44 U.S.C. § 3556 — Federal information security incident cen-

Page 193 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3556 by an independent external auditor, as deter- mined by the Inspector General of the agency; and (2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to per- form the evaluation. (c) NATIONAL SECURITY SYSTEMS.—For each agency operating or exercising control of a na- tional security system, that portion of the eval- uation required by this section directly relating to a national security system shall be per- formed— (1) only by an entity designated by the agen- cy head; and (2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in ac- cordance with all applicable laws. (d) EXISTING EVALUATIONS.—The evaluation re- quired by this section may be based in whole or in part on an audit, evaluation, or report relat- ing to programs or practices of the applicable agency. (e) AGENCY REPORTING.—(1) Each year, not later than such date established by the Director, the head of each agency shall submit to the Di- rector the results of the evaluation required under this section. (2) To the extent an evaluation required under this section directly relates to a national secu- rity system, the evaluation results submitted to the Director shall contain only a summary and assessment of that portion of the evaluation di- rectly relating to a national security system. (f) PROTECTION OF INFORMATION.—Agencies and evaluators shall take appropriate steps to en- sure the protection of information which, if dis- closed, may adversely affect information secu- rity. Such protections shall be commensurate with the risk and comply with all applicable laws and regulations. (g) OMB REPORTS TO CONGRESS.—(1) The Direc- tor shall summarize the results of the evalua- tions conducted under this section in the report to Congress required under section 3553(c). (2) The Director’s report to Congress under this subsection shall summarize information re- garding information security relating to na- tional security systems in such a manner as to ensure appropriate protection for information associated with any information security vul- nerability in such system commensurate with the risk and in accordance with all applicable laws. (3) Evaluations and any other descriptions of information systems under the authority and control of the Director of National Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with ap- plicable laws. (h) COMPTROLLER GENERAL.—The Comptroller General shall periodically evaluate and report to Congress on— (1) the adequacy and effectiveness of agency information security policies and practices; and (2) implementation of the requirements of this subchapter. (i) ASSESSMENT TECHNICAL ASSISTANCE.—The Comptroller General may provide technical as- sistance to an Inspector General or the head of an agency, as applicable, to assist the Inspector General or head of an agency in carrying out the duties under this section, including by testing information security controls and procedures. (j) GUIDANCE.—The Director, in consultation with the Secretary, the Chief Information Offi- cers Council established under section 3603, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3082; amended Pub. L. 117–286, § 4(b)(89), Dec. 27, 2022, 136 Stat. 4352.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3535 and 3545 of this title prior to repeal by Pub. L. 113–283. AMENDMENTS 2022—Subsec. (b)(1). Pub. L. 117–286 substituted ‘‘chap- ter 4 of title 5,’’ for ‘‘the Inspector General Act of 1978,’’. § 3556. Federal information security incident cen- ter (a) IN GENERAL.—The Secretary shall ensure the operation of a central Federal information security incident center to— (1) provide timely technical assistance to op- erators of agency information systems regard- ing security incidents, including guidance on detecting and handling information security incidents; (2) compile and analyze information about incidents that threaten information security; (3) inform operators of agency information systems about current and potential informa- tion security threats, and vulnerabilities; (4) provide, as appropriate, intelligence and other information about cyber threats, vulnerabilities, and incidents to agencies to assist in risk assessments conducted under section 3554(b); and (5) consult with the National Institute of Standards and Technology, agencies or offices operating or exercising control of national se- curity systems (including the National Secu- rity Agency), and such other agencies or of- fices in accordance with law and as directed by the President regarding information security incidents and related matters. (b) NATIONAL SECURITY SYSTEMS.—Each agen- cy operating or exercising control of a national security system shall share information about information security incidents, threats, and vulnerabilities with the Federal information se- curity incident center to the extent consistent with standards and guidelines for national secu- rity systems, issued in accordance with law and as directed by the President. Page 194 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3557 1 So in original. Probably should be ‘‘National Institute of Standards’’. 2 So in original. Probably should be ‘‘chapter’’. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3084.