget4 7#b7 ,the ,director shall review and offer a non-binding approval or disapproval of each agency's annual budget to each such agency before the submission of such budget by the head of the agency to the ,office of ,management and ,budget4 7#c7 ,if the ,director offers a non-binding disapproval of an agency's budget1 the ,director shall transmit recommendations to the head of such agency for strengthening its proposed budget with regard to the protection of such agency's information infrastructure4 7#d7 ,each budget submitted by the head of an agency pursuant to paragraph 7#a7 shall include-- 7,a7 a review of any threats to information technology for such agency2 7,b7 a plan to secure the information infrastructure for such agency based on threats to information technology1 using the ,national ,institute of ,standards and ,technology guidelines and recommendations2 7,c7 a review of compliance by such agency with any previous year plan described in subparagraph 7,b72 and 7,d7 a report on the development of the credentialing process to enable secure authentication of identity and authorization for access to the information infrastructure of such agency4 7#e7 ,the ,director of the ,national ,office for ,cyberspace may recommend to the ,president monetary penalties or incentives necessary to encourage and maintain accountability of any agency1 or senior agency official1 for efforts to secure the information infrastructure of such agency4 #ceef4 ,agency responsibilities 7a7 ,in general ,the head of each agency shall-- 7#a7 be responsible for-- 7,a7 providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7i7 information collected or maintained by or on behalf of the agency2 and 7ii7 information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7,b7 complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines1 including-- 7i7 the regulations promulgated under section #ceed and the information security standards promulgated under section #ceeh2 7ii7 information security standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 and 7iii7 ensuring the standards implemented for information infrastructure and national security systems under the agency head are complementary and uniform1 to the extent practicable2 and 7,c7 ensuring that information security management processes are integrated with agency strategic and operational planning processes2 7#b7 ensure that senior agency officials provide information security for the information and information infrastructure that support the operations and assets under their control1 including through-- 7,a7 assessing the risk and magnitude of the harm that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of such information or information infrastructure2 7,b7 determining the levels of information security appropriate to protect such information and information infrastructure in accordance with regulations promulgated under section #ceed and standards promulgated under section #ceeh1 for information security classifications and related requirements2 7,c7 implementing policies and procedures to cost effectively reduce risks to an acceptable level2 and 7,d7 continuously testing and evaluating information security controls and techniques to ensure that they are effectively implemented2 7#c7 delegate to an agency official1 designated as the ,chief ,information ,security ,officer1 under the authority of the agency ,chief ,information ,officer the responsibility to oversee agency information security and the authority to ensure and enforce compliance with the requirements imposed on the agency under this subchapter1 including-- 7,a7 overseeing the establishment and maintenance of a security operations capability on an automated and continuous basis that can-- 7i7 assess the state of compliance of all networks and systems with prescribed controls issued pursuant to section #ceeh and report immediately any variance therefrom and1 where appropriate and with the approval of the agency ,chief ,information ,officer1 shut down systems that are found to be non-compliant2 7ii7 detect1 report1 respond to1 contain1 and mitigate incidents that impair adequate security of the information and information infrastructure1 in accordance with policy provided by the ,director of the ,national ,office for ,cyberspace1 in consultation with the ,chief ,information ,officers ,council1 and guidance from the ,national ,institute of ,standards and ,technology2 7iii7 collaborate with the ,national ,office for ,cyberspace and appropriate public and private sector security operations centers to address incidents that impact the security of information and information infrastructure that extend beyond the control of the agency2 and 7iv7 not later than #bd hours after discovery of any incident described under subparagraph 7,a77ii71 unless otherwise directed by policy of the ,national ,office for ,cyberspace1 provide notice to the