50 U.S.C. § 3618

(a) Collection The Director may collect charges for evaluating, certifying, or validating information assurance products under the National Information Assurance Program or successor program. (b) Establishment of charges The charges collected under subsection (a) shall be established through a public rulemaking process in accordance with Office of Management and Budget Circular No. A–25. (c) Limitation on charges Charges collected under subsection (a) shall not exceed the direct costs of the program referred to in that subsection. (d) Reimbursement or advance payment The appropriation or fund bearing the cost of the service for which charges are collected under the program referred to in subsection (a) may be reimbursed, or the Director may require advance payment subject to such adjustment on completion of the work as may be agreed upon. (e) Crediting of amounts collected Amounts collected under this section shall be credited to the account or accounts from which costs associated with such amounts have been or will be incurred, to reimburse or offset the direct costs of the program referred to in subsection (a).