---
kind: "section"
citation: "44 U.S.C. § 3554"
title: "44"
title_heading: "Public Printing and Documents"
number: "3554"
heading: "Federal agency responsibilities"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/44/3554"
units:
  - "Chapter 35 — Coordination of Federal Information Policy"
  - "Subchapter II — Information Security"
---

# §3554. Federal agency responsibilities

- (a) **In General.—** The head of each [agency](/usc/44/3502.md?p=1) shall—
  - (1) be responsible for—
    - (A) providing [information security](/usc/44/3552.md?p=b-3) protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of—
      - (i) information collected or maintained by or on behalf of the [agency](/usc/44/3502.md?p=1); and
      - (ii) [information systems](/usc/44/3502.md?p=8) used or operated by an [agency](/usc/44/3502.md?p=1) or by a contractor of an [agency](/usc/44/3502.md?p=1) or other organization on behalf of an [agency](/usc/44/3502.md?p=1);
    - (B) complying with the requirements of this subchapter, subchapter III of [chapter 13](/usc/41/chstI/dB/ch13.md) of title 41, and related policies, procedures, standards, and guidelines, including—
      - (i) [information security](/usc/44/3552.md?p=b-3) standards promulgated under [section 11331 of title 40](/usc/40/11331.md);
      - (ii) operational directives developed by the [Secretary](/usc/44/3552.md?p=b-7) under [section 3553(b)](/usc/44/3553.md?p=b);
      - (iii) policies and procedures issued by the [Director](/usc/44/3502.md?p=4);
      - (iv) [information security](/usc/44/3552.md?p=b-3) standards and guidelines for [national security systems](/usc/44/3552.md?p=b-6-A) issued in accordance with law and as directed by the President;
      - (v) emergency directives issued by the [Secretary](/usc/44/3552.md?p=b-7) under [section 3553(h)](/usc/44/3553.md?p=h); and
      - (vi) responsibilities relating to assessing and avoiding, mitigating, transferring, or accepting supply chain risks under [section 1326 of title 41](/usc/41/1326.md), and complying with exclusion and removal orders issued under [section 1323](/usc/44/1323.md) of such title; and
    - (C) ensuring that [information security](/usc/44/3552.md?p=b-3) management processes are integrated with [agency](/usc/44/3502.md?p=1) strategic, operational, and budgetary planning processes;
  - (2) ensure that senior [agency](/usc/44/3502.md?p=1) officials provide [information security](/usc/44/3552.md?p=b-3) for the information and [information systems](/usc/44/3502.md?p=8) that support the operations and assets under their control, including through—
    - (A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or [information systems](/usc/44/3502.md?p=8);
    - (B) determining the levels of [information security](/usc/44/3552.md?p=b-3) appropriate to protect such information and [information systems](/usc/44/3502.md?p=8) in accordance with standards promulgated under [section 11331 of title 40](/usc/40/11331.md), for [information security](/usc/44/3552.md?p=b-3) classifications and related requirements;
    - (C) implementing policies and procedures to cost-effectively reduce risks to an acceptable level; and
    - (D) periodically testing and evaluating [information security](/usc/44/3552.md?p=b-3) controls and techniques to ensure that they are effectively implemented;
  - (3) delegate to the [agency](/usc/44/3502.md?p=1) Chief Information Officer established under [section 3506](/usc/44/3506.md) (or comparable official in an [agency](/usc/44/3502.md?p=1) not covered by such section) the authority to ensure compliance with the requirements imposed on the [agency](/usc/44/3502.md?p=1) under this subchapter, including—
    - (A) designating a senior [agency](/usc/44/3502.md?p=1) [information security](/usc/44/3552.md?p=b-3) officer who shall—
      - (i) carry out the Chief Information Officer’s responsibilities under this section;
      - (ii) possess professional qualifications, including training and experience, required to administer the functions described under this section;
      - (iii) have [information security](/usc/44/3552.md?p=b-3) duties as that official’s primary duty; and
      - (iv) head an office with the mission and resources to assist in ensuring [agency](/usc/44/3502.md?p=1) compliance with this section;
    - (B) developing and maintaining an agencywide [information security](/usc/44/3552.md?p=b-3) program as required by [subsection (b)](#b);
    - (C) developing and maintaining [information security](/usc/44/3552.md?p=b-3) policies, procedures, and control techniques to address all applicable requirements, including those issued under [section 3553 of this title](/usc/44/3553.md) and [section 11331 of title 40](/usc/40/11331.md);
    - (D) training and overseeing personnel with significant responsibilities for [information security](/usc/44/3552.md?p=b-3) with respect to such responsibilities; and
    - (E) assisting senior [agency](/usc/44/3502.md?p=1) officials concerning their responsibilities under [paragraph (2)](#a-2);
