,one ,hundred ,thirteenth ,congress of the ,united ,states of ,america #b;d ,session ,begun and held at the ,city of ,washington on ,friday1 the third day of ,january1 two thousand and fourteen ,s4 #beba ,,an ,,act ,to amend chapter #ce of title #dd1 ,united ,states ,code1 to provide for reform to ,federal information security4 #a4 ,short title ,this ,act may be cited as the ,federal ,information ,security ,modernization ,act of #bjad4 #b4 ,,fisma reform 7a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking subchapters ,,ii and ,,iii and inserting the following3 ,,ii ,information security #ceea4 ,purposes ,the purposes of this subchapter are to-- 7#a7 provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support ,federal operations and assets2 7#b7 recognize the highly networked nature of the current ,federal computing environment and provide effective governmentwide management and oversight of the related information security risks1 including coordination of information security efforts throughout the civilian1 national security1 and law enforcement communities2 7#c7 provide for development and maintenance of minimum controls required to protect ,federal information and information systems2 7#d7 provide a mechanism for improved oversight of ,federal agency information security programs1 including through automated security tools to continuously diagnose and improve security2 7#e7 acknowledge that commercially developed information security products offer advanced1 dynamic1 robust1 and effective information security solutions1 reflecting market solutions for the protection of critical information infrastructures important to the national defense and economic security of the nation that are designed1 built1 and operated by the private sector2 and 7#f7 recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products4 #ceeb4 ,definitions 7a7 ,in general ,except as provided under subsection 7b71 the definitions under section #cejb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,the term binding operational directive means a compulsory direction to an agency that-- 7,a7 is for purposes of safeguarding ,federal information and information systems from a known or reasonably suspected information security threat1 vulnerability1 or risk2 7,b7 shall be in accordance with policies1 principles1 standards1 and guidelines issued by the ,director2 and 7,c7 may be revised or repealed by the ,director if the direction issued on behalf of the ,director is not in accordance with policies and principles developed by the ,director4 7#b7 ,the term incident means an occurrence that-- 7,a7 actually or imminently jeopardizes1 without lawful authority1 the integrity1 confidentiality1 or availability of information or an information system2 or 7,b7 constitutes a violation or imminent threat of violation of law1 security policies1 security procedures1 or acceptable use policies4 7#c7 ,the term information security means protecting information and information systems from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction in order to provide-- 7,a7 integrity1 which means guarding against improper information modification or destruction1 and includes ensuring information nonrepudiation and authenticity2 7,b7 confidentiality1 which means preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 and 7,c7 availability1 which means ensuring timely and reliable access to and use of information4 7#d7 ,the term information technology has the meaning given that term in section #aaaja of title #dj4 7#e7 ,the term intelligence community has the meaning given that term in section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#f7 7,a7 ,the term national security system means any information system 7including any telecommunications system7 used or operated by an agency or by a contractor of an agency1 or other organization on behalf of an agency-- 7i7 the function1 operation1 or use of which-- 7,i7 involves intelligence activities2 7,,ii7 involves cryptologic activities related to national security2 7,,iii7 involves command and control of military forces2 7,,iv7 involves equipment that is an integral part of a weapon or weapons system2 or 7,v7 subject to subparagraph 7,b71 is critical to the direct fulfillment of military or intelligence missions2 or 7ii7 is protected at all times by procedures established for information that have been specifically authorized under criteria established by an ,executive order or an ,act of ,congress to be kept classified in the interest of national defense or foreign policy4 7,b7 ,subparagraph 7,a77i77,v7 does not include a system that is to be used for routine administrative and business applications 7including payroll1 finance1 logistics1 and personnel management applications74 7#g7 ,the term ,secretary means the ,secretary of ,homeland ,security4 #ceec4 ,authority and functions of the ,director and the ,secretary 7a7 ,director ,the ,director shall oversee agency information security policies and practices1 including-- 7#a7 developing and overseeing the implementation of policies1 principles1 standards1 and guidelines on information security1 including through ensuring timely agency adoption of and compliance with standards promulgated under section #aacca of title #dj2 7#b7 requiring agencies1 consistent with the standards promulgated under such section #aacca and the requirements of this subchapter1 