6 U.S.C. § 1523 — Federal cybersecurity requirements

Page 511 TITLE 6—DOMESTIC SECURITY § 1523 1 See References in Text note below. SUBCHAPTER II—FEDERAL CYBERSECURITY ENHANCEMENT § 1521. Definitions In this subchapter: (1) Agency The term ‘‘agency’’ has the meaning given the term in section 3502 of title 44. (2) Agency information system The term ‘‘agency information system’’ has the meaning given the term in section 660 of this title. (3) Appropriate congressional committees The term ‘‘appropriate congressional com- mittees’’ means— (A) the Committee on Homeland Security and Governmental Affairs of the Senate; and (B) the Committee on Homeland Security of the House of Representatives. (4) Cybersecurity risk; information system The terms ‘‘cybersecurity risk’’ and ‘‘infor- mation system’’ have the meanings given those terms in section 650 of this title. (5) Director The term ‘‘Director’’ means the Director of the Office of Management and Budget. (6) Intelligence community The term ‘‘intelligence community’’ has the meaning given the term in section 3003(4) of title 50. (7) National security system The term ‘‘national security system’’ has the meaning given the term in section 11103 of title 40. (8) Secretary The term ‘‘Secretary’’ means the Secretary of Homeland Security. (Pub. L. 114–113, div. N, title II, § 222, Dec. 18, 2015, 129 Stat. 2963; Pub. L. 115–278, § 2(h)(1)(D), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div. G, title LXXI, § 7143(d)(1)(A), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes REFERENCES IN TEXT This subchapter, referred to in text, was in the origi- nal ‘‘this subtitle’’, meaning subtitle B (§§ 221–229) of title II of div. N of Pub. L. 114–113, which is classified principally to this subchapter. For complete classifica- tion of subtitle B to the Code, see Tables. AMENDMENTS 2022—Par. (4). Pub. L. 117–263 substituted ‘‘section 650 of this title’’ for ‘‘section 659 of this title’’. 2018—Par. (2). Pub. L. 115–278, § 2(h)(1)(D)(i), sub- stituted ‘‘section 660 of this title’’ for ‘‘section 149 of this title, as added by section 223(a)(4) of this division’’. Par. (4). Pub. L. 115–278, § 2(h)(1)(D)(ii), substituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title, as so redesignated by section 223(a)(3) of this division’’. § 1522. Advanced internal defenses (a) Advanced network security tools (1) In general The Secretary shall include, in the efforts of the Department to continuously diagnose and mitigate cybersecurity risks, advanced net- work security tools to improve visibility of network activity, including through the use of commercial and free or open source tools, and to detect and mitigate intrusions and anoma- lous activity. (2) Development of plan The Director shall develop and the Secretary shall implement a plan to ensure that each agency utilizes advanced network security tools, including those described in paragraph (1), to detect and mitigate intrusions and anomalous activity. (b) Prioritizing advanced security tools The Director and the Secretary, in consulta- tion with appropriate agencies, shall— (1) review and update Government-wide poli- cies and programs to ensure appropriate prioritization and use of network security monitoring tools within agency networks; and (2) brief appropriate congressional commit- tees on such prioritization and use. (c) Improved metrics The Secretary, in collaboration with the Di- rector, shall review and update the metrics used to measure security under section 3554 of title 44 to include measures of intrusion and incident detection and response times. (d) Transparency and accountability The Director, in consultation with the Sec- retary, shall increase transparency to the public on agency cybersecurity posture, including by increasing the number of metrics available on Federal Government performance websites and, to the greatest extent practicable, displaying metrics for department components, small agen- cies, and micro-agencies. (e) Omitted (f) Exception The requirements under this section shall not apply to the Department of Defense, a national security system, or an element of the intel- ligence community. (Pub. L. 114–113, div. N, title II, § 224, Dec. 18, 2015, 129 Stat. 2967.) Editorial Notes CODIFICATION Section is comprised of section 224 of title II of div. N of Pub. L. 114–113. Subsec. (e) of section 224 of title II of div. N of Pub. L. 114–113 amended section 3553 of Title 44, Public Printing and Documents. § 1523. Federal cybersecurity requirements (a) Implementation of Federal cybersecurity standards Consistent with section 3553 of title 44, the Secretary, in consultation with the Director, shall exercise the authority to issue binding operational directives to assist the Director in ensuring timely agency adoption of and compli- ance with policies and standards promulgated under section 11331 of title 40 1 for securing