appropriate security operations center1 the ,national ,cyber ,investigative ,joint ,task ,force1 and the ,inspector ,general of the agency2 7,b7 developing1 maintaining1 and overseeing an agency wide information security program as required by subsection 7b72 7,c7 developing1 maintaining1 and overseeing information security policies1 procedures1 and control techniques to address all applicable requirements1 including those issued under sections #ceee and #ceeh2 7,d7 training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities2 and 7,e7 assisting senior agency officials concerning their responsibilities under paragraph 7#b72 7#d7 ensure that the agency has trained and cleared personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines2 7#e7 ensure that the ,chief ,information ,security ,officer1 in coordination with other senior agency officials1 reports biannually to the agency head on the effectiveness of the agency information security program1 including progress of remedial actions2 and 7#f7 ensure that the ,chief ,information ,security ,officer possesses necessary qualifications1 including education1 professional certifications1 training1 experience1 and the security clearance required to administer the functions described under this subchapter2 and has information security duties as the primary duty of that official4 7b7 ,agency program ,each agency shall develop1 document1 and implement an agencywide information security program1 approved by the ,director of the ,national ,office for ,cyberspace under section #ceee7;a77#e71 to provide information security for the information and information infrastructure that support the operations and assets of the agency1 including those provided or managed by another agency1 contractor1 or other source1 that includes-- 7#a7 continuous automated technical monitoring of information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency to assure conformance with regulations promulgated under section #ceed and standards promulgated under section #ceeh2 7#b7 testing of the effectiveness of security controls that are commensurate with risk 7as defined by the ,national ,institute of ,standards and ,technology and the ,national ,office for ,cyberspace7 for agency information infrastructure2 7#c7 policies and procedures that-- 7,a7 mitigate and remediate1 to the extent practicable1 information security vulnerabilities based on the risk posed to the agency2 7,b7 cost effectively reduce information security risks to an acceptable level2 7,c7 ensure that information security is addressed throughout the life cycle of each agency information system and information infrastructure2 7,d7 ensure compliance with-- 7i7 the requirements of this subchapter2 7ii7 policies and procedures as may be prescribed by the ,director of the ,national ,office for ,cyberspace1 and information security standards promulgated under section #ceeh2 7iii7 minimally acceptable system configuration requirements1 as determined by the ,director of the ,national ,office for ,cyberspace2 and 7iv7 any other applicable requirements1 including-- 7,i7 standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 7,,ii7 the policy of the ,director of the ,national ,office for ,cyberspace2 7,,iii7 the ,national ,institute of ,standards and ,technology guidance2 and 7,,iv7 the ,chief ,information ,officers ,council recommended approaches2 7,e7 develop1 maintain1 and oversee information security policies1 procedures1 and control techniques to address all applicable requirements1 including those issued under sections #ceee and #ceeh2 and 7,f7 ensure the oversight and training of personnel with significant responsibilities for information security with respect to such responsibilities2 7#d7 ensuring that the agency has trained and cleared personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines2 7#e7 to the extent practicable1 automated and continuous technical monitoring for testing1 and evaluation of the effectiveness and compliance of information security policies1 procedures1 and practices1 including-- 7,a7 management1 operational1 and technical controls of every information infrastructure identified in the inventory required under section #ceje7;b72 and 7,b7 management1 operational1 and technical controls relied on for an evaluation under section #ceef2 7#f7 a process for planning1 implementing1 evaluating1 and documenting remedial action to address any deficiencies in the information security policies1 procedures1 and practices of the agency2 7#g7 to the extent practicable1 continuous automated technical monitoring for detecting1 reporting1 and responding to security incidents1 consistent with standards and guidelines issued by the ,director of the ,national ,office for ,cyberspace1 including-- 7,a7 mitigating risks associated with such incidents before substantial damage is done2 7,b7 notifying and consulting with the appropriate security