  - (4) ensure that the [agency](/usc/44/3502.md?p=1) has trained personnel sufficient to assist the [agency](/usc/44/3502.md?p=1) in complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines;
  - (5) ensure that the [agency](/usc/44/3502.md?p=1) Chief Information Officer, in coordination with other senior [agency](/usc/44/3502.md?p=1) officials, reports annually to the [agency](/usc/44/3502.md?p=1) head on the effectiveness of the [agency](/usc/44/3502.md?p=1) [information security](/usc/44/3552.md?p=b-3) program, including progress of remedial actions;
  - (6) ensure that senior [agency](/usc/44/3502.md?p=1) officials, including chief information officers of component [agencies](/usc/44/3502.md?p=1) or equivalent officials, carry out responsibilities under this subchapter as directed by the official delegated authority under [paragraph (3)](#a-3); and
  - (7) ensure that all personnel are held accountable for complying with the [agency](/usc/44/3502.md?p=1)-wide [information security](/usc/44/3552.md?p=b-3) program implemented under [subsection (b)](#b).
- (b) **Agency Program.—** Each [agency](/usc/44/3502.md?p=1) shall develop, document, and implement an [agency](/usc/44/3502.md?p=1)-wide [information security](/usc/44/3552.md?p=b-3) program to provide [information security](/usc/44/3552.md?p=b-3) for the information and [information systems](/usc/44/3502.md?p=8) that support the operations and assets of the [agency](/usc/44/3502.md?p=1), including those provided or managed by another [agency](/usc/44/3502.md?p=1), contractor, or other source, that includes—
  - (1) periodic assessments of the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and [information systems](/usc/44/3502.md?p=8) that support the operations and assets of the [agency](/usc/44/3502.md?p=1), which may include using automated tools consistent with standards and guidelines promulgated under [section 11331 of title 40](/usc/40/11331.md);
  - (2) policies and procedures that—
    - (A) are based on the risk assessments required by [paragraph (1)](#b-1);
    - (B) cost-effectively reduce [information security](/usc/44/3552.md?p=b-3) risks to an acceptable level;
    - (C) ensure that [information security](/usc/44/3552.md?p=b-3) is addressed throughout the life cycle of each [agency](/usc/44/3502.md?p=1) [information system](/usc/44/3502.md?p=8); and
    - (D) ensure compliance with—
      - (i) the requirements of this subchapter;
      - (ii) policies and procedures as may be prescribed by the [Director](/usc/44/3502.md?p=4), and [information security](/usc/44/3552.md?p=b-3) standards promulgated under [section 11331 of title 40](/usc/40/11331.md);
      - (iii) minimally acceptable system configuration requirements, as determined by the [agency](/usc/44/3502.md?p=1); and
      - (iv) any other applicable requirements, including standards and guidelines for [national security systems](/usc/44/3552.md?p=b-6-A) issued in accordance with law and as directed by the President;
  - (3) subordinate plans for providing adequate [information security](/usc/44/3552.md?p=b-3) for networks, facilities, and systems or groups of [information systems](/usc/44/3502.md?p=8), as appropriate;
  - (4) security awareness training to inform personnel, including contractors and other users of [information systems](/usc/44/3502.md?p=8) that support the operations and assets of the [agency](/usc/44/3502.md?p=1), of—
    - (A) [information security](/usc/44/3552.md?p=b-3) risks associated with their activities; and
    - (B) their responsibilities in complying with [agency](/usc/44/3502.md?p=1) policies and procedures designed to reduce these risks;
  - (5) periodic testing and evaluation of the effectiveness of [information security](/usc/44/3552.md?p=b-3) policies, procedures, and practices, to be performed with a frequency depending on risk, but no less than annually, of which such testing—
    - (A) shall include testing of management, operational, and technical controls of every [information system](/usc/44/3502.md?p=8) identified in the inventory required under [section 3505(c)](/usc/44/3505.md?p=c);[^1]
    - (B) may include testing relied on in an evaluation under [section 3555](/usc/44/3555.md); and
    - (C) shall include using automated tools, consistent with standards and guidelines promulgated under [section 11331 of title 40](/usc/40/11331.md);
  - (6) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the [information security](/usc/44/3552.md?p=b-3) policies, procedures, and practices of the [agency](/usc/44/3502.md?p=1);
  - (7) procedures for detecting, reporting, and responding to security [incidents](/usc/44/3552.md?p=b-2), which—
    - (A) shall be consistent with the standards and guidelines described in [section 3556(b)](/usc/44/3556.md?p=b);
    - (B) may include using automated tools; and
    - (C) shall include—
      - (i) mitigating risks associated with such [incidents](/usc/44/3552.md?p=b-2) before substantial damage is done;
