write_parts.c-54 : failed to open = [/local/etc/httpd/cgi-lis/txt_templates/compr_reg_crumb.txt]

Committee Reports

107th Congress (2001-2002)

House Report 107-787 - Part 1

House Report 107-787 - Part 1 1 of 1

This Report: To Accompany H.R.2458     Printer Friendly: HTML  |  PDF




{link: 'http://www.congress.gov:80/cgi-bin/cpquery?',title: 'THOMAS - Committee Report - House Report 107-787 - Part 1' }

E-GOVERNMENT ACT OF 2002

19-006

107TH CONGRESS

REPT. 107-787

HOUSE OF REPRESENTATIVES

2d Session

Part 1
E-GOVERNMENT ACT OF 2002

NOVEMBER 14, 2002- Committed to the Committee of the Whole House on the State of the Union and ordered to be printed
Mr. BURTON of Indiana, from the Committee on Government Reform, submitted the following
R E P O R T
[To accompany H.R. 2458]
[Including cost estimate of the Congressional Budget Office]

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

Sec. 1. Short title; table of contents.
Sec. 2. Findings and purposes.
TITLE I--OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES
Sec. 101. Management and promotion of electronic government services.
Sec. 102. Conforming amendments.
TITLE II--FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES
Sec. 201. Definitions.
Sec. 202. Federal agency responsibilities.
Sec. 203. Compatibility of executive agency methods for use and acceptance of electronic signatures.
Sec. 204. Federal Internet portal.
Sec. 205. Federal courts.
Sec. 206. Regulatory agencies.
Sec. 207. Accessibility, usability, and preservation of government information.
Sec. 208. Privacy provisions.
Sec. 209. Federal information technology workforce development.
Sec. 210. Share-in-savings initiatives.
Sec. 211. Authorization for acquisition of information technology by State and local governments through Federal supply schedules.
Sec. 212. Integrated reporting study and pilot projects.
Sec. 213. Community technology centers.
Sec. 214. Enhancing crisis management through advanced information technology.
Sec. 215. Disparities in access to the Internet.
TITLE III--INFORMATION SECURITY
Sec. 301. Information security.
Sec. 302. Management of information technology.
Sec. 303. National Institute of Standards and Technology.
Sec. 304. Information Security and Privacy Advisory Board.
Sec. 305. Technical and conforming amendments.
Sec. 306. Construction.
TITLE IV--AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES
Sec. 401. Authorization of appropriations.
Sec. 402. Effective dates.
TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY
Sec. 501. Short title.
Sec. 502. Definitions.
Sec. 503. Coordination and oversight of policies.
Sec. 504. Effect on other laws.
Subtitle A--Confidential Information Protection
Sec. 511. Findings and purposes.
Sec. 512. Limitations on use and disclosure of data and information.
Sec. 513. Fines and penalties.
Subtitle B--Statistical Efficiency
Sec. 521. Findings and purposes.
Sec. 522. Designation of statistical agencies.
Sec. 523. Responsibilities of designated statistical agencies.
Sec. 524. Sharing of business data among designated statistical agencies.
Sec. 525. Limitations on use of business data provided by designated statistical agencies.
Sec. 526. Conforming amendments.

SEC. 2. FINDINGS AND PURPOSES.

TITLE I--OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES

SEC. 101. MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES.

`CHAPTER 36--MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

`Sec.
`3601. Definitions.
`3602. Office of Electronic Government.
`3603. Chief Information Officers Council.
`3604. E-Government Fund.
`3605. Program to encourage innovative solutions to enhance electronic Government services and processes.
`3606. E-Government report.

`Sec. 3601. Definitions

`Sec. 3602. Office of Electronic Government

`Sec. 3603. Chief Information Officers Council

`Sec. 3604. E-Government Fund

`Sec. 3605. Program to encourage innovative solutions to enhance electronic Government services and processes

`Sec. 3606. E-Government report

`36. Management and Promotion of Electronic Government Services
3601'.

SEC. 102. CONFORMING AMENDMENTS.

`Sec. 305. Electronic Government and information technologies

`305. Electronic Government and information technologies.'.

`Sec. 507. Office of Electronic Government

`507. Office of Electronic Government.'.

TITLE II--FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

SEC. 201. DEFINITIONS.

SEC. 202. FEDERAL AGENCY RESPONSIBILITIES.

SEC. 203. COMPATIBILITY OF EXECUTIVE AGENCY METHODS FOR USE AND ACCEPTANCE OF ELECTRONIC SIGNATURES.

SEC. 204. FEDERAL INTERNET PORTAL.

SEC. 205. FEDERAL COURTS.

SEC. 206. REGULATORY AGENCIES.

SEC. 207. ACCESSIBILITY, USABILITY, AND PRESERVATION OF GOVERNMENT INFORMATION.

(aa) institutions not a part of the Federal Government, including State, local, and foreign governments; industrial firms; educational institutions; not-for-profit organizations; federally funded research and development centers; and private individuals; and

(bb) entities of the Federal Government, including research and development laboratories, centers, and offices; and

(aa) the dates upon which the task or award is expected to start and end;

(bb) a brief summary describing the objective and the scientific and technical focus of the task or award;

(cc) the entity or institution performing the task or award and its contact information;

(dd) the total amount of Federal funds expected to be provided to the task or award over its lifetime and the amount of funds expected to be provided in each fiscal year in which the work of the task or award is ongoing;

(ee) any restrictions attached to the task or award that would prevent the sharing with the general public of any or all of the information required by this subsection, and the reasons for such restrictions; and

(ff) such other information as may be determined to be appropriate; and

SEC. 208. PRIVACY PROVISIONS.

SEC. 209. FEDERAL INFORMATION TECHNOLOGY WORKFORCE DEVELOPMENT.

`CHAPTER 37--INFORMATION TECHNOLOGY EXCHANGE PROGRAM

`Sec.
`3701. Definitions.
`3702. General provisions.
`3703. Assignment of employees to private sector organizations.
`3704. Assignment of employees from private sector organizations.
`3705. Application to Office of the Chief Technology Officer of the District of Columbia.
`3706. Reporting requirement.
`3707. Regulations.

`Sec. 3701. Definitions

`Sec. 3702. General provisions

`Sec. 3703. Assignment of employees to private sector organizations

`Sec. 3704. Assignment of employees from private sector organizations

`Sec. 3705. Application to Office of the Chief Technology Officer of the District of Columbia

`Sec. 3706. Reporting requirement

`Sec. 3707. Regulations

`37. Information Technology Exchange Program 3701'.

SEC. 210. SHARE-IN-SAVINGS INITIATIVES.

`Sec. 2332. Share-in-savings contracts

`2332. Share-in-savings contracts.'.

`SEC. 317. SHARE-IN-SAVINGS CONTRACTS.

SEC. 211. AUTHORIZATION FOR ACQUISITION OF INFORMATION TECHNOLOGY BY STATE AND LOCAL GOVERNMENTS THROUGH FEDERAL SUPPLY SCHEDULES.

SEC. 212. INTEGRATED REPORTING STUDY AND PILOT PROJECTS.

SEC. 213. COMMUNITY TECHNOLOGY CENTERS.

SEC. 214. ENHANCING CRISIS MANAGEMENT THROUGH ADVANCED INFORMATION TECHNOLOGY.

SEC. 215. DISPARITIES IN ACCESS TO THE INTERNET.

TITLE III--INFORMATION SECURITY

SEC. 301. INFORMATION SECURITY.

`SUBCHAPTER II--INFORMATION SECURITY

`Sec. 3531. Purposes

`Sec. 3532. Definitions

`Sec. 3533. Authority and functions of the Director

`Sec. 3534. Federal agency responsibilities

`Sec. 3535. Annual independent evaluation

`Sec. 3536. Federal information security incident center

`Sec. 3537. National security systems

`Sec. 3538. Authorization of appropriations

`Sec. 3539. Effect on existing law

`3531. Purposes.
`3532. Definitions.
`3533. Authority and functions of the Director.
`3534. Federal agency responsibilities.
`3535. Annual independent evaluation.
`3536. Federal information security incident center.
`3537. National security systems.
`3538. Authorization of appropriations.
`3539. Effect on existing law.'.

SEC. 302. MANAGEMENT OF INFORMATION TECHNOLOGY.

`Sec. 11331. Responsibilities for federal information systems standards

`11331. Responsibilities for Federal information systems standards.'.

SEC. 303. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY.

SEC. 304. INFORMATION SECURITY AND PRIVACY ADVISORY BOARD.

SEC. 305. TECHNICAL AND CONFORMING AMENDMENTS.

SEC. 306. CONSTRUCTION.

TITLE IV--AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES

SEC. 401. AUTHORIZATION OF APPROPRIATIONS.

SEC. 402. EFFECTIVE DATES.

TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY

SEC. 501. SHORT TITLE.

SEC. 502. DEFINITIONS.

SEC. 503. COORDINATION AND OVERSIGHT OF POLICIES.

SEC. 504. EFFECT ON OTHER LAWS.

Subtitle A--Confidential Information Protection

SEC. 511. FINDINGS AND PURPOSES.

SEC. 512. LIMITATIONS ON USE AND DISCLOSURE OF DATA AND INFORMATION.

SEC. 513. FINES AND PENALTIES.

Subtitle B--Statistical Efficiency

SEC. 521. FINDINGS AND PURPOSES.

SEC. 522. DESIGNATION OF STATISTICAL AGENCIES.

SEC. 523. RESPONSIBILITIES OF DESIGNATED STATISTICAL AGENCIES.

SEC. 524. SHARING OF BUSINESS DATA AMONG DESIGNATED STATISTICAL AGENCIES.

SEC. 525. LIMITATIONS ON USE OF BUSINESS DATA PROVIDED BY DESIGNATED STATISTICAL AGENCIES.

SEC. 526. CONFORMING AMENDMENTS.

`Sec. 402. Providing business data to Designated Statistical Agencies

`402. Providing business data to Designated Statistical Agencies.'.

I. PURPOSE

H.R. 2458, the bipartisan, `Electronic Government Act of 2002,' introduced by Congressman Jim Turner (TX), provides a new framework for managing the Federal government's information resources and increasing the availability of information to citizens through electronic government initiatives. The act establishes an E-Government fund and creates a new Office of Electronic Government in the Office of Management and Budget, which will be led by a presidentially appointed E-Government Administrator. The new office can then focus on better management of our information resources. H.R. 2458 includes several provisions intended to ensure greater citizen access to the Federal government through the improved application of information technology (IT). The act strengthens information security government-wide and addresses the management and protection of information collected for statistical purposes. It also encourages contractor innovation for information technology solutions that will enhance electronic government services and processes, and allows for the limited use of share-in-savings contracts for the procurement of information technology solutions.

II. BACKGROUND AND NEED FOR LEGISLATION

The Federal government, as well as State and local governments, are increasingly turning to the Internet and other information technologies to conduct the business of government. In addition to internal agency electronic initiatives, Federal agencies are conducting paperless acquisitions for goods and services, developing interactive electronic services for the public, and engaging in electronic collection and dissemination of information. Electronic government is the term that captures this use of technology, particularly Web-based Internet applications, to enhance the access to and delivery of government information and services to citizens, businesses, employees, agencies, and other governments.

As the General Accounting Office (GAO) has pointed out: `While the Internet opens new opportunities for streamlining processes and enhancing delivery of services, federal executives and managers must also be cognizant of the responsibilities and challenges that accompany these opportunities. These challenges include (1) sustaining committed executive leadership, (2) building effective e-government business cases, (3) maintaining a citizen focus, (4) protecting personal privacy, (5) implementing appropriate security controls, (6) maintaining electronic records, (7) maintaining a robust technical infrastructure, (8) addressing human capital concerns, and (9) ensuring uniform service to the public.' 1

[Footnote] These challenges must be met in order for E-Government initiatives to succeed. Therefore, this act provides for critically needed training for information technology managers, improvements in information security, and facilitates the procurement of information technology solutions.

[Footnote 1: `Electronic Government: Challenges Must Be Addressed With Effective Leadership and Management,' GAO-01-959T, July 11, 2001.]

Congressman Tom Davis noted at the October 1, 2002, Subcommittee on Technology and Procurement Policy mark-up that H.R. 2458 is `strong piece of legislation that will bring an analog federal government into the digital age.' It is an amalgam of provisions from several important pieces of legislation that the Committee on Government Reform has developed. Most of these provisions were passed and reported by the Committee, which incorporated them into H.R. 2458 to form a comprehensive approach to the implementation of E-Government initiatives. Among the critical provisions incorporated into this act is S. 803, the Senate companion bill introduced by Senator Joseph Lieberman and passed by the Senate on June 27, 2002, by unanimous consent. This includes several programs to improve the deployment of E-Government, such as the creation of a government-wide Web site, government-wide information collection and dissemination provisions, privacy provisions, and studies on disaster management, the community technology centers, and the digital divide.

The Committee intends this Act to promote streamlining of technology requirements in a way that allows the Federal government to respond to changes in technology in a timely manner, rather than to introduce unnecessary layers of bureaucratic process to the mission of expanding and furthering electronic government. The Committee intends the Act to assist the Federal government in leveraging technology in a way that enhances agency business processes to serve the needs of the citizen.

TITLE I: OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES

Summary.--In Title I, the act provides several measures to strengthen government-wide approaches to improving the use of information technology for service delivery and governmental efficiency and effectiveness. It establishes an Office of Electronic Government in the Office of Management and Budget (OMB) to focus OMB and government-wide management attention on the important tasks of developing information technology capabilities to enable electronic government initiatives. Second, it endeavors to institutionalize reforms in agency information resources management by establishing a statutory basis for the interagency Chief Information Officers Council. Third, it establishes a program to promote contractor innovation and excellence in E-Gov services and processes. Finally, the act establishes an interagency E-Gov Fund to provide funding for innovative E-Gov initiatives.