operations response center2 and 7,c7 notifying and consulting with1 as appropriate-- 7i7 law enforcement agencies and relevant ,offices of ,inspectors ,general2 7ii7 the ,national ,office for ,cyberspace2 and 7iii7 any other agency or office1 in accordance with law or as directed by the ,president2 and 7#h7 plans and procedures to ensure continuity of operations for information infrastructure that support the operations and assets of the agency4 7c7 ,agency reporting ,each agency shall-- 7#a7 submit an annual report on the adequacy and effectiveness of information security policies1 procedures1 and practices1 and compliance with the requirements of this subchapter1 including compliance with each requirement of subsection 7b7 to-- 7,a7 the ,national ,office for ,cyberspace2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,c7 the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives2 7,d7 other appropriate authorization and appropriations committees of ,congress2 and 7,e7 the ,comptroller ,general2 7#b7 address the adequacy and effectiveness of information security policies1 procedures1 and practices in plans and reports relating to-- 7,a7 annual agency budgets2 7,b7 information resources management of this subchapter2 7,c7 information technology management under this chapter2 7,d7 program performance under sections #aaje and #aaae through #aaai of title #ca1 and sections #bhja and #bhje of title #ci2 7,e7 financial management under chapter #i of title #ca1 and the ,chief ,financial ,officers ,act of #aiij 7#ca ,u4,s4,c4 #eja note2 ,public ,law #aja-egf7 7and the amendments made by that ,act72 7,f7 financial management systems under the ,federal ,financial ,management ,improvement ,act 7#ca ,u4,s4,c4 #ceab note72 and 7,g7 internal accounting and administrative controls under section #ceab of title #ca2 and 7#c7 report any significant deficiency in a policy1 procedure1 or practice identified under paragraph 7#a7 or 7#b7-- 7,a7 as a material weakness in reporting under section #ceab of title #ca2 and 7,b7 if relating to financial management systems1 as an instance of a lack of substantial compliance under the ,federal ,financial ,management ,improvement ,act 7#ca ,u4,s4,c4 #ceab note74 7d7 ,performance plan 7#a7 ,in addition to the requirements of subsection 7c71 each agency1 in consultation with the ,national ,office for ,cyberspace1 shall include as part of the performance plan required under section #aaae of title #ca a description of the resources1 including budget1 staffing1 and training1 that are necessary to implement the program required under subsection 7b74 7#b7 ,the description under paragraph 7#a7 shall be based on the risk assessments required under subsection 7a77#b74 7e7 ,public notice and comment ,each agency shall provide the public with timely notice and opportunities for comment on proposed information security policies and procedures to the extent that such policies and procedures affect communication with the public4 #ceeg4 ,annual independent audit 7a7 ,in general 7#a7 ,each year each agency shall have performed an independent audit of the information security program and practices of that agency to determine the effectiveness of such program and practices4 7#b7 ,each audit under this section shall include-- 7,a7 testing of the effectiveness of the information infrastructure of the agency for automated1 continuous monitoring of the state of compliance of its information infrastructure with regulations promulgated under section #ceed and standards promulgated under section #ceeh in a representative subset of-- 7i7 the information infrastructure used or operated by the agency2 and 7ii7 the information infrastructure used1 operated1 or supported on behalf of the agency by a contractor of the agency1 a subcontractor 7at any tier7 of such contractor1 or any other entity2 7,b7 an assessment 7made on the basis of the results of the testing7 of compliance with-- 7i7 the requirements of this subchapter2 and 7ii7 related information security policies1 procedures1 standards1 and guidelines2 7,c7 separate assessments1 as appropriate1 regarding information security relating to national security systems2 and 7,d7 a conclusion regarding whether the information security controls of the agency are effective1 including an identification of any significant deficiencies in such controls4 7#c7 ,each audit under this section shall be performed in accordance with applicable generally accepted ,government auditing standards4 7b7 ,independent auditor ,subject to subsection 7c7-- 7#a7 for each agency with an ,inspector ,general appointed under the ,inspector ,general ,act of #aigh or any other law1 the annual audit required by this section shall be performed by the ,inspector ,general or by an independent external auditor1 as determined by the ,inspector ,general of the agency2 and 7#b7 for each agency to which paragraph 7#a7 does not apply1 