1. Remarks by the President, “On Securing Our Nation’s Cyber Infrastructure,” May 29, 2009. https://obamawhitehouse.archives.gov/the-press-office/remarks-president-securing-our-nations-cyber-infrastructure (accessed May 16, 2020).
2. Committee on Oversight and Government Reform, “Federal Information Security: Current Challenges and Future Policy Considerations,” March 24, 2010. http://www.gpo.gov/fdsys/pkg/CHRG-111hhrg65549/html/CHRG-111hhrg65549.htm (accessed May 16, 2020).
3. U.S. Government Accountability Office, “Federal Information Security: Agencies and OMB Need to Strengthen Policies and Practices,” July 2019. https://www.gao.gov/assets/710/700588.pdf (accessed May 16, 2020).
4. Computer Security Act of 1987, P.L. 100-235, 101 Stat. 1724.
5. Federal Information Security Management Act, Title III of the E-Government Act of 2002, P.L. 107-347, 116 Stat. 2899, 2946 (Dec. 17, 2002).
6. The Federal Information Security Modernization Act of 2014 (Pub. L. No. 113-283, Dec. 18, 2014) largely superseded the Federal Information Security Management Act of 2002 (FISMA 2002), enacted as Title III, E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899, 2946 (Dec. 17, 2002).
7. Secretary of Defense Leon E. Panetta, “Remarks by Secretary Panetta on Cybersecurity to the Business Executives for National Security, New York City” (New York, NY: Oct. 11, 2012). Available at: http://www.gao.gov/assets/660/652170.pdf (accessed May 16, 2020).
8. Time, “Here’s What We Know So Far About Russia’s 2016 Meddling,” April 18, 2019. https://time.com/5565991/russia-influence-2016-election/ (accessed May 16, 2020).
9. BBC News, “Ukraine Power Cut Was Cyber Attack,” January 11, 2017. https://www.bbc.com/news/technology-38573074 (accessed May 16, 2020).
10. The New York Times, “The World Once Laughed at North Korean Cyberpower. No More,” October 15, 2017. https://www.nytimes.com/2017/10/15/world/asia/north-korea-hacking-cyber-sony.html (accessed May 16, 2020).
11. U.S. Code Vol. 44, sec. 3551.
12. Statista, “Proposed Budget of the U.S. Government for Cyber Security in FY 2017 to 2021,” February 2020. https://www.statista.com/statistics/675399/us-government-spending-cyber-security/ (accessed May 16, 2020).
13. U.S. Code Vol. 44, sec. 3552(b)(3).
14. U.S. Code Vol. 44, sec. 3544.
15. U.S. Code Vol. 44, sec. 3554(b)(5).
16. U.S. Code Vol. 15, sec. 278g-3.
17. U.S. Code Vol. 44, sec. 3554(a)(3).
18. U.S. Code Vol. 44, sec. 3554(c).
19. U.S. Code Vol. 44, sec. 3554(b)(3)(A)(ii).
20. Inspector General Act of 1978, U.S. Code Vol. 5 app, sec. 1.
21. Inspector General Act of 1978, U.S. Code Vol. 5 app, sec. 2.
22. U.S. Code Vol. 44, sec. 3554(c)(1)(B).
23. U.S. Office of Management and Budget, “OMB Circular A-130, Managing Information as a Strategic Resource, Section 5(f),” July 28, 2016. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/A130/a130revised.pdf (accessed May 16, 2020).
24. Committee on Oversight and Government Reform, “Federal Information Security: Current Challenges and Future Policy Considerations,” March 24, 2010. http://www.gpo.gov/fdsys/pkg/CHRG-111hhrg65549/html/CHRG-111hhrg65549.htm (accessed May 16, 2020).
25. U.S. Code Vol. 44, sec. 3555.
26. National Institute of Standards and Technology, “Procedures for Developing FIPS (Federal Information Processing Standards) Publications,” May 21, 2018. https://www.nist.gov/itl/procedures-developing-fips-federal-information-processing-standards-publications (accessed May 16, 2020).
27. U.S. Office of Management and Budget, “Federal Cloud Computing Strategy,” Undated. https://cloud.cio.gov/strategy/ (accessed May 16, 2020).
28. Federal Risk and Authorization Management Program, “FedRAMP Security Assessment Framework,” November 15, 2017. https://www.fedramp.gov/assets/resources/documents/FedRAMP_Security_Assessment_Framework.pdf (accessed May 16, 2020).
29. National Institute of Standards and Technology, “SP 800-37, Revision 1, Risk Management Framework for Information Systems and Organizations,” December 2018. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf (accessed May 16, 2020).
30. National Institute of Standards and Technology, “FIPS Pub 199, Standards for Security Categorization of Federal Information and Information Systems,” February 2004. https://csrc.nist.gov/publications/detail/fips/199/final (accessed May 16, 2020).