      - (ii) notifying and consulting with the Federal [information security](/usc/44/3552.md?p=b-3) [incident](/usc/44/3552.md?p=b-2) center established in [section 3556](/usc/44/3556.md); and
      - (iii) notifying and consulting with, as appropriate—
        - (I) law enforcement [agencies](/usc/44/3502.md?p=1) and relevant Offices of Inspector General and Offices of General Counsel;
        - (II) an office designated by the President for any [incident](/usc/44/3552.md?p=b-2) involving a [national security system](/usc/44/3552.md?p=b-6-A);
        - (III) for a major [incident](/usc/44/3552.md?p=b-2), the committees of Congress described in [subsection (c)(1)](#c-1)—
          - (aa) not later than 7 days after the date on which there is a reasonable basis to conclude that the major [incident](/usc/44/3552.md?p=b-2) has occurred; and
          - (bb) after the initial notification under [item (aa)](#b-7-C-iii-III-aa), within a reasonable period of time after additional information relating to the [incident](/usc/44/3552.md?p=b-2) is discovered, including the summary required under [subsection (c)(1)(A)(i)](#c-1-A-i); and
        - (IV) any other [agency](/usc/44/3502.md?p=1) or office, in accordance with law or as directed by the President; and
  - (8) plans and procedures to ensure continuity of operations for [information systems](/usc/44/3502.md?p=8) that support the operations and assets of the [agency](/usc/44/3502.md?p=1).
- (c) **Agency Reporting.—**
  - (1) **Annual report.—**
    - (A) **In general.—** Each [agency](/usc/44/3502.md?p=1) shall submit to the [Director](/usc/44/3502.md?p=4), the [Secretary](/usc/44/3552.md?p=b-7), the Committee on Government Reform, the Committee on Homeland Security, and the Committee on Science of the House of Representatives, the Committee on Homeland Security and Governmental Affairs and the Committee on Commerce, Science, and Transportation of the Senate, the appropriate authorization and appropriations committees of Congress, and the Comptroller General a report on the adequacy and effectiveness of [information security](/usc/44/3552.md?p=b-3) policies, procedures, and practices, including—
      - (i) a description of each major [information security](/usc/44/3552.md?p=b-3) [incident](/usc/44/3552.md?p=b-2) or related sets of [incidents](/usc/44/3552.md?p=b-2), including summaries of—
        - (I) the threats and threat actors, vulnerabilities, and impacts relating to the [incident](/usc/44/3552.md?p=b-2);
        - (II) the risk assessments conducted under [section 3554(a)(2)(A)](#a-2-A) of the affected [information systems](/usc/44/3502.md?p=8) before the date on which the [incident](/usc/44/3552.md?p=b-2) occurred;
        - (III) the status of compliance of the affected [information systems](/usc/44/3502.md?p=8) with applicable security requirements at the time of the [incident](/usc/44/3552.md?p=b-2); and
        - (IV) the detection, response, and remediation actions;
      - (ii) the total number of [information security](/usc/44/3552.md?p=b-3) [incidents](/usc/44/3552.md?p=b-2), including a description of [incidents](/usc/44/3552.md?p=b-2) resulting in significant compromise of [information security](/usc/44/3552.md?p=b-3), system impact levels, types of [incident](/usc/44/3552.md?p=b-2), and locations of affected systems;
      - (iii) a description of each major [information security](/usc/44/3552.md?p=b-3) [incident](/usc/44/3552.md?p=b-2) that involved a breach of personally identifiable information, as defined by the [Director](/usc/44/3502.md?p=4), including—
        - (I) the number of individuals whose information was affected by the major [information security](/usc/44/3552.md?p=b-3) [incident](/usc/44/3552.md?p=b-2); and
        - (II) a description of the information that was breached or exposed; and
      - (iv) any other information as the [Director](/usc/44/3502.md?p=4) or the [Secretary](/usc/44/3552.md?p=b-7), in consultation with the [Director](/usc/44/3502.md?p=4), may require.
    - (B) **Unclassified report.—**
      - (i) **In general.—** Each report submitted under [subparagraph (A)](#c-1-A) shall be in unclassified form, but may include a classified annex.
      - (ii) **Access to information.—** The head of an [agency](/usc/44/3502.md?p=1) shall ensure that, to the greatest extent practicable, information is included in the unclassified version of the reports submitted by the [agency](/usc/44/3502.md?p=1) under [subparagraph (A)](#c-1-A).
  - (2) **Other plans and reports.—** Each [agency](/usc/44/3502.md?p=1) shall address the adequacy and effectiveness of [information security](/usc/44/3552.md?p=b-3) policies, procedures, and practices in management plans and reports.
- (d) **Performance Plan.—**
  - (1) In addition to the requirements of [subsection (c)](#c), each [agency](/usc/44/3502.md?p=1), in consultation with the [Director](/usc/44/3502.md?p=4), shall include as part of the performance plan required under [section 1115 of title 31](/usc/31/1115.md) a description of—
    - (A) the time periods; and
    - (B) the resources, including budget, staffing, and training,

