Sec. 206. Information technology system security
426 words·~2 min read·
/bill/114/s/1635/es/section-206A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary shall regularly consult with the Director of the National Security Agency and any other departments or agencies the Secretary determines to be appropriate regarding the security of United States Government and nongovernment information technology systems and networks owned, operated, managed, or utilized by the Department, including any such systems or networks facilitating the use of sensitive or classified information. In performing the consultations required under subsection (a), the Secretary shall make all such systems and networks available to the Director of the National Security Agency and any other such departments or agencies to carry out such tests and procedures as are necessary to ensure adequate policies and protections are in place to prevent penetrations or compromises of such systems and networks, including by malicious intrusions by any unauthorized individual or state actor or other entity.
Not later than 180 days after the date of the enactment of this Act, and every 180 days thereafter, the Secretary, in consultation with the Director of the National Security Agency and any other departments or agencies the Secretary determines to be appropriate, shall submit a report to the appropriate congressional committees and to the Select Committee on Intelligence of the Senate and the Permanent Select Committee on Intelligence of the House of Representatives that describes in detail— all known or suspected penetrations or compromises of the systems or networks described in subsection
(a)facilitating the use of classified information; and all known or suspected significant penetrations or compromises of any other such systems and networks that occurred since the submission of the prior report. Each report submitted under subsection
(c)shall include— a description of the relevant information technology system or network penetrated or compromised; an assessment of the date and time such penetration or compromise occurred; an assessment of the duration for which such system or network was penetrated or compromised, including whether such penetration or compromise is ongoing; an assessment of the amount and sensitivity of information accessed and available to have been accessed by such penetration or compromise, including any such information contained on systems and networks owned, operated, managed, or utilized by any other department or agency of the United States Government; an assessment of whether such system or network was penetrated by a malicious intrusion, including an assessment of— the known or suspected perpetrators, including state actors; and the methods used to conduct such penetration or compromise; and a description of the actions the Department has taken, or plans to take, to prevent future, similar penetrations or compromises of such systems and networks.