,,ii ,calendar ,no4 #efd #aacth         
,,congress  #b;d ,session  ,s4 #beba    
,report ,no4 #aac-bef ,,in ,,the        
,,senate ,,of ,,the ,,united ,,states   
,june #bd1 #bjad,mr4 ,carper 7for       
himself and ,mr4 ,coburn7 introduced the
 following bill2 which was read twice   
and referred to the ,committee on       
,homeland ,security and ,governmental   
,affairs  ,september #ae1 #bjad,reported
 by ,mr4 ,carper1 without amendment  ,a 
,,bill  ,to amend chapter #ce of title  
#dd1 ,united ,states ,code1 to provide  
for reform to ,federal information      
security4  #a4 ,short title ,this ,act  
may be cited as the ,federal            
,information ,security ,modernization   
,act of #bjad4  #b4 ,,fisma reform  7a7 
,in general ,chapter #ce of title #dd1  
,united ,states ,code1 is amended by    
striking subchapters ,,ii and ,,iii and 
inserting the following3  ,,ii          
,information security  #ceea4 ,purposes 
,the purposes of this subchapter are    
to-- 7#a7 provide a comprehensive       

framework for ensuring the effectiveness
 of information security controls over  
information resources that support      
,federal operations and assets2  7#b7   
recognize the highly networked nature of
 the current ,federal computing         
environment and provide effective       
governmentwide management and oversight 
of the related information security     
risks1 including coordination of        
information security efforts throughout 
the civilian1 national security1 and law
 enforcement communities2  7#c7 provide 
for development and maintenance of      
minimum controls required to protect    
,federal information and information    
systems2  7#d7 provide a mechanism for  
improved oversight of ,federal agency   
information security programs2  7#e7    
acknowledge that commercially developed 
information security products offer     
advanced1 dynamic1 robust1 and effective
 information security solutions1        
reflecting market solutions for the     
protection of critical information      

infrastructures important to the        
national defense and economic security  
of the nation that are designed1 built1 
and operated by the private sector2 and 
7#f7 recognize that the selection of    
specific technical hardware and software
 information security solutions should  
be left to individual agencies from     
among commercially developed products4  
#ceeb4 ,definitions  7a7 ,in general    
,except as provided under subsection    
7b71 the definitions under section #cejb
 shall apply to this subchapter4  7b7   
,additional definitions ,as used in this
 subchapter3 7#a7 ,the term binding     
operational directive means a compulsory
 direction to an agency that is in      
accordance with policies1 principles1   
standards1 and guidelines issued by the 
,director4  7#b7 ,the term incident     
means an occurrence that-- 7,a7 actually
 or imminently jeopardizes1 without     
lawful authority1 the integrity1        
confidentiality1 or availability of     
information or an information system2 or

  7,b7 constitutes a violation or       
imminent threat of violation of law1    
security policies1 security procedures1 
or acceptable use policies4  7#c7 ,the  
term information security means         
protecting information and information  
systems from unauthorized access1 use1  
disclosure1 disruption1 modification1 or
 destruction in order to provide-- 7,a7 
integrity1 which means guarding against 
improper information modification or    
destruction1 and includes ensuring      
information nonrepudiation and          
authenticity2  7,b7 confidentiality1    
which means preserving authorized       
restrictions on access and disclosure1  
including means for protecting personal 
privacy and proprietary information2 and
  7,c7 availability1 which means        
ensuring timely and reliable access to  
and use of information4  7#d7 ,the term 
information technology has the meaning  
given that term in section #aaaja of    
title #dj4  7#e7 ,the term intelligence 
community has the meaning given that    

term in section #c7d7 of the ,national  
,security ,act of #aidg 7#ej ,u4,s4,c4  
#cjjc7d774  7#f7 7,a7 ,the term national
 security system means any information  
system 7including any telecommunications
 system7 used or operated by an agency  
or by a contractor of an agency1 or     
other organization on behalf of an      
agency-- 7i7 the function1 operation1 or
 use of which-- 7,i7 involves           
intelligence activities2  7,,ii7        
involves cryptologic activities related 
to national security2  7,,iii7 involves 
command and control of military forces2 
7,,iv7 involves equipment that is an    
integral part of a weapon or weapons    
system2 or  7,v7 subject to subparagraph
 7,b71 is critical to the direct        
fulfillment of military or intelligence 
missions2 or  7ii7 is protected at all  
times by procedures established for     
information that have been specifically 
authorized under criteria established by
 an ,executive order or an ,act of      
,congress to be kept classified in the  

