,i  #aac? ,,congress  #a/ ,session  ,h4 
,r4 #cjcb  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,augu/ #b1 #bjac ,mr4 
,langev9 7= himself1 ,mr4 ,ca/ro (      
,texas1 ,mr4 ,rupp]sb]g]1 ,ms4 ,loretta 
,san*ez ( ,cali=nia1 ,mr4 ,pocan1 ,mr4  
,&rews1 ,mr4 ,l>s5 ( ,wa%+ton1 & ,mrs4  
,davis ( ,cali=nia7 introduc$ ! foll[+  
bill2 :i* 0 ref]r$ to ! ,committee on   
,ov]sight & ,gov]nm5t ,re=m1 & 9        
addition to ! ,committee on ,homel&     
,security1 = a p]iod to be subsequ5tly  
det]m9$ by ! ,speak]1 9 ea* case =      
consid]ation ( su* provisions z fall )9 
! jurisdiction ( ! committee conc]n$  ,a
 ,,bill  ,to am5d *apt] #ce ( title #dd1
 ,unit$ ,/ates ,code1 to create !       
,national ,(fice = ,cyb]space1 to revise
 requirem5ts relat+ to ,f$]al in=mation 
security1 & = o!r purposes4  #a4 ,%ort  
title  7a7 ,%ort title ,?is ,act may be 
cit$ z ! ,executive ,cyb]space          
,coord9ation ,act ( #bjac4  7b7 ,table (
 cont5ts ,! table ( cont5ts = ?is ,act  
is z foll[s3  ,sec4 #a4 ,%ort title4    

,title ,i--,f$]al in=mation security    
am5dm5ts ,sec4 #aja4 ,coord9ation (     
,f$]al in=mation policy4 ,sec4 #ajb4    
,in=mation security acquisition         
requirem5ts4 ,sec4 #ajc4 ,te*nical &    
con=m+ am5dm5ts4 ,sec4 #ajd4 ,effective 
date4 ,title ,,ii--,f$]al ,*ief         
,te*nology ,(fic] ,sec4 #bja4 ,(fice ( !
 ,*ief ,te*nology ,(fic]4 ,title        
,,iii--,/r5g!n+ ,cyb]security =         
,critical ,infra/ructure ,sec4 #cja4    
,def9itions4 ,sec4 #cjb4 ,au?ority (    
,secret>y4  ,i ,f$]al in=mation security
 am5dm5ts  #aja4 ,coord9ation ( ,f$]al  
in=mation policy ,*apt] #ce ( title #dd1
 ,unit$ ,/ates ,code1 is am5d$ by /rik+ 
sub*apt]s ,,ii & ,,iii & ins]t+ !       
foll[+3  ,,ii ,in=mation security       
#ceea4 ,purposes ,! purposes ( ?is      
sub*apt] are to--  7#a7 provide a       
compreh5sive framework = ensur+ !       
effectiv5ess ( in=mation security       
controls ov] in=mation res\rces t       
support ,f$]al op]ations & assets2  7#b7
 recognize ! highly network$ nature ( ! 

curr5t ,f$]al comput+ environm5t &      
provide effective ,gov]nm5twide         
managem5t & ov]sight ( ! relat$         
in=mation security risks1 includ+       
coord9ation ( in=mation security ef=ts  
?r\gh\t ! civilian1 national security1 &
 law en=cem5t communities2  7#c7 provide
 = developm5t & ma9t5ance ( m9imum      
controls requir$ to protect ,f$]al      
in=mation & in=mation infra/ructure2    
7#d7 provide a me*anism = improv$       
ov]sight ( ,f$]al ag5cy in=mation       
security programs2  7#e7 ackn[l$ge t    
comm]cially develop$ in=mation security 
products (f] advanc$1 dynamic1 robu/1 & 
effective in=mation security solutions1 
reflect+ m>ket solutions = ! protection 
( critical in=mation infra/ructures     
important to ! national def5se &        
economic security ( ! ,nation t are     
design$1 built1 & op]at$ by ! private   
sector2 &  7#f7 recognize t ! selection 
( specific te*nical h>dw>e & s(tw>e     
in=mation security solutions %\ld be    
left to individual ag5cies f among      

comm]cially develop$ products4  #ceeb4  
,def9itions  7a7 ,section #cejb         
def9itions ,except z provid$ "u         
subsection 7b71 ! def9itions "u section 
#cejb %all apply to ?is sub*apt]4  7b7  
,additional def9itions ,9 ?is sub*apt]3 
7#a7 ,! t]m adequate security means     
security t complies ) ! regulations     
promulgat$ "u section #ceed & ! /&>ds   
promulgat$ "u section #ceeh4  7#b7 ,!   
t]m incid5t means an occurr5ce t        
actually or pot5tially jeop>dizes !     
confid5tiality1 integrity1 or           
availability ( an in=mation sy/em1      
in=mation infra/ructure1 or ! in=mation 
! sy/em processes1 /ores1 or transmits  
or t con/itutes a violation or imm95t   
?reat ( violation ( security policies1  
security proc$ures1 or acceptable use   
policies4  7#c7 ,! t]m in=mation        
infra/ructure means ! und]ly+ framework 
t in=mation sy/ems & assets rely on 9   
process+1 /or+1 or transmitt+ in=mation 
electronically4  7#d7 ,! t]m in=mation  
security means protect+ in=mation &     

in=mation infra/ructure f unau?oriz$    
access1 use1 disclosure1 disruption1    
modification1 or de/ruction 9 ord] to   
provide--  7,a7 integrity1 :i* means    
gu>d+ aga9/ improp] in=mation           
modification or de/ruction1 & includes  
ensur+ in=mation nonrepudiation &       
au!nticity2  7,b7 confid5tiality1 :i*   
means pres]v+ au?oriz$ re/rictions on   
access & disclosure1 includ+ means =    
protect+ p]sonal privacy & propriet>y   
in=mation2  7,c7 availability1 :i* means
 ensur+ timely & reliable access to &   
use ( in=mation2 &  7,d7 au!ntication1  
:i* means us+ digital cr$5tials to      
assure ! id5tity ( us]s & validate      
access ( su* us]s4  7#e7 ,! t]m         
in=mation te*nology has ! mean+ giv5 t  
t]m 9 section #aaaja ( title #dj4  7#f7 
7,a7 ,! t]m national security sy/em     
means any in=mation infra/ructure       
7includ+ any telecommunications sy/em7  
us$ or op]at$ by an ag5cy or by a       
contractor ( an ag5cy1 or o!r           
organization on behalf ( an ag5cy--  7i7

 ! function1 op]ation1 or use ( :i*--   
7,i7 involves intellig5ce activities2   
7,,ii7 involves cryptologic activities  
relat$ to national security2  7,,iii7   
involves comm& & control ( milit>y =ces2
  7,,iv7 involves equipm5t t is an      
integral "p ( a weapon or weapons sy/em2
 or  7,v7 subject to subp>agraph 7,b71  
is critical to ! direct fulfillm5t (    
milit>y or intellig5ce missions2 or     
7ii7 is protect$ at all times by        
proc$ures e/abli%$ = in=mation t h be5  
specifically au?oriz$ "u crit]ia        
e/abli%$ by an ,executive ord] or an    
,act ( ,congress to be kept classifi$ 9 
! int]e/ ( national def5se or =eign     
policy4  7,b7 ,subp>agraph 7,a77i77,v7  
does n include a sy/em t is to be us$ = 
r\t9e adm9i/rative & bus9ess            
applications 7includ+ payroll1 f9ance1  
logi/ics1 & p]sonnel managem5t          
applications74  #ceec4 ,national ,(fice 
= ,cyb]space  7a7 ,e/abli%m5t ,!re is   
e/abli%$ )9 ! ,executive ,(fice ( !     
,presid5t an (fice to be kn[n z !       

,national ,(fice = ,cyb]space4  7b7     
,director  7#a7 ,9 g5]al ,!re %all be at
 ! head ( ! ,national ,(fice =          
,cyb]space a ,director1 :o %all be      
appo9t$ by ! ,presid5t by & ) ! advice &
 cons5t ( ! ,s5ate4 ,! ,director ( !    
,national ,(fice = ,cyb]space %all      
adm9i/] all functions designat$ to su*  
,director "u ?is sub*apt] & collaborate 
to ! ext5t practicable ) ! heads (      
appropriate ag5cies1 ! private sector1 &
 int]national p>tn]s4 ,! ,(fice %all    
s]ve z ! pr9cipal (fice = coord9at+     
issues relat+ to cyb]space1 includ+     
a*iev+ an assur$1 reliable1 secure1 &   
survivable in=mation infra/ructure &    
relat$ capabilities = ! ,f$]al          
,gov]nm5t1 :ile promot+ national        
economic int]e/s1 security1 & civil     
lib]ties4  7#b7 ,basic pay ,! ,director 
( ! ,national ,(fice = ,cyb]space %all  
be paid at ! rate ( basic pay = level   
,,iii ( ! ,executive ,s*$ule4  7c7 ,/aff
 ,! ,director ( ! ,national ,(fice =    
,cyb]space may appo9t & fix ! pay (     

