6 U.S.C. § 1524: Assessment; reports

Summary

Requires the government to study and report on how well it finds and stops intruders in agency computer systems. Key terms used are: agency information (agency data and systems), cyber threat indicator and defensive measure (ways to describe threats and defenses), intrusion assessments (steps to find and remove intruders), intrusion assessment plan (the written plan for those steps), and intrusion detection and prevention capabilities (the tools used to spot and stop attacks). The Comptroller General must do a study and publish a report on effectiveness not later than 3 years after December 18, 2015. The Secretary of Homeland Security must send a report to Congress not later than 6 months after December 18, 2015 and every year after that. Those reports must cover privacy protections, the tools used to detect and block risky network traffic, lists and counts of indicators and detection/blocking events, and results of any pilot tests (including number of new technologies tested and agencies involved). The Director of OMB must include, not later than 18 months after December 18, 2015 and annually thereafter, an analysis showing how each agency is using these tools and counts of detections and blocks by agency. The Federal Chief Information Officer must send a review between 18 months and 2 years after December 18, 2015 that assesses effectiveness, costs and benefits, and whether agencies can protect sensitive threat information if shared unclassified. The OMB Director must also send the intrusion assessment plan no later than 6 months after December 18, 2015 (and within 30 days of updates) and, within 1 year and annually, report on plan implementation, assessment findings, advanced tools used, and agency compliance; within 1 year the Director must also provide a related plan copy and improved metrics. All reports must be unclassified but may include a classified annex.

Title 6, §1524

Domestic Security, Source: USLM XML via OLRC

(a)Definitions

In this section: (1) Agency information

(2)Cyber threat indicator; defensive measure

The terms “cyber threat indicator” and “defensive measure” have the meanings given those terms in section 650 of this title.

(3)Intrusion assessments

The term “intrusion assessments” means actions taken under the intrusion assessment plan to identify and remove intruders in agency information systems.

(4)Intrusion assessment plan

The term “intrusion assessment plan” means the plan required under section 2210(b)(1) of the Homeland Security Act of 2002 [6 U.S.C. 660(b)(1)].

(5)Intrusion detection and prevention capabilities

The term “intrusion detection and prevention capabilities” means the capabilities required under section 2213(b) of the Homeland Security Act of 2002 [6 U.S.C. 663(b)].

(b)Third-party assessment

Not later than 3 years after December 18, 2015, the Comptroller General of the United States shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Federal Government to securing agency information systems, including the intrusion detection and prevention capabilities and the intrusion assessment plan.

(c)Reports to Congress

(1)Intrusion detection and prevention capabilities

(A)Secretary of Homeland Security report

Not later than 6 months after December 18, 2015, and annually thereafter, the Secretary shall submit to the appropriate congressional committees a report on the status of implementation of the intrusion detection and prevention capabilities, including—

(i)a description of privacy controls;

(ii)a description of the technologies and capabilities utilized to detect cybersecurity risks in network traffic, including the extent to which those technologies and capabilities include existing commercial and noncommercial technologies;

(iii)a description of the technologies and capabilities utilized to prevent network traffic associated with cybersecurity risks from transiting or traveling to or from agency information systems, including the extent to which those technologies and capabilities include existing commercial and noncommercial technologies;

(iv)a list of the types of indicators or other identifiers or techniques used to detect cybersecurity risks in network traffic transiting or traveling to or from agency information systems on each iteration of the intrusion detection and prevention capabilities and the number of each such type of indicator, identifier, and technique;

(v)the number of instances in which the intrusion detection and prevention capabilities detected a cybersecurity risk in network traffic transiting or traveling to or from agency information systems and the number of times the intrusion detection and prevention capabilities blocked network traffic associated with cybersecurity risk; and

(vi)a description of the pilot established under section 2213(c)(5) of the Homeland Security Act of 2002 [6 U.S.C. 663(c)(5)], including the number of new technologies tested and the number of participating agencies.

(B)OMB report

Not later than 18 months after December 18, 2015, and annually thereafter, the Director shall submit to Congress, as part of the report required under section 3553(c) of title 44, an analysis of agency application of the intrusion detection and prevention capabilities, including—

(i)a list of each agency and the degree to which each agency has applied the intrusion detection and prevention capabilities to an agency information system; and

(ii)a list by agency of—

(I)the number of instances in which the intrusion detection and prevention capabilities detected a cybersecurity risk in network traffic transiting or traveling to or from an agency information system and the types of indicators, identifiers, and techniques used to detect such cybersecurity risks; and

(II)the number of instances in which the intrusion detection and prevention capabilities prevented network traffic associated with a cybersecurity risk from transiting or traveling to or from an agency information system and the types of indicators, identifiers, and techniques used to detect such agency information systems.