interest of national defense or foreign 
policy4  7,b7 ,subparagraph 7,a77i77,v7 
does not include a system that is to be 
used for routine administrative and     
business applications 7including        
payroll1 finance1 logistics1 and        
personnel management applications74     
7#g7 ,the term ,secretary means the     
,secretary of ,homeland ,security4      
#ceec4 ,authority and functions of the  
,director and the ,secretary  7a7       
,director ,the ,director shall oversee  
agency information security policies1   
including-- 7#a7 developing and         
overseeing the implementation of        
policies1 principles1 standards1 and    
guidelines on information security1     
including through ensuring timely agency
 adoption of and compliance with        
standards promulgated under section     
#aacca of title #dj2  7#b7 requiring    
agencies1 consistent with the standards 
promulgated under such section #aacca   
and the requirements of this subchapter1
 to identify and provide information    

security protections commensurate with  
the risk and magnitude of the harm      
resulting from the unauthorized access1 
use1 disclosure1 disruption1            
modification1 or destruction of-- 7,a7  
information collected or maintained by  
or on behalf of an agency2 or  7,b7     
information systems used or operated by 
an agency or by a contractor of an      
agency or other organization on behalf  
of an agency2  7#c7 ensuring that the   
,secretary carries out the authorities  
and functions under subsection 7b72     
7#d7 coordinating the development of    
standards and guidelines under section  
#bj of the ,national ,institute of      
,standards and ,technology ,act 7#ae    
,u4,s4,c4 #bgh;g-#c7 with agencies and  
offices operating or exercising control 
of national security systems 7including 
the ,national ,security ,agency7 to     
assure1 to the maximum extent feasible1 
that such standards and guidelines are  
complementary with standards and        
guidelines developed for national       

security systems2  7#e7 overseeing      
agency compliance with the requirements 
of this subchapter1 including through   
any authorized action under section     
#aacjc of title #dj1 to enforce         
accountability for compliance with such 
requirements2  7#f7 coordinating        
information security policies and       
procedures with related information     
resources management policies and       
procedures2 and  7#g7 consulting with   
the ,secretary in carrying out the      
authorities and functions under this    
subsection4  7b7 ,secretary ,the        
,secretary1 in consultation with the    
,director1 shall oversee the operational
 aspects of agency information security 
policies and practices for information  
systems1 except for national security   
systems and information systems         
described in paragraph 7#b7 or 7#c7 of  
subsection 7e71 including-- 7#a7        
assisting the ,director in carrying out 
the authorities and functions under     
subsection 7a72  7#b7 developing and    

overseeing the implementation of binding
 operational directives to agencies to  
implement the policies1 principles1     
standards1 and guidelines developed by  
the ,director under subsection 7a77#a7  
and the requirements of this subchapter1
 which may be repealed by the ,director 
if the operational directives issued on 
behalf of the ,director are not in      
accordance with policies1 principles1   
standards1 and guidelines developed by  
the ,director1 including-- 7,a7         
requirements for reporting security     
incidents to the ,federal information   
security incident center established    
under section #ceef2  7,b7 requirements 
for the contents of the annual reports  
required to be submitted under section  
#ceed7;c77#a72  7,c7 requirements for   
the mitigation of exigent risks to      
information systems2 and  7,d7 other    
operational requirements as the         
,director or ,secretary may determine   
necessary2  7#c7 monitoring agency      
implementation of information security  

policies and practices2  7#d7 convening 
meetings with senior agency officials to
 help ensure effective implementation of
 information security policies and      
practices2  7#e7 coordinating           
,government-wide efforts on information 
security policies and practices1        
including consultation with the ,chief  
,information ,officers ,council         
established under section #cfjc2  7#f7  
providing operational and technical     
assistance to agencies in implementing  
policies1 principles1 standards1 and    
guidelines on information security1     
including implementation of standards   
promulgated under section #aacca of     
title #dj1 including by-- 7,a7 operating
 the ,federal information security      
incident center established under       
section #ceef2  7,b7 upon request by an 
agency1 deploying technology to assist  
the agency to continuously diagnose and 
mitigate against cyber threats and      
vulnerabilities1 with or without        
reimbursement2  7,c7 compiling and      