the head of the agency shall engage an independent external auditor to perform the audit4 7c7 ,national security systems ,for each agency operating or exercising control of a national security system1 that portion of the audit required by this section directly relating to a national security system shall be performed-- 7#a7 only by an entity designated head2 and 7#b7 in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws4 7d7 ,existing audits ,the audit required by this section may be based in whole or in part on another audit relating to programs or practices of the applicable agency4 7e7 ,agency reporting 7#a7 ,each year1 not later than such date established by the ,director of the ,national ,office for ,cyberspace1 the head of each agency shall submit to the ,director the results of the audit required under this section4 7#b7 ,to the extent an audit required under this section directly relates to a national security system1 the results of the audit submitted to the ,director of the ,national ,office for ,cyberspace shall contain only a summary and assessment of that portion of the audit directly relating to a national security system4 7f7 ,protection of information ,agencies and auditors shall take appropriate steps to ensure the protection of information which1 if disclosed1 may adversely affect information security4 ,such protections shall be commensurate with the risk and comply with all applicable laws and regulations4 7g7 ,national ,office for ,cyberspace reports to congress 7#a7 ,the ,director of the ,national ,office for ,cyberspace shall summarize the results of the audits conducted under this section in the annual report to ,congress required under section #ceee7;a77#h74 7#b7 ,the ,director's report to ,congress under this subsection shall summarize information regarding information security relating to national security systems in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws4 7#c7 ,audits and any other descriptions of information infrastructure under the authority and control of the ,director of ,central ,intelligence or of ,national ,foreign ,intelligence ,programs systems under the authority and control of the ,secretary of ,defense shall be made available to ,congress only through the appropriate oversight committees of ,congress1 in accordance with applicable laws4 7h7 ,comptroller general ,the ,comptroller ,general shall periodically evaluate and report to ,congress on-- 7#a7 the adequacy and effectiveness of agency information security policies and practices2 and 7#b7 implementation of the requirements of this subchapter4 7i7 ,contractor audits ,each year each contractor that operates1 uses1 or supports an information system or information infrastructure on behalf of an agency and each subcontractor of such contractor-- 7#a7 shall conduct an audit using an independent external auditor in accordance with subsection 7a71 including an assessment of compliance with the applicable requirements of this subchapter2 and 7#b7 shall submit the results of such audit to such agency not later than such date established by the ,agency4 #ceeh4 ,responsibilities for ,federal information systems standards 7a7 ,requirement ,to ,prescribe ,standards 7#a7 ,in general 7,a7 ,requirement ,except as provided under paragraph 7#b71 the ,secretary of ,commerce shall1 on the basis of proposed standards developed by the ,national ,institute of ,standards and ,technology pursuant to paragraphs 7#b7 and 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a77 and in consultation with the ,secretary of ,homeland ,security1 promulgate information security standards pertaining to ,federal information systems4 7,b7 ,required standards ,standards promulgated under subparagraph 7,a7 shall include-- 7i7 standards that provide minimum information security requirements as determined under section #bj7;b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;b772 and 7ii7 such standards that are otherwise necessary to improve the efficiency of operation or security of ,federal information systems4 7,c7 ,required standards binding ,information security standards described under subparagraph 7,b7 shall be compulsory and binding4 7#b7 ,standards and guidelines for national security systems ,standards and guidelines for national security systems1 as defined under section #ceeb7;b71 shall be developed1 promulgated1 enforced1 and overseen as otherwise authorized by law and as directed by the ,president4 7b7 ,application of ,more ,stringent ,standards ,the head of an agency may employ standards for the cost-effective information security for all operations and assets within or under the supervision of that agency that are more stringent than the standards promulgated by the ,secretary of ,commerce under this section1 if such standards-- 7#a7 contain1 at a minimum1 the provisions of those applicable standards made compulsory and binding by the ,secretary2 