6 U.S.C. § 1524 — Assessment; reports

Page 512 TITLE 6—DOMESTIC SECURITY § 1524 (b) Cybersecurity requirements at agencies (1) In general Consistent with policies, standards, guide- lines, and directives on information security under subchapter II of chapter 35 of title 44 and the standards and guidelines promulgated under section 11331 of title 40 and except as provided in paragraph (2), not later than 1 year after December 18, 2015, the head of each agen- cy shall— (A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under the first sub- section (c) (relating to the inventory of major information systems) and the second subsection (c) (relating to the inventory of information systems) of section 3505 of title 44; (B) assess access controls to the data de- scribed in subparagraph (A), the need for readily accessible storage of the data, and individuals’ need to access the data; (C) encrypt or otherwise render indecipher- able to unauthorized users the data de- scribed in subparagraph (A) that is stored on or transiting agency information systems; (D) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that re- quires user authentication, as developed by the Administrator of General Services in collaboration with the Secretary; and (E) implement identity management con- sistent with section 7464 of title 15, including multi-factor authentication, for— (i) remote access to an agency informa- tion system; and (ii) each user account with elevated privileges on an agency information sys- tem. (2) Exception The requirements under paragraph (1) shall not apply to an agency information system for which— (A) the head of the agency has personally certified to the Director with particularity that— (i) operational requirements articulated in the certification and related to the agency information system would make it excessively burdensome to implement the cybersecurity requirement; (ii) the cybersecurity requirement is not necessary to secure the agency informa- tion system or agency information stored on or transiting it; and (iii) the agency has taken all necessary steps to secure the agency information system and agency information stored on or transiting it; and (B) the head of the agency or the designee of the head of the agency has submitted the certification described in subparagraph (A) to the appropriate congressional committees and the agency’s authorizing committees. (3) Construction Nothing in this section shall be construed to alter the authority of the Secretary, the Di- rector, or the Director of the National Insti- tute of Standards and Technology in imple- menting subchapter II of chapter 35 of title 44. Nothing in this section shall be construed to affect the National Institute of Standards and Technology standards process or the require- ment under section 3553(a)(4) of such title or to discourage continued improvements and ad- vancements in the technology, standards, poli- cies, and guidelines used to promote Federal information security. (c) Exception The requirements under this section shall not apply to the Department of Defense, a national security system, or an element of the intel- ligence community. (Pub. L. 114–113, div. N, title II, § 225, Dec. 18, 2015, 129 Stat. 2967.) Editorial Notes REFERENCES IN TEXT The text of section 11331 of title 40, referred to in sub- sec. (a), was generally amended by Pub. L. 117–167, div. B, title II, § 10246(f), Aug. 9, 2022, 136 Stat. 1492, so as to provide for the prescription by the Secretary of Com- merce of standards and guidelines pertaining to Fed- eral information systems. § 1524. Assessment; reports (a) Definitions In this section: (1) Agency information The term ‘‘agency information’’ has the meaning given the term in section 2213 of the Homeland Security Act of 2002 [6 U.S.C. 663]. (2) Cyber threat indicator; defensive measure The terms ‘‘cyber threat indicator’’ and ‘‘de- fensive measure’’ have the meanings given those terms in section 650 of this title. (3) Intrusion assessments The term ‘‘intrusion assessments’’ means ac- tions taken under the intrusion assessment plan to identify and remove intruders in agen- cy information systems. (4) Intrusion assessment plan The term ‘‘intrusion assessment plan’’ means the plan required under section 2210(b)(1) of the Homeland Security Act of 2002 [6 U.S.C. 660(b)(1)]. (5) Intrusion detection and prevention capa- bilities The term ‘‘intrusion detection and preven- tion capabilities’’ means the capabilities re- quired under section 2213(b) of the Homeland Security Act of 2002 [6 U.S.C. 663(b)]. (b) Third-party assessment Not later than 3 years after December 18, 2015, the Comptroller General of the United States shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Federal Government to securing agency in- formation systems, including the intrusion de- tection and prevention capabilities and the in- trusion assessment plan. Page 513 TITLE 6—DOMESTIC SECURITY § 1524 1 See References in Text note below. (c) Reports to Congress (1) Intrusion detection and prevention capa- bilities (A) Secretary of Homeland Security report Not later than 6 months after December 18, 2015, and annually thereafter, the Secretary shall submit to the appropriate congres- sional committees a report on the status of implementation of the intrusion detection and prevention