015 - Appendix 4 Executive Order 13718

Speaker 1: Section fourteen of Report on Securing and Growing the Digital Economy. This is a LibriVox recording. All LibriVox recordings are in the public domain. For more information or to volunteer, please visit LibriVox dot org. Recording by Colleen McMahon. Report on Securing and Growing the Digital Economy by the Commission on Enhancing National Cybersecurity. Appendix four Executive Order one three seven one eight. This appendix provides the text of Executive Order one three seven one eight, Commission on Enhancing National Cybersecurity, February ninth, twenty sixteen. The text is also available at https colan slash slash www dot Federal Register dot gov slash Executive hyphen Order slash one three seven one eight, By the authority vested in May as President, by the Constitution and the Laws of the United States of America, and in order to enhance cybersecurity awareness and protections at all levels of government, business, and society, to protect privacy, to ensure public safety, and economic and national security, and to empower Americans to take better control of their digital security. It is hereby ordered as follows. Section one. Establishment there is established within the Department of Commerce, the Commission on Enhancing National Cybersecurity Commission. Section two Membership A. The Commission shall be composed of not more than twelve members appointed by the President. The members of the Commission may include those with knowledge about or experience in cybersecurity, the digital economy, national security and law enforcement, corporate governance, risk management, information technology, IT, privacy, identity management, internet governance and standards, government administration, digital and social media communications, or any other area determined by the President to be of value to the Commission. The Speaker of the House of Representatives, the Minority Leader of the House of Representatives, the Majority Leader of the Senate, and the Minority Leader of the Senate are each invited to recommend one individual for membership on the Commission. No federally registered lobbyists or person presently otherwise employed by the federal government may serve on the Commission. B. The President shall designate one member of the Commission to serve as the Chair and one member of the Commission to serve as the vice Chair. Section three. Mission and Work. The Commission will make detailed recommendations to strengthen cybersecurity in both the public and private sectors, while protecting privacy, insuring public safety, and economic and national security, fostering discovery and development of new technical solutions, and bolstering partnerships between federal, state, and local government and the private sector in the development, promotion, and use of cybersecurity technologies, policies and best practices. The Commission's recommendations should address actions that can be taken over the next decade to accomplish these goals. A In developing its recommendations, the Commission shall identify and study actions necessary to further improve cybersecurity awareness, risk management, and adoption of best practices throughout the private sector and at all levels of government. These areas of study may include methods to influence the way individuals and organizations perceive and use technology and approach cybersecurity as consumers and providers in the digital economy, Demonstrate the nature and severity of cybersecurity threats, the importance of mitigation, and potential ways to manage and reduce the economic impacts of cyber risk, improve access to the knowledge needed to make informed cyber risk management decisions related to privacy, economic impact, and business continuity. And develop partnerships with industry, civil society, and international stakeholders. At a minimum, the Commission shall develop recommendations regarding one how best to bolster the protection of systems and data, including how to advance identity management, authentication, and cybersecurity of online identities in light of technological developments and other trends. Two ensuring that cybersecurity is a core element of the technologies associated with the Internet of Things and cloud computing, and that the policy and legal foundation for cybersecurity in the context of the Internet of Things is stable and adaptable. Three further investments in research and development initiatives that can enhance cybersecurity. Four increasing the quality, quantity, and level of expertise of the cybersecurity workforce in the federal government and private sector, including through EDGBA location and training. Five Improving broad based education of common sense cybersecurity practices for the general public. And six any other issues that the President, through the Secretary of Commerce Secretary requests the Commission to consider. B In developing its recommendations, the Commission shall also identify and study advances in technology management and IT service delivery that should be developed, widely adopted, or further tested throughout the private sector and at all levels of government, and in particular in the federal government, and by critical infrastructure owners and operators. These areas of study may include cybersecurity technologies and other advances that are responsive to the rapidly evolving digital economy, and approaches to accelerating the introduction and use of emerging methods designed to enhance early detection, mitigation, and management of cyber risk in the security and privacy and business and governance sectors. At a minimum, the Commission shall develop recommendations regarding one governance, procurement