The major impetus for the provisions of Title I is the repeated call for improved leadership for electronic government. Currently, Federal information resources management (IRM) is overseen by OMB's Office of Information and Regulatory Affairs (OIRA) under the Paperwork Reduction Act, 44 U.S.C. ch. 35. Over the years, there have been many complaints about agency IRM practices and OIRA IRM oversight. 2

[Footnote]

[Footnote 2: See, for example, `Paperwork Reduction Act Reauthorization and Government Information Management Issues,' Congressional Research Service, RL30590, February 7, 2001, and `Information Resources Management: Comprehensive Strategic Plan Needed to Address Mounting Challenges,' General Accounting Office, GAO-02-292, February 2002; `Paperwork Reduction Act of 1995,' Report of the Committee on Government Reform and Oversight, House of Representatives, Report 104-37, February 15, 1995.]

Rather than address the challenges of electronic government through review and perhaps revision of the IRM framework in the Paperwork Reduction Act, the current legislation reflects a decision to establish a separate office and management approach for E-Gov. Given the pressing nature of the problems the legislation addresses, and given the broad support for this approach in both this body and the Senate, the Committee supports the effort at this time, with reservation. The Committee will watch the implementation of these provisions very closely, however, to assess whether they actually improve Federal management of information resources.

Definitions.--This Title uses the definitions provided in 44 U.S.C. 3502, but provides eight additional definitions, including `electronic government' and `enterprise architecture.' The Committee intends the definition of `electronic government' to be interpreted as applying to agency information technologies in the same manner as is applied to information technology under the Clinger Cohen Act, including appropriate exemptions in that statute for national security systems.

The Committee defines the term `enterprise architecture' because successful public and private-sector organizations have used such architectures as best practice for effective business and technology transformation. In simplest terms, an enterprise represents the entire scope of an entity (e.g., an entire agency or set of agencies performing a related function), and an architecture is the structural description of the processes that make up the entity; an `enterprise architecture' describes the business, information, technology, and infrastructure of such entities. The architecture describes the current, or `as is,' environment, as well as the target, or `to be,' environment, and the modernization plan that bridges the two. When well implemented, enterprise architectures bring clarity to the interrelationships among business operations and the underlying IT that support the operations, and can be used to guide IT investments in a way that reduces redundancies in systems and processes, modernizes operations, and improves program performance.

Categorization Standards and Guidelines.--The E-Government Administrator will assist the OMB Director in establishing policies to support IT standards and guidelines. The Committee intends that the standards and guidelines to be developed by the National Institute of Standards and Technology for the categorization of Federal Government electronic information shall be consistent with the recommendation for any similar standards required in Section 207(d) of this Act.

Ongoing Dialogue.--The Office of Electronic Government sponsor ongoing dialogue that shall be conducted among Federal (in the executive, legislative, and judicial branches), State, local, and tribal government leaders on electronic Government to encourage collaboration and enhance understanding of best practices and innovative approaches in acquiring, using, and managing information resources.

Chief Information Officers Council.--The Committee recognizes that as technology and management priorities change, the agenda of the CIO Council must allow for flexibility. The functions of the Council that this bill describes are intended to be sufficiently broad so as to provide OMB and CIOs with flexibility to address and manage change so that the Administration can adjust the priorities of the Council accordingly.

E-Government Fund.--The act establishes an interagency E-Gov Fund to provide funding for innovative E-Gov initiatives. Section 3604 outlines criteria by which projects submitted to for funding from this Fund are to be evaluated. The Committee notes that OMB must `consider' certain criteria under 3604(c)(1), but that applying each of these criteria is not mandatory in every case and projects should be evaluated by relevant criteria. The Committee also notes that these criteria will evolve to meet the needs of electronic government, and that the Office of Electronic Government shall be responsible for ensuring that the criteria for evaluating projects applying for funds reflect changes to the government's electronic government initiatives.

TITLE II: FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

Summary

Title II mandates a broad array of specific initiatives that require the use of Internet applications and other information technologies to enhance Federal E-Government capabilities. Among its provisions are requirements to support broader use of electronic signatures, develop a Federal Internet portal, improve public access to public information in Federal agencies and the courts, strengthen privacy protections, improve Federal workforce information technology skills, to harness the innovative spirit of the private sector by making greater use of share-in-savings contracts, research the use of information technologies for better crisis management, and mandate more effective use of community technology centers.

The spectacular growth of the Internet and the increasing use of information technology applications by government agencies not only have fueled a drive for broad government-wide reforms to promote E-Gov, but also have provided insights into opportunities for specific E-Gov initiatives. The following provisions are necessary to ensure the implementation of the concepts outlined and promoted in this act.

Agency Responsibilities

Title II establishes agency responsibilities for implementing this act, including the development of performance measures to help agencies ensure that the E-Government initiatives will enable progress toward agency objectives. Agencies are required to report to OMB on their compliance with the act's provisions. The agencies are instructed to consider the impact of E-Government initiatives on citizens without access to the Internet and to ensure that the availability of government information resources is not diminished for such persons.

Accessibility to People with Disabilities.--The Committee intends that the term `information technology' in this Section be interpreted in the same manner as the term `Electronic and Information Technology' under Section 508 of the Rehabilitation Act of 1973, as amended.

E-government Status Report- The Committee notes that in preparing for this annual reporting requirement, that agencies should report on the sections of this Act that are relevant to agency activities and initiatives, unless noted. Further, as many electronic government initiatives involve cross-agency collaboration, the Committee intends that cross-agency initiatives be included in the report. In cases where agencies are involved in collaborative efforts, one agency may serve as the lead agency in reporting on the status of the imitative on behalf of its partner agencies.

Public Access

Provisions in this section are intended to increase the availability of information and the ease with which the public may access it. Sifting through the wealth of information disseminated by the government can be daunting and confusing. Currently, the federal government organizes publicly available information according to agency jurisdiction which often leads to duplicative information resource management efforts, and may be counter-intuitive for citizens conducting searches.

This Act requires federal agencies to improve online access to agency information through a number of initiatives. For instance, the federal Internet portal will help improve public access to government information and services. The Committee intends that access to information on a portal web site be consistent with existing laws and policies on privacy. Portal web sites maintained by Federal agencies should only allow access to information on individuals if such access fully complies with privacy protections under existing law and policy. A directory of government websites organized by subject matter, will be created and linked to the federal Internet portal. Furthermore, regulatory agencies will be required to include on a publicly accessible website all information required to be published in the Federal Register and to keep public rulemaking information online. Federal Courts will be required to have information and judicial opinions on websites.

OMB will be responsible for providing guidance to agencies in a number of areas so that they may improve the organization, presentation, and public accessibility of their information, including information on the Internet. OMB must establish an Interagency Committee on Government Information which will submit its recommendations to OMB about information access, dissemination, and retention. OMB must then issue policies to address such matters as standards for the organization and categorization of government information in a way that is searchable electronically and interoperable across agencies. OMB must also issue guidance to agencies regarding the content requirements and accessibility of their websites.

Electronic Docketing.--Subsection (d) requires agencies, `to the extent practicable,' to include submissions under section 553(c) of title 5, U.S.C., and other materials that agencies include in their dockets (by rule or practice) in their electronic dockets, `whether or not submitted electronically.' The Committee intends that this requirement serve to increase transparency for agency rulemaking by making agency dockets accessible online wherever possible. The Committee notes that agencies receive many materials in the docket that may be difficult to make accessible through electronic means. There are also copyright issues associated with some materials submitted to agency dockets. To avoid the burden associated with transferring certain items to electronic format, such as books or physical objects, agencies may simply provide notice of the availability of the material, including in the electronic docket a description of the item and instructions for the public on accessing the material through the agency docket. Agencies may also consider using visual means, such as digital photos, to make materials available through the agency's electronic docket.

Section 207 `Accessibility, Usability, and Preservation of Government Information'

Process.--The Committee notes that the activities of the Interagency Committee outlined in this section will lead to further actions, and uses this opportunity to clarify this process. In all cases, the Interagency Committee is charged with making recommendations to OMB and/or the Executive Branch agency with authorities in that topic area. OMB will then develop and issue guidance and/or policy based on the recommendation of the Committee. Federal agencies are then responsible for implementing those guidelines/policies. Information placed on government web sites can be federal records; federal records should be routinely reviewed to assure proper scheduling for archival storage.

Consultation of the Interagency Committee.--The Committee intends that the consultation of the Interagency Committee on Government Information with interested groups be done in such a way as to simply seek views and not to warrant the establishment of a Federal Advisory Committee. The Committee does not contemplate the consultation activities of the Interagency Committee to provide advice that would invoke the Federal Advisory Committee Act (FACA)

Searchable Identifiers.--The Committee intends that the searchable identifiers developed under this section will build on an advance the purposes of Section 3511 of title 44 of the United States Code.

Privacy

The revolutionary impact of the Internet and the growing number of online transactions raise concerns about the protection of information collected in an `identifiable form,' that is information that permits the identity of the individual to whom the information applies to be reasonably inferred directly or indirectly.

Privacy Impact Assessments.--This section requires agencies, with OMB guidance, to complete Privacy Impact Assessments (PIA) before collecting information in an identifiable form or procuring information technology that collects, maintains, or disseminates such information. The Committee intends that the OMB guidance on for conducting Privacy Impact Assessments (PIAs) under Section 208(b) address initial, high-level assessments that are consistent with post-procurement PIAs done by some agencies.

In addition, the Committee intends that the OMB guidance on process for developing a Privacy Impact Assessment (PIA) be done in a way that allows for consistency with work done by agencies to assess privacy requirements under the Paperwork Reduction Act (PRA) and the Privacy Act of 1974, with regard to new collections of information that include personally identifiable information.

In section 208(b)(1)(B)(iii), the Committee intends that on occasions where a Privacy Act systems of record notice is required, agencies can satisfy the publication requirement for PIAs by attaching a PIA to a Privacy Act systems of records notice published in the Federal Register.

OMB must also issue guidance regarding the posting of privacy notices on agency websites. This will give the public a better understanding of what and why information is collected, its use, with whom it will be shared, individual rights with regard to the information, and how it will be secured. Additionally, OMB guidance will cover the conversion of privacy policies into machine-readable formats to provide the public with a simple automated way to better control the use of personal information on websites they visit.

Tracking- In addition, the Committee intends this Act to be consistent with OMB policy and the restrictions on the tracking of individuals through agency websites through the use of such devices as persistent cookies.

Information technology training

E-Government initiatives require a well-trained information technology workforce to implement them. However, in 2001 the General Accounting Office added the Federal government's human capital management crisis to its annual high-risk list. The expected personnel shortages are greatest in the information technology fields. In fact, fifty percent of the federal government's information technology workforce will be eligible to retire by 2006, compared to 34 percent government-wide. Therefore, it is critical that the federal government retains and recruits talented IT workers, but the competition from the private sector is fierce. Currently, federal agencies face overwhelming obstacles in enticing IT workers away from the private sector and into the federal workforce. The federal government simply cannot compete with the salaries, benefits, and comprehensive training offered by the private sector. For these reasons, the act creates training opportunities in information technology management through the Digital Tech Corps, an exchange of eligible mid-level staff between leading-edge private sector organizations and governmental agencies. The Digital Tech Corps program is intended to invigorate the current IT workforce and help establish the Federal government as a desirable employer in the IT arena. This program is based on H.R. 3925, the Digital Tech Corps Act of 2002, which the Committee on Government Reform favorably reported by voice vote on March 14, 2002.

Technical innovations

In order to evaluate the overwhelming number of industry proposals offering solutions to the Federal government's IT challenges, this act includes technical innovation provisions based on H.R. 4629, introduced by Congressman Tom Davis on May 1, 2002. The E-Government Administrator will establish a multi-agency screening board to review and assess cutting-edge technologies that promise to facilitate and enhance the rapid deployment of IT solutions that will breakdown stovepipes and achieve greater interagency cooperation. The screening board will then submit its assessments to the E-Government Administrator for funding consideration under the E-Government Fund or will forward them to the appropriate agency. These provisions are an excellent means to leverage innovative technology solutions that would not otherwise be available to the government.

Share-in-savings

To date, congressional reforms of the government procurement process include streamlining measures, cost-savings, access to technological advancements, and reduced procurement cycles. As a result there has been an improvement in the quality of products and services purchased by the federal government. However, these reforms do not address the growth in agency purchases of services necessary to meet their mission objectives, particularly in the IT field. Therefore, this act will authorize the government-wide use of share-in-savings contracts for information technology.

Share-in savings is an innovative contract vehicle that allows agencies to leverage their limited resources in order to achieve a greater return on investment. Agencies can use this type of contract to improve their service delivery and lower their costs without initial capital expenditures since the contractor would provide the technology. Further, agencies would be obligated to pay the contractor for the services only if savings are realized and then payment is limited to an agreed upon portion of the total savings realized. The agency may retain a portion of the remaining savings. Agencies would be permitted to enter into share-in-savings contracts for five years, and with appropriate approval up to 10 years. The share-in-savings provisions would sunset in September 2009. The federal government may use an aggregate of five such contracts during fiscal years 2003, 2004, and 2005. Beginning in fiscal year 2006, the aggregate number would increase to ten. Two years after enactment, the Office of Management and Budget is required to report to Congress on the number of share-in-savings contracts entered into and its recommendations for changes in law to encourage their use. The General Accounting Office is required to review the OMB report. It is the hope of the Committee that OMB will encourage federal agencies to engage in these contracts and contact the Administrator of General Services for guidance in identifying share-in-savings contract opportunities as directed under these provisions. The share-in-savings concept originated in H.R. 3832, the Services Acquisition Reform Act (SARA). The Subcommittee on Technology and Procurement Policy held a legislative hearing on SARA on March 7, 2002.

Integrated reporting study and pilot projects

The Committee notes that this section is consistent with the Administration's approach to consolidation of information by collection of information one time, and using such information to populate data elements that can be utilized across many purposes and transactions. By `collect once, use many,' the Administration seeks to reduce stovepipes and to reduce the reporting burdens on citizen and businesses. The Committee understands that the Administration's electronic government initiatives will demonstrate methods by which this principle can be realized, while ensuring the security and privacy of personal information.

Contents of study on enhancement of crisis response

The Committee intends that the contents of the commissioned study examine opportunities for research and development on enhanced technologies for improving communications with citizens at risk before and during a crisis; enhancing the use of remote sensor data and other information sources for planning, mitigation, response, and advance warning; building more robust and trustworthy systems for communications in crises; facilitating coordinated actions among responders through more interoperable communications and information systems; and other areas of potential improvement as determined during the course of the study.