additional p]sonnel z ! ,director       
consid]s appropriate4  7d7 ,exp]ts &    
consultants ,! ,director ( ! ,national  
,(fice = ,cyb]space may procure tempor>y
 & int]mitt5t s]vices "u section        
#caji7;b7 ( title #e4  #ceed4 ,f$]al    
,cyb]security ,practice ,bo>d  7a7      
,e/abli%m5t ,)9 ! ,national ,(fice =    
,cyb]space1 !re %all be e/abli%$ a bo>d 
to be kn[n z ! ,f$]al ,cyb]security     
,practice ,bo>d 79 ?is section ref]r$ to
 z ! ,bo>d74  7b7 ,memb]s ,! ,bo>d %all 
be *air$ by ! ,director ( ! ,national   
,(fice = ,cyb]space & consi/ ( n m ?an  
#aj memb]s1 ) at lea/ "o repres5tative  
f--  7#a7 ! ,(fice ( ,managem5t &       
,budget2  7#b7 civilian ag5cies2  7#c7 !
 ,dep>tm5t ( ,def5se2  7#d7 ! ,f$]al law
 en=cem5t community2  7#e7 ! ,f$]al     
,*ief ,te*nology ,(fice2 &  7#f7 su*    
additional milit>y & civilian ag5cies z 
! ,director consid]s appropriate4  7c7  
,responsibilities  7#a7 ,developm5t (   
policies & proc$ures ,subject to !      
au?ority1 direction1 & control ( !      

,director ( ! ,national ,(fice =        
,cyb]space1 ! ,bo>d %all be responsible 
= develop+ & p]iodically updat+         
in=mation security policies & proc$ures 
relat+ to ! matt]s describ$ 9 p>agraph  
7#b74 ,9 develop+ su* policies &        
proc$ures1 ! ,bo>d %all require t all   
matt]s address$ 9 ! policies & proc$ures
 are consi/5t1 to ! maximum ext5t       
practicable & 9 accordance ) applicable 
law1 among ! civilian1 milit>y1         
intellig5ce1 & law en=cem5t communities4
  7#b7 ,specific matt]s cov]$ 9 policies
 & proc$ures  7,a7 ,m9imum security     
controls ,! ,bo>d %all be responsible = 
develop+ & p]iodically updat+ in=mation 
security policies & proc$ures relat+ to 
m9imum security controls = in=mation    
te*nology1 9 ord] to--  7i7 provide     
,gov]nm5twide protection (              
,gov]nm5t-network$ comput]s aga9/ common
 attacks2 &  7ii7 provide ag5cywide     
protection aga9/ ?reats1 vuln]abilities1
 & o!r risks to ! in=mation             
infra/ructure )9 individual ag5cies4    

7,b7 ,measures ( effectiv5ess ,! ,bo>d  
%all be responsible = develop+ &        
p]iodically updat+ in=mation security   
policies & proc$ures relat+ to          
measurem5ts ne$$ to assess !            
effectiv5ess ( ! m9imum security        
controls ref]r$ to 9 subp>agraph 7,a74  
,su* measurem5ts %all include a risk    
scor+ sy/em to evaluate risk to         
in=mation security bo? ,gov]nm5twide &  
)9 contractors ( ! ,f$]al ,gov]nm5t4    
7,c7 ,products & s]vices ,! ,bo>d %all  
be responsible = develop+ & p]iodically 
updat+ in=mation security policies1     
proc$ures1 & m9imum security /&>ds      
relat+ to crit]ia = products & s]vices  
to be us$ 9 ag5cy in=mation sy/ems &    
in=mation infra/ructure t w meet !      
m9imum security controls ref]r$ to 9    
subp>agraph 7,a74 ,9 c>ry+ out ?is      
subp>agraph1 ! ,bo>d %all act 9         
consultation ) ! ,(fice ( ,managem5t &  
,budget & ! ,g5]al ,s]vices             
,adm9i/ration4  7,d7 ,rem$ies ,! ,bo>d  
%all be responsible = develop+ &        

p]iodically updat+ in=mation security   
policies & proc$ures relat+ to me?ods = 
provid+ rem$ies = security defici5cies  
id5tifi$ 9 ag5cy in=mation              
infra/ructure4  7#c7 ,additional        
consid]ations ,! ,bo>d %all also        
consid]--  7,a7 opportunities to engage 
) ! int]national community to set       
policies1 pr9ciples1 tra9+1 /&>ds1 or   
guidel9es = in=mation security2  7,b7   
opportunities to "w ) ag5cies & indu/ry 
p>tn]s to increase in=mation %>+ &      
policy coord9ation ef=ts 9 ord] to r$uce
 vuln]abilities 9 ! national in=mation  
infra/ructure2 &  7,c7 options necess>y 
to enc\rage & ma9ta9 acc\ntability ( any
 ag5cy1 or s5ior ag5cy (ficial1 = ef=ts 
to secure ! in=mation infra/ructure (   
su* ag5cy4  7#d7 ,relation%ip to o!r    
/&>ds ,! policies & proc$ures develop$  
"u p>agraph 7#a7 are supplem5tal to !   
/&>ds promulgat$ by ! ,director ( !     
,national ,(fice = ,cyb]space "u section
 #ceeh4  7#e7 ,recomm5dations =         
regulations ,! ,bo>d %all be responsible

 = mak+ recomm5dations to ! ,director ( 
! ,national ,(fice = ,cyb]space on      
regulations to c>ry out ! policies &    
proc$ures develop$ by ! ,bo>d "u        
p>agraph 7#a74  7d7 ,regulations ,!     
,director ( ! ,national ,(fice =        
,cyb]space1 9 consultation ) ! ,director
 ( ! ,(fice ( ,managem5t & !            
,adm9i/rator ( ,g5]al ,s]vices1 %all    
promulgate & p]iodically update         
regulations to c>ry out ! policies &    
proc$ures develop$ by ! ,bo>d "u        
subsection 7c74  7e7 ,annual ,report ,! 
,director ( ! ,national ,(fice =        
,cyb]space %all provide to ,congress a  
report conta9+ a summ>y ( ag5cy progress
 9 implem5t+ ! regulations promulgat$ "u
 ?is section z "p ( ! annual report to  
,congress requir$ "u section            
#ceee7;a77#h74  7f7 ,no disclosure by   
,bo>d requir$ ,! ,bo>d is n requir$ to  
disclose "u section #eeb ( title #e     
in=mation submitt$ by ag5cies to ! ,bo>d
 reg>d+ ?reats1 vuln]abilities1 & risks4
  #ceee4 ,au?ority & functions ( !      

,director ( ! ,national ,(fice =        
,cyb]space  7a7 ,9 ,g5]al ,! ,director (
 ! ,national ,(fice = ,cyb]space %all   
ov]see ag5cy in=mation security policies
 & practices1 includ+--  7#a7 develop+ &
 ov]see+ ! implem5tation ( policies1    
pr9ciples1 /&>ds1 & guidel9es on        
in=mation security1 includ+ ?r\gh ensur+
 timely ag5cy adoption ( & compliance ) 
/&>ds promulgat$ "u section #ceeh2  7#b7
 requir+ ag5cies1 consi/5t ) ! /&>ds    
promulgat$ "u section #ceeh & o!r       
requirem5ts ( ?is sub*apt]1 to id5tify &
 provide in=mation security protections 
comm5surate ) ! risk & magnitude ( ! h>m
 result+ f ! unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction (--  7,a7 in=mation collect$
 or ma9ta9$ by or on behalf ( an ag5cy2 
or  7,b7 in=mation infra/ructure us$ or 
op]at$ by an ag5cy or by a contractor ( 
an ag5cy or o!r organization on behalf (
 an ag5cy2  7#c7 coord9at+ ! developm5t 
( /&>ds & guidel9es "u section #bj ( !  
,national ,in/itute ( ,/&>ds &          

,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7 ) ag5cies & (fices op]at+ or 
ex]cis+ control ( national security     
sy/ems 7includ+ ! ,national ,security   
,ag5cy7 to assure1 to ! maximum ext5t   
feasible1 t su* /&>ds & guidel9es are   
complem5t>y ) /&>ds & guidel9es develop$
 = national security sy/ems2  7#d7      
ov]see+ ag5cy compliance ) ! requirem5ts
 ( ?is sub*apt]1 includ+ ?r\gh any      
au?oriz$ action "u section #aacjc (     
title #dj1 to en=ce acc\ntability =     
compliance ) su* requirem5ts2  7#e7     
review+ at lea/ annually1 & approv+ or  
disapprov+1 ag5cy in=mation security    
programs requir$ "u section #ceef7;b72  
7#f7 coord9at+ in=mation security       
policies & proc$ures ( ! ,f$]al         
,gov]nm5t ) relat$ in=mation res\rces   
managem5t policies & proc$ures on !     
security & resili5cy ( cyb]space2  7#g7 
ov]see+ ! op]ation ( ! ,f$]al in=mation 
security incid5t c5t] requir$ "u section
 #ceei2  7#h7 report+ to ,congress no   
lat] ?an ,m>* #a ( ea* ye> on ag5cy     

compliance ) ! requirem5ts ( ?is        
sub*apt]1 includ+--  7,a7 a summ>y ( !  
f9d+s ( audits requir$ by section #ceeg2
  7,b7 an assessm5t ( ! developm5t1     
promulgation1 & adoption (1 & compliance
 )1 /&>ds develop$ "u section #bj ( !   
,national ,in/itute ( ,/&>ds &          
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7 & promulgat$ "u section      
#ceeh2  7,c7 significant defici5cies 9  
ag5cy in=mation security practices2     
7,d7 plann$ rem$ial action to address   
su* defici5cies2 &  7,e7 a summ>y (1 & !
 views ( ! ,director ( ! ,national      
,(fice = ,cyb]space on1 ! report prep>$ 
by ! ,national ,in/itute ( ,/&>ds &     
,te*nology "u section #bj7;d77#aj7 ( !  
,national ,in/itute ( ,/&>ds &          
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c72  7#i7 coord9at+ ! def5se (  
in=mation infra/ructure op]at$ by       
ag5cies 9 ! case ( a l>ge-scale attack  
on in=mation infra/ructure1 z det]m9$ by
 ! ,director2  7#aj7 e/abli%+ a national
 /rategy n lat] ?an #abj days aft] !    

