Version	Word Count	Changes From Previous Version	Percent Change
Introduced in Senate	31,646	n/a	n/a
Reported in Senate	67,135	341 Show Changes Hide Changes	20%

Display Version Introduced in Senate Reported in Senate

S 3480 ISRSCommentsClose CommentsPermalink

111th CONGRESSCommentsClose CommentsPermalink

2d SessionCommentsClose CommentsPermalink

S. 3480CommentsClose CommentsPermalink

To amend the Homeland Security Act of 2002 and other laws to enhance the security and resiliency of the cyber and communications infrastructure of the United States.CommentsClose CommentsPermalink

IN THE SENATE OF THE UNITED STATESCommentsClose CommentsPermalink

June 10, 2010CommentsClose CommentsPermalink

Mr. LIEBERMAN (for himself, Ms. COLLINS, and Mr. CARPER) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental AffairsCommentsClose CommentsPermalink

A BILLCommentsClose CommentsPermalink

To amend the Homeland Security Act of 2002 and other laws to enhance the security and resiliency of the cyber and communications infrastructure of the United States.CommentsClose CommentsPermalink

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, CommentsClose CommentsPermalink

SECTION 1. SHORT TITLE.

This Act may be cited as the ‘Protecting Cyberspace as a National Asset Act of 2010’. CommentsClose CommentsPermalink

SEC. 2. TABLE OF CONTENTS.

The table of contents for this Act is as follows: CommentsClose CommentsPermalink





Sec. 1. Short title. CommentsClose CommentsPermalink





Sec. 2. Table of contents. CommentsClose CommentsPermalink





Sec. 3. Definitions. CommentsClose CommentsPermalink

TITLE I--OFFICE OF CYBERSPACE POLICY

Sec. 101. Establishment of the Office of Cyberspace Policy. CommentsClose CommentsPermalink





Sec. 102. Appointment and responsibilities of the Director. CommentsClose CommentsPermalink





Sec. 103. Prohibition on political campaigning. CommentsClose CommentsPermalink





Sec. 104. Review of Federal agency budget requests relating to the National Strategy. CommentsClose CommentsPermalink





Sec. 105. Access to intelligence. CommentsClose CommentsPermalink





Sec. 106. Consultation. CommentsClose CommentsPermalink





Sec. 107. Reports to Congress. CommentsClose CommentsPermalink

TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS

Sec. 201. Cybersecurity. CommentsClose CommentsPermalink

TITLE III--FEDERAL INFORMATION SECURITY MANAGEMENT

Sec. 301. Coordination of Federal information policy. CommentsClose CommentsPermalink

TITLE IV--RECRUITMENT AND PROFESSIONAL DEVELOPMENT

Sec. 401. Definitions. CommentsClose CommentsPermalink





Sec. 402. Assessment of cybersecurity workforce. CommentsClose CommentsPermalink





Sec. 403. Strategic cybersecurity workforce planning. CommentsClose CommentsPermalink





Sec. 404. Cybersecurity occupation classifications. CommentsClose CommentsPermalink





Sec. 405. Measures of cybersecurity hiring effectiveness. CommentsClose CommentsPermalink





Sec. 406. Training and education. CommentsClose CommentsPermalink





Sec. 407. Cybersecurity incentives. CommentsClose CommentsPermalink





Sec. 408. Recruitment and retention program for the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink

TITLE V--OTHER PROVISIONS

Sec. 501. Consultation on cybersecurity matters.Sec. 502. Cybersecurity research and development. CommentsClose CommentsPermalink





Sec. 5032. Prioritized critical information infrastructure. CommentsClose CommentsPermalink





Sec. 5043. National Center for Cybersecurity and Communications acquisition authorities. CommentsClose CommentsPermalink





Sec. 504. Evaluation of the effective implementation of Office of Management and Budget information security related policies and directives. CommentsClose CommentsPermalink





Sec. 505. Technical and conforming amendments. CommentsClose CommentsPermalink

SEC. 3. DEFINITIONS.

In this Act: CommentsClose CommentsPermalink





(1) APPROPRIATE CONGRESSIONAL COMMITTEES- The term ‘appropriate congressional committees’ means-- CommentsClose CommentsPermalink





(A) the Committee on Homeland Security and Governmental Affairs of the Senate; CommentsClose CommentsPermalink





(B) the Committee on Homeland Security of the House of Representatives; CommentsClose CommentsPermalink





(C) the Committee on Oversight and Government Reform of the House of Representatives; and CommentsClose CommentsPermalink





(D) any other congressional committee with jurisdiction over the particular matter. CommentsClose CommentsPermalink





(2) CRITICAL INFRASTRUCTURE- The term ‘critical infrastructure’ has the meaning given that term in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)). CommentsClose CommentsPermalink





(3) CYBERSPACE- The term ‘cyberspace’ means the interdependent network of information infrastructure, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries. CommentsClose CommentsPermalink





(4) DIRECTOR- The term ‘Director’ means the Director of Cyberspace Policy established under section 101. CommentsClose CommentsPermalink





(5) FEDERAL AGENCY- The term ‘Federal agency’-- CommentsClose CommentsPermalink





(A) means any executive department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; and CommentsClose CommentsPermalink





(B) does not include the governments of the District of Columbia and of the territories and possessions of the United States and their various subdivisions. CommentsClose CommentsPermalink





(6) FEDERAL INFORMATION INFRASTRUCTURE- The term ‘Federal information infrastructure’-- CommentsClose CommentsPermalink





(A) means information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; and CommentsClose CommentsPermalink





(B) does not include-- CommentsClose CommentsPermalink





(i) a national security system; or CommentsClose CommentsPermalink





(ii) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community. CommentsClose CommentsPermalink





(7) INCIDENT- The term ‘incident’ means an occurrence that--

(A) actually or potentially jeopardizes--

(i) the information security of information infrastructure; or

(ii) the information that information infrastructure processes, stores, receives, or transmits; or

(B) constitutes a violation or threat of violation of security policies, security procedures, or acceptable use policies applicable to information infrastructurehas the meaning given that term insection 3551 of title 44, United States Code, as added by this Act. CommentsClose CommentsPermalink




(8) INFORMATION INFRASTRUCTURE- The term ‘information infrastructure’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including programmable electronic devices and communications networks and any associated hardware, software, or data. CommentsClose CommentsPermalink





(9) INFORMATION SECURITY- The term ‘information security’ means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide-- CommentsClose CommentsPermalink





(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity; CommentsClose CommentsPermalink





(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and CommentsClose CommentsPermalink





(C) availability, by ensuring timely and reliable access to and use of information. CommentsClose CommentsPermalink





(10) INFORMATION TECHNOLOGY- The term ‘information technology’ has the meaning given that term insection 11101 of title 40, United States Code. CommentsClose CommentsPermalink