to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7,a7 information collected or maintained by or on behalf of an agency2 or 7,b7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7#c7 ensuring that the ,secretary carries out the authorities and functions under subsection 7b72 7#d7 coordinating the development of standards and guidelines under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 with agencies and offices operating or exercising control of national security systems 7including the ,national ,security ,agency7 to assure1 to the maximum extent feasible1 that such standards and guidelines are complementary with standards and guidelines developed for national security systems2 7#e7 overseeing agency compliance with the requirements of this subchapter1 including through any authorized action under section #aacjc of title #dj1 to enforce accountability for compliance with such requirements2 and 7#f7 coordinating information security policies and procedures with related information resources management policies and procedures4 7b7 ,secretary ,the ,secretary1 in consultation with the ,director1 shall administer the implementation of agency information security policies and practices for information systems1 except for national security systems and information systems described in paragraph 7#b7 or 7#c7 of subsection 7e71 including-- 7#a7 assisting the ,director in carrying out the authorities and functions under paragraphs 7#a71 7#b71 7#c71 7#e71 and 7#f7 of subsection 7a72 7#b7 developing and overseeing the implementation of binding operational directives to agencies to implement the policies1 principles1 standards1 and guidelines developed by the ,director under subsection 7a77#a7 and the requirements of this subchapter1 which may be revised or repealed by the ,director if the operational directives issued on behalf of the ,director are not in accordance with policies1 principles1 standards1 and guidelines developed by the ,director1 including-- 7,a7 requirements for reporting security incidents to the ,federal information security incident center established under section #ceef2 7,b7 requirements for the contents of the annual reports required to be submitted under section #ceed7;c77#a72 7,c7 requirements for the mitigation of exigent risks to information systems2 and 7,d7 other operational requirements as the ,director or ,secretary1 in consultation with the ,director1 may determine necessary2 7#c7 monitoring agency implementation of information security policies and practices2 7#d7 convening meetings with senior agency officials to help ensure effective implementation of information security policies and practices2 7#e7 coordinating ,government-wide efforts on information security policies and practices1 including consultation with the ,chief ,information ,officers ,council established under section #cfjc and the ,director of the ,national ,institute of ,standards and ,technology2 7#f7 providing operational and technical assistance to agencies in implementing policies1 principles1 standards1 and guidelines on information security1 including implementation of standards promulgated under section #aacca of title #dj1 including by-- 7,a7 operating the ,federal information security incident center established under section #ceef2 7,b7 upon request by an agency1 deploying technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities1 with or without reimbursement2 7,c7 compiling and analyzing data on agency information security2 and 7,d7 developing and conducting targeted operational evaluations1 including threat and vulnerability assessments1 on the information systems2 and 7#g7 other actions as the ,director or the ,secretary1 in consultation with the ,director1 may determine necessary to carry out this subsection4 7c7 ,report ,not later than ,march #a of each year1 the ,director1 in consultation with the ,secretary1 shall submit to ,congress a report on the effectiveness of information security policies and practices during the preceding year1 including-- 7#a7 a summary of the incidents described in the annual reports required to be submitted under section #ceed7;c77#a71 including a summary of the information required under section #ceed7;c77#a77;,a77iii72 7#b7 a description of the threshold for reporting major information security incidents2 7#c7 a summary of the results of evaluations required to be performed under section #ceee2 7#d7 an assessment of agency compliance with standards promulgated under section #aacca of title #dj2 and 7#e7 an assessment of agency compliance with data breach notification policies and procedures issued by the ,director4 7d7 ,national security systems ,except for the authorities and functions described in subsection 7a77#e7 and subsection 7c71 the authorities and functions of the ,director and the ,secretary under this section shall not apply to national security systems4 7e7 ,department of ,defense and ,intelligence community systems 7#a7 ,the authorities of the ,director described in paragraphs 7#a7 and 7#b7 of subsection 7a7 shall be delegated to the ,secretary of ,defense in the case of systems described in paragraph 7#b7 and to the ,director of ,national ,intelligence in the case of systems described in paragraph 7#c74 7#b7 ,the systems described in this paragraph are systems that are operated by the ,department of ,defense1 a contractor of the ,department of ,defense1 or another entity on behalf of