Browse Arkansas Code titles and sections
10 U.S.C. § 2225 — Insider threat detection
Federal law — U.S. Code and appendices · legal_authorities
**(a) Program Required.—** The Secretary of Defense shall establish a program for information sharing protection and insider threat mitigation for the information systems of the Department of Defense to detect unauthorized access to, use of, or transmission of classified or controlled unclassified information.
**(b) Elements.—** The program established under subsection (a) shall include the following:
(1) Technology solutions for deployment within the Department of Defense that allow for centralized monitoring and detection of unauthorized activities, including—
(A) monitoring the use of external ports and read and write capability controls;
(B) disabling the removable media ports of computers physically or electronically;
(C) electronic auditing and reporting of unusual and unauthorized user activities;
(D) using data-loss prevention and data-rights management technology to prevent the unauthorized export of information from a network or to render such information unusable in the event of the unauthorized export of such information;
(E) a roles-based access certification system;
(F) cross-domain guards for transfers of information between different networks; and
(G) patch management for software and security updates.
(2) Policies and procedures to support such program, including special consideration for policies and procedures related to international and interagency partners and activities in support of ongoing operations in areas of hostilities.
(3) A governance structure and process that integrates information security and sharing technologies with the policies and procedures referred to in paragraph (2). Such structure and process shall include—
(A) coordination with the existing security clearance and suitability review process;
(B)
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 2225
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 1d096f17ecf5d1a34024d4f3dbfefd0cc6c7cb7ca8fdbbdc9bef939933fa6b50. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_48891c0b534b1ce0df2e0476
Source file: Laws/federal/codes/united-states-code/title-10/section-2225-insider-threat-detection--876d48295a.md
Pages: Not recorded – Not recorded
Passage SHA-256: 732b97853fe8e5cec3f162a20a6f3f049b7d01dd4d83615361b72bdce8862663
Source location: Title 10, Chapter 131, § 2225; chapter-131-planning-and-coordination.md
Stored source content
**(a) Program Required.—** The Secretary of Defense shall establish a program for information sharing protection and insider threat mitigation for the information systems of the Department of Defense to detect unauthorized access to, use of, or transmission of classified or controlled unclassified information.
**(b) Elements.—** The program established under subsection (a) shall include the following:
(1) Technology solutions for deployment within the Department of Defense that allow for centralized monitoring and detection of unauthorized activities, including—
(A) monitoring the use of external ports and read and write capability controls;
(B) disabling the removable media ports of computers physically or electronically;
(C) electronic auditing and reporting of unusual and unauthorized user activities;
(D) using data-loss prevention and data-rights management technology to prevent the unauthorized export of information from a network or to render such information unusable in the event of the unauthorized export of such information;
(E) a roles-based access certification system;
(F) cross-domain guards for transfers of information between different networks; and
(G) patch management for software and security updates.
(2) Policies and procedures to support such program, including special consideration for policies and procedures related to international and interagency partners and activities in support of ongoing operations in areas of hostilities.
(3) A governance structure and process that integrates information security and sharing technologies with the policies and procedures referred to in paragraph (2). Such structure and process shall include—
(A) coordination with the existing security clearance and suitability review process;
(B) coordination of existing anomaly detection techniques, including those used in counterintelligence investigation or personnel screening activities; and
(C) updating and expediting of the classification review and marking process.
(4) A continuing analysis of—
(A) gaps in security measures under the program; and
(B) technology, policies, and processes needed to increase the capability of the program beyond the initially established full operating capability to address such gaps.
(5) A baseline analysis framework that includes measures of performance and effectiveness.
(6) A plan for how to ensure related security measures are put in place for other departments or agencies with access to Department of Defense networks.
(7) A plan for enforcement to ensure that the program is being applied and implemented on a uniform and consistent basis.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Defense Information Assurance Program.—** The Secretary of Defense shall carry out a program, to be known as the “Defense Information Assurance Program”, to protect and defend Department of Defense information, information systems, and information networks that are critical to the Department and the armed forces during day-to-day operations and operations in times of crisis.
