,,ii  #aac? ,,congress  #b;d ,session   
,s4 #beba  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,june #bd1 #bjad ,mr4  
,c>p] 7= himself & ,mr4 ,coburn7        
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to am5d *apt] #ce ( title 
#dd1 ,unit$ ,/ates ,code1 to provide =  
re=m to ,f$]al in=mation security4  #a4 
,%ort title  ,?is ,act may be cit$ z !  
,f$]al ,in=mation ,security             
,mod]nization ,act ( #bjad4  #b4 ,,fisma
 re=m  7a7 ,9 g5]al ,*apt] #ce ( title  
#dd1 ,unit$ ,/ates ,code1 is am5d$ by   
/rik+ sub*apt]s ,,ii & ,,iii & ins]t+ ! 
foll[+3  ,,ii  ,in=mation security      
#ceea4  ,purposes  ,! purposes ( ?is    
sub*apt] are to--  7#a7 provide a       
compreh5sive framework = ensur+ !       
effectiv5ess ( in=mation security       
controls ov] in=mation res\rces t       
support ,f$]al op]ations & assets2  7#b7
 recognize ! highly network$ nature ( ! 
curr5t ,f$]al comput+ environm5t &      

provide effective gov]nm5twide managem5t
 & ov]sight ( ! relat$ in=mation        
security risks1 includ+ coord9ation (   
in=mation security ef=ts ?r\gh\t !      
civilian1 national security1 & law      
en=cem5t communities2  7#c7 provide =   
developm5t & ma9t5ance ( m9imum controls
 requir$ to protect ,f$]al in=mation &  
in=mation sy/ems2  7#d7 provide a       
me*anism = improv$ ov]sight ( ,f$]al    
ag5cy in=mation security programs2  7#e7
 ackn[l$ge t comm]cially develop$       
in=mation security products (f] advanc$1
 dynamic1 robu/1 & effective in=mation  
security solutions1 reflect+ m>ket      
solutions = ! protection ( critical     
in=mation infra/ructures important to ! 
national def5se & economic security ( ! 
nation t are design$1 built1 & op]at$ by
 ! private sector2 &  7#f7 recognize t !
 selection ( specific te*nical h>dw>e & 
s(tw>e in=mation security solutions %\ld
 be left to individual ag5cies f among  
comm]cially develop$ products4  #ceeb4  
,def9itions  7a7  ,9 g5]al  ,except z   

provid$ "u subsection 7b71 ! def9itions 
"u section #cejb %all apply to ?is      
sub*apt]4  7b7  ,additional def9itions  
,z us$ 9 ?is sub*apt]3  7#a7 ,! t]m b9d+
 op]ational directive means a compulsory
 direction to an ag5cy t is 9 accordance
 ) policies1 pr9ciples1 /&>ds1 &        
guidel9es issu$ by ! ,director4  7#b7 ,!
 t]m incid5t means an occurr5ce t-- 7,a7
 actually or imm95tly jeop>dizes1 )\t   
lawful au?ority1 ! integrity1           
confid5tiality1 or availability (       
in=mation or an in=mation sy/em2 or     
7,b7 con/itutes a violation or imm95t   
?reat ( violation ( law1 security       
policies1 security proc$ures1 or        
acceptable use policies4  7#c7 ,! t]m   
in=mation security means protect+       
in=mation & in=mation sy/ems f          
unau?oriz$ access1 use1 disclosure1     
disruption1 modification1 or de/ruction 
9 ord] to provide--  7,a7 integrity1 :i*
 means gu>d+ aga9/ improp] in=mation    
modification or de/ruction1 & includes  
ensur+ in=mation nonrepudiation &       

au!nticity2  7,b7 confid5tiality1 :i*   
means pres]v+ au?oriz$ re/rictions on   
access & disclosure1 includ+ means =    
protect+ p]sonal privacy & propriet>y   
in=mation2 &  7,c7 availability1 :i*    
means ensur+ timely & reliable access to
 & use ( in=mation4  7#d7 ,! t]m        
in=mation te*nology has ! mean+ giv5 t  
t]m 9 section #aaaja ( title #dj4  7#e7 
,! t]m intellig5ce community has ! mean+
 giv5 t t]m 9 section #c7d7 ( !         
,national ,security ,act ( #aidg 7#ej   
,u4,s4,c4 #cjjc7d774  7#f7  7,a7 ,! t]m 
national security sy/em means any       
in=mation sy/em 7includ+ any            
telecommunications sy/em7 us$ or op]at$ 
by an ag5cy or by a contractor ( an     
ag5cy1 or o!r organization on behalf (  
an ag5cy--  7i7 ! function1 op]ation1 or
 use ( :i*--  7,i7 involves intellig5ce 
activities2  7,,ii7 involves cryptologic
 activities relat$ to national security2
  7,,iii7 involves comm& & control (    
milit>y =ces2  7,,iv7 involves equipm5t 
t is an integral "p ( a weapon or       

