Browse Arkansas Code titles and sections
10 U.S.C. § 2223a — Untitled legal text
Federal law — U.S. Code and appendices · legal_authorities
Page 1782
TITLE 10—ARMED FORCES
[§ 2223a
compliance of that infrastructure with such policies,
procedures, and practices, including automation of—
‘‘(A) management, operational, and technical
controls of every information system identified in
the inventory required under section 3505(c) of title
44, United States Code; and
‘‘(B) management, operational, and technical con-
trols relied on for evaluations under [former] sec-
tion 3545 of title 44, United States Code [see now 44
U.S.C. 3555].
‘‘(b) DEFINITIONS.—In this section:
‘‘(1) The term ‘information security incident’
means an occurrence that—
‘‘(A) actually or potentially jeopardizes the con-
fidentiality, integrity, or availability of an infor-
mation system or the information such system
processes, stores, or transmits; or
‘‘(B) constitutes a violation or imminent threat
of violation of security policies, security proce-
dures, or acceptable use policies with respect to an
information system.
‘‘(2) The term ‘information infrastructure’ means
the underlying framework, equipment, and software
that an information system and related assets rely on
to process, transmit, receive, or store information
electronically.
‘‘(3) The term ‘national security system’ has the
meaning given that term in [former] section 3542(b)(2)
of title 44, United States Code [see now 44 U.S.C.
3552(b)(6)].’’
[§ 2223a. Renumbered § 4571]
§ 2224. Defense Information Assurance Program
(a) DEFENSE
INFORMATION
ASSURANCE
PRO-
GRAM.—The Secretary of Defense shall carry out
a program, to be known as the ‘‘Defense Infor-
mation Assurance Program’’, to protect and de-
fend Department of Defense information, infor-
mation systems, and information networks that
are critical to the Department and the armed
forces during day-to-da
Source: Supplied 2024 U.S. Code historical extraction · 10 U.S.C. § 2223a
Stored review status: historical_2024_not_currentness_verified. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: d2288b557bb9911c356e4c95c30b14fba1288c932b81b0ab37a01fc5a888b176. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:usc2024-c0689c0129d96746c8a76439
Source file: Laws/federal/codes/united-states-code-2024/title-10/section-2223a-untitled-legal-text--4e5f82e993.md
Pages: Not recorded – Not recorded
Passage SHA-256: a7bd6f3c062bfadbb9eb043dd13da33d1c3e98d0b371519581152da01d941d13
Source location: USCODE-2024-title10-subtitleA-partIV-chap131-sec2223a.pdf
Stored source content
Page 1782
TITLE 10—ARMED FORCES
[§ 2223a
compliance of that infrastructure with such policies,
procedures, and practices, including automation of—
‘‘(A) management, operational, and technical
controls of every information system identified in
the inventory required under section 3505(c) of title
44, United States Code; and
‘‘(B) management, operational, and technical con-
trols relied on for evaluations under [former] sec-
tion 3545 of title 44, United States Code [see now 44
U.S.C. 3555].
‘‘(b) DEFINITIONS.—In this section:
‘‘(1) The term ‘information security incident’
means an occurrence that—
‘‘(A) actually or potentially jeopardizes the con-
fidentiality, integrity, or availability of an infor-
mation system or the information such system
processes, stores, or transmits; or
‘‘(B) constitutes a violation or imminent threat
of violation of security policies, security proce-
dures, or acceptable use policies with respect to an
information system.
‘‘(2) The term ‘information infrastructure’ means
the underlying framework, equipment, and software
that an information system and related assets rely on
to process, transmit, receive, or store information
electronically.
‘‘(3) The term ‘national security system’ has the
meaning given that term in [former] section 3542(b)(2)
of title 44, United States Code [see now 44 U.S.C.
3552(b)(6)].’’
[§ 2223a. Renumbered § 4571]
§ 2224. Defense Information Assurance Program
(a) DEFENSE
INFORMATION
ASSURANCE
PRO-
GRAM.—The Secretary of Defense shall carry out
a program, to be known as the ‘‘Defense Infor-
mation Assurance Program’’, to protect and de-
fend Department of Defense information, infor-
mation systems, and information networks that
are critical to the Department and the armed
forces during day-to-day operations and oper-
ations in times of crisis.
(b) OBJECTIVES OF THE PROGRAM.—The objec-
tives of the program shall be to provide continu-
ously for the availability, integrity, authentica-
tion, confidentiality, nonrepudiation, and rapid
restitution of information and information sys-
tems that are essential elements of the Defense
Information Infrastructure.