agen- cy information systems. Page 512 TITLE 6—DOMESTIC SECURITY § 1524 (b) Cybersecurity requirements at agencies (1) In general Consistent with policies, standards, guide- lines, and directives on information security under subchapter II of chapter 35 of title 44 and the standards and guidelines promulgated under section 11331 of title 40 and except as provided in paragraph (2), not later than 1 year after December 18, 2015, the head of each agen- cy shall— (A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under the first sub- section (c) (relating to the inventory of major information systems) and the second subsection (c) (relating to the inventory of information systems) of section 3505 of title 44; (B) assess access controls to the data de- scribed in subparagraph (A), the need for readily accessible storage of the data, and individuals’ need to access the data; (C) encrypt or otherwise render indecipher- able to unauthorized users the data de- scribed in subparagraph (A) that is stored on or transiting agency information systems; (D) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that re- quires user authentication, as developed by the Administrator of General Services in collaboration with the Secretary; and (E) implement identity management con- sistent with section 7464 of title 15, including multi-factor authentication, for— (i) remote access to an agency informa- tion system; and (ii) each user account with elevated privileges on an agency information sys- tem. (2) Exception The requirements under paragraph (1) shall not apply to an agency information system for which— (A) the head of the agency has personally certified to the Director with particularity that— (i) operational requirements articulated in the certification and related to the agency information system would make it excessively burdensome to implement the cybersecurity requirement; (ii) the cybersecurity requirement is not necessary to secure the agency informa- tion system or agency information stored on or transiting it; and (iii) the agency has taken all necessary steps to secure the agency information system and agency information stored on or transiting it; and (B) the head of the agency or the designee of the head of the agency has submitted the certification described in subparagraph (A) to the appropriate congressional committees and the agency’s authorizing committees. (3) Construction Nothing in this section shall be construed to alter the authority of the Secretary, the Di- rector, or the Director of the National Insti- tute of Standards and Technology in imple- menting subchapter II of chapter 35 of title 44. Nothing in this section shall be construed to affect the National Institute of Standards and Technology standards process or the require- ment under section 3553(a)(4) of such title or to discourage continued improvements and ad- vancements in the technology, standards, poli- cies, and guidelines used to promote Federal information security. (c) Exception The requirements under this section shall not apply to the Department of Defense, a national security system, or an element of the intel- ligence community. (Pub. L. 114–113, div. N, title II, § 225, Dec. 18, 2015, 129 Stat. 2967.) Editorial Notes REFERENCES IN TEXT The text of section 11331 of title 40, referred to in sub- sec. (a), was generally amended by Pub. L. 117–167, div. B, title II, § 10246(f), Aug. 9, 2022, 136 Stat. 1492, so as to provide for the prescription by the Secretary of Com- merce of standards and guidelines pertaining to Fed- eral information systems. § 1524. Assessment; reports (a) Definitions In this section: (1) Agency information The term ‘‘agency information’’ has the meaning given the term in section 2213 of the Homeland Security Act of 2002 [6 U.S.C. 663]. (2) Cyber threat indicator; defensive measure The terms ‘‘cyber threat indicator’’ and ‘‘de- fensive measure’’ have the meanings given those terms in section 650 of this title. (3) Intrusion assessments The term ‘‘intrusion assessments’’ means ac- tions taken under the intrusion assessment plan to identify and remove intruders in agen- cy information systems. (4) Intrusion assessment plan The term ‘‘intrusion assessment plan’’ means the plan required under section 2210(b)(1) of the Homeland Security Act of 2002 [6 U.S.C. 660(b)(1)]. (5) Intrusion detection and prevention capa- bilities The term ‘‘intrusion detection and preven- tion capabilities’’ means the capabilities re- quired under section 2213(b) of the Homeland Security Act of 2002 [6 U.S.C. 663(b)]. (b) Third-party assessment Not later than 3 years after December 18, 2015, the Comptroller General of the United States shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Federal Government to securing agency in- formation systems, including the intrusion de- tection and prevention capabilities and the in- trusion assessment plan.