analyzing data on agency information    
security2 and  7,d7 developing and      
conducting targeted operational         
evaluations1 including threat and       
vulnerability assessments1 on the       
information systems2 and  7#g7 other    
actions as the ,secretary may determine 
necessary to carry out this subsection  
on behalf of the ,director4  7c7 ,report
 ,not later than ,march #a of each year1
 the ,director1 in consultation with the
 ,secretary1 shall submit to ,congress a
 report on the effectiveness of         
information security policies and       
practices during the preceding year1    
including-- 7#a7 a summary of the       
incidents described in the annual       
reports required to be submitted under  
section #ceed7;c77#a71 including a      
summary of the information required     
under section #ceed7;c77#a77;,a77iii72  
7#b7 a description of the threshold for 
reporting major information security    
incidents2  7#c7 a summary of the       
results of evaluations required to be   

performed under section #ceee2  7#d7 an 
assessment of agency compliance with    
standards promulgated under section     
#aacca of title #dj2 and  7#e7 an       
assessment of agency compliance with the
 policies and procedures established    
under section #ceei7;a74  7d7 ,national 
security systems ,except for the        
authorities and functions described in  
subsection 7a77#d7 and subsection 7c71  
the authorities and functions of the    
,director and the ,secretary under this 
section shall not apply to national     
security systems4  7e7 ,department of   
,defense and ,intelligence community    
systems  7#a7 ,the authorities of the   
,director described in paragraphs 7#a7  
and 7#b7 of subsection 7a7 shall be     
delegated to the ,secretary of ,defense 
in the case of systems described in     
paragraph 7#b7 and to the ,director of  
,national ,intelligence in the case of  
systems described in paragraph 7#c74    
7#b7 ,the systems described in this     
paragraph are systems that are operated 

by the ,department of ,defense1 a       
contractor of the ,department of        
,defense1 or another entity on behalf of
 the ,department of ,defense that       
processes any information the           
unauthorized access1 use1 disclosure1   
disruption1 modification1 or destruction
 of which would have a debilitating     
impact on the mission of the ,department
 of ,defense4  7#c7 ,the systems        
described in this paragraph are systems 
that are operated by an element of the  
intelligence community1 a contractor of 
an element of the intelligence          
community1 or another entity on behalf  
of an element of the intelligence       
community that processes any information
 the unauthorized access1 use1          
disclosure1 disruption1 modification1 or
 destruction of which would have a      
debilitating impact on the mission of an
 element of the intelligence community4 
#ceed4 ,federal agency responsibilities 
7a7 ,in general ,the head of each agency
 shall-- 7#a7 be responsible for-- 7,a7 

providing information security          
protections commensurate with the risk  
and magnitude of the harm resulting from
 unauthorized access1 use1 disclosure1  
disruption1 modification1 or destruction
 of-- 7i7 information collected or      
maintained by or on behalf of the       
agency2 and  7ii7 information systems   
used or operated by an agency or by a   
contractor of an agency or other        
organization on behalf of an agency2    
7,b7 complying with the requirements of 
this subchapter and related policies1   
procedures1 standards1 and guidelines1  
including-- 7i7 information security    
standards promulgated under section     
#aacca of title #dj2  7ii7 operational  
directives developed by the ,secretary  
under section #ceec7;b72  7iii7 policies
 and procedures issued by the ,director 
under section #ceei2 and  7iv7          
information security standards and      
guidelines for national security systems
 issued in accordance with law and as   
directed by the ,president2 and  7,c7   

ensuring that information security      
management processes are integrated with
 agency strategic and operational       
planning processes2  7#b7 ensure that   
senior agency officials provide         
information security for the information
 and information systems that support   
the operations and assets under their   
control1 including through-- 7,a7       
assessing the risk and magnitude of the 
harm that could result from the         
unauthorized access1 use1 disclosure1   
disruption1 modification1 or destruction
 of such information or information     
systems2  7,b7 determining the levels of
 information security appropriate to    
protect such information and information
 systems in accordance with standards   
promulgated under section #aacca of     
title #dj1 for information security     
classifications and related             
requirements2  7,c7 implementing        
policies and procedures to              
cost-effectively reduce risks to an     
acceptable level2 and  7,d7 periodically

