6 U.S.C. § 1524 — Assessment; reports

(a) Definitions. In this section: (1) “Agency information” has the meaning given in section 2213 of the Homeland Security Act of 2002 (6 U.S.C. 663). (2) “Cyber threat indicator” and “defensive measure” have the meanings given in section 650 of this title. (3) “Intrusion assessments” means actions under the intrusion assessment plan to find and remove intruders from agency information systems. (4) “Intrusion assessment plan” means the plan required by section 2210(b)(1) of the Homeland Security Act of 2002 (6 U.S.C. 660(b)(1)). (5) “Intrusion detection and prevention capabilities” means the capabilities required by section 2213(b) of that Act (6 U.S.C. 663(b)). (b) Third-party assessment. No later than 3 years after December 18, 2015, the Comptroller General must study and publish a report on how effective the Federal Government’s approach and strategy are for securing agency information systems. The study must include the intrusion detection and prevention capabilities and the intrusion assessment plan. (c) Reports to Congress. (1) Intrusion detection and prevention capabilities. (A) Secretary of Homeland Security report. No later than 6 months after December 18, 2015, and every year after that, the Secretary must send the appropriate congressional committees a report on implementation of the intrusion detection and prevention capabilities. The report must include: (i) a description of privacy controls; (ii) the technologies and capabilities used to detect cybersecurity risks in network traffic, including how much they use existing commercial and noncommercial technologies; (iii) the technologies and capabilities used to stop network traffic linked to cybersecurity risks from traveling to or from agency information systems, including how much they use existing commercial and noncommercial technologies; (iv) for each version of the capabilities, the types of indicators, identifiers, or techniques used to detect cybersecurity risks in such traffic and the number of each type; (v) the number of times the capabilities detected a cybersecurity risk in such traffic and the number of times they blocked traffic linked to a cybersecurity risk; and (vi) a description of the pilot under section 2213(c)(5) of the Homeland Security Act of 2002 (6 U.S.C. 663(c)(5)), including the number of new technologies tested and participating agencies. (B) OMB report. No later than 18 months after December 18, 2015, and every year after that, the Director must include in the report required by section 3553(c) of title 44 an analysis of how agencies applied the capabilities. It must list each agency and how extensively it applied them to an agency information system. For each agency it must also list (I) the number of times the capabilities detected a cybersecurity risk in traffic to or from an agency information system and the types of indicators, identifiers, and techniques used; and (II) the number of times they stopped such traffic and the types of indicators, identifiers, and techniques used to detect cybersecurity risks in that traffic. (C) Federal Chief Information Officer. Between 18 months and 2 years after December 18, 2015, the Federal Chief Information Officer must review and report to the appropriate congressional committees on the intrusion detection and prevention capabilities. The report must assess (i) how effectively the system detects, disrupts, and prevents cyber-threat actors, including advanced persistent threats, from accessing agency information and systems; (ii) whether those capabilities, continuous diagnostics and mitigation, and other systems under subtitle D of title II of the Homeland Security Act of 2002 (6 U.S.C. 231 et seq.) secure Federal information systems effectively; (iii) the costs and benefits of the capabilities compared with commercial technologies and tools, including the value of classified cyber threat indicators; and (iv) whether agencies can protect sensitive cyber threat indicators and defensive measures if they are shared through unclassified mechanisms for commercial technologies and tools. (2) OMB report on the intrusion assessment plan, advanced internal defenses, and Federal cybersecurity requirements. The Director must: (A) no later than 6 months after December 18, 2015, and 30 days after each update, send the plan to the appropriate congressional committees; (B) no later than 1 year after December 18, 2015, and every year after that, include in the section 3553(c) report (i) a description of implementation of the plan; (ii) the findings of assessments under the plan; (iii) a description of advanced network-security tools used to continuously diagnose and mitigate cybersecurity risks under section 1522(a)(1); and (iv) an agency-by-agency list of compliance with section 1523(b); and (C) no later than 1 year after December 18, 2015, send the appropriate congressional committees (i) a copy of the plan under section 1522(a)(2); and (ii) the improved metrics under section 1522(c). (d) Form. Each report required by this section must be submitted in unclassified form, but it may include a classified annex.