date ( ! enactm5t ( ?is section2  7#aa7 
coord9at+ in=mation security tra9+ =    
,f$]al employees ) ! ,(fice ( ,p]sonnel 
,managem5t2  7#ab7 ensur+ ! adequacy (  
protections = privacy & civil lib]ties 9
 c>ry+ out ! responsibilities ( !       
,director "u ?is sub*apt]2  7#ac7 mak+  
recomm5dations t ! ,director det]m9es   
are necess>y to ensure risk-bas$        
security ( ! ,f$]al in=mation           
infra/ructure & in=mation infra/ructure 
t is own$1 op]at$1 controll$1 or lic5s$ 
= use by1 or on behalf (1 ! ,dep>tm5t ( 
,def5se1 a milit>y dep>tm5t1 or ano!r   
elem5t ( ! intellig5ce community to--   
7,a7 ! ,director ( ! ,(fice ( ,managem5t
 & ,budget2  7,b7 ! head ( an ag5cy2 or 
7,c7 to ,congress ) reg>d to !          
reprogramm+ ( funds2  7#ad7 ensur+1 9   
consultation ) ! ,adm9i/rator ( ! ,(fice
 ( ,in=mation & ,regulatory ,affairs1 t 
! ef=ts ( ag5cies relat+ to ! developm5t
 ( regulations1 rules1 requirem5ts1 or  
o!r actions applicable to ! national    
in=mation infra/ructure are complem5t>y2

  7#ae7 :5 direct$ by ! ,presid5t1 c>ry+
 out ! responsibilities = national      
security & em]g5cy prep>$ness           
communications describ$ 9 section #gjf (
 ! ,communications ,act ( #aicd 7#dg    
,u4,s4,c4 #fjf7 to ensure integration & 
coord9ation2 &  7#af7 z assign$ by !    
,presid5t1 o!r duties relat+ to !       
security & resili5cy ( cyb]space4  7b7  
,recruitm5t program ,n lat] ?an #a ye>  
aft] appo9tm5t1 ! ,director ( !         
,national ,(fice = ,cyb]space %all      
e/abli% a national program to conduct   
competitions & *all5ges t in/ruct ,unit$
 ,/ates /ud5ts 9 cyb]security education 
& comput] lit]acy4  7c7 ,budget ov]sight
 & report+  7#a7 ,! head ( ea* ag5cy    
%all submit to ! ,director ( ! ,national
 ,(fice = ,cyb]space a budget ea* ye> = 
! foll[+ fiscal ye> relat+ to !         
protection ( in=mation infra/ructure =  
su* ag5cy1 by a date det]m9$ by !       
,director t is be=e ! submission ( su*  
budget by ! head ( ! ag5cy to ! ,(fice (
 ,managem5t & ,budget4  7#b7 ,!         

,director %all review & (f] a non-b9d+  
approval or disapproval ( ea* ag5cy's   
annual budget to ea* su* ag5cy be=e !   
submission ( su* budget by ! head ( !   
ag5cy to ! ,(fice ( ,managem5t &        
,budget4  7#c7 ,if ! ,director (f]s a   
non-b9d+ disapproval ( an ag5cy's       
budget1 ! ,director %all transmit       
recomm5dations to ! head ( su* ag5cy =  
/r5g!n+ its propos$ budget ) reg>d to ! 
protection ( su* ag5cy's in=mation      
infra/ructure4  7#d7 ,ea* budget        
submitt$ by ! head ( an ag5cy pursuant  
to p>agraph 7#a7 %all include--  7,a7 a 
review ( any ?reats to in=mation        
te*nology = su* ag5cy2  7,b7 a plan to  
secure ! in=mation infra/ructure = su*  
ag5cy bas$ on ?reats to in=mation       
te*nology1 us+ ! ,national ,in/itute (  
,/&>ds & ,te*nology guidel9es &         
recomm5dations2  7,c7 a review (        
compliance by su* ag5cy ) any previ\s   
ye> plan describ$ 9 subp>agraph 7,b72 & 
7,d7 a report on ! developm5t ( !       
cr$5tial+ process to enable secure      

au!ntication ( id5tity & au?orization = 
access to ! in=mation infra/ructure (   
su* ag5cy4  7#e7 ,! ,director ( !       
,national ,(fice = ,cyb]space may       
recomm5d to ! ,presid5t monet>y p5alties
 or inc5tives necess>y to enc\rage &    
ma9ta9 acc\ntability ( any ag5cy1 or    
s5ior ag5cy (ficial1 = ef=ts to secure !
 in=mation infra/ructure ( su* ag5cy4   
#ceef4 ,ag5cy responsibilities  7a7 ,9  
g5]al ,! head ( ea* ag5cy %all--  7#a7  
be responsible =--  7,a7 provid+        
in=mation security protections          
comm5surate ) ! risk & magnitude ( ! h>m
 result+ f unau?oriz$ access1 use1      
disclosure1 disruption1 modification1 or
 de/ruction (--  7i7 in=mation collect$ 
or ma9ta9$ by or on behalf ( ! ag5cy2 & 
7ii7 in=mation infra/ructure us$ or     
op]at$ by an ag5cy or by a contractor ( 
an ag5cy or o!r organization on behalf (
 an ag5cy2  7,b7 comply+ ) ! requirem5ts
 ( ?is sub*apt] & relat$ policies1      
proc$ures1 /&>ds1 & guidel9es1 includ+--
  7i7 ! regulations promulgat$ "u       

section #ceed & ! in=mation security    
/&>ds promulgat$ "u section #ceeh2  7ii7
 in=mation security /&>ds & guidel9es = 
national security sy/ems issu$ 9        
accordance ) law & z direct$ by !       
,presid5t2 &  7iii7 ensur+ ! /&>ds      
implem5t$ = in=mation infra/ructure &   
national security sy/ems "u ! ag5cy head
 are complem5t>y & uni=m1 to ! ext5t    
practicable2 &  7,c7 ensur+ t in=mation 
security managem5t processes are        
integrat$ ) ag5cy /rategic & op]ational 
plann+ processes2  7#b7 ensure t s5ior  
ag5cy (ficials provide in=mation        
security = ! in=mation & in=mation      
infra/ructure t support ! op]ations &   
assets "u _! control1 includ+ ?r\gh--   
7,a7 assess+ ! risk & magnitude ( ! h>m 
t c\ld result f ! unau?oriz$ access1    
use1 disclosure1 disruption1            
modification1 or de/ruction ( su*       
in=mation or in=mation infra/ructure2   
7,b7 det]m9+ ! levels ( in=mation       
security appropriate to protect su*     
in=mation & in=mation infra/ructure 9   

accordance ) regulations promulgat$ "u  
section #ceed & /&>ds promulgat$ "u     
section #ceeh1 = in=mation security     
classifications & relat$ requirem5ts2   
7,c7 implem5t+ policies & proc$ures to  
co/ effectively r$uce risks to an       
acceptable level2 &  7,d7 cont9u\sly    
te/+ & evaluat+ in=mation security      
controls & te*niques to ensure t !y are 
effectively implem5t$2  7#c7 delegate to
 an ag5cy (ficial1 designat$ z ! ,*ief  
,in=mation ,security ,(fic]1 "u !       
au?ority ( ! ag5cy ,*ief ,in=mation     
,(fic] ! responsibility to ov]see ag5cy 
in=mation security & ! au?ority to      
ensure & en=ce compliance ) !           
requirem5ts impos$ on ! ag5cy "u ?is    
sub*apt]1 includ+--  7,a7 ov]see+ !     
e/abli%m5t & ma9t5ance ( a security     
op]ations capability on an automat$ &   
cont9u\s basis t c--  7i7 assess ! /ate 
( compliance ( all networks & sy/ems )  
prescrib$ controls issu$ pursuant to    
section #ceeh & report imm$iately any   
v>iance !refrom &1 :]e appropriate & ) !

