42 U.S.C. § 18445 — Information security

(a) Monitoring risk (1) Update on system implementation — Every 2 years starting 120 days after October 11, 2010, NASA's chief information officer must work with other national security agencies and report to the right congressional committees on three things: (A) how NASA is doing on building a system that gives real-time information about the risk of unauthorized access — whether it's remote, close-up ("proximity"), or from insiders — to all of NASA's information systems and networks, including contractor networks; (B) whether this system has actually and measurably lowered network risk compared to other ways of measuring security; and (C) how much progress each NASA center and facility has made in putting the system in place. (2) Existing assessments — The Inspector General already has to check NASA's systems under a separate law (title 44, section 3545). Those checks must also judge whether the risk-monitoring system described above is actually working. (b) Information security awareness and education (1) In general — The chief information officer, working with the Department of Education and other agencies, must create a security awareness and training program for everyone who operates or uses NASA's information systems. The goal is to cut down on unauthorized remote, proximity, and insider access. (2) Program requirements — (A) The program must include ongoing briefings on threats, both classified and unclassified, plus automated drills that simulate real attack methods. (B) Every NASA employee and contractor who works with NASA's information systems must take part in the program. (C) Only people who keep meeting the program's requirements may access NASA's information systems. (D) NASA's chief human capital officer, working with the chief information officer, must create a system to reward people who consistently do well in the program. (c) Information infrastructure defined — "Information infrastructure" means the underlying framework — including programmable electronic devices, communications networks, and any related hardware, software, or data — that information systems depend on to process, send, receive, or store information electronically.