44 U.S.C. § 3555 — Annual independent evaluation

Page 192 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3555 (III) the status of compliance of the af- fected information systems with applica- ble security requirements at the time of the incident; and (IV) the detection, response, and reme- diation actions; (ii) the total number of information se- curity incidents, including a description of incidents resulting in significant com- promise of information security, system impact levels, types of incident, and loca- tions of affected systems; (iii) a description of each major informa- tion security incident that involved a breach of personally identifiable informa- tion, as defined by the Director, includ- ing— (I) the number of individuals whose in- formation was affected by the major in- formation security incident; and (II) a description of the information that was breached or exposed; and (iv) any other information as the Direc- tor or the Secretary, in consultation with the Director, may require. (B) UNCLASSIFIED REPORT.— (i) IN GENERAL.—Each report submitted under subparagraph (A) shall be in unclas- sified form, but may include a classified annex. (ii) ACCESS TO INFORMATION.—The head of an agency shall ensure that, to the great- est extent practicable, information is in- cluded in the unclassified version of the re- ports submitted by the agency under sub- paragraph (A). (2) OTHER PLANS AND REPORTS.—Each agency shall address the adequacy and effectiveness of information security policies, procedures, and practices in management plans and reports. (d) PERFORMANCE PLAN.—(1) In addition to the requirements of subsection (c), each agency, in consultation with the Director, shall include as part of the performance plan required under sec- tion 1115 of title 31 a description of— (A) the time periods; and (B) the resources, including budget, staffing, and training, that are necessary to implement the program required under subsection (b). (2) The description under paragraph (1) shall be based on the risk assessments required under subsection (b)(1). (e) PUBLIC NOTICE AND COMMENT.—Each agency shall provide the public with timely notice and opportunities for comment on proposed informa- tion security policies and procedures to the ex- tent that such policies and procedures affect communication with the public. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3078; amended Pub. L. 114–113, div. N, title II, § 229(b), Dec. 18, 2015, 129 Stat. 2974; Pub. L. 115–390, title II, § 204(a)(2), Dec. 21, 2018, 132 Stat. 5193.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3534 and 3544 of this title prior to repeal by Pub. L. 113–283. AMENDMENTS 2018—Subsec. (a)(1)(B). Pub. L. 115–390, § 204(a)(2)(A), inserted ‘‘, subchapter III of chapter 13 of title 41,’’ after ‘‘complying with the requirements of this sub- chapter’’ in introductory provisions. Subsec. (a)(1)(B)(vi). Pub. L. 115–390, § 204(a)(2)(B), (C), added cl. (vi). 2015—Subsec. (a)(1)(B)(v). Pub. L. 114–113 added cl. (v). Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Government Reform of House of Rep- resentatives changed to Committee on Oversight and Government Reform of House of Representatives by House Resolution No. 6, One Hundred Tenth Congress, Jan. 5, 2007. Committee on Oversight and Government Reform of House of Representatives changed to Com- mittee on Oversight and Reform of House of Represent- atives by House Resolution No. 6, One Hundred Six- teenth Congress, Jan. 9, 2019. Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hun- dred Eighteenth Congress, Jan. 9, 2023. EFFECTIVE DATE OF 2018 AMENDMENT Amendment by Pub. L. 115–390 effective 90 days after Dec. 21, 2018, see section 205 of Pub. L. 115–390, set out as an Effective Date note under section 1321 of Title 41, Public Contracts. MAJOR INCIDENT Pub. L. 113–283, § 2(b), Dec. 18, 2014, 128 Stat. 3085, pro- vided that: ‘‘The Director of the Office of Management and Budget shall— ‘‘(1) develop guidance on what constitutes a major incident for purposes of section 3554(b) of title 44, United States Code, as added by subsection (a); and ‘‘(2) provide to Congress periodic briefings on the status of the developing of the guidance until the date on which the guidance is issued.’’ § 3555. Annual independent evaluation (a) IN GENERAL.—(1) Each year each agency shall have performed an independent evaluation of the information security program and prac- tices of that agency to determine the effective- ness of such program and practices. (2) Each evaluation under this section shall in- clude— (A) testing of the effectiveness of informa- tion security policies, procedures, and prac- tices of a representative subset of the agency’s information systems; (B) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency; and (C) separate presentations, as appropriate, regarding information security relating to na- tional security systems. (b) INDEPENDENT AUDITOR.