Disparities in access to the Internet

In our efforts to modernize the government's information resources management and implement E-Government initiatives, we must bear in mind that not all citizens have Internet access. Therefore, the act requires the General Services Administration to commission a study to examine the disparities in Internet access, including a review of alternative sources of internet access, particularly access through public libraries. The study must include recommendations for ensuring that E-Government initiatives do not decrease public access to government information. The Committee intends that the commissioned study should examine disparities in Internet access, including a review of alternative sources of internet access, particularly access through public libraries.

TITLE III: INFORMATION SECURITY

A. Summary

Title III of H.R. 2458 is the `Federal Information Security Management Act of 2002' (FISMA). It is intended to revise GISRA, the Government Information Security Reform provisions of the Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001 (Div. A, Title X, Subtitle G, sec. 1061-1065; Pub. L. 106-398, October 30, 2000).

The purpose of FISMA is to permanently authorize a government-wide risk-based approach to information security by eliminating GISRA's two-year sunset, and to further strengthen Federal information security by requiring compliance with minimum mandatory management controls for securing information and information systems, clarifying and strengthening current management and reporting requirements, and strengthening the role of National Institute of Standards and Technology (NIST).

In accomplishing this range of reforms, FISMA takes the significant step of consolidating current information security requirements spread across the GISRA, the Computer Security Act, the Clinger-Cohen Act, and the Paperwork Reduction Act. FISMA eliminates obsolete mandates, updates outmoded provisions, harmonizes overlapping requirements, and strengthens key requirements. The result is a clearer and stronger law to guide Federal agencies to provide needed improvements to their information security.

Title III largely reflects the provisions of H.R. 3844, introduced on March 5, 2002, by Representative Tom Davis, for himself and Representative Steve Horn. Following introduction, H.R. 3844 was referred to the Committees on Government Reform and the Committee on Science. Several legislative hearings were held:

B. Background and Need for the Legislation

Increases in computer interconnectivity, especially through the Internet, continue to revolutionize the way our government, our nation, and much of the world communicate and conduct business. Unfortunately, this interconnectivity has also dramatically increased significant risks to our computer systems and the critical operations and infrastructures they support, such as telecommunications, power distribution, public health, national defense and law enforcement.

As greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation's defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital governmental and national interests. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, including for reasons of crime, terrorism, foreign intelligence gathering, and acts of war. According to the FBI, terrorists, transnational criminals, and foreign intelligence services are learning to use tools such as computer viruses, Trojan horses, worms, logic bombs, and eavesdropping sniffers that can destroy, intercept, degrade the integrity of, or deny access to information and systems. These growing threats are in addition to the continuing problem faced by all organizations from disgruntled insiders who often have the knowledge to gain access and inflict damage or steal assets, even if they do not know a great deal about computers.

Over the past several years, GAO has reported numerous times that poor information security is a widespread federal problem with potentially devastating consequences. 3

[Footnote] Although agencies have taken steps to redesign and strengthen their information system security programs, GAO analyses of information security at major federal agencies have shown that federal systems were not being adequately protected from computer-based threats, even though these systems process, store, and transmit enormous amounts of sensitive data and are indispensable to many federal agency operations. 4

[Footnote]

[Footnote 3: U.S. General Accounting Office, Information Security: Opportunities for Improved OMB Oversight of Agency Practices. GAO/AIMD-96-110 (Washington, D.C.: Sept. 24, 1996). U.S. General Accounting Office, Information Security: Serious Weaknesses Place Critical Federal Operations and Assets at Risk, GAO/AIMD-98-92 (Washington, D.C.: Sept. 23, 1998); Information Security: Serious and Widespread Weaknesses Persist at Federal Agencies, GAO/AIMD-00-295 (Washington, D.C.: Sept. 6, 2000). U.S. General Accounting Office, Computer Security: Improvements Needed to Reduce Risk to Critical Federal Operations and Assets, GAO-02-231T (Washington, D.C.: Nov. 9, 2001).]

[Footnote 4: U.S. General Accounting Office, High-Risk Series: Information Management and Technology, GAO/HR-97-9 (Washington, D.C.: Feb. 1, 1997); High-Risk Series: An Update, GAO/HR-99-1 (Washington, D.C.: Jan. 1999); High Risk Series: An Update, GAO-01-263 (Washington, D.C.: Jan. 2001).]

The weaknesses GAO identified place a broad array of federal operations and assets at risk. For example:

Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, on October 30, 2000, the Congress enacted GISRA, the Government Information Security Reform provisions of the Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001 (Div. A, Title X, Subtitle G, sec. 1061-1065; Pub. L. 106-398, October 30, 2000). GISRA supplements information security requirements established in the Computer Security Act of 1987, the Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996. GISRA drew on these separate requirements to establish an overall framework for managing information security centered on the establishment of agency-wide information security management programs involving periodic risk assessments and periodic management testing and evaluation; and annual independent evaluation of each agency's information security program and practices.

GAO has reported that the first-year implementation of GISRA yielded significant benefits in terms of agency focus on information security. 5

[Footnote] Agency Inspectors General (IG) also have described GISRA as a positive step toward improving information security particularly by increasing agency management's focus on this issue. However, GAO and IG's have also reported on problems in implementing GISRA, as well as the potential problems created by the expiration of GISRA on November 29, 2002.

[Footnote 5: U.S. General Accounting Office, Information Security: Additional Actions Needed to Fully Implement Reform Legislation. GAO-02-470T. (Washington, D.C.: March 6, 2002). U.S. General Accounting Office, Information Security: Comments on the Proposed Federal Information Security Management Act of 2002. GAO-02-677T. (Washington, D.C.: May 2, 2002).]

GAO has identified several key issues that remain a problem for federal information security under GISRA. Currently, agencies have wide discretion in deciding what computer security controls to implement and the level of rigor with which to enforce these controls. In theory, some discretion is appropriate since, as OMB and NIST guidance state, the level of protection that agencies provide should be commensurate with the risk to agency operations and assets. In essence, one set of specific controls will not be appropriate for all types of systems and data. Nevertheless, GAO studies of best practices at leading organizations have shown that more specific guidance is important. 6

[Footnote] In particular, specific mandatory standards for specified risk levels can clarify expectations for information protection, including audit criteria; provide a standard framework for assessing information security risk; help ensure that shared data are appropriately and consistently protected; and reduce demands for already limited agency information security resources to independently develop security controls.

[Footnote 6: GAO/AIMD-98-68, May 1998.]

The Congress should have consistent and timely information for overseeing agencies' efforts to implement information security requirements and for taking corrective actions, as well as for budget deliberations. Unfortunately, both GAO and the Subcommittee on Government Efficiency, Financial Management and Intergovernmental Relations have experienced difficulties in getting access to information concerning agency implementation of GISRA. Clarified statutory language, including more precise reporting requirements should help ensure that Congress receives the information it needs to perform its oversight function.

Experience under GISRA has also highlighted a number of other provisions that complicate fulfillment of the law's purposes. There is significant variation among agencies in structuring their agency information security programs, and not all agencies have well-established information security offices. Reliance on different provisions in GISRA have led to some confusion about requirements for information security `programs' as opposed to `plans', as well as `mission critical systems.' Agencies also continue to lack adequate plans and procedures to respond to information security incidents and ensure the continuity of operations for information systems that support the operations and assets of the agency.

The imminent expiration of GISRA along with identified Federal information security weaknesses not adequately addressed under current law argues for legislation to strengthen Federal information security.

C. Explanation of the Legislation

Title III, entitled the `Federal Information Security Management Act of 2002' (FISMA), largely reflects the provisions of H.R. 3844, introduced on March 5, 2002, by Rep. Tom Davis, for himself and Rep. Steve Horn. The provisions amend the Government Information Security Reform (GISRA) provisions of the Floyd D. Spence National Defense Authorization Act for Fiscal Year 2001 (Div. A, Title X, Subtitle G, sec. 1061-1065; Pub. L. 106-398, October 30, 2000).

FISMA is composed of GISRA revisions, provisions of the `Federal Information Policy Act of 2000' (H.R. 5024), introduced on July 27, 2000, by Rep. Tom Davis (R-VA), and the original GISRA legislation, the `Government Information Security Act of 1999 (S. 1993), introduced on November 19, 1999, by Senator Fred Thompson (R-TN) and Senator Joseph Lieberman (D-CT). The legislation also includes elements similar to provisions in the `Computer Security Enhancement Act of 2001' (H.R. 1259), introduced on March 28, 2001 (and passed by the House on November 27, 2001), by Rep. Connie Morella (R-MD).

In summary, FISMA:

Overall, the goal of FISMA is to continue and strengthen the risk management information security reforms first enacted into law in GISRA. This goal is accomplished through six key sets of provisions.

First, in Sec. 3533, FISMA sets out OMB's information security responsibilities. In one respect, FISMA expands OMB responsibilities provided under GISRA, requiring OMB to promulgate information security standards developed by NIST. By this change, OMB would take over this function from the Secretary of Commerce, who would still promulgate NIST-developed information system standards. Otherwise, FISMA refines the comparable GISRA section to streamline the OMB provisions and avoid unnecessary duplication with other provisions of law.

Second, in Sec. 3534, FISMA sets out Federal agency information security responsibilities. Again, FISMA maintains the general range of agency responsibilities provided under GISRA, while refining specific provisions to streamline provisions and more clearly specify key requirements, for example, providing more detailed requirements for the agency information security office, and responsibilities for periodic management testing and evaluation.

Third, in Sec. 3535, FISMA provides for annual independent evaluation of agency information security programs and practices. Preserving the general scheme established under GISRA, FISMA refines the requirements of this section to address concerns raised by agency program and Inspectors General officials about the scale and scope of the annual evaluation. The overall goal of FISMA's revision is to ensure accountability for a comprehensive evaluation of agency information security. This does not require a single simultaneous or integrated review of all systems. Rather, the Committee envisions a set of reviews involving testing of systems with different standards of frequency and rigor depending on risk levels and unique requirements, including those for national security systems. Thus, each agency's annual information security evaluation should be comprehensive in its scope while selective in its detail. The goal is to ensure accountability for a review or set of reviews that in combination covers the full extent of an agency's information security program and practices. Given the Committee's concern that these evaluations be carried out in a way that provides meaningful review and accountability without jeopardizing efficient and effective operations of either agency program operations, agency IG's, or OMB, the Committee expects OMB to report on the costs and benefits of this process.

Fourth, in Sec. 3536, FISMA provides for the operation of a central Federal information security incident center. The Committee recognizes the current successful operation of GSA's incident center, FedCIRC. The purpose of the requirement in this section is to provide a permanent authorization for a center such as FedCIRC, and to insure that its activities are broadly conceived and faithfully carried out consistent with the mandate in this section. Testimony by GAO and others in both the context of government information security and critical infrastructure protection have stressed the importance of having a well-established government-wide incident center that can analyze security incidents, provide timely assistance, and consult with agencies across the entire range of government, including national security agencies, to ensure an effective government-wide response to information security threats and vulnerabilities. The Committee believes the statutory mandate in this section will accomplish this goal.

Fifth, in Sec. 3537, FISMA places national security systems within the government-wide information security risk management framework of the legislation. The purpose of the section is to make clear that while agencies must manage national security systems consistent with applicable national security requirements (independent of OMB or NIST system requirements), they must also secure those systems with the same risk-based management approach and the same commitment to agency accountability applicable to all Federal agencies through provisions of the instant legislation, most notably the requirements at 3534 and 3535.

This section is intended to complement other provisions that address the unique needs of national security systems within the framework of a government-wide approach to information security, while at the same time simplify GISRA's varied formulations for national security-related systems. For example:

Sixth, FISMA would require the development, promulgation, and compliance with minimum mandatory management controls for securing information and information systems to manage risks as determined by agencies. Specifically:

It should be noted that in this section FISMA refers to `security' instead of `security and privacy,' as under the Computer Security Act. The elimination of references to privacy reflects the decision to have NIST focus on technical issues critical to developing effective information security controls. While the Computer Security Act linked security and privacy, experience over the last decade and a half has shown that privacy policy is largely outside the area of expertise of NIST. This is a reflection of the differences between information security and privacy. Information security requires the development and use of technical and management controls and processes to provide appropriate levels of information integrity, confidentiality, and availability. Without adequate security, personal information is, of course, vulnerable to a breach of privacy, but the protection of privacy flows from policy decisions about levels of confidentiality to apply to specific sets of personal information. Thus, the congressional Office of Technology Assessment stated in 1995, `Privacy refers to the social balance between an individual's right to keep information confidential and the societal benefit derived from sharing information, and how this balance is codified to give individuals the means to control personal information.' Issue Update on Information Security and Privacy in Network Environments, June 1995. The development of such policy choices is not a technical matter for an agency such as NIST. On the other hand, attention to standards and guidelines necessary to provide agreed upon confidentiality in information systems is a matter for the agency.

The Committee believes that the provisions of FISMA can significantly strengthen information security in the Federal government. The Committee's view is that while the initial implementation of GISRA has been beneficial, the changes provided in this title can drive further reforms in Federal information security. This legislation is needed therefore not simply to remove the sunset that will otherwise soon end GISRA, but also to reinforce and redouble the Federal government's commitment to establishing information security as an integral part of its operations.

TITLE IV: AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES

Title IV provides authorization of appropriations and effective dates for this legislation.

TITLE V: CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY

This act establishes new processes for the improved accuracy, management, and protection of information collected from businesses for statistical purposes. It lifts the current statutory barriers on information sharing of business-related statistical data between the Census Bureau, the Bureau of Labor Statistics, and the Bureau of Economic Analysis so that the Federal government can improve accuracy and correct anomalies in economic statistics. Additionally, the act would reduce the reporting burdens on the businesses that must now supply data separately to the individual agencies. The data-sharing will be conducted according to written agreements that will specify its uses, including which data is to be used and the appropriate security safeguards that will be followed. The Act will also ensure that the confidential data that individual citizens and businesses provide to Federal agencies for statistical purposes are subject to uniform and rigorous confidentiality protections. The Act includes severe fines and penalties for willful disclosure of collected data. These provisions originated in H.R. 5215, the Confidential Information Protection and Statistical Efficiency Act of 2002, which passed by voice vote in the Committee on Government Reform on October 9, 2002.