weapons sy/em2 or  7,v7 subject to      
subp>agraph 7,b71 is critical to !      
direct fulfillm5t ( milit>y or          
intellig5ce missions2 or  7ii7 is       
protect$ at all times by proc$ures      
e/abli%$ = in=mation t h be5            
specifically au?oriz$ "u crit]ia        
e/abli%$ by an ,executive ord] or an    
,act ( ,congress to be kept classifi$ 9 
! int]e/ ( national def5se or =eign     
policy4  7,b7 ,subp>agraph 7,a77i77,v7  
does n include a sy/em t is to be us$ = 
r\t9e adm9i/rative & bus9ess            
applications 7includ+ payroll1 f9ance1  
logi/ics1 & p]sonnel managem5t          
applications74  7#g7 ,! t]m ,secret>y   
means ! ,secret>y ( ,homel& ,security4  
#ceec4  ,au?ority & functions ( !       
,director & ! ,secret>y  7a7  ,director 
,! ,director %all ov]see ag5cy in=mation
 security policies1 includ+--  7#a7     
develop+ & ov]see+ ! implem5tation (    
policies1 pr9ciples1 /&>ds1 & guidel9es 
on in=mation security1 includ+ ?r\gh    
ensur+ timely ag5cy adoption ( &        

compliance ) /&>ds promulgat$ "u section
 #aacca ( title #dj2  7#b7 requir+      
ag5cies1 consi/5t ) ! /&>ds promulgat$  
"u su* section #aacca & ! requirem5ts ( 
?is sub*apt]1 to id5tify & provide      
in=mation security protections          
comm5surate ) ! risk & magnitude ( ! h>m
 result+ f ! unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction (--  7,a7 in=mation collect$
 or ma9ta9$ by or on behalf ( an ag5cy2 
or  7,b7 in=mation sy/ems us$ or op]at$ 
by an ag5cy or by a contractor ( an     
ag5cy or o!r organization on behalf ( an
 ag5cy2  7#c7 ensur+ t ! ,secret>y      
c>ries out ! au?orities & functions "u  
subsection 7b72  7#d7 coord9at+ !       
developm5t ( /&>ds & guidel9es "u       
section #bj ( ! ,national ,in/itute (   
,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 
#bgh;g-#c7 ) ag5cies & (fices op]at+ or 
ex]cis+ control ( national security     
sy/ems 7includ+ ! ,national ,security   
,ag5cy7 to assure1 to ! maximum ext5t   
feasible1 t su* /&>ds & guidel9es are   

complem5t>y ) /&>ds & guidel9es develop$
 = national security sy/ems2  7#e7      
ov]see+ ag5cy compliance ) ! requirem5ts
 ( ?is sub*apt]1 includ+ ?r\gh any      
au?oriz$ action "u section #aacjc (     
title #dj1 to en=ce acc\ntability =     
compliance ) su* requirem5ts2  7#f7     
coord9at+ in=mation security policies & 
proc$ures ) relat$ in=mation res\rces   
managem5t policies & proc$ures2 &  7#g7 
consult+ ) ! ,secret>y 9 c>ry+ out !    
au?orities & functions "u ?is           
subsection4  7b7 ,secret>y ,! ,secret>y1
 9 consultation ) ! ,director1 %all     
ov]see ! op]ational aspects ( ag5cy     
in=mation security policies & practices 
= in=mation sy/ems1 except = national   
security sy/ems & in=mation sy/ems      
describ$ 9 p>agraph 7#b7 or 7#c7 (      
subsection 7e71 includ+-- 7#a7 assi/+ ! 
,director 9 c>ry+ out ! au?orities &    
functions "u subsection 7a72  7#b7      
develop+ & ov]see+ ! implem5tation (    
b9d+ op]ational directives to ag5cies to
 implem5t ! policies1 pr9ciples1 /&>ds1 

& guidel9es develop$ by ! ,director "u  
subsection 7a77#a7 & ! requirem5ts ( ?is
 sub*apt]1 :i* may be repeal$ by !      
,director if ! op]ational directives    
issu$ on behalf ( ! ,director are n 9   
accordance ) policies1 pr9ciples1 /&>ds1
 & guidel9es develop$ by ! ,director1   
includ+--  7,a7 requirem5ts = report+   
security incid5ts to ! ,f$]al in=mation 
security incid5t c5t] e/abli%$ "u       
section #ceef2  7,b7 requirem5ts = !    
cont5ts ( ! annual reports requir$ to be
 submitt$ "u section #ceed7;c77#a72     
7,c7 requirem5ts = ! mitigation ( exig5t
 risks to in=mation sy/ems2 &  7,d7 o!r 
op]ational requirem5ts z ! ,director or 
,secret>y may det]m9e necess>y2  7#c7   
monitor+ ag5cy implem5tation ( in=mation
 security policies & practices2  7#d7   
conv5+ meet+s ) s5ior ag5cy (ficials to 
help ensure effective implem5tation (   
in=mation security policies & practices2
  7#e7 coord9at+ ,gov]nm5t-wide ef=ts on
 in=mation security policies &          
practices1 includ+ consultation ) !     

,*ief ,in=mation ,(fic]s ,c\ncil        
e/abli%$ "u section #cfjc2  7#f7 provid+
 op]ational & te*nical assi/ance to     
ag5cies 9 implem5t+ policies1 pr9ciples1
 /&>ds1 & guidel9es on in=mation        
security1 includ+ implem5tation ( /&>ds 
promulgat$ "u section #aacca ( title    
#dj1 includ+ by-- 7,a7 op]at+ ! ,f$]al  
in=mation security incid5t c5t] e/abli%$
 "u section #ceef2  7,b7 ^u reque/ by an
 ag5cy1 deploy+ te*nology to assi/ !    
ag5cy to cont9u\sly diagnose & mitigate 
aga9/ cyb] ?reats & vuln]abilities1 ) or
 )\t reimbursem5t2  7,c7 compil+ &      
analyz+ data on ag5cy in=mation         
security2 &  7,d7 develop+ & conduct+   
t>get$ op]ational evaluations1 includ+  
?reat & vuln]ability assessm5ts1 on !   
in=mation sy/ems2 &  7#g7 o!r actions z 
! ,secret>y may det]m9e necess>y to c>ry
 out ?is subsection on behalf ( !       
,director4  7c7 ,report ,n lat] ?an ,m>*
 #a ( ea* ye>1 ! ,director1 9           
consultation ) ! ,secret>y1 %all submit 
to ,congress a report on ! effectiv5ess 