the ,department of ,defense that processes any information the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of which would have a debilitating impact on the mission of the ,department of ,defense4 7#c7 ,the systems described in this paragraph are systems that are operated by an element of the intelligence community1 a contractor of an element of the intelligence community1 or another entity on behalf of an element of the intelligence community that processes any information the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of which would have a debilitating impact on the mission of an element of the intelligence community4 7f7 ,consideration 7#a7 ,in general ,in carrying out the responsibilities under subsection 7b71 the ,secretary shall consider any applicable standards or guidelines developed by the ,national ,institute of ,standards and ,technology and issued by the ,secretary of ,commerce under section #aacca of title #dj4 7#b7 ,directives ,the ,secretary shall-- 7,a7 consult with the ,director of the ,national ,institute of ,standards and ,technology regarding any binding operational directive that implements standards and guidelines developed by the ,national ,institute of ,standards and ,technology2 and 7,b7 ensure that binding operational directives issued under subsection 7b77#b7 do not conflict with the standards and guidelines issued under section #aacca of title #dj4 7#c7 ,rule of construction ,nothing in this subchapter shall be construed as authorizing the ,secretary to direct the ,secretary of ,commerce in the development and promulgation of standards and guidelines under section #aacca of title #dj4 7g7 ,exercise of authority ,to ensure fiscal and policy consistency1 the ,secretary shall exercise the authority under this section subject to direction by the ,president1 in coordination with the ,director4 #ceed4 ,federal agency responsibilities 7a7 ,in general ,the head of each agency shall-- 7#a7 be responsible for-- 7,a7 providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7i7 information collected or maintained by or on behalf of the agency2 and 7ii7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7,b7 complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines1 including-- 7i7 information security standards promulgated under section #aacca of title #dj2 7ii7 operational directives developed by the ,secretary under section #ceec7;b72 7iii7 policies and procedures issued by the ,director2 and 7iv7 information security standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 and 7,c7 ensuring that information security management processes are integrated with agency strategic1 operational1 and budgetary planning processes2 7#b7 ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under their control1 including through-- 7,a7 assessing the risk and magnitude of the harm that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of such information or information systems2 7,b7 determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section #aacca of title #dj1 for information security classifications and related requirements2 7,c7 implementing policies and procedures to cost-effectively reduce risks to an acceptable level2 and 7,d7 periodically testing and evaluating information security controls and techniques to ensure that they are effectively implemented2 7#c7 delegate to the agency ,chief ,information ,officer established under section #cejf 7or comparable official in an agency not covered by such section7 the authority to ensure compliance with the requirements imposed on the agency under this subchapter1 including-- 7,a7 designating a senior agency information security officer who shall-- 7i7 carry out the ,chief ,information ,officer's responsibilities under this section2 7ii7 possess professional qualifications1 including training and experience1 required to administer the functions described under this section2 7iii7 have information security duties as that official's primary duty2 and 7iv7 head an office with the mission and resources to assist in ensuring agency compliance with this section2 7,b7 developing and maintaining an agencywide information security program as required by subsection 7b72 7,c7 developing and maintaining information security policies1 procedures1 and control techniques to address all applicable requirements1 including those issued under section #ceec of this title and section #aacca of title #dj2 7,d7 training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities2 and 7,e7 assisting senior agency officials concerning their responsibilities under paragraph 7#b72 7#d7 ensure that the agency has trained personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies1 procedures1 standards1 and guidelines2 7#e7 ensure that the agency ,chief ,information ,officer1 in coordination with other senior agency officials1 reports annually to the agency head on the effectiveness of the agency information security program1 including progress of remedial actions2 7#f7 ensure that senior agency officials1 including chief information officers of component agencies or equivalent officials1 carry out responsibilities under this subchapter as directed by the official delegated authority under paragraph 7#c72 and 7#g7 ensure that all personnel are held accountable for complying with the agency-wide information security program implemented under subsection 7b74 7b7 ,agency program ,each agency shall develop1 document1 and implement an agency-wide information security program to provide information security for the information and information systems that support the operations and assets of the agency1 including those provided or managed by another agency1 contractor1 or other source1 that includes-- 7#a7 periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of information and information systems that support the operations and assets of the agency1 which may include using automated tools consistent with standards and guidelines promulgated under section #aacca of title #dj2 7#b7 policies and procedures that-- 7,a7 are based on the risk assessments required by paragraph 7#a72 7,b7 cost-effectively reduce information security risks to an acceptable level2 7,c7 ensure that information security is addressed throughout the life cycle of each agency information system2 and 7,d7 ensure compliance with-- 7i7 the requirements of this subchapter2 7ii7 policies and procedures as may be prescribed by the ,director1 and information security standards promulgated under section #aacca of title #dj2 7iii7 minimally acceptable system configuration requirements1 as determined by the agency2 and 7iv7 any other applicable requirements1 including standards and guidelines for national security systems issued in accordance with law and as directed by the ,president2 7#c7 subordinate plans for providing adequate information security for networks1 facilities1 and systems or groups of information systems1 as appropriate2 7#d7 security awareness training to inform personnel1 including contractors and other users of information systems that support the operations and assets of the agency1 of-- 7,a7 information security risks associated with their activities2 and 7,b7 their responsibilities in complying with agency policies and procedures designed to reduce these risks2 7#e7 periodic testing and evaluation of the effectiveness of information security policies1 procedures1 and practices1 to be performed with a frequency depending on risk1 but no less than annually1 of which such testing-- 7,a7 shall include testing of management1 operational1 and technical controls of every information system identified in the inventory required under section #ceje7;c72 7,b7 may include testing relied on in an evaluation under section #ceee2 and 7,c7 shall include using automated tools1 consistent with standards and guidelines promulgated under section #aacca of title #dj2 7#f7 a process for planning1 implementing1 evaluating1 and documenting remedial action to address any deficiencies in the information security policies1 procedures1 and practices of the agency2 7#g7 procedures for detecting1 reporting1 and responding to security incidents1 which-- 7,a7 shall be consistent with the standards and guidelines described in section #ceef7;b72 7,b7 may include using automated tools2 and 7,c7 shall include-- 7i7 mitigating risks associated with such incidents before substantial damage is done2 7ii7 notifying and consulting with the ,federal information security incident center established in section #ceef2 and 7iii7 notifying and consulting with1 as appropriate-- 7,i7 law enforcement agencies and relevant ,offices of ,inspector ,general and ,offices of ,general ,counsel2 7,,ii7 an office designated by the ,president for any incident involving a national security system2 7,,iii7 for a major incident1 the committees of ,congress described in subsection 7c77#a7-- 7aa7 not later than #g days after the date on which there is a reasonable basis to conclude that the major incident has occurred2 and 7bb7 after the initial notification under item 7aa71 within a reasonable period of time after additional information relating to the incident is discovered1 including the summary required under subsection 7c77#a77;,a77i72 and 7,,iv7 any other agency or office1 in accordance with law or as directed by the ,president2 and 7#h7 plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency4 7c7 ,agency reporting 7#a7 ,annual report 7,a7 ,in general ,each agency shall submit to the ,director1 the ,secretary1 the ,committee on ,government ,reform1 the ,committee on ,homeland ,security1 and the ,committee on ,science of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 the appropriate authorization and appropriations committees of ,congress1 and the ,comptroller ,general a report on the adequacy and effectiveness of information security policies1 procedures1 and practices1 including-- 7i7 a description of each major information security incident or related sets of incidents1 including summaries of-- 7,i7 the threats and threat actors1 vulnerabilities1 and impacts relating to the incident2 7,,ii7 the risk assessments conducted under section #ceed7;a77#b77;,a7 of the affected information systems before the date on which the incident occurred2 7,,iii7 the status of compliance of the affected information systems with applicable security requirements at the time of the incident2 and 7,,iv7 the detection1 response1 and remediation actions2 7ii7 the total number of information security incidents1 including a description of incidents resulting in significant compromise of information security1 system impact levels1 types of incident1 and locations of affected systems2 7iii7 a description of each major information security incident that involved a breach of personally identifiable information1 