 testing and evaluating information     
security controls and techniques to     
ensure that they are effectively        
implemented2  7#c7 delegate to the      
agency ,chief ,information ,officer     
established under section #cejf 7or     
comparable official in an agency not    
covered by such section7 the authority  
to ensure compliance with the           
requirements imposed on the agency under
 this subchapter1 including-- 7,a7      
designating a senior agency information 
security officer who shall-- 7i7 carry  
out the ,chief ,information ,officer's  
responsibilities under this section2    
7ii7 possess professional               
qualifications1 including training and  
experience1 required to administer the  
functions described under this section2 
7iii7 have information security duties  
as that official's primary duty2 and    
7iv7 head an office with the mission and
 resources to assist in ensuring agency 
compliance with this section2  7,b7     
developing and maintaining an           

agency-wide information security program
 as required by subsection 7b72  7,c7   
developing and maintaining information  
security policies1 procedures1 and      
control techniques to address all       
applicable requirements1 including those
 issued under section #ceec of this     
title and section #aacca of title #dj2  
7,d7 training and overseeing personnel  
with significant responsibilities for   
information security with respect to    
such responsibilities2 and  7,e7        
assisting senior agency officials       
concerning their responsibilities under 
paragraph 7#b72  7#d7 ensure that the   
agency has trained personnel sufficient 
to assist the agency in complying with  
the requirements of this subchapter and 
related policies1 procedures1 standards1
 and guidelines2  7#e7 ensure that the  
agency ,chief ,information ,officer1 in 
coordination with other senior agency   
officials1 reports annually to the      
agency head on the effectiveness of the 
agency information security program1    

including progress of remedial actions2 
7#f7 ensure that senior agency          
officials1 including chief information  
officers of component agencies or       
equivalent officials1 carry out         
responsibilities under this subchapter  
as directed by the official delegated   
authority under paragraph 7#c72 and     
7#g7 ensure that all personnel are held 
accountable for complying with the      
agency-wide information security program
 implemented under subsection 7b74  7b7 
,agency program ,each agency shall      
develop1 document1 and implement an     
agency-wide information security program
 to provide information security for the
 information and information systems    
that support the operations and assets  
of the agency1 including those provided 
or managed by another agency1           
contractor1 or other source1 that       
includes-- 7#a7 periodic assessments of 
the risk and magnitude of the harm that 
could result from the unauthorized      
access1 use1 disclosure1 disruption1    

modification1 or destruction of         
information and information systems that
 support the operations and assets of   
the agency2  7#b7 policies and          
procedures that-- 7,a7 are based on the 
risk assessments required by paragraph  
7#a72  7,b7 cost-effectively reduce     
information security risks to an        
acceptable level2  7,c7 ensure that     
information security is addressed       
throughout the life cycle of each agency
 information system2 and  7,d7 ensure   
compliance with-- 7i7 the requirements  
of this subchapter2  7ii7 policies and  
procedures as may be prescribed by the  
,director1 and information security     
standards promulgated under section     
#aacca of title #dj2  7iii7 minimally   
acceptable system configuration         
requirements1 as determined by the      
agency2 and  7iv7 any other applicable  
requirements1 including standards and   
guidelines for national security systems
 issued in accordance with law and as   
directed by the ,president2  7#c7       

subordinate plans for providing adequate
 information security for networks1     
facilities1 and systems or groups of    
information systems1 as appropriate2    
7#d7 security awareness training to     
inform personnel1 including contractors 
and other users of information systems  
that support the operations and assets  
of the agency1 of-- 7,a7 information    
security risks associated with their    
activities2 and  7,b7 their             
responsibilities in complying with      
agency policies and procedures designed 
to reduce these risks2  7#e7 periodic   
testing and evaluation of the           
effectiveness of information security   
policies1 procedures1 and practices1 to 
be performed with a frequency depending 
on risk1 but no less than annually1 of  
which such testing-- 7,a7 shall include 
testing of management1 operational1 and 
technical controls of every information 
system identified in the inventory      
required under section #ceje7;c72 and   
7,b7 may include testing relied on in an