**(b) Objectives of the Program.—** The objectives of the program shall be to provide continuously for the availability, integrity, authentication, confidentiality, nonrepudiation, and rapid restitution of information and information systems that are essential elements of the Defense Information Infrastructure.
**(c) Program Strategy.—** In carrying out the program, the Secretary shall develop a program strategy that encompasses those actions necessary to assure the readiness, reliability, continuity, and integrity of Defense information systems, networks, and infrastructure, including through compliance with subchapter II of chapter 35 of title 44, including through compliance with subchapter III of chapter 35 of title 44. The program strategy shall include the following:
(1) A vulnerability and threat assessment of elements of the defense and supporting nondefense information infrastructures that are essential to the operations of the Department and the armed forces.
(2) Development of essential information assurances technologies and programs.
(3) Organization of the Department, the armed forces, and supporting activities to defend against information warfare.
(4) Joint activities of the Department with other departments and agencies of the Government, State and local agencies, and elements of the national information infrastructure.
(5) The conduct of exercises, war games, simulatio
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 2224
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Data Collection Required.—** The Secretary of Defense shall establish a data collection system to provide management information with regard to each purchase of services by a military department or Defense Agency in excess of $3,000,000, regardless of whether such a purchase is made in the form of a contract, task order, delivery order, military interdepartmental purchase request, or any other form of interagency agreement, for services in the following service acquisition portfolio groups:
(1) Logistics management services.
(2) Equipment related services.
(3) Knowledge-based services.
(4) Electronics and communications services.
**(b) Data To Be Collected.—** The data required to be collected under subsection (a) includes the following:
(1) The services purchased.
(2) The total dollar amount of the purchase.
(3) The form of contracting action used to make the purchase.
(4) Whether the purchase was made through—
(A) a performance-based contract, performance-based task order, or other performance-based arrangement that contains firm fixed prices for the specific tasks to be performed;
(B) any other performance-based contract, performance-based task order, or performance-based arrangement; or
(C) any contract, task order, or other arrangement that is not performance based.
(5) In the case of a purchase made through an agency other than the Department of Defense, the agency through which the purchase is made.
(6) The extent of competition provided in making the purchase and whether there was more than one offer.
(7) Whether the purchase was made from—
(A) a small business concern;
(B) a small business concern owned and controlled by socially and economically disadvantaged individuals; or
(C) a small business concern owned and controlled
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 4505
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 1812
TITLE 10—ARMED FORCES
§ 2224a
1 See References in Text note below.
fense committees [Committees on Armed Services and
Appropriations of the Senate and the House of Rep-
resentatives] a report on the strategy required by sub-
section (a). The report shall include the following:
‘‘(1) A description of the current status of the strat-
egy required by subsection (a) and of the implementa-
tion of the strategy, including a description of the
role of the strategy in the risk management by the
Department regarding the supply chain and in oper-
ational planning for cyber security.
‘‘(2) A description of the risks, if any, that the De-
partment will accept in the strategy due to limita-
tions on funds or other applicable constraints.’’
INSTITUTE FOR DEFENSE COMPUTER SECURITY AND
INFORMATION PROTECTION
Pub. L. 106–398, § 1 [[div. A], title IX, § 921], Oct. 30,
2000, 114 Stat. 1654, 1654A–233, provided that:
‘‘(a) ESTABLISHMENT.—The Secretary of Defense shall
establish an Institute for Defense Computer Security
and Information Protection.
‘‘(b) MISSION.—The Secretary shall require the insti-
tute—
‘‘(1) to conduct research and technology develop-
ment that is relevant to foreseeable computer and
network security requirements and information as-
surance requirements of the Department of Defense
with a principal focus on areas not being carried out
by other organizations in the private or public sector;
and
‘‘(2) to facilitate the exchange of information re-
garding cyberthreats, technology, tools, and other
relevant issues.
‘‘(c) CONTRACTOR
OPERATION.—The Secretary shall
enter into a contract with a not-for-profit entity, or a
consortium of not-for-profit entities, to organize and
operate the institute. The Secretary shall use competi-
tive procedu
Source: Supplied 2024 U.S. Code historical extraction · 10 U.S.C. § 2225
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.