as defined by the ,director1 including-- 7,i7 the number of individuals whose information was affected by the major information security incident2 and 7,,ii7 a description of the information that was breached or exposed2 and 7iv7 any other information as the ,director or the ,secretary1 in consultation with the ,director1 may require4 7,b7 ,unclassified report 7i7 ,in general ,each report submitted under subparagraph 7,a7 shall be in unclassified form1 but may include a classified annex4 7ii7 ,access to information ,the head of an agency shall ensure that1 to the greatest extent practicable1 information is included in the unclassified version of the reports submitted by the agency under subparagraph 7,a74 7#b7 ,other plans and reports ,each agency shall address the adequacy and effectiveness of information security policies1 procedures1 and practices in management plans and reports4 7d7 ,performance plan 7#a7 ,in addition to the requirements of subsection 7c71 each agency1 in consultation with the ,director1 shall include as part of the performance plan required under section #aaae of title #ca a description of-- 7,a7 the time periods2 and 7,b7 the resources1 including budget1 staffing1 and training1 that are necessary to implement the program required under subsection 7b74 7#b7 ,the description under paragraph 7#a7 shall be based on the risk assessments required under subsection 7b77#a74 7e7 ,public notice and comment ,each agency shall provide the public with timely notice and opportunities for comment on proposed information security policies and procedures to the extent that such policies and procedures affect communication with the public4 #ceee4 ,annual independent evaluation 7a7 ,in general 7#a7 ,each year each agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices4 7#b7 ,each evaluation under this section shall include-- 7,a7 testing of the effectiveness of information security policies1 procedures1 and practices of a representative subset of the agency's information systems2 7,b7 an assessment of the effectiveness of the information security policies1 procedures1 and practices of the agency2 and 7,c7 separate presentations1 as appropriate1 regarding information security relating to national security systems4 7b7 ,independent auditor ,subject to subsection 7c7-- 7#a7 for each agency with an ,inspector ,general appointed under the ,inspector ,general ,act of #aigh1 the annual evaluation required by this section shall be performed by the ,inspector ,general or by an independent external auditor1 as determined by the ,inspector ,general of the agency2 and 7#b7 for each agency to which paragraph 7#a7 does not apply1 the head of the agency shall engage an independent external auditor to perform the evaluation4 7c7 ,national security systems ,for each agency operating or exercising control of a national security system1 that portion of the evaluation required by this section directly relating to a national security system shall be performed-- 7#a7 only by an entity designated by the agency head2 and 7#b7 in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws4 7d7 ,existing evaluations ,the evaluation required by this section may be based in whole or in part on an audit1 evaluation1 or report relating to programs or practices of the applicable agency4 7e7 ,agency reporting 7#a7 ,each year1 not later than such date established by the ,director1 the head of each agency shall submit to the ,director the results of the evaluation required under this section4 7#b7 ,to the extent an evaluation required under this section directly relates to a national security system1 the evaluation results submitted to the ,director shall contain only a summary and assessment of that portion of the evaluation directly relating to a national security system4 7f7 ,protection of information ,agencies and evaluators shall take appropriate steps to ensure the protection of information which1 if disclosed1 may adversely affect information security4 ,such protections shall be commensurate with the risk and comply with all applicable laws and regulations4 7g7 ,,omb reports to ,congress 7#a7 ,the ,director shall summarize the results of the evaluations conducted under this section in the report to ,congress required under section #ceec7;c74 7#b7 ,the ,director's report to ,congress under this subsection shall summarize information regarding information security relating to national security systems in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws4 7#c7 ,evaluations and any other descriptions of information systems under the authority and control of the ,director of ,national ,intelligence or of ,national ,foreign ,intelligence ,programs systems under the authority and control of the ,secretary of ,defense shall be made available to ,congress only through the appropriate oversight committees of ,congress1 in accordance with applicable laws4 7h7 ,comptroller ,general ,the ,comptroller ,general shall periodically evaluate and report to ,congress on-- 7#a7 the adequacy and effectiveness of agency information security policies and practices2 and 7#b7 implementation of the requirements of this subchapter4 7i7 ,assessment technical assistance ,the ,comptroller ,general may provide technical assistance to an ,inspector ,general or the head of an agency1 as applicable1 to assist the ,inspector ,general or head of an agency in carrying out the duties under