Browse Arkansas Code titles and sections
40 U.S.C. § 11331 — Responsibilities for Federal information systems standards
Federal law — U.S. Code and appendices · legal_authorities
**(a) Standards and Guidelines.—**
(1) **Authority to prescribe.—** — Except as provided under paragraph (2), the Secretary of Commerce shall, on the basis of standards and guidelines developed by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(a)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/a&num=0&edition=prelim)), prescribe standards and guidelines pertaining to Federal information systems.
(2) **National security systems.—** — Standards and guidelines for national security systems shall be developed, prescribed, enforced, and overseen as otherwise authorized by law and as directed by the President.
**(b) Mandatory Requirements.—**
(1) **Authority to make mandatory.—** — Except as provided under paragraph (2), the Secretary of Commerce shall make standards prescribed under subsection (a)(1) compulsory and binding to the extent determined necessary by the Secretary to improve the efficiency of operation or security of Federal information systems.
(2) **Required mandatory standards.—**
(A) *In general.—* — Standards prescribed under subsection (a)(1) shall include information security standards that—
(i) provide minimum information security requirements as determined under section 20(b) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/b&num=0&edition=prelim)); and
(ii) are otherwise necessary to improve the security of Federal information and information systems.
(B) *Requirement.—* — Information security standards described in subparagraph (A) shall be compulsory and
Source: Supplied U.S. Code snapshot — release unconfirmed · 40 U.S.C. § 11331
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: fa4d632a951b240f84401051f3c8bc4f316245248b334244a37674dc88db578d. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_3f8c3094009b420daa48510d
Source file: Laws/federal/codes/united-states-code/title-40/section-11331-responsibilities-for-federal-information-systems-standards--ddefaded67.md
Pages: Not recorded – Not recorded
Passage SHA-256: a467aef34eb1d1efb9eaa43c7804b1d3aab0c803d149a87f38475ad92d424c81
Source location: Title 40, Chapter 113, § 11331; chapter-113-responsibility-for-acquisitions-of-information-technology.md
Stored source content
**(a) Standards and Guidelines.—**
(1) **Authority to prescribe.—** — Except as provided under paragraph (2), the Secretary of Commerce shall, on the basis of standards and guidelines developed by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(a)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/a&num=0&edition=prelim)), prescribe standards and guidelines pertaining to Federal information systems.
(2) **National security systems.—** — Standards and guidelines for national security systems shall be developed, prescribed, enforced, and overseen as otherwise authorized by law and as directed by the President.
**(b) Mandatory Requirements.—**
(1) **Authority to make mandatory.—** — Except as provided under paragraph (2), the Secretary of Commerce shall make standards prescribed under subsection (a)(1) compulsory and binding to the extent determined necessary by the Secretary to improve the efficiency of operation or security of Federal information systems.
(2) **Required mandatory standards.—**
(A) *In general.—* — Standards prescribed under subsection (a)(1) shall include information security standards that—
(i) provide minimum information security requirements as determined under section 20(b) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/b&num=0&edition=prelim)); and
(ii) are otherwise necessary to improve the security of Federal information and information systems.
(B) *Requirement.—* — Information security standards described in subparagraph (A) shall be compulsory and binding.
**(c) Authority to Disapprove or Modify.—** The President may disapprove or modify the standards and guidelines referred to in subsection (a)(1) if the President determines such action to be in the public interest. The President’s authority to disapprove or modify such standards and guidelines may not be delegated. Notice of such disapproval or modification shall be published promptly in the Federal Register. Upon receiving notice of such disapproval or modification, the Secretary of Commerce shall immediately rescind or modify such standards or guidelines as directed by the President.
**(d) Exercise of Authority.—** To ensure fiscal and policy consistency, the Secretary of Commerce shall exercise the authority conferred by this section subject to direction by the President and in coordination with the Director of the Office of Management and Budget.
**(e) Application of More Stringent Standards.—** The head of an executive agency may employ standards for the cost-effective information security for Federal information systems within or under the supervision of that agency that are more stringent than the standards the Secretary prescribes under this section if the more stringent standards—
(1) contain at least the applicable standards made compulsory and binding by the Secretary of Commerce; and
(2) are otherwise consistent with policies and guidelines issued under [section 3553 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3553&num=0&edition=prelim).
**(f) Decisions on Promulgation of Standards.—** The decision by the Secretary of Commerce regarding the promulgation of any standard under this section shall occur not later than 6 months after the submission of the proposed standard to the Secretary by the National Institute of Standards and Technology, as provided under section 20 of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3&num=0&edition=prelim)).
**(g) Definitions.—** In this section:
(1) **Federal information system.—** — The term “Federal information system” means an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.
(2) **Information security.—** — The term “information security” has the meaning given that term in [section 3552(b)(3) of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552/b/3&num=0&edition=prelim).
(3) **National security system.—** — The term “national security system” has the meaning given that term in [section 3552(b)(6) of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552/b/6&num=0&edition=prelim).
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a)**
(1) The head of each agency shall be responsible for—
(A) carrying out the agency’s information resources management activities to improve agency productivity, efficiency, and effectiveness; and
(B) complying with the requirements of this subchapter and related policies established by the Director.
