32 CFR § 2400.40 - Responsibility.
---
identifier: "/us/cfr/t32/s2400.40"
source: "ecfr"
legal_status: "authoritative_unofficial"
title: "32 CFR § 2400.40 - Responsibility."
title_number: 32
title_name: "National Defense"
section_number: "2400.40"
section_name: "Responsibility."
chapter_name: "OFFICE OF SCIENCE AND TECHNOLOGY POLICY"
part_number: "2400"
part_name: "REGULATIONS TO IMPLEMENT E.O. 12356; OFFICE OF SCIENCE AND TECHNOLOGY POLICY INFORMATION SECURITY PROGRAM"
positive_law: false
currency: "2026-03-24"
last_updated: "2026-03-24"
format_version: "1.1.0"
generator: "[email protected]"
authority: "E.O. 12356 and Information Security Oversight Office Directive No. 1."
regulatory_source: "48 FR 10821, Mar. 15, 1983, unless otherwise noted."
cfr_part: "2400"
---
# 2400.40 Responsibility.
The Director, OSTP is the senior OSTP official having authority and responsibility to ensure effective and uniform compliance with and implementation of Executive Order 12356 and its implementing Directive No. 1. As such, the Director, OSTP, shall have primary responsibility for providing guidance, oversight and approval of policy and procedures governing the OSTP Information Security Program. The Director, OSTP, may approve waivers or exceptions to the provisions of this regulation to the extent such action is consistent with Executive Order 12356 and Directive No. 1.