( in=mation security policies &         
practices dur+ ! prec$+ ye>1 includ+--  
7#a7 a summ>y ( ! incid5ts describ$ 9 ! 
annual reports requir$ to be submitt$ "u
 section #ceed7;c77#a71 includ+ a summ>y
 ( ! in=mation requir$ "u section       
#ceed7;c77#a77;,a77iii72  7#b7 a        
description ( ! ?re%old = report+ major 
in=mation security incid5ts2  7#c7 a    
summ>y ( ! results ( evaluations requir$
 to be p]=m$ "u section #ceee2  7#d7 an 
assessm5t ( ag5cy compliance ) /&>ds    
promulgat$ "u section #aacca ( title    
#dj2 &  7#e7 an assessm5t ( ag5cy       
compliance ) ! policies & proc$ures     
e/abli%$ "u section #ceei7;a74  7d7     
,national security sy/ems  ,except = !  
au?orities & functions describ$ 9       
subsection 7a77#d7 & subsection 7c71 !  
au?orities & functions ( ! ,director & !
 ,secret>y "u ?is section %all n apply  
to national security sy/ems4  7e7       
,dep>tm5t ( ,def5se & ,intellig5ce      
community sy/ems  7#a7 ,! au?orities ( !
 ,director describ$ 9 p>agraphs 7#a7 &  

7#b7 ( subsection 7a7 %all be delegat$  
to ! ,secret>y ( ,def5se 9 ! case (     
sy/ems describ$ 9 p>agraph 7#b7 & to !  
,director ( ,national ,intellig5ce 9 !  
case ( sy/ems describ$ 9 p>agraph 7#c74 
7#b7 ,! sy/ems describ$ 9 ?is p>agraph  
are sy/ems t are op]at$ by ! ,dep>tm5t (
 ,def5se1 a contractor ( ! ,dep>tm5t (  
,def5se1 or ano!r entity on behalf ( !  
,dep>tm5t ( ,def5se t processes any     
in=mation ! unau?oriz$ access1 use1     
disclosure1 disruption1 modification1 or
 de/ruction ( :i* w\ld h a debilitat+   
impact on ! mission ( ! ,dep>tm5t (     
,def5se4  7#c7 ,! sy/ems describ$ 9 ?is 
p>agraph are sy/ems t are op]at$ by an  
elem5t ( ! intellig5ce community1 a     
contractor ( an elem5t ( ! intellig5ce  
community1 or ano!r entity on behalf (  
an elem5t ( ! intellig5ce community t   
processes any in=mation ! unau?oriz$    
access1 use1 disclosure1 disruption1    
modification1 or de/ruction ( :i* w\ld h
 a debilitat+ impact on ! mission ( an  
elem5t ( ! intellig5ce community4       

#ceed4  ,f$]al ag5cy responsibilities   
7a7  ,9 g5]al  ,! head ( ea* ag5cy      
%all--  7#a7 be responsible =--  7,a7   
provid+ in=mation security protections  
comm5surate ) ! risk & magnitude ( ! h>m
 result+ f unau?oriz$ access1 use1      
disclosure1 disruption1 modification1 or
 de/ruction (--  7i7 in=mation collect$ 
or ma9ta9$ by or on behalf ( ! ag5cy2 & 
7ii7 in=mation sy/ems us$ or op]at$ by  
an ag5cy or by a contractor ( an ag5cy  
or o!r organization on behalf ( an      
ag5cy2  7,b7 comply+ ) ! requirem5ts (  
?is sub*apt] & relat$ policies1         
proc$ures1 /&>ds1 & guidel9es1 includ+--
  7i7 in=mation security /&>ds          
promulgat$ "u section #aacca ( title    
#dj2  7ii7 op]ational directives        
develop$ by ! ,secret>y "u section      
#ceec7;b72  7iii7 policies & proc$ures  
issu$ by ! ,director "u section #ceei2 &
  7iv7 in=mation security /&>ds &       
guidel9es = national security sy/ems    
issu$ 9 accordance ) law & z direct$ by 
! ,presid5t2 &  7,c7 ensur+ t in=mation 

security managem5t processes are        
integrat$ ) ag5cy /rategic & op]ational 
plann+ processes2  7#b7 ensure t s5ior  
ag5cy (ficials provide in=mation        
security = ! in=mation & in=mation      
sy/ems t support ! op]ations & assets "u
 _! control1 includ+ ?r\gh--  7,a7      
assess+ ! risk & magnitude ( ! h>m t    
c\ld result f ! unau?oriz$ access1 use1 
disclosure1 disruption1 modification1 or
 de/ruction ( su* in=mation or in=mation
 sy/ems2  7,b7 det]m9+ ! levels (       
in=mation security appropriate to       
protect su* in=mation & in=mation sy/ems
 9 accordance ) /&>ds promulgat$ "u     
section #aacca ( title #dj1 = in=mation 
security classifications & relat$       
requirem5ts2  7,c7 implem5t+ policies & 
proc$ures to co/-effectively r$uce risks
 to an acceptable level2 &  7,d7        
p]iodically te/+ & evaluat+ in=mation   
security controls & te*niques to ensure 
t !y are effectively implem5t$2  7#c7   
delegate to ! ag5cy ,*ief ,in=mation    
,(fic] e/abli%$ "u section #cejf 7or    