capabilities, including— (i) a description of privacy controls; (ii) a description of the technologies and capabilities utilized to detect cybersecurity risks in network traffic, in- cluding the extent to which those tech- nologies and capabilities include existing commercial and noncommercial tech- nologies; (iii) a description of the technologies and capabilities utilized to prevent network traffic associated with cybersecurity risks from transiting or traveling to or from agency information systems, including the extent to which those technologies and ca- pabilities include existing commercial and noncommercial technologies; (iv) a list of the types of indicators or other identifiers or techniques used to de- tect cybersecurity risks in network traffic transiting or traveling to or from agency information systems on each iteration of the intrusion detection and prevention ca- pabilities and the number of each such type of indicator, identifier, and tech- nique; (v) the number of instances in which the intrusion detection and prevention capa- bilities detected a cybersecurity risk in network traffic transiting or traveling to or from agency information systems and the number of times the intrusion detec- tion and prevention capabilities blocked network traffic associated with cybersecurity risk; and (vi) a description of the pilot established under section 2213(c)(5) of the Homeland Security Act of 2002 [6 U.S.C. 663(c)(5)], in- cluding the number of new technologies tested and the number of participating agencies. (B) OMB report Not later than 18 months after December 18, 2015, and annually thereafter, the Direc- tor shall submit to Congress, as part of the report required under section 3553(c) of title 44, an analysis of agency application of the intrusion detection and prevention capabili- ties, including— (i) a list of each agency and the degree to which each agency has applied the intru- sion detection and prevention capabilities to an agency information system; and (ii) a list by agency of— (I) the number of instances in which the intrusion detection and prevention capabilities detected a cybersecurity risk in network traffic transiting or traveling to or from an agency informa- tion system and the types of indicators, identifiers, and techniques used to detect such cybersecurity risks; and (II) the number of instances in which the intrusion detection and prevention capabilities prevented network traffic associated with a cybersecurity risk from transiting or traveling to or from an agency information system and the types of indicators, identifiers, and tech- niques used to detect such agency infor- mation systems. (C) Chief information officer Not earlier than 18 months after December 18, 2015, and not later than 2 years after De- cember 18, 2015, the Federal Chief Informa- tion Officer shall review and submit to the appropriate congressional committees a re- port assessing the intrusion detection and intrusion prevention capabilities, includ- ing— (i) the effectiveness of the system in de- tecting, disrupting, and preventing cyber- threat actors, including advanced per- sistent threats, from accessing agency in- formation and agency information sys- tems; (ii) whether the intrusion detection and prevention capabilities, continuous diagnostics and mitigation, and other sys- tems deployed under subtitle D 1 of title II of the Homeland Security Act of 2002 (6 U.S.C. 231 et seq.) are effective in securing Federal information systems; (iii) the costs and benefits of the intru- sion detection and prevention capabilities, including as compared to commercial tech- nologies and tools and including the value of classified cyber threat indicators; and (iv) the capability of agencies to protect sensitive cyber threat indicators and de- fensive measures if they were shared through unclassified mechanisms for use in commercial technologies and tools. (2) OMB report on development and implemen- tation of intrusion assessment plan, ad- vanced internal defenses, and Federal cybersecurity requirements The Director shall— (A) not later than 6 months after Decem- ber 18, 2015, and 30 days after any update thereto, submit the intrusion assessment plan to the appropriate congressional com- mittees; (B) not later than 1 year after December 18, 2015, and annually thereafter, submit to Congress, as part of the report required under section 3553(c) of title 44— (i) a description of the implementation of the intrusion assessment plan; (ii) the findings of the intrusion assess- ments conducted pursuant to the intrusion assessment plan; (iii) a description of the advanced net- work security tools included in the efforts to continuously diagnose and mitigate cybersecurity risks pursuant to section 1522(a)(1) of this title; and Page 514 TITLE 6—DOMESTIC SECURITY § 1525 1 So in original. Probably should be ‘‘663(c)(2)’’. (iv) a list by agency of compliance with the requirements of section 1523(b) of this title; and (C) not later than 1 year after December 18, 2015, submit to the appropriate congres- sional committees— (i) a copy of the plan developed pursuant to section 1522(a)(2) of this title; and (ii) the improved metrics developed pur- suant to section 1522(c) of this title. (d) Form Each report required under this section shall be submitted in unclassified form, but