44 U.S.C. § 3552 — Definitions

Page 185 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3552 need to perform their jobs. If a device is compromised, zero trust can ensure that the damage is contained. The Zero Trust Architecture security model assumes that a breach is inevitable or has likely already oc- curred, so it constantly limits access to only what is needed and looks for anomalous or malicious activity. Zero Trust Architecture embeds comprehensive secu- rity monitoring; granular risk-based access controls; and system security automation in a coordinated man- ner throughout all aspects of the infrastructure in order to focus on protecting data in real-time within a dynamic threat environment. This data-centric secu- rity model allows the concept of least-privileged access to be applied for every access decision, where the an- swers to the questions of who, what, when, where, and how are critical for appropriately allowing or denying access to resources based on the combination of sever. SEC. 11. General Provisions. (a) Upon the appointment of the National Cyber Director (NCD) and the establish- ment of the related Office within the Executive Office of the President, pursuant to section 1752 of Public Law 116–283 [enacting 6 U.S.C. 1500], portions of this order may be modified to enable the NCD to fully execute its duties and responsibilities. (b) Nothing in this order shall be construed to impair or otherwise affect: (i) the authority granted by law to an executive de- partment or agency, or the head thereof; or (ii) the functions of the Director of the Office of Man- agement and Budget relating to budgetary, administra- tive, or legislative proposals. (c) This order shall be implemented in a manner con- sistent with applicable law and subject to the avail- ability of appropriations. (d) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforce- able at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. (e) Nothing in this order confers authority to inter- fere with or to direct a criminal or national security investigation, arrest, search, seizure, or disruption op- eration or to alter a legal restriction that requires an agency to protect information learned in the course of a criminal or national security investigation. J.R. BIDEN, JR. § 3552. Definitions (a) IN GENERAL.—Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter. (b) ADDITIONAL DEFINITIONS.—As used in this subchapter: (1) The term ‘‘binding operational directive’’ means a compulsory direction to an agency that— (A) is for purposes of safeguarding Federal information and information systems from a known or reasonably suspected information security threat, vulnerability, or risk; (B) shall be in accordance with policies, principles, standards, and guidelines issued by the Director; and (C) may be revised or repealed by the Di- rector if the direction issued on behalf of the Director is not in accordance with policies and principles developed by the Director. (2) The term ‘‘incident’’ means an occur- rence that— (A) actually or imminently jeopardizes, without lawful authority, the integrity, con- fidentiality, or availability of information or an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use poli- cies. (3) The term ‘‘information security’’ means protecting information and information sys- tems from unauthorized access, use, disclo- sure, disruption, modification, or destruction in order to provide— (A) integrity, which means guarding against improper information modification or destruction, and includes ensuring infor- mation nonrepudiation and authenticity; (B) confidentiality, which means pre- serving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary informa- tion; and (C) availability, which means ensuring timely and reliable access to and use of in- formation. (4) The term ‘‘information technology’’ has the meaning given that term in section 11101 of title 40. (5) The term ‘‘intelligence community’’ has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)). (6)(A) The term ‘‘national security system’’ means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency— (i) the function, operation, or use of which— (I) involves intelligence activities; (II) involves cryptologic activities re- lated to national security; (III) involves command and control of military forces; (IV) involves equipment that is an inte- gral part of a weapon or weapons system; or (V) subject to subparagraph (B), is crit- ical to the direct fulfillment of military or intelligence missions; or (ii) is protected at all times by procedures established for information that have been specifically authorized under criteria estab- lished by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. (B) Subparagraph (A)(i)(V) does not include a system that is to be used for routine admin- istrative and business applications (including payroll, finance, logistics, and personnel man- agement applications). (7) The term ‘‘Secretary’’ means the Sec- retary of Homeland Security. (Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3074.) Editorial Notes PRIOR PROVISIONS Provisions similar to this section were contained in sections 3532 and 3542 of this title prior to repeal by Pub. L. 113–283. Page 186 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3553 § 3553. Authority and functions of the Director and the Secretary (a) DIRECTOR.—The Director shall oversee agency information security policies and prac- tices, including— (1) developing and overseeing the implemen- tation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 11331 of title 40; (2) requiring agencies, consistent with the standards promulgated under such section 11331 and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the un- authorized access, use, disclosure, disruption, modification, or destruction of— (A) information collected or maintained by or on behalf of an agency; or (B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency; (3) ensuring that the Secretary carries out the authorities and functions under subsection (b); (4) coordinating the development of stand- ards and guidelines under section 20 of the Na- tional Institute of Standards and Technology Act (15 U.S.C. 278g–3) with agencies and offices operating or exercising control of national se- curity systems (including the National Secu- rity Agency) to assure, to the maximum ex- tent feasible, that such standards and guide- lines are complementary with standards and guidelines developed for national security sys- tems; (5) overseeing agency compliance with the requirements of this subchapter and section 1326 of title 41, including through any author- ized action under section 11303 of title 40, to enforce accountability for compliance with such requirements; and (6) coordinating information security poli- cies and procedures with related information resources management policies and proce- dures. (b) SECRETARY.—The Secretary, in consulta- tion with the Director, shall administer the im- plementation of agency information security policies and practices for information systems, except for national security systems and infor- mation systems described in paragraph (2) or (3) of subsection (e), including— (1) assisting the Director in carrying out the authorities and functions under paragraphs (1), (2), (3), (5), and (6) of subsection (a); (2) developing and overseeing the implemen- tation of binding operational directives to agencies to implement the policies, principles, standards, and guidelines developed by the Di- rector under subsection (a)(1) and the require- ments of this subchapter, which may be re- vised or repealed by the Director if the oper- ational directives issued on behalf of the Di- rector are not in accordance with policies, principles, standards, and guidelines developed by the Director, including— (A) requirements for reporting security in- cidents to the Federal information security incident center established under section 3556; (B) requirements for the contents of the annual reports required to be submitted under section 3554(c)(1); (C) requirements for the mitigation of exi- gent risks to information systems; and (D) other operational requirements as the Director or Secretary, in consultation with the Director, may determine necessary; (3) monitoring agency implementation of in- formation security policies and practices; (4) convening meetings with senior agency officials to help ensure effective implementa- tion of information security policies and prac- tices; (5) coordinating Government-wide efforts on information security policies and practices, including consultation with the Chief Informa- tion Officers Council established under section 3603 and the Director of the National Institute of Standards and Technology; (6) providing operational and technical as- sistance to agencies in implementing policies, principles, standards, and guidelines on infor- mation security, including implementation of standards promulgated under section 11331 of title 40, including by— (A) operating the Federal information se- curity incident center established under sec- tion 3556; (B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimburse- ment; (C) compiling and analyzing data on agen- cy information security; and (D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the infor- mation systems; (7) hunting for and identifying, with or with- out advance notice to or authorization from agencies, threats and vulnerabilities within Federal information systems; (8) upon request by an agency, and at the Secretary’s discretion, with or without reim- bursement— (A) providing services, functions, and capa- bilities, including operation of the agency’s information security program, to assist the agency with meeting the requirements set forth in section 3554(b); and (B) deploying, operating, and maintaining secure technology platforms and tools, in- cluding networks and common business ap- plications, for use by the agency to perform agency functions, including collecting, maintaining, storing, processing, dissemi- nating, and analyzing information; and (9) other actions as the Director or the Sec- retary, in consultation with the Director, may determine necessary to carry out this sub- section. (c) REPORT.—Not later than March 1 of each year, the Director, in consultation with the Sec- retary, shall submit to Congress a report on the