comp>able (ficial 9 an ag5cy n cov]$ by 
su* section7 ! au?ority to ensure       
compliance ) ! requirem5ts impos$ on !  
ag5cy "u ?is sub*apt]1 includ+--  7,a7  
designat+ a s5ior ag5cy in=mation       
security (fic] :o %all--  7i7 c>ry out !
 ,*ief ,in=mation ,(fic]'s              
responsibilities "u ?is section2  7ii7  
possess pr(essional qualifications1     
includ+ tra9+ & exp]i5ce1 requir$ to    
adm9i/] ! functions describ$ "u ?is     
section2  7iii7 h in=mation security    
duties z t (ficial's prim>y duty2 &     
7iv7 head an (fice ) ! mission &        
res\rces to assi/ 9 ensur+ ag5cy        
compliance ) ?is section2  7,b7 develop+
 & ma9ta9+ an ag5cywide in=mation       
security program z requir$ by subsection
 7b72  7,c7 develop+ & ma9ta9+ in=mation
 security policies1 proc$ures1 & control
 te*niques to address all applicable    
requirem5ts1 includ+ ^? issu$ "u section
 #ceec ( ?is title & section #aacca (   
title #dj2  7,d7 tra9+ & ov]see+        
p]sonnel ) significant responsibilities 

= in=mation security ) respect to su*   
responsibilities2 &  7,e7 assi/+ s5ior  
ag5cy (ficials conc]n+ _!               
responsibilities "u p>agraph 7#b72  7#d7
 ensure t ! ag5cy has tra9$ p]sonnel    
suffici5t to assi/ ! ag5cy 9 comply+ ) !
 requirem5ts ( ?is sub*apt] & relat$    
policies1 proc$ures1 /&>ds1 & guidel9es2
  7#e7 ensure t ! ag5cy ,*ief ,in=mation
 ,(fic]1 9 coord9ation ) o!r s5ior ag5cy
 (ficials1 reports annually to ! ag5cy  
head on ! effectiv5ess ( ! ag5cy        
in=mation security program1 includ+     
progress ( rem$ial actions2  7#f7 ensure
 t s5ior ag5cy (ficials1 includ+ *ief   
in=mation (fic]s ( compon5t ag5cies or  
equival5t (ficials1 c>ry out            
responsibilities "u ?is sub*apt] z      
direct$ by ! (ficial delegat$ au?ority  
"u p>agraph 7#c72 &  7#g7 ensure t all  
p]sonnel are held acc\ntable = comply+ )
 ! ag5cy-wide in=mation security program
 implem5t$ "u subsection 7b74  7b7      
,ag5cy program  ,ea* ag5cy %all develop1
 docum5t1 & implem5t an ag5cy-wide      

in=mation security program to provide   
in=mation security = ! in=mation &      
in=mation sy/ems t support ! op]ations &
 assets ( ! ag5cy1 includ+ ^? provid$ or
 manag$ by ano!r ag5cy1 contractor1 or  
o!r s\rce1 t includes--  7#a7 p]iodic   
assessm5ts ( ! risk & magnitude ( ! h>m 
t c\ld result f ! unau?oriz$ access1    
use1 disclosure1 disruption1            
modification1 or de/ruction ( in=mation 
& in=mation sy/ems t support ! op]ations
 & assets ( ! ag5cy2  7#b7 policies &   
proc$ures t--  7,a7 are bas$ on ! risk  
assessm5ts requir$ by p>agraph 7#a72    
7,b7 co/-effectively r$uce in=mation    
security risks to an acceptable level2  
7,c7 ensure t in=mation security is     
address$ ?r\gh\t ! life cycle ( ea*     
ag5cy in=mation sy/em2 &  7,d7 ensure   
compliance )--  7i7 ! requirem5ts ( ?is 
sub*apt]2  7ii7 policies & proc$ures z  
may be prescrib$ by ! ,director1 &      
in=mation security /&>ds promulgat$ "u  
section #aacca ( title #dj2  7iii7      
m9imally acceptable sy/em configuration 

requirem5ts1 z det]m9$ by ! ag5cy2 &    
7iv7 any o!r applicable requirem5ts1    
includ+ /&>ds & guidel9es = national    
security sy/ems issu$ 9 accordance ) law
 & z direct$ by ! ,presid5t2  7#c7      
subord9ate plans = provid+ adequate     
in=mation security = networks1          
facilities1 & sy/ems or gr\ps (         
in=mation sy/ems1 z appropriate2  7#d7  
security aw>5ess tra9+ to in=m p]sonnel1
 includ+ contractors & o!r us]s (       
in=mation sy/ems t support ! op]ations &
 assets ( ! ag5cy1 (--  7,a7 in=mation  
security risks associat$ ) _!           
activities2 &  7,b7 _! responsibilities 
9 comply+ ) ag5cy policies & proc$ures  
design$ to r$uce ^! risks2  7#e7 p]iodic
 te/+ & evaluation ( ! effectiv5ess (   
in=mation security policies1 proc$ures1 
& practices1 to be p]=m$ ) a frequ5cy   
dep5d+ on risk1 b no less ?an annually1 
( :i* su* te/+--  7,a7 %all include te/+
 ( managem5t1 op]ational1 & te*nical    
controls ( e in=mation sy/em id5tifi$ 9 
! inv5tory requir$ "u section #ceje7;c72

