15 U.S.C. § 278g–4 — Information Security and Privacy Advisory Board

(a) Establishment and composition: The Department of Commerce has an Information Security and Privacy Advisory Board. The Secretary of Commerce appoints its chairman, plus 12 more members: 4 from outside government who are experts in the information technology industry (at least one representing small or medium-sized tech companies); 4 from outside government who are experts in information technology or related fields but don't work for or represent a tech producer; and 4 from the federal government with experience managing information systems, including security and privacy, with at least one from the National Security Agency. (b) Duties: The Board must spot new management, technical, administrative, and physical safeguard issues around information security and privacy; advise the Institute, the Secretary of Homeland Security, and the Director of OMB on security and privacy issues for federal information systems, including by reviewing proposed standards under section 278g–3; and report its findings once a year to the Secretary of Commerce, the Secretary of Homeland Security, the Director of OMB, the Director of the National Security Agency, and the relevant congressional committees. (c) Term of office: Members serve four-year terms, except that among the first members, three served one-year terms, three served two-year terms, three served three-year terms, and three served four-year terms. A member appointed to fill a vacancy serves out the rest of that term. (d) Quorum: The Board cannot act without a quorum of seven members. (e) Allowance for travel expenses: Members who aren't full-time federal employees can get travel expenses, under subchapter I of chapter 57 of title 5, for attending Board meetings or doing Board work away from home. (f) Meetings: The Board decides, by majority vote, where and when to meet. (g) Staff services and utilization of Federal personnel: With the agency head's consent, the Board can use staff from the Institute or any other federal agency to help it do its work. (h) Definitions: "Information system" and "information technology" mean what section 278g–3 says they mean.