    that are necessary to implement the program required under [subsection (b)](#b).

  - (2) The description under [paragraph (1)](#d-1) shall be based on the risk assessments required under [subsection (b)(1)](#b-1).
- (e) **Public Notice and Comment.—** Each [agency](/usc/44/3502.md?p=1) shall provide the public with timely notice and opportunities for comment on proposed [information security](/usc/44/3552.md?p=b-3) policies and procedures to the extent that such policies and procedures affect communication with the public.

## Footnotes

[^1]: So in original. Section 3505 contains two subsecs. (c).

## Source credit

(Added Pub. L. 113–283, § 2(a), Dec. 18, 2014, 128 Stat. 3078; amended Pub. L. 114–113, div. N, title II, § 229(b), Dec. 18, 2015, 129 Stat. 2974; Pub. L. 115–390, title II, § 204(a)(2), Dec. 21, 2018, 132 Stat. 5193.)

## Notes

### Editorial Notes

### Prior Provisions

Provisions similar to this section were contained in sections 3534 and 3544 of this title prior to repeal by Pub. L. 113–283.

### Amendments

2018—Subsec. (a)(1)(B). Pub. L. 115–390, § 204(a)(2)(A), inserted “, subchapter III of chapter 13 of title 41,” after “complying with the requirements of this subchapter” in introductory provisions.

Subsec. (a)(1)(B)(vi). Pub. L. 115–390, § 204(a)(2)(B), (C), added cl. (vi).

2015—Subsec. (a)(1)(B)(v). Pub. L. 114–113 added cl. (v).

### Statutory Notes and Related Subsidiaries

### Change of Name

Committee on Government Reform of House of Representatives changed to Committee on Oversight and Government Reform of House of Representatives by House Resolution No. 6, One Hundred Tenth Congress, Jan. 5, 2007. Committee on Oversight and Government Reform of House of Representatives changed to Committee on Oversight and Reform of House of Representatives by House Resolution No. 6, One Hundred Sixteenth Congress, Jan. 9, 2019. Committee on Oversight and Reform of House of Representatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023.

### Effective Date of 2018 Amendment

Amendment by Pub. L. 115–390 effective 90 days after Dec. 21, 2018, see section 205 of Pub. L. 115–390, set out as an Effective Date note under section 1321 of Title 41, Public Contracts.

### Major Incident

Pub. L. 113–283, § 2(b), Dec. 18, 2014, 128 Stat. 3085, provided that: “The Director of the Office of Management and Budget shall— develop guidance on what constitutes a major incident for purposes of section 3554(b) of title 44, United States Code, as added by subsection (a); and provide to Congress periodic briefings on the status of the developing of the guidance until the date on which the guidance is issued.”