Sec. 206. Implementing zero trust architecture
237 words·~1 min read·
/bill/117/hr/6497/ih/section-206·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Director shall maintain guidance on the adoption of zero trust architecture and not later than 2 years after the date of the enactment of this Act, provide an update to the appropriate congressional committees on progress in increasing the internal defenses of agency systems through such adoption across the government, including— shifting away from trusted networks to implement security controls based on a presumption of compromise; implementing principles of least privilege in administering information security programs; limiting the ability of entities that cause incidents to move laterally through or between agency systems; identifying incidents quickly; isolating and removing unauthorized entities from agency systems as quickly as practicable, accounting for intelligence or law enforcement purposes; otherwise increasing the resource costs for entities that cause incidents to be successful; and a summary of the agency progress reports required under subsection (b).
Not later than 270 days after the date of the enactment of this Act, the head of each agency shall submit to the Director a progress report on implementing an information security program based on a zero trust architecture, which shall include— a description of any steps the agency has completed, including progress toward achieving any requirements issued by the Director, including the adoption of any models or reference architecture; an identification of activities that have not yet been completed and that would have the most immediate security impact; and a schedule to implement any planned activities.