42 U.S.C. § 18445 — Information security

Page 9164 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 18443 (b)(2)(B), is Pub. L. 109–155, Dec. 30, 2005, 119 Stat. 2895, which was classified principally to chapter 150 (§ 16601 et seq.) of this title and was substantially repealed and restated in chapters 305 (§ 30501 et seq.), 401 (§ 40101 et seq.), 603 (§ 60301 et seq.) and 707 (§ 70701 et seq.) and sec- tions 20301, 20302, 30103(a), (b), 30104, 30306, 30703, 30704, 30902, 31301, 31501, 40701, 40904 to 40909, 50505, 50116, 60505, 70501 to 70503, and 70902 to 70905 of Title 51, National and Commercial Space Programs, by Pub. L. 111–314, §§ 3, 6, Dec. 18, 2010, 124 Stat. 3328, 3444. For complete classi- fication of this Act to the Code, see Short Title of 2005 Act note set out under section 10101 of Title 51 and Ta- bles. § 18443. Eligibility for service of individual cur- rently serving as Administrator of NASA The individual serving in the position of Ad- ministrator of the National Aeronautics and Space Administration as of October 11, 2010, comes from civilian life and is therefore eligible to serve in such position, in conformance with section 20111 of title 51. (Pub. L. 111–267, title XII, § 1204, Oct. 11, 2010, 124 Stat. 2842.) Editorial Notes CODIFICATION In text, ‘‘section 20111 of title 51’’ substituted for ‘‘section 202 of the National Aeronautics and Space Act of 1958 (42 U.S.C. 2472(a))’’ on authority of Pub. L. 111–314, § 5(e), Dec. 18, 2010, 124 Stat. 3443, which Act en- acted Title 51, National and Commercial Space Pro- grams. § 18444. Counterfeit parts (a) In general The Administrator shall plan, develop, and im- plement a program, in coordination with other Federal agencies, to detect, track, catalog, and reduce the number of counterfeit electronic parts in the NASA supply chain. (b) Requirements In carrying out the program, the Adminis- trator shall establish— (1) counterfeit part identification training for all employees that procure, process, dis- tribute, and install electronic parts that will— (A) teach employees how to identify coun- terfeit parts; (B) educate employees on procedures to follow if they suspect a part is counterfeit; (C) regularly update employees on new threats, identification techniques, and re- porting requirements; and (D) integrate industry associations, manu- facturers, suppliers, and other Federal agen- cies, as appropriate; (2) an internal database to track all sus- pected and confirmed counterfeit electronic parts that will maintain, at a minimum— (A) companies and individuals known and suspected of selling counterfeit parts; (B) parts known and suspected of being counterfeit, including lot and date codes, part numbers, and part images; (C) countries of origin; (D) sources of reporting; (E) United States Customs seizures; and (F) Government-Industry Data Exchange Program reports and other public or private sector database notifications; and (3) a mechanism to report all information on suspected and confirmed counterfeit elec- tronic parts to law enforcement agencies, in- dustry associations, and other databases, and to issue bulletins to industry on counterfeit electronic parts and related counterfeit activ- ity. (c) Review of procurement and acquisition pol- icy (1) In general In establishing the program, the Adminis- trator shall amend existing acquisition and procurement policy to purchase electronic parts from trusted or approved manufacturers. To determine trusted or approved manufactur- ers, the Administrator shall establish a list, assessed and adjusted at least annually, and create criteria for manufacturers to meet in order to be placed onto the list. (2) Criteria The criteria may include— (A) authentication or encryption codes; (B) embedded security markings in parts; (C) unique, harder to copy labels and markings; (D) identifying distinct lot and serial codes on external packaging; (E) radio frequency identification embed- ded into high-value parts; (F) physical destruction of all defective, damaged, and sub-standard parts that are by-products of the manufacturing process; (G) testing certifications; (H) maintenance of procedures for han- dling any counterfeit parts that slip through; (I) maintenance of secure facilities to pre- vent unauthorized access to proprietary in- formation; and (J) maintenance of product return, buy back, and inventory control practices that limit counterfeiting. (d) Report to Congress Within one year after October 11, 2010, the Ad- ministrator shall report on the progress of im- plementing this section to the appropriate com- mittees of Congress. (Pub. L. 111–267, title XII, § 1206, Oct. 11, 2010, 124 Stat. 2843.) § 18445. Information security (a) Monitoring risk (1) Update on system implementation Not later than 120 days after October 11, 2010, and on a biennial basis thereafter, the chief in- formation officer of NASA, in coordination with other national security agencies, shall provide to the appropriate committees of Con- gress— (A) an update on efforts to