Browse Arkansas Code titles and sections
6 U.S.C. § 1523 — Federal cybersecurity requirements
Federal law — U.S. Code and appendices · legal_authorities
**(a) Implementation of Federal cybersecurity standards** Consistent with [section 3553 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3553&num=0&edition=prelim), the Secretary, in consultation with the Director, shall exercise the authority to issue binding operational directives to assist the Director in ensuring timely agency adoption of and compliance with policies and standards promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim) 11 See References in Text note below. for securing agency information systems.
**(b) Cybersecurity requirements at agencies**
(1) **In general** — Consistent with policies, standards, guidelines, and directives on information security under subchapter II of chapter 35 of title 44 and the standards and guidelines promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim) and except as provided in paragraph (2), not later than 1 year after December 18, 2015, the head of each agency shall—
(A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under the first subsection (c) (relating to the inventory of major information systems) and the second subsection (c) (relating to the inventory of information systems) of [section 3505 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim);
(B) assess access controls to the data described in subparagraph (A), the need for readily accessible storage of the data, and individuals’ need to access the data;
(C) encrypt or otherwise render indecipherable to u
Source: Supplied U.S. Code snapshot — release unconfirmed · 6 U.S.C. § 1523
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: fb45ca45a6b19b3966e8ed496931f8dbd8b05de43639702916d8cad1d0c45626. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_9255c79f1b8bc8f864d3a668
Source file: Laws/federal/codes/united-states-code/title-6/section-1523-federal-cybersecurity-requirements--00a7f503e3.md
Pages: Not recorded – Not recorded
Passage SHA-256: e6af8fec408b08d519c227d1880decf5daf0328bdbbcf1215bd89cbbecd8becf
Source location: Title 6, Chapter 6, § 1523; chapter-006-cybersecurity.md
Stored source content
**(a) Implementation of Federal cybersecurity standards** Consistent with [section 3553 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3553&num=0&edition=prelim), the Secretary, in consultation with the Director, shall exercise the authority to issue binding operational directives to assist the Director in ensuring timely agency adoption of and compliance with policies and standards promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim) 11 See References in Text note below. for securing agency information systems.
**(b) Cybersecurity requirements at agencies**
(1) **In general** — Consistent with policies, standards, guidelines, and directives on information security under subchapter II of chapter 35 of title 44 and the standards and guidelines promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim) and except as provided in paragraph (2), not later than 1 year after December 18, 2015, the head of each agency shall—
(A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under the first subsection (c) (relating to the inventory of major information systems) and the second subsection (c) (relating to the inventory of information systems) of [section 3505 of title 44](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3505&num=0&edition=prelim);
(B) assess access controls to the data described in subparagraph (A), the need for readily accessible storage of the data, and individuals’ need to access the data;
(C) encrypt or otherwise render indecipherable to unauthorized users the data described in subparagraph (A) that is stored on or transiting agency information systems;
(D) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that requires user authentication, as developed by the Administrator of General Services in collaboration with the Secretary; and
(E) implement identity management consistent with [section 7464 of title 15](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section7464&num=0&edition=prelim), including multi-factor authentication, for—
(i) remote access to an agency information system; and
(ii) each user account with elevated privileges on an agency information system.
(2) **Exception** — The requirements under paragraph (1) shall not apply to an agency information system for which—
(A) the head of the agency has personally certified to the Director with particularity that—
(i) operational requirements articulated in the certification and related to the agency information system would make it excessively burdensome to implement the cybersecurity requirement;
(ii) the cybersecurity requirement is not necessary to secure the agency information system or agency information stored on or transiting it; and
(iii) the agency has taken all necessary steps to secure the agency information system and agency information stored on or transiting it; and
(B) the head of the agency or the designee of the head of the agency has submitted the certification described in subparagraph (A) to the appropriate congressional committees and the agency’s authorizing committees.
(3) **Construction** — Nothing in this section shall be construed to alter the authority of the Secretary, the Director, or the Director of the National Institute of Standards and Technology in implementing subchapter II of chapter 35 of title 44. Nothing in this section shall be construed to affect the National Institute of Standards and Technology standards process or the requirement under section 3553(a)(4) of such title or to discourage continued improvements and advancements in the technology, standards, policies, and guidelines used to promote Federal information security.
**(c) Exception** The requirements under this section shall not apply to the Department of Defense, a national security system, or an element of the intelligence community.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
In this subchapter:
(1) **Director** — The term “Director” means the Director of the National Institute of Standards and Technology.
(2) **Institute** — The term “Institute” means the National Institute of Standards and Technology.
Source: Supplied U.S. Code snapshot — release unconfirmed · 15 U.S.C. § 7464
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Standards and Guidelines.—**
(1) **Authority to prescribe.—** — Except as provided under paragraph (2), the Secretary of Commerce shall, on the basis of standards and guidelines developed by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(a)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/a&num=0&edition=prelim)), prescribe standards and guidelines pertaining to Federal information systems.