this section1 including by testing information security controls and procedures4 7j7 ,guidance ,the ,director1 in consultation with the ,secretary1 the ,chief ,information ,officers ,council established under section #cfjc1 the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 and other interested parties as appropriate1 shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices4 #ceef4 ,federal information security incident center 7a7 ,in general ,the ,secretary shall ensure the operation of a central ,federal information security incident center to-- 7#a7 provide timely technical assistance to operators of agency information systems regarding security incidents1 including guidance on detecting and handling information security incidents2 7#b7 compile and analyze information about incidents that threaten information security2 7#c7 inform operators of agency information systems about current and potential information security threats1 and vulnerabilities2 7#d7 provide1 as appropriate1 intelligence and other information about cyber threats1 vulnerabilities1 and incidents to agencies to assist in risk assessments conducted under section #ceed7;b72 and 7#e7 consult with the ,national ,institute of ,standards and ,technology1 agencies or offices operating or exercising control of national security systems 7including the ,national ,security ,agency71 and such other agencies or offices in accordance with law and as directed by the ,president regarding information security incidents and related matters4 7b7 ,national security systems ,each agency operating or exercising control of a national security system shall share information about information security incidents1 threats1 and vulnerabilities with the ,federal information security incident center to the extent consistent with standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president4 #ceeg4 ,national security systems ,the head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency-- 7#a7 provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of the information contained in such system2 7#b7 implements information security policies and practices as required by standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president2 and 7#c7 complies with the requirements of this subchapter4 #ceeh4 ,effect on existing law ,nothing in this subchapter1 section #aacca of title #dj1 or section #bj of the ,national ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 may be construed as affecting the authority of the ,president1 the ,office of ,management and ,budget or the ,director thereof1 the ,national ,institute of ,standards and ,technology1 or the head of any agency1 with respect to the authorized use or disclosure of information1 including with regard to the protection of personal privacy under section #eeb;a of title #e1 the disclosure of information under section #eeb of title #e1 the management and disposition of records under chapters #bi1 #ca1 or #cc of title #dd1 the management of information resources under subchapter ,i of chapter #ce of this title1 or the disclosure of information to the ,congress or the ,comptroller ,general of the ,united ,states4 4 7b7 ,major incident ,the ,director of the ,office of ,management and ,budget shall-- 7#a7 develop guidance on what constitutes a major incident for purposes of section #ceed7;b7 of title #dd1 ,united ,states ,code1 as added by subsection 7a72 and 7#b7 provide to ,congress periodic briefings on the status of the developing of the guidance until the date on which the guidance is issued4 7c7 ,continuous diagnostics ,during the #b year period beginning on the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget1 with the assistance of the ,secretary of ,homeland ,security1 shall include in each report submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code1 as added by subsection 7a71 an assessment of the adoption by agencies of continuous diagnostics technologies1 including through the ,continuous ,diagnostics and ,mitigation program1 and other advanced security tools to provide information security1 including challenges to the adoption of such technologies or security tools4 7d7 ,breaches 7#a7 ,requirements ,the ,director of the ,office of ,management and ,budget shall ensure that data breach notification policies and guidelines are updated periodically and require-- 7,a7 except as provided in paragraph 7#d71 notice by the affected agency to each committee of ,congress described in section #ceed7;c77#a7 of title #dd1 ,united ,states ,code1 as added by subsection 7a71 the ,committee on the ,judiciary of the ,senate1 and the ,committee on the ,judiciary of the ,house of ,representatives1 which shall-- 7i7 be provided expeditiously and not later than #cj days after the date on which the agency discovered the unauthorized acquisition or access2 and 7ii7 include-- 7,i7 information about the breach1 including a summary of any information that the agency knows on the date on which notification is provided about how the breach occurred2 7,,ii7 an estimate of the number of individuals affected by the breach1 based on information that the agency knows on the date on which notification is provided1 including an assessment of the risk of harm to affected individuals2 7,,iii7 a description of any circumstances necessitating a delay in providing notice to affected individuals2 and 7,,iv7 an estimate of whether and when the