and 7#b7 are otherwise consistent with policies and guidelines issued under section #ceee4 7c7 ,requirements ,regarding ,decisions by the ,secretary 7#a7 ,deadline ,the decision regarding the promulgation of any standard by the ,secretary of ,commerce under subsection 7b7 shall occur not later than #f months after the submission of the proposed standard to the ,secretary by the ,national ,institute of ,standards and ,technology1 as provided under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7#b7 ,notice and comment ,a decision by the ,secretary of ,commerce to significantly modify1 or not promulgate1 a proposed standard submitted to the ,secretary by the ,national ,institute of ,standards and ,technology1 as provided under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c71 shall be made after the public is given an opportunity to comment on the ,secretary's proposed decision4 #ceei4 ,federal information security incident center 7a7 ,in ,general ,the ,director of the ,national ,office for ,cyberspace shall ensure the operation of a central ,federal information security incident center to-- 7#a7 provide timely technical assistance to operators of agency information systems and information infrastructure regarding security incidents1 including guidance on detecting and handling information security incidents2 7#b7 compile and analyze information about incidents that threaten information security2 7#c7 inform operators of agency information systems and information infrastructure about current and potential information security threats1 and vulnerabilities2 and 7#d7 consult with the ,national ,institute of ,standards and ,technology1 agencies or offices operating or exercising control of national security systems 7including the ,national ,security ,agency71 and such other agencies or offices in accordance with law and as directed by the ,president regarding information security incidents and related matters4 7b7 ,national ,security ,systems ,each agency operating or exercising control of a national security system shall share information about information security incidents1 threats1 and vulnerabilities with the ,federal information security incident center to the extent consistent with standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president4 7c7 ,review and approval ,in coordination with the ,administrator for ,electronic ,government and ,information ,technology1 the ,director of the ,national ,office for ,cyberspace shall review and approve the policies1 procedures1 and guidance established in this subchapter to ensure that the incident center has the capability to effectively and efficiently detect1 correlate1 respond to1 contain1 mitigate1 and remediate incidents that impair the adequate security of the information systems and information infrastructure of more than one agency4 ,to the extent practicable1 the capability shall be continuous and technically automated4 #cefj4 ,national security systems ,the head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency-- 7#a7 provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of the information contained in such system2 7#b7 implements information security policies and practices as required by standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president2 and 7#c7 complies with the requirements of this subchapter4 4 #ajb4 ,information security acquisition requirements ,chapter #aac of title #dj1 ,united ,states ,code1 is amended by adding at the end of subchapter ,,ii the following new section3 #aacai4 ,information security acquisition requirements4 7a7 ,prohibition ,notwithstanding any other provision of law1 beginning one year after the date of the enactment of the ,executive ,cyberspace ,coordination ,act of #bjac1 no agency may enter into a contract1 an order under a contract1 or an interagency agreement for-- 7#a7 the collection1 use1 management1 storage1 or dissemination of information on behalf of the agency2 7#b7 the use or operation of an information system or information infrastructure on behalf of the agency2 or 7#c7 information technology2 unless such contract1 order1 or agreement includes requirements to provide effective information security that supports the operations and assets under the control of the agency1 in compliance with the policies1 standards1 and guidance developed under subsection 7b71 and otherwise ensures compliance with this section4 7b7 ,coordination of secure acquisition policies 7#a7 ,in general ,the ,director of the ,office of ,management and ,budget1 in consultation with the ,director of the ,national ,institute of ,standards and ,technology1 the ,director of the ,national ,office for ,cyberspace1 and the ,administrator of ,general ,services1 shall oversee the development and implementation of policies1 standards1 and guidance1 including through revisions to the ,federal ,acquisition ,regulation and the ,department of ,defense