may in- clude a classified annex. (Pub. L. 114–113, div. N, title II, § 226, Dec. 18, 2015, 129 Stat. 2969; Pub. L. 115–278, § 2(h)(1)(F), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div. G, title LXXI, § 7143(d)(1)(B), Dec. 23, 2022, 136 Stat. 3663.) Editorial Notes REFERENCES IN TEXT Subtitle D of title II of the Homeland Security Act of 2002, referred to in subsec. (c)(1)(C)(ii), is subtitle D (§§ 231–237) of title II of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2159, which enacted part D (§ 161 et seq.) of sub- chapter II of chapter 1 of this title and amended sec- tions 10102 and 10122 of Title 34, Crime Control and Law Enforcement. Subtitle D was redesignated subtitle C of title II of the Homeland Security Act of 2002 by Pub. L. 115–278, § 2(g)(2)(K), Nov. 16, 2018, 132 Stat. 4178, and is classified principally to part C (§ 161 et seq.) of sub- chapter II of chapter 1 of this title. For complete clas- sification of subtitle C to the Code, see Tables. AMENDMENTS 2022—Subsec. (a)(2). Pub. L. 117–263 substituted ‘‘sec- tion 650 of this title’’ for ‘‘section 1501 of this title’’. 2018—Subsec. (a)(1). Pub. L. 115–278, § 2(h)(1)(F)(i)(I), substituted ‘‘section 2213’’ for ‘‘section 230’’ and struck out before period at end ‘‘, as added by section 223(a)(6) of this division’’. Subsec. (a)(4). Pub. L. 115–278, § 2(h)(1)(F)(i)(II), sub- stituted ‘‘section 2210(b)(1)’’ for ‘‘section 228(b)(1)’’ and struck out before period at end ‘‘, as added by section 223(a)(4) of this division’’. Subsec. (a)(5). Pub. L. 115–278, § 2(h)(1)(F)(i)(III), sub- stituted ‘‘section 2213(b)’’ for ‘‘section 230(b)’’ and struck out before period at end ‘‘, as added by section 223(a)(6) of this division’’. Subsec. (c)(1)(A)(vi). Pub. L. 115–278, § 2(h)(1)(F)(ii), substituted ‘‘section 2213(c)(5)’’ for ‘‘section 230(c)(5)’’ and struck out ‘‘, as added by section 223(a)(6) of this division’’ after ‘‘Homeland Security Act of 2002’’. § 1525. Termination (a) In general The authority provided under section 663 of this title, and the reporting requirements under section 1524(c) of this title shall terminate on March 14, 2025. (b) Rule of construction Nothing in subsection (a) shall be construed to affect the limitation of liability of a private en- tity for assistance provided to the Secretary under section 663(d)(2) 1 of this title, if such as- sistance was rendered before the termination date under subsection (a) or otherwise during a period in which the assistance was authorized. (Pub. L. 114–113, div. N, title II, § 227, Dec. 18, 2015, 129 Stat. 2971; Pub. L. 115–278, § 2(h)(1)(G), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–328, div. O, title I, § 101, Dec. 29, 2022, 136 Stat. 5226; Pub. L. 118–47, div. G, title I, § 106, Mar. 23, 2024, 138 Stat. 857; Pub. L. 118–83, div. B, title I, § 103, Sept. 26, 2024, 138 Stat. 1534; Pub. L. 118–158, div. E, § 5104, Dec. 21, 2024, 138 Stat. 1771.) Editorial Notes AMENDMENTS 2024—Subsec. (a). Pub. L. 118–158 substituted ‘‘March 14, 2025’’ for ‘‘December 20, 2024’’. Pub. L. 118–83 substituted ‘‘December 20, 2024’’ for ‘‘September 30, 2024’’. Pub. L. 118–47 substituted ‘‘September 30, 2024’’ for ‘‘September 30, 2023’’. 2022—Subsec. (a). Pub. L. 117–328 substituted ‘‘Sep- tember 30, 2023’’ for ‘‘the date that is 7 years after De- cember 18, 2015’’. 2018—Subsec. (a). Pub. L. 115–278, § 2(h)(1)(G)(i), sub- stituted ‘‘section 663 of this title’’ for ‘‘section 151 of this title, as added by section 223(a)(6) of this divi- sion,’’. Subsec. (b). Pub. L. 115–278, § 2(h)(1)(G)(ii), substituted ‘‘section 663(d)(2) of this title’’ for ‘‘section 151(d)(2) of this title, as added by section 223(a)(6) of this divi- sion,’’. § 1526. Inventory of cryptographic systems; mi- gration to post-quantum cryptography (a) Inventory (1) Establishment Not later than 180 days after December 21, 2022, the Director of OMB, in coordination with the National Cyber Director and in con- sultation with the Director of CISA, shall issue guidance on the migration of informa- tion technology to post-quantum cryptog- raphy, which shall include at a minimum— (A) a requirement for each agency to es- tablish and maintain a current inventory of information technology in use by the agency that is vulnerable to decryption by quantum computers, prioritized using the criteria de- scribed in subparagraph (B); (B) criteria to allow agencies to prioritize their inventory efforts; and (C) a description of the information re- quired to be reported pursuant to subsection (b). (2) Additional content in guidance In the guidance established by paragraph (1), the Director of OMB shall include, in addition to the requirements described in that para- graph— (A) a description of information tech- nology to be prioritized for migration to post-quantum cryptography; and (B) a process for evaluating progress on migrating information technology to post- quantum cryptography, which shall be auto- mated to the greatest extent practicable. (3) Periodic updates The Director of OMB shall update the guid- ance required under paragraph (1) as the Di- rector of OMB determines necessary, in co- ordination with the National Cyber Director and in consultation with the Director of CISA. (b) Agency reports Not later than 1 year after December 21, 2022, and on an ongoing basis thereafter, the head of