agency will provide notice to affected individuals2 and 7,b7 notice by the affected agency to affected individuals1 pursuant to data breach notification policies and guidelines1 which shall be provided as expeditiously as practicable and without unreasonable delay after the agency discovers the unauthorized acquisition or access4 7#b7 ,national security2 law enforcement2 remediation ,the ,attorney ,general1 the head of an element of the intelligence community 7as such term is defined under section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d771 or the ,secretary of ,homeland ,security may delay the notice to affected individuals under paragraph 7#a77;,b7 if the notice would disrupt a law enforcement investigation1 endanger national security1 or hamper security remediation actions4 7#c7 ,reports 7,a7 ,director of ,,omb ,during the first #b years beginning after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall1 on an annual basis-- 7i7 assess agency implementation of data breach notification policies and guidelines in aggregate2 and 7ii7 include the assessment described in clause 7i7 in the report required under section #ceec7;c7 of title #dd1 ,united ,states ,code4 7,b7 ,secretary of ,homeland ,security ,during the first #b years beginning after the date of enactment of this ,act1 the ,secretary of ,homeland ,security shall include an assessment of the status of agency implementation of data breach notification policies and guidelines in the requirements under section #ceec7;b77#b77;,b7 of title #dd1 ,united ,states ,code4 7#d7 ,exception ,any element of the intelligence community 7as such term is defined under section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d77 that is required to provide notice under paragraph 7#a77;,a7 shall only provide such notice to appropriate committees of ,congress4 7#e7 ,rule of construction ,nothing in paragraph 7#a7 shall be construed to alter any authority of a ,federal agency or department4 7e7 ,technical and conforming amendments 7#a7 ,table of sections ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code is amended by striking the matter relating to subchapters ,,ii and ,,iii and inserting the following3 ,,subchapter ,,ii--,information security#ceea4 ,purposes4#ceeb4 ,definitions4#ceec4 ,authority and functions of the ,director and the ,secretary4#ceed4 ,federal agency responsibilities4#ceee4 ,annual independent evaluation4#ceef4 ,federal information security incident center4#ceeg4 ,national security systems4#ceeh4 ,effect on existing law4 4 7#b7 ,cybersecurity ,research and ,development ,act ,section #h7;d77#a7 of the ,cybersecurity ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7 is amended by striking section #cecd and inserting section #ceed4 7#c7 ,homeland ,security ,act of #bjjb ,the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja et seq47 is amended-- 7,a7 in section #bbc 7#f ,u4,s4,c4 #adc7 7i7 in the section heading1 by inserting ,federal and before non-,federal2 7ii7 in the matter preceding paragraph 7#a71 by striking the ,under ,secretary for ,intelligence and ,analysis1 in cooperation with the ,assistant ,secretary for ,infrastructure ,protection and inserting the ,under ,secretary appointed under section #ajc7;a77#a77;,h72 7iii7 in paragraph 7#b71 by striking the period at the end and inserting 2 and2 and 7iv7 by adding at the end the following3 7#c7 fulfill the responsibilities of the ,secretary to protect ,federal information systems under subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code4 2 7,b7 in section #ajja7;c77#a77;,a7 7#f ,u4,s4,c4 #eaa7;c77#a77;,a771 by striking section #cecb7c7 and inserting section #ceeb7;b77#e72 and 7,c7 in the table of contents in section #a7;b71 by striking the item relating to section #bbc and inserting the following3 ,sec4 #bbc4 ,enhancement of ,federal and non-,federal cybersecurity4 4 7#d7 ,national ,institute of ,standards and ,technology ,act ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7,a7 in subsection 7a77#b71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b77#e72 and 7,b7 in subsection 7e7-- 7i7 in paragraph 7#b71 by striking section #cecb7a7 and inserting section #ceeb7;b77#b72 and 7ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b77#e74 7#e7 ,title #aj ,title #aj1 ,united ,states ,code1 is amended-- 7,a7 in section #bbbb7;j77#e71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b77#e72 7,b7 in section #bbbc7;c77#c71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b77#e72 and 7,c7 in section #bcae1 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b77#e74 7f7 ,other provisions 7#a7 ,circular ,a-#acj ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall amend or revise ,office of ,management and ,budget ,circular ,a-#acj to eliminate inefficient or wasteful reporting4 ,the ,director of the ,office of ,management and ,budget shall provide quarterly briefings to ,congress on the status of the amendment or revision required under this paragraph4 7#b7 ,,ispab ,section #ba7;b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#d7;b77 is amended-- 7,a7 in paragraph 7#b71 by inserting 1 the ,secretary of ,homeland ,security1 after the ,institute2 and 7,b7 in paragraph 7#c71 by inserting the ,secretary of ,homeland ,security1 after the ,secretary of ,commerce14 ,speaker of the ,house of ,representatives ,vice ,president of the ,united ,states and ,president of the ,senate