Sec. 4. Security standards for use of covered devices by the Federal Government
320 words·~1 min read·
/bill/116/hr/1668/rh/section-4A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 6 months after the date on which the report under section 3 is completed, the Director of the Institute shall develop under section 20 of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g-3 ), and submit to the Director of OMB, guidelines on— the appropriate use and management by the agencies of covered devices owned or controlled by the agencies; and minimum information security requirements for managing security vulnerabilities associated with such devices.
In developing the guidelines submitted under paragraph (1), the Director of the Institute shall— consider relevant standards and best practices developed by the private sector, agencies, and public-private partnerships; and ensure that such guidelines are consistent with the considerations published in the report described under section 3. Not later than 180 days after the date on which the Director of the Institute completes the development of the guidelines required under subsection (a), the Director of OMB, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, shall— promulgate standards on the basis of the guidelines submitted under subsection
(a)pertaining to covered devices owned or controlled by agencies, except those considered national security systems as defined by section 3552(b)(6) of title 44, United States Code; and ensure such standards are consistent with the information security requirements under subchapter II of chapter 35 of title 44, United States Code. Not later than 5 years after the date on which the Director of OMB promulgates the standards under paragraph (1), and not less frequently than once every 5 years thereafter, the Director of OMB, in consultation with and the Director of the Institute and the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, shall— review such standards; and revise such standards as appropriate. The Federal Acquisition Regulation shall be revised to implement any standard promulgated under subsection (b).
Connectionstraces to 1
Traces to 1 document
U.S. Code
Citation graph
cites case law
Sec. 4
Security standards for use of covered devices by the Federal Government
Cites 1Cited by 0 across 0 sources