(11) INTELLIGENCE COMMUNITY- The term ‘intelligence community’ has the meaning given that term under section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)). CommentsClose CommentsPermalink





(12) KEY RESOURCES- The term ‘key resources’ has the meaning given that term in section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101) CommentsClose CommentsPermalink





.(13) NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS- The term ‘National Center for Cybersecurity and Communications’ means the National Center for Cybersecurity and Communications established under section 242(a) of the Homeland Security Act of 2002, as added by this Act. CommentsClose CommentsPermalink





(14) NATIONAL INFORMATION INFRASTRUCTURE- The term ‘national information infrastructure’ means information infrastructure-- CommentsClose CommentsPermalink





(A)(i) that is owned, operated, or controlled within or from the United States; or(ii) if located outside the United States, the disruption of which could result in national or regional catastrophic damage in the United States; and CommentsClose CommentsPermalink





(B) that is not owned, operated, controlled, or licensed for use by a Federal agency. CommentsClose CommentsPermalink





(15) NATIONAL SECURITY SYSTEM- The term ‘national security system’ has the meaning given that term insection 3551 of title 44, United States Code, as added by this Act. CommentsClose CommentsPermalink





(16) NATIONAL STRATEGY- The term ‘National Strategy’ means the national strategy to increase the security and resiliency of cyberspace developed under section 101(a)(1). CommentsClose CommentsPermalink





(17) OFFICE- The term ‘Office’ means the Office of Cyberspace Policy established under section 101. CommentsClose CommentsPermalink





(18) RESILIENCY- The term ‘resiliency’ means the ability to eliminate or reduce the magnitude or duration of a disruptive event, including the ability to prevent, prepare for, respond to, and recover from the event. CommentsClose CommentsPermalink





(19) RISK- The term ‘risk’ means the potential for an unwanted outcome resulting from an incident, as determined by the likelihood of the occurrence of the incident and the associated consequences, including potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident. CommentsClose CommentsPermalink





(19) 20) RISK-BASED SECURITY- The term ‘risk-based security’ has the meaning given that term insection 3551 of title 44, United States Code, as added by this Act. CommentsClose CommentsPermalink

TITLE I--OFFICE OF CYBERSPACE POLICY CommentsClose CommentsPermalink

SEC. 101. ESTABLISHMENT OF THE OFFICE OF CYBERSPACE POLICY.

(a) Establishment of Office- There is established in the Executive Office of the President an Office of Cyberspace Policy which shall-- CommentsClose CommentsPermalink





(1) develop, not later than 1 year after the date of enactment of this Act, and update as needed, but not less frequently than once every 2 years, a national strategy to increase the security and resiliency of cyberspace, that includes goals and objectives relating to-- CommentsClose CommentsPermalink





(A) computer network operations, including offensive activities, defensive activities, and other activities; CommentsClose CommentsPermalink





(B) information assurance; CommentsClose CommentsPermalink





(C) protection of critical infrastructure and key resources; CommentsClose CommentsPermalink





(D) research and development priorities; CommentsClose CommentsPermalink





(E) law enforcement; CommentsClose CommentsPermalink





(F) diplomacy; CommentsClose CommentsPermalink





(G) homeland security; CommentsClose CommentsPermalink





and(H (H) protection of privacy and civil liberties; CommentsClose CommentsPermalink





(I) military and intelligence activities;(2) and CommentsClose CommentsPermalink





(J) identity management and authentication; CommentsClose CommentsPermalink





(2) oversee, coordinate, and integrate all policies and activities of the Federal Government across all instruments of national power relating to ensuring the security and resiliency of cyberspace, including-- CommentsClose CommentsPermalink





(A) diplomatic, economic, military, intelligence, homeland security, and law enforcement policies and activities within and among Federal agencies; and CommentsClose CommentsPermalink





(B) offensive activities, defensive activities, and other policies and activities necessary to ensure effective capabilities to operate in cyberspace; CommentsClose CommentsPermalink





(3) ensure that all Federal agencies comply with appropriate guidelines, policies, and directives from the Department of Homeland Security, other Federal agencies with responsibilities relating to cyberspace security or resiliency, and the National Center for Cybersecurity and Communications; and CommentsClose CommentsPermalink





(4) ensure that Federal agencies have access to, receive, and appropriately disseminate law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246 of the Homeland Security Act of 2002, as added by this Act) relevant to-- CommentsClose CommentsPermalink





(A) the security of the Federal information infrastructure or the national information infrastructure; and CommentsClose CommentsPermalink





(B) the security of-- CommentsClose CommentsPermalink





(i) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; or CommentsClose CommentsPermalink





(ii) a national security system. CommentsClose CommentsPermalink





(b) Director of Cyberspace Policy- CommentsClose CommentsPermalink





(1) IN GENERAL- There shall be a Director of Cyberspace Policy, who shall be the head of the Office. CommentsClose CommentsPermalink





(2) EXECUTIVE SCHEDULE POSITION-Section 5312 of title 5, United States Code, is amended by adding at the end the following: CommentsClose CommentsPermalink





‘Director of Cyberspace Policy.’. CommentsClose CommentsPermalink

SEC. 102. APPOINTMENT AND RESPONSIBILITIES OF THE DIRECTOR.

(a) Appointment- CommentsClose CommentsPermalink





(1) IN GENERAL- The Director shall be appointed by the President, by and with the advice and consent of the Senate. CommentsClose CommentsPermalink





(2) QUALIFICATIONS- The President shall appoint the Director from among individuals who have demonstrated ability and knowledge in information technology, cybersecurity, and the operations, security, and resiliency of communications networks. CommentsClose CommentsPermalink





(3) PROHIBITION- No person shall serve as Director while serving in any other position in the Federal Government. CommentsClose CommentsPermalink





(b) Responsibilities- The Director shall-- CommentsClose CommentsPermalink





(1) advise the President regarding the establishment of policies, goals, objectives, and priorities for securing the information infrastructure of the Nation; CommentsClose CommentsPermalink





(2) advise the President and other entities within the Executive Office of the President regarding mechanisms to build, and improve the resiliency and efficiency of, the information and communication industry of the Nation, in collaboration with the private sector, while promoting national economic interests; CommentsClose CommentsPermalink





(3) work with Federal agencies to-- CommentsClose CommentsPermalink





(A) oversee, coordinate, and integrate the implementation of the National Strategy, including coordination with-- CommentsClose CommentsPermalink





(i) the Department of Homeland Security; CommentsClose CommentsPermalink





(ii) the Department of Defense; CommentsClose CommentsPermalink





(iii) the Department of Commerce; CommentsClose CommentsPermalink





(iv) the Department of State; CommentsClose CommentsPermalink





(v) the Department of Justice; CommentsClose CommentsPermalink





(vi) the Department of Energy; CommentsClose CommentsPermalink





(vii) through the Director of National Intelligence, the intelligence community; and CommentsClose CommentsPermalink





