	Summary

To summarize, the Director of OMB is authorized to oversee the development of, and ensure compliance with, policies, principles, standards and guidelines governing the security of all federal computer systems, except for national security computer systems. Introduction

This report provides a short summary of selected federal laws, executive orders, and presidential directives, currently in force, that govern computer security. In general, the federal government does not regulate the security of non-government computer systems (other than those used by contractors for the federal government). However, the federal government does require certain information held on non-government systems to be protected against unauthorized access and disclosure. Another role the federal government plays in computer systems security is to investigate and prosecute federal computer crimes. The federal government also offers assistance to state and local law enforcement entities in their investigation and prosecution of computer activities made illegal at the state level. 104-106 , Division E), the Federal Information Security Act of 2002 ( P.L. FISMA authorizes the National Institute of Standards and Technology (NIST) to develop security standards and guidelines for systems used by the federal government. It authorizes the Secretary of Commerce to choose which of these standards and guidelines to promulgate. The roles and responsibilities for securing national security systems are outlined in National Security Directive 42 (NSD-42) , signed July 5, 1990 by President George H. W. Bush. NSD-42 establishes the National Security Telecommunications and Information Systems Security Committee, now called the Committee on National Security Systems (CNSS). Among the authorities granted the National Manager are: examine U.S. Government national security systems and evaluate their vulnerability to foreign interception and exploitation; conduct, approve, or endorse research and development of security techniques and equipment; review and approve all security related standards, techniques, systems, and equipment for national security systems; assess the overall security posture of and disseminate information on threats to and vulnerabilities of national security systems; operate a central technical center to evaluate and certify national security systems; prescribe minimum standards, methods, and procedures for protecting national security systems; annually review and assess the national security systems programs and budgets of department and agencies, individually and in the aggregate, and recommend alternatives to the Executive Agent; and, enter into agreements for the procurement of technical security materials and equipment and their provision to executive departments and agencies, and when appropriate, to government contractors and foreign governments. To date, this includes financial information and medical information. There is also a federal requirement that certain firms that register with the Security and Exchange Commission (SEC) must include in the financial reports an assessment of their internal financial controls. Title V of the Gramm-Leach-Bliley Act ( P.L. The Health Insurance Portability and Accountability Act of 1996 , ( P.L. Besides these privacy-oriented rules, the Sarbanes-Oxley Act of 2002 ( P.L. 63, the Bush Administration's Homeland Security Presidential Directive No. Research and Development and Developing Information Security Expertise

The federal government has a number of programs aimed at developing computer security expertise. While inheriting the NCS and its responsibilities in the area of the NCS and telecommunications, the primary role of the Department of Homeland Security is to work with the private sector, state and local governments, and the public to protect the nation's information infrastructure (i.e. Issues

However, at least three issues have arisen concerning these roles and responsibilities: 1) the role the federal government in regulating the nation's privately owned and operated critical information infrastructure; 2) the relative roles of the Department of Homeland Security and the National Security Agency in setting policy and standards for computer and telecommunication systems handling critical infrastructure information; and, 3) the relative roles of the National Cyber Security Division and the National Communication System in setting policy and standards for dealing with the private sector.
This report provides a short summary of selected federal laws, executive orders, and presidential directives, currently in force, that govern computer security. The report focuses on the major roles and responsibilities assigned various federal agencies in the area of computer security. This report will not be updated.
One major area of federal activity in computer security deals with securing federal computer systems. The roles and responsibilities for securing federal computer systems are split between national security systems and all other federal systems. The Federal Information Security Management Act of 2002 authorizes the Director of the Office and Management and Budget to oversee the development of, and compliance with, security standards and guidelines, developed by the National Institute of Standards and Technology and promulgated by the Secretary of Commerce. These authorities, however, do not apply to computer systems considered to be national security systems. The roles and responsibilities for securing national security systems are established by National Security Directive 42 (NSD-42). NSD-42 establishes what is now called the Committee on National Security Systems, which it authorizes to develop, and require compliance with, standards and guidelines for national security systems.
In general, the federal government does not regulate the security of non-government computer systems. However, the federal government does require certain information held on non-government systems to be protected against unauthorized access and disclosure, primarily out of privacy considerations. To date, this has been limited to financial information (Gramm-Leach-Bliley Act) and medical information (Health Insurance Portability and Accountability Act of 1996). A number of regulatory agencies have authority for developing and enforcing standards for financial information. The Secretary of Health and Human Services has authority to develop and enforce standards for medical information. The Sarbanes-Oxley Act of 2002 requires certain companies to certify the accuracy of their internal financial controls. The Security Exchange Commission has authority to develop standards and enforce these regulations.
Although it currently has a limited role in securing the nation's overall information infrastructure, the federal government does, through the Department of Homeland Security, work with and encourage the private sector, state and local government, academia, and the general public to protect the nation's information infrastructure. This role is authorized in a generic sense for all critical infrastructure by the Homeland Security Act of 2002. It is also reinforced more specifically in Homeland Security Presidential Directive No. 7 and the National Strategy for Securing Cyberspace. To date, these activities are voluntary for non-federal entities.
Other roles established for the federal government include: investigation and prosecution of federal computer crimes; assisting state and local law enforcement entities in their investigation and prosecutions; and, developing the nation's expertise in information security.