15 U.S.C. § 7406 — National Institute of Standards and Technology programs
submitted 24 years ago by Pub. L. 107-305 to r/title-15-COMMERCE-AND-TRADE · 599 words · no verdicts yet
Subsections (a) and (b) are omitted. The Director of NIST must develop security standards and checklists for widely used Federal systems, while agencies retain discretion about using them.
(a), (b) Omitted.
(c)(1) As needed, the Director* of the National Institute of Standards and Technology must develop and revise automated-security standards, related reference materials including protocols, and checklists with settings and options that minimize security risks for information-technology hardware, software, and security tools widely used or likely to be widely used in the Federal Government. They must support standardized, interoperable technology, architecture, and frameworks for continuously monitoring Federal information security. (2) Priorities must be based on the system’s security risks, the number of agencies using it, usefulness to current or potential Federal users, effectiveness for continuous monitoring, and other appropriate factors. (3) The Director may exclude a system or tool when a standard is inappropriate because use is infrequent, the system is obsolete, or development lacks utility or is impracticable. (4) The Director must tell Federal agencies that each developed standard, reference, checklist, or other item is available. (5) Development does not require an agency to choose the recommended settings; create procurement or deployment conditions; imply NIST endorsement; or prevent an agency from buying or deploying systems for which no such item was developed or identified.
(d)(1) An agency deploying a system for which NIST developed a checklist must, in its agencywide security program required by 44 U.S.C. § 3554(b), explain how it considered the checklist. The agency may treat that explanation as part of its properly classified annual performance plan under an Executive Order. (2) This requirement does not apply to a system for which NIST lacks responsibility under 15 U.S.C. § 278g-3(a)(3).
The Director* of the National Institute of Standards and Technology shall, as necessary, develop and revise security automation standards, associated reference materials (including protocols), and checklists providing settings and option selections that minimize the security risks associated with each information technology hardware or software system and security tool that is, or is likely to become, widely used within the Federal Government, thereby enabling standardized and interoperable technologies, architectures, and frameworks for continuous monitoring of information security within the Federal Government.
The Director of the National Institute of Standards and Technology shall establish priorities for the development of standards, reference materials, and checklists under this subsection on the basis of—
the security risks associated with the use of the system;
the number of agencies that use a particular system or security tool;
the usefulness of the standards, reference materials, or checklists to Federal agencies that are users or potential users of the system;
the effectiveness of the associated standard, reference material, or checklist in creating or enabling continuous monitoring of information security; or
such other factors as the Director of the National Institute of Standards and Technology determines to be appropriate.
The Director of the National Institute of Standards and Technology may exclude from the application of paragraph (1) any information technology hardware or software system or security tool for which such Director determines that the development of a standard, reference material, or checklist is inappropriate because of the infrequency of use of the system, the obsolescence of the system, or the lack of utility or impracticability of developing a standard, reference material, or checklist for the system.
The Director of the National Institute of Standards and Technology shall ensure that Federal agencies are informed of the availability of any standard, reference material, checklist, or other item developed under this subsection.
The development of standards, reference materials, and checklists under paragraph (1) for an information technology hardware or software system or tool does not—
require any Federal agency to select the specific settings or options recommended by the standard, reference material, or checklist for the system;
establish conditions or prerequisites for Federal agency procurement or deployment of any such system;
imply an endorsement of any such system by the Director of the National Institute of Standards and Technology; or
preclude any Federal agency from procuring or deploying other information technology hardware or software systems for which no such standard, reference material, or checklist has been developed or identified under paragraph (1).
In developing the agencywide information security program required by section 3554(b) of title 44, an agency that deploys a computer hardware or software system for which the Director of the National Institute of Standards and Technology has developed a checklist under subsection (c) of this section—
shall include in that program an explanation of how the agency has considered such checklist in deploying that system; and
may treat the explanation as if it were a portion of the agency’s annual performance plan properly classified under criteria established by an Executive Order (within the meaning of section 1115(d) of title 31).
Paragraph (1) does not apply to any computer hardware or software system for which the National Institute of Standards and Technology does not have responsibility under section 278g–3(a)(3) of this title.
Source credit: (Pub. L. 107–305, § 8, Nov. 27, 2002, 116 Stat. 2375; Pub. L. 113–274, title II, § 203, Dec. 18, 2014, 128 Stat. 2979; Pub. L. 113–283, § 2(e)(2), Dec. 18, 2014, 128 Stat. 3086.)
- 2002Enacted · Pub. L. 107-305 · 116 Stat. 2375
- 2014Amended · Pub. L. 113-274 · 128 Stat. 2979
- 2014Amended · Pub. L. 113-283 · 128 Stat. 3086
A history note hasn’t been published yet. The record shows enactment by Pub. L. 107-305 on 2002-11-27.
all 0 arguments · sorted by: best
no arguments yet — make the first case