and management processes for federal civilian IT systems, applications, services, and infrastructure, including the following A framework for identifying which IT services should be developed internally or shared across agencies, and for specific investment priorities for all such IT services. B A framework to ensure that as federal civilian agencies procure, modernize, or upgrade their IT systems, cybersecurity is incorporated into the process. C A governance model for managing cybersecurity risk, enhancing resilience and ensuring appropriate incident response and recovery in the operations of and delivery of goods and services by the federal government. And D Strategies to overcome by barriers that make it difficult for the federal government to adopt and keep pace with industry best practices. Two Effective private sector and government approaches to critical infrastructure protection a light of current and projected trends in cybersecurity threats and the connected nature of the United States economy. Three Steps states and local governments can take to enhance cybersecurity, and how the federal government can best support such steps, and for any other issues that the President, through the Secretary, requests the Commission to consider. See To accomplish its mission, the Commission shall one reference and as appropriate, build on successful existing cybersecurity policies, public private partnerships, and other initiatives. Two Consult with cybersecurity, national security and law enforcement, privacy management, technology, and digital economy experts in the public and private sectors. Three seek input from those who have experienced significant cybersecurity incidents to understand lessons learned from these experiences, including identifying any barriers to awareness, risk management, and investment. Four review reported information from the Office of Management and Budget regarding federal information and information systems, including legacy systems, in order to assess critical federal civilian IT infrastructures, governance and management processes. Five review the impact of technological trends and market forces on existing cybersecurity policies and practices. And six examine other issues related to the Commission's mission that the Chair and Vice Chair agree are necessary and appropriate to the Commission's work. D. Where appropriate, the Commission may conduct original research, commission studies, and hold hearings to further examine particular issues. E. The Commission shall be advisory in nature and shall submit a final report to the President by December one, twenty sixteen. This report shall be published on a public website, along with any appropriate response from the President, within forty five days after it is provided to the President. Section four Administration A. The Commission shall hold periodic meetings in public forums in an open and transparent environment. B. In carrying out its mission, the Commission shall be informed by and shall strive to avoid duplicating the efforts of other governmental entities. C. The Commission shall have a staff, headed by an Executive Director, which shall provide support for the functions of the Commission. The Secretary shall appoint the Executive Director, who shall be a full time federal employee, and the Commission's staff. The Executive Director may also serve as the designated Federal Officer. In accordance with the Federal Advisory Committee Act, as amended five us c. App FACA. The Act D, the Executive Director, in consultation with the Chair and Vice Chair, shall have the authority to create subcommittees as necessary to support the Commission's work and to examine particular areas of importance. These subcommittees must report their work to the Commission to inform its final recommendations. E. The Secretary will work with the heads of Executive Departments and agencies, to the extent permitted by law and consistent with their ongoing activities, to provide the Commission such information and cooperation as it may require for purposes of carrying out its mission. Section five Termination The Commission shall terminate within fifteen days after it presents its final report to the President, unless extended by the President. Section six General Provisions. A. To the extent permitted by law and subject to the availability of appropriations, the Secretary shall direct the Director of the National Institute of Standards and Technology to provide the Commission with such expertise, services, funds, facilities, staff, equipment, and other support services as may be necessary to carry out its mission. B. Insofar as FACA may apply to the Commission. Any functions of the President under that Act, except for those in Section six and Section fourteen of that Act, shall be performed by the Secretary c Members of the Commission shall serve without any compensation for their work on the Commission, but shall be allowed travel expenses, including per diem in lieu of subsistence, to the extent permitted by law for persons serving intermittently in the government service. Five USC. Fifty seven one through fifty seven O seven D. Nothing in this Order shall be construed to impair or otherwise effect one the authority granted by law to a department, agency or the head thereof, or two the functions of the Director of the Office of Management and Budget relating to budgetary, administrative, or legislative proposals. E. This Order is not intended to, and does not create, any right or benefit, substantive or procedural, enforceable at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. The White House, February ninth, twenty sixteen, end of Section fourteen. Recording by Colleen McMahon