Browse Arkansas Code titles and sections
44 U.S.C. § 3555 — Annual independent evaluation
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—**
(1) Each year each agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices.
(2) Each evaluation under this section shall include—
(A) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems;
(B) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency; and
(C) separate presentations, as appropriate, regarding information security relating to national security systems.
**(b) Independent Auditor.—** Subject to subsection (c)—
(1) for each agency with an Inspector General appointed under chapter 4 of title 5, the annual evaluation required by this section shall be performed by the Inspector General or by an independent external auditor, as determined by the Inspector General of the agency; and
(2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the evaluation.
**(c) National Security Systems.—** For each agency operating or exercising control of a national security system, that portion of the evaluation required by this section directly relating to a national security system shall be performed—
(1) only by an entity designated by the agency head; and
(2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
**(d) Existing Evaluations.—** The evaluation required by this section may be based in whole or in part on an audit, eval
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3555
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: d80366bd5ff1579c08ae04f3b0b2aac0e96f633ef4e97263d57826b9e108dba4. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_6d2e3911602ca76c5985792d
Source file: Laws/federal/codes/united-states-code/title-44/section-3555-annual-independent-evaluation--a6437011a3.md
Pages: Not recorded – Not recorded
Passage SHA-256: 443242017c18fade12e26b72ce6487e1b40a95a9d8e34357525e567655942b17
Source location: Title 44, Chapter 35, § 3555; chapter-035-coordination-of-federal-information-policy.md
Stored source content
**(a) In General.—**
(1) Each year each agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices.
(2) Each evaluation under this section shall include—
(A) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems;
(B) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency; and
(C) separate presentations, as appropriate, regarding information security relating to national security systems.
**(b) Independent Auditor.—** Subject to subsection (c)—
(1) for each agency with an Inspector General appointed under chapter 4 of title 5, the annual evaluation required by this section shall be performed by the Inspector General or by an independent external auditor, as determined by the Inspector General of the agency; and
(2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the evaluation.
**(c) National Security Systems.—** For each agency operating or exercising control of a national security system, that portion of the evaluation required by this section directly relating to a national security system shall be performed—
(1) only by an entity designated by the agency head; and
(2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
**(d) Existing Evaluations.—** The evaluation required by this section may be based in whole or in part on an audit, evaluation, or report relating to programs or practices of the applicable agency.
**(e) Agency Reporting.—**
(1) Each year, not later than such date established by the Director, the head of each agency shall submit to the Director the results of the evaluation required under this section.
(2) To the extent an evaluation required under this section directly relates to a national security system, the evaluation results submitted to the Director shall contain only a summary and assessment of that portion of the evaluation directly relating to a national security system.
**(f) Protection of Information.—** Agencies and evaluators shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate with the risk and comply with all applicable laws and regulations.
**(g) OMB Reports to Congress.—**
(1) The Director shall summarize the results of the evaluations conducted under this section in the report to Congress required under section 3553(c).
(2) The Director’s report to Congress under this subsection shall summarize information regarding information security relating to national security systems in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
(3) Evaluations and any other descriptions of information systems under the authority and control of the Director of National Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with applicable laws.
**(h) Comptroller General.—** The Comptroller General shall periodically evaluate and report to Congress on—
(1) the adequacy and effectiveness of agency information security policies and practices; and
(2) implementation of the requirements of this subchapter.
**(i) Assessment Technical Assistance.—** The Comptroller General may provide technical assistance to an Inspector General or the head of an agency, as applicable, to assist the Inspector General or head of an agency in carrying out the duties under this section, including by testing information security controls and procedures.