 evaluation under section #ceee2  7#f7 a
 process for planning1 implementing1    
evaluating1 and documenting remedial    
action to address any deficiencies in   
the information security policies1      
procedures1 and practices of the agency2
  7#g7 procedures for detecting1        
reporting1 and responding to security   
incidents1 consistent with standards and
 guidelines described in section        
#ceef7;b71 including-- 7,a7 mitigating  
risks associated with such incidents    
before substantial damage is done2  7,b7
 notifying and consulting with the      
,federal information security incident  
center established in section #ceef2 and
  7,c7 notifying and consulting with1 as
 appropriate-- 7i7 law enforcement      
agencies and relevant ,offices of       
,inspector ,general2  7ii7 an office    
designated by the ,president for any    
incident involving a national security  
system2  7iii7 the committees of        
,congress described in subsection       
7c77#a7-- 7,i7 not later than #g days   

after the date on which the incident is 
discovered2 and  7,,ii7 after the       
initial notification under subclause    
7,i71 within a reasonable period of time
 after additional information relating  
to the incident is discovered2 and  7iv7
 any other agency or office1 in         
accordance with law or as directed by   
the ,president2 and  7#h7 plans and     
procedures to ensure continuity of      
operations for information systems that 
support the operations and assets of the
 agency4  7c7 ,agency reporting  7#a7   
,annual report  7,a7 ,in general ,each  
agency shall submit to the ,director1   
the ,secretary1 the ,committee on       
,government ,reform1 the ,committee on  
,homeland ,security1 and the ,committee 
on ,science of the ,house of            
,representatives1 the ,committee on     
,homeland ,security and ,governmental   
,affairs and the ,committee on          
,commerce1 ,science1 and ,transportation
 of the ,senate1 the appropriate        
authorization and appropriations        

committees of ,congress1 and the        
,comptroller ,general a report on the   
adequacy and effectiveness of           
information security policies1          
procedures1 and practices1 including--  
7i7 a description of each major         
information security incident or related
 sets of incidents1 including summaries 
of-- 7,i7 the threats and threat actors1
 vulnerabilities1 and impacts relating  
to the incident2  7,,ii7 the risk       
assessments conducted under section     
#ceed7;a77#b77;,a7 of the affected      
information systems before the date on  
which the incident occurred2 and        
7,,iii7 the detection1 response1 and    
remediation actions2  7ii7 the total    
number of information security          
incidents1 including a description of   
incidents resulting in significant      
compromise of information security1     
system impact levels1 types of incident1
 and locations of affected systems2     
7iii7 a description of each major       
information security incident that      

involved a breach of personally         
identifiable information1 including--   
7,i7 the number of individuals whose    
information was affected by the major   
information security incident2 and      
7,,ii7 a description of the information 
that was breached or exposed2 and  7iv7 
any other information as the ,secretary 
may require4  7,b7 ,unclassified report 
7i7 ,in general ,each report submitted  
under subparagraph 7,a7 shall be in     
unclassified form1 but may include a    
classified annex4  7ii7 ,access to      
information ,the head of an agency shall
 ensure that1 to the greatest extent    
practicable1 information is included in 
the unclassified version of the reports 
submitted by the agency under           
subparagraph 7,a74  7#b7 ,other plans   
and reports ,each agency shall address  
the adequacy and effectiveness of       
information security policies1          
procedures1 and practices in management 
plans and reports4  7d7 ,performance    
plan  7#a7 ,in addition to the          

requirements of subsection 7c71 each    
agency1 in consultation with the        
,director1 shall include as part of the 
performance plan required under section 
#aaae of title #ca a description of--   
7,a7 the time periods2 and  7,b7 the    
resources1 including budget1 staffing1  
and training1  that are necessary to    
implement the program required under    
subsection 7b74  7#b7 ,the description  
under paragraph 7#a7 shall be based on  
the risk assessments required under     
subsection 7b77#a74  7e7 ,public notice 
and comment ,each agency shall provide  
the public with timely notice and       
opportunities for comment on proposed   
information security policies and       
procedures to the extent that such      
policies and procedures affect          
communication with the public4  #ceee4  
,annual independent evaluation  7a7 ,in 
general  7#a7 ,each year each agency    
shall have performed an independent     
evaluation of the information security  
program and practices of that agency to 

