Sec. 118. Quantitative cybersecurity metrics
380 words·~2 min read·
/bill/117/s/3600/pcs/section-118A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
In this section, the term covered metrics means the metrics established, reviewed, and updated under section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) ). Not later than 1 year after the date of enactment of this Act, and as appropriate thereafter, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall— evaluate any covered metrics established as of the date of enactment of this Act; and as appropriate and pursuant to section 224(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1522(c) ) update or establish new covered metrics.
Not later than 540 days after the date of enactment of this Act, the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, shall promulgate guidance that requires each agency to use covered metrics to track trends in the cybersecurity and incident response capabilities of the agency. The guidance issued under paragraph
(1)and any subsequent guidance shall require agencies to share with the Director of the Cybersecurity and Infrastructure Security Agency data demonstrating the performance of the agency using the covered metrics included in the guidance. On not less than 2 occasions during the 2-year period following the date on which guidance is promulgated under paragraph (1), the Director shall ensure that not less than 3 agencies are subjected to substantially similar penetration tests, as determined by the Director, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, in order to validate the utility of the covered metrics. The Director of the Cybersecurity and Infrastructure Security Agency shall develop a capability that allows for the analysis of the covered metrics, including cross-agency performance of agency cybersecurity and incident response capability trends. With respect the first update or establishment of covered metrics required under subsection (b)(2), the Director of the Cybersecurity and Infrastructure Security Agency shall establish covered metrics that include not less than 1 metric addressing the time it takes for agencies to identify and respond to incidents. Not later than 1 year after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency, in coordination with the Director, shall submit to the appropriate congressional committees a report on the utility and use of the covered metrics.
Connectionstraces to 1
Traces to 1 document
U.S. Code
Citation graph
cites case law
Sec. 118
Quantitative cybersecurity metrics
Cites 1Cited by 0 across 0 sources