The Institute shall—

(1) have the mission of developing standards, guidelines, and associated methods and techniques for information systems;

(2) develop standards and guidelines, including minimum requirements, for information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency, other than national security systems (as defined in section 3552(b)(5) [1] of title 44);

(3) develop standards and guidelines, including minimum requirements, for providing adequate information security for all agency operations and assets, but such standards and guidelines shall not apply to national security systems; and

(4) carry out the responsibilities described in paragraph (3) through the Computer Security Division.

The standards and guidelines required by subsection (a) shall include, at a minimum—

standards to be used by all agencies to categorize all information and information systems collected or maintained by or on behalf of each agency based on the objectives of providing appropriate levels of information security according to a range of risk levels;

(A) standards to be used by all agencies to categorize all information and information systems collected or maintained by or on behalf of each agency based on the objectives of providing appropriate levels of information security according to a range of risk levels;

(B) guidelines recommending the types of information and information systems to be included in each such category; and

(C) minimum information security requirements for information and information systems in each such category;

(2) a definition of and guidelines concerning detection and handling of information security incidents; and

(3) guidelines developed in coordination with the National Security Agency for identifying an information system as a national security system consistent with applicable requirements for national security systems, issued in accordance with law and as directed by the President.

In developing standards and guidelines required by subsections (a) and (b), the Institute shall—

consult with other agencies and offices (including, but not limited to, the Director of the Office of Management and Budget, the Departments of Defense and Energy, the National Security Agency, the Government Accountability Office, and the Secretary of Homeland Security) to assure—

(A) use of appropriate information security policies, procedures, and techniques, in order to improve information security and avoid unnecessary and costly duplication of effort; and

(B) that such standards and guidelines are complementary with standards and guidelines employed for the protection of national security systems and information contained in such systems;

(2) provide the public with an opportunity to comment on proposed standards and guidelines;

submit to the Director of the Office of Management and Budget for promulgation under section 11331 of title 40—

(A) standards, as required under subsection (b)(1)(A), no later than 12 months after November 25, 2002; and

(B) minimum information security requirements for each category, as required under subsection (b)(1)(C), no later than 36 months after November 25, 2002;

(4) issue guidelines as required under subsection (b)(1)(B), no later than 18 months after November 25, 2002;

(5) ensure that such standards and guidelines do not require specific technological solutions or products, including any specific hardware or software security solutions;

(6) ensure that such standards and guidelines provide for sufficient flexibility to permit alternative solutions to provide equivalent levels of protection for identified information security risks; and

(7) use flexible, performance-based standards and guidelines that, to the greatest extent possible, permit the use of off-the-shelf commercially developed information security products.

The Institute shall—

(1) submit standards developed pursuant to subsection (a), along with recommendations as to the extent to which these should be made compulsory and binding, to the Director of the Office of Management and Budget for promulgation under section 11331 of title 40;

provide assistance to agencies regarding—

(A) compliance with the standards and guidelines developed under subsection (a);

(B) detecting and handling information security incidents; and

(C) information security policies, procedures, and practices;

conduct research and analysis—

(A) to determine the nature and extent of information security vulnerabilities and techniques for providing cost-effective information security;

(B) to review and determine prevalent information security challenges and deficiencies identified by agencies or the Institute, including any challenges or deficiencies described in any of the annual reports under section 3553 or 3554 of title 44, and in any of the reports and the independent evaluations under section 3555 of that title, that may undermine the effectiveness of agency information security programs and practices; and

(C) to evaluate the effectiveness and sufficiency of, and challenges to, Federal agencies’ implementation of standards and guidelines developed under this section and policies and standards promulgated under section 11331 of title 40;

(4) develop and periodically revise performance indicators and measures for agency information security policies and practices;

(5) evaluate private sector information security policies and practices and commercially available information technologies to assess potential application by agencies to strengthen information security;

(6) evaluate security policies and practices developed for national security systems to assess potential application by agencies to strengthen information security;

(7) periodically assess the effectiveness of standards and guidelines developed under this section and undertake revisions as appropriate;

(8) solicit and consider the recommendations of the Information Security and Privacy Advisory Board, established by section 278g–4 of this title, regarding standards and guidelines developed under subsection (a) and submit such recommendations to the Director of the Office of Management and Budget with such standards submitted to the Director; and

(9) prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry out responsibilities under this section.

As part of the research activities conducted in accordance with subsection (d)(3), the Institute shall, to the extent practicable and appropriate—

(1) conduct a research program to develop a unifying and standardized identity, privilege, and access control management framework for the execution of a wide variety of resource protection policies and that is amenable to implementation within a wide variety of existing and emerging computing environments;

(2) carry out research associated with improving the security of information systems and networks;

(3) carry out research associated with improving the testing, measurement, usability, and assurance of information systems and networks;

(4) carry out research associated with improving security of industrial control systems;

(5) carry out research associated with improving the security and integrity of the information technology supply chain; and

(6) carry out any additional research the Institute determines appropriate.

As used in this section—

(1) the term “agency” has the same meaning as provided in section 3502(1) of title 44;

(2) the term “information security” has the same meaning as provided in section 3552(b)(2) [2] of such title;

(3) the term “information system” has the same meaning as provided in section 3502(8) of such title;

(4) the term “information technology” has the same meaning as provided in section 11101 of title 40; and

(5) the term “national security system” has the same meaning as provided in section 3552(b)(5) 1 of such title.[3]

(Mar. 3, 1901, ch. 872, § 20, as added Pub. L. 100–235, § 3(2), Jan. 8, 1988, 101 Stat. 1724; amended Pub. L. 100–418, title V, § 5115(a)(1), Aug. 23, 1988, 102 Stat. 1433; Pub. L. 104–106, div. E, title LVI, § 5607(a), Feb. 10, 1996, 110 Stat. 701; Pub. L. 105–85, div. A, title X, § 1073(h)(1), Nov. 18, 1997, 111 Stat. 1906; Pub. L. 107–296, title X, § 1003, Nov. 25, 2002, 116 Stat. 2269; Pub. L. 107–305, §§ 8(b), 9, 10, Nov. 27, 2002, 116 Stat. 2378, 2379; Pub. L. 107–347, title III, § 303, Dec. 17, 2002, 116 Stat. 2957; Pub. L. 108–271, § 8(b), July 7, 2004, 118 Stat. 814; Pub. L. 113–274, title II, § 204, Dec. 18, 2014, 128 Stat. 2980; Pub. L. 113–283, § 2(e)(4), Dec. 18, 2014, 128 Stat. 3087; Pub. L. 114–329, title I, § 104(b)(3), Jan. 6, 2017, 130 Stat. 2976.)