implement a system to provide dynamic, comprehensive, real-time information regarding risk of un- authorized remote, proximity, and insider use or access, for all information infrastruc- ture under the responsibility of the chief in- formation officer, and mission-related net- works, including contractor networks; Page 9165 TITLE 42—THE PUBLIC HEALTH AND WELFARE § 18501 1 See References in Text note below. (B) an assessment of whether the system has demonstrably and quantifiably reduced network risk compared to alternative meth- ods of measuring security; and (C) an assessment of the progress that each center and facility has made toward imple- menting the system. (2) Existing assessments The assessments required of the Inspector General under section 3545 1 of title 44 shall evaluate the effectiveness of the system de- scribed in this subsection. (b) Information security awareness and edu- cation (1) In general In consultation with the Department of Edu- cation, other national security agencies, and other agency directorates, the chief informa- tion officer shall institute an information se- curity awareness and education program for all operators and users of NASA information infrastructure, with the goal of reducing unau- thorized remote, proximity, and insider use or access. (2) Program requirements (A) The program shall include, at a min- imum, ongoing classified and unclassified threat-based briefings, and automated exer- cises and examinations that simulate common attack techniques. (B) All agency employees and contractors engaged in the operation or use of agency in- formation infrastructure shall participate in the program. (C) Access to NASA information infrastruc- ture shall only be granted to operators and users who regularly satisfy the requirements of the program. (D) The chief human capital officer of NASA, in consultation with the chief information of- ficer, shall create a system to reward opera- tors and users of agency information infra- structure for continuous high achievement in the program. (c) Information infrastructure defined In this section, the term ‘‘information infra- structure’’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including programmable elec- tronic devices and communications networks and any associated hardware, software, or data. (Pub. L. 111–267, title XII, § 1207, Oct. 11, 2010, 124 Stat. 2844.) Editorial Notes REFERENCES IN TEXT Section 3545 of title 44, referred to in subsec. (a)(2), was repealed by Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3073. Provisions similar to section 3545 of title 44 are now contained in section 3555 of title 44, as enacted by Pub. L. 113–283. CHAPTER 160—TREATMENT OF CERTAIN PAYMENTS IN EUGENICS COMPENSATION Sec. 18501. Exclusion of payments from State eugenics compensation programs from consideration in determining eligibility for, or the amount of, Federal public benefits. § 18501. Exclusion of payments from State eugen- ics compensation programs from consider- ation in determining eligibility for, or the amount of, Federal public benefits (a) In general Notwithstanding any other provision of law, payments made under a State eugenics com- pensation program shall not be considered as in- come or resources in determining eligibility for, or the amount of, any Federal public benefit. (b) Definitions For purposes of this section: (1) Federal public benefit The term ‘‘Federal public benefit’’ means— (A) any grant, contract, loan, professional license, or commercial license provided by an agency of the United States or by appro- priated funds of the United States; and (B) any retirement, welfare, health, dis- ability, public or assisted housing, postsec- ondary education, food assistance, unem- ployment benefit, or any other similar ben- efit for which payments or assistance are provided to an individual, household, or fam- ily eligibility unit by an agency of the United States or by appropriated funds of the United States. (2) State eugenics compensation program The term ‘‘State eugenics compensation pro- gram’’ means a program established by State law that is intended to compensate individuals who were sterilized under the authority of the State. (Pub. L. 114–241, § 2, Oct. 7, 2016, 130 Stat. 976.) Statutory Notes and Related Subsidiaries SHORT TITLE Pub. L. 114–241, § 1, Oct. 7, 2016, 130 Stat. 976, provided that: ‘‘This Act [enacting this chapter] may be cited as the ‘Treatment of Certain Payments in Eugenics Com- pensation Act’.’’ CHAPTER 161—DEPARTMENT OF ENERGY RESEARCH AND INNOVATION Sec. 18601. Definitions. SUBCHAPTER I—LABORATORY MODERNIZATION AND TECHNOLOGY TRANSFER 18611. Sense of Congress on accelerating energy in- novation. 18612. Restoration of laboratory directed research and development program. 18613. Research grants database. 18614. Technology transfer and transitions assess- ment. 18615. Agreements for commercializing technology pilot program. SUBCHAPTER II—DEPARTMENT OF ENERGY RESEARCH COORDINATION 18631. Crosscutting research and development.