(viii) and any other Federal agency with responsibilities relating to the National Strategy; and CommentsClose CommentsPermalink





(B) resolve any disputes that arise between Federal agencies relating to the National Strategy or other matters within the responsibility of the Office; CommentsClose CommentsPermalink





(4) if the policies or activities of a Federal agency are not in compliance with the responsibilities of the Federal agency under the National Strategy-- CommentsClose CommentsPermalink





(A) notify the Federal agency; CommentsClose CommentsPermalink





(B) transmit a copy of each notification under subparagraph (A) to the President and the appropriate congressional committees; and CommentsClose CommentsPermalink





(C) coordinate the efforts to bring the Federal agency into compliance; CommentsClose CommentsPermalink





(5) ensure the adequacy of protections for privacy and civil liberties in carrying out the responsibilities of the Director under this title, including through consultation with the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee); CommentsClose CommentsPermalink





(6) upon reasonable request, appear before any duly constituted committees of the Senate or of the House of Representatives; CommentsClose CommentsPermalink





(7) recommend to the Office of Management and Budget or the head of a Federal agency actions (including requests to Congress relating to the reprogramming of funds) that the Director determines are necessary to ensure risk-based security of-- CommentsClose CommentsPermalink





(A) the Federal information infrastructure; CommentsClose CommentsPermalink





(B) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; or CommentsClose CommentsPermalink





(C) a national security system; CommentsClose CommentsPermalink





(8) advise the Administrator of the Office of E-Government and Information Technology and the Administrator of the Office of Information and Regulatory Affairs on the development, and oversee the implementation, of policies, principles, standards, guidelines, and budget priorities for information technology functions and activities of the Federal Government; CommentsClose CommentsPermalink





(9) coordinate and ensure, to the maximum extent practicable, that the standards and guidelines developed for national security systems and the standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) are complementary and unified; CommentsClose CommentsPermalink





(10) in consultation with the Administrator of the Office of Information and Regulatory Affairs, coordinate efforts of Federal agencies relating to the development of regulations, rules, requirements, or other actions applicable to the national information infrastructure to ensure, to the maximum extent practicable, that the efforts are complementary; CommentsClose CommentsPermalink





(11) coordinate the activities of the Office of Science and Technology Policy, the National Economic Council, the Office of Management and Budget, the National Security Council, the Homeland Security Council, and the United States Trade Representative related to the National Strategy and other matters within the purview of the Office; CommentsClose CommentsPermalink





and(12 (12) carry out the responsibilities for national security and emergency preparedness communications described in section 706 of the Communications Act of 1934 (47 U.S.C. 606) to ensure integration and coordination; and CommentsClose CommentsPermalink





(13) as assigned by the President, other duties relating to the security and resiliency of cyberspace. CommentsClose CommentsPermalink





(c) Conforming Regulations and Orders- The President shall amend the regulations and orders issued under section 706 of the Communications Act of 1934 (47 U.S.C. 606) in accordance with subsection (b)(12). CommentsClose CommentsPermalink

SEC. 103. PROHIBITION ON POLITICAL CAMPAIGNING.

Section 7323(b)(2)(B) of title 5, United States Code, is amended-- CommentsClose CommentsPermalink





(1) in clause (i), by striking ‘or’ at the end; CommentsClose CommentsPermalink





(2) in clause (ii), by striking the period at the end and inserting ‘; or’; and CommentsClose CommentsPermalink





(3) by adding at the end the following: CommentsClose CommentsPermalink





‘(iii) notwithstanding the exception under subparagraph (A) (relating to an appointment made by the President, by and with the advice and consent of the Senate), the Director of Cyberspace Policy.’. CommentsClose CommentsPermalink

SEC. 104. REVIEW OF FEDERAL AGENCY BUDGET REQUESTS RELATING TO THE NATIONAL STRATEGY.

(a) In General- For each fiscal year, the head of each Federal agency shall transmit to the Director a copy of any portion of the budget of the Federal agency intended to implement the National Strategy at the same time as that budget request is submitted to the Office of Management and Budget in the preparation of the budget of the President submitted to Congress undersection 1105 (a) of title 31, United States Code. CommentsClose CommentsPermalink





(b) Timely Submissions- The head of each Federal agency shall ensure the timely development and submission to the Director of each proposed budget under this section, in such format as may be designated by the Director with the concurrence of the Director of the Office of Management and Budget. CommentsClose CommentsPermalink





(c) Adequacy of the Proposed Budget Requests- With the assistance of, and in coordination with, the Office of E-Government and Information Technology and the National Center for Cybersecurity and Communications, the Director shall review each budget submission to assess the adequacy of the proposed request with regard to implementation of the National Strategy.(d) , including the overall sufficiency of the requests to implement effectively the National Strategy across all Federal agencies. CommentsClose CommentsPermalink





(d) Inadequate Budget Requests- If the Director concludes that a budget request submitted under subsection (a) is inadequate, in whole or in part, to implement the objectives of the National Strategy, the Director shall submit to the Director of the Office of Management and Budget and the head of the Federal agency submitting the budget request a written description of funding levels and specific initiatives that would, in the determination of the Director, make the request adequate. CommentsClose CommentsPermalink

SEC. 105. ACCESS TO INTELLIGENCE.

The Director shall have access to law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246 of the Homeland Security Act of 2002, as added by this Act) that is obtained by, or in the possession of, any Federal agency that the Director determines relevant to the security of-- CommentsClose CommentsPermalink





(1) the Federal information infrastructure; CommentsClose CommentsPermalink





(2) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; CommentsClose CommentsPermalink





(3) a national security system; or CommentsClose CommentsPermalink





(4) national information infrastructure. CommentsClose CommentsPermalink

SEC. 106. CONSULTATION.

(a) In General- The Director may consult and obtain recommendations from, as needed, such Presidential and other advisory entities as the Director determines will assist in carrying out the mission of the Office, including-- CommentsClose CommentsPermalink





(1) the National Security Telecommunications Advisory Committee; CommentsClose CommentsPermalink





(2) the National Infrastructure Advisory Council; CommentsClose CommentsPermalink





(3) the Privacy and Civil Liberties Oversight Board; CommentsClose CommentsPermalink





(4) the President’s Intelligence Advisory Board; CommentsClose CommentsPermalink





(5) the Critical Infrastructure Partnership Advisory Council; CommentsClose CommentsPermalink





and(6 (6) the Committee on Foreign Investment in the United States; CommentsClose CommentsPermalink





(7) the Information Security and Privacy Advisory Board; CommentsClose CommentsPermalink





(8) the National Cybersecurity Advisory Council established under section 239 of the Homeland Security Act of 2002, as added by this Act; and CommentsClose CommentsPermalink





(9) any other entity that may provide assistance to the Director. CommentsClose CommentsPermalink





(b) National Strategy- In developing and updating the National Strategy the Director shall consult with the National Cybersecurity Advisory Council and, as appropriate, State and local governments and private entities. CommentsClose CommentsPermalink

SEC. 107. REPORTS TO CONGRESS.

