40 U.S.C. § 11319 — Resources, planning, and portfolio man-

Page 234 TITLE 40—PUBLIC BUILDINGS, PROPERTY, AND WORKS § 11319 acquisition, and procurement of information technology to support jointly with other execu- tive agencies the activities of interagency groups that are established to advise the Direc- tor of the Office of Management and Budget in carrying out the Director’s responsibilities under this chapter. The use of those amounts for that purpose is subject to requirements and lim- itations on uses and amounts that the Director may prescribe. The Director shall prescribe the requirements and limitations during the Direc- tor’s review of the executive agency’s proposed budget submitted to the Director by the head of the executive agency for purposes of section 1105 of title 31. (Pub. L. 107–217, Aug. 21, 2002, 116 Stat. 1242.) HISTORICAL AND REVISION NOTES Revised Section Source (U.S. Code) Source (Statutes at Large) 11318 .......... 40:1428. Pub. L. 104–106, div. E, title LI, § 5128, Feb. 10, 1996, 110 Stat. 687. § 11319. Resources, planning, and portfolio man- agement (a) DEFINITIONS.—In this section: (1) The term ‘‘covered agency’’ means each agency listed in section 901(b)(1) or 901(b)(2) of title 31. (2) The term ‘‘information technology’’ has the meaning given that term under capital planning guidance issued by the Office of Man- agement and Budget. (b) ADDITIONAL AUTHORITIES FOR CHIEF INFOR- MATION OFFICERS.— (1) PLANNING, PROGRAMMING, BUDGETING, AND EXECUTION AUTHORITIES FOR CIOS.— (A) IN GENERAL.—The head of each covered agency other than the Department of De- fense shall ensure that the Chief Informa- tion Officer of the agency has a significant role in— (i) the decision processes for all annual and multi-year planning, programming, budgeting, and execution decisions, related reporting requirements, and reports re- lated to information technology; and (ii) the management, governance, and oversight processes related to information technology. (B) BUDGET FORMULATION.—The Director of the Office of Management and Budget shall require in the annual information tech- nology capital planning guidance of the Of- fice of Management and Budget the fol- lowing: (i) That the Chief Information Officer of each covered agency other than the De- partment of Defense approve the informa- tion technology budget request of the cov- ered agency, and that the Chief Informa- tion Officer of the Department of Defense review and provide recommendations to the Secretary of Defense on the informa- tion technology budget request of the De- partment. (ii) That the Chief Information Officer of each covered agency certify that informa- tion technology investments are ade- quately implementing incremental devel- opment, as defined in capital planning guidance issued by the Office of Manage- ment and Budget. (C) REVIEW.— (i) IN GENERAL.—A covered agency other than the Department of Defense— (I) may not enter into a contract or other agreement for information tech- nology or information technology serv- ices, unless the contract or other agree- ment has been reviewed and approved by the Chief Information Officer of the agency; (II) may not request the reprogram- ming of any funds made available for in- formation technology programs, unless the request has been reviewed and ap- proved by the Chief Information Officer of the agency; and (III) may use the governance processes of the agency to approve such a contract or other agreement if the Chief Informa- tion Officer of the agency is included as a full participant in the governance processes. (ii) DELEGATION.— (I) IN GENERAL.—Except as provided in subclause (II), the duties of a Chief Infor- mation Officer under clause (i) are not delegable. (II) NON-MAJOR INFORMATION TECH- NOLOGY INVESTMENTS.—For a contract or agreement for a non-major information technology investment, as defined in the annual information technology capital planning guidance of the Office of Man- agement and Budget, the Chief Informa- tion Officer of a covered agency other than the Department of Defense may delegate the approval of the contract or agreement under clause (i) to an indi- vidual who reports directly to the Chief Information Officer. (2) PERSONNEL-RELATED AUTHORITY.