Sec. 1537. Requirements for implementation of user activity monitoring for certain personnel
319 words·~1 min read·
/bill/118/hr/2670/enr/section-1537·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary of Defense shall require each head of a component of the Department of Defense to fully implement each directive, policy, and program requirement for user activity monitoring and least privilege access controls with respect to the personnel of that component, including Federal employees and contractors, granted access to classified information and classified networks, including the following directives (and any successor directives): The Committee on National Security Systems Directive 504, issued on February 4, 2014, relating to the protection of national security systems from insider threats (including any annex to such directive).
Department of Defense Directive 5205.16, issued on September 30, 2014, relating to the insider threat program of the Department of Defense. The Secretary of Defense shall require each head of a component of the Department of Defense to implement, with respect to systems, devices, and personnel of the component, automated controls to detect and prohibit privileged user accounts from performing general user activities not requiring privileged access. The Secretary shall require that, not less frequently than once every two years, each head of a component of the Department of Defense— conducts insider threat testing using threat-realistic tactics, techniques, and procedures; and submits to the Under Secretary of Defense for Intelligence and Security, the Chief Information Officer of the Department of Defense, and the Director of Operational Test and Evaluation of the Department of Defense a report on the findings of the head with respect to the testing conducted pursuant to paragraph (1).
Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall submit to the appropriate congressional committees a report on the implementation of this section. In this section, the term appropriate congressional committees means— the Committee on Armed Services and the Permanent Select Committee on Intelligence of the House of Representatives; and the Committee on Armed Services and the Select Committee on Intelligence of the Senate.