(a) In General- The Director shall submit an annual report to the appropriate congressional committees describing the activities, ongoing projects, and plans of the Federal Government designed to meet the goals and objectives of the National Strategy. CommentsClose CommentsPermalink





(b) Classified Annex- A report submitted under this section shall be submitted in an unclassified form, but may include a classified annex, if necessary. CommentsClose CommentsPermalink





(c) Public Report- An unclassified version of each report submitted under this section shall be made available to the public. CommentsClose CommentsPermalink

TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS CommentsClose CommentsPermalink

SEC. 201. CYBERSECURITY.

Title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding at the end the following: CommentsClose CommentsPermalink

‘Subtitle E--Cybersecurity CommentsClose CommentsPermalink

‘SEC. 241. DEFINITIONS.

‘In this subtitle-- CommentsClose CommentsPermalink





‘(1) the term ‘agency information infrastructure’ means the Federal information infrastructure of a particular Federal agency; CommentsClose CommentsPermalink





‘(2) the term ‘appropriate committees of Congress’ means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives; CommentsClose CommentsPermalink





‘(3) the term ‘Center’ means the National Center for Cybersecurity and Communications established under section 242(a); CommentsClose CommentsPermalink





‘(4) the term ‘covered critical infrastructure’ means a system or asset--

‘(A) that is on the prioritized critical infrastructure list established by the Secretary under section 210E(a)(2); and

‘(B)(i) that is a component of the national information infrastructure; or

‘(ii) for which the national information infrastructure is essential to the reliable operation of the system or asset identified by the Secretary as covered critical infrastructure under section 254; CommentsClose CommentsPermalink




‘(5) the term ‘cyber vulnerability’ means any security vulnerabilityrisk’ means any risk to information infrastructure, including physical or personnel risks and security vulnerabilities, that, if exploited or not mitigated, could pose a significant risk of disruption to the operation of information infrastructure essential to the reliable operation of covered critical infrastructure; CommentsClose CommentsPermalink





‘(6) the term ‘Director’ means the Director of the Center appointed under section 242(b)(1); CommentsClose CommentsPermalink





‘(7) the term ‘Federal agency’-- CommentsClose CommentsPermalink





‘(A) means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; and CommentsClose CommentsPermalink





‘(B) does not include the governments of the District of Columbia and of the territories and possessions of the United States and their various subdivisions; CommentsClose CommentsPermalink





‘(8) the term ‘Federal information infrastructure’-- CommentsClose CommentsPermalink





‘(A) means information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; and CommentsClose CommentsPermalink





‘(B) does not include-- CommentsClose CommentsPermalink





‘(i) a national security system; or CommentsClose CommentsPermalink





‘(ii) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; CommentsClose CommentsPermalink





‘(9) the term ‘incident’ means an occurrence that--

‘(A) actually or potentially jeopardizes--

‘(i) the information security of information infrastructure; or

‘(ii) the information that information infrastructure processes, stores, receives, or transmits; or

‘(B) constitutes a violation or threat of violation of security policies, security procedures, or acceptable use policies applicable to information infrastructure.

has the meaning given that term insection 3551 of title 44, United States Code; CommentsClose CommentsPermalink




‘(10) the term ‘information infrastructure’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including-- CommentsClose CommentsPermalink





‘(A) programmable electronic devices and communications networks; and CommentsClose CommentsPermalink





‘(B) any associated hardware, software, or data; CommentsClose CommentsPermalink





‘(11) the term ‘information security’ means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide-- CommentsClose CommentsPermalink





‘(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity; CommentsClose CommentsPermalink





‘(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and CommentsClose CommentsPermalink





‘(C) availability, by ensuring timely and reliable access to and use of information; CommentsClose CommentsPermalink





‘(12) the term ‘information sharing and analysis center’ means a self-governed forum whose members work together within a specific sector of critical infrastructure to identify, analyze, and share with other members and the Federal Government critical information relating to threats, vulnerabilities, or incidents to the security and resiliency of the critical infrastructure that comprises the specific sector; CommentsClose CommentsPermalink





‘(13) the term ‘information system’ has the meaning given that term insection 3502 of title 44, United States Code; CommentsClose CommentsPermalink





‘(14) the term ‘intelligence community’ has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)); CommentsClose CommentsPermalink





‘(15) the term ‘management controls’ means safeguards or countermeasures for an information system that focus on the management of risk and the management of information system security; CommentsClose CommentsPermalink





‘(16) the term ‘National Cybersecurity Advisory Council’ means the National Cybersecurity Advisory Council established under section 239; CommentsClose CommentsPermalink





‘(17) the term ‘national cyber emergency’ means an actual or imminent action by any individual or entity to exploit a cyber vulnerability in a risk in a manner that disrupts, attempts to disrupt, or poses a significant risk of disruption to the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure; CommentsClose CommentsPermalink





‘(18) the term ‘national information infrastructure’ means information infrastructure-- CommentsClose CommentsPermalink





‘(A)(i) that is owned, operated, or controlled within or from the United States; or‘(ii) if located outside the United States, the disruption of which could result in national or regional catastrophic damage in the United States; and CommentsClose CommentsPermalink





‘(B) that is not owned, operated, controlled, or licensed for use by a Federal agency; CommentsClose CommentsPermalink





‘(19) the term ‘national security system’ has the same meaning given that term insection 3551 of title 44, United States Code; CommentsClose CommentsPermalink





‘(20) the term ‘operational controls’ means the safeguards and countermeasures for an information system that are primarily implemented and executed by individuals not systems; CommentsClose CommentsPermalink





‘(21) the term ‘sector-specific agency’ means the relevant Federal agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category under the National Infrastructure Protection Plan, or any other appropriate Federal agency identified by the President after the date of enactment of this subtitle; CommentsClose CommentsPermalink





‘(22) the term ‘sector coordinating councils’ means self-governed councils that are composed of representatives of key stakeholders within a specific sector of critical infrastructure that serve as the principal private sector policy coordination and planning entities with the Federal Government relating to the security and resiliency of the critical infrastructure that comprise that sector; CommentsClose CommentsPermalink





‘(23) the term ‘security controls’ means the management, operational, and technical controls prescribed for an information system to protect the information security of the system; CommentsClose CommentsPermalink