 approval ( ! ag5cy ,*ief ,in=mation    
,(fic]1 %ut d[n sy/ems t are f\nd to be 
non-compliant2  7ii7 detect1 report1    
respond to1 conta91 & mitigate incid5ts 
t impair adequate security ( ! in=mation
 & in=mation infra/ructure1 9 accordance
 ) policy provid$ by ! ,director ( !    
,national ,(fice = ,cyb]space1 9        
consultation ) ! ,*ief ,in=mation       
,(fic]s ,c\ncil1 & guidance f !         
,national ,in/itute ( ,/&>ds &          
,te*nology2  7iii7 collaborate ) !      
,national ,(fice = ,cyb]space &         
appropriate public & private sector     
security op]ations c5t]s to address     
incid5ts t impact ! security ( in=mation
 & in=mation infra/ructure t ext5d      
beyond ! control ( ! ag5cy2 &  7iv7 n   
lat] ?an #bd h\rs aft] discov]y ( any   
incid5t describ$ "u subp>agraph         
7,a77ii71 unless o!rwise direct$ by     
policy ( ! ,national ,(fice =           
,cyb]space1 provide notice to !         
appropriate security op]ations c5t]1 !  
,national ,cyb] ,inve/igative ,jo9t     

,task ,=ce1 & ! ,inspector ,g5]al ( !   
ag5cy2  7,b7 develop+1 ma9ta9+1 &       
ov]see+ an ag5cy wide in=mation security
 program z requir$ by subsection 7b72   
7,c7 develop+1 ma9ta9+1 & ov]see+       
in=mation security policies1 proc$ures1 
& control te*niques to address all      
applicable requirem5ts1 includ+ ^? issu$
 "u sections #ceee & #ceeh2  7,d7 tra9+ 
& ov]see+ p]sonnel ) significant        
responsibilities = in=mation security ) 
respect to su* responsibilities2 &  7,e7
 assi/+ s5ior ag5cy (ficials conc]n+ _! 
responsibilities "u p>agraph 7#b72  7#d7
 ensure t ! ag5cy has tra9$ & cle>$     
p]sonnel suffici5t to assi/ ! ag5cy 9   
comply+ ) ! requirem5ts ( ?is sub*apt] &
 relat$ policies1 proc$ures1 /&>ds1 &   
guidel9es2  7#e7 ensure t ! ,*ief       
,in=mation ,security ,(fic]1 9          
coord9ation ) o!r s5ior ag5cy (ficials1 
reports biannually to ! ag5cy head on ! 
effectiv5ess ( ! ag5cy in=mation        
security program1 includ+ progress (    
rem$ial actions2 &  7#f7 ensure t !     

,*ief ,in=mation ,security ,(fic]       
possesses necess>y qualifications1      
includ+ education1 pr(essional          
c]tifications1 tra9+1 exp]i5ce1 & !     
security cle>ance requir$ to adm9i/] !  
functions describ$ "u ?is sub*apt]2 &   
has in=mation security duties z ! prim>y
 duty ( t (ficial4  7b7 ,ag5cy program  
,ea* ag5cy %all develop1 docum5t1 &     
implem5t an ag5cywide in=mation security
 program1 approv$ by ! ,director ( !    
,national ,(fice = ,cyb]space "u section
 #ceee7;a77#e71 to provide in=mation    
security = ! in=mation & in=mation      
infra/ructure t support ! op]ations &   
assets ( ! ag5cy1 includ+ ^? provid$ or 
manag$ by ano!r ag5cy1 contractor1 or   
o!r s\rce1 t includes--  7#a7 cont9u\s  
automat$ te*nical monitor+ ( in=mation  
infra/ructure us$ or op]at$ by an ag5cy 
or by a contractor ( an ag5cy or o!r    
organization on behalf ( an ag5cy to    
assure con=mance ) regulations          
promulgat$ "u section #ceed & /&>ds     
promulgat$ "u section #ceeh2  7#b7 te/+ 

( ! effectiv5ess ( security controls t  
are comm5surate ) risk 7z def9$ by !    
,national ,in/itute ( ,/&>ds &          
,te*nology & ! ,national ,(fice =       
,cyb]space7 = ag5cy in=mation           
infra/ructure2  7#c7 policies &         
proc$ures t--  7,a7 mitigate & rem$iate1
 to ! ext5t practicable1 in=mation      
security vuln]abilities bas$ on ! risk  
pos$ to ! ag5cy2  7,b7 co/ effectively  
r$uce in=mation security risks to an    
acceptable level2  7,c7 ensure t        
in=mation security is address$ ?r\gh\t !
 life cycle ( ea* ag5cy in=mation sy/em 
& in=mation infra/ructure2  7,d7 ensure 
compliance )--  7i7 ! requirem5ts ( ?is 
sub*apt]2  7ii7 policies & proc$ures z  
may be prescrib$ by ! ,director ( !     
,national ,(fice = ,cyb]space1 &        
in=mation security /&>ds promulgat$ "u  
section #ceeh2  7iii7 m9imally          
acceptable sy/em configuration          
requirem5ts1 z det]m9$ by ! ,director ( 
! ,national ,(fice = ,cyb]space2 &  7iv7
 any o!r applicable requirem5ts1        

includ+--  7,i7 /&>ds & guidel9es =     
national security sy/ems issu$ 9        
accordance ) law & z direct$ by !       
,presid5t2  7,,ii7 ! policy ( !         
,director ( ! ,national ,(fice =        
,cyb]space2  7,,iii7 ! ,national        
,in/itute ( ,/&>ds & ,te*nology         
guidance2 &  7,,iv7 ! ,*ief ,in=mation  
,(fic]s ,c\ncil recomm5d$ approa*es2    
7,e7 develop1 ma9ta91 & ov]see in=mation
 security policies1 proc$ures1 & control
 te*niques to address all applicable    
requirem5ts1 includ+ ^? issu$ "u        
sections #ceee & #ceeh2 &  7,f7 ensure !
 ov]sight & tra9+ ( p]sonnel )          
significant responsibilities = in=mation
 security ) respect to su*              
responsibilities2  7#d7 ensur+ t ! ag5cy
 has tra9$ & cle>$ p]sonnel suffici5t to
 assi/ ! ag5cy 9 comply+ ) ! requirem5ts
 ( ?is sub*apt] & relat$ policies1      
proc$ures1 /&>ds1 & guidel9es2  7#e7 to 
! ext5t practicable1 automat$ & cont9u\s
 te*nical monitor+ = te/+1 & evaluation 
( ! effectiv5ess & compliance (         

in=mation security policies1 proc$ures1 
& practices1 includ+--  7,a7 managem5t1 
op]ational1 & te*nical controls ( e     
in=mation infra/ructure id5tifi$ 9 !    
inv5tory requir$ "u section #ceje7;b72 &
  7,b7 managem5t1 op]ational1 & te*nical
 controls reli$ on = an evaluation "u   
section #ceef2  7#f7 a process = plann+1
 implem5t+1 evaluat+1 & docum5t+ rem$ial
 action to address any defici5cies 9 !  
in=mation security policies1 proc$ures1 
& practices ( ! ag5cy2  7#g7 to ! ext5t 
practicable1 cont9u\s automat$ te*nical 
monitor+ = detect+1 report+1 & respond+ 
to security incid5ts1 consi/5t ) /&>ds &
 guidel9es issu$ by ! ,director ( !     
,national ,(fice = ,cyb]space1 includ+--
  7,a7 mitigat+ risks associat$ ) su*   
incid5ts be=e sub/antial damage is done2
  7,b7 notify+ & consult+ ) !           
appropriate security op]ations response 
c5t]2 &  7,c7 notify+ & consult+ )1 z   
appropriate--  7i7 law en=cem5t ag5cies 
& relevant ,(fices ( ,inspectors ,g5]al2
  7ii7 ! ,national ,(fice = ,cyb]space2 

&  7iii7 any o!r ag5cy or (fice1 9      
accordance ) law or z direct$ by !      
,presid5t2 &  7#h7 plans & proc$ures to 
ensure cont9uity ( op]ations = in=mation
 infra/ructure t support ! op]ations &  
assets ( ! ag5cy4  7c7 ,ag5cy report+   
,ea* ag5cy %all--  7#a7 submit an annual
 report on ! adequacy & effectiv5ess (  
in=mation security policies1 proc$ures1 
& practices1 & compliance ) !           
requirem5ts ( ?is sub*apt]1 includ+     
compliance ) ea* requirem5t ( subsection
 7b7 to--  7,a7 ! ,national ,(fice =    
,cyb]space2  7,b7 ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate2  7,c7 ! ,committee on      
,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( 
,repres5tatives2  7,d7 o!r appropriate  
au?orization & appropriations committees
 ( ,congress2 &  7,e7 ! ,comptroll]     
,g5]al2  7#b7 address ! adequacy &      
effectiv5ess ( in=mation security       
policies1 proc$ures1 & practices 9 plans
 & reports relat+ to--  7,a7 annual     
ag5cy budgets2  7,b7 in=mation res\rces 

managem5t ( ?is sub*apt]2  7,c7         
in=mation te*nology managem5t "u ?is    
*apt]2  7,d7 program p]=mance "u        
sections #aaje & #aaae ?r\gh #aaai (    
title #ca1 & sections #bhja & #bhje (   
title #ci2  7,e7 f9ancial managem5t "u  
*apt] #i ( title #ca1 & ! ,*ief         
,f9ancial ,(fic]s ,act ( #aiij 7#ca     
,u4,s4,c4 #eja note2 ,public ,law       
#aja-egf7 7& ! am5dm5ts made by t ,act72
  7,f7 f9ancial managem5t sy/ems "u !   
,f$]al ,f9ancial ,managem5t ,improvem5t 
,act 7#ca ,u4,s4,c4 #ceab note72 &  7,g7
 int]nal acc\nt+ & adm9i/rative controls
 "u section #ceab ( title #ca2 &  7#c7  
report any significant defici5cy 9 a    
policy1 proc$ure1 or practice id5tifi$  
"u p>agraph 7#a7 or 7#b7--  7,a7 z a    
mat]ial weakness 9 report+ "u section   
#ceab ( title #ca2 &  7,b7 if relat+ to 
f9ancial managem5t sy/ems1 z an in/ance 
( a lack ( sub/antial compliance "u !   
,f$]al ,f9ancial ,managem5t ,improvem5t 
,act 7#ca ,u4,s4,c4 #ceab note74  7d7   
,p]=mance plan  7#a7 ,9 addition to !   

