; (6) a plan for improving the information security of agency information and agency information systems, including improving security control assessments and role-based security training of employees; and (7) submission by NASA to Congress of information regarding high risk projects and cybersecurity risks. (d) Congressional oversight The Administrator shall submit to the appropriate committees of Congress the strategic plan under subsection (a) and any updates thereto. 813. Cybersecurity (a) Finding Congress finds that the security of NASA information and information systems is vital to the success of the mission of the agency. (b) Information security plan (1) In general Not later than 1 year after the date of enactment of this Act, the Administrator shall implement the information security plan developed under paragraph (2) and take such further actions as the Administrator considers necessary to improve the information security system in accordance with this section. (2) Information security plan Subject to paragraphs (3) and (4), the Administrator shall develop an agency-wide information security plan to enhance information security for NASA information and information infrastructure. (3) Requirements In developing the plan under paragraph (2), the Administrator shall ensure that the plan— (A) reflects the unique nature of NASA's mission and expertise; (B) is informed by policies, standards, guidelines, and directives on information security required for Federal agencies; (C) is consistent with the standards and guidelines under section 11331 of title 40, United States Code; and (D) meets applicable National Institute of Standards and Technology information security standards and guidelines. (4) Contents The plan shall address— (A) an overview of the requirements of the information security system; (B) an agency-wide risk management framework for information security