determine the effectiveness of such     
program and practices4  7#b7 ,each      
evaluation under this section shall     
include-- 7,a7 testing of the           
effectiveness of information security   
policies1 procedures1 and practices of a
 representative subset of the agency's  
information systems2  7,b7 an assessment
 of the effectiveness of the information
 security policies1 procedures1 and     
practices of the agency2 and  7,c7      
separate presentations1 as appropriate1 
regarding information security relating 
to national security systems4  7b7      
,independent auditor ,subject to        
subsection 7c7-- 7#a7 for each agency   
with an ,inspector ,general appointed   
under the ,inspector ,general ,act of   
#aigh1 the annual evaluation required by
 this section shall be performed by the 
,inspector ,general or by an independent
 external auditor1 as determined by the 
,inspector ,general of the agency2 and  
7#b7 for each agency to which paragraph 
7#a7 does not apply1 the head of the    

agency shall engage an independent      
external auditor to perform the         
evaluation4  7c7 ,national security     
systems ,for each agency operating or   
exercising control of a national        
security system1 that portion of the    
evaluation required by this section     
directly relating to a national security
 system shall be performed-- 7#a7 only  
by an entity designated by the agency   
head2 and  7#b7 in such a manner as to  
ensure appropriate protection for       
information associated with any         
information security vulnerability in   
such system commensurate with the risk  
and in accordance with all applicable   
laws4  7d7 ,existing evaluations ,the   
evaluation required by this section may 
be based in whole or in part on an      
audit1 evaluation1 or report relating to
 programs or practices of the applicable
 agency4  7e7 ,agency reporting  7#a7   
,each year1 not later than such date    
established by the ,director1 the head  
of each agency shall submit to the      

,director the results of the evaluation 
required under this section4  7#b7 ,to  
the extent an evaluation required under 
this section directly relates to a      
national security system1 the evaluation
 results submitted to the ,director     
shall contain only a summary and        
assessment of that portion of the       
evaluation directly relating to a       
national security system4  7f7          
,protection of information ,agencies and
 evaluators shall take appropriate steps
 to ensure the protection of information
 which1 if disclosed1 may adversely     
affect information security4 ,such      
protections shall be commensurate with  
the risk and comply with all applicable 
laws and regulations4  7g7 ,,omb reports
 to ,congress  7#a7 ,the ,director shall
 summarize the results of the           
evaluations conducted under this section
 in the report to ,congress required    
under section #ceec7;c74  7#b7 ,the     
,director's report to ,congress under   
this subsection shall summarize         

information regarding information       
security relating to national security  
systems in such a manner as to ensure   
appropriate protection for information  
associated with any information security
 vulnerability in such system           
commensurate with the risk and in       
accordance with all applicable laws4    
7#c7 ,evaluations and any other         
descriptions of information systems     
under the authority and control of the  
,director of ,central ,intelligence or  
of ,national ,foreign ,intelligence     
,programs systems under the authority   
and control of the ,secretary of        
,defense shall be made available to     
,congress only through the appropriate  
oversight committees of ,congress1 in   
accordance with applicable laws4  7h7   
,comptroller ,general ,the ,comptroller 
,general shall periodically evaluate and
 report to ,congress on-- 7#a7 the      
adequacy and effectiveness of agency    
information security policies and       
practices2 and  7#b7 implementation of  

the requirements of this subchapter4    
7i7 ,assessment technical assistance    
,the ,comptroller ,general may provide  
technical assistance to an ,inspector   
,general or the head of an agency1 as   
applicable1 to assist the ,inspector    
,general or head of an agency in        
carrying out the duties under this      
section1 including by testing           
information security controls and       
procedures4  #ceef4 ,federal information
 security incident center  7a7 ,in      
general ,the ,secretary shall ensure the
 operation of a central ,federal        
information security incident center    
to-- 7#a7 provide timely technical      
assistance to operators of agency       
information systems regarding security  
incidents1 including guidance on        
detecting and handling information      
security incidents2  7#b7 compile and   
analyze information about incidents that
 threaten information security2  7#c7   
inform operators of agency information  
systems about current and potential     

