§11331. Responsibilities for Federal information systems standards — Inbound Citations

Citations to 40 U.S.C. § 11331 as a whole

• 6 U.S.C. § 1523(a)

  Go to provision →
  (a) Consistent with section 3553 of title 44, the Secretary, in consultation with the Director, shall exercise the authority to issue binding operational directives to assist the Director in ensuring timely agency adoption of and compliance with policies and standards promulgated under section 11331 of title 40¹ for securing agency information systems.
• 6 U.S.C. § 1523(b)(1)

  Go to provision →
  (1) Consistent with policies, standards, guidelines, and directives on information security under subchapter II of chapter 35 of title 44 and the standards and guidelines promulgated under section 11331 of title 40 and except as provided in paragraph (2), not later than 1 year after December 18, 2015, the head of each agency shall—

  (A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under the first subsection (c) (relating to the inventory of major information systems) and the second subsection (c) (relating to the inventory of information systems) of section 3505 of title 44;

  (B) assess access controls to the data described in subparagraph (A), the need for readily accessible storage of the data, and individuals’ need to access the data;

  (C) encrypt or otherwise render indecipherable to unauthorized users the data described in subparagraph (A) that is stored on or transiting agency information systems;

  (D) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that requires user authentication, as developed by the Administrator of General Services in collaboration with the Secretary; and

  (E) implement identity management consistent with section 7464 of title 15, including multi-factor authentication, for—

  (i) remote access to an agency information system; and

  (ii) each user account with elevated privileges on an agency information system.
• 15 U.S.C. § 278g–3(c)(3)

  Go to provision →
  (3) submit such standards and guidelines to the Secretary of Commerce for promulgation under section 11331 of title 40;
• 15 U.S.C. § 278g–3(d)(1)

  Go to provision →
  (1) submit standards developed pursuant to subsection (a), along with recommendations as to the extent to which these should be made compulsory and binding, to the Secretary of Commerce for promulgation under section 11331 of title 40;
• 15 U.S.C. § 278g–3(d)(3)(C)

  Go to provision →
  (C) to evaluate the effectiveness and sufficiency of, and challenges to, Federal agencies’ implementation of standards and guidelines developed under this section and policies and standards promulgated under section 11331 of title 40;
• 40 U.S.C. § 11302(d)

  Go to provision →
  (d) The Director shall oversee the development and implementation of standards and guidelines pertaining to federal computer systems by the Secretary of Commerce through the National Institute of Standards and Technology under section 11331 of this title¹ and section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3).
• 41 U.S.C. § 1323(c)(1)(D)

  Go to provision →
  (D) ensuring that recommended orders do not conflict with standards and guidelines issued under section 11331 of title 40 and that the Council consults with the Director of the National Institute of Standards and Technology regarding any recommended orders that would implement standards and guidelines developed by the National Institute of Standards and Technology.
• 42 U.S.C. § 1395kk–1(e)(2)(A)(ii)

  Go to provision →
  (ii) test the effectiveness of information security control techniques of an appropriate subset of the contractor’s information systems (as defined in section 3502(8) of title 44) relating to such functions under this subchapter and an assessment of compliance with the requirements of this subsection and related information security policies, procedures, standards and guidelines, including policies and procedures as may be prescribed by the Director of the Office of Management and Budget and applicable information security standards promulgated under section 11331 of title 40.¹
• 44 U.S.C. § 3504(g)(2)

  Go to provision →
  (2) oversee and coordinate compliance with sections 552 and 552a of title 5, sections 20 and 21 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3 and 278g–4), section 11331 of title 40 and subchapter II of this chapter, and related information management laws.
• 44 U.S.C. § 3504(h)(1)(B)

  Go to provision →
  (B) oversee the development and implementation of standards under section 11331 of title 40;²
• 44 U.S.C. § 3553(a)(1)

  Go to provision →
  (1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 11331 of title 40;
• 44 U.S.C. § 3553(b)(6)

  Go to provision →
  (6) providing operational and technical assistance to agencies in implementing policies, principles, standards, and guidelines on information security, including implementation of standards promulgated under section 11331 of title 40, including by—

  (A) operating the Federal information security incident center established under section 3556;

  (B) upon request by an agency, deploying, operating, and maintaining technology to assist the agency to continuously diagnose and mitigate against cyber threats and vulnerabilities, with or without reimbursement;

  (C) compiling and analyzing data on agency information security; and

  (D) developing and conducting targeted operational evaluations, including threat and vulnerability assessments, on the information systems;
• 44 U.S.C. § 3553(c)(4)