III. LEGISLATIVE HEARINGS AND COMMITTEE ACTION

H.R. 2458, the bipartisan `E-Government Act of 2001' was introduced on July 11, 2001, by Congressman Jim Turner (TX), the Ranking Member of the Government Reform Subcommittee on Technology and Procurement Policy. As introduced, the legislation largely reflected the provisions of Title I and II of the current Act. After introduction, the bill was referred to the Government Reform and the Subcommittee on Technology and Procurement Policy.

On September 18, 2002, the Subcommittee on Technology and Procurement Policy held a legislative hearing to consider the legislation and S. 803, the Senate companion bill, which was passed by the Senate on June 27, 2002. The Subcommittee heard testimony from Linda Koontz of GAO; Mark Forman from the Office of Management and Budget; Pat McGinnis from the Council of Excellence in Government; Mr. Tom Gann, Vice President of Government Relations for Siebel Systems testifying on behalf of the Information Technology and Industry Council, and Mr. Roger Baker, former Chief Information Officer of the Department of Commerce.

On October 1, 2002, the Subcommittee held a mark-up of the bill. Subcommittee Chairman Tom Davis offered three amendments that were accepted by voice vote. The first amendment strikes the Senate confirmation requirement for the Administrator of Electronic Government. The second amendment increases training opportunities for IT managers through the creation of the Digital Tech Corps, which will encourage the exchange of talented mid-level staff between leading-edge private sector organizations and governmental agencies. The third amendment authorizes the government-wide use of share-in-savings contracts for information technology solutions. These amendments were incorporated into a manager's amendment in the nature of a substitute that the Subcommittee approved by voice vote. This substitute reflected the current form of the legislation, namely, Titles I, II, III, IV, and V.

On October 9, 2002, the Committee on Government Reform held a business meeting where it marked up H.R. 2458. The Committee, by voice vote, did not accept an amendment offered by Congressman Jim Turner to reinstate Senate confirmation of the Administrator of Electronic Government. By voice vote, the Committee then approved reporting H.R. 2458 without amendment to the full House.

IV. SECTION-BY-SECTION ANALYSIS

SECTION 1. SHORT TITLE; TABLE OF CONTENTS

This Act may be cited as the `E-Government Act of 2002.'

SEC. 2. FINDINGS AND PURPOSES

(a) Findings

This subsection lists seven findings including: (1) that the use of computers and the internet is transforming the relationships among citizens, private businesses, and the Government, (2) that the Federal Government has had uneven success in applying advances in information technology to enhance it services and functions, (3) that most Internet services of the Federal Government have been developed and presented separately, according to the jurisdictional boundaries of the individual department or agency rather than being integrated cooperatively according to function or topic, and (4) that to take full advantage of improved Government performance that can be achieved through Internet-based technology requires strong leadership, better organization, improved interagency collaboration, and more focused oversight of agency compliance with statutes related to information resources management.

(b) Purposes

This subsection lists 11 purposes of the Act, including: (1) to provide effective leadership of Federal Government efforts to develop and promote electronic Government services and processes by establishing an Administrator of a new Office of Electronic Government within the Office of Management and Budget (OMB), (2) to improve the ability of the Government to achieve agency missions and program performance goals, (3) to promote the use of the Internet and emerging technologies within and across the Government agencies to provide citizen-centric Government information and services, (4) to promote access to high quality Government information and services across multiple channels and (5) to transform agency operations by utilizing, where appropriate, best practices from public and private sector organizations.

TITLE I--OFFICE OF MANAGEMENT AND BUDGET ELECTRONIC GOVERNMENT SERVICES

SEC. 101. MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

This section creates a new chapter 36 in title 44, U.S. Code, entitled `Management and Promotion of Electronic Government Services.' This chapter follows the Paperwork Reduction Act (PRA), which comprises chapter 35 in title 44. The new chapter 36 has six sections:

This section establishes an OMB Office of Electronic Government, headed by an Administrator of Electronic Government, to provide overall leadership and direction to the executive branch on electronic Government initiatives. The E-Gov Administrator would be appointed by the President. The E-Gov Administrator will coordinate E-Gov efforts with the Administrator of the Office of Information and Regulatory Affairs (OIRA) to ensure consistent implementation of related information management laws.

Sec. 3601. Definitions

The new chapter 36 uses the definitions provided in 44 U.S.C. 3502, but provides eight additional definitions, including:

Sec. 3602. Office of Electronic Government

This section establishes an OMB Office of Electronic Government, to be headed by an Administrator for Electronic Government. The E-Gov Administrator's functions are to:

Sec. 3603. Chief Information Officers Council

This section establishes the CIO Council. The Council is comprised of the OMB Deputy Director for Management (DDM), the E-Gov Administrator, the OIRA Administrator, CIO's from major agencies, the CIA, the Department of Defense Service CIO's, and any other Federal employees designated by the DDM. The E-Gov Administrator is to lead the activities of the Council on behalf of the DDM who chairs the Council. GSA is to provide administrative and other support to the Council.

The CIO Council is the principal interagency IRM forum with functions to include:

Sec. 3604. E-Government Fund

This section establishes an E-Government Fund in the U.S. Treasury. GSA is to administer the Fund to support projects approved by the Director of OMB, assisted by the E-Gov Administrator, that improve the ability of the Federal Government to conduct activities electronically using the Internet and other electronic methods. Projects funded by the Fund may include efforts to make information and services more readily available to the public, make it easier for the public to conduct transactions with the Federal Government, and improve information sharing among government agencies.

The E-Gov Administrator is to establish procedures for funding, consult with interagency councils, and assist the OMB Director in coordinating agency expenditure of funds. The E-Gov Administrator is also to adhere to procedures to insure accountability, planning and review, including the OMB Director's final authority to select projects to be funded. Finally, the E-Gov Administrator is to recommend projects for funding based on criteria that include meeting needs of identified groups, ensuring security and privacy, interagency in scope, performance objectives tied to agency mission goals, as well as 12 criteria for ranking proposals that focus on innovative Government-wide applications of information technology.

No Fund money may be transferred to an agency until 15 days after GSA reports to Congress. OMB is to report annually to Congress on the Fund as part of the E-Government report required under Sec. 3606. Authorization of appropriations rises from $45 million in 2003 to $150 million in 2006, with such sums as are necessary authorized for 2007, with all appropriated funds available until expended.

Sec. 3605. Program to encourage innovative solutions to enhance electronic government services and process

This section, which is based on H.R. 4629, introduced by Representative Tom Davis on May 1, 2002, would provide for a program run by the E-Government Administrator to encourage contractor innovation by the issuance of announcements seeking innovative solutions to enhance electronic government services and processes. The program would include the formation of a multi-agency technical assistance team to screen the proposals submitted. After evaluating the proposals the team would submit them, along with the assessment, to the Administrator who would consider funding appropriate proposals under the E-Government Fund or forward them to the appropriate agency.

Sec. 3606. E-Government report

This section requires the OMB Director to submit an annual E-Government report to Congress. The report is to contain a summary of information reported by agencies (including the E-Gov Status Report required by sec. 202(g)), information about the operations of the E-Gov Fund, and a description of compliance with the Act.

SEC. 102. CONFORMING AMENDMENTS

Sec. 102(a). Electronic Government and information technologies

This subsection amends chapter 3 of title 40, U.S. Code to add a new section 305 to require GSA to consult with the OMB E-Gov office on Electronic Government and other IT initiatives.

Sec. 102(b). Modification of Deputy Director for Management Functions (DDM)

This subsection amends 31 U.S.C. 503(b), which establishes the functions of the OMB DDM, to state that the DDM chairs the CIO Council.

Sec. 102(c). Office of Electronic Government

This subsection amends 31 U.S.C. 505 to state that the E-Gov office is an office of OMB.

TITLE II--FEDERAL MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

SEC. 201. DEFINITIONS

This section states that unless otherwise provided, the title uses definitions from the Paperwork Reduction Act (44 U.S.C. 3502) and title I of the Act.

SEC. 202. FEDERAL AGENCY RESPONSIBILITIES

This section provides a variety of requirements for agencies under the Act.

Sec. 202(a). In general

This subsection requires each agency head to ensure: (1) compliance with the Act, related OMB information resource management (IRM) policies and guidance, and IT standards promulgated by the Commerce Secretary; (2) effective communication of such policies, guidance, and standards to relevant agency officials; and (3) support for OMB and GSA efforts to develop, maintain, and promote an integrated Internet-based system of delivering information and services to the public.

Sec. 202(b). Performance integration

This subsection requires agencies to: (1) develop E-Gov performance measures; (2) try to rely on existing data collections; (3) consider measuring performance in customer service, agency productivity, and use of innovative technology; (4) link their performance goals as appropriate to key groups and to `internal Federal Government operations;' and (5) try to `work collectively in linking their performance goals' to such groups and use IT to deliver information and services to those groups.

Subsection 202(c). Avoiding diminished access

This subsection requires agency heads to consider the impact of E-Gov initiatives on persons without access to the Internet, ensure that the availability of government services and information has not been diminished for such persons, and `pursue alternate modes of delivery' to make such services and information available to them. This provision is complemented by the requirement in sec. 215 for a study of disparities in access to the Internet.

Subsection 202(d). Accessibility to people with disabilities

This subsection states that agencies must comply with section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d).

Subsection 202(e). Sponsored activities

This subsection states that agencies must support the use of IT `to engage the public in the development and implementation of policies and programs.'

Subsection 202(f). Chief Information Officers (CIO)

This subsection states that agency CIO's are to participate in the CIO Council and monitor implementation of IT standards.

Subsection 202(g). E-Gov status report

This subsection states that each agency must submit an annual report to OMB on the status of implementation of E-Gov initiatives and compliance with the Act.

Subsection 202(h). Use of technology

This subsection states that nothing in the Act supersedes any agency responsibility `to use or manage information technology to deliver Government information and services that fulfill the statutory mission and programs of the agency.'

Subsection (i). National security systems

This subsection states that Title II of the Act does not apply to national security systems, as defined at 40 U.S.C. 11103, except sections 202, 203 and 214 apply to such systems `to the extent practicable and consistent with law.'

SEC. 203. COMPATIBILITY OF EXECUTIVE AGENCY METHODS FOR USE AND ACCEPTANCE OF ELECTRONIC SIGNATURES

This section supports the interoperable implementation of electronic signatures that are necessary for secure electronic transactions with Government. The section requires agencies to ensure that their methods for the use and acceptance of electronic signatures are compatible with OMB policies and procedures. The section also requires GSA to establish a framework for efficient interoperability among agencies when using electronic signatures, including digital signatures. To support this effort, the section authorizes the appropriation of $8 million in FY 2003 and such sums as necessary for each year thereafter for a Federal bridge certification authority to support interoperable use of digital signatures and for other electronic signature initiatives.

SEC. 204. FEDERAL INTERNET PORTAL

This section directs the Director of OMB to work with GSA and other agencies to `maintain and promote' an integrated Internet-based system to give the public consolidated access to Government information and services (State and local, as well as Federal) from a single point, and organized according to function rather than agency jurisdiction. The section further authorizes to be appropriated to GSA $15,000,000 for the system for fiscal year 2003 and such sums as necessary for fiscal years 2004-2007.

SEC. 205. FEDERAL COURTS

This section requires the Supreme Court, each circuit court, each district court, and each bankruptcy court of a district to establish a website for public access to current and updated information about the court and cases before the court, including electronic filings. The section does, however, permit courts to defer compliance if they notify the Administrative Office of the U.S. Courts of the reasons for the deferral. The Judicial Conference of the U.S. is to report to Congressional Committees on the deferral notifications. The section is intended to provide the public with greater access to judicial information.

SEC. 206. REGULATORY AGENCIES

This section requires Federal agencies to improve public online access to agency information. To the extent practicable, and in consultation with the Office of Management and Budget, agencies are to: (1) Include in a publicly accessible website all information required to be published in the Federal Register under the Freedom of Information Act, at 5 U.S.C. 552(a)(1) & (2); (2) Accept public rulemaking comments by electronic means; and (3) Have a public website containing electronic rulemaking dockets, including public comments and other material in the agency's rulemaking docket.

SEC. 207. ACCESSIBILITY, USABILITY, AND PRESERVATION OF GOVERNMENT INFORMATION

This section would improve the organization, preservation, and public accessibility of Government information, including information on the Internet.

First, OMB is to establish the Interagency Committee on Government Information to consult with interested parties, conduct studies, submit recommendations, and share effective practices with regard to information access, dissemination and retention. On the basis of recommendations from that committee, OMB is to issue policies on: (1) Standards for the organization and categorization of Government information in ways that are searchable electronically and are interoperable across agencies; (2) Categories of Government information to be classified under the standards; and (3) Priorities and schedules for the initial agency implementation of the standards.

Also on the basis of recommendations of the committee, the National Archives and Records Administration (NARA) is to issue policies and procedures to ensure that Federal Records Act (chapters 21, 25, 27, 29, and 31 of title 44, U.S. Code) requirements are applied to Government information on the Internet and to other electronic records.

The section requires OMB to issue guidance for agency websites with requirements for links to descriptions of an agency's organization, mission and statutory authority, as well as public information under the Freedom of Information Act (5 U.S.C. 552(a)(1) and (b)). The OMB guidance is also to include minimum goals for agencies to assist public users to navigate agency websites, e.g., search retrieval speed, data aggregation tools, and security protocols.

Agencies are to consult with the committee and the public as part of establishing a process for determining which Government information the agency intends to make available and accessible to the public on the Internet and by other means.

The section also requires the establishment of a public domain directory of public Federal Government websites that is to be developed in a collaborative effort with librarians, IT managers, records managers, and others.

The section, at subsection (g), also requires the OMB Director to work with the Office of Science and Technology Policy (OSTP) and other agencies to ensure the development and maintenance of a repository, and one or more publicly accessible websites, with detailed information about federally funded research and development (R&D). OMB is to issue guidance for the information to be put in the repository. The repository and website(s) are to include information about: (1) Federally funded R&D performed by the Federal Government and institutions and individuals outside the Federal Government; and (2) Each separate R&D task or award, including dates, summaries, objectives, researchers, funds, information restrictions, and other information.