information security threats1 and       
vulnerabilities2  7#d7 provide1 as      
appropriate1 intelligence and other     
information about cyber threats1        
vulnerabilities1 and incidents to       
agencies to assist in risk assessments  
conducted under section #ceed7;b72 and  
7#e7 consult with the ,national         
,institute of ,standards and            
,technology1 agencies or offices        
operating or exercising control of      
national security systems 7including the
 ,national ,security ,agency71 and such 
other agencies or offices in accordance 
with law and as directed by the         
,president regarding information        
security incidents and related matters4 
7b7 ,national security systems ,each    
agency operating or exercising control  
of a national security system shall     
share information about information     
security incidents1 threats1 and        
vulnerabilities with the ,federal       
information security incident center to 
the extent consistent with standards and

 guidelines for national security       
systems1 issued in accordance with law  
and as directed by the ,president4      
#ceeg4 ,national security systems ,the  
head of each agency operating or        
exercising control of a national        
security system shall be responsible for
 ensuring that the agency-- 7#a7        
provides information security           
protections commensurate with the risk  
and magnitude of the harm resulting from
 the unauthorized access1 use1          
disclosure1 disruption1 modification1 or
 destruction of the information         
contained in such system2  7#b7         
implements information security policies
 and practices as required by standards 
and guidelines for national security    
systems1 issued in accordance with law  
and as directed by the ,president2 and  
7#c7 complies with the requirements of  
this subchapter4  #ceeh4 ,effect on     
existing law ,nothing in this           
subchapter1 section #aacca of title #dj1
 or section #bj of the ,national        

,standards and ,technology ,act 7#ae    
,u4,s4,c4 #bgh;g-#c7 may be construed as
 affecting the authority of the         
,president1 the ,office of ,management  
and ,budget or the ,director thereof1   
the ,national ,institute of ,standards  
and ,technology1 or the head of any     
agency1 with respect to the authorized  
use or disclosure of information1       
including with regard to the protection 
of personal privacy under section #eeb;a
 of title #e1 the disclosure of         
information under section #eeb of title 
#e1 the management and disposition of   
records under chapters #bi1 #ca1 or #cc 
of title #dd1 the management of         
information resources under subchapter  
,i of chapter #ce of this title1 or the 
disclosure of information to the        
,congress or the ,comptroller ,general  
of the ,united ,states4  4  7b7         
,technical and conforming amendments    
7#a7 ,table of sections ,the table of   
sections for chapter #ce of title #dd1  
,united ,states ,code is amended by     

striking the matter relating to         
subchapters ,,ii and ,,iii and inserting
 the following3  ,,subchapter           
,,ii--,information security#ceea4       
,purposes4#ceeb4 ,definitions4#ceec4    
,authority and functions of the         
,director and the ,secretary4#ceed4     
,federal agency responsibilities4#ceee4 
,annual independent evaluation4#ceef4   
,federal information security incident  
center4#ceeg4 ,national security        
systems4#ceeh4 ,effect on existing law4 
4  7#b7 ,cybersecurity ,research and    
,development ,act ,section #h7;d77#a7 of
 the ,cybersecurity ,research and       
,development ,act 7#ae ,u4,s4,c4 #gdjf7 
is amended by striking section #cecd and
 inserting section #ceed4  7#c7         
,homeland ,security ,act of #bjjb       
,section #ajja7;c77#a77;,a7 of the      
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #eaa7 by striking section     
#cecb7c7 and inserting section          
#ceeb7;b77#e74  7#d7 ,national          
,institute of ,standards and ,technology

 ,act ,section #bj of the ,national     
,institute of ,standards and ,technology
 ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is      
amended-- 7,a7 in subsection 7a77#b71 by
 striking section #cecb7;b77#b7 and     
inserting section #ceeb7;b77#e72 and    
7,b7 in subsection 7e7-- 7i7 in         
paragraph 7#b71 by striking section     
#cecb7a7 and inserting section          
#ceeb7;b77#b72 and  7ii7 in paragraph   
7#e71 by striking section #cecb7;b77#b7 
and inserting section #ceeb7;b77#e74    
7#e7 ,title #aj ,title #aj1 ,united     
,states ,code1 is amended-- 7,a7 in     
section #bbbb7;j77#e71 by striking      
section #cedb7;b77#b7 and inserting     
section #ceeb7;b77#e72  7,b7 in section 
#bbbc7;c77#c71 by striking section      
#cedb7;b77#b7 and inserting section     
#ceeb7;b77#e72 and  7,c7 in section     
#bcae1 by striking section #cedb7;b77#b7
 and inserting section #ceeb7;b77#e74   
7c7 ,other provisions  7#a7 ,circular   
,a-#acj ,not later than #ahj days after 
the date of enactment of this ,act1 the 

