---
kind: "section"
citation: "6 U.S.C. § 1524"
title: "6"
title_heading: "Domestic Security"
number: "1524"
heading: "Assessment; reports"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/1524"
units:
  - "Chapter 6 — Cybersecurity"
  - "Subchapter II — Federal Cybersecurity Enhancement"
---

# §1524. Assessment; reports

- (a) **Definitions—** In this section:
  - (1) **Agency information—** The term “[agency](/usc/6/1501.md?p=1) information” has the meaning given the term in section 2213 of the [Homeland](/usc/6/101.md?p=1) Security Act of 2002 [[6 U.S.C. 663](/usc/6/663.md)].
  - (2) **Cyber threat indicator; defensive measure—** The terms “[cyber threat indicator](/usc/6/1501.md?p=6)” and “[defensive measure](/usc/6/1501.md?p=7)” have the meanings given those terms in [section 650 of this title](/usc/6/650.md).
  - (3) **Intrusion assessments—** The term “intrusion assessments” means actions taken under the intrusion assessment plan to identify and remove intruders in [agency information systems](/usc/6/1521.md?p=2).
  - (4) **Intrusion assessment plan—** The term “intrusion assessment plan” means the plan required under section 2210(b)(1) of the [Homeland](/usc/6/101.md?p=1) Security Act of 2002 [[6 U.S.C. 660(b)(1)](/usc/6/660.md?p=b-1)].
  - (5) **Intrusion detection and prevention capabilities—** The term “intrusion detection and prevention capabilities” means the capabilities required under section 2213(b) of the [Homeland](/usc/6/101.md?p=1) Security Act of 2002 [[6 U.S.C. 663(b)](/usc/6/663.md?p=b)].
- (b) **Third-party assessment—** Not later than 3 years after December 18, 2015, the Comptroller General of the [United States](/usc/6/101.md?p=19-A) shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Federal Government to securing [agency information systems](/usc/6/1521.md?p=2), including the intrusion detection and prevention capabilities and the intrusion assessment plan.
- (c) **Reports to Congress—**
  - (1) **Intrusion detection and prevention capabilities—**
    - (A) **Secretary of Homeland Security report—** Not later than 6 months after December 18, 2015, and annually thereafter, the [Secretary](/usc/6/1521.md?p=8) shall submit to the [appropriate congressional committees](/usc/6/1521.md?p=3) a report on the status of implementation of the intrusion detection and prevention capabilities, including—
      - (i) a description of privacy controls;
      - (ii) a description of the technologies and capabilities utilized to detect [cybersecurity risks](/usc/6/1521.md?p=4) in network traffic, including the extent to which those technologies and capabilities include existing commercial and noncommercial technologies;
      - (iii) a description of the technologies and capabilities utilized to prevent network traffic associated with [cybersecurity risks](/usc/6/1521.md?p=4) from transiting or traveling to or from [agency information systems](/usc/6/1521.md?p=2), including the extent to which those technologies and capabilities include existing commercial and noncommercial technologies;
      - (iv) a list of the types of indicators or other identifiers or techniques used to detect [cybersecurity risks](/usc/6/1521.md?p=4) in network traffic transiting or traveling to or from [agency information systems](/usc/6/1521.md?p=2) on each iteration of the intrusion detection and prevention capabilities and the number of each such type of indicator, identifier, and technique;
      - (v) the number of instances in which the intrusion detection and prevention capabilities detected a [cybersecurity risk](/usc/6/1521.md?p=4) in network traffic transiting or traveling to or from [agency information systems](/usc/6/1521.md?p=2) and the number of times the intrusion detection and prevention capabilities blocked network traffic associated with [cybersecurity risk](/usc/6/1521.md?p=4); and
      - (vi) a description of the pilot established under section 2213(c)(5) of the [Homeland](/usc/6/101.md?p=1) Security Act of 2002 [[6 U.S.C. 663(c)(5)](/usc/6/663.md?p=c-5)], including the number of new technologies tested and the number of participating [agencies](/usc/6/1501.md?p=1).
    - (B) **OMB report—** Not later than 18 months after December 18, 2015, and annually thereafter, the [Director](/usc/6/1521.md?p=5) shall submit to Congress, as part of the report required under [section 3553(c) of title 44](/usc/44/3553.md?p=c), an analysis of [agency](/usc/6/1501.md?p=1) application of the intrusion detection and prevention capabilities, including—
      - (i) a list of each [agency](/usc/6/1501.md?p=1) and the degree to which each [agency](/usc/6/1501.md?p=1) has applied the intrusion detection and prevention capabilities to an [agency information system](/usc/6/1521.md?p=2); and
      - (ii) a list by [agency](/usc/6/1501.md?p=1) of—
        - (I) the number of instances in which the intrusion detection and prevention capabilities detected a [cybersecurity risk](/usc/6/1521.md?p=4) in network traffic transiting or traveling to or from an [agency information system](/usc/6/1521.md?p=2) and the types of indicators, identifiers, and techniques used to detect such [cybersecurity risks](/usc/6/1521.md?p=4); and
        - (II) the number of instances in which the intrusion detection and prevention capabilities prevented network traffic associated with a [cybersecurity risk](/usc/6/1521.md?p=4) from transiting or traveling to or from an [agency information system](/usc/6/1521.md?p=2) and the types of indicators, identifiers, and techniques used to detect such [agency information systems](/usc/6/1521.md?p=2).
    - (C) **Chief information officer—** Not earlier than 18 months after December 18, 2015, and not later than 2 years after December 18, 2015, the Federal Chief Information Officer shall review and submit to the [appropriate congressional committees](/usc/6/1521.md?p=3) a report assessing the intrusion detection and intrusion prevention capabilities, including—
      - (i) the effectiveness of the system in detecting, disrupting, and preventing cyber-threat actors, including advanced persistent threats, from accessing [agency](/usc/6/1501.md?p=1) information and [agency information systems](/usc/6/1521.md?p=2);
      - (ii) whether the intrusion detection and prevention capabilities, continuous diagnostics and mitigation, and other systems deployed under subtitle D[^1] of title II of the [Homeland](/usc/6/101.md?p=1) Security Act of 2002 ([6 U.S.C. 231](/usc/6/231.md) et seq.) are effective in securing Federal [information systems](/usc/6/1501.md?p=9);
      - (iii) the costs and benefits of the intrusion detection and prevention capabilities, including as compared to commercial technologies and tools and including the value of classified [cyber threat indicators](/usc/6/1501.md?p=6); and
      - (iv) the capability of [agencies](/usc/6/1501.md?p=1) to protect sensitive [cyber threat indicators](/usc/6/1501.md?p=6) and [defensive measures](/usc/6/1501.md?p=7) if they were shared through unclassified mechanisms for use in commercial technologies and tools.
  - (2) **OMB report on development and implementation of intrusion assessment plan, advanced internal defenses, and Federal cybersecurity requirements—** The [Director](/usc/6/1521.md?p=5) shall—
    - (A) not later than 6 months after December 18, 2015, and 30 days after any update thereto, submit the intrusion assessment plan to the [appropriate congressional committees](/usc/6/1521.md?p=3);
    - (B) not later than 1 year after December 18, 2015, and annually thereafter, submit to Congress, as part of the report required under [section 3553(c) of title 44](/usc/44/3553.md?p=c)—
      - (i) a description of the implementation of the intrusion assessment plan;
      - (ii) the findings of the intrusion assessments conducted pursuant to the intrusion assessment plan;
      - (iii) a description of the advanced network security tools included in the efforts to continuously diagnose and mitigate [cybersecurity risks](/usc/6/1521.md?p=4) pursuant to [section 1522(a)(1) of this title](/usc/6/1522.md?p=a-1); and
      - (iv) a list by [agency](/usc/6/1501.md?p=1) of compliance with the requirements of [section 1523(b) of this title](/usc/6/1523.md?p=b); and
    - (C) not later than 1 year after December 18, 2015, submit to the [appropriate congressional committees](/usc/6/1521.md?p=3)—
      - (i) a copy of the plan developed pursuant to [section 1522(a)(2) of this title](/usc/6/1522.md?p=a-2); and
      - (ii) the improved metrics developed pursuant to [section 1522(c) of this title](/usc/6/1522.md?p=c).
- (d) **Form—** Each report required under this section shall be submitted in unclassified form, but may include a classified annex.