‘(24) the term ‘small business concern’ has the meaning given that term under section 3 of the Small Business Act (15 U.S.C. 632); CommentsClose CommentsPermalink





‘(25) the term ‘technical controls’ means the safeguards or countermeasures for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system; CommentsClose CommentsPermalink





‘(26) the term ‘terrorism information’ has the meaning given that term in section 1016 of the Intelligence Reform and Terrorism Prevention Act of 2004 (6 U.S.C. 485); CommentsClose CommentsPermalink





‘(27) the term ‘United States person’ has the meaning given that term in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801); and CommentsClose CommentsPermalink





‘(28) the term ‘US-CERT’ means the United States Computer Emergency Readiness Team established under section 244. CommentsClose CommentsPermalink

‘SEC. 242. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

‘(a) Establishment- CommentsClose CommentsPermalink





‘(1) IN GENERAL- There is established within the Department a National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘(2) OPERATIONAL ENTITY- The Center may-- CommentsClose CommentsPermalink





‘(A) enter into contracts for the procurement of property and services for the Center; and CommentsClose CommentsPermalink





‘(B) appoint employees of the Center in accordance with the civil service laws of the United States. CommentsClose CommentsPermalink





‘(b) Director- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Center shall be headed by a Director, who shall be appointed by the President, by and with the advice and consent of the Senate. CommentsClose CommentsPermalink





‘(2) REPORTING TO SECRETARY- The Director shall report directly to the Secretary and serve as the principal advisor to the Secretary on cybersecurity and the operations, security, and resiliency of the information infrastructure and communications infrastructure of the United States. CommentsClose CommentsPermalink





‘(3) PRESIDENTIAL ADVICE- The Director shall regularly advise the President on the exercise of the authorities provided under this subtitle or any other provision of law relating to the security of the Federal information infrastructure or an agency information infrastructure. CommentsClose CommentsPermalink





‘(4) QUALIFICATIONS- The Director shall be appointed from among individuals who have-- CommentsClose CommentsPermalink





‘(A) a demonstrated ability in and knowledge of information technology, cybersecurity, and the operations, security and resiliency of communications networks; and CommentsClose CommentsPermalink





‘(B) significant executive leadership and management experience in the public or private sector. CommentsClose CommentsPermalink





‘(5) LIMITATION ON SERVICE- CommentsClose CommentsPermalink





‘(A) IN GENERAL- Subject to subparagraph (B), the individual serving as the Director may not, while so serving, serve in any other capacity in the Federal Government, except to the extent that the individual serving as Director is doing so in an acting capacity. CommentsClose CommentsPermalink





‘(B) EXCEPTION- The Director may serve on any commission, board, council, or similar entity with responsibilities or duties relating to cybersecurity or the operations, security, and resiliency of the information infrastructure and communications infrastructure of the United States at the direction of the President or as otherwise provided by law. CommentsClose CommentsPermalink





‘(c) Deputy Directors- CommentsClose CommentsPermalink





‘(1) IN GENERAL- There shall be not less than 2 Deputy Directors for the Center, who shall report to the Director. CommentsClose CommentsPermalink





‘(2) INFRASTRUCTURE PROTECTION- CommentsClose CommentsPermalink





‘(A) APPOINTMENT- There shall be a Deputy Director appointed by the Secretary, who shall have expertise in infrastructure protection. CommentsClose CommentsPermalink





‘(B) RESPONSIBILITIES- The Deputy Director appointed under subparagraph (A) shall-- CommentsClose CommentsPermalink





‘(i) assist the Director and the Assistant Secretary for Infrastructure Protection in coordinating, managing, and directing the information, communications, and physical infrastructure protection responsibilities and activities of the Department, including activities under Homeland Security Presidential Directive-7, or any successor thereto, and the National Infrastructure Protection Plan, or any successor thereto; CommentsClose CommentsPermalink





‘(ii) review the budget for the Center and the Office of Infrastructure Protection before submission of the budget to the Secretary to ensure that activities are appropriately coordinated; CommentsClose CommentsPermalink





‘(iii) develop, update periodically, and submit to the appropriate committees of Congress a strategic plan detailing how critical infrastructure protection activities will be coordinated between the Center, the Office of Infrastructure Protection, and the private sector; CommentsClose CommentsPermalink





‘(iv) subject to the direction of the Director resolve conflicts between the Center and the Office of Infrastructure Protection relating to the information, communications, and physical infrastructure protection responsibilities of the Center and the Office of Infrastructure Protection; and CommentsClose CommentsPermalink





‘(v) perform such other duties as the Director may assign. CommentsClose CommentsPermalink





‘(C) ANNUAL EVALUATION- The Assistant Secretary for Infrastructure Protection shall submit annually to the Director an evaluation of the performance of the Deputy Director appointed under subparagraph (A). CommentsClose CommentsPermalink





‘(3) INTELLIGENCE COMMUNITY- The Director of National Intelligence shall identify an employee of an element of the intelligence community to serve as a Deputy Director of the Center. The employee shall be detailed to the Center on a reimbursable basis for such period as is agreed to by the Director and the Director of National Intelligence, and, while serving as Deputy Director, shall report directly to the Director of the Center. CommentsClose CommentsPermalink





‘(d) Liaison Officers- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Secretary of Defense, the Attorney General, the Secretary of Commerce, and the Director of National Intelligence shall detail personnel to the Center to act as full-time liaisons with the Department of Defense, the Department of Justice, the National Institute of Standards and Technology, and elements of the intelligence community to assist in coordination between and among the Center, the Department of Defense, the Department of Justice, the National Institute of Standards and Technology, and elements of the intelligence community. CommentsClose CommentsPermalink





‘(2) PRIVATE SECTOR- CommentsClose CommentsPermalink





‘(A) IN GENERAL- Consistent with applicable law and ethics requirements, and except as provided in subparagraph (B), the Director may authorize representatives from private sector entities to participate in the activities of the Center to improve the information sharing, analysis, and coordination of activities of the US-CERT. CommentsClose CommentsPermalink





‘(B) LIMITATION- A representative from a private sector entity authorized to participate in the activities of the Center under subparagraph (A) may not participate in any activities of the Center under section 248, 249, or 250. CommentsClose CommentsPermalink





‘(e) Privacy Officer- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director, in consultation with the Secretary, shall designate a full-time privacy officer, who shall report to the Director. CommentsClose CommentsPermalink





‘(2) DUTIES- The privacy officer designated under paragraph (1) shall have primary responsibility for implementation by the Center of the privacy policy for the Department established by the Privacy Officer appointed under section 222. CommentsClose CommentsPermalink





‘(f) Duties of Director- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director shall-- CommentsClose CommentsPermalink





