Sec. 206. Assessment; reports
733 words·~3 min read·
/bill/114/s/754/es/section-206·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
In this section— the term intrusion assessments means actions taken under the intrusion assessment plan to identify and remove intruders in agency information systems; the term intrusion assessment plan means the plan required under section 228(b)(1) of the Homeland Security Act of 2002, as added by section 203(a) of this Act; and the term intrusion detection and prevention capabilities means the capabilities required under section 230(b) of the Homeland Security Act of 2002, as added by section 203(a) of this Act.
Not later than 3 years after the date of enactment of this Act, the Government Accountability Office shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Federal Government to securing agency information systems, including the intrusion detection and prevention capabilities and the intrusion assessment plan. Not later than 6 months after the date of enactment of this Act, and annually thereafter, the Secretary shall submit to the appropriate congressional committees a report on the status of implementation of the intrusion detection and prevention capabilities, including— a description of privacy controls; a description of the technologies and capabilities utilized to detect cybersecurity risks in network traffic, including the extent to which those technologies and capabilities include existing commercial and non-commercial technologies; a description of the technologies and capabilities utilized to prevent network traffic associated with cybersecurity risks from transiting or traveling to or from agency information systems, including the extent to which those technologies and capabilities include existing commercial and non-commercial technologies; a list of the types of indicators or other identifiers or techniques used to detect cybersecurity risks in network traffic transiting or traveling to or from agency information systems on each iteration of the intrusion detection and prevention capabilities and the number of each such type of indicator, identifier, and technique; the number of instances in which the intrusion detection and prevention capabilities detected a cybersecurity risk in network traffic transiting or traveling to or from agency information systems and the number of times the intrusion detection and prevention capabilities blocked network traffic associated with cybersecurity risk; and a description of the pilot established under section 230(c)(5) of the Homeland Security Act of 2002, as added by section 203(a) of this Act, including the number of new technologies tested and the number of participating agencies.
Not later than 18 months after the date of enactment of this Act, and annually thereafter, the Director shall submit to Congress, as part of the report required under section 3553(c) of title 44, United States Code, an analysis of agency application of the intrusion detection and prevention capabilities, including— a list of each agency and the degree to which each agency has applied the intrusion detection and prevention capabilities to an agency information system; and a list by agency of— the number of instances in which the intrusion detection and prevention capabilities detected a cybersecurity risk in network traffic transiting or traveling to or from an agency information system and the types of indicators, identifiers, and techniques used to detect such cybersecurity risks; and the number of instances in which the intrusion detection and prevention capabilities prevented network traffic associated with a cybersecurity risk from transiting or traveling to or from an agency information system and the types of indicators, identifiers, and techniques used to detect such agency information systems.
The Director shall— not later than 6 months after the date of enactment of this Act, and 30 days after any update thereto, submit the intrusion assessment plan to the appropriate congressional committees; not later than 1 year after the date of enactment of this Act, and annually thereafter, submit to Congress, as part of the report required under section 3553(c) of title 44, United States Code— a description of the implementation of the intrusion assessment plan; the findings of the intrusion assessments conducted pursuant to the intrusion assessment plan; advanced network security tools included in the Continuous Diagnostics and Mitigation Program pursuant to section 204(a)(1); the results of the assessment of the Secretary of best practices for Federal cybersecurity pursuant to section 205(a); and a list by agency of compliance with the requirements of section 205(b); and not later than 1 year after the date of enactment of this Act, submit to the appropriate congressional committees— a copy of the plan developed pursuant to section 204(a)(2); and the improved metrics developed pursuant to section 204(b).