 &  7,b7 may include te/+ reli$ on 9 an 
evaluation "u section #ceee2  7#f7 a    
process = plann+1 implem5t+1 evaluat+1 &
 docum5t+ rem$ial action to address any 
defici5cies 9 ! in=mation security      
policies1 proc$ures1 & practices ( !    
ag5cy2  7#g7 proc$ures = detect+1       
report+1 & respond+ to security         
incid5ts1 consi/5t ) /&>ds & guidel9es  
describ$ 9 section #ceef7;b71 includ+-- 
7,a7 mitigat+ risks associat$ ) su*     
incid5ts be=e sub/antial damage is done2
  7,b7 notify+ & consult+ ) ! ,f$]al    
in=mation security incid5t c5t] e/abli%$
 9 section #ceef2 &  7,c7 notify+ &     
consult+ )1 z appropriate--  7i7 law    
en=cem5t ag5cies & relevant ,(fices (   
,inspector ,g5]al2  7ii7 an (fice       
designat$ by ! ,presid5t = any incid5t  
involv+ a national security sy/em2      
7iii7 ! committees ( ,congress describ$ 
9 subsection 7c77#a7-- 7,i7 n lat] ?an  
#g days aft] ! date on :i* ! incid5t is 
discov]$2 &  7,,ii7 aft] ! initial      
notification "u subclause 7,i71 )9 a    

reasonable p]iod ( "t aft] additional   
in=mation relat+ to ! incid5t is        
discov]$2 &  7iv7 any o!r ag5cy or      
(fice1 9 accordance ) law or z direct$  
by ! ,presid5t2 &  7#h7 plans &         
proc$ures to ensure cont9uity (         
op]ations = in=mation sy/ems t support !
 op]ations & assets ( ! ag5cy4  7c7     
,ag5cy report+  7#a7 ,annual report     
7,a7 ,9 g5]al ,ea* ag5cy %all submit to 
! ,director1 ! ,secret>y1 ! ,committee  
on ,gov]nm5t ,re=m1 ! ,committee on     
,homel& ,security1 & ! ,committee on    
,sci5ce ( ! ,h\se ( ,repres5tatives1 !  
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs & ! ,committee on  
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate1 ! appropriate au?orization &   
appropriations committees ( ,congress1 &
 ! ,comptroll] ,g5]al a report on !     
adequacy & effectiv5ess ( in=mation     
security policies1 proc$ures1 &         
practices1 includ+--  7i7 a description 
( ea* major in=mation security incid5t  
or relat$ sets ( incid5ts1 includ+      

summ>ies (-- 7,i7 ! ?reats & ?reat      
actors1 vuln]abilities1 & impacts relat+
 to ! incid5t2  7,,ii7 ! risk assessm5ts
 conduct$ "u section #ceed7;a77#b77;,a7 
( ! affect$ in=mation sy/ems be=e ! date
 on :i* ! incid5t occurr$2 &  7,,iii7 ! 
detection1 response1 & rem$iation       
actions2  7ii7 ! total numb] ( in=mation
 security incid5ts1 includ+ a           
description ( incid5ts result+ 9        
significant compromise ( in=mation      
security1 sy/em impact levels1 types (  
incid5t1 & locations ( affect$ sy/ems2  
7iii7 a description ( ea* major         
in=mation security incid5t t involv$ a  
brea* ( p]sonally id5tifiable in=mation1
 includ+-- 7,i7 ! numb] ( individuals ^:
 in=mation 0 affect$ by ! major         
in=mation security incid5t2 &  7,,ii7 a 
description ( ! in=mation t 0 brea*$ or 
expos$2 &  7iv7 any o!r in=mation z !   
,secret>y may require4  7,b7            
,unclassifi$ report  7i7 ,9 g5]al ,ea*  
report submitt$ "u subp>agraph 7,a7 %all
 be 9 unclassifi$ =m1 b may include a   

classifi$ annex4  7ii7 ,access to       
in=mation ,! head ( an ag5cy %all ensure
 t1 to ! greate/ ext5t practicable1     
in=mation is includ$ 9 ! unclassifi$    
v]sion ( ! reports submitt$ by ! ag5cy  
"u subp>agraph 7,a74  7#b7  ,o!r plans &
 reports ,ea* ag5cy %all address !      
adequacy & effectiv5ess ( in=mation     
security policies1 proc$ures1 &         
practices 9 managem5t plans & reports4  
7d7  ,p]=mance plan  7#a7 ,9 addition to
 ! requirem5ts ( subsection 7c71 ea*    
ag5cy1 9 consultation ) ! ,director1    
%all include z "p ( ! p]=mance plan     
requir$ "u section #aaae ( title #ca a  
description (--  7,a7 ! "t p]iods2 &    
7,b7 ! res\rces1 includ+ budget1 /aff+1 
& tra9+1  t are necess>y to implem5t !  
program requir$ "u subsection 7b74  7#b7
 ,! description "u p>agraph 7#a7 %all be
 bas$ on ! risk assessm5ts requir$ "u   
subsection 7b77#a74  7e7  ,public notice
 & comm5t  ,ea* ag5cy %all provide !    
public ) timely notice & opportunities =
 comm5t on propos$ in=mation security   