—Subject to sub- section (c)— (1) for each agency with an Inspector Gen- eral appointed under chapter 4 of title 5, the annual evaluation required by this section shall be performed by the Inspector General or Page 193 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3556 by an independent external auditor, as deter- mined by the Inspector General of the agency; and (2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to per- form the evaluation. (c) NATIONAL SECURITY SYSTEMS.—For each agency operating or exercising control of a na- tional security system, that portion of the eval- uation required by this section directly relating to a national security system shall be per- formed— (1) only by an entity designated by the agen- cy head; and (2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in ac- cordance with all applicable laws. (d) EXISTING EVALUATIONS.—The evaluation re- quired by this section may be based in whole or in part on an audit, evaluation, or report relat- ing to programs or practices of the applicable agency. (e) AGENCY REPORTING.—(1) Each year, not later than such date established by the Director, the head of each agency shall submit to the Di- rector the results of the evaluation required under this section. (2) To the extent an evaluation required under this section directly relates to a national secu- rity system, the evaluation results submitted to the Director shall contain only a summary and assessment of that portion of the evaluation di- rectly relating to a national security system. (f) PROTECTION OF INFORMATION.—Agencies and evaluators shall take appropriate steps to en- sure the protection of information which, if dis- closed, may adversely affect information secu- rity. Such protections shall be commensurate with the risk and comply with all applicable laws and regulations. (g) OMB REPORTS TO CONGRESS.—(1) The Direc- tor shall summarize the results of the evalua- tions conducted under this section in the report to Congress required under section 3553(c). (2) The Director’s report to Congress under this subsection shall summarize information re- garding information security relating to na- tional security systems in such a manner as to ensure appropriate protection for information associated with any information security vul- nerability in such system commensurate with the risk and in accordance with all applicable laws. (3) Evaluations and any other descriptions of information systems under the authority and control of the Director of National Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with ap- plicable laws. (h) COMPTROLLER GENERAL.—The Comptroller General shall periodically evaluate and report to Congress on— (1) the adequacy and effectiveness of agency information security policies and practices; and (2) implementation of the requirements of this subchapter. (i) ASSESSMENT TECHNICAL ASSISTANCE.—The Comptroller General may provide technical as- sistance to an Inspector General or the head of an agency, as applicable, to assist the Inspector General or head of an agency in carrying out the duties under this section, including by testing information security controls and procedures. (j) GUIDANCE.—The Director, in consultation with the Secretary, the Chief Information Offi- cers Council established under section 3603, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of guidance for evaluating the effectiveness of an information security program and practices. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3082; amended Pub. L. 117–286, § 4(b)(89), Dec. 27, 2022, 136 Stat. 4352.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3535 and 3545 of this title prior to repeal by Pub. L. 113–283. AMENDMENTS 2022—Subsec. (b)(1). Pub. L. 117–286 substituted ‘‘chap- ter 4 of title 5,’’ for ‘‘the Inspector General Act of 1978,’’. § 3556. Federal information security incident cen- ter (a) IN GENERAL.—The Secretary shall ensure the operation of a central Federal information security incident center to— (1) provide timely technical assistance to op- erators of agency information systems regard- ing security incidents, including guidance on detecting and handling information security incidents; (2) compile and analyze information about incidents that threaten information security; (3) inform operators of agency information systems about current and potential informa- tion security threats, and vulnerabilities; (4) provide, as appropriate, intelligence and other information about cyber threats, vulnerabilities, and incidents to agencies to assist in risk assessments conducted under section 3554(b); and (5) consult with the National Institute of Standards and Technology, agencies or offices operating or exercising control of national se- curity systems (including the National Secu- rity Agency), and such other agencies or of- fices in accordance with law and as directed by the President regarding information security incidents and related matters. (b) NATIONAL SECURITY SYSTEMS.—Each agen- cy operating or exercising control of a national security system shall share information about information security incidents, threats, and vulnerabilities with the Federal information se- curity incident center to the extent consistent with standards and guidelines for national secu- rity systems, issued in accordance with law and as directed by the President.