### Question
How does the law define information security requirements?


### Answer
Under *38 U.S.C. § 5727*, **information security requirements** is defined as:

> information security requirements promulgated in accordance with law, or directed by the Secretary of Commerce, the National Institute of Standards and Technology, and the Office of Management and Budget, and, as to national security systems, the President

#### Citation:
  - *38 U.S.C. § 5727*
  - Heading: **PART IV-GENERAL ADMINISTRATIVE PROVISIONS > CHAPTER 57-RECORDS AND INVESTIGATIONS > SUBCHAPTER III-INFORMATION SECURITY**