  Go to provision →
  (4) an assessment of agency compliance with standards promulgated under section 11331 of title 40; and
• 44 U.S.C. § 3553(f)(1)

  Go to provision →
  (1) In carrying out the responsibilities under subsection (b), the Secretary shall consider any applicable standards or guidelines developed by the National Institute of Standards and Technology and issued by the Secretary of Commerce under section 11331 of title 40.
• 44 U.S.C. § 3553(f)(2)(B)

  Go to provision →
  (B) ensure that binding operational directives issued under subsection (b)(2) do not conflict with the standards and guidelines issued under section 11331 of title 40.
• 44 U.S.C. § 3553(f)(3)

  Go to provision →
  (3) Nothing in this subchapter shall be construed as authorizing the Secretary to direct the Secretary of Commerce in the development and promulgation of standards and guidelines under section 11331 of title 40.
• 44 U.S.C. § 3553(h)(2)(F)

  Go to provision →
  (F) ensure that directives issued under this subsection do not conflict with the standards and guidelines issued under section 11331 of title 40;
• 44 U.S.C. § 3553(h)(2)(G)

  Go to provision →
  (G) consider any applicable standards or guidelines developed by the National Institute of Standards and Technology issued by the Secretary of Commerce under section 11331 of title 40; and
• 44 U.S.C. § 3554(a)(1)(B)(i)

  Go to provision →
  (i) information security standards promulgated under section 11331 of title 40;
• 44 U.S.C. § 3554(a)(2)(B)

  Go to provision →
  (B) determining the levels of information security appropriate to protect such information and information systems in accordance with standards promulgated under section 11331 of title 40, for information security classifications and related requirements;
• 44 U.S.C. § 3554(a)(3)(C)

  Go to provision →
  (C) developing and maintaining information security policies, procedures, and control techniques to address all applicable requirements, including those issued under section 3553 of this title and section 11331 of title 40;
• 44 U.S.C. § 3554(b)(1)

  Go to provision →
  (1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, which may include using automated tools consistent with standards and guidelines promulgated under section 11331 of title 40;
• 44 U.S.C. § 3554(b)(2)(D)(ii)

  Go to provision →
  (ii) policies and procedures as may be prescribed by the Director, and information security standards promulgated under section 11331 of title 40;
• 44 U.S.C. § 3554(b)(5)(C)

  Go to provision →
  (C) shall include using automated tools, consistent with standards and guidelines promulgated under section 11331 of title 40;
• 44 U.S.C. § 3558

  Go to provision →
  Nothing in this subchapter, section 11331 of title 40, or section 20 of the National Standards¹ and Technology Act (15 U.S.C. 278g–3) may be construed as affecting the authority of the President, the Office of Management and Budget or the Director thereof, the National Institute of Standards and Technology, or the head of any agency, with respect to the authorized use or disclosure of information, including with regard to the protection of personal privacy under section 552a of title 5, the disclosure of information under section 552 of title 5, the management and disposition of records under chapters² 29, 31, or 33 of title 44, the management of information resources under subchapter I of chapter 35 of this title, or the disclosure of information to the Congress or the Comptroller General of the United States.
• 44 U.S.C. § 3602(f)(8)

  Go to provision →
  (8) Assist the Director in establishing policies which shall set the framework for information technology standards for the Federal Government developed by the National Institute of Standards and Technology and promulgated by the Secretary of Commerce under section 11331 of title 40, taking into account, if appropriate, recommendations of the Chief Information Officers Council, experts, and interested parties from the private and nonprofit sectors and State, local, and tribal governments, and maximizing the use of commercial standards as appropriate, including the following:

  (A) Standards and guidelines for interconnectivity and interoperability as described under section 3504.

  (B) Consistent with the process under section 207(d) of the E-Government Act of 2002, standards and guidelines for categorizing Federal Government electronic information to enable efficient use of technologies, such as through the use of extensible markup language.

  (C) Standards and guidelines for Federal Government computer system efficiency and security.
• 44 U.S.C. § 3603(f)(5)

  Go to provision →
  (5) Work as appropriate with the National Institute of Standards and Technology and the Administrator to develop recommendations on information technology standards developed under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g–3) and promulgated under section 11331 of title 40, and maximize the use of commercial standards as appropriate, including the following:

  (A) Standards and guidelines for interconnectivity and interoperability as described under section 3504.

  (B) Consistent with the process under section 207(d) of the E-Government Act of 2002, standards and guidelines for categorizing Federal Government electronic information to enable efficient use of technologies, such as through the use of extensible markup language.

  (C) Standards and guidelines for Federal Government computer system efficiency and security.