(2) **National security systems.—** — Standards and guidelines for national security systems shall be developed, prescribed, enforced, and overseen as otherwise authorized by law and as directed by the President.
**(b) Mandatory Requirements.—**
(1) **Authority to make mandatory.—** — Except as provided under paragraph (2), the Secretary of Commerce shall make standards prescribed under subsection (a)(1) compulsory and binding to the extent determined necessary by the Secretary to improve the efficiency of operation or security of Federal information systems.
(2) **Required mandatory standards.—**
(A) *In general.—* — Standards prescribed under subsection (a)(1) shall include information security standards that—
(i) provide minimum information security requirements as determined under section 20(b) of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3(b)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3/b&num=0&edition=prelim)); and
(ii) are otherwise necessary to improve the security of Federal information and information systems.
(B) *Requirement.—* — Information security standards described in subparagraph (A) shall be compulsory and
Source: Supplied U.S. Code snapshot — release unconfirmed · 40 U.S.C. § 11331
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a)** In carrying out the functions under this subchapter, the Director shall—
(1) in consultation with agency heads, set an annual Governmentwide goal for the reduction of information collection burdens by at least 10 percent during each of fiscal years 1996 and 1997 and 5 percent during each of fiscal years 1998, 1999, 2000, and 2001, and set annual agency goals to—
(A) reduce information collection burdens imposed on the public that—
(i) represent the maximum practicable opportunity in each agency; and
(ii) are consistent with improving agency management of the process for the review of collections of information established under section 3506(c); and
(B) improve information resources management in ways that increase the productivity, efficiency and effectiveness of Federal programs, including service delivery to the public;
(2) with selected agencies and non-Federal entities on a voluntary basis, conduct pilot projects to test alternative policies, practices, regulations, and procedures to fulfill the purposes of this subchapter, particularly with regard to minimizing the Federal information collection burden; and
(3) in consultation with the Administrator of General Services, the Director of the National Institute of Standards and Technology, the Archivist of the United States, and the Director of the Office of Personnel Management, develop and maintain a Governmentwide strategic plan for information resources management, that shall include—
(A) a description of the objectives and the means by which the Federal Government shall apply information resources to improve agency and program performance;
(B) plans for—
(i) reducing information burdens on the public, including reducing such burdens through the elimination of duplication and
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3505
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Director.—** The Director shall oversee agency information security policies and practices, including—
(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under [section 11331 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11331&num=0&edition=prelim);
(2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of—
(A) information collected or maintained by or on behalf of an agency; or
(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;
(3) ensuring that the Secretary carries out the authorities and functions under subsection (b);
(4) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act ([15 U.S.C. 278g–3](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section278g–3&num=0&edition=prelim)) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;
(5) overseeing agency compliance with the requirements of this subchapter and [section 1326 of title 41](https://uscode
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3553
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 511
TITLE 6—DOMESTIC SECURITY
§ 1523
1 See References in Text note below.
SUBCHAPTER II—FEDERAL
CYBERSECURITY ENHANCEMENT
§ 1521. Definitions
In this subchapter:
(1) Agency
The term ‘‘agency’’ has the meaning given
the term in section 3502 of title 44.
(2) Agency information system
The term ‘‘agency information system’’ has
the meaning given the term in section 660 of
this title.
(3) Appropriate congressional committees
The term ‘‘appropriate congressional com-
mittees’’ means—
(A) the Committee on Homeland Security
and Governmental Affairs of the Senate; and
(B) the Committee on Homeland Security
of the House of Representatives.
(4) Cybersecurity risk; information system
The terms ‘‘cybersecurity risk’’ and ‘‘infor-
mation system’’ have the meanings given
those terms in section 650 of this title.
(5) Director
The term ‘‘Director’’ means the Director of
the Office of Management and Budget.
(6) Intelligence community
The term ‘‘intelligence community’’ has the
meaning given the term in section 3003(4) of
title 50.
(7) National security system
The term ‘‘national security system’’ has
the meaning given the term in section 11103 of
title 40.
(8) Secretary
The term ‘‘Secretary’’ means the Secretary
of Homeland Security.
(Pub. L. 114–113, div. N, title II, § 222, Dec. 18,
2015, 129 Stat. 2963; Pub. L. 115–278, § 2(h)(1)(D),
Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div.
G, title LXXI, § 7143(d)(1)(A), Dec. 23, 2022, 136
Stat. 3663.)
Editorial Notes
REFERENCES IN TEXT
This subchapter, referred to in text, was in the origi-
nal ‘‘this subtitle’’, meaning subtitle B (§§ 221–229) of
title II of div. N of Pub. L. 114–113, which is classified
principally to this subchapter. For complete classifica-
tion of subtitle B to the Code
Source: Supplied 2024 U.S. Code historical extraction · 6 U.S.C. § 1523
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.