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in section 3546 of this title prior to repeal by Pub. L. 113–283. § 3557. National security systems The head of each agency operating or exer- cising control of a national security system shall be responsible for ensuring that the agen- cy— (1) provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized ac- cess, use, disclosure, disruption, modification, or destruction of the information contained in such system; (2) implements information security policies and practices as required by standards and guidelines for national security systems, issued in accordance with law and as directed by the President; and (3) complies with the requirements of this subchapter. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3084.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3536 and 3547 of this title prior to repeal by Pub. L. 113–283. Statutory Notes and Related Subsidiaries ENFORCEMENT OF CYBERSECURITY REQUIREMENTS FOR NATIONAL SECURITY SYSTEMS Pub. L. 117–263, div. F, title LXIII, § 6309, Dec. 23, 2022, 136 Stat. 3506, as amended by Pub. L. 118–31, div. G, title III, § 7352, Dec. 22, 2023, 137 Stat. 1065, provided that: ‘‘(a) DEFINITIONS.—In this section: ‘‘(1) CYBERSECURITY REQUIREMENTS FOR NATIONAL SECURITY SYSTEMS.—The term ‘cybersecurity require- ments for national security systems’ means the min- imum cybersecurity requirements established by the National Manager, consistent with the direction of the President and in consultation with the Director of National Intelligence, that applies to all national security systems operated by, on the behalf of, or ad- ministered by the head of an element of the intel- ligence community. ‘‘(2) NATIONAL MANAGER.—The term ‘National Man- ager’ means the National Manager for National Secu- rity Systems designated by the President. ‘‘(3) NATIONAL SECURITY SYSTEMS.—The term ‘na- tional security systems’ includes— ‘‘(A) national security systems (as defined in sec- tion 3552(b) of title 44, United States Code); and ‘‘(B) information systems described in paragraph (2) or (3) of section 3553(e) of such title. ‘‘(b) IMPLEMENTATION DEADLINE.—The cybersecurity requirements for national security systems shall in- clude appropriate deadlines by which all elements of the intelligence community shall have fully imple- mented the requirements. ‘‘(c) REEVALUATION AND UPDATES.—Not less fre- quently than once every 2 years, the National Manager shall reevaluate and update the cybersecurity require- ments for national security systems. ‘‘(d) RESOURCES.—Each head of an element of the in- telligence community that owns or operates a national security system shall update plans of the element to prioritize resources in such a manner as to fully imple- ment the cybersecurity requirements for national secu- rity systems by the deadline established pursuant to subsection (b) for the next 10 fiscal years. ‘‘(e) IMPLEMENTATION REPORT.—Each head of an ele- ment of the intelligence community that owns or oper- ates a national security system shall submit to the congressional intelligence committees not later than 90 days after the date of the enactment of this subsection [Dec. 22, 2023] a plan detailing the cost and schedule re- quirements necessary to meet all of the cybersecurity requirements for national security systems by the end of fiscal year 2026. ‘‘(f) EXEMPTIONS.— ‘‘(1) IN GENERAL.—The head of an element of the in- telligence community may exempt a national secu- rity system owned or operated by the element from the cybersecurity requirements for national security systems if done so in accordance with the procedures established under paragraph (2). ‘‘(2) EXEMPTION PROCEDURES.—The National Man- ager shall, consistent with the direction of the Presi- dent, establish procedures that govern— ‘‘(A) the circumstances under which the head of an element of the intelligence community may ex- empt a national security system under paragraph (1); and ‘‘(B) the process for implementing the exemption. ‘‘(3) ANNUAL REPORTS ON EXEMPTIONS.— ‘‘(A) IN GENERAL.—Each year, the National Man- ager and the Director of National Intelligence shall— ‘‘(i) submit to the congressional intelligence committees an annual report documenting all ex- emptions made under paragraph (1) during the pe- riod covered by the report, along with the jus- tifications for the exemptions; and ‘‘(ii) in the case of an exemption made by the Assistant Secretary of State for Intelligence and Research under such paragraph, submit to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives a separate report de- scribing the exemption and the justification for it. ‘‘(B) MANNER.—Each report submitted under sub- paragraph (A) shall be submitted with such classi- fication as the Director considers appropriate and with due regard for the protection of sensitive in- telligence sources and methods.’’ [For definitions of ‘‘intelligence community’’ and ‘‘congressional intelligence committees’’ as used in sec- tion 6309 of Pub. L. 117–263, set out above, see section 3003 of Title 50, War and National Defense, as made ap- plicable by section 6002 of Pub. L. 117–263, which is set out as a note under section 3003 of Title 50.] § 3558. Effect on existing law Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards 1 and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under sec- tion 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters 2 29, 31, or 33 of title 44, the management of information re-