—Not- withstanding any other provision of law, for each covered agency other than the Depart- ment of Defense, the Chief Information Officer of the covered agency shall approve the ap- pointment of any other employee with the title of Chief Information Officer, or who func- tions in the capacity of a Chief Information Officer, for any component organization with- in the covered agency. (c) LIMITATION.—None of the authorities pro- vided in this section shall apply to tele- communications or information technology that is fully funded by amounts made available— (1) under the National Intelligence Program, defined by section 3(6) of the National Secu- rity Act of 1947 (50 U.S.C. 3003(6)); (2) under the Military Intelligence Program or any successor program or programs; or (3) jointly under the National Intelligence Program and the Military Intelligence Pro- gram (or any successor program or programs). (d) INFORMATION TECHNOLOGY PORTFOLIO, PRO- GRAM, AND RESOURCE REVIEWS.— Page 235 TITLE 40—PUBLIC BUILDINGS, PROPERTY, AND WORKS § 11319 (1) PROCESS.—The Director of the Office of Management and Budget, in consultation with the Chief Information Officers of appropriate agencies, shall implement a process to assist covered agencies in reviewing their portfolio of information technology investments— (A) to identify or develop ways to increase the efficiency and effectiveness of the infor- mation technology investments of the cov- ered agency; (B) to identify or develop opportunities to consolidate the acquisition and management of information technology services, and in- crease the use of shared-service delivery models; (C) to identify potential duplication and waste; (D) to identify potential cost savings; (E) to develop plans for actions to optimize the information technology portfolio, pro- grams, and resources of the covered agency; (F) to develop ways to better align the in- formation technology portfolio, programs, and financial resources of the covered agen- cy to any multi-year funding requirements or strategic plans required by law; (G) to develop a multi-year strategy to identify and reduce duplication and waste within the information technology portfolio of the covered agency, including component- level investments and to identify projected cost savings resulting from such strategy; and (H) to carry out any other goals that the Director may establish. (2) METRICS AND PERFORMANCE INDICATORS.— The Director of the Office of Management and Budget, in consultation with the Chief Infor- mation Officers of appropriate agencies, shall develop standardized cost savings and cost avoidance metrics and performance indicators for use by agencies for the process imple- mented under paragraph (1). (3) ANNUAL REVIEW.—The Chief Information Officer of each covered agency, in conjunction with the Chief Operating Officer or Deputy Secretary (or equivalent) of the covered agen- cy and the Administrator of the Office of Elec- tronic Government, shall conduct an annual review of the information technology portfolio of the covered agency. (4) APPLICABILITY TO THE DEPARTMENT OF DE- FENSE.—In the case of the Department of De- fense, processes established pursuant to this subsection shall apply only to the business systems information technology portfolio of the Department of Defense and not to national security systems as defined by section 11103(a) of this title. The annual review required by paragraph (3) shall be carried out by the Chief Information Officer of the Department of De- fense, in consultation with the Under Sec- retary of Defense for Acquisition and Sustainment and other appropriate Depart- ment of Defense officials. The Secretary of De- fense may designate an existing investment or management review process to fulfill the re- quirement for the annual review required by paragraph (3), in consultation with the Admin- istrator of the Office of Electronic Govern- ment. (5) QUARTERLY REPORTS.— (A) IN GENERAL.