‘(A) working cooperatively with the private sector, lead the Federal effort to secure, protect, and ensure the resiliency of the Federal information infrastructure and national information infrastructure of the United States, including communications , national information infrastructure, and communications infrastructure of the United States, including communications networks; CommentsClose CommentsPermalink





‘(B) assist in the identification, remediation, and mitigation of vulnerabilities to the Federal information infrastructure and the national information infrastructure; CommentsClose CommentsPermalink





‘(C) provide dynamic, comprehensive, and continuous situational awareness of the security status of the Federal information infrastructure, national information infrastructure, and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States by sharing and integrating classified and unclassified information, including information relating to threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the infrastructure or systems, on a routine and continuous basis with-- CommentsClose CommentsPermalink





‘(i) the National Threat Operations Center of the National Security Agency; CommentsClose CommentsPermalink





‘(ii) the United States Cyber Command, including the Joint Task Force-Global Network Operations; CommentsClose CommentsPermalink





‘(iii) the Cyber Crime Center of the Department of Defense; CommentsClose CommentsPermalink





‘(iv) the National Cyber Investigative Joint Task Force; CommentsClose CommentsPermalink





‘(v) the Intelligence Community Incident Response Center; CommentsClose CommentsPermalink





‘(vi) any other Federal agency, or component thereof, identified by the Director; and CommentsClose CommentsPermalink





‘(vii) any non-Federal entity, including, where appropriate, information sharing and analysis centers, identified by the Director, with the concurrence of the owner or operator of that entity and consistent with applicable law; CommentsClose CommentsPermalink





‘(D) work with the entities described in subparagraph (C) to establish policies and procedures that enable information sharing between and among the entities; CommentsClose CommentsPermalink





‘(E)(i) develop, in coordination with the Assistant Secretary for Infrastructure Protection, other Federal agencies, the private sector, and State and local governments, a national incident response plan that details the roles of Federal agencies, State and local governments, and the private sector, including plans to be executed in response to a declaration of a national cyber emergency by the President under section 249; and CommentsClose CommentsPermalink





‘(ii) establish mechanisms for assisting owners or operators of critical infrastructure, including covered critical infrastructure, in the deployment of emergency measures or other actions, including measures to restore the critical infrastructure in the event of the destruction or a serious disruption of the critical infrastructure; CommentsClose CommentsPermalink





‘(F) conduct risk-based assessments of the Federal information infrastructure with respect to acts of terrorism, natural disasters, and other large-scale disruptions and provide the results of the assessments to the Director of Cyberspace Policy and to affected Federal agencies; CommentsClose CommentsPermalink





‘(G) develop, oversee the implementation of, and enforce policies, principles, and guidelines on information security for the Federal information infrastructure, including timely adoption of and compliance with standards developed by the National Institute of Standards and Technology under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3); CommentsClose CommentsPermalink





‘(H) provide assistance to the National Institute of Standards and Technology in developing standards under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3); CommentsClose CommentsPermalink





‘(I) provide to Federal agencies mandatory security controls to mitigate and remediate vulnerabilities of and incidents affecting the Federal information infrastructure; CommentsClose CommentsPermalink





‘(J) subject to paragraph (2), and as needed, assist the Director of the Office of Management and Budget and the Director of Cyberspace Policy in conducting analysis and prioritization of budgets, resources, and policies relating to the security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(K) in accordance with section 253, develop, periodically update, and implement a supply chain risk management strategy to enhance, in a risk-based and cost-effective manner, the security of the communications and information technology products and services purchased by the Federal Government; CommentsClose CommentsPermalink





‘(L) notify the Director of Cyberspace Policy of any incident involving the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure that could compromise or significantly affect economic or national security; CommentsClose CommentsPermalink





‘(M) consult, in coordination with the Director of Cyberspace Policy, with appropriate international partners to enhance the security of the Federal information infrastructure and national information infrastructure;‘(N)(i), national information infrastructure, and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States; CommentsClose CommentsPermalink





‘(N)(i) coordinate and integrate information to analyze the composite security state of the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; CommentsClose CommentsPermalink





‘(ii) ensure the information required under clause (i) andsection 3553(c)(1)(A) of title 44, United States Code, including the views of the Director on the adequacy and effectiveness of information security throughout the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, is available on an automated and continuous basis through the system maintained under section 3552(a)(3)(D) of title 44, United States Code; CommentsClose CommentsPermalink





‘(iii) in conjunction with the quadrennial homeland security review required under section 707, and at such other times determined appropriate by the Director, analyze the composite security state of the national information infrastructure and submit to the President, Congress, and the Secretary a report regarding actions necessary to enhance the composite security state of the national information infrastructure based on the analysis; and CommentsClose CommentsPermalink





‘(iv) foster collaboration and serve as the primary contact between the Federal Government, State and local governments, and private entities on matters relating to the security of the Federal information infrastructure and the national information infrastructure; CommentsClose CommentsPermalink





‘(O) oversee the development, implementation, and management of security requirements for Federal agencies relating to the external access points to or from the Federal information infrastructure; CommentsClose CommentsPermalink





‘(P) establish, develop, and oversee the capabilities and operations within the US-CERT as required by section 244; CommentsClose CommentsPermalink





‘(Q) oversee the operations of the National Communications System, as described in Executive Order 12472 (49 Fed. Reg. 13471; relating to the assignment of national security and emergency preparedness telecommunications functions), as amended by Executive Order 13286 (68 Fed. Reg. 10619) and Executive Order 13407 (71 Fed. Reg. 36975), or any successor thereto, including planning for and providing communications for the Federal Government under all circumstances, including crises, emergencies, attacks, recoveries, and reconstitutions; CommentsClose CommentsPermalink





‘(R) ensure, in coordination with the privacy officer designated under subsection (e), the Privacy Officer appointed under section 222, and the Director of the Office of Civil Rights and Civil Liberties appointed under section 705, that the activities of the Center comply with all policies, regulations, and laws protecting the privacy and civil liberties of United States persons; CommentsClose CommentsPermalink





‘(S) subject to the availability of resources, in accordance with applicable law relating to the protection of trade secrets, and at the discretion of the Director, provide voluntary technical assistance-- CommentsClose CommentsPermalink





‘(i) at the request of an owner or operator of covered critical infrastructure, to assist the owner or operator in complying with sections 248 and 249, including implementing required security or emergency measures and developing response plans for national cyber emergencies declared under section 249; and CommentsClose CommentsPermalink





‘(ii) at the request of the owner or operator of national information infrastructure that is not covered critical infrastructure, and based on risk, to assist the owner or operator in implementing best practices, and related standards and guidelines, recommended under section 247 and other measures necessary to mitigate or remediate vulnerabilities of the information infrastructure and the consequences of efforts to exploit the vulnerabilities; CommentsClose CommentsPermalink