The purpose of creating broader access to this information is to facilitate: coordination of Federal R&D, collaboration among researchers; technology transfer; and access by policymakers and the public to information about Federal R&D. The subsection would authorize to be appropriated $2 million in each of fiscal years 2003-2005.

SEC. 208. PRIVACY PROVISIONS

This section requires agencies, with OMB guidance, to conduct and review a privacy impact assessment before collecting information in an identifiable form, or developing or procuring information technology that collects, maintains, or disseminates such information. The definition of information in an `identifiable form' means information that permits the identity of the individual to whom the information applies to be reasonably inferred directly or indirectly.

This section also requires OMB to issue guidance for privacy notices on agency public websites. The notices are to address what and why information is collected, its use, with whom it will be shared, individual rights with regard to the information, and how the information will be secured. The OMB guidance is also to address translating privacy policies into standardized machine-readable formats.

SEC. 209. FEDERAL INFORMATION TECHNOLOGY WORKFORCE DEVELOPMENT

This section requires the Office of Personnel Management (OPM) in consultation with OMB, the CIO Council, and GSA, to analyze Federal IT and IRM personnel needs, oversee the development of training programs, and assess the adequacy of training for Federal employees in IT `disciplines.' In carrying out these duties, the Director of OPM may provide for a program allowing federal workers to be detailed to the private sector for training purposes, under section 3703 below.

The section at subsection (c) would also amend subpart B of part III of title 5 of the U.S. Code by adding a new chapter 37 establishing an IT exchange program. The provisions are also contained in legislation previously introduced as H.R. 3925, the Digital Tech Corps Act of 2002, which was reported by the Government Reform Committee on March 14, 2002, and passed the House of Representatives on April 10, 2002. The provisions of the new chapter 37 are as follows:

Sec. 3701. Definitions

For purposes of this chapter, the term `agency' applies only to executive branch agencies, and the term `detail' means either an assignment of an employee of a private sector company to a Federal agency, or it means an assignment of an employee of a Federal agency to a private sector company.

Sec. 3702. General provisions

a. Initiation and Eligibility provisions: The IT Exchange Program is initiated via an agreement of the agency, the private sector organization, and the employee involved. Eligible employees are those that are: (1) working in IT management; (2) considered exceptional performers; and (3) expected to assume increased IT management responsibilities in the future. Employees detailed from the Federal government must be in the GS 11-15 range and serving under career or career-conditional appointment (or the equivalent in the excepted service). Schedule C employees are prohibited from participation.

b. Written agreement required: Establishing an IT Exchange Program requires a written agreement between the agency, the employee and the private sector organization involved. This agreement must contain, at a minimum, requirements that Federal employees must return to service of the Government for a period of not less than the length of the exchange (on penalty of paying the Government back the costs of the exchange).

c. Assignment Termination: Provides that the agency or the private sector organization involved can terminate the exchange program at any time, for any reason.

d. Duration of Exchange: Provides that exchange assignments under this program will be from three months to 1 year and can be extended in 3 month increments for up to one additional year (i.e., 2 year maximum).

e. Chief Information Officers Council Participation: Provides that the CIO Council may participate in the administration of the IT Exchange Program.

f. Small Business Concerns: Requires that small business concerns be appropriately represented in the IT Exchange Program.

Sec. 3703. Assignment of employees to private sector organizations

a. Detail of a Regular Work Assignment: This clarifies that a Federal employee who agrees to participate in the IT Exchange Program remains a Federal employee while detailed to a private sector organization. Thus she or he will retain uninterrupted pay, credits for step increases, retention, sick and leave accrual, insurance, and retirement benefits. Nothing about participation in the IT Exchange Program will be detrimental to the Federal employee's career, livelihood, or benefits.

b. Coverage Under Workers Compensation and Wrongful Death: This provision specifies that while on detail, a Federal employee retains his or her coverage for purposes of injury or death while on the job. Also, so that there is no double compensation, the provision also states that if the Federal employee is similarly covered by the private sector organizations, the payment or benefit for the same injury or death will be appropriately credited.

c. Travel and Transportation Cost Reimbursements: This provision allows agencies to fund the travel and transportation costs of Federal employees participating in the IT Exchange Program. This reimbursement is subject to the same conditions as are applicable in 5 U.S.C. Sec. 3375.

d. Tort Claims Act Protection: This provision provides that a Federal employee assigned to a private sector organization under the IT Exchange Program is covered under the Federal Tort Claims Act and any other Federal tort liability statutes.

e. Small Business Concerns: Requires that agencies ensure that 20% of assignments in the IT Exchange Program are to small business concerns as defined in the Small Business Act.

Sec. 3704. Assignment of employees from private sector organizations

a. In General: This provision provides that an employee of a private sector organization assigned to an agency under this chapter is deemed to be on detail to such agency. The purpose of this section is to provide that a private sector employee's pay and benefits are to be provided by the private sector employer while on the detail. There is no cost to the government for this employee's services while detailed.

b. Terms and Conditions: An employee of a private sector organization assigned to an agency under this chapter is governed by the following four provisions.

1. The employee may receive pay from the private sector employer: This provision clarifies that a private sector employee will not be in violation of ethics statutes for receiving pay from the employee's private sector employer under the IT Exchange Program.

2. The employee is deemed a Federal government employee for purposes of Federal employee ethics and revolving door requirements, including:

3. The employee may not have access to any trade secrets or to any other nonpublic information, which is of commercial value to the private sector organization from which he is assigned.

4. The employee is subject to such regulations as the President may prescribe to govern the IT Exchange Program.

In addition, private sector employees working at Federal agencies will be under the supervision of the agency's Federal managers.

c. Private Sector Employee Covered by Workers Compensation and Wrongful Death If Not Otherwise Covered: This provision provides that if a private sector employee participating in the IT Exchange Program is not covered by a private sector company for workers compensation or wrongful death, then the Government will provide these benefits if injury or death occurs during the performance of official duties under the IT Exchange Program.

d. Prohibition on Charging Costs: This provision prevents private sector company with an employee on assignment to the IT Exchange Program from charging the costs of pay or benefits under a Federal Government contract.

Sec. 3705. Application to Office of the Chief Technology Officer of the District of Columbia

This section provides that the Tech Corps program applies to IT workers in the District of Columbia government.

Sec. 3706. Reporting requirement

This section requires OPM to do a semiannual report to congressional committees summarizing the operation of this chapter.

Sec. 3707. Regulations

This section provides that OPM is to issue regulations implementing the IT Exchange Program. It also requires that OPM prepare a report identifying all existing exchange programs and IT training opportunities for Federal employees. Also requires that the General Accounting Office (GAO) report on the IT Exchange Program established in this chapter not later than four years after enactment (program sunsets in five years). Finally the section provides for a number of technical and conforming amendments to current law, including titles 5, 18, and 31 of the U.S. Code.

SEC. 210. SHARE-IN-SAVINGS INITIATIVES

The section would amend chapter 137 of title 10, U.S. Code and title III of the Federal Property and Administrative Services Act to authorize government-wide the use of share in savings contracts for information technology. These contracts represent an innovative approach to encourage industry to share creative technology solutions with the Government. Through these contracts agencies can lower their costs and improve service delivery without large `up front' investments as the contractor provides the technology and is compensated by receiving a portion of savings achieved. The section is based upon a provision contained in the Services Acquisition Reform Act of 2002, H.R. 3832.

The section would authorize agencies to enter into share-in-savings contracts for information technology for a term of 5 years, and with the appropriate approval for up to 10 years, to pay contractors from the savings realized, and to retain those savings that exceed the amount paid to the contractor. The section would permit agencies to use various options for funding cancellation or termination costs and would permit the cancellation or termination amount to be negotiated by the parties. The section would require that contracts awarded pursuant to this section include a provision containing a quantifiable baseline for savings that is approved by the agency's senior procurement executive. Currently, agencies subject to title 10 of the U.S. Code would be permitted to enter into an aggregate of up to 5 contracts each during fiscal years 2003, 2004, and 2005 where funds are only available for the first fiscal year of the contract and certain conditions met. The same number would be authorized for the same period for agencies under title 41 of the U.S. Code. The number of such contracts authorized would increase to an aggregate of ten for agencies under each title starting in 2006. Further, the section would require that the Federal Acquisition Regulation (FAR) be revised to implement this section and to provide for such matters as the use of competitive procedures and innovative provisions for technology refreshment, appropriate regulatory flexibility to facilitate the use of such contracts. Further, GSA is to provide additional guidance to agencies in identifying additional opportunities for the use of these contracts and for determining baselines and saving share ratios. Finally, the section would require the Director of OMB to report to Congress two years after enactment describing the number of share-in savings contracts entered into and making recommendations for changes in law needed to encourage their use and the GAO would review the OMB report. The provisions would sunset in September 2009.

SEC. 211. AUTHORIZATION FOR ACQUISITION OF INFORMATION TECHNOLOGY BY STATE AND LOCAL GOVERNMENTS THROUGH FEDERAL SUPPLY SCHEDULES

The section would amend section 502 of title 40 of the U.S. Code to give the GSA Administrator the authority to provide for the use by State or local governments of the Federal Supply Schedules of the GSA for automated data processing equipment, software, support equipment and services, and other items contained in Federal supply classification group 70. The section would further provide that participation by a Federal Supply Schedule contractor in a sale to a State or local government would be voluntary. Not later than December 31, 2004, the Administrator is to report on the implementation and effects of the new provision.

SEC. 212. INTEGRATED REPORTING STUDY AND PILOT PROJECTS

This section would enhance the interoperability of Federal information systems; reduce information collection burdens and assure accuracy of submitted information; and enable individuals to integrate and obtain similar bodies of agency information.

The section requires the OMB to report to Congress within 3 years on progress toward integrating Federal information systems across agencies. The report is to address:

To assist in the study, OMB is designating up to 5 pilot projects to integrate data elements in order to reduce information collection burdens by eliminating duplicative data, create interoperability among public databases, and use software to reduce errors.

SEC. 213. COMMUNITY TECHNOLOGY CENTERS

This section requires a study by the E-Gov. Administrator of best practices of Federally funded community technology centers, how to enhance their development, and how to improve sharing of information and resources. The E-Gov. Administrator in consultation with the Secretary of Education is to work with other agencies to assist in the implementation of the study's recommendations. The E-Gov. Administrator in consultation with the Secretary of Education is also to develop an online tutorial to explain how to access Government information and services on the Internet.

SEC. 214. ENHANCING CRISIS MANAGEMENT THROUGH ADVANCED INFORMATION TECHNOLOGY

This section provides for a 2-year study to be performed by a contractor and overseen by the E-Gov. Administrator in consultation with the Federal Emergency Management Agency (FEMA), to develop a research and implementation strategy for the use of IT in disaster preparedness, response, and recovery. Based on the results of the study, the E-Gov. Administrator in consultation with FEMA is to initiate pilot projects or report to Congress on other activities to maximize the use of IT in disaster management.

SEC. 215. DISPARITIES IN ACCESS TO THE INTERNET

This section provides for a 2-year study to be requested by GSA and conducted by a contractor selected by the National Academy of Sciences on disparities in Internet access for online government services. The study is to include recommendations for ensuring that online government initiatives do not have the `unintended result of increasing any deficiency in public access to Government services.'

TITLE III--INFORMATION SECURITY

Title III contains six sections:

SEC. 301. INFORMATION SECURITY

Subsection (a) states that this title may be cited as the `Federal Information Security Management Act of 2002' (FISMA), reflecting its origins in H.R. 3844, of the same name.

Subsection (b) amends subchapter II of chapter 35 of title 44, U.S. Code, to include the following provisions.

Sec. 3531. Purposes

The provision provides that the purposes of this subchapter are to:

Sec. 3532. Definitions

The definition for the term `information security' covers the protection of both information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. This definition addresses the three objectives of information integrity, confidentiality, and availability. These three concepts are the widely accepted key organizing principles for information security and encompass concepts such as non-repudiation and authenticity. Including the three objectives reflects the importance of recognizing that information security not only involves keeping secrets (confidentiality), but also depends on protecting the ability to use and rely on information and information systems (integrity and availability).

This section's definition of `national security system' encompasses the longstanding statutory treatment of military and intelligence mission-related systems and classified systems. This definition replaces Government Information Security Reform Act's (GISRA) introduction of the term `mission critical system.' It restores reliance on: (1) `Warner Amendment' national security systems, most recently reenacted into law in section 5142 of the Clinger-Cohen Act of 1996, at 40 U.S.C. 11103(a); and (2) the Computer Security Act's treatment of systems protected by procedures for information authorized to be kept secret in the interest of national defense or foreign policy, at 15 U.S.C. 278g-3. The provision uses `classified' instead of `secret' to reflect the use of the term in recent Executive Orders on information classification.

This section's definition of `information technology' references the current definition of the term in the Clinger-Cohen Act, at 40 U.S.C. 11101(6).

Sec. 3533. Authority and functions of the Director

This section states that OMB is to oversee agency information security policies and practices, including through:

The purpose of these provisions is to clarify and streamline OMB's statutory requirements in comparison with those under GISRA. The new section eliminates unnecessary and redundant language and harmonizes the provisions with current law in the Paperwork Reduction Act and the Clinger-Cohen Act. It also strengthens OMB's role in several respects, for example, heightening its responsibility to ensure agency compliance with information system and security standards.

This section also clarifies the scope of the law with regard to the treatment of national security systems. At Sec. 3533(b), it provides that OMB's authorities under this section do not apply to national security systems except for oversight of agency compliance under subsection (a)(4), and reporting to Congress under subsection (a)(8). The purpose of this provision is to recognize OMB's continuing oversight and reporting responsibilities, while also recognizing that information security for national security systems is to be provided under standards and guidelines as required by law and as directed by the President for national security systems. Neither NIST nor OMB will establish requirements for those systems. This mandate is reiterated in the statement of general agency responsibilities, at 3534(a)(1)(B), and in a separate section specifically on agency responsibilities for national security systems, at 3537. This approach is consistent with that of Executive Order No. 13231 (October 16, 2001).

