Bill Would Force Federal Agencies To Toughen CybersecurityBill Would Force Federal Agencies To Toughen Cybersecurity

Legislation to require federal agencies to account for cybersecurity when conducting information systems planning and acquisition was introduced Tuesday by two House leaders on federal government IT policy. The bill, HR 4570, also grants the White House Office of Management and Budget greater authority to guide agencies on IT security issues.

The legislation updates the Clinger-Cohen Act, which requires the heads of federal agencies to link IT investments to agency accomplishments and establish a process to select, manage, and control their IT investments.

"Cyberattackers specifically target the federal government because of the high value of penetrating or taking over government systems," co-sponsor Rep. Adam Putnam, R.-Fla., said in a statement introducing the bill. "A myriad of automated attack tools are operating around the clock scanning the Internet for systems that can be taken over. I am very concerned that we may not be giving adequate consideration to security."

Putnam chairs the Technology, Information Policy, Intergovernmental Relations, and Census Subcommittee of the House Government Reform Committee, which provides oversight on federal government IT policy. He contends the Clinger-Cohen Act, formally known as the Information Technology Management Reform Act of 1996, was written before the federal government had a large Web presence. "It is essential that Clinger-Cohen be modernized to keep pace with these changing threats," he said.

Rep. Tom Davis, R.-Va., who chairs the House Government Reform Committee, pointed out that a high degree of interconnectivity exists between internal and external information systems, which exposes the federal government's computer networks to benign and malicious disruptions. In addition, he said, an agency's operational efficiency relies heavily on the productive use of technology. The bill, if enacted, would ensure that every federal IT system is managed in a way that minimizes the security risks. "In terms of security," said Davis, a co-sponsor of the bill, "it's not how much money you spend, but how you spend it that counts."