**(j) Guidance.—** The Director, in consultation with the Secretary, the Chief Information Officers Council established under section 3603, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Additional Responsibilities of Chief Information Officer of Department of Defense.—** In addition to the responsibilities provided for in chapter 35 of title 44 and in [section 11315 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11315&num=0&edition=prelim), the Chief Information Officer of the Department of Defense shall—
(1) review and provide recommendations to the Secretary of Defense on Department of Defense budget requests for information technology and national security systems;
(2) ensure the interoperability of information technology and national security systems throughout the Department of Defense;
(3) ensure that information technology and national security systems standards that will apply throughout the Department of Defense are prescribed;
(4) provide for the elimination of duplicate information technology and national security systems within and between the military departments and Defense Agencies; and
(5) maintain a consolidated inventory of Department of Defense mission critical and mission essential information systems, identify interfaces between those systems and other information systems, and develop and maintain contingency plans for responding to a disruption in the operation of any of those information systems.
**(b) Additional Responsibilities of Chief Information Officer of Military Departments.—** In addition to the responsibilities provided for in chapter 35 of title 44 and in [section 11315 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11315&num=0&edition=prelim), the Chief Information Officer of a military department, with respect to the military department concerned, shall—
(1) review budget requests for all information technology and nation
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 2223
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Monitoring risk**
(1) **Update on system implementation** — Not later than 120 days after October 11, 2010, and on a biennial basis thereafter, the chief information officer of NASA, in coordination with other national security agencies, shall provide to the appropriate committees of Congress—
(A) an update on efforts to implement a system to provide dynamic, comprehensive, real-time information regarding risk of unauthorized remote, proximity, and insider use or access, for all information infrastructure under the responsibility of the chief information officer, and mission-related networks, including contractor networks;
(B) an assessment of whether the system has demonstrably and quantifiably reduced network risk compared to alternative methods of measuring security; and
(C) an assessment of the progress that each center and facility has made toward implementing the system.
(2) **Existing assessments** — The assessments required of the Inspector General under section 3545 11 See References in Text note below. of title 44 shall evaluate the effectiveness of the system described in this subsection.
**(b) Information security awareness and education**
(1) **In general** — In consultation with the Department of Education, other national security agencies, and other agency directorates, the chief information officer shall institute an information security awareness and education program for all operators and users of NASA information infrastructure, with the goal of reducing unauthorized remote, proximity, and insider use or access.
(2) **Program requirements**
(A) The program shall include, at a minimum, ongoing classified and unclassified threat-based briefings, and automated exercises and examinations that simulate common attack techniques.
(B
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 18302
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Vulnerabilities in open source software** The Director shall assign severity metrics to identified vulnerabilities with open source software and produce voluntary guidance to assist the entities that maintain open source software repositories to discover and mitigate vulnerabilities.
**(b) Artificial intelligence-enabled defenses** The Director shall carry out research and testing to improve the effectiveness of artificial intelligence-enabled cybersecurity, including by generating optimized data sets to train artificial intelligence defense systems and evaluating the performance of varying network architectures at strengthening network security.
**(c) Authentication of Institute software** The Director shall ensure all software released by the Institute is digitally signed and maintained to enable stakeholders to verify its authenticity and integrity upon installation and execution.
**(d) Assistance to Inspectors General** Subject to available funding, the Director shall provide technical assistance to improve the education and training of individual Federal agency Inspectors General and staff who are responsible for the annual independent evaluation they are required to perform of the information security program and practices of Federal agencies under [section 3555 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3555&num=0&edition=prelim).
**(e) Software supply chain security practices**
(1) **In general** — The Director shall, in coordination with industry, academia, and other Federal agencies, as appropriate, develop a set of security outcomes and practices, including security controls, control enhancements, supplemental guidance, or other supporting information to enable software developers and operators to ident
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 18935
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Privacy Officer** Each agency shall have a Chief Privacy Officer to assume primary responsibility for privacy and data protection policy, including—
(1) assuring that the use of technologies sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of information in an identifiable form;
(2) assuring that technologies used to collect, use, store, and disclose information in identifiable form allow for continuous auditing of compliance with stated privacy policies and practices governing the collection, use and distribution of information in the operation of the program;
(3) assuring that personal information contained in Privacy Act systems of records is handled in full compliance with fair information practices as defined in the Privacy Act of 1974 [[5 U.S.C. 552a](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim)];
(4) evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Federal Government;
(5) conducting a privacy impact assessment of proposed rules of the Department on the privacy of information in an identifiable form, including the type of personally identifiable information collected and the number of people affected;
(6) preparing a report to Congress on an annual basis on activities of the Department that affect privacy, including complaints of privacy violations, implementation of [section 552a of title 5](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title5-section552a&num=0&edition=prelim), 11 11 So in original. internal controls, and other relevant matters;
(7) ensuring that the Department protects information in an identifiable form and information systems from unauthorized
Source: Supplied U.S. Code snapshot — release unconfirmed · 42 U.S.C. § 2000ee–2
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
### Statutory Notes
Sections 3531 to 3538 comprised subchapter II of this chapter “INFORMATION SECURITY”.