## Footnotes

[^1]: See References in Text note below.

## Source credit

(Pub. L. 114–113, div. N, title II, § 226, Dec. 18, 2015, 129 Stat. 2969; Pub. L. 115–278, § 2(h)(1)(F), Nov. 16, 2018, 132 Stat. 4182; Pub. L. 117–263, div. G, title LXXI, § 7143(d)(1)(B), Dec. 23, 2022, 136 Stat. 3663.)

## Notes

### Editorial Notes

### References in Text

Subtitle D of title II of the Homeland Security Act of 2002, referred to in subsec. (c)(1)(C)(ii), is subtitle D (§§ 231–237) of title II of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2159, which enacted part D (§ 161 et seq.) of subchapter II of chapter 1 of this title and amended sections 10102 and 10122 of Title 34, Crime Control and Law Enforcement. Subtitle D was redesignated subtitle C of title II of the Homeland Security Act of 2002 by Pub. L. 115–278, § 2(g)(2)(K), Nov. 16, 2018, 132 Stat. 4178, and is classified principally to part C (§ 161 et seq.) of subchapter II of chapter 1 of this title. For complete classification of subtitle C to the Code, see Tables.

### Amendments

2022—Subsec. (a)(2). Pub. L. 117–263 substituted “section 650 of this title” for “section 1501 of this title”.

2018—Subsec. (a)(1). Pub. L. 115–278, § 2(h)(1)(F)(i)(I), substituted “section 2213” for “section 230” and struck out before period at end “, as added by section 223(a)(6) of this division”.

Subsec. (a)(4). Pub. L. 115–278, § 2(h)(1)(F)(i)(II), substituted “section 2210(b)(1)” for “section 228(b)(1)” and struck out before period at end “, as added by section 223(a)(4) of this division”.

Subsec. (a)(5). Pub. L. 115–278, § 2(h)(1)(F)(i)(III), substituted “section 2213(b)” for “section 230(b)” and struck out before period at end “, as added by section 223(a)(6) of this division”.

Subsec. (c)(1)(A)(vi). Pub. L. 115–278, § 2(h)(1)(F)(ii), substituted “section 2213(c)(5)” for “section 230(c)(5)” and struck out “, as added by section 223(a)(6) of this division” after “Homeland Security Act of 2002”.