§7406 National Institute of Standards and Technology programs

Summary

Require the head of NIST to make and update automated security rules, guides (including protocols), and checklists that give recommended settings to reduce risks for any IT hardware, software, or security tool that is or may become widely used by the Federal Government. NIST must focus work based on factors like the security risk, how many agencies use the system, how useful the guidance would be, and how well it helps continuous security monitoring. NIST can decide not to make guidance for systems that are rarely used, outdated, or impractical to cover. NIST must tell Federal agencies when new guidance is available. Having these guides does not force an agency to use the suggested settings, change buying rules, mean NIST endorses the product, or stop agencies from using tools that lack NIST guidance. When an agency uses a system that has a NIST checklist, the agency must explain in its agencywide information security program (under section 3554(b) of title 44) how it considered that checklist. The agency may count that explanation as part of its annual performance plan under Executive Order rules (see section 1115(d) of title 31). That explanation rule does not apply to systems for which NIST does not have responsibility under section 278g–3(a)(3).