§3555 Annual Independent Evaluation

Summary

Each year, every agency must get an independent review of its information security program to see how well it works. The review must test security rules and practices on a representative set of the agency’s systems, assess the agency’s overall policies and practices, and, when needed, give a separate briefing about national security systems. If the agency has an Inspector General appointed under chapter 4 of title 5, that Inspector General or an outside independent auditor chosen by the IG must do the review. If not, the agency head must hire an outside auditor. Reviews about national security systems must be done only by an entity the agency head picks and must protect any sensitive vulnerability information as required by law. Agencies can use existing audits or reports in the review. Each year the agency head must send the review results to the Director by the date the Director sets; national security system results sent to the Director may be only a summary and assessment. Agencies and reviewers must protect sensitive information based on the risk and the law. The Director will summarize the reviews in the report to Congress, while protecting national security details. The Comptroller General will also periodically evaluate and report to Congress on agencies’ security practices and may help agencies or Inspectors General with technical testing. The Director must develop guidance for how to evaluate security, working with other officials and councils.