—The Administrator of the Office of Electronic Government shall sub- mit a quarterly report on the cost savings and reductions in duplicative information technology investments identified through the review required by paragraph (3) to— (i) the Committee on Homeland Security and Governmental Affairs and the Com- mittee on Appropriations of the Senate; (ii) the Committee on Oversight and Government Reform and the Committee on Appropriations of the House of Rep- resentatives; and (iii) upon a request by any committee of Congress, to that committee. (B) INCLUSION IN OTHER REPORTS.—The re- ports required under subparagraph (A) may be included as part of another report sub- mitted to the committees of Congress de- scribed in clauses (i), (ii), and (iii) of sub- paragraph (A). (Added and amended Pub. L. 113–291, div. A, title VIII, §§ 831(a), 833, title IX, § 901(n)(1), Dec. 19, 2014, 128 Stat. 3438, 3442, 3469; Pub. L. 115–88, § 3, Nov. 21, 2017, 131 Stat. 1278; Pub. L. 115–91, div. A, title VIII, § 819(b), title X, § 1081(b)(1)(D), Dec. 12, 2017, 131 Stat. 1464, 1597; Pub. L. 115–232, div. A, title X, § 1081(f)(1)(A)(iii), Aug. 13, 2018, 132 Stat. 1986; Pub. L. 116–92, div. A, title IX, § 902(87), Dec. 20, 2019, 133 Stat. 1554; Pub. L. 118–31, div. A, title IX, § 901(f), Dec. 22, 2023, 137 Stat. 355.) Editorial Notes AMENDMENTS 2023—Subsec. (d)(4). Pub. L. 118–31 substituted ‘‘the Chief Information Officer of the Department of De- fense, in consultation with the Under Secretary of De- fense for Acquisition and Sustainment and’’ for ‘‘the Chief Management Officer of the Department of De- fense (or any successor to such Officer), in consultation with the Chief Information Officer, the Under Sec- retary of Defense for Acquisition and Sustainment, and’’. 2019—Subsec. (d)(4). Pub. L. 116–92 substituted ‘‘Under Secretary of Defense for Acquisition and Sustainment’’ for ‘‘Under Secretary of Defense for Acquisition, Tech- nology, and Logistics’’. 2018—Subsec. (d)(4). Pub. L. 115–232 substituted ‘‘Chief Management Officer’’ for ‘‘Deputy Chief Management Officer’’. 2017—Subsecs. (c), (d). Pub. L. 115–88, § 3(1), and Pub. L. 115–91, § 819(b)(1), amended section identically, redes- ignating subsec. (c) relating to information technology portfolio, program, and resource reviews as (d). Subsec. (d)(6). Pub. L. 115–88, § 3(2), and Pub. L. 115–91, § 819(b)(2), amended subsec. (d) identically, striking out par. (6). Text read as follows: ‘‘This subsection shall not be in effect on and after the date that is 5 years after the date of the enactment of the Carl Levin and How- ard P. ‘Buck’ McKeon National Defense Authorization Act for Fiscal Year 2015.’’ 2014—Subsec. (c). Pub. L. 113–291, § 833, added subsec. (c) relating to information technology portfolio, pro- gram, and resource reviews. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Government Reform of House of Representatives changed to Committee on Oversight and Reform of House of Representatives by House Resolution No. 6, One Hundred Sixteenth Con- Page 236 TITLE 40—PUBLIC BUILDINGS, PROPERTY, AND WORKS § 11331 gress, Jan. 9, 2019. Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representa- tives by House Resolution No. 5, One Hundred Eight- eenth Congress, Jan. 9, 2023. SUBCHAPTER III—OTHER RESPONSIBILITIES § 11331. Responsibilities for Federal information systems standards (a) STANDARDS AND GUIDELINES.— (1) AUTHORITY TO PRESCRIBE.—Except as pro- vided under paragraph (2), the Secretary of Commerce shall, on the basis of standards and guidelines developed by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Tech- nology Act (15 U.S.C. 278g–3(a)), prescribe standards and guidelines pertaining to Federal information systems. (2) NATIONAL SECURITY SYSTEMS.—Standards and guidelines for national security systems shall be developed, prescribed, enforced, and overseen as otherwise authorized by law and as directed by the President. (b) MANDATORY REQUIREMENTS.— (1) AUTHORITY TO MAKE MANDATORY.—Except as provided under paragraph (2), the Secretary of Commerce shall make standards prescribed under subsection (a)(1) compulsory and bind- ing to the extent determined necessary by the Secretary to improve the efficiency of oper- ation or security of Federal information sys- tems. (2) REQUIRED MANDATORY STANDARDS.— (A) IN GENERAL.