policies & proc$ures to ! ext5t t su*   
policies & proc$ures affect             
communication ) ! public4  #ceee4       
,annual indep5d5t evaluation  7a7  ,9   
g5]al  7#a7 ,ea* ye> ea* ag5cy %all h   
p]=m$ an indep5d5t evaluation ( !       
in=mation security program & practices (
 t ag5cy to det]m9e ! effectiv5ess ( su*
 program & practices4  7#b7 ,ea*        
evaluation "u ?is section %all include--
  7,a7 te/+ ( ! effectiv5ess ( in=mation
 security policies1 proc$ures1 &        
practices ( a repres5tative subset ( !  
ag5cy's in=mation sy/ems2  7,b7 an      
assessm5t ( ! effectiv5ess ( ! in=mation
 security policies1 proc$ures1 &        
practices ( ! ag5cy2 &  7,c7 sep>ate    
pres5tations1 z appropriate1 reg>d+     
in=mation security relat+ to national   
security sy/ems4  7b7  ,indep5d5t       
auditor  ,subject to subsection 7c7--   
7#a7 = ea* ag5cy ) an ,inspector ,g5]al 
appo9t$ "u ! ,inspector ,g5]al ,act (   
#aigh1 ! annual evaluation requir$ by   
?is section %all be p]=m$ by !          

,inspector ,g5]al or by an indep5d5t    
ext]nal auditor1 z det]m9$ by !         
,inspector ,g5]al ( ! ag5cy2 &  7#b7 =  
ea* ag5cy to :i* p>agraph 7#a7 does n   
apply1 ! head ( ! ag5cy %all engage an  
indep5d5t ext]nal auditor to p]=m !     
evaluation4  7c7  ,national security    
sy/ems  ,= ea* ag5cy op]at+ or ex]cis+  
control ( a national security sy/em1 t  
portion ( ! evaluation requir$ by ?is   
section directly relat+ to a national   
security sy/em %all be p]=m$--  7#a7    
only by an entity designat$ by ! ag5cy  
head2 &  7#b7 9 su* a mann] z to ensure 
appropriate protection = in=mation      
associat$ ) any in=mation security      
vuln]ability 9 su* sy/em comm5surate ) !
 risk & 9 accordance ) all applicable   
laws4  7d7  ,exi/+ evaluations  ,!      
evaluation requir$ by ?is section may be
 bas$ 9 :ole or 9 "p on an audit1       
evaluation1 or report relat+ to programs
 or practices ( ! applicable ag5cy4  7e7
  ,ag5cy report+  7#a7 ,ea* ye>1 n lat] 
?an su* date e/abli%$ by ! ,director1 ! 

head ( ea* ag5cy %all submit to !       
,director ! results ( ! evaluation      
requir$ "u ?is section4  7#b7 ,to !     
ext5t an evaluation requir$ "u ?is      
section directly relates to a national  
security sy/em1 ! evaluation results    
submitt$ to ! ,director %all conta9 only
 a summ>y & assessm5t ( t portion ( !   
evaluation directly relat+ to a national
 security sy/em4  7f7  ,protection (    
in=mation  ,ag5cies & evaluators %all   
take appropriate /eps to ensure !       
protection ( in=mation :i*1 if disclos$1
 may adv]sely affect in=mation security4
 ,su* protections %all be comm5surate ) 
! risk & comply ) all applicable laws & 
regulations4  7g7  ,,omb reports to     
,congress  7#a7 ,! ,director %all       
summ>ize ! results ( ! evaluations      
conduct$ "u ?is section 9 ! report to   
,congress requir$ "u section #ceec7;c74 
7#b7 ,! ,director's report to ,congress 
"u ?is subsection %all summ>ize         
in=mation reg>d+ in=mation security     
relat+ to national security sy/ems 9 su*

 a mann] z to ensure appropriate        
protection = in=mation associat$ ) any  
in=mation security vuln]ability 9 su*   
sy/em comm5surate ) ! risk & 9          
accordance ) all applicable laws4  7#c7 
,evaluations & any o!r descriptions (   
in=mation sy/ems "u ! au?ority & control
 ( ! ,director ( ,c5tral ,intellig5ce or
 ( ,national ,=eign ,intellig5ce        
,programs sy/ems "u ! au?ority & control
 ( ! ,secret>y ( ,def5se %all be made   
available to ,congress only ?r\gh !     
appropriate ov]sight committees (       
,congress1 9 accordance ) applicable    
laws4  7h7  ,comptroll] ,g5]al  ,!      
,comptroll] ,g5]al %all p]iodically     
evaluate & report to ,congress on--     
7#a7 ! adequacy & effectiv5ess ( ag5cy  
in=mation security policies & practices2
 &  7#b7 implem5tation ( ! requirem5ts (
 ?is sub*apt]4  7i7 ,assessm5t te*nical 
assi/ance ,! ,comptroll] ,g5]al may     
provide te*nical assi/ance to an        
,inspector ,g5]al or ! head ( an ag5cy1 
z applicable1 to assi/ ! ,inspector     