(2)
(A) Except as provided under subparagraph (B), the head of each agency shall designate a Chief Information Officer who shall report directly to such agency head to carry out the responsibilities of the agency under this subchapter.
(B) The Secretary of the Department of Defense and the Secretary of each military department may each designate Chief Information Officers who shall report directly to such Secretary to carry out the responsibilities of the department under this subchapter. If more than one Chief Information Officer is designated, the respective duties of the Chief Information Officers shall be clearly delineated.
(3) The Chief Information Officer designated under paragraph (2) shall head an office responsible for ensuring agency compliance with and prompt, efficient, and effective implementation of the information policies and information resources management responsibilities established under this subchapter, including the reduction of information collection burdens on the public. The Chief Information Officer and employees of such office shall be selected with special attention to the professional qualifications required to administer the functions described under this subchapter.
(4) Each agency program official shall be responsible and accountable for information resources assigned to and supporting the programs under such official. In consultation with the Chief Information Officer designated under paragraph (2) and the agency Chie
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3506
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a)**
(1) The Director shall oversee the use of information resources to improve the efficiency and effectiveness of governmental operations to serve agency missions, including burden reduction and service delivery to the public. In performing such oversight, the Director shall—
(A) develop, coordinate and oversee the implementation of Federal information resources management policies, principles, standards, and guidelines; and
(B) provide direction and oversee—
(i) the review and approval of the collection of information and the reduction of the information collection burden;
(ii) agency dissemination of and public access to information;
(iii) statistical activities;
(iv) records management activities;
(v) privacy, confidentiality, security, disclosure, and sharing of information; and
(vi) the acquisition and use of information technology, including alternative information technologies that provide for electronic submission, maintenance, or disclosure of information as a substitute for paper and for the use and acceptance of electronic signatures.
(2) The authority of the Director under this subchapter shall be exercised consistent with applicable law.
**(b)** With respect to general information resources management policy, the Director shall—
(1) develop and oversee the implementation of uniform information resources management policies, principles, standards, and guidelines;
(2) foster greater sharing, dissemination, and access to public information, including through—
(A) the use of comprehensive data inventories and the Federal data catalogue under section 3511; and
(B) the development and utilization of common standards for information collection, storage, processing and communication, including standards for securi
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3504
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Activities** The Center shall—
(1) receive, aggregate, analyze, and secure, using processes consistent with the processes developed pursuant to the Cybersecurity Information Sharing Act of 2015 ([6 U.S.C. 1501](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title6-section1501&num=0&edition=prelim) et seq.) reports from covered entities related to a covered cyber incident to assess the effectiveness of security controls, identify tactics, techniques, and procedures adversaries use to overcome those controls and other cybersecurity purposes, including to assess potential impact of cyber incidents on public health and safety and to enhance situational awareness of cyber threats across critical infrastructure sectors;
(2) coordinate and share information with appropriate Federal departments and agencies to identify and track ransom payments, including those utilizing virtual currencies;
(3) leverage information gathered about cyber incidents to—
(A) enhance the quality and effectiveness of information sharing and coordination efforts with appropriate entities, including agencies, sector coordinating councils, Information Sharing and Analysis Organizations, State, local, Tribal, and territorial governments, technology providers, critical infrastructure owners and operators, cybersecurity and cyber incident response firms, and security researchers; and
(B) provide appropriate entities, including sector coordinating councils, Information Sharing and Analysis Organizations, State, local, Tribal, and territorial governments, technology providers, cybersecurity and cyber incident response firms, and security researchers, with timely, actionable, and anonymized reports of cyber incident campaigns and trends, including, to the maximum extent practicable
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 101
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Director.—** The Director shall oversee agency information security policies and practices, including—
(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim);
(2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of—
(A) information collected or maintained by or on behalf of an agency; or
(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
(3) ensuring that the Secretary carries out the authorities and functions under subsection (b);
(4) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3&num=0&edition=prelim)) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;
(5) overseeing agency compliance with the requirements of this subchapter and [section 1326 of title 41](https://uscode
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3553
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In general** The Institute shall—
(1) have the mission of developing standards, guidelines, and associated methods and techniques for information systems;
(2) develop standards and guidelines, including minimum requirements, for information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency, other than national security systems (as defined in [section 3552(b)(6) of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552/b/6&num=0&edition=prelim));
(3) develop standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems;
(4) carry out the responsibilities described in paragraph (3) through the Computer Security Division; and
(5) identify and develop standards and guidelines for improving the cybersecurity workforce for an agency as part of the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NIST Special Publication 800–181), or successor framework.
**(b) Minimum requirements for standards and guidelines** The standards and guidelines required by subsection (a) shall include, at a minimum—
(1)
(A) standards to be used by all agencies to categorize all information and information systems collected or maintained by or on behalf of each agency based on the objectives of providing appropriate levels of information security according to a range of risk levels;
(B) guidelines recommending the types of information and information systems to be included in each such category; and
(C) minimum information security requirements for information and information systems
Source: Supplied U.S. Code snapshot — release unconfirmed · 15 U.S.C. § 278g–3
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Federal Information Technology.—** The Director of the Office of Management and Budget shall perform the responsibilities set forth in this section in fulfilling the responsibilities under [section 3504(h) of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3504/h&num=0&edition=prelim).
