44 U.S.C. § 3554 — Federal agency responsibilities

(a) In general. The head of each agency must—(1) be responsible for (A) protecting agency information and agency or agency-contractor information systems in proportion to the risk and possible harm from unauthorized access, use, disclosure, disruption, modification, or destruction; (B) complying with this subchapter, subchapter III of chapter 13 of title 41, and related policies, procedures, standards, and guidelines, including standards under 40 U.S.C. 11331, the Secretary's operational and emergency directives, the Director's policies, national-security-system standards and guidelines, and the supply-chain-risk duties and exclusion or removal orders under 41 U.S.C. 1326 and 1323; and (C) making information-security management part of the agency's strategic, operational, and budget planning; (2) ensure that senior officials protect information and systems supporting the operations and assets under their control by (A) assessing the risk and possible harm from unauthorized access, use, disclosure, disruption, modification, or destruction; (B) setting appropriate security levels under the standards and classification requirements under 40 U.S.C. 11331; (C) using cost-effective policies and procedures to reduce risk to an acceptable level; and (D) periodically testing and evaluating controls and techniques; (3) delegate to the agency Chief Information Officer, or comparable official, authority to ensure compliance, including (A) designating a senior agency information security^* officer who carries out the CIO's duties, has the required training and experience, has security as the primary duty, and heads an adequately resourced office; (B) developing and maintaining the agencywide program under subsection (b); (C) developing and maintaining policies, procedures, and controls addressing all applicable requirements, including requirements under 44 U.S.C. 3553 and 40 U.S.C. 11331; (D) training and supervising personnel with significant security duties; and (E) helping senior officials perform paragraph (2); (4) ensure enough trained personnel are available; (5) ensure the CIO, working with senior officials, reports each year to the agency head on program effectiveness and remedial progress; (6) ensure senior officials, including component CIOs, perform their duties as directed by the official delegated authority under paragraph (3); and (7) hold all personnel accountable for following the agencywide program. (b) Agency program. Each agency must develop, document, and implement an agencywide program protecting information and systems supporting its operations and assets, including systems supplied or managed by another agency, contractor, or other source. The program must include—(1) periodic risk and harm assessments, which may use automated tools consistent with 40 U.S.C. 11331 standards and guidelines; (2) policies and procedures that (A) are based on those assessments, (B) cost-effectively reduce risk to an acceptable level, (C) address security through each system's life cycle, and (D) ensure compliance with this subchapter; the Director's policies and 40 U.S.C. 11331 standards; agency minimum configuration requirements; and other applicable requirements, including national-security-system standards and guidelines; (3) subordinate plans for networks, facilities, systems, or groups of systems; (4) awareness training for personnel, contractors, and other users about the risks of their activities and their duties under agency policies; (5) risk-based periodic testing and evaluation, at least annually, including management, operational, and technical controls for every system in the inventory under 44 U.S.C. 3505(c), possibly testing used under 44 U.S.C. 3555, and automated tools consistent with 40 U.S.C. 11331 standards and guidelines; (6) a process for planning, carrying out, evaluating, and documenting corrective action for deficiencies; (7) procedures to detect, report, and respond to security incidents, consistent with 44 U.S.C. 3556(b), possibly using automated tools, and including (A) reducing incident^* risks before substantial damage, (B) notifying and consulting the Federal information security incident center, and (C) notifying and consulting, as appropriate, law-enforcement agencies, relevant Inspectors General and General Counsels, the President-designated office for national-security-system incidents, the congressional committees listed in subsection (c)(1) for a major incident within 7 days after there is a reasonable basis to conclude it occurred and again within a reasonable time after new information is found, including the summary required by subsection (c)(1)(A)(i), and any other agency or office required by law or presidential direction; and (8) continuity-of-operations plans and procedures. (c) Agency reporting. (1) Annual report. (A) Each agency must report to the Director, Secretary^*, specified House and Senate committees, the appropriate congressional authorization and appropriations committees, and the Comptroller General on the adequacy and effectiveness of its security policies, procedures, and practices. The report must include (i) each major incident or related set of incidents, including the threats and actors, vulnerabilities, impacts, earlier risk assessments under subsection (a)(2)(A), compliance status when the incident occurred, and detection, response, and correction; (ii) the total number of incidents, including significant compromises, system impact levels, incident types, and affected-system locations; (iii) each major incident involving a breach of personally identifiable information as defined by the Director, including the number of affected people and what information was breached or exposed; and (iv) any other information the Director or Secretary, after consulting the Director, requires. (B) The report must be unclassified, but may have a classified annex. The agency head must include information in the unclassified version to the greatest practicable extent. (2) Agencies must address the adequacy and effectiveness of their security policies, procedures, and practices in management plans and reports. (d) Performance plan. (1) In addition to subsection (c), each agency, consulting the Director, must include in its 31 U.S.C. 1115 performance plan the time periods and the resources, including budget, staff, and training, needed to implement subsection (b). (2) This description must be based on subsection (b)(1) risk assessments. (e) Public notice and comment. Each agency must give the public timely notice and opportunities to comment on proposed information-security policies and procedures to the extent they affect communication with the public.