,g5]al or head ( an ag5cy 9 c>ry+ out ! 
duties "u ?is section1 includ+ by te/+  
in=mation security controls & proc$ures4
  #ceef4  ,f$]al in=mation security     
incid5t c5t]  7a7  ,9 g5]al  ,!         
,secret>y %all ensure ! op]ation ( a    
c5tral ,f$]al in=mation security incid5t
 c5t] to--  7#a7 provide timely te*nical
 assi/ance to op]ators ( ag5cy in=mation
 sy/ems reg>d+ security incid5ts1       
includ+ guidance on detect+ & h&l+      
in=mation security incid5ts2  7#b7      
compile & analyze in=mation ab\t        
incid5ts t ?reat5 in=mation security2   
7#c7 in=m op]ators ( ag5cy in=mation    
sy/ems ab\t curr5t & pot5tial in=mation 
security ?reats1 & vuln]abilities2  7#d7
 provide1 z appropriate1 intellig5ce &  
o!r in=mation ab\t cyb] ?reats1         
vuln]abilities1 & incid5ts to ag5cies to
 assi/ 9 risk assessm5ts conduct$ "u    
section #ceed7;b72 &  7#e7 consult ) !  
,national ,in/itute ( ,/&>ds &          
,te*nology1 ag5cies or (fices op]at+ or 
ex]cis+ control ( national security     

sy/ems 7includ+ ! ,national ,security   
,ag5cy71 & su* o!r ag5cies or (fices 9  
accordance ) law & z direct$ by !       
,presid5t reg>d+ in=mation security     
incid5ts & relat$ matt]s4  7b7          
,national security sy/ems  ,ea* ag5cy   
op]at+ or ex]cis+ control ( a national  
security sy/em %all %>e in=mation ab\t  
in=mation security incid5ts1 ?reats1 &  
vuln]abilities ) ! ,f$]al in=mation     
security incid5t c5t] to ! ext5t        
consi/5t ) /&>ds & guidel9es = national 
security sy/ems1 issu$ 9 accordance )   
law & z direct$ by ! ,presid5t4  #ceeg4 
,national security sy/ems  ,! head ( ea*
 ag5cy op]at+ or ex]cis+ control ( a    
national security sy/em %all be         
responsible = ensur+ t ! ag5cy--  7#a7  
provides in=mation security protections 
comm5surate ) ! risk & magnitude ( ! h>m
 result+ f ! unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction ( ! in=mation conta9$ 9 su* 
sy/em2  7#b7 implem5ts in=mation        
security policies & practices z requir$ 

by /&>ds & guidel9es = national security
 sy/ems1 issu$ 9 accordance ) law & z   
direct$ by ! ,presid5t2 &  7#c7 complies
 ) ! requirem5ts ( ?is sub*apt]4  #ceeh4
  ,effect on exi/+ law  ,no?+ 9 ?is     
sub*apt]1 section #aacca ( title #dj1 or
 section #bj ( ! ,national ,/&>ds &     
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7 may be con/ru$ z affect+ !   
au?ority ( ! ,presid5t1 ! ,(fice (      
,managem5t & ,budget or ! ,director     
!re(1 ! ,national ,in/itute ( ,/&>ds &  
,te*nology1 or ! head ( any ag5cy1 )    
respect to ! au?oriz$ use or disclosure 
( in=mation1 includ+ ) reg>d to !       
protection ( p]sonal privacy "u section 
#eeb;a ( title #e1 ! disclosure (       
in=mation "u section #eeb ( title #e1 ! 
managem5t & disposition ( records "u    
*apt]s #bi1 #ca1 or #cc ( title #dd1 !  
managem5t ( in=mation res\rces "u       
sub*apt] ,i ( *apt] #ce ( ?is title1 or 
! disclosure ( in=mation to ! ,congress 
or ! ,comptroll] ,g5]al ( ! ,unit$      
,/ates4  4  7b7 ,te*nical & con=m+      

am5dm5ts  7#a7 ,table ( sections ,!     
table ( sections = *apt] #ce ( title    
#dd1 ,unit$ ,/ates ,code is am5d$ by    
/rik+ ! matt] relat+ to sub*apt]s ,,ii &
 ,,iii & ins]t+ ! foll[+3  ,,sub*apt]   
,,ii--,in=mation security #ceea4        
,purposes4 #ceeb4 ,def9itions4 #ceec4   
,au?ority & functions ( ! ,director & ! 
,secret>y4 #ceed4 ,f$]al ag5cy          
responsibilities4 #ceee4 ,annual        
indep5d5t evaluation4 #ceef4 ,f$]al     
in=mation security incid5t c5t]4 #ceeg4 
,national security sy/ems4 #ceeh4       
,effect on exi/+ law4  4  7#b7          
,cyb]security ,rese>* & ,developm5t ,act
 ,section #h7;d77#a7 ( ! ,cyb]security  
,rese>* & ,developm5t ,act 7#ae         
,u4,s4,c4 #gdjf7 is am5d$ by /rik+      
section #cecd & ins]t+ section #ceed4   
7#c7 ,homel& ,security ,act ( #bjjb     
,section #ajja7;c77#a77;,a7 ( ! ,homel& 
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#eaa7 by /rik+ section #cecb7c7 & ins]t+
 section #ceeb7;b77#e74  7#d7 ,national 
,in/itute ( ,/&>ds & ,te*nology ,act    