requirem5ts ( subsection 7c71 ea* ag5cy1
 9 consultation ) ! ,national ,(fice =  
,cyb]space1 %all include z "p ( !       
p]=mance plan requir$ "u section #aaae (
 title #ca a description ( ! res\rces1  
includ+ budget1 /aff+1 & tra9+1 t are   
necess>y to implem5t ! program requir$  
"u subsection 7b74  7#b7 ,! description 
"u p>agraph 7#a7 %all be bas$ on ! risk 
assessm5ts requir$ "u subsection        
7a77#b74  7e7 ,public notice & comm5t   
,ea* ag5cy %all provide ! public )      
timely notice & opportunities = comm5t  
on propos$ in=mation security policies &
 proc$ures to ! ext5t t su* policies &  
proc$ures affect communication ) !      
public4  #ceeg4 ,annual indep5d5t audit 
7a7 ,9 g5]al  7#a7 ,ea* ye> ea* ag5cy   
%all h p]=m$ an indep5d5t audit ( !     
in=mation security program & practices (
 t ag5cy to det]m9e ! effectiv5ess ( su*
 program & practices4  7#b7 ,ea* audit  
"u ?is section %all include--  7,a7 te/+
 ( ! effectiv5ess ( ! in=mation         
infra/ructure ( ! ag5cy = automat$1     

cont9u\s monitor+ ( ! /ate ( compliance 
( its in=mation infra/ructure )         
regulations promulgat$ "u section #ceed 
& /&>ds promulgat$ "u section #ceeh 9 a 
repres5tative subset (--  7i7 !         
in=mation infra/ructure us$ or op]at$ by
 ! ag5cy2 &  7ii7 ! in=mation           
infra/ructure us$1 op]at$1 or support$  
on behalf ( ! ag5cy by a contractor ( ! 
ag5cy1 a subcontractor 7at any ti]7 (   
su* contractor1 or any o!r entity2  7,b7
 an assessm5t 7made on ! basis ( !      
results ( ! te/+7 ( compliance )--  7i7 
! requirem5ts ( ?is sub*apt]2 &  7ii7   
relat$ in=mation security policies1     
proc$ures1 /&>ds1 & guidel9es2  7,c7    
sep>ate assessm5ts1 z appropriate1      
reg>d+ in=mation security relat+ to     
national security sy/ems2 &  7,d7 a     
conclusion reg>d+ :e!r ! in=mation      
security controls ( ! ag5cy are         
effective1 includ+ an id5tification (   
any significant defici5cies 9 su*       
controls4  7#c7 ,ea* audit "u ?is       
section %all be p]=m$ 9 accordance )    

applicable g5]ally accept$ ,gov]nm5t    
audit+ /&>ds4  7b7 ,indep5d5t auditor   
,subject to subsection 7c7--  7#a7 = ea*
 ag5cy ) an ,inspector ,g5]al appo9t$ "u
 ! ,inspector ,g5]al ,act ( #aigh or any
 o!r law1 ! annual audit requir$ by ?is 
section %all be p]=m$ by ! ,inspector   
,g5]al or by an indep5d5t ext]nal       
auditor1 z det]m9$ by ! ,inspector      
,g5]al ( ! ag5cy2 &  7#b7 = ea* ag5cy to
 :i* p>agraph 7#a7 does n apply1 ! head 
( ! ag5cy %all engage an indep5d5t      
ext]nal auditor to p]=m ! audit4  7c7   
,national security sy/ems ,= ea* ag5cy  
op]at+ or ex]cis+ control ( a national  
security sy/em1 t portion ( ! audit     
requir$ by ?is section directly relat+  
to a national security sy/em %all be    
p]=m$--  7#a7 only by an entity         
designat$ head2 &  7#b7 9 su* a mann] z 
to ensure appropriate protection =      
in=mation associat$ ) any in=mation     
security vuln]ability 9 su* sy/em       
comm5surate ) ! risk & 9 accordance )   
all applicable laws4  7d7 ,exi/+ audits 

,! audit requir$ by ?is section may be  
bas$ 9 :ole or 9 "p on ano!r audit      
relat+ to programs or practices ( !     
applicable ag5cy4  7e7 ,ag5cy report+   
7#a7 ,ea* ye>1 n lat] ?an su* date      
e/abli%$ by ! ,director ( ! ,national   
,(fice = ,cyb]space1 ! head ( ea* ag5cy 
%all submit to ! ,director ! results ( !
 audit requir$ "u ?is section4  7#b7 ,to
 ! ext5t an audit requir$ "u ?is section
 directly relates to a national security
 sy/em1 ! results ( ! audit submitt$ to 
! ,director ( ! ,national ,(fice =      
,cyb]space %all conta9 only a summ>y &  
assessm5t ( t portion ( ! audit directly
 relat+ to a national security sy/em4   
7f7 ,protection ( in=mation ,ag5cies &  
auditors %all take appropriate /eps to  
ensure ! protection ( in=mation :i*1 if 
disclos$1 may adv]sely affect in=mation 
security4 ,su* protections %all be      
comm5surate ) ! risk & comply ) all     
applicable laws & regulations4  7g7     
,national ,(fice = ,cyb]space reports to
 congress  7#a7 ,! ,director ( !        

,national ,(fice = ,cyb]space %all      
summ>ize ! results ( ! audits conduct$  
"u ?is section 9 ! annual report to     
,congress requir$ "u section            
#ceee7;a77#h74  7#b7 ,! ,director's     
report to ,congress "u ?is subsection   
%all summ>ize in=mation reg>d+ in=mation
 security relat+ to national security   
sy/ems 9 su* a mann] z to ensure        
appropriate protection = in=mation      
associat$ ) any in=mation security      
vuln]ability 9 su* sy/em comm5surate ) !
 risk & 9 accordance ) all applicable   
laws4  7#c7 ,audits & any o!r           
descriptions ( in=mation infra/ructure  
"u ! au?ority & control ( ! ,director ( 
,c5tral ,intellig5ce or ( ,national     
,=eign ,intellig5ce ,programs sy/ems "u 
! au?ority & control ( ! ,secret>y (    
,def5se %all be made available to       
,congress only ?r\gh ! appropriate      
ov]sight committees ( ,congress1 9      
accordance ) applicable laws4  7h7      
,comptroll] g5]al ,! ,comptroll] ,g5]al 
%all p]iodically evaluate & report to   

,congress on--  7#a7 ! adequacy &       
effectiv5ess ( ag5cy in=mation security 
policies & practices2 &  7#b7           
implem5tation ( ! requirem5ts ( ?is     
sub*apt]4  7i7 ,contractor audits ,ea*  
ye> ea* contractor t op]ates1 uses1 or  
supports an in=mation sy/em or in=mation
 infra/ructure on behalf ( an ag5cy &   
ea* subcontractor ( su* contractor--    
7#a7 %all conduct an audit us+ an       
indep5d5t ext]nal auditor 9 accordance )
 subsection 7a71 includ+ an assessm5t ( 
compliance ) ! applicable requirem5ts ( 
?is sub*apt]2 &  7#b7 %all submit !     
results ( su* audit to su* ag5cy n lat] 
?an su* date e/abli%$ by ! ,ag5cy4      
#ceeh4 ,responsibilities = ,f$]al       
in=mation sy/ems /&>ds  7a7 ,requirem5t 
,to ,prescribe ,/&>ds  7#a7 ,9 g5]al    
7,a7 ,requirem5t ,except z provid$ "u   
p>agraph 7#b71 ! ,secret>y ( ,comm]ce   
%all1 on ! basis ( propos$ /&>ds        
develop$ by ! ,national ,in/itute (     
,/&>ds & ,te*nology pursuant to         
p>agraphs 7#b7 & 7#c7 ( section #bj7;a7 