Sec. 3534. Federal agency responsibilities

This section details Federal agency information security responsibilities:

This section maintains the key requirements in GISRA for agencies to establish agency-wide information security programs. FISMA goes on, however, to revise the GISRA provisions in this section to streamline provisions and more clearly specify key agency requirements.

First, Sec. 3534(a)(1)(B), provides that agencies must comply with NIST-developed information security standards, as well as applicable national security system standards. This provision bases agency information security programs in compliance with standards, as well as in individual agency risk management. Historically, Federal information security system standards have not been mandatory. Agencies will be responsible for compliance with all applicable standards--for national security as well as non-national security systems. While standards development and oversight is divided between NIST and OMB for non-national security systems and the Department of Defense (including roles for the Director of Central Intelligence and the National Security Agency) for national security systems, it remains the obligation of every agency to comply with applicable requirements to provide adequate security for information and information systems supporting the agency's operations and assets, whether they involve non-national security or national security systems. While some agencies may have only one or the other, others have both national security and non-national security systems. The key to information security for those agencies is to have an agency-wide information security program that can address both national security and non-national security system security needs, including compliance with applicable standards.

Third, Sec. 3534(a)(3) describes the information security responsibilities of each agency CIO. This expands the same subsection in GISRA to include a more detailed requirement for the designation of a senior agency information security officer. Under this provision, this official is to: (1) carry out the CIO's responsibilities under the Act; (2) possess appropriate professional qualifications; (3) have information security as his or her primary duty; and (4) head an information security office with the mission and resources needed to help ensure agency compliance with the Act. GAO has found that an information security best practice is the establishment of a central management focal point to ensure adequate attention to information security. This provision will help agencies implement this practice.

Fourth, Sec. 3534(b) requires each agency to `document' its agency-wide security program, and prepare `subordinate plans' as needed for networks, facilities, and systems, at 3534(b)(3). These provisions replace GISRA's alternating use of `program' and `plan,' as well as the Computer Security Act's exclusive reliance on individual system security plans, repealed at sec. 305(a). These provisions are meant to ensure that each agency's information security program will represent an agency-wide management process that is adequately documented at appropriate component and agency-wide levels.

Fifth, Sec. 3534(b)(5) strengthens GISRA by providing more precise management testing and evaluation requirements. Each agency information security program must include periodic testing and evaluation of the effectiveness of policies, procedures, and practices, to be performed. depending on risk, but at least annually. This requirement is part of the ongoing obligation of systems owners and managers to maintain a current understanding of the security status of their systems and the steps needed to address security weaknesses.

This requirement is not intended to mean the degree of testing and evaluation associated with formal certification and accreditation (C & A) processes, although timely C & A testing, as well as other relevant tests and evaluations, can be used to satisfy this requirement. Rather, it reflects the need for program officials and systems owners to maintain an understanding of the effectiveness of the security controls for programs and systems over which they have responsibility. Overall, this provision underscores the need for periodic control checks as a matter of ongoing management responsibility. Particularly given the rapid pace of emerging threats and vulnerabilities, waiting as much as three years for a formal C & A will not provide an adequate assurance that appropriate controls are in place and operating as intended.

Finally, Sec. 3534 refines a number of GISRA provisions with regards to agency information security responsibilities:

Sec. 3535. Annual independent evaluation

This section requires that each agency have performed an annual independent evaluation of its information security program and practices by either its Inspector General or an independent external auditor. The evaluation is to be submitted to the OMB Director, who is to summarize the results in the annual report to Congress on compliance with the subchapter.

This section continues the GISRA requirement for an annual independent evaluation at 44 U.S.C. 3535. Several changes are made to the provisions of the section for the sake of clarity. For example, Sec. 3535(a)(2)(A) is revised by substituting `representative' for `appropriate.' An evaluation should involve the examination of a sample of systems and procedures. Such a sample should be representative of the whole. The word `appropriate' does not express that concept. The word `representative' also better reflects the Committee's view that the evaluations are meant to provide an overview of each agency's information security program and practices, rather than an exhaustive review of every system and procedure.

The section is revised to clarify procedures for evaluating national security systems within the context of the agency-wide evaluation. These revisions address the confusion created when GISRA established separate procedures for the evaluation of national security systems and left unexplained the relation of those evaluations to the agency-wide evaluation. Because most agencies with national security systems also have non-national security systems, agency-wide evaluations must take into account both categories of systems.

To achieve this goal of a more reasoned approach to the evaluation of agency-wide information security, including national security systems, this section provides that:

Given these FISMA provisions relating to the evaluation of national security systems, the Committee would eliminate the GISRA requirement for audits of evaluations of national security systems at 44 U.S.C. 3535(b)(1)(A), (c)(2), and (d)(2). The Committee believes the GISRA audit of evaluations requirement is unnecessary and unduly complicated.

Finally, Sec. 3535(h) requires periodic GAO evaluation of agency information security policies and practices. This is a new subsection and is meant to ensure that GAO continues to perform its valuable service in assisting Congress in the oversight of Federal information security.

Sec. 3536. Federal information security incident center

This section directs OMB to ensure the operation of a central Federal information security incident center. The Committee recognizes the current successful operation of GSA's incident center, FedCIRC. The purpose of the requirement in this section is to provide a permanent authorization for a center such as FedCIRC, and to insure that its activities are broadly conceived and faithfully carried out consistent with the mandate in this section. Under subsection (a), the center's mission is to: (1) Provide timely technical assistance to agencies and other operators of Federal information systems; (2) Compile and analyze information security incident information; Inform agencies about information security threats and vulnerabilities; and (3) Consult with national security agencies and other appropriate agencies, e.g., an infrastructure protection office.

The section, at Sec. 3536(b), provides that agencies responsible for national security systems are to share information about information security incidents with the center to the extent consistent with national security system standards and guidelines. This provision is intended to encourage inter-agency communication and consultation, while preserving national security agency discretion to determine appropriate information sharing.

Sec. 3537. National security systems

This section states that agencies operating or controlling national security systems must: Provide information security protections commensurate with the risk and magnitude of harm for information maintained in such systems; Implement all applicable national security system standards and guidelines; and Comply with the requirements of the subchapter.

The purpose of the section is to make clear that agencies must manage national security systems consistent with applicable national security requirements (independent of OMB or NIST-developed guidance for other systems), but that they must also secure those systems with the same risk-based management approach and the same commitment to agency accountability applicable to all Federal agencies, most notably the requirements at 3534 and Sec. 3535.

Sec. 3538. Authorization of appropriations

This section authorizes such sums as may be necessary to carry out the provisions of the subchapter for five years. This limited authorization will help ensure periodic congressional oversight, without limiting the effectiveness of the law, as was accomplished by GISRA's two-year sunset, currently at 44 U.S.C. 3536.

Sec. 3539. Effect on existing law

This section provides that nothing in this subchapter or those provisions of law relating to the development and promulgation of NIST-developed standards may be construed as affecting current authorities regarding the use or disclosure of information, including under the Privacy Act, Freedom of Information Act, the Federal Records Act, the Paperwork Reduction Act, or disclosure of information to the General Accounting Office.

SEC. 301(C). INFORMATION SECURITY RESPONSIBILITIES OF CERTAIN AGENCIES

This subsection states that nothing in this subchapter supersedes any authority of the Secretary of Defense, the Director of Central Intelligence, or other agency head, as authorized by law and as directed by the President, with regard to the operation, control, or management of national security systems. This subsection, at paragraph (B), also amends several provisions of law to clarify and harmonize language with the subchapter. Further, this subsection provides (in the same terms as in GISRA) that nothing in the subchapter supersedes any requirement made by or under the Atomic Energy Act of 1954. Finally, this subsection revises section 1062 of GISRA to eliminate unnecessary statutory language and rely instead on current guidance in OMB Circular A-130, and to simplify the treatment of national security systems.

SEC. 302. MANAGEMENT OF INFORMATION TECHNOLOGY

This section amends 40 U.S.C. 11331 (sec. 5131 of the Clinger-Cohen Act) to:

The purpose of this section is to strengthen the process for the promulgation of information security standards.

The section, at subparagraph (a)(1)(A), requires OMB to issue Federal information security standards developed by NIST under section 20(a)(3) of the NIST Act. This responsibility is limited by paragraph (a)(2), which states the standards and guidelines for national security systems are to be developed, promulgated, enforced, and overseen as otherwise authorized by law and as directed by the President. Thus, this section continues the principle in law since the enactment of the Computer Security Act of 1987, namely that NIST is to develop standards for all Federal systems, other than national security systems.

Under subparagraph (a)(1)(B), OMB must make these standards compulsory to the extent they: (1) Provide minimum mandatory requirements as determined under the NIST Act; or (2) Otherwise are necessary for information security. This requirement for the issuance of minimum mandatory standards is the counterpart to FISMA's other requirements for NIST to develop minimum mandatory standards, and for agency compliance with, and OMB oversight of, such standards (see discussion of sec. 303, below, and 44 U.S.C. 3533 & 3534, above).

Paragraph (a)(3) preserves the provision in current law (at 40 U.S.C. 11331(c)) permitting agencies to use more stringent standards than provided by NIST-developed standards, but only if those more stringent standards incorporate applicable mandatory NIST requirements and are otherwise consistent with the risk management policies and guidelines issued by OMB under 44 U.S.C. 3533. This provision is consistent with the principle that NIST-developed standards are generally intended to provide minimum guidance. The requirements are to be geared to risk levels and would have minimum requirements by such risk levels.

These FISMA provisions permitting the use of more stringent standards should be distinguished from requirements in GISRA to develop `more stringent' policies for national security systems (GISRA, sec. 1062(b)), and to make such policies available to other agencies (GISRA, sec. 1062(f)). The FISMA provisions permit the use of more stringent requirements and envision building more stringent protections on top of minimum requirements, depending on the nature of information security risks. GISRA, on the other hand, mandates the use of requirements for defense systems that provide more stringent protection than that otherwise provided under GISRA (GISRA, sec. 1062(b)). This approach imposes an arbitrary and illogical ceiling on the law's own risk management principles, and could lead to unnecessarily inconsistent approaches to information security.

FISMA eliminates the current provision at 40 U.S.C. 11331(d) permitting waivers of standards. Agencies currently operate under a blanket delegation of waiver authority from the Secretary of Commerce (Memorandum to the Heads of Executive Departments and Agencies, Secretary of Commerce, November 14, 1988). The Committee believes it is inconsistent with the purpose of developing standards needed for information security to provide such a broad waiver under the argument that compliance with the standards would have an adverse impact on the mission of the agency. The fundamental purpose of FISMA is to require each agency to employ information security policies and practices in order to manage risks to the agency's operations and assets. FISMA's equally fundamental presumption is that the Federal government must have a consistent information security approach across all agencies. FISMA's standards are intended to provide that consistent approach, while meeting the mission-specific needs of each agency. Accordingly, the Committee believes that a strengthened process is needed to focus on developing and implementing workable mandatory standards.

Subsection (b) provides a similarly revised standards promulgation process for the Secretary of Commerce, with regard to systems standards, developed by NIST under section 20(a)(2) of the NIST Act. Again, this process is currently found at 40 U.S.C. 11331.

SEC. 303. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

This section revises section 20 of the National Institute of Standards and Technology (NIST) Act (15 U.S.C. 278g-3), originally enacted as part of the Computer Security Act of 1987, to update the mission of NIST in light of current understandings of information security and related provisions in FISMA.

Subsection (a) maintains NIST's three-part standards mission of developing standards and guidelines for information systems, for Federal information systems, and for Federal information security. However, it updates original Computer Security Act language to focus on information systems and information security, and otherwise conform to the definitions provided in FISMA.

Subsection (b) establishes new requirements for NIST-developed standards to include: (1) Standards for categorizing the criticality and sensitivity of agency information according to information security control objectives and across a range of risk levels, and (2) Minimum information security requirements for each information category. The subsection also would have NIST develop guidance, in coordination with NSA, for identifying national security systems. This guidance is not to govern such systems, but rather to ensure that agencies receive consistent guidance on the identification of systems that should be governed by national security system requirements. NIST is required to develop this guidance in coordination with NSA to ensure consistency with national security system requirements.

Subsection (c) requires NIST to consult with other agencies to improve security and avoid duplication of effort, and to ensure that NIST standards are complementary with national security system requirements. This provision maintains the basic consultation requirements of the Computer Security Act at 15 U.S.C. 278g-3(b)(5) and (c), while revising the language for clarity and consistency with other FISMA terms and requirements. For example, it strikes the reference to achieving consistency `to the maximum extent possible' with national security system requirements, and substitutes a requirement that the NIST-developed standards should be `complementary with standards and guidelines' for national security systems. The use of the term `consistency' has proven unsatisfactory, as it has raised arguments that these standards might be `inconsistent' and, conversely, that `consistency' might require identical requirements. The Committee believes that `complementary' is a formulation that helps communicate the importance of the Federal government having requirements that can meet the needs of different agencies and programs while fitting together in a coordinated manner to provide government-wide information security.

This subsection also provides for the submission of NIST-developed information security standards to OMB for promulgation; deadlines for the developing standards and guidelines; and mandates to avoid prescriptive technology-specific requirements, provide for flexibility to permit alternative solutions to information security problems, and ensure the use of performance-based standards to the greatest extent possible.

Subsection 303(c)(5) emphasizes that open, transparent standards activities undertaken by NIST, such as the development and publication of the Advanced Encryption Standard, promote flexibility by permitting alternative hardware and software solutions to provide equivalent levels of protection and enable vendors to offer a variety of solutions to meet customer needs. By contrast, when standards development has not been open and the resulting NIST standard is not published and flexibly implementable, the standard has failed to gain broad acceptance and use. The Clipper Chip is an example of this failed effort.

Subsection (d), strengthens NIST's organizational attention and commitment to information security by establishing a NIST Office for Information Security Programs.