31. National Institute of Standards and Technology, “FIPS Pub 200, Minimum Security Requirements for Federal Information and Information Systems,” March 2006. https://csrc.nist.gov/publications/detail/fips/200/final (accessed May 16, 2020).
32. National Institute of Standards and Technology, “SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations,” April 2013. https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final (accessed May 16, 2020).
33. National Institute of Standards and Technology, “SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII),” April 2010. https://csrc.nist.gov/publications/detail/sp/800-122/final (accessed May 16, 2020).
34. National Institute of Standards and Technology, “SP 800-53A, Assessing Security and Privacy Controls in Federal Information Systems and Organizations: Building Effective Assessment Plans,” December 2014. https://csrc.nist.gov/publications/detail/sp/800-53a/rev-4/final (accessed May 16, 2020).
35. U.S. Code Vol. 44, sec. 3556.
36. U.S. Government Accountability Office, “Federal Information Security: Agencies and OMB Need to Strengthen Policies and Practices,” July 2019. https://www.gao.gov/assets/710/700588.pdf (accessed May 16, 2020).
37. U.S. Code Vol. 44, sec. 3552(b)(2).
38. U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency, “US-CERT Federal Incident Notification Guidelines,” 2017. https://www.us-cert.gov/incident-notification-guidelines (accessed May 16, 2020).
39. U.S. Code Vol. 44, sec. 3552(b)(6)(A).
40. Committee of National Security Systems, “Policy No. 22, Cybersecurity Risk Management,” August 2016. http://www.cnss.gov/cnss/issuances/Policies.cfm (accessed May 16, 2020).
41. Office of Management and Budget, “Fiscal Year (FY) 2018 Annual Report to Congress,” August 2019. https://www.whitehouse.gov/wp-content/uploads/2019/08/FISMA-2018-Report-FINAL-to-post.pdf (accessed May 16, 2020).
42. Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896, codified at U.S. Code Vol. 5, sec. 552a.
43. E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899, codified in scattered sections throughout U.S. Code Vol. 44 (various sections) (2012).
44. U.S. Code Vol. 5, sec. 552a(a)(4).
45. U.S. Code Vol. 5, sec. 552a(b).
46. U.S. Code Vol. 5, sec. 552a(d).
47. U.S. Code Vol. 5, sec. 552a(e)(10).
48. U.S. Code Vol. 5, sec. 552a(e).
49. U.S. Code Vol. 5, sec. 552a(g)(4)(A).
50. U.S. Code Vol. 5, sec. 552a(i).
51. U.S. Office of Management and Budget, “Memo M-03-22: OMB Guidance for Implementing the Privacy Protections of the E-Government Act of 2002,” September 26, 2003. https://obamawhitehouse.archives.gov/omb/memoranda_m03-22/ (accessed May 16, 2020).
52. E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899, sec. 208.
53. E-Government Act of 2002, Pub. L. No. 107-347, 116 Stat. 2899, sec. 208.
54. U.S. Office of Management and Budget, “OMB Memorandum M-17-12, Preparing for and Responding to a Breach of Personally Identifiable Information,” January 3, 2017. https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2017/m-17-12_0.pdf (accessed May 16, 2020).
55. International Traffic in Arms Regulations, Code of Federal Regulations, Title 22, sec. 120-130.
56. U.S. Department of Justice, “Summary of Major U.S. Export Enforcement, Economic Espionage, and Sanctions Related to Criminal Cases,” January 2018. https://www.pmddtc.state.gov/sys_attachment.do?sysparm_referring_url=tear_off&view=true&sys_id=6ae22ec1db2a9740c53a7d321f9619c4 (accessed May 16, 2020).
57. International Traffic in Arms Regulations, Code of Federal Regulations, Title 22, sec. 121.1.
58. International Traffic in Arms Regulations, Code of Federal Regulations, Title 22, sec. 128.
59. U.S. Code Vol. 22, sec. 2778(c).
60. Export Administration Regulations, Code of Federal Regulations, Title 15, sec. 730-774.
61. U.S. Department of Commerce, “Statistics of 2018 BIS License Authorization,” April 3, 2019. https://www.bis.doc.gov/index.php/documents/technology-evaluation/ote-data-portal/licensing-analysis/2453-2018-statistical-analysis-of-bis-licensing-pdf-1/file (accessed May 16, 2020).
62. U.S. Code Vol. 22, sec. 2370.
63. Export Administration Regulations, Code of Federal Regulations, Title 15, sec. 730-774.
64. U.S. Code Vol. 50, sec. 4801-4852.
65. U.S. House of Representatives, Committee Oversight and Government Reform, “The OPM Data Breach: How the Government Jeopardized Our National Security for More Than a Generation,” September 7, 2016. https://republicans-oversight.house.gov/wp-content/uploads/2016/09/The-OPM-Data-Breach-How-the-Government-Jeopardized-Our-National-Security-for-More-than-a-Generation.pdf (accessed May 16, 2020).