**(b) Use of Information Technology in Federal Programs.—** The Director shall promote and improve the acquisition, use, security, and disposal of information technology by the Federal Government to improve the productivity, efficiency, and effectiveness of federal programs, including through dissemination of public information and the reduction of information collection burdens on the public.
**(c) Use of Budget Process.—**
(1) **Definitions.—** — In this subsection:
(A) The term “covered agency” means an agency listed in section 901(b)(1) or 901(b)(2) of title 31.
(B) The term “major information technology investment” means an investment within a covered agency information technology investment portfolio that is designated by the covered agency as major, in accordance with capital planning guidance issued by the Director.
(C) The term “national security system” has the meaning provided in [section 3542 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3542&num=0&edition=prelim).11 See References in Text note below.
(2) **Analyzing, tracking, and evaluating capital investments.—** — As part of the budget process, the Director shall develop a process for analyzing, tracking, and evaluating the risks, including information security risks, and results of all major capital investments made by an executive agency for information systems. The process shall cover the life of each system and shall inc
Source: Supplied U.S. Code snapshot — release unconfirmed · 40 U.S.C. § 11302
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** The Council shall perform functions that include the following:
(1) Identifying and recommending development by the National Institute of Standards and Technology of supply chain risk management standards, guidelines, and practices for executive agencies to use when assessing and developing mitigation strategies to address supply chain risks, particularly in the acquisition and use of covered articles under [section 1326(a) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section1326/a&num=0&edition=prelim).
(2) Identifying or developing criteria for sharing information with executive agencies, other Federal entities, and non-Federal entities with respect to supply chain risk, including information related to the exercise of authorities provided under this section and sections 1326 and 4713 of this title. At a minimum, such criteria shall address—
(A) the content to be shared;
(B) the circumstances under which sharing is mandated or voluntary; and
(C) the circumstances under which it is appropriate for an executive agency to rely on information made available through such sharing in exercising the responsibilities and authorities provided under this section and [section 4713 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section4713&num=0&edition=prelim).
(3) Identifying an appropriate executive agency to—
(A) accept information submitted by executive agencies based on the criteria established under paragraph (2);
(B) facilitate the sharing of information received under subparagraph (A) to support supply chain risk analyses under [section 1326 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section1326&num=0&edition=prelim),
Source: Supplied U.S. Code snapshot — release unconfirmed · 41 U.S.C. § 1323
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Authority**
(1) **Authority to enter into contracts** — The Secretary may enter into contracts with any eligible entity to serve as a medicare administrative contractor with respect to the performance of any or all of the functions described in paragraph (4) or parts of those functions (or, to the extent provided in a contract, to secure performance thereof by other entities).
(2) **Eligibility of entities** — An entity is eligible to enter into a contract with respect to the performance of a particular function described in paragraph (4) only if—
(A) the entity has demonstrated capability to carry out such function;
(B) the entity complies with such conflict of interest standards as are generally applicable to Federal acquisition and procurement;
(C) the entity has sufficient assets to financially support the performance of such function; and
(D) the entity meets such other requirements as the Secretary may impose.
(3) **Medicare administrative contractor defined** — For purposes of this subchapter and subchapter XI—
(A) *In general* — The term “medicare administrative contractor” means an agency, organization, or other person with a contract under this section.
(B) *Appropriate medicare administrative contractor* — With respect to the performance of a particular function in relation to an individual entitled to benefits under part A or enrolled under part B, or both, a specific provider of services or supplier (or class of such providers of services or suppliers), the “appropriate” medicare administrative contractor is the medicare administrative contractor that has a contract under this section with respect to the performance of that function in relation to that individual, provider of services or supplier or class of provider of services o
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 1395uu
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
The Joint Committee on Printing shall consist of the chairman and four members of the Committee on Rules and Administration of the Senate and the chairman and four members of the Committee on House Oversight of the House of Representatives.
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 101
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** The head of each agency shall—
(1) be responsible for—
(A) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of—
(i) information collected or maintained by or on behalf of the agency; and
(ii) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
(B) complying with the requirements of this subchapter, subchapter III of chapter 13 of title 41, and related policies, procedures, standards, and guidelines, including—
(i) information security standards promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim);
(ii) operational directives developed by the Secretary under section 3553(b);
(iii) policies and procedures issued by the Director;
(iv) information security standards and guidelines for national security systems issued in accordance with law and as directed by the President;
(v) emergency directives issued by the Secretary under section 3553(h); and
(vi) responsibilities relating to assessing and avoiding, mitigating, transferring, or accepting supply chain risks under [section 1326 of title 41](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41-section1326&num=0&edition=prelim), and complying with exclusion and removal orders issued under section 1323 of such title; and
(C) ensuring that information security management processes are integrated with agency strategic, operational, and budgetary planning processes;
(2) ensure that senior agency officials provide information securit
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3554
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.