(c) PROGRAM STRATEGY.—In carrying out the
program, the Secretary shall develop a program
strategy that encompasses those actions nec-
essary to assure the readiness, reliability, con-
tinuity, and integrity of Defense information
systems, networks, and infrastructure, including
through compliance with subchapter II of chap-
ter 35 of title 44, including through compliance
with subchapter III of chapter 35 of title 44. The
program strategy shall include the following:
(1) A vulnerability and threat assessment of
elements of the defense and supporting non-
defense information infrastructures that are
essential to the operations of the Department
and the armed forces.
(2) Development of essential information as-
surances technologies and programs.
(3) Organization of the Department, the
armed forces, and supporting activities to de-
fend against information warfare.
(4) Joint activities of the Department with
other departments and agencies of the Govern-
ment, State and local agencies, and elements
of the national information infrastructure.
(5) The conduct of exercises, war games, sim-
ulations, experiments, and other activities de-
signed to prepare the Department to respond
to information warfare threats.
(6) Development of proposed legislation that
the Secretary considers necessary for imple-
menting the program or for otherwise respond-
ing to the information warfare threat.
(d) COORDINATION.—In carrying out the pro-
gram, the Secretary shall coordinate, as appro-
priate, with the head of any relevant Federal
agency and with representatives of those na-
tional critical information infrastructure sys-
tems that are essential to the operations of the
Department and the armed forces on informa-
tion assurance measures necessary to the pro-
tection of these systems.
[(e) Repealed. Pub. L. 108–136, div. A, title X,
§ 1031(a)(12), Nov. 24, 2003, 117 Stat. 1597.]
(f) INFORMATION ASSURANCE TEST BED.—The
Secretary shall develop an information assur-
ance test bed within the Department of Defense
to provide—
(1) an integrated organization structure to
plan and facilitate the conduct of simulations,
war games, exercises, experiments, and other
activities to prepare and inform the Depart-
ment regarding information warfare threats;
and
(2) organization and planning means for the
conduct by the Department of the integrated
or joint exercises and experiments with ele-
ments of the national information systems in-
frastructure and other non-Department of De-
fense organizations that are responsible for
the oversight and management of critical in-
formation systems and infrastructures on
which the Department, the armed forces, and
supporting activities depend for the conduct of
daily operations and operations during crisis.
(Added Pub. L. 106–65, div. A, title X, § 1043(a),
Oct. 5, 1999, 113 Stat. 760; amended Pub. L.
106–398, § 1 [[div. A], title X, § 1063], Oct. 30, 2000,
114 Stat. 1654, 1654A–274; Pub. L. 107–296, title X,
§ 1001(c)(1)(B), Nov. 25, 2002, 116 Stat. 2267; Pub.
L. 107–347, title III, § 301(c)(1)(B), Dec. 17, 2002, 116
Stat. 2955; Pub. L. 108–136, div. A, title X,
§ 1031(a)(12), Nov. 24, 2003, 117 Stat. 1597; Pub. L.
108–375, div. A, title X, § 1084(d)(17), Oct. 28, 2004,
118 Stat. 2062.)
Editorial Notes
AMENDMENTS
2004—Subsec. (c). Pub. L. 108–375 substituted ‘‘sub-
chapter II’’ for ‘‘subtitle II’’ in introductory provisions.
2003—Subsec. (e). Pub. L. 108–136 struck out subsec.
(e) which directed the Secretary of Defense to annually
submit to Congress a report on the Defense Information
Assurance Program.
2002—Subsec. (b). Pub. L. 107–296, § 1001(c)(1)(B)(i), and
Pub. L. 107–347, § 301(c)(1)(B)(i), amended subsec. (b)
identically, substituting ‘‘Objectives of the Program’’
for ‘‘Objectives and Minimum Requirements’’ in head-
ing and striking out par. (1) designation before ‘‘The
objectives’’.
Subsec. (b)(2). Pub. L. 107–347, § 301(c)(1)(B)(ii), struck
out par. (2) which read as follows: ‘‘The program shall
at a minimum meet the requirements of sections 3534
and 3535 of title 44.’’
Pub. L. 107–296, § 1001(c)(1)(B)(ii), which directed the
striking out of ‘‘(2) the program shall at a minimum
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter.
**(b) Additional Definitions.—** As used in this subchapter:
(1) The term “binding operational directive” means a compulsory direction to an agency that—
(A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk;
(B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and
(C) may be revised or repealed by the Director if the direction issued on behalf of the Director is not in accordance with policies and principles developed by the Director.
(2) The term “incident” means an occurrence that—
(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or
(B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
(3) The term “information security” means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—
(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;
(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and
(C) availability, which means ensuring timely and reliable access to and use of information.
(4) The term “information technology” has the meaning given that term
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3552
Stored review status: release_metadata_unconfirmed. The source passage cites 44 U.S.C. § 3552. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
Page 185
TITLE 44—PUBLIC PRINTING AND DOCUMENTS
§ 3552
need to perform their jobs. If a device is compromised,
zero trust can ensure that the damage is contained.