‘(T)(i) conduct, in consultation with the National Cybersecurity Advisory Council, the head of appropriate sector-specific agencies, and any private sector entity determined appropriate by the Director, risk-based assessments of national information infrastructure and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States, on a sector-by-sector basis, with respect to acts of terrorism, natural disasters, and other large-scale disruptions or financial harm, which shall identify and prioritize risks to the national information infrastructure, including and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States, including vulnerabilities and associated consequences; and CommentsClose CommentsPermalink





‘(ii) coordinate and evaluate the mitigation or remediation of cyber vulnerabilities and consequences identified under clause (i); CommentsClose CommentsPermalink





‘(U) regularly evaluate and assess technologies designed to enhance the protection of the Federal information infrastructure and national information infrastructure, including an assessment of the cost-effectiveness of the technologies; CommentsClose CommentsPermalink





‘(V) promote the use of the best practices recommended under section 247 to State and local governments and the private sector; CommentsClose CommentsPermalink





‘(W) develop and implement outreach and awareness programs on cybersecurity, including-- CommentsClose CommentsPermalink





‘(i) a public education campaign to increase the awareness of cybersecurity, cyber safety, and cyber ethics, which shall include use of the Internet, social media, entertainment, and other media to reach the public; CommentsClose CommentsPermalink





‘(ii) an education campaign to increase the understanding of State and local governments and private sector entities of the costs of failing to ensure effective security of information infrastructure and cost-effective methods to mitigate and remediate vulnerabilities; and CommentsClose CommentsPermalink





‘(iii) outcome-based performance measures to determine the success of the programs; CommentsClose CommentsPermalink





‘(X) develop and implement a national cybersecurity exercise program that includes-- CommentsClose CommentsPermalink





‘(i) the participation of State and local governments, international partners of the United States, and the private sector; CommentsClose CommentsPermalink





and‘(ii) an after action ‘(ii) an after action report analyzing lessons learned from exercises and identifying vulnerabilities to be remediated or mitigated; and CommentsClose CommentsPermalink





‘(iii) oversight, in coordination with the Director of the Office of Cyberspace Policy, of the efforts by Federal agencies to address deficiencies identified in the after action reports required under clause (ii); CommentsClose CommentsPermalink





‘(Y) coordinate with the Assistant Secretary for Infrastructure Protection to ensure that-- CommentsClose CommentsPermalink





‘(i) cybersecurity is appropriately addressed in carrying out the infrastructure protection responsibilities described in section 201(d); and CommentsClose CommentsPermalink





‘(ii) the operations of the Center and the Office of Infrastructure Protection avoid duplication and use, to the maximum extent practicable, joint mechanisms for information sharing and coordination with the private sector; CommentsClose CommentsPermalink





‘(Z) oversee the activities of the Office of Emergency Communications established under section 1801; CommentsClose CommentsPermalink





and‘(AA ‘(AA) in coordination with the Director of the Office of Cyberspace Policy and the heads of relevant Federal agencies, develop and implement an identity management strategy for cyberspace, which shall include, at a minimum, research and development goals, an analysis of appropriate protections for privacy and civil liberties, and mechanisms to develop and disseminate best practices and standards relating to identity management, including usability and transparency; and CommentsClose CommentsPermalink





‘(BB) perform such other duties as the Secretary may direct relating to the security and resiliency of the information and communications infrastructure of the United States. CommentsClose CommentsPermalink





‘(2) BUDGET ANALYSIS- In conducting analysis and prioritization of budgets under paragraph (1)(J), the Director-- CommentsClose CommentsPermalink





‘(A) in coordination with the Director of the Office of Management and Budget, may access information from any Federal agency regarding the finances, budget, and programs of the Federal agency relevant to the security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(B) may make recommendations to the Director of the Office of Management and Budget and the Director of Cyberspace Policy regarding the budget for each Federal agency to ensure that adequate funding is devoted to securing the Federal information infrastructure, in accordance with policies, principles, and guidelines established by the Director under this subtitle; and CommentsClose CommentsPermalink





‘(C) shall provide copies of any recommendations made under subparagraph (B) to-- CommentsClose CommentsPermalink





‘(i) the Committee on Appropriations of the Senate; CommentsClose CommentsPermalink





‘(ii) the Committee on Appropriations of the House of Representatives; and CommentsClose CommentsPermalink





‘(iii) the appropriate committees of Congress. CommentsClose CommentsPermalink





‘(g) Use of Mechanisms for Collaboration- In carrying out the responsibilities and authorities of the Director under this subtitle, to the maximum extent practicable, the Director shall use mechanisms for collaboration and information sharing (including mechanisms relating to the identification and communication of threats, vulnerabilities, and associated consequences) established by other components of the Department or other Federal agencies to avoid unnecessary duplication or waste. CommentsClose CommentsPermalink





‘(h) Sufficiency of Resources Plan- CommentsClose CommentsPermalink





‘(1) REPORT- Not later than 120 days after the date of enactment of this subtitle, the Director of the Office of Management and Budget shall submit to the appropriate committees of Congress and the Comptroller General of the United States a report on the resources and staff necessary to carry out fully the responsibilities under this subtitle. CommentsClose CommentsPermalink





‘(2) COMPTROLLER GENERAL REVIEW- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Comptroller General of the United States shall evaluate the reasonableness and adequacy of the report submitted by the Director under paragraph (1). CommentsClose CommentsPermalink





‘(B) REPORT- Not later than 60 days after the date on which the report is submitted under paragraph (1), the Comptroller General shall submit to the appropriate committees of Congress a report containing the findings of the review under subparagraph (A). CommentsClose CommentsPermalink





‘(i) Functions Transferred- There are transferred to the Center the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System, including all the functions, personnel, assets, authorities, and liabilities of the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System. CommentsClose CommentsPermalink





‘(j) Assistant to the Director for State, Local, and Private Sector Outreach- The Director shall identify a senior official in the Center who-- CommentsClose CommentsPermalink





‘(1) shall report directly to the Director; and CommentsClose CommentsPermalink





‘(2) in coordination with the Special Assistant to the Secretary appointed under section 102(f), shall-- CommentsClose CommentsPermalink





‘(A) advise the Director on policies and regulations, rules, requirements or other actions affecting the private sector, including the economic impact; CommentsClose CommentsPermalink





‘(B) work with individual businesses and other nongovernmental organizations to foster dialogue with the Center; CommentsClose CommentsPermalink





‘(C) foster partnerships and facilitate communication between the Center and State and local governments and private sector entities; CommentsClose CommentsPermalink





‘(D) coordinate and maintain communication and interaction with State and local governments and private sector entities on matters relating to the security of the Federal information infrastructure and the national information infrastructure; CommentsClose CommentsPermalink





‘(E) assist the Director in sharing best practices, guidelines, and other important information relating to the policies, goals, and activities of the Center; CommentsClose CommentsPermalink





‘(F) assist the Director in developing and implementing the national cybersecurity exercise program under subsection (f)(1)(X) as it relates to State and local governments and private sector entities; CommentsClose CommentsPermalink





‘(G) assist the Director in developing the national incident response plan under subsection (f)(1)(E) as it relates to State and local governments and private sector entities; CommentsClose CommentsPermalink





‘(H) assist the Director in information sharing activities of the Center as it relates to State and local governments and private sector entities; and CommentsClose CommentsPermalink





‘(I) perform any other duties, as directed by the Director. CommentsClose CommentsPermalink

‘SEC. 243. PHYSICAL AND CYBER INFRASTRUCTURE COLLABORATION.

