Sec. 114. Implementing zero trust architecture
222 words·~1 min read·
/bill/117/s/3600/es/section-114·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 18 months after the date of enactment of this Act, the Director shall provide an update to the appropriate congressional committees on progress in increasing the internal defenses of agency systems, including— shifting away from trusted networks to implement security controls based on a presumption of compromise; implementing principles of least privilege in administering information security programs; limiting the ability of entities that cause incidents to move laterally through or between agency systems; identifying incidents quickly; isolating and removing unauthorized entities from agency systems as quickly as practicable, accounting for intelligence or law enforcement purposes; otherwise increasing the resource costs for entities that cause incidents to be successful; and a summary of the agency progress reports required under subsection (b).
Not later than 270 days after the date of enactment of this Act, the head of each agency shall submit to the Director a progress report on implementing an information security program based on the presumption of compromise and least privilege principles, which shall include— a description of any steps the agency has completed, including progress toward achieving requirements issued by the Director, including the adoption of any models or reference architecture; an identification of activities that have not yet been completed and that would have the most immediate security impact; and a schedule to implement any planned activities.