6 U.S.C. § 1522 — Advanced internal defenses

Page 511 TITLE 6—DOMESTIC SECURITY § 1523 1 See References in Text note below. SUBCHAPTER II—FEDERAL CYBERSECURITY ENHANCEMENT § 1521. Definitions In this subchapter: (1) Agency The term ‘‘agency’’ has the meaning given the term in section 3502 of title 44. (2) Agency information system The term ‘‘agency information system’’ has the meaning given the term in section 660 of this title. (3) Appropriate congressional committees The term ‘‘appropriate congressional com- mittees’’ means— (A) the Committee on Homeland Security and Governmental Affairs of the Senate; and (B) the Committee on Homeland Security of the House of Representatives. (4) Cybersecurity risk; information system The terms ‘‘cybersecurity risk’’ and ‘‘infor- mation system’’ have the meanings given those terms in section 650 of this title. (5) Director The term ‘‘Director’’ means the Director of the Office of Management and Budget. (6) Intelligence community The term ‘‘intelligence community’’ has the meaning given the term in section 3003(4) of title 50. (7) National security system The term ‘‘national security system’’ has the meaning given the term in section 11103 of title 40. (8) Secretary The term ‘‘Secretary’’ means the Secretary of Homeland Security. (Pub. L. 114–113, div. N, title II, § 222, Dec. 18, 2015, 129 Stat. 2963; Pub. L. 115–278, § 2(h)(1)(D), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div. G, title LXXI, § 7143(d)(1)(A), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle B (§§ 221–229) of title II of div. N of Pub. L. 114–113, which is classified principally to this subchapter. For complete classifica- tion of subtitle B to the Code, see Tables. AMENDMENTS 2022—Par. (4). Pub. L. 117–263 substituted ‘‘section 650 of this title’’ for ‘‘section 659 of this title’’. 2018—Par. (2). Pub. L. 115–278, § 2(h)(1)(D)(i), sub- stituted ‘‘section 660 of this title’’ for ‘‘section 149 of this title, as added by section 223(a)(4) of this division’’. Par. (4). Pub. L. 115–278, § 2(h)(1)(D)(ii), substituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title, as so redesignated by section 223(a)(3) of this division’’. § 1522. Advanced internal defenses (a) Advanced network security tools (1) In general The Secretary shall include, in the efforts of the Department to continuously diagnose and mitigate cybersecurity risks, advanced net- work security tools to improve visibility of network activity, including through the use of commercial and free or open source tools, and to detect and mitigate intrusions and anoma- lous activity. (2) Development of plan The Director shall develop and the Secretary shall implement a plan to ensure that each agency utilizes advanced network security tools, including those described in paragraph (1), to detect and mitigate intrusions and anomalous activity. (b) Prioritizing advanced security tools The Director and the Secretary, in consulta- tion with appropriate agencies, shall— (1) review and update Government-wide poli- cies and programs to ensure appropriate prioritization and use of network security monitoring tools within agency networks; and (2) brief appropriate congressional commit- tees on such prioritization and use. (c) Improved metrics The Secretary, in collaboration with the Di- rector, shall review and update the metrics used to measure security under section 3554 of title 44 to include measures of intrusion and incident detection and response times. (d) Transparency and accountability The Director, in consultation with the Sec- retary, shall increase transparency to the public on agency cybersecurity posture, including by increasing the number of metrics available on Federal Government performance websites and, to the greatest extent practicable, displaying metrics for department components, small agen- cies, and micro-agencies. (e) Omitted (f) Exception The requirements under this section shall not apply to the Department of Defense, a national security system, or an element of the intel- ligence community. (Pub. L. 114–113, div. N, title II, § 224, Dec. 18, 2015, 129 Stat. 2967.) Editorial Notes CODIFICATION Section is comprised of section 224 of title II of div. N of Pub. L. 114–113. Subsec. (e) of section 224 of title II of div. N of Pub. L. 114–113 amended section 3553 of Title 44, Public Printing and Documents. § 1523. Federal cybersecurity requirements (a) Implementation of Federal cybersecurity standards Consistent with section 3553 of title 44, the Secretary, in consultation with the Director, shall exercise the authority to issue binding operational directives to assist the Director in ensuring timely agency adoption of and compli- ance with policies and standards promulgated under section 11331 of title 40 1 for securing agen- cy information systems.