§ 813. CYBERSECURITY.

312 words·~1 min read·/usc/title-51/section-813

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Finding .— Congress finds that the security of NASA [National Aeronautics and Space Administration] information and information systems is vital to the success of the mission of the agency. Information Security Plan.— In general .— Not later than 1 year after the date of enactment of this Act [ Mar. 21, 2017 ], the Administrator [of the National Aeronautics and Space Administration] shall implement the information security plan developed under paragraph

(2)and take such further actions as the Administrator considers necessary to improve the information security system in accordance with this section. Information security plan .— Subject to paragraphs

(3)and (4), the Administrator shall develop an agency-wide information security plan to enhance information security for NASA information and information infrastructure. Requirements .— In developing the plan under paragraph (2), the Administrator shall ensure that the plan— reflects the unique nature of NASA’s mission and expertise; is informed by policies, standards, guidelines, and directives on information security required for Federal agencies; is consistent with the standards and guidelines under section 11331 of title 40 , United States Code; and meets applicable National Institute of Standards and Technology information security standards and guidelines. Contents .— The plan shall address— an overview of the requirements of the information security system; an agency-wide risk management framework for information security; a description of the information security system management controls and common controls that are necessary to ensure compliance with information security-related requirements; an identification and assignment of roles, responsibilities, and management commitment for information security at the agency; coordination among organizational entities, including between each center, facility, mission directorate, and mission support office, and among agency entities responsible for different aspects of information security; the need to protect the information security of mission-critical systems and activities and high-impact and moderate-impact information systems; and a schedule of frequent reviews and updates, as necessary, of the plan.”