The Zero Trust Architecture security model assumes
that a breach is inevitable or has likely already oc-
curred, so it constantly limits access to only what is
needed and looks for anomalous or malicious activity.
Zero Trust Architecture embeds comprehensive secu-
rity monitoring; granular risk-based access controls;
and system security automation in a coordinated man-
ner throughout all aspects of the infrastructure in
order to focus on protecting data in real-time within a
dynamic threat environment. This data-centric secu-
rity model allows the concept of least-privileged access
to be applied for every access decision, where the an-
swers to the questions of who, what, when, where, and
how are critical for appropriately allowing or denying
access to resources based on the combination of sever.
SEC. 11. General Provisions. (a) Upon the appointment
of the National Cyber Director (NCD) and the establish-
ment of the related Office within the Executive Office
of the President, pursuant to section 1752 of Public Law
116–283 [enacting 6 U.S.C. 1500], portions of this order
may be modified to enable the NCD to fully execute its
duties and responsibilities.
(b) Nothing in this order shall be construed to impair
or otherwise affect:
(i) the authority granted by law to an executive de-
partment or agency, or the head thereof; or
(ii) the functions of the Director of the Office of Man-
agement and Budget relating to budgetary, administra-
tive, or legislative proposals.
(c) This order shall be implemented in a manner con-
sistent with applicable law and subject to the avail-
ability of appropriat
Source: Supplied 2024 U.S. Code historical extraction · 44 U.S.C. § 3552
Stored review status: historical_2024_not_currentness_verified. The source passage cites 44 U.S.C. § 3552. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—**
(1) Each year each agency shall have performed an independent evaluation of the information security program and practices of that agency to determine the effectiveness of such program and practices.
(2) Each evaluation under this section shall include—
(A) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the agency’s information systems;
(B) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency; and
(C) separate presentations, as appropriate, regarding information security relating to national security systems.
**(b) Independent Auditor.—** Subject to subsection (c)—
(1) for each agency with an Inspector General appointed under chapter 4 of title 5, the annual evaluation required by this section shall be performed by the Inspector General or by an independent external auditor, as determined by the Inspector General of the agency; and
(2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the evaluation.
**(c) National Security Systems.—** For each agency operating or exercising control of a national security system, that portion of the evaluation required by this section directly relating to a national security system shall be performed—
(1) only by an entity designated by the agency head; and
(2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.
**(d) Existing Evaluations.—** The evaluation required by this section may be based in whole or in part on an audit, eval
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3555
Stored review status: release_metadata_unconfirmed. The source passage cites 44 U.S.C. § 3555. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
Page 192
TITLE 44—PUBLIC PRINTING AND DOCUMENTS
§ 3555
(III) the status of compliance of the af-
fected information systems with applica-
ble security requirements at the time of
the incident; and
(IV) the detection, response, and reme-
diation actions;
(ii) the total number of information se-
curity incidents, including a description of
incidents resulting in significant com-
promise of information security, system
impact levels, types of incident, and loca-
tions of affected systems;
(iii) a description of each major informa-
tion security incident that involved a
breach of personally identifiable informa-
tion, as defined by the Director, includ-
ing—
(I) the number of individuals whose in-
formation was affected by the major in-
formation security incident; and
(II) a description of the information
that was breached or exposed; and
(iv) any other information as the Direc-
tor or the Secretary, in consultation with
the Director, may require.
(B) UNCLASSIFIED REPORT.—
(i) IN GENERAL.—Each report submitted
under subparagraph (A) shall be in unclas-
sified form, but may include a classified
annex.
(ii) ACCESS TO INFORMATION.—The head of
an agency shall ensure that, to the great-
est extent practicable, information is in-
cluded in the unclassified version of the re-
ports submitted by the agency under sub-
paragraph (A).
(2) OTHER PLANS AND REPORTS.—Each agency
shall address the adequacy and effectiveness of
information security policies, procedures, and
practices in management plans and reports.
(d) PERFORMANCE PLAN.—(1) In addition to the
requirements of subsection (c), each agency, in
consultation with the Director, shall include as
part of the performance plan required under sec-
tion 1115 of title 31 a description of—
(A) the time periods; and
(
Source: Supplied 2024 U.S. Code historical extraction · 44 U.S.C. § 3555
Stored review status: historical_2024_not_currentness_verified. The source passage cites 44 U.S.C. § 3555. This identifies an authority to review, not proof of applicability.
Federal law — U.S. Code and appendices · legal_authorities
<a id="section-2224"></a>
Source: U.S. Code supplied Markdown snapshot · 10 U.S.C. § 2223a
Stored review status: release_metadata_unconfirmed; partially_verified. Same stored citation; legal effect and authority still require review.