(C)Chief information officer

Not earlier than 18 months after December 18, 2015, and not later than 2 years after December 18, 2015, the Federal Chief Information Officer shall review and submit to the appropriate congressional committees a report assessing the intrusion detection and intrusion prevention capabilities, including—

(i)the effectiveness of the system in detecting, disrupting, and preventing cyber-threat actors, including advanced persistent threats, from accessing agency information and agency information systems;

(ii)whether the intrusion detection and prevention capabilities, continuous diagnostics and mitigation, and other systems deployed under subtitle D of title II of the Homeland Security Act of 2002 (6 U.S.C. 231 et seq.) are effective in securing Federal information systems;

(iii)the costs and benefits of the intrusion detection and prevention capabilities, including as compared to commercial technologies and tools and including the value of classified cyber threat indicators; and

(iv)the capability of agencies to protect sensitive cyber threat indicators and defensive measures if they were shared through unclassified mechanisms for use in commercial technologies and tools.

(2)OMB report on development and implementation of intrusion assessment plan, advanced internal defenses, and Federal cybersecurity requirements

The Director shall—

(A)not later than 6 months after December 18, 2015, and 30 days after any update thereto, submit the intrusion assessment plan to the appropriate congressional committees;

(B)not later than 1 year after December 18, 2015, and annually thereafter, submit to Congress, as part of the report required under section 3553(c) of title 44—

(i)a description of the implementation of the intrusion assessment plan;

(ii)the findings of the intrusion assessments conducted pursuant to the intrusion assessment plan;

(iii)a description of the advanced network security tools included in the efforts to continuously diagnose and mitigate cybersecurity risks pursuant to section 1522(a)(1) of this title; and

(iv)a list by agency of compliance with the requirements of section 1523(b) of this title; and

(C)not later than 1 year after December 18, 2015, submit to the appropriate congressional committees—

(i)a copy of the plan developed pursuant to section 1522(a)(2) of this title; and

(ii)the improved metrics developed pursuant to section 1522(c) of this title.

(d)Form

Each report required under this section shall be submitted in unclassified form, but may include a classified annex.

Notes & Related Subsidiaries

Editorial Notes

References in Text

Subtitle D of title II of the Homeland Security Act of 2002, referred to in subsec. (c)(1)(C)(ii), is subtitle D (§§ 231–237) of title II of Pub. L. 107–296, Nov. 25, 2002, 116 Stat. 2159, which enacted part D (§ 161 et seq.) of subchapter II of chapter 1 of this title and amended section 10102 and 10122 of Title 34, Crime Control and Law

Enforcement

. Subtitle D was redesignated subtitle C of title II of the Homeland Security Act of 2002 by Pub. L. 115–278, § 2(g)(2)(K), Nov. 16, 2018, 132 Stat. 4178, and is classified principally to part C (§ 161 et seq.) of subchapter II of chapter 1 of this title. For complete classification of subtitle C to the Code, see Tables.

Amendments

2022—Subsec. (a)(2). Pub. L. 117–263 substituted “section 650 of this title” for “section 1501 of this title”. 2018—Subsec. (a)(1). Pub. L. 115–278, § 2(h)(1)(F)(i)(I), substituted “section 2213” for “section 230” and struck out before period at end “, as added by section 223(a)(6) of this division”. Subsec. (a)(4). Pub. L. 115–278, § 2(h)(1)(F)(i)(II), substituted “section 2210(b)(1)” for “section 228(b)(1)” and struck out before period at end “, as added by section 223(a)(4) of this division”. Subsec. (a)(5). Pub. L. 115–278, § 2(h)(1)(F)(i)(III), substituted “section 2213(b)” for “section 230(b)” and struck out before period at end “, as added by section 223(a)(6) of this division”. Subsec. (c)(1)(A)(vi). Pub. L. 115–278, § 2(h)(1)(F)(ii), substituted “section 2213(c)(5)” for “section 230(c)(5)” and struck out “, as added by section 223(a)(6) of this division” after “Homeland Security Act of 2002”.

§1524 Assessment; Reports