44 U.S.C. § 3558 — Effect on existing law

Page 194 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3557 1 So in original. Probably should be ‘‘National Institute of Standards’’. 2 So in original. Probably should be ‘‘chapter’’. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3084.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in section 3546 of this title prior to repeal by Pub. L. 113–283. § 3557. National security systems The head of each agency operating or exer- cising control of a national security system shall be responsible for ensuring that the agen- cy— (1) provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized ac- cess, use, disclosure, disruption, modification, or destruction of the information contained in such system; (2) implements information security policies and practices as required by standards and guidelines for national security systems, issued in accordance with law and as directed by the President; and (3) complies with the requirements of this subchapter. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3084.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3536 and 3547 of this title prior to repeal by Pub. L. 113–283. Statutory Notes and Related Subsidiaries ENFORCEMENT OF CYBERSECURITY REQUIREMENTS FOR NATIONAL SECURITY SYSTEMS Pub. L. 117–263, div. F, title LXIII, § 6309, Dec. 23, 2022, 136 Stat. 3506, as amended by Pub. L. 118–31, div. G, title III, § 7352, Dec. 22, 2023, 137 Stat. 1065, provided that: ‘‘(a) DEFINITIONS.—In this section: ‘‘(1) CYBERSECURITY REQUIREMENTS FOR NATIONAL SECURITY SYSTEMS.—The term ‘cybersecurity require- ments for national security systems’ means the min- imum cybersecurity requirements established by the National Manager, consistent with the direction of the President and in consultation with the Director of National Intelligence, that applies to all national security systems operated by, on the behalf of, or ad- ministered by the head of an element of the intel- ligence community. ‘‘(2) NATIONAL MANAGER.—The term ‘National Man- ager’ means the National Manager for National Secu- rity Systems designated by the President. ‘‘(3) NATIONAL SECURITY SYSTEMS.—The term ‘na- tional security systems’ includes— ‘‘(A) national security systems (as defined in sec- tion 3552(b) of title 44, United States Code); and ‘‘(B) information systems described in paragraph (2) or (3) of section 3553(e) of such title. ‘‘(b) IMPLEMENTATION DEADLINE.—The cybersecurity requirements for national security systems shall in- clude appropriate deadlines by which all elements of the intelligence community shall have fully imple- mented the requirements. ‘‘(c) REEVALUATION AND UPDATES.—Not less fre- quently than once every 2 years, the National Manager shall reevaluate and update the cybersecurity require- ments for national security systems. ‘‘(d) RESOURCES.—Each head of an element of the in- telligence community that owns or operates a national security system shall update plans of the element to prioritize resources in such a manner as to fully imple- ment the cybersecurity requirements for national secu- rity systems by the deadline established pursuant to subsection (b) for the next 10 fiscal years. ‘‘(e) IMPLEMENTATION REPORT.—Each head of an ele- ment of the intelligence community that owns or oper- ates a national security system shall submit to the congressional intelligence committees not later than 90 days after the date of the enactment of this subsection [Dec. 22, 2023] a plan detailing the cost and schedule re- quirements necessary to meet all of the cybersecurity requirements for national security systems by the end of fiscal year 2026. ‘‘(f) EXEMPTIONS.— ‘‘(1) IN GENERAL.—The head of an element of the in- telligence community may exempt a national secu- rity system owned or operated by the element from the cybersecurity requirements for national security systems if done so in accordance with the procedures established under paragraph (2). ‘‘(2) EXEMPTION PROCEDURES.—The National Man- ager shall, consistent with the direction of the Presi- dent, establish procedures that govern— ‘‘(A) the circumstances under which the head of an element of the intelligence community may ex- empt a national security system under paragraph (1); and ‘‘(B) the process for implementing the exemption. ‘‘(3) ANNUAL REPORTS ON EXEMPTIONS.— ‘‘(A) IN GENERAL.—Each year, the National Man- ager and the Director of National Intelligence shall— ‘‘(i) submit to the congressional intelligence committees an annual report documenting all ex- emptions made under paragraph (1) during the pe- riod covered by the report, along with the jus- tifications for the exemptions; and ‘‘(ii) in the case of an exemption made by the Assistant Secretary of State for Intelligence and Research under such paragraph, submit to the Committee on Foreign Relations of the Senate and the Committee on Foreign Affairs of the House of Representatives a separate report de- scribing the exemption and the justification for it. ‘‘(B) MANNER.—Each report submitted under sub- paragraph (A) shall be submitted with such classi- fication as the Director considers appropriate and with due regard for the protection of sensitive in- telligence sources and methods.’’ [For definitions of ‘‘intelligence community’’ and ‘‘congressional intelligence committees’’ as used in sec- tion 6309 of Pub. L. 117–263, set out above, see section 3003 of Title 50, War and National Defense, as made ap- plicable by section 6002 of Pub. L. 117–263, which is set out as a note under section 3003 of Title 50.] § 3558. Effect on existing law Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards 1 and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under sec- tion 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters 2 29, 31, or 33 of title 44, the management of information re- Page 195 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3561 sources under subchapter I of chapter 35 of this title, or the disclosure of information to the Congress or the Comptroller General of the United States. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3084.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3538 and 3549 of this title prior to repeal by Pub. L. 113–283. § 3559. Federal websites required to be mobile friendly (a) IN GENERAL.—If, on or after the date that is 180 days after the date of the enactment of this section, an agency creates a website that is intended for use by the public or conducts a re- design of an existing legacy website that is in- tended for use by the public, the agency shall ensure to the greatest extent practicable that the website is mobile friendly. (b) DEFINITIONS.—In this section: (1) AGENCY.—The term ‘‘agency’’ has the meaning given that term in section 551 of title 5. (2) MOBILE FRIENDLY.—The term ‘‘mobile friendly’’ means, with respect to a website, that the website is configured in such a way that the website may be navigated, viewed, and accessed on a smartphone, tablet com- puter, or similar mobile device. (Added Pub. L. 115–114, § 2(a), Jan. 10, 2018, 131 Stat. 2278.) Editorial Notes REFERENCES IN TEXT The date of the enactment of this section, referred to in subsec. (a), is the date of enactment of Pub. L. 115–114, which was approved Jan. 10, 2018. SUBCHAPTER III—CONFIDENTIAL INFOR- MATION PROTECTION AND STATISTICAL EFFICIENCY Editorial Notes PRIOR PROVISIONS Provisions similar to those in parts A to C of this subchapter were contained in Pub. L. 107–347, title V, Dec. 17, 2002, 116 Stat. 2962, which was set out as a note under section 3501 of this title, prior to repeal by Pub. L. 115–435, title III, § 302(c)(1), title IV, § 403, Jan. 14, 2019, 132 Stat. 5552, 5557, effective 180 days after Jan. 14, 2019. PART A—GENERAL § 3561. Definitions In this subchapter: (1) AGENCY.—The term ‘‘agency’’ means any entity that falls within the definition of the term ‘‘executive agency’’, as defined in section 102 of title 31, or ‘‘agency’’, as defined in sec- tion 3502. (2) AGENT.—The term ‘‘agent’’ means an in- dividual— (A)(i) who is an employee of a private or- ganization or a researcher affiliated with an institution of higher learning (including a person granted special sworn status by the Bureau of the Census under section 23(c) of title 13), and with whom a contract or other agreement is executed, on a temporary basis, by an executive agency to perform ex- clusively statistical activities under the control and supervision of an officer or em- ployee of that agency; (ii) who is working under the authority of a government entity with which a contract or other agreement is executed by an execu- tive agency to perform exclusively statis- tical activities under the control of an offi- cer or employee of that agency; (iii) who is a self-employed researcher, a consultant, a contractor, or an employee of a contractor, and with whom a contract or other agreement is executed by an executive agency to perform a statistical activity under the control of an officer or employee of that agency; or (iv) who is a contractor or an employee of a contractor, and who is engaged by the agency to design or maintain the systems for handling or storage of data received under this subchapter; and (B) who agrees in writing to comply with all provisions of law that affect information acquired by that agency. (3) BUSINESS DATA.—The term ‘‘business data’’ means operating and financial data and information about businesses, tax-exempt or- ganizations, and government entities. (4) DATA ASSET.—The term ‘‘data asset’’ has the meaning given that term in section 3502. (5) DIRECTOR.—The term ‘‘Director’’ means the Director of the Office of Management and Budget. (6) EVIDENCE.—The term ‘‘evidence’’ means information produced as a result of statistical activities conducted for a statistical purpose. (7) IDENTIFIABLE FORM.—The term ‘‘identifi- able form’’ means any representation of infor- mation that permits the identity of the re- spondent to whom the information applies to be reasonably inferred by either direct or indi- rect means. (8) NONSTATISTICAL PURPOSE.—The term ‘‘nonstatistical purpose’’— (A) means the use of data in identifiable form for any purpose that is not a statistical purpose, including any administrative, regu- latory, law enforcement, adjudicatory, or other purpose that affects the rights, privi- leges, or benefits of a particular identifiable respondent; and (B) includes the disclosure under section 552 of title 5 of data that are acquired for ex- clusively statistical purposes under a pledge of confidentiality. (9) RESPONDENT.—The term ‘‘respondent’’ means a person who, or organization that, is requested or required to supply information to an agency, is the subject of information re- quested or required to be supplied to an agen- cy, or provides that information to an agency. (10) STATISTICAL ACTIVITIES.—The term ‘‘sta- tistical activities’’— (A) means the collection, compilation, processing, or analysis of data for the pur-