—Standards prescribed under subsection (a)(1) shall include infor- mation security standards that— (i) provide minimum information secu- rity requirements as determined under section 20(b) of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3(b)); and (ii) are otherwise necessary to improve the security of Federal information and in- formation systems. (B) REQUIREMENT.—Information security standards described in subparagraph (A) shall be compulsory and binding. (c) AUTHORITY TO DISAPPROVE OR MODIFY.—The President may disapprove or modify the stand- ards and guidelines referred to in subsection (a)(1) if the President determines such action to be in the public interest. The President’s au- thority to disapprove or modify such standards and guidelines may not be delegated. Notice of such disapproval or modification shall be pub- lished promptly in the Federal Register. Upon receiving notice of such disapproval or modifica- tion, the Secretary of Commerce shall imme- diately rescind or modify such standards or guidelines as directed by the President. (d) EXERCISE OF AUTHORITY.—To ensure fiscal and policy consistency, the Secretary of Com- merce shall exercise the authority conferred by this section subject to direction by the Presi- dent and in coordination with the Director of the Office of Management and Budget. (e) APPLICATION OF MORE STRINGENT STAND- ARDS.—The head of an executive agency may employ standards for the cost-effective informa- tion security for Federal information systems within or under the supervision of that agency that are more stringent than the standards the Secretary prescribes under this section if the more stringent standards— (1) contain at least the applicable standards made compulsory and binding by the Sec- retary of Commerce; and (2) are otherwise consistent with policies and guidelines issued under section 3553 of title 44. (f) DECISIONS ON PROMULGATION OF STAND- ARDS.—The decision by the Secretary of Com- merce regarding the promulgation of any stand- ard under this section shall occur not later than 6 months after the submission of the proposed standard to the Secretary by the National Insti- tute of Standards and Technology, as provided under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3). (g) DEFINITIONS.—In this section: (1) FEDERAL INFORMATION SYSTEM.—The term ‘‘Federal information system’’ means an infor- mation system used or operated by an execu- tive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency. (2) INFORMATION SECURITY.—The term ‘‘infor- mation security’’ has the meaning given that term in section 3552(b)(3) of title 44. (3) NATIONAL SECURITY SYSTEM.—The term ‘‘national security system’’ has the meaning given that term in section 3552(b)(6) of title 44. (Pub. L. 107–217, Aug. 21, 2002, 116 Stat. 1243; Pub. L. 107–296, title X, § 1002(a), Nov. 25, 2002, 116 Stat. 2268; Pub. L. 107–347, title III, § 302(a), Dec. 17, 2002, 116 Stat. 2956; Pub. L. 117–167, div. B, title II, § 10246(f), Aug. 9, 2022, 136 Stat. 1492.) HISTORICAL AND REVISION NOTES Revised Section Source (U.S. Code) Source (Statutes at Large) 11331 .......... 40:1441. Pub. L. 104–106, div. E, title LI, § 5131(a)–(d), Feb. 10, 1996, 110 Stat. 687. Editorial Notes AMENDMENTS 2022—Pub. L. 117–167 amended text generally. Prior to amendment, text related to the definition of ‘‘informa- tion security’’, in subsec. (a); the requirement that the Director of the Office of Management and Budget pro- mulgate information security standards, in subsec. (b); the application of more stringent standards by heads of agencies, in subsec. (c); and requirements regarding de- cisions by the Director, in subsec. (d). 2002—Pub. L. 107–296 amended text generally. Prior to amendment, text, as amended generally by Pub. L. 107–347, read as follows: ‘‘(a) STANDARDS AND GUIDELINES.— ‘‘(1) AUTHORITY TO PRESCRIBE.—Except as provided under paragraph (2), the Secretary of Commerce shall, on the basis of standards and guidelines devel- oped by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of sec- tion 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3(a)), prescribe stand- ards and guidelines pertaining to Federal information systems.