supplement to the ,federal ,acquisition ,regulation1 to cost effectively enhance agency information security1 including-- 7,a7 minimum information security requirements for agency procurement of information technology products and services2 and 7,b7 approaches for evaluating and mitigating significant supply chain security risks associated with products or services to be acquired by agencies4 7#b7 ,report ,not later than two years after the date of the enactment of the ,executive ,cyberspace ,coordination ,act of #bjac1 the ,director of the ,office of ,management and ,budget shall submit to ,congress a report describing-- 7,a7 actions taken to improve the information security associated with the procurement of products and services by the ,federal ,government2 and 7,b7 plans for overseeing and coordinating efforts of agencies to use best practice approaches for cost-effectively purchasing more secure products and services4 7c7 ,vulnerability assessments of major systems 7#a7 ,requirement for initial vulnerability assessments ,the ,director of the ,office of ,management and ,budget shall require each agency to conduct an initial vulnerability assessment for any major system and its significant items of supply prior to the development of the system4 ,the initial vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based approach to-- 7,a7 identify vulnerabilities2 7,b7 define exploitation potential2 7,c7 examine the system's potential effectiveness2 7,d7 determine overall vulnerability2 and 7,e7 make recommendations for risk reduction4 7#b7 ,subsequent vulnerability assessments 7,a7 ,the ,director shall require a subsequent vulnerability assessment of each major system and its significant items of supply within a program if the ,director determines that circumstances warrant the issuance of an additional vulnerability assessment4 7,b7 ,upon the request of a congressional committee1 the ,director may require a subsequent vulnerability assessment of a particular major system and its significant items of supply within the program4 7,c7 ,any subsequent vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based approach and1 if applicable1 a testing-based approach1 to monitor the exploitation potential of such system and reexamine the factors described in subparagraphs 7,a7 through 7,e7 of paragraph 7#a74 7#c7 ,congressional oversight ,the ,director shall provide to the appropriate congressional committees a copy of each vulnerability assessment conducted under paragraph 7#a7 or 7#b7 not later than #aj days after the date of the completion of such assessment4 7d7 ,definitions ,in this section3 7#a7 ,item of supply ,the term item of supply-- 7,a7 means any individual part1 component1 subassembly1 assembly1 or subsystem integral to a major system1 and other property which may be replaced during the service life of the major system1 including a spare part or replenishment part2 and 7,b7 does not include packaging or labeling associated with shipment or identification of an item4 7#b7 ,vulnerability assessment ,the term vulnerability assessment means the process of identifying and quantifying vulnerabilities in a major system and its significant items of supply4 7#c7 ,major system ,the term major system has the meaning given that term in section #d of the ,office of ,federal ,procurement ,policy ,act 7#da ,u4,s4,c4 #djc74 4 #ajc4 ,technical and conforming amendments 7a7 ,table of sections in title #dd ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the matter relating to subchapters ,,ii and ,,iii and inserting the following3 ,subchapter ,,ii--,information security #ceea4 ,purposes4 #ceeb4 ,definitions4 #ceec4 ,national ,office for ,cyberspace4 #ceed4 ,federal ,cybersecurity ,practice ,board4 #ceee4 ,authority and functions of the ,director of the ,national ,office for ,cyberspace4 #ceef4 ,agency responsibilities4 #ceeg4 ,annual independent audit4 #ceeh4 ,responsibilities for ,federal information systems standards4 #ceei4 ,federal information security incident center4 #cefj4 ,national security systems4 4 7b7 ,table of sections in title #dj ,the table of sections for chapter #aac of title #dj1 ,united ,states ,code1 is amended by inserting after the item relating to section #aacah the following new item3 ,sec4 #aacai4 ,information security acquisition requirements4 4 7c7 ,other references 7#a7 ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7;c77#a77;,a77 is amended by striking section #cecb7c7 and inserting section #ceeb7;b74 7#b7 ,section #bbbb7;j77#f7 of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b77 and inserting section #ceeb7;b74 7#c7 ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended1 by striking section #cedb7;b77#b77 and inserting section #ceeb7;b74 7#d7 ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b77 and inserting section #ceeb7;b74 7#e7 ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7,a7 in subsections 