Section 3531, added Pub. L. 107–296, title X, § 1001(b)(1), Nov. 25, 2002, 116 Stat. 2259, set forth purposes of subchapter II. See [section 3551 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3551&num=0&edition=prelim).
A prior section 3531, added Pub. L. 106–398, § 1 [[div. A], title X, § 1061], Oct. 30, 2000, 114 Stat. 1654, 1654A–266, set forth purposes of subchapter II prior to the general amendment of subchapter II by Pub. L. 107–296.
Section 3532, added Pub. L. 107–296, title X, § 1001(b)(1), Nov. 25, 2002, 116 Stat. 2260, related to definitions applicable to subchapter II. See [section 3552 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3552&num=0&edition=prelim).
A prior section 3532, added Pub. L. 106–398, § 1 [[div. A], title X, § 1061], Oct. 30, 2000, 114 Stat. 1654, 1654A–266, related to definitions applicable to subchapter II prior to the general amendment of subchapter II by Pub. L. 107–296.
Section 3533, added Pub. L. 107–296, title X, § 1001(b)(1), Nov. 25, 2002, 116 Stat. 2261, set forth authority and functions of the Director. See [section 3553 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3553&num=0&edition=prelim).
A prior section 3533, added Pub. L. 106–398, § 1 [[div. A], title X, § 1061], Oct. 30, 2000, 114 Stat. 1654, 1654A–266, set forth authority and functions of the Director prior to the general amendment of subchapter II by Pub. L. 107–296.
Section 3534, added Pub. L. 107–296, title X, § 1001(b)(1), Nov. 25, 2002, 116 Stat. 2262, related to Federal agency responsibilities. See [section 3554 of this
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3531 to 3549
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 192
TITLE 44—PUBLIC PRINTING AND DOCUMENTS
§ 3555
(III) the status of compliance of the af-
fected information systems with applica-
ble security requirements at the time of
the incident; and
(IV) the detection, response, and reme-
diation actions;
(ii) the total number of information se-
curity incidents, including a description of
incidents resulting in significant com-
promise of information security, system
impact levels, types of incident, and loca-
tions of affected systems;
(iii) a description of each major informa-
tion security incident that involved a
breach of personally identifiable informa-
tion, as defined by the Director, includ-
ing—
(I) the number of individuals whose in-
formation was affected by the major in-
formation security incident; and
(II) a description of the information
that was breached or exposed; and
(iv) any other information as the Direc-
tor or the Secretary, in consultation with
the Director, may require.
(B) UNCLASSIFIED REPORT.—
(i) IN GENERAL.—Each report submitted
under subparagraph (A) shall be in unclas-
sified form, but may include a classified
annex.
(ii) ACCESS TO INFORMATION.—The head of
an agency shall ensure that, to the great-
est extent practicable, information is in-
cluded in the unclassified version of the re-
ports submitted by the agency under sub-
paragraph (A).
(2) OTHER PLANS AND REPORTS.—Each agency
shall address the adequacy and effectiveness of
information security policies, procedures, and
practices in management plans and reports.
(d) PERFORMANCE PLAN.—(1) In addition to the
requirements of subsection (c), each agency, in
consultation with the Director, shall include as
part of the performance plan required under sec-
tion 1115 of title 31 a description of—
(A) the time periods; and
(
Source: Supplied 2024 U.S. Code historical extraction · 44 U.S.C. § 3555
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.