,director of the ,office of ,management 
and ,budget shall revise ,office of     
,management and ,budget ,circular       
,a-#acj to eliminate inefficient or     
wasteful reporting4  7#b7 ,,ispab       
,section #ba7;b7 of the ,national       
,institute of ,standards and ,technology
 ,act 7#ae ,u4,s4,c4 #bgh;g-#d7;b77 is  
amended-- 7,a7 in paragraph 7#b71 by    
inserting 1 the ,secretary of ,homeland 
,security1 after the ,institute2 and    
7,b7 in paragraph 7#c71 by inserting the
 ,secretary of ,homeland ,security1     
after the ,secretary of ,commerce14  #c4
 ,federal data breach response          
guidelines  7a7 ,in general ,subchapter 
,,ii of chapter #ce of title #dd1       
,united ,states ,code1 as added by this 
,act1 is amended by adding at the end   
the following3  #ceei4 ,privacy breach  
requirements  7a7 ,policies and         
procedures ,the ,director1 in           
consultation with the ,secretary1 shall 
establish and oversee policies and      
procedures for agencies to follow in the

 event of a breach of information       
security involving the disclosure of    
personally identifiable information1    
including requirements for-- 7#a7 timely
 notice to affected individuals based on
 a determination of the level of risk   
and consistent with law enforcement and 
national security considerations2  7#b7 
timely reporting to the ,federal        
information security incident center    
established under section #ceef or other
 ,federal cybersecurity center1 as      
designated by the ,director2  7#c7      
timely notice to committees of ,congress
 with jurisdiction over cybersecurity2  
and  7#d7 such additional actions as the
 ,director may determine necessary and  
appropriate1 including the provision of 
risk mitigation measures to affected    
individuals4  7b7 ,considerations ,in   
carrying out subsection 7a71 the        
,director shall consider recommendations
 made by the ,government ,accountability
 ,office1 including recommendations in  
the ,december #bjac ,government         

,accountability ,office report entitled 
,information ,security3 ,agency         
,responses to ,breaches of ,personally  
,identifiable ,information ,need to ,be 
,more ,consistent 7,,gao-#ad-cd74  7c7  
,required agency action ,the head of    
each agency shall ensure that actions   
taken in response to a breach of        
information security involving the      
disclosure of personally identifiable   
information under the authority or      
control of the agency comply with       
policies and procedures established     
under subsection 7a74  7d7 ,timeliness  
7#a7 ,in general ,except as provided in 
paragraph 7#b71 the policies and        
procedures established under subsection 
7a7 shall require that the notice to    
affected individuals required under     
subsection 7a77#a7 be made without      
unreasonable delay and with             
consideration of the likely risk of harm
 and the level of impact1 but not later 
than #fj days after the date on which   
the head of an agency discovers the     

breach of information security involving
 the disclosure of personally           
identifiable information4  7#b7 ,delay  
,the ,attorney ,general1 the head of an 
element of the intelligence community   
7as such term is defined under section  
#c7d7 of the ,national ,security ,act of
 #aidg 7#ej ,u4,s4,c4 #cjjc7d771 or the 
,secretary may delay the notice to      
affected individuals under subsection   
7a77#a7 for not more than #ahj days1 if 
the notice would disrupt a law          
enforcement investigation1 endanger     
national security1 or hamper security   
remediation actions from the breach of  
information security involving the      
disclosure of personally identifiable   
information4  4  7b7 ,technical and     
conforming amendment ,the table of      
sections for subchapter ,,ii for chapter
 #ce of title #dd1 ,united ,states      
,code1 as added by this ,act1 is amended
 by inserting after the item relating to
 section #ceeh the following3  #ceei4   
,privacy breach requirements4  4        

,september #ae1 #bjad,reported without  
amendment