( ! ,national ,in/itute ( ,/&>ds &      
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7;a77 & 9 consultation ) !     
,secret>y ( ,homel& ,security1          
promulgate in=mation security /&>ds     
p]ta9+ to ,f$]al in=mation sy/ems4  7,b7
 ,requir$ /&>ds ,/&>ds promulgat$ "u    
subp>agraph 7,a7 %all include--  7i7    
/&>ds t provide m9imum in=mation        
security requirem5ts z det]m9$ "u       
section #bj7;b7 ( ! ,national ,in/itute 
( ,/&>ds & ,te*nology ,act 7#ae         
,u4,s4,c4 #bgh;g-#c7;b772 &  7ii7 su*   
/&>ds t are o!rwise necess>y to improve 
! effici5cy ( op]ation or security (    
,f$]al in=mation sy/ems4  7,c7 ,requir$ 
/&>ds b9d+ ,in=mation security /&>ds    
describ$ "u subp>agraph 7,b7 %all be    
compulsory & b9d+4  7#b7 ,/&>ds &       
guidel9es = national security sy/ems    
,/&>ds & guidel9es = national security  
sy/ems1 z def9$ "u section #ceeb7;b71   
%all be develop$1 promulgat$1 en=c$1 &  
ov]se5 z o!rwise au?oriz$ by law & z    
direct$ by ! ,presid5t4  7b7            

,application ( ,m ,/r+5t ,/&>ds ,! head 
( an ag5cy may employ /&>ds = !         
co/-effective in=mation security = all  
op]ations & assets )9 or "u ! sup]vision
 ( t ag5cy t are m /r+5t ?an ! /&>ds    
promulgat$ by ! ,secret>y ( ,comm]ce "u 
?is section1 if su* /&>ds--  7#a7       
conta91 at a m9imum1 ! provisions ( ^?  
applicable /&>ds made compulsory & b9d+ 
by ! ,secret>y2 &  7#b7 are o!rwise     
consi/5t ) policies & guidel9es issu$ "u
 section #ceee4  7c7 ,requirem5ts       
,reg>d+ ,decisions by ! ,secret>y  7#a7 
,deadl9e ,! decision reg>d+ !           
promulgation ( any /&>d by ! ,secret>y (
 ,comm]ce "u subsection 7b7 %all occur n
 lat] ?an #f mon?s aft] ! submission ( !
 propos$ /&>d to ! ,secret>y by !       
,national ,in/itute ( ,/&>ds &          
,te*nology1 z provid$ "u section #bj ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c74  7#b7 ,notice & comm5t ,a   
decision by ! ,secret>y ( ,comm]ce to   
significantly modify1 or n promulgate1 a

 propos$ /&>d submitt$ to ! ,secret>y by
 ! ,national ,in/itute ( ,/&>ds &       
,te*nology1 z provid$ "u section #bj ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c71 %all be made aft] ! public  
is giv5 an opportunity to comm5t on !   
,secret>y's propos$ decision4  #ceei4   
,f$]al in=mation security incid5t c5t]  
7a7 ,9 ,g5]al ,! ,director ( ! ,national
 ,(fice = ,cyb]space %all ensure !      
op]ation ( a c5tral ,f$]al in=mation    
security incid5t c5t] to--  7#a7 provide
 timely te*nical assi/ance to op]ators (
 ag5cy in=mation sy/ems & in=mation     
infra/ructure reg>d+ security incid5ts1 
includ+ guidance on detect+ & h&l+      
in=mation security incid5ts2  7#b7      
compile & analyze in=mation ab\t        
incid5ts t ?reat5 in=mation security2   
7#c7 in=m op]ators ( ag5cy in=mation    
sy/ems & in=mation infra/ructure ab\t   
curr5t & pot5tial in=mation security    
?reats1 & vuln]abilities2 &  7#d7       
consult ) ! ,national ,in/itute ( ,/&>ds

 & ,te*nology1 ag5cies or (fices op]at+ 
or ex]cis+ control ( national security  
sy/ems 7includ+ ! ,national ,security   
,ag5cy71 & su* o!r ag5cies or (fices 9  
accordance ) law & z direct$ by !       
,presid5t reg>d+ in=mation security     
incid5ts & relat$ matt]s4  7b7 ,national
 ,security ,sy/ems ,ea* ag5cy op]at+ or 
ex]cis+ control ( a national security   
sy/em %all %>e in=mation ab\t in=mation 
security incid5ts1 ?reats1 &            
vuln]abilities ) ! ,f$]al in=mation     
security incid5t c5t] to ! ext5t        
consi/5t ) /&>ds & guidel9es = national 
security sy/ems1 issu$ 9 accordance )   
law & z direct$ by ! ,presid5t4  7c7    
,review & approval ,9 coord9ation ) !   
,adm9i/rator = ,electronic ,gov]nm5t &  
,in=mation ,te*nology1 ! ,director ( !  
,national ,(fice = ,cyb]space %all      
review & approve ! policies1 proc$ures1 
& guidance e/abli%$ 9 ?is sub*apt] to   
ensure t ! incid5t c5t] has ! capability
 to effectively & effici5tly detect1    
correlate1 respond to1 conta91 mitigate1

 & rem$iate incid5ts t impair ! adequate
 security ( ! in=mation sy/ems &        
in=mation infra/ructure ( m ?an "o      
ag5cy4 ,to ! ext5t practicable1 !       
capability %all be cont9u\s & te*nically
 automat$4  #cefj4 ,national security   
sy/ems ,! head ( ea* ag5cy op]at+ or    
ex]cis+ control ( a national security   
sy/em %all be responsible = ensur+ t !  
ag5cy--  7#a7 provides in=mation        
security protections comm5surate ) !    
risk & magnitude ( ! h>m result+ f !    
unau?oriz$ access1 use1 disclosure1     
disruption1 modification1 or de/ruction 
( ! in=mation conta9$ 9 su* sy/em2  7#b7
 implem5ts in=mation security policies &
 practices z requir$ by /&>ds &         
guidel9es = national security sy/ems1   
issu$ 9 accordance ) law & z direct$ by 
! ,presid5t2 &  7#c7 complies ) !       
requirem5ts ( ?is sub*apt]4  4  #ajb4   
,in=mation security acquisition         
requirem5ts ,*apt] #aac ( title #dj1    
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ( sub*apt] ,,ii ! foll[+ new     

section3  #aacai4 ,in=mation security   
acquisition requirem5ts4  7a7           
,prohibition ,not)/&+ any o!r provision 
( law1 beg9n+ "o ye> aft] ! date ( !    
enactm5t ( ! ,executive ,cyb]space      
,coord9ation ,act ( #bjac1 no ag5cy may 
ent] into a contract1 an ord] "u a      
contract1 or an int]ag5cy agreem5t =--  
7#a7 ! collection1 use1 managem5t1      
/orage1 or dissem9ation ( in=mation on  
behalf ( ! ag5cy2  7#b7 ! use or        
op]ation ( an in=mation sy/em or        
in=mation infra/ructure on behalf ( !   
ag5cy2 or  7#c7 in=mation te*nology2    
unless su* contract1 ord]1 or agreem5t  
includes requirem5ts to provide         
effective in=mation security t supports 
! op]ations & assets "u ! control ( !   
ag5cy1 9 compliance ) ! policies1 /&>ds1
 & guidance develop$ "u subsection 7b71 
& o!rwise ensures compliance ) ?is      
section4  7b7 ,coord9ation ( secure     
acquisition policies  7#a7 ,9 g5]al ,!  
,director ( ! ,(fice ( ,managem5t &     
,budget1 9 consultation ) ! ,director ( 

! ,national ,in/itute ( ,/&>ds &        
,te*nology1 ! ,director ( ! ,national   
,(fice = ,cyb]space1 & ! ,adm9i/rator ( 
,g5]al ,s]vices1 %all ov]see !          
developm5t & implem5tation ( policies1  
/&>ds1 & guidance1 includ+ ?r\gh        
revisions to ! ,f$]al ,acquisition      
,regulation & ! ,dep>tm5t ( ,def5se     
supplem5t to ! ,f$]al ,acquisition      
,regulation1 to co/ effectively enhance 
ag5cy in=mation security1 includ+--     
7,a7 m9imum in=mation security          
requirem5ts = ag5cy procurem5t (        
in=mation te*nology products & s]vices2 
&  7,b7 approa*es = evaluat+ & mitigat+ 
significant supply *a9 security risks   
associat$ ) products or s]vices to be   
acquir$ by ag5cies4  7#b7 ,report ,n    
lat] ?an two ye>s aft] ! date ( !       
enactm5t ( ! ,executive ,cyb]space      
,coord9ation ,act ( #bjac1 ! ,director (
 ! ,(fice ( ,managem5t & ,budget %all   
submit to ,congress a report describ+-- 
7,a7 actions tak5 to improve ! in=mation
 security associat$ ) ! procurem5t (    

products & s]vices by ! ,f$]al          
,gov]nm5t2 &  7,b7 plans = ov]see+ &    
coord9at+ ef=ts ( ag5cies to use be/    
practice approa*es = co/-effectively    
pur*as+ m secure products & s]vices4    
7c7 ,vuln]ability assessm5ts ( major    
sy/ems  7#a7 ,requirem5t = initial      
vuln]ability assessm5ts ,! ,director ( !
 ,(fice ( ,managem5t & ,budget %all     
require ea* ag5cy to conduct an initial 
vuln]ability assessm5t = any major sy/em
 & its significant items ( supply prior 
to ! developm5t ( ! sy/em4 ,! initial   
vuln]ability assessm5t ( a major sy/em &
 its significant items ( supply %all    
include use ( an analysis-bas$ approa*  
to--  7,a7 id5tify vuln]abilities2  7,b7
 def9e exploitation pot5tial2  7,c7     
exam9e ! sy/em's pot5tial effectiv5ess2 
7,d7 det]m9e ov]all vuln]ability2 &     
7,e7 make recomm5dations = risk         
r$uction4  7#b7 ,subsequ5t vuln]ability 
assessm5ts  7,a7 ,! ,director %all      
require a subsequ5t vuln]ability        
assessm5t ( ea* major sy/em & its       