7a77#b7 and 7e77#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b72 7,b7 in subsection 7e77#b71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7,c7 in subsections 7c77#c7 and 7d77#a71 by striking section #aacca of title #dj and inserting section #ceeh of title #dd4 7#f7 ,section #h7;d77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7;d77#a77 is amended by striking section #cecd7;b7 and inserting section #ceef7;b74 7d7 ,repeal 7#a7 ,subchapter ,,iii of chapter #aac of title #dj1 ,united ,states ,code1 is repealed4 7#b7 ,the table of sections for chapter #aac of such title is amended by striking the matter relating to subchapter ,,iii4 7e7 ,executive schedule pay rate ,section #ecad of title #e1 ,united ,states ,code1 is amended by adding at the end the following3 ,director of the ,national ,office for ,cyberspace4 4 7f7 ,membership on the ,national ,security ,council ,section #aja7;a7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #djb7;a77 is amended-- 7#a7 by redesignating paragraphs 7#g7 and 7#h7 as paragraphs 7#h7 and 7#i71 respectively2 and 7#b7 by inserting after paragraph 7#f7 the following3 7#g7 the ,director of the ,national ,office for ,cyberspace2 4 #ajd4 ,effective date 7a7 ,in general ,unless otherwise specified in this section1 this title 7including the amendments made by this title7 shall take effect #cj days after the date of enactment of this ,act4 7b7 ,national ,office for ,cyberspace ,section #ceec of title #dd1 ,united ,states ,code1 as added by section #aja of this title1 shall take effect #ahj days after the date of enactment of this ,act4 7c7 ,federal ,cybersecurity ,practice ,board ,section #ceed of title #dd1 ,united ,states ,code1 as added by section #aja of this title1 shall take effect one year after the date of enactment of this ,act4 ,,ii ,federal ,chief ,technology ,officer #bja4 ,office of the ,chief ,technology ,officer 7a7 ,establishment and staff 7#a7 ,establishment 7,a7 ,in general ,there is established in the ,executive ,office of the ,president an ,office of the ,federal ,chief ,technology ,officer 7in this section referred to as the ,office74 7,b7 ,head of the ,office 7i7 ,federal ,chief ,technology ,officer ,the ,president shall appoint a ,federal ,chief ,technology ,officer 7in this section referred to as the ,federal ,,cto7 who shall be the head of the ,office4 7ii7 ,compensation ,section #ecad of title #e1 ,united ,states ,code1 is amended by adding at the end the following3 ,federal ,chief ,technology ,officer4 4 7#b7 ,staff of the ,office ,the ,president may appoint additional staff members to the ,office4 7b7 ,duties of the office ,the functions of the ,federal ,,cto are the following3 7#a7 ,undertake fact-gathering1 analysis1 and assessment of the ,federal ,government's information technology infrastructures1 information technology strategy1 and use of information technology1 and provide advice on such matters to the ,president1 heads of ,federal departments and agencies1 and government chief information officers and chief technology officers4 7#b7 ,lead an interagency effort1 working with the chief technology and chief information officers of each of the ,federal departments and agencies1 to develop and implement a planning process to ensure that they use best-in-class technologies1 share best practices1 and improve the use of technology in support of ,federal ,government requirements4 7#c7 ,advise the ,president on information technology considerations with regard to ,federal budgets and with regard to general coordination of the research and development programs of the ,federal ,government for information technology-related matters4 7#d7 ,promote technological innovation in the ,federal ,government1 and encourage and oversee the adoption of robust cross-governmental architectures and standards-based information technologies1 in support of effective operational and management policies1 practices1 and services across ,federal departments and agencies and with the public and external entities4 7#e7 ,establish cooperative public-private sector partnership initiatives to achieve knowledge of technologies available in the marketplace that can be used for improving governmental operations and information technology research and development activities4 7#f7 ,gather timely and authoritative information concerning significant developments and trends in information technology1 and in national priorities1 both current and prospective1 and analyze and interpret the information for the purpose of determining whether the developments and trends are likely to affect achievement of the priority goals of the ,federal ,government4 7#g7 ,develop1 review1 revise1 and recommend criteria for determining information technology activities warranting ,federal support1 and recommend ,federal policies designed to advance the development and maintenance of effective and efficient information technology