Sec. 1628. Email and Internet website security and authentication
240 words·~1 min read·
/bill/115/hr/5515/pap/section-1628·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Except as provided by subsection (b), the Secretary of Defense shall develop and implement the plan outlined in Binding Operational Directive 18–01, issued by the Secretary of Homeland Security on October 16, 2017, relating to email security and authentication and Internet website security, according to the schedule established by the Binding Operational Directive for the rest of the Executive Branch beginning with the date of enactment of this Act. The actions required of the Secretary of Defense under subsection
(a)include the following: The adoption of the START Transport Layer Security (STARTTLS) protocol for encryption. Enforcement of Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) for email authentication. Implementation of Hypertext Transfer Protocol Strict Transport Security (HSTS). The Secretary may waive the requirements of subsection
(a)if the Secretary submits to the congressional defense committees a certification that existing or planned security measures for the Department of Defense either meet or exceed the information security requirements of Binding Operational Directive 18–01. The Chief Information Officer of the Department of Defense shall notify the congressional defense committees within 180 days of the issuance by the Secretary of Homeland Security after the date of the enactment of this Act of any Binding Operational Directive for cybersecurity whether the Department of Defense will comply with the Directive or how the Department of Defense plans to meet or exceed the security objectives of the Directive.