significant items ( supply )9 a program 
if ! ,director det]m9es t circum/ances  
w>rant ! issuance ( an additional       
vuln]ability assessm5t4  7,b7 ,^u !     
reque/ ( a congressional committee1 !   
,director may require a subsequ5t       
vuln]ability assessm5t ( a p>ticul>     
major sy/em & its significant items (   
supply )9 ! program4  7,c7 ,any         
subsequ5t vuln]ability assessm5t ( a    
major sy/em & its significant items (   
supply %all include use ( an            
analysis-bas$ approa* &1 if applicable1 
a te/+-bas$ approa*1 to monitor !       
exploitation pot5tial ( su* sy/em &     
reexam9e ! factors describ$ 9           
subp>agraphs 7,a7 ?r\gh 7,e7 ( p>agraph 
7#a74  7#c7 ,congressional ov]sight ,!  
,director %all provide to ! appropriate 
congressional committees a copy ( ea*   
vuln]ability assessm5t conduct$ "u      
p>agraph 7#a7 or 7#b7 n lat] ?an #aj    
days aft] ! date ( ! completion ( su*   
assessm5t4  7d7 ,def9itions ,9 ?is      
section3  7#a7 ,item ( supply ,! t]m    

item ( supply--  7,a7 means any         
individual "p1 compon5t1 subassembly1   
assembly1 or subsy/em integral to a     
major sy/em1 & o!r prop]ty :i* may be   
replac$ dur+ ! s]vice life ( ! major    
sy/em1 includ+ a sp>e "p or repl5i%m5t  
"p2 &  7,b7 does n include packag+ or   
label+ associat$ ) %ipm5t or            
id5tification ( an item4  7#b7          
,vuln]ability assessm5t ,! t]m          
vuln]ability assessm5t means ! process (
 id5tify+ & quantify+ vuln]abilities 9 a
 major sy/em & its significant items (  
supply4  7#c7 ,major sy/em ,! t]m major 
sy/em has ! mean+ giv5 t t]m 9 section  
#d ( ! ,(fice ( ,f$]al ,procurem5t      
,policy ,act 7#da ,u4,s4,c4 #djc74  4   
#ajc4 ,te*nical & con=m+ am5dm5ts  7a7  
,table ( sections 9 title #dd ,! table (
 sections = *apt] #ce ( title #dd1      
,unit$ ,/ates ,code1 is am5d$ by /rik+ !
 matt] relat+ to sub*apt]s ,,ii & ,,iii 
& ins]t+ ! foll[+3  ,sub*apt]           
,,ii--,in=mation security #ceea4        
,purposes4 #ceeb4 ,def9itions4 #ceec4   

,national ,(fice = ,cyb]space4 #ceed4   
,f$]al ,cyb]security ,practice ,bo>d4   
#ceee4 ,au?ority & functions ( !        
,director ( ! ,national ,(fice =        
,cyb]space4 #ceef4 ,ag5cy               
responsibilities4 #ceeg4 ,annual        
indep5d5t audit4 #ceeh4                 
,responsibilities = ,f$]al in=mation    
sy/ems /&>ds4 #ceei4 ,f$]al in=mation   
security incid5t c5t]4 #cefj4 ,national 
security sy/ems4  4  7b7 ,table (       
sections 9 title #dj ,! table ( sections
 = *apt] #aac ( title #dj1 ,unit$ ,/ates
 ,code1 is am5d$ by ins]t+ aft] ! item  
relat+ to section #aacah ! foll[+ new   
item3  ,sec4 #aacai4 ,in=mation security
 acquisition requirem5ts4  4  7c7 ,o!r  
ref]5ces  7#a7 ,section                 
#ajja7;c77#a77;,a7 ( ! ,homel& ,security
 ,act ( #bjjb 7#f ,u4,s4,c4             
#eaa7;c77#a77;,a77 is am5d$ by /rik+    
section #cecb7c7 & ins]t+ section       
#ceeb7;b74  7#b7 ,section #bbbb7;j77#f7 
( title #aj1 ,unit$ ,/ates ,code1 is    
am5d$ by /rik+ section #cedb7;b77#b77 & 

ins]t+ section #ceeb7;b74  7#c7 ,section
 #bbbc7;c77#c7 ( title #aj1 ,unit$      
,/ates ,code1 is am5d$1 by /rik+ section
 #cedb7;b77#b77 & ins]t+ section        
#ceeb7;b74  7#d7 ,section #bcae ( title 
#aj1 ,unit$ ,/ates ,code1 is am5d$ by   
/rik+ section #cedb7;b77#b77 & ins]t+   
section #ceeb7;b74  7#e7 ,section #bj ( 
! ,national ,in/itute ( ,/&>ds &        
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7 is am5d$--  7,a7 9           
subsections 7a77#b7 & 7e77#e71 by /rik+ 
section #cecb7;b77#b7 & ins]t+ section  
#ceeb7;b72  7,b7 9 subsection 7e77#b71  
by /rik+ section #cecb7a7 & ins]t+      
section #ceeb7;b72 &  7,c7 9 subsections
 7c77#c7 & 7d77#a71 by /rik+ section    
#aacca ( title #dj & ins]t+ section     
#ceeh ( title #dd4  7#f7 ,section       
#h7;d77#a7 ( ! ,cyb] ,security ,rese>* &
 ,developm5t ,act 7#ae ,u4,s4,c4        
#gdjf7;d77#a77 is am5d$ by /rik+ section
 #cecd7;b7 & ins]t+ section #ceef7;b74  
7d7 ,repeal  7#a7 ,sub*apt] ,,iii (     
*apt] #aac ( title #dj1 ,unit$ ,/ates   

,code1 is repeal$4  7#b7 ,! table (     
sections = *apt] #aac ( su* title is    
am5d$ by /rik+ ! matt] relat+ to        
sub*apt] ,,iii4  7e7 ,executive s*$ule  
pay rate ,section #ecad ( title #e1     
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+3  ,director ( !         
,national ,(fice = ,cyb]space4 4  7f7   
,memb]%ip on ! ,national ,security      
,c\ncil ,section #aja7;a7 ( ! ,national 
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#djb7;a77 is am5d$--  7#a7 by r$esignat+
 p>agraphs 7#g7 & 7#h7 z p>agraphs 7#h7 
& 7#i71 respectively2 &  7#b7 by ins]t+ 
aft] p>agraph 7#f7 ! foll[+3  7#g7 !    
,director ( ! ,national ,(fice =        
,cyb]space2  4  #ajd4 ,effective date   
7a7 ,9 g5]al ,unless o!rwise specifi$ 9 
?is section1 ?is title 7includ+ !       
am5dm5ts made by ?is title7 %all take   
effect #cj days aft] ! date ( enactm5t (
 ?is ,act4  7b7 ,national ,(fice =      
,cyb]space ,section #ceec ( title #dd1  
,unit$ ,/ates ,code1 z add$ by section  
#aja ( ?is title1 %all take effect #ahj 

days aft] ! date ( enactm5t ( ?is ,act4 
7c7 ,f$]al ,cyb]security ,practice ,bo>d
 ,section #ceed ( title #dd1 ,unit$     
,/ates ,code1 z add$ by section #aja (  
?is title1 %all take effect "o ye> aft] 
! date ( enactm5t ( ?is ,act4  ,,ii     
,f$]al ,*ief ,te*nology ,(fic]  #bja4   
,(fice ( ! ,*ief ,te*nology ,(fic]  7a7 
,e/abli%m5t & /aff  7#a7 ,e/abli%m5t    
7,a7 ,9 g5]al ,!re is e/abli%$ 9 !      
,executive ,(fice ( ! ,presid5t an      
,(fice ( ! ,f$]al ,*ief ,te*nology      
,(fic] 79 ?is section ref]r$ to z !     
,(fice74  7,b7 ,head ( ! ,(fice  7i7    
,f$]al ,*ief ,te*nology ,(fic] ,!       
,presid5t %all appo9t a ,f$]al ,*ief    
,te*nology ,(fic] 79 ?is section ref]r$ 
to z ! ,f$]al ,,cto7 :o %all be ! head (
 ! ,(fice4  7ii7 ,comp5sation ,section  
#ecad ( title #e1 ,unit$ ,/ates ,code1  
is am5d$ by add+ at ! end ! foll[+3     
,f$]al ,*ief ,te*nology ,(fic]4 4  7#b7 
,/aff ( ! ,(fice ,! ,presid5t may appo9t
 additional /aff memb]s to ! ,(fice4    
7b7 ,duties ( ! (fice ,! functions ( !  

