§18445 Information security

Summary

NASA's chief information officer must tell the right Congressional committees, within 120 days after October 11, 2010 and every two years after that, about work to build a system that gives live, complete information on the risk that people far away, people nearby, or insiders might access NASA computers and networks without permission, including contractor networks. The report must say whether the system has actually cut network risk compared with other ways of measuring security and must describe how each NASA center and facility is doing. The Inspector General must evaluate how well the system works under section 3545 of title 44. The chief information officer must set up a security training and awareness program, working with the Department of Education and other agencies. The program must include ongoing classified and unclassified threat briefings and automated exercises and tests that mimic common attacks. All employees and contractors who operate or use NASA information systems must take the program, must meet its requirements to keep access, and the chief human capital officer, with the CIO, must create rewards for high performers. information infrastructure — the framework (devices, networks, hardware, software, and data) that systems use to handle electronic information.