Subsection (e) strengthens other current NIST responsibilities relating to standards development, technical assistance, research, and evaluation. First, NIST is to submit standards to OMB along with recommendations as to the extent to which they should be made mandatory. Second, NIST is to provide assistance to agencies with regard to compliance with standards and guidelines, detecting and handling security incidents, and information security policies and procedures. Third, NIST is to conduct research, as needed, into information security matters. Fourth, NIST is to develop and periodically revise information security performance indicators and measures. Fifth, NIST is to evaluate private sector information security policies and practices and assess their potential application in government. Sixth, NIST is to evaluate national security policies and practices and assess their potential application to other agencies. Seventh, NIST is to periodically assess the effectiveness of its standards and guidelines, and undertake revisions as appropriate. Eighth, NIST is to solicit and consider its advisory board's recommendations with regards to proposed NIST standards and guidelines. Ninth, NIST is to prepare an annual public report on its activities.

Finally, subsection (f) revises Computer Security definitions to conform to the definitions in 44 U.S.C. 3532, as amended by FISMA.

SEC. 304. INFORMATION SECURITY AND PRIVACY ADVISORY BOARD

This section revises section 21 of the NIST Act (15 U.S.C. 278g-4) regarding the Computer System Security and Privacy Advisory Board. The subchapter strengthens the board and updates its name and mission to ensure that it has sufficient independence and resources to consider information security issues and provide useful advice to NIST.

At Sec. 278g-4(a), FISMA changes the board's name from the Computer System Security and Privacy Advisory Board (CSSPAB) to the Information Security and Privacy Advisory Board, consistent with general use of the term `information security.'

At Sec. 278g-4(b)(2), FISMA strengthens the role of the board by mandating that it provide advice not only to NIST in developing standards, but also to OMB, which is to promulgate the NIST-developed standards.

At Sec. 278g-4(b)(3), FISMA strengthens the role of the board by requiring that it prepare an annual report. For a number of years the CSSPAB produced annual reports that reflect the board's consideration of important security issues. In more recent years, the board did not produce such reports. The Committee believes Federal information security could be assisted by the preparation and dissemination of these reports.

At Sec. 278g-4(f), FISMA strengthens the board by authorizing it to hold its meetings where and when it chooses. To function as an effective advisory board, it would be useful for the board to be able to hold meetings in locations easily accessible by expert witnesses and interested Federal employees as well as members of the public.

At Sec. 278g-4(h), FISMA revises Computer Security Act definitions consistent with its other definitional changes.

SEC. 305. TECHNICAL AND CONFORMING AMENDMENTS

Sec. 305(a) repeals sections 5 and 6 of the Computer Security Act of 1987, at 40 U.S.C. 11332(b) and (c). These sections are superseded by the new legislation. Section 5 of the Computer Security Act covers computer system security training. These provisions are unnecessary given FISMA's training provisions at Sec. 3534(a)(3)(D) & (4), (b)(4), and (d)(1)(B). Section 6 of the Computer Security Act requires the identification of systems containing sensitive information and the development of systems security plans. This section is unnecessary given the overall scheme and specific requirements for agency risk-based management of information and information systems supporting agency operations and assets. With regard to the other substantive provisions of the Computer Security Act, FISMA, at sec. 302, amends section 4 (section 5131 of the Clinger-Cohen Act, at 40 U.S.C. 11331), and, at sec. 303 and 304, amends section 3 (sections 20 & 21 of the NIST Act, 15 U.S.C. 278g-3 & 4).

Sec. 305(b) repeals sec. 1062 of Pub. L. 106-398, the section of the Government Information Security Reform (GISRA) provisions of the 2001 Defense Authorization Act, not directly superseded by FISMA, which is intended to represent a complete substitute revision of GISRA. FISMA, sec. 301(b)(1), supersedes GISRA, sec. 1061; FISMA, sec. 301(c)(1)(B), supersedes GISRA, sec. 1063; FISMA, sec. 301(c)(2), supersedes GISRA, sec. 1062(g); FISMA, sec. 301(b)(2), supersedes GISRA, sec. 1064; and FISMA, sec. 402, supersedes GISRA, sec. 1065. Accordingly, FISMA, sec. 305(b), repeals the remaining provisions in GISRA, sec. 1062.

The establishment of specific information security requirements for OMB and Federal agencies by FISMA obviates the need for several provisions in the Paperwork Reduction Act (PRA), which describe general information security mandates. Accordingly, FISMA, at sec. 305(c), amends the PRA to strike duplicative language and otherwise update references to refer to FISMA. Further, at sec. 305(c)(2), FISMA amends the PRA to establish a requirement for a regular inventory of major information systems to support information security and broader information resources management decision-making.

SEC. 306. CONSTRUCTION

This section provides that nothing in the subchapter affects the authority of NIST or the Department of Commerce concerning the development and promulgation of information standards or guidelines under paragraphs (1) and (2) of section 20(a) of the NIST Act. This is to ensure that the transfer of authority to promulgate information security standards from Commerce to OMB not affect or otherwise interfere with the continuing responsibility of NIST and Commerce with regard to other information system standards.

TITLE IV--AUTHORIZATION OF APPROPRIATIONS AND EFFECTIVE DATES

SEC. 401. AUTHORIZATION OF APPROPRIATIONS

The section authorizes such sums as are necessary to carry out titles I and II for fiscal years 2003 through 2007, except where authorization is specifically provided in those titles.

SEC. 402. EFFECTIVE DATES

The section provides that titles I and II and their amendments are to be effective 120 days after enactment, except sections 207, 216, and 217, which are to be effective on the date of enactment. The section further provides that title III and IV shall take effect on the date of enactment.

TITLE V--CONFIDENTIAL INFORMATION PROTECTION AND STATISTICAL EFFICIENCY

SEC. 501. SHORT TITLE

The section provides that this title may be cited as the `Confidential Information Protection and Statistical Efficiency Act of 2002.'

SEC. 502. DEFINITIONS

This section contains definitions of nine terms including; `agent,' `identifiable form,' `business data,' `statistical activities,' `statistical purpose, and nonstatistical purpose'.

SEC. 503. COORDINATION AND OVERSIGHT OF POLICIES

The section specifies that the Director of OMB shall coordinate and oversee the confidentiality and information sharing policies and rules established by the various agencies under this title. Among other required reports, each designated statistical agency is required to report to the Director of OMB and to the House Committee on Government Reform and the Senate Committee on Governmental Affairs on actions taken under subtitle B of this title.

SEC. 504. EFFECT ON OTHER LAWS

The section provides that this title does not affect other laws, including Bureau of Census provisions providing for limited disclosures of business statistical information. Also specifies that State laws on the confidentiality of data are not preempted and that statistical information may be disclosed to a law enforcement agency for prosecutions for the submission of false statistical information.

SUBTITLE A--CONFIDENTIAL INFORMATION PROTECTION

SEC. 511. FINDINGS AND PURPOSES

The section lists five findings including: that protecting the confidentiality interests of individuals or organizations who provide information for federal statistical programs serves both the interests of the public and the needs of society and that ensuring that information provided for statistical purposes receives protection is essential in continuing public cooperation in statistical programs. The section further lists the proposes for the title which include ensuring that information supplied to an agency for statistical purposes under a pledge of confidentiality is used only for statistical purposes and to safeguarding individually identifiable information acquired under a confidentiality pledge by controlling access to and uses made of such information.

SEC. 512. LIMITATIONS ON USE AND DISCLOSURE OF DATA AND INFORMATION

The section would protect information submitted to all agencies under a pledge of confidentiality and for statistical purposes and sets strict rules for the confidentiality of the data provided. It prohibits disclosure of the data or information in an identifiable form for any use other than a statistical one except with the informed consent of the person or organization providing the information. Such disclosure is only authorized when approved by an agency head and it is not otherwise prohibited by law.

SEC. 513. FINES AND PENALTIES

The section provides felony criminal penalties (up to 5 years in jail and a maximum $250,000 fine) for any knowing and willful disclosures by an agency officer, employee, or agent of information acquired exclusively for statistical purposes in violation of this title.

SUBTITLE B--STATISTICAL EFFICIENCY

SEC. 521. FINDINGS AND PURPOSES

The section lists six findings including: that federal statistics are an important source of information for public and private decision makers, the quality of federal statistics depends on the willingness of businesses to respond to surveys, and enhanced sharing of business data among the Bureau of the Census, the Bureau of Economic Analysis, and the Bureau of Labor Statistics for exclusively statistical purposes will improve their ability to track more accurately the changing nature of U.S. business. The section further provides that the purposes of this subtitle include authorizing the sharing of business data among the Bureaus of Census, Economic Analysis, and Labor Statistics for only statistical purposes, to reduce paperwork burdens on businesses that provide information to the Government, and to improve the comparability and accuracy of Federal economic statistics

SEC. 522. DESIGNATION OF STATISTICAL AGENCIES

This section designates that the U.S. Census Bureau, the U.S. Bureau of Labor Statistics and the U.S. Bureau of Economic Analysis as statistical agencies for the purposes of this subtitle.

SEC. 523. RESPONSIBILITIES OF DESIGNATED STATISTICAL AGENCIES

The section provides that the head of each of the three statistical agencies is to identify opportunities to eliminate duplication in the collection and reporting of statistical business data, enter into joint projects to improve the quality and reduce costs, protect the confidentiality of individually identifiable information by, among other things, emphasizing to employees and agents the importance of protecting the confidentiality of identifiable information, and implementing appropriate measures to assure security.

SEC. 524. SHARING OF BUSINESS DATA AMONG DESIGNATED STATISTICAL AGENCIES

This section would allow that the U.S. Census Bureau, the U.S. Bureau of Labor Statistics and the U.S. Bureau of Economic Analysis to enter into a written agreement to provide business data in an identifiable form in their possession to each other and specifies that any information sharing will be accorded all of the confidentiality provisions of subtitle A and other existing laws. The written agreement must specify: (1) the business data to be shared; (2) the statistical purpose for which it can be used; (3) who in each agency can examine the data; and (4) appropriate security procedures to safeguard the confidentiality of the business data.

SEC. 525. LIMITATIONS ON USE OF BUSINESS DATA PROVIDED BY STATISTICAL AGENCIES

The section provides that any shared business data under this subtitle shall be used exclusively for statistical purposes and that any publication of business data shall occur only in a form where the data is not personally identifiable.

SEC. 526. CONFORMING AMENDMENTS

The section provides for amendments to current law, including adding a new section 402 to chapter 10 of title 13 of the U.S. Code allowing the Census Bureau to provide business data to the Bureaus of Economic Analysis and Labor Statistics.

U.S. Congress,

Congressional Budget Office,

Washington, DC, November 14, 2002.

Hon. DAN BURTON,
Chairman, Committee on Government Reform,
House of Representatives, Washington, DC.

DEAR MR. CHAIRMAN: The Congressional Budget Office has prepared the enclosed cost estimate for H.R. 2458, the E-Government Act of 2002.

If you wish further details on this estimate, we will be pleased to provide them. The CBO staff contact is Matthew Pickford.

Sincerely,

Dan L. Crippen,

Director.

Enclosure.

CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

H.R. 2458--E-Government Act of 2002

Summary: H.R. 2458 would authorize appropriations for programs to improve the coordination and deployment of information technology, as well as improve electronic access to government information and services. The bill would:

Assuming appropriation of the necessary amounts, we estimate that implementing H.R. 2458 would cost about $60 million in 2003 and about $600 million over the 2003-2007 period. That spending could be partially offset by savings of up to $10 million a year after a two- or three-year implementation period, assuming that appropriations for the Census Bureau and BLS are reduced accordingly. We also estimate that enacting the bill would increase direct spending by $7 million over the 2003-2007 period and $22 million over the 2003-2012 period. That spending would be for the estimated cost of unfunded termination liability of SIS contracts authorized by the bill. CBO estimates that the provisions regarding civil and criminal penalties would have no significant effect on revenues.

H.R. 2458 contains no intergovernmental or private-sector mandates as defined in the Unfunded Mandates Reform Act (UMRA) and would impose no costs on state, local, or tribal governments. Provisions of title II would benefit the District of Columbia by authorizing employees of the Office of the Chief Technology Officer to be assigned to a private-sector organization or an employee of such organization to be assigned to the office. Other provisions of title II could benefit state and local governments by authorizing the General Services Administration to allow them access to certain federal purchasing schedules.

Estimated cost to the Federal Government: As shown in the following table, CBO estimates that implementing H.R. 2458 would cost about $570 million over the 2003-2007 period, subject to appropriation of the necessary amounts, as well as $8 million in new direct spending over the same period. The costs of this legislation fall within budget functions 370 (commerce and housing credit), 500 (education, training, employment, and social services), and 800 (general government).


----------------------------------------------------------------------------------------------------------
                                             By fiscal year, in millions of dollars--                     
                                                                                 2003 2004 2005 2006 2007 
----------------------------------------------------------------------------------------------------------
CHANGES IN SPENDING SUBJECT TO APPROPRIATION                                                              
Specified Authorization Level                                                     100   74  122  170   20 
Estimated Outlays                                                                  59   57   76  112   20 
Electronic Government Programs:                                                                           
Estimated Authorization Level                                                       3   31   34   36  191 
Estimated Outlays                                                                   2   32   34   36  165 
BLS and Census Savings:                                                                                   
Estimated Authorization Level                                                       0    0  -10  -10  -10 
Estimated Outlays                                                                   0    0  -10  -10  -10 
Total Estimated Authorization Level                                               103  105  146  196  201 
Total Estimated Outlays                                                            61   89  100  138  175 
CHANGES IN DIRECT SPENDING                                                                                
Estimated Budget Authority                                                      ( 1 )    1    1    2    3 
Estimated Outlays                                                               ( 1 )    1    1    2    3 
----------------------------------------------------------------------------------------------------------

Basis of estimate: For this estimate, we assume that the necessary amounts will be provided each year and that spending will follow historical patterns for similar activities. CBO estimates that H.R. 2458 would authorize the appropriation of approximately $750 million over the 2003-2007 period for managing and promoting electronic government services and processes. This estimate assumes that funding would be adjusted for anticipated inflation.

Specific authorizations

The bill would authorize the appropriation of $486 million over the 2003-2007 period for the following activities:

Estimated authorizations

The authorizations specified in H.R. 2458 would cover different time periods. For example, some are only for fiscal year 2003, but others extend for four or five years. In addition to these specified authorizations, H.R. 2458 also would authorize such sums as necessary during the next five years to fund electronic government programs. These include operating the E-Government Fund; maintaining and promoting the federal Internet portal; developing electronic signatures; developing and maintaining databases and websites for federally funded research; and supporting information technology training, research, reports, and education. CBO estimates that continuing the activities authorized by the bill would require the appropriation of $295 million over the 2003-2007 period, assuming adjustments for anticipated inflation.