capabilities1 including human resources1 at all levels of government1 academia1 and industry1 and the effective application of the capabilities to national needs4 7#h7 ,any other functions and activities that the ,president may assign to the ,federal ,,cto4 7c7 ,policy ,planning2 ,analysis and ,advice ,the ,office shall serve as a source of analysis and advice for the ,president and heads of ,federal departments and agencies with respect to major policies1 plans1 and programs of the ,federal ,government in accordance with the functions described in subsection 7b74 7d7 ,coordination of the ,office with other entities 7#a7 ,federal ,,cto on ,domestic ,policy ,council ,the ,federal ,,cto shall be a member of the ,domestic ,policy ,council4 7#b7 ,federal ,,cto on ,cyber ,security ,practice ,board ,the ,federal ,,cto shall be a member of the ,federal ,cybersecurity ,practice ,board4 7#c7 ,obtain information from agencies ,the ,office may secure1 directly from any department or agency of the ,united ,states1 information necessary to enable the ,federal ,,cto to carry out this section4 ,on request of the ,federal ,,cto1 the head of the department or agency shall furnish the information to the ,office1 subject to any applicable limitations of ,federal law4 7#d7 ,staff of ,federal ,agencies ,on request of the ,federal ,,cto1 to assist the ,office in carrying out the duties of the ,office1 the head of any ,federal department or agency may detail personnel1 services1 or facilities of the department or agency to the ,office4 7e7 ,annual ,report 7#a7 ,publication and ,contents ,the ,federal ,,cto shall publish1 in the ,federal ,register and on a public ,internet website of the ,federal ,,cto1 an annual report that includes the following3 7,a7 ,information on programs to promote the development of technological innovations4 7,b7 ,recommendations for the adoption of policies to encourage the generation of technological innovations4 7,c7 ,information on the activities and accomplishments of the ,office in the year covered by the report4 7#b7 ,submission ,the ,federal ,,cto shall submit each report under paragraph 7#a7 to-- 7,a7 the ,president2 7,b7 the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives2 7,c7 the ,committee on ,science and ,technology of the ,house of ,representatives2 and 7,d7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate4 ,,iii ,strengthening ,cybersecurity for ,critical ,infrastructure #cja4 ,definitions ,in this title3 7#a7 ,critical information infrastructure ,the term critical information infrastructure means the electronic information and communications systems1 software1 and assets that control1 protect1 process1 transmit1 receive1 program1 or store information in any form1 including data1 voice1 and video1 relied upon by critical infrastructure1 industrial control systems such as supervisory control and data acquisition systems1 and programmable logic controllers4 ,this shall also include such systems of the ,federal ,government4 7#b7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 #cjb4 ,authority of ,secretary 7a7 ,in general ,the ,secretary shall have primary authority1 in consultation with the ,director of the ,national ,office for ,cyberspace and the ,federal ,cyberspace ,practice ,board1 in the executive branch of the ,federal ,government in creation1 verification1 and enforcement of measures with respect to the protection of critical information infrastructure1 including promulgating risk-informed information security practices and standards applicable to critical information infrastructures that are not owned by or under the direct control of the ,federal ,government4 ,the ,secretary should consult with appropriate private sector entities1 including private owners and operators of the affected infrastructure1 to carry out this section4 7b7 ,other ,federal agencies ,in establishing measures with respect to the protection of critical information infrastructure the ,secretary shall-- 7#a7 consult with the ,secretary of ,commerce1 the ,secretary of ,defense1 the ,national ,institute of ,standards and ,technology1 and other sector specific ,federal regulatory agencies in exercising the authority referred to in subsection 7a72 and 7#b7 coordinate1 though the ,executive ,office of the ,president1 with sector specific ,federal regulatory agencies1 including the ,federal ,energy ,regulatory ,commission1 in establishing enforcement mechanisms under the authority referred to in subsection 7a74 7c7 ,auditing authority ,the ,secretary may-- 7#a7 conduct such audits as are necessary to ensure that appropriate measures are taken to secure critical information infrastructure2 7#b7 issue such subpoenas as are necessary to determine compliance with ,federal regulatory requirements for securing critical information infrastructure2 and 7#c7 authorize sector specific ,federal regulatory agencies to undertake such audits4