,f$]al ,,cto are ! foll[+3  7#a7        
,und]take fact-ga!r+1 analysis1 &       
assessm5t ( ! ,f$]al ,gov]nm5t's        
in=mation te*nology infra/ructures1     
in=mation te*nology /rategy1 & use (    
in=mation te*nology1 & provide advice on
 su* matt]s to ! ,presid5t1 heads (     
,f$]al dep>tm5ts & ag5cies1 & gov]nm5t  
*ief in=mation (fic]s & *ief te*nology  
(fic]s4  7#b7 ,lead an int]ag5cy ef=t1  
work+ ) ! *ief te*nology & *ief         
in=mation (fic]s ( ea* ( ! ,f$]al       
dep>tm5ts & ag5cies1 to develop &       
implem5t a plann+ process to ensure t !y
 use be/-9-class te*nologies1 %>e be/   
practices1 & improve ! use ( te*nology 9
 support ( ,f$]al ,gov]nm5t requirem5ts4
  7#c7 ,advise ! ,presid5t on in=mation 
te*nology consid]ations ) reg>d to      
,f$]al budgets & ) reg>d to g5]al       
coord9ation ( ! rese>* & developm5t     
programs ( ! ,f$]al ,gov]nm5t =         
in=mation te*nology-relat$ matt]s4  7#d7
 ,promote te*nological innovation 9 !   
,f$]al ,gov]nm5t1 & enc\rage & ov]see ! 

adoption ( robu/ cross-gov]nm5tal       
ar*itectures & /&>ds-bas$ in=mation     
te*nologies1 9 support ( effective      
op]ational & managem5t policies1        
practices1 & s]vices across ,f$]al      
dep>tm5ts & ag5cies & ) ! public &      
ext]nal entities4  7#e7 ,e/abli%        
coop]ative public-private sector        
p>tn]%ip initiatives to a*ieve k (      
te*nologies available 9 ! m>ketplace t c
 be us$ = improv+ gov]nm5tal op]ations &
 in=mation te*nology rese>* & developm5t
 activities4  7#f7 ,ga!r timely &       
au?oritative in=mation conc]n+          
significant developm5ts & tr5ds 9       
in=mation te*nology1 & 9 national       
priorities1 bo? curr5t & prospective1 & 
analyze & int]pret ! in=mation = !      
purpose ( det]m9+ :e!r ! developm5ts &  
tr5ds are likely to affect a*ievem5t ( !
 priority goals ( ! ,f$]al ,gov]nm5t4   
7#g7 ,develop1 review1 revise1 &        
recomm5d crit]ia = det]m9+ in=mation    
te*nology activities w>rant+ ,f$]al     
support1 & recomm5d ,f$]al policies     

design$ to advance ! developm5t &       
ma9t5ance ( effective & effici5t        
in=mation te*nology capabilities1       
includ+ human res\rces1 at all levels ( 
gov]nm5t1 academia1 & indu/ry1 & !      
effective application ( ! capabilities  
to national ne$s4  7#h7 ,any o!r        
functions & activities t ! ,presid5t may
 assign to ! ,f$]al ,,cto4  7c7 ,policy 
,plann+2 ,analysis & ,advice ,! ,(fice  
%all s]ve z a s\rce ( analysis & advice 
= ! ,presid5t & heads ( ,f$]al dep>tm5ts
 & ag5cies ) respect to major policies1 
plans1 & programs ( ! ,f$]al ,gov]nm5t 9
 accordance ) ! functions describ$ 9    
subsection 7b74  7d7 ,coord9ation ( !   
,(fice ) o!r entities  7#a7 ,f$]al ,,cto
 on ,dome/ic ,policy ,c\ncil ,! ,f$]al  
,,cto %all be a memb] ( ! ,dome/ic      
,policy ,c\ncil4  7#b7 ,f$]al ,,cto on  
,cyb] ,security ,practice ,bo>d ,!      
,f$]al ,,cto %all be a memb] ( ! ,f$]al 
,cyb]security ,practice ,bo>d4  7#c7    
,obta9 in=mation f ag5cies ,! ,(fice may
 secure1 directly f any dep>tm5t or     

ag5cy ( ! ,unit$ ,/ates1 in=mation      
necess>y to enable ! ,f$]al ,,cto to    
c>ry out ?is section4 ,on reque/ ( !    
,f$]al ,,cto1 ! head ( ! dep>tm5t or    
ag5cy %all furni% ! in=mation to !      
,(fice1 subject to any applicable       
limitations ( ,f$]al law4  7#d7 ,/aff ( 
,f$]al ,ag5cies ,on reque/ ( ! ,f$]al   
,,cto1 to assi/ ! ,(fice 9 c>ry+ out !  
duties ( ! ,(fice1 ! head ( any ,f$]al  
dep>tm5t or ag5cy may detail p]sonnel1  
s]vices1 or facilities ( ! dep>tm5t or  
ag5cy to ! ,(fice4  7e7 ,annual ,report 
7#a7 ,publication & ,cont5ts ,! ,f$]al  
,,cto %all publi%1 9 ! ,f$]al ,regi/] & 
on a public ,int]net website ( ! ,f$]al 
,,cto1 an annual report t includes !    
foll[+3  7,a7 ,in=mation on programs to 
promote ! developm5t ( te*nological     
innovations4  7,b7 ,recomm5dations = !  
adoption ( policies to enc\rage !       
g5]ation ( te*nological innovations4    
7,c7 ,in=mation on ! activities &       
accompli%m5ts ( ! ,(fice 9 ! ye> cov]$  
by ! report4  7#b7 ,submission ,! ,f$]al

 ,,cto %all submit ea* report "u        
p>agraph 7#a7 to--  7,a7 ! ,presid5t2   
7,b7 ! ,committee on ,ov]sight &        
,gov]nm5t ,re=m ( ! ,h\se (             
,repres5tatives2  7,c7 ! ,committee on  
,sci5ce & ,te*nology ( ! ,h\se (        
,repres5tatives2 &  7,d7 ! ,committee on
 ,comm]ce1 ,sci5ce1 & ,transportation ( 
! ,s5ate4  ,,iii ,/r5g!n+ ,cyb]security 
= ,critical ,infra/ructure  #cja4       
,def9itions ,9 ?is title3  7#a7         
,critical in=mation infra/ructure ,! t]m
 critical in=mation infra/ructure means 
! electronic in=mation & communications 
sy/ems1 s(tw>e1 & assets t control1     
protect1 process1 transmit1 receive1    
program1 or /ore in=mation 9 any =m1    
includ+ data1 voice1 & video1 reli$ ^u  
by critical infra/ructure1 indu/rial    
control sy/ems su* z sup]visory control 
& data acquisition sy/ems1 &            
programmable logic controll]s4 ,?is %all
 also include su* sy/ems ( ! ,f$]al     
,gov]nm5t4  7#b7 ,secret>y ,! t]m       
,secret>y means ! ,secret>y ( ,homel&   

,security4  #cjb4 ,au?ority ( ,secret>y 
7a7 ,9 g5]al ,! ,secret>y %all h prim>y 
au?ority1 9 consultation ) ! ,director (
 ! ,national ,(fice = ,cyb]space & !    
,f$]al ,cyb]space ,practice ,bo>d1 9 !  
executive bran* ( ! ,f$]al ,gov]nm5t 9  
creation1 v]ification1 & en=cem5t (     
measures ) respect to ! protection (    
critical in=mation infra/ructure1       
includ+ promulgat+ risk-in=m$ in=mation 
security practices & /&>ds applicable to
 critical in=mation infra/ructures t are
 n own$ by or "u ! direct control ( !   
,f$]al ,gov]nm5t4 ,! ,secret>y %\ld     
consult ) appropriate private sector    
entities1 includ+ private own]s &       
op]ators ( ! affect$ infra/ructure1 to  
c>ry out ?is section4  7b7 ,o!r ,f$]al  
ag5cies ,9 e/abli%+ measures ) respect  
to ! protection ( critical in=mation    
infra/ructure ! ,secret>y %all--  7#a7  
consult ) ! ,secret>y ( ,comm]ce1 !     
,secret>y ( ,def5se1 ! ,national        
,in/itute ( ,/&>ds & ,te*nology1 & o!r  
sector specific ,f$]al regulatory       

ag5cies 9 ex]cis+ ! au?ority ref]r$ to 9
 subsection 7a72 &  7#b7 coord9ate1 ?\gh
 ! ,executive ,(fice ( ! ,presid5t1 )   
sector specific ,f$]al regulatory       
ag5cies1 includ+ ! ,f$]al ,en]gy        
,regulatory ,commission1 9 e/abli%+     
en=cem5t me*anisms "u ! au?ority ref]r$ 
to 9 subsection 7a74  7c7 ,audit+       
au?ority ,! ,secret>y may--  7#a7       
conduct su* audits z are necess>y to    
ensure t appropriate measures are tak5  
to secure critical in=mation            
infra/ructure2  7#b7 issue su* subpo5as 
z are necess>y to det]m9e compliance )  
,f$]al regulatory requirem5ts = secur+  
critical in=mation infra/ructure2 &     
7#c7 au?orize sector specific ,f$]al    
regulatory ag5cies to und]take su*      
audits4