Savings

The use of electronic information systems to collect information form the public and to provide government services could reduce administrative costs at federal agencies; however, CBO has no basis for estimating any such savings over the next few years.

CBO also expects that allowing the Census Bureau and BLS to share business data could generate cost savings for the two agencies. Under current law, statistical agencies cannot exchange such data, and therefore sometimes collect duplicative information. For example, the Census Bureau and BLS together typically spend about $150 million a year to collect and process data for their own independent lists of business establishments. Under H.R. 5215, these agencies could create one master list and potentially reduce total data collection and maintenance costs. Based on information from the two agencies, OMB and the General Accounting Office, CBO estimates that, after an implementation period of two or three years, the Census Bureau and BLS could achieve savings of up to $10 million annually, assuming that appropriations for the two agencies are reduced accordingly.

Direct spending and revenues

H.R. 2458 would authorize federal agencies to use SIS contracts for the purchase of information technology consultants and hardware through September 2009. The bill would allow up to five contracts per year in fiscal years 2003 through 2005 and up to 10 contracts per year in fiscal year 2006 through 2009.

A SIS contract can be used to procure products and services without an up-front payment. Payment for such goods and services would be made from any operational savings or increased collections generated from the contract. In addition, H.R. 2458 would allow agencies to enter into SIS contracts without funds available for the termination cost of the contract. The bill would limit the amount of such unfunded termination liability to $5 million per contract (or 25 percent of the termination costs, whichever is less).

For this estimate, we assume that the new authority provided by the bill will be fully used. Based on information from GSA about the current use of SIS contracts, CBO estimates that 10 percent of the SIS contracts authorized by H.R. 2458 would be terminated before completion. Assuming that SIS contracts have an average duration of five years and that the maximum termination liability could be incurred in any year, we estimate this provision would cost $7 million over the 2003-2007 period and $22 over the 2003-2012 period.

Intergovernmental and private-sector impact: H.R. 2458 contains no intergovernmental or private-sector mandates as defined in UMRA and would impose no costs on state, local, or tribal governments. Provisions of title II would benefit the District of Columbia by authorizing employees of the Office of the Chief Technology Officer to be assigned to a private-sector organization or an employee of such organization to be assigned to the office. Other provisions of title II could benefit state and local governments by authorizing the General Services Administration to allow them access to certain federal purchasing schedules.

Previous CBO estimate: On June 7, 2002, CBO transmitted a cost estimate for S. 803, the E-Government Act of 2002, as ordered reported by the Senate Committee on Governmental Affairs on March 21, 2002. These pieces of legislation are very similar, however, the House bill would authorize the appropriation of about $100 million more than S. 803. In addition, the House bill would authorize SIS contracts, and S. 803 would not.

Title V of H.R. 2458, concerning sharing business data among federal statistical agencies, is identical to H.R. 5215, as ordered reported by the House Committee on Government Reform on October 9, 2002, for which CBO transmitted a cost estimate on November 8, 2002. The estimated budgetary effects of those provisions are the same.

Estimate prepared by: Census and BLS: Ken Johnson and Christina Hawley Sadoti; Other Federal Costs: Matthew Pickford; Impact on State, Local, and Tribal Governments: Susan Sieg Tompkins; and Impact on the Private Sector: Paige Piper/Bach.

Estimated approved by: Peter H. Fontaine, Deputy Assistant Director for Budget Analysis.

CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

TITLE 44, UNITED STATES CODE

PUBLIC PRINTING AND DOCUMENTS

Chap. Sec.
1. Joint Committee on Printing
101
* * * * * * *
36. Management and Promotion of Electronic Government Services
3601

* * * * * * *

CHAPTER 35--COORDINATION OF FEDERAL INFORMATION POLICY

SUBCHAPTER I--FEDERAL INFORMATION POLICY
Sec.
3501. Purposes.
* * * * * * *
SUBCHAPTER II--INFORMATION SECURITY
Sec.
[Struck out->][ 3531. Purposes. ][<-Struck out]
[Struck out->][ 3532. Definitions. ][<-Struck out]
[Struck out->][ 3533. Authority and functions of the Director. ][<-Struck out]
[Struck out->][ 3534. Federal agency responsibilities. ][<-Struck out]
[Struck out->][ 3535. Annual independent evaluation. ][<-Struck out]
[Struck out->][ 3536. Expiration. ][<-Struck out]
3531. Purposes.
3532. Definitions.
3533. Authority and functions of the Director.
3534. Federal agency responsibilities.
3535. Annual independent evaluation.
3536. Federal information security incident center.
3537. National security systems.
3538. Authorization of appropriations.
3539. Effect on existing law.

SUBCHAPTER I--FEDERAL INFORMATION POLICY

* * * * * * *

Sec. 3504. Authority and functions of Director

* * * * * * *

* * * * * * *

Sec. 3505. Assignment of tasks and deadlines

* * * * * * *

Sec. 3506. Federal agency responsibilities

* * * * * * *

* * * * * * *

[Struck out->][ SUBCHAPTER II--INFORMATION SECURITY ][<-Struck out]

[Struck out->][ Sec. 3531. Purposes ][<-Struck out]

[Struck out->][ Sec. 3532. Definitions ][<-Struck out]

[Struck out->][ Sec. 3533. Authority and functions of the Director ][<-Struck out]

[Struck out->][ Sec. 3534. Federal agency responsibilities ][<-Struck out]

[Struck out->][ Sec. 3535. Annual independent evaluation ][<-Struck out]

[Struck out->][ Sec. 3536. Expiration ][<-Struck out]

SUBCHAPTER II--INFORMATION SECURITY

Sec. 3531. Purposes

Sec. 3532. Definitions

Sec. 3533. Authority and functions of the Director

Sec. 3534. Federal agency responsibilities

Sec. 3535. Annual independent evaluation

Sec. 3536. Federal information security incident center

Sec. 3537. National security systems

Sec. 3538. Authorization of appropriations

Sec. 3539. Effect on existing law

CHAPTER 36--MANAGEMENT AND PROMOTION OF ELECTRONIC GOVERNMENT SERVICES

Sec.
3601. Definitions.
3602. Office of Electronic Government.
3603. Chief Information Officers Council.
3604. E-Government Fund.
3605. Program to encourage innovative solutions to enhance electronic Government services and processes.
3606. E-Government report.

Sec. 3601. Definitions

Sec. 3602. Office of Electronic Government

Sec. 3603. Chief Information Officers Council

Sec. 3604. E-Government Fund

Sec. 3605. Program to encourage innovative solutions to enhance electronic Government services and processes

Sec. 3606. E-Government report

* * * * * * *

-

TITLE 40, UNITED STATES CODE

* * * * * * *

SUBTITLE I--FEDERAL PROPERTY AND ADMINISTRATIVE SERVICES

* * * * * * *

CHAPTER 3--ORGANIZATION OF GENERAL SERVICES ADMINISTRATION

SUBCHAPTER I--GENERAL
Sec.
301. Establishment.
* * * * * * *
305. Electronic Government and information technologies.

* * * * * * *

SUBCHAPTER I--GENERAL

* * * * * * *

Sec. 305. Electronic Government and information technologies

* * * * * * *

CHAPTER 5--PROPERTY MANAGEMENT

* * * * * * *

SUBCHAPTER I--PROCUREMENT AND WAREHOUSING

Sec. 502. Services for other entities

* * * * * * *

* * * * * * *

SUBTITLE III--INFORMATION TECHNOLOGY MANAGEMENT

* * * * * * *

CHAPTER 113--RESPONSIBILITY FOR ACQUISITIONS OF INFORMATION TECHNOLOGY

SUBCHAPTER I--DIRECTOR OF OFFICE OF MANAGEMENT AND BUDGET
Sec.
11301. Responsibility of Director.
* * * * * * *
SUBCHAPTER III--OTHER RESPONSIBILITIES
[Struck out->][ 11331. Responsibilities regarding efficiency, security, and privacy of federal computer systems. ][<-Struck out]
11331. Responsibilities for Federal information systems standards.
* * * * * * *

SUBCHAPTER III--OTHER RESPONSIBILITIES

[Struck out->][ Sec. 11331. Responsibilities regarding efficiency, security, and privacy of federal computer systems ][<-Struck out]

Sec. 11331. Responsibilities for federal information systems standards

Sec. 11332. Federal computer system security training and plan

* * * * * * *

-

TITLE 31, UNITED STATES CODE

* * * * * * *

SUBTITLE I--GENERAL

* * * * * * *

CHAPTER 5--OFFICE OF MANAGEMENT AND BUDGET

SUBCHAPTER I--ORGANIZATION
Sec.
501. Office of Management and Budget.
* * * * * * *
507. Office of Electronic Government.
* * * * * * *

SUBCHAPTER I--ORGANIZATION

* * * * * * *

Sec. 503. Functions of Deputy Director for Management

* * * * * * *

* * * * * * *

* * * * * * *

Sec. 507. Office of Electronic Government

* * * * * * *

-

TITLE 5, UNITED STATES CODE

* * * * * * *

PART III--EMPLOYEES

SUBPART A--GENERAL PROVISIONS

Chap. Sec.
21.
Definitions
2101
* * * * * * *
37.
Information Technology Exchange Program
3701
* * * * * * *

Subpart B--Employment and Retention

CHAPTER 31--AUTHORITY FOR EMPLOYMENT

* * * * * * *

SUBCHAPTER I--EMPLOYMENT AUTHORITIES

* * * * * * *

Sec. 3111. Acceptance of volunteer service

* * * * * * *

* * * * * * *

CHAPTER 37--INFORMATION TECHNOLOGY EXCHANGE PROGRAM

Sec.
3701. Definitions.
3702. General provisions.
3703. Assignment of employees to private sector organizations.
3704. Assignment of employees from private sector organizations.
3705. Application to Office of the Chief Technology Officer of the District of Columbia.
3706. Reporting requirement.
3707. Regulations.

Sec. 3701. Definitions

Sec. 3702. General provisions

Sec. 3703. Assignment of employees to private sector organizations

Sec. 3704. Assignment of employees from private sector organizations

Sec. 3705. Application to Office of the Chief Technology Officer of the District of Columbia

Sec. 3706. Reporting requirement

Sec. 3707. Regulations

Subpart C--Employee Performance

CHAPTER 41--TRAINING

* * * * * * *

Sec. 4108. Employee agreements; service after training

* * * * * * *

* * * * * * *

Subpart F--Labor-Management and Employee Relations

* * * * * * *

CHAPTER 73--SUITABILITY, SECURITY, AND CONDUCT

* * * * * * *

SUBCHAPTER V--MISCONDUCT

* * * * * * *

Sec. 7353. Gifts to Federal employees

* * * * * * *

* * * * * * *

-

SECTION 303 OF THE JUDICIARY APPROPRIATIONS ACT, 1992

* * * * * * *

-

TITLE 18, UNITED STATES CODE

* * * * * * *

PART I--CRIMES

* * * * * * *

CHAPTER 11--BRIBERY, GRAFT, AND CONFLICTS OF INTEREST

* * * * * * *

Sec. 207. Restrictions on former officers, employees, and elected officials of the executive and legislative branches

* * * * * * *

* * * * * * *

* * * * * * *

* * * * * * *

Sec. 209. Salary of Government officials and employees payable only by United States

* * * * * * *

* * * * * * *

CHAPTER 93--PUBLIC OFFICERS AND EMPLOYEES

* * * * * * *

Sec. 1905. Disclosure of confidential information generally

* * * * * * *

-

SECTION 27 OF THE OFFICE OF FEDERAL PROCUREMENT POLICY ACT

SEC. 27. RESTRICTIONS ON DISCLOSING AND OBTAINING CONTRACTOR BID OR PROPOSAL INFORMATION OR SOURCE SELECTION INFORMATION.

* * * * * * *

-

THE ACT OF JANUARY 8, 1988

(Public Law 100-238)

AN ACT making technical corrections relating to the Federal Employees' Retirement System, and for other purposes.

SEC. 125. ELIGIBILITY OF CERTAIN INDIVIDUALS TO PARTICIPATE IN THE THRIFT SAVINGS PLAN.

* * * * * * *

* * * * * * *

-

TITLE 10, UNITED STATES CODE

* * * * * * *

Subtitle A--General Military Law

* * * * * * *

PART IV--SERVICE, SUPPLY, AND PROCUREMENT

* * * * * * *

CHAPTER 131--PLANNING AND COORDINATION

* * * * * * *

Sec. 2224. Defense Information Assurance Program

* * * * * * *

CHAPTER 137--PROCUREMENT GENERALLY

Sec.
2302. Definitions.
* * * * * * *
2332. Share-in-savings contracts.

* * * * * * *

Sec. 2332. Share-in-savings contracts

* * * * * * *

-

FEDERAL PROPERTY AND ADMINISTRATIVE SERVICES ACT OF 1949

* * * * * * *

TITLE III--PROCUREMENT PROCEDURE

* * * * * * *

SEC. 317. SHARE-IN-SAVINGS CONTRACTS.

* * * * * * *

-

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY ACT

* * * * * * *

* * * * * * *

* * * * * * *

-

SECTION 1062 OF THE FLOYD D. SPENCE NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2001

[Struck out->][ SEC. 1062. RESPONSIBILITIES OF CERTAIN AGENCIES. ][<-Struck out]

-

ACT OF JANUARY 27, 1938

AN ACT to make confidential certain information furnished to the Bureau of Foreign and Domestic Commerce, and for other purposes.

* * * * * * *

-

CHAPTER 10 OF TITLE 13, UNITED STATES CODE

CHAPTER 10--EXCHANGE OF CENSUS INFORMATION

Sec.
401. Exchange of census information with Bureau of Economic Analysis.
402. Providing business data to Designated Statistical Agencies.

* * * * * * *

Sec. 402. Providing business data to Designated Statistical Agencies



This Report:     Printer Friendly: HTML  |  PDF
1 of 1