‘(a) In General- The Director and the Assistant Secretary for Infrastructure Protection shall coordinate the information, communications, and physical infrastructure protection responsibilities and activities of the Center and the Office of Infrastructure Protection. CommentsClose CommentsPermalink





‘(b) Oversight- The Secretary shall ensure that the coordination described in subsection (a) occurs. CommentsClose CommentsPermalink

‘SEC. 244. UNITED STATES COMPUTER EMERGENCY READINESS TEAM.

‘(a) Establishment of Office- There is established within the Center, the United States Computer Emergency Readiness Team, which shall be headed by a Director, who shall be selected from the Senior Executive Service by the Secretary. CommentsClose CommentsPermalink





‘(b) Responsibilities- The US-CERT shall-- CommentsClose CommentsPermalink





‘(1) collect, coordinate, and disseminate information on-- CommentsClose CommentsPermalink





‘(A) risks to the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure; and CommentsClose CommentsPermalink





‘(B) security controls to enhance the security of the Federal information infrastructure or the national information infrastructure against the risks identified in subparagraph (A); and CommentsClose CommentsPermalink





‘(2) establish a mechanism for engagement with the private sector. CommentsClose CommentsPermalink





‘(c) Monitoring, Analysis, Warning, and Response- CommentsClose CommentsPermalink





‘(1) DUTIES- Subject to paragraph (2), the US-CERT shall-- CommentsClose CommentsPermalink





‘(A) provide analysis and reports to Federal agencies on the security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(B) provide continuous, automated monitoring of the Federal information infrastructure at external Internet access points, which shall include detection and warning of threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the information security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(C) warn Federal agencies of threats, vulnerabilities, incidents, and anomalous activities that could affect the Federal information infrastructure; CommentsClose CommentsPermalink





‘(D) develop, recommend, and deploy security controls to mitigate or remediate vulnerabilities; CommentsClose CommentsPermalink





‘(E) support Federal agencies in conducting risk assessments of the agency information infrastructure; CommentsClose CommentsPermalink





‘(F) disseminate to Federal agencies risk analyses of incidents that could impair the risk-based security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(G) develop and acquire predictive analytic tools to evaluate threats, vulnerabilities, traffic, trends, incidents, and anomalous activities; CommentsClose CommentsPermalink





‘(H) aid in the detection of, and warn owners or operators of national information infrastructure regarding, threats, vulnerabilities, and incidents, affecting the national information infrastructure, including providing-- CommentsClose CommentsPermalink





‘(i) timely, targeted, and actionable notifications of threats, vulnerabilities, and incidents; CommentsClose CommentsPermalink





and‘( ‘(ii) notifications under this subparagraph; and CommentsClose CommentsPermalink





‘(iii) recommended security controls to mitigate or remediate vulnerabilities; and CommentsClose CommentsPermalink





‘(I) respond to assistance requests from Federal agencies and, subject to the availability of resources, owners or operators of the national information infrastructure to-- CommentsClose CommentsPermalink





‘(i) isolate, mitigate, or remediate incidents; CommentsClose CommentsPermalink





‘(ii) recover from damages and mitigate or remediate vulnerabilities; and CommentsClose CommentsPermalink





‘(iii) evaluate security controls and other actions taken to secure information infrastructure and incorporate lessons learned into best practices, policies, principles, and guidelines. CommentsClose CommentsPermalink





‘(2) REQUIREMENT- With respect to the Federal information infrastructure, the US-CERT shall conduct the activities described in paragraph (1) in a manner consistent with the responsibilities of the head of a Federal agency described insection 3553 of title 44, United States Code. CommentsClose CommentsPermalink





‘(3) REPORT- Not later than 1 year after the date of enactment of this subtitle, and every year thereafter, the Secretary shall-- CommentsClose CommentsPermalink





‘(A) in conjunction with the Inspector General of the Department, conduct an independent audit or review of the activities of the US-CERT under paragraph (1)(B)), which shall include, at a minimum, an assessment of whether and to what extent the activities authorized under paragraph (1)(B) have monitored communications other than communications to or from a Federal agency; and CommentsClose CommentsPermalink





‘(B) submit to the appropriate committees of Congress and the President a report regarding the audit or reportview under subparagraph (A). CommentsClose CommentsPermalink





‘(4) CLASSIFIED ANNEX- A report submitted under paragraph (3) shall be submitted in an unclassified form, but may include a classified annex, if necessary. CommentsClose CommentsPermalink





‘(d) Procedures for Federal Government- Not later than 90 days after the date of enactment of this subtitle, the head of each Federal agency shall establish procedures for the Federal agency that ensure that the US-CERT can perform the functions described in subsection (c) in relation to the Federal agency. CommentsClose CommentsPermalink





‘(e) Operational Updates- The US-CERT shall provide unclassified and, as appropriate, classified updates regarding the composite security state of the Federal information infrastructure to the Federal Information Security Taskforce. CommentsClose CommentsPermalink





‘(f) Federal Points of Contact- The Director of the US-CERT shall designate a principal point of contact within the US-CERT for each Federal agency to-- CommentsClose CommentsPermalink





‘(1) maintain communication; CommentsClose CommentsPermalink





‘(2) ensure cooperative engagement and information sharing; and CommentsClose CommentsPermalink





‘(3) respond to inquiries or requests. CommentsClose CommentsPermalink





‘(g) Requests for Information or Physical Access- CommentsClose CommentsPermalink





‘(1) INFORMATION ACCESS- Upon request of the Director of the US-CERT, the head of a Federal agency or an Inspector General for a Federal agency shall provide any law enforcement information, intelligence information, terrorism information, or any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure or the national information infrastructure necessary to carry out the duties, responsibilities, and authorities under this subtitle. CommentsClose CommentsPermalink





‘(2) PHYSICAL ACCESS- Upon request of the Director, and in consultation with the head of a Federal agency, the Federal agency shall provide physical access to any facility of the Federal agency necessary to determine whether