National Aeronautics and Space Administration

There is established the National Aeronautics and Space Administration. The Administration shall be headed by an Administrator, who shall be appointed from civilian life by the President by and with the advice and consent of the Senate. Under the supervision and direction of the President, the Administrator shall be responsible for the exercise of all powers and the discharge of all duties of the Administration and shall have authority and control over all personnel and activities thereof. There shall be in the Administration a Deputy Administrator, who shall be appointed from civilian life by the President by and with the advice and consent of the Senate. The Deputy Administrator shall perform such duties and exercise such powers as the Administrator may prescribe. The Deputy Administrator shall act for, and exercise the powers of, the Administrator during the Administrator’s absence or disability. The Administrator and the Deputy Administrator shall not engage in any other business, vocation, or employment while serving as such. ensure the NASA Chief Information Officer, Mission Directorates, and Centers have appropriate roles in the management, governance, and oversight processes related to information technology operations and investments and information security programs for the protection of NASA systems; ensure the NASA Chief Information Officer has the appropriate resources and insight to oversee NASA information technology and information security operations and investments; provide an information technology program management framework to increase the efficiency and effectiveness of information technology investments, including relying on metrics for identifying and reducing potential duplication, waste, and cost; improve the operational linkage between the NASA Chief Information Officer and each NASA mission directorate, center, and mission support office to ensure both agency and mission needs are considered in agency-wide information technology and information security management and oversight; review the portfolio of information technology investments and spending, including information technology-related investments included as part of activities within NASA mission directorates that may not be considered information technology, to ensure investments are recognized and reported appropriately based on guidance from the Office of Management and Budget; consider appropriate revisions to the charters of information technology boards and councils that inform information technology investment and operation decisions; and consider whether the NASA Chief Information Officer should have a seat on any boards or councils described in paragraph (6). The Comptroller General of the United States shall conduct a study of the effectiveness of the Administration’s Information Technology Governance in ensuring information technology resources are aligned with agency missions and are cost effective and secure. the resources available for overseeing Administration-wide information technology operations, investments, and security measures and the NASA Chief Information Officer’s visibility and involvement into information technology oversight and access to those resources; the effectiveness and challenges of the Administration’s information technology structure, decision making processes and authorities, including impacts on its ability to implement information security; and the impact of NASA Chief Information Officer approval authority over information technology investments that exceed a defined monetary threshold, including any potential impacts of such authority on the Administration’s missions, flights programs and projects, research activities, and Center operations. Not later than 1 year after the date of enactment of this Act [Mar. 21, 2017], the Comptroller General shall submit to the appropriate committees of Congress [Committee on Science, Space, and Technology of the House of Representatives and Committee on Commerce, Science, and Transportation of the Senate] a report detailing the results of the study under paragraph (1), including any recommendations. Subject to subsection (b), the Administrator [of the National Aeronautics and Space Administration] shall develop an information technology strategic plan to guide NASA [National Aeronautics and Space Administration] information technology management and strategic objectives. the deadline under section 306(a) of title 5, United States Code; and the requirements under section 3506 of title 44, United States Code. near and long-term goals and objectives for leveraging information technology; a plan for how NASA will submit to Congress of [sic] a list of information technology projects, including completion dates and risk level in accordance with guidance from the Office of Management and Budget; an implementation overview for an agency-wide approach to information technology investments and operations, including reducing barriers to cross-center collaboration; coordination by the NASA Chief Information Officer with centers and mission directorates to ensure that information technology policies are effectively and efficiently implemented across the agency; a plan to increase the efficiency and effectiveness of information technology investments, including a description of how unnecessarily duplicative, wasteful, legacy, or outdated information technology across NASA will be identified and eliminated, and a schedule for the identification and elimination of such information technology; a plan for improving the information security of agency information and agency information systems, including improving security control assessments and role-based security training of employees; and submission by NASA to Congress of information regarding high risk projects and cybersecurity risks. The Administrator shall submit to the appropriate committees of Congress [Committee on Science, Space, and Technology of the House of Representatives and Committee on Commerce, Science, and Transportation of the Senate] the strategic plan under subsection (a) and any updates thereto. Congress finds that the security of NASA [National Aeronautics and Space Administration] information and information systems is vital to the success of the mission of the agency. Not later than 1 year after the date of enactment of this Act [Mar. 21, 2017], the Administrator [of the National Aeronautics and Space Administration] shall implement the information security plan developed under paragraph (2) and take such further actions as the Administrator considers necessary to improve the information security system in accordance with this section. Subject to paragraphs (3) and (4), the Administrator shall develop an agency-wide information security plan to enhance information security for NASA information and information infrastructure. reflects the unique nature of NASA’s mission and expertise; is informed by policies, standards, guidelines, and directives on information security required for Federal agencies; is consistent with the standards and guidelines under section 11331 of title 40, United States Code; and meets applicable National Institute of Standards and Technology information security standards and guidelines. an overview of the requirements of the information security system; an agency-wide risk management framework for information security; a description of the information security system management controls and common controls that are necessary to ensure compliance with information security-related requirements; an identification and assignment of roles, responsibilities, and management commitment for information security at the agency; coordination among organizational entities, including between each center, facility, mission directorate, and mission support office, and among agency entities responsible for different aspects of information security; the need to protect the information security of mission-critical systems and activities and high-impact and moderate-impact information systems; and a schedule of frequent reviews and updates, as necessary, of the plan.” to improve coordination, and encourage collaboration and early planning on scope; to determine areas of overlap or alignment; to find ways to leverage across divisional perspectives to maximize outcomes; and to be more efficient with resources and funds.” The National Space Council shall establish a Users’ Advisory Group composed of non-Federal representatives of industries and other persons involved in aeronautical and space activities. The Vice President shall name a chairman of the Users’ Advisory Group. The National Space Council shall from time to time, but not less than once a year, meet with the Users’ Advisory Group. The function of the Users’ Advisory Group shall be to ensure that the interests of industries and other non-Federal entities involved in space activities, including in particular commercial entities, are adequately represented in the National Space Council. The Users’ Advisory Group may be assisted by personnel detailed to the National Space Council. The Users’ Advisory Group shall not be subject to section 1013(a) of title 5, United States Code.” Effective February 1, 1989, there is established in the Executive Office of the President the National Space Council, which shall be chaired by the Vice President. By March 1, 1989, the President shall submit to the Congress a report that outlines the composition and functions of the National Space Council. The Council may employ a staff of not more than seven persons, which is to be headed by a civilian executive secretary, who shall be appointed by the President.” The Administrator [of the National Aeronautics and Space Administration] shall, in a manner that reflects the unique nature of NASA [National Aeronautics and Space Administration]’s mission and expertise— The study shall include an assessment of— In developing the strategic plan, the Administrator shall ensure that the strategic plan addresses— The strategic plan shall address, in a manner that reflects the unique nature of NASA’s mission and expertise— In developing the plan under paragraph (2), the Administrator shall ensure that the plan— The plan shall address— (Source: (Pub. L. 111–314, § 3, Dec. 18, 2010, 124 Stat. 3332.))