Cybersecurity Regulations Pass House

The House of Representatives has passed a bill that would update the federal government's cybersecurity requirements and create a permanent cybersecurity office within the White House, putting some long-sought reforms closer to passage.

The reforms were passed as an amendment offered by Rep. Jim Langevin (D-R.I.) and Dianne Watson (D-Calif.) that made its way into the annual defense spending bill, the National Defense Authorization Act for Fiscal Year 2011. The defense authorization bill passed the House on Friday by a 229-186 vote.

The Senate version of the bill, which passed the Senate Armed Services Committee last week, does not currently contain the Watson-Langevin amendment or similar provisions, but that could change before the vote on the Senate floor. Any differences would be reconciled in conference before the bill is sent to President Obama to sign.

The most wide-ranging changes of the amendment, which combines legislation offered earlier this session by Langevin and Watson, include creating a permanent National Office for Cyberspace and Office of the Federal Chief Technology Officer within the White House, giving both the director of the National Office for Cyberspace and the federal CTO specific responsibilities, and adding new cybersecurity requirements for agencies in areas like acquisition, budgeting, and actually securing IT systems.

"The passage of this amendment comes after a great deal of work to raise awareness about the cyber vulnerabilities that exist throughout our federal government," Langevin, co-chair of the House Cybersecurity Caucus, said in a statement. "These provisions will establish strong, centralized oversight to protect our nation's critical information infrastructure and update our comprehensive policy for operating in cyberspace."

The National Office for Cyberspace -- the "principal office for coordinating" cybersecurity issues in government, according to the amendment, would include a director, appointed by the President and confirmed by the Senate, who would develop and oversee implementation of cybersecurity policies, principles, and standards.

The role of the director would be somewhat analogous to that of the current White House cybersecurity coordinator, Howard Schmidt, but arguably with more power. The director would be vested with authority to require agencies to identify and provide cybersecurity protections at a level commensurate with risk, establish an international cybersecurity strategy, coordinate development of standards for national security systems, and help coordinate secure acquisition policies. Like Schmidt's position, the director would not have budget authority, though agencies would have to send their cybersecurity budgets to the cyberspace office.

The director and agencies would be advised by a Federal Cybersecurity Practice Board containing 10 or fewer members, including representatives from certain agencies. The board would develop and update IT security policies and procedures like minimum security controls, measures of effectiveness, criteria for products and services to meet minimum security controls, and remedies for agencies' security deficiencies.

The creation of a permanent federal CTO position seems to blur the lines of roles currently filled by federal CIO Vivek Kundra and federal CTO Aneesh Chopra. The new official would advise the president, agencies, and CIOs and CTOs on IT issues including budget issues; lead interagency IT planning efforts; establish public-private partnerships to "achieve knowledge of tech available to be used for improving government operations and information technology research and development activities"; recommend federal IT policies; and publish an annual report about the state of federal IT.

Another significant change in the bill is the replacement of a requirement for "periodic testing" of cybersecurity, found in old legislative language, to automated and continuous monitoring to ensure cybersecurity controls are properly implemented and effective.

The amendment also requires creation of new guidance to ensure sufficient training and qualifications of officials with significant cybersecurity duties; the formal designation of a senior agency official as a CISO, rather than simply designating a senior agency official who will take on cybersecurity responsibilities; the addition of formal compliance assessment and operational cybersecurity roles for CISOs; development of secure acquisition policies; and a requirement to send to Congress initial vulnerability assessments of any new major systems that agencies plan to deploy.