,section #bj ( ! ,national ,in/itute (  
,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 
#bgh;g-#c7 is am5d$-- 7,a7 9 subsection 
7a77#b71 by /rik+ section #cecb7;b77#b7 
& ins]t+ section #ceeb7;b77#e72 &  7,b7 
9 subsection 7e7-- 7i7 9 p>agraph 7#b71 
by /rik+ section #cecb7a7 & ins]t+      
section #ceeb7;b77#b72 &  7ii7 9        
p>agraph 7#e71 by /rik+ section         
#cecb7;b77#b7 & ins]t+ section          
#ceeb7;b77#e74  7#e7 ,title #aj ,title  
#aj1 ,unit$ ,/ates ,code1 is am5d$--    
7,a7 9 section #bbbb7;j77#e71 by /rik+  
section #cedb7;b77#b7 & ins]t+ section  
#ceeb7;b77#e72  7,b7 9 section          
#bbbc7;c77#c71 by /rik+ section         
#cedb7;b77#b7 & ins]t+ section          
#ceeb7;b77#e72 &  7,c7 9 section #bcae1 
by /rik+ section #cedb7;b77#b7 & ins]t+ 
section #ceeb7;b77#e74  7c7 ,o!r        
provisions  7#a7 ,circul> ,a-#acj ,n    
lat] ?an #ahj days aft] ! date (        
enactm5t ( ?is ,act1 ! ,director ( !    
,(fice ( ,managem5t & ,budget %all      
revise ,(fice ( ,managem5t & ,budget    

,circul> ,a-#acj to elim9ate ineffici5t 
or wa/eful report+4  7#b7 ,,ispab       
,section #ba7;b7 ( ! ,national ,in/itute
 ( ,/&>ds & ,te*nology ,act 7#ae        
,u4,s4,c4 #bgh;g-#d7;b77 is am5d$-- 7,a7
 9 p>agraph 7#b71 by ins]t+ 1 !         
,secret>y ( ,homel& ,security1 aft] !   
,in/itute2 &  7,b7 9 p>agraph 7#c71 by  
ins]t+ ! ,secret>y ( ,homel& ,security1 
aft] ! ,secret>y ( ,comm]ce14  #c4      
,f$]al data brea* response guidel9es    
7a7 ,9 g5]al ,sub*apt] ,,ii ( *apt] #ce 
( title #dd1 ,unit$ ,/ates ,code1 z add$
 by ?is ,act1 is am5d$ by add+ at ! end 
! foll[+3  #ceei4 ,privacy brea*        
requirem5ts  7a7 ,policies & proc$ures  
,! ,director1 9 consultation ) !        
,secret>y1 %all e/abli% & ov]see        
policies & proc$ures = ag5cies to foll[ 
9 ! ev5t ( a brea* ( in=mation security 
involv+ ! disclosure ( p]sonally        
id5tifiable in=mation1 includ+          
requirem5ts =-- 7#a7 timely notice to   
affect$ individuals bas$ on a           
det]m9ation ( ! level ( risk & consi/5t 

) law en=cem5t & national security      
consid]ations2  7#b7 timely report+ to !
 ,f$]al in=mation security incid5t c5t] 
e/abli%$ "u section #ceef or o!r ,f$]al 
cyb]security c5t]1 z designat$ by !     
,director2  7#c7 timely notice to       
committees ( ,congress ) jurisdiction   
ov] cyb]security2 &  7#d7 su* additional
 actions z ! ,director may det]m9e      
necess>y & appropriate1 includ+ !       
provision ( risk mitigation measures to 
affect$ individuals4  7b7 ,consid]ations
 ,9 c>ry+ out subsection 7a71 !         
,director %all consid] recomm5dations   
made by ! ,gov]nm5t ,acc\ntability      
,(fice1 includ+ recomm5dations 9 !      
,decemb] #bjac ,gov]nm5t ,acc\ntability 
,(fice report entitl$ ,in=mation        
,security3 ,ag5cy ,responses to ,brea*es
 ( ,p]sonally ,id5tifiable ,in=mation   
,ne$ to ,be ,m ,consi/5t 7,,gao-#ad-cd74
  7c7 ,requir$ ag5cy action ,! head (   
ea* ag5cy %all ensure t actions tak5 9  
response to a brea* ( in=mation security
 involv+ ! disclosure ( p]sonally       

id5tifiable in=mation "u ! au?ority or  
control ( ! ag5cy comply ) policies &   
proc$ures e/abli%$ "u subsection 7a74   
7d7 ,timel9ess  7#a7 ,9 g5]al ,except z 
provid$ 9 p>agraph 7#b71 ! policies &   
proc$ures e/abli%$ "u subsection 7a7    
%all require t ! notice to affect$      
individuals requir$ "u subsection       
7a77#a7 be made )\t unreasonable delay &
 ) consid]ation ( ! likely risk ( h>m & 
! level ( impact1 b n lat] ?an #fj days 
aft] ! date on :i* ! head ( an ag5cy    
discov]s ! brea* ( in=mation security   
involv+ ! disclosure ( p]sonally        
id5tifiable in=mation4  7#b7 ,delay ,!  
,attorney ,g5]al1 ! head ( an elem5t ( !
 intellig5ce community 7z su* t]m is    
def9$ "u section #c7d7 ( ! ,national    
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc7d771 or ! ,secret>y may delay !   
notice to affect$ individuals "u        
subsection 7a77#a7 = n m ?an #ahj days1 
if ! notice w\ld disrupt a law en=cem5t 
inve/igation1 endang] national security1
 or hamp] security rem$iation actions f 

! brea* ( in=mation security involv+ !  
disclosure ( p]sonally id5tifiable      
in=mation4  4  7b7 ,te*nical & con=m+   
am5dm5t ,! table ( sections = sub*apt]  
,,ii = *apt] #ce ( title #dd1 ,unit$    
,/ates ,code1 z add$ by ?is ,act1 is    
am5d$ by ins]t+ aft] ! item relat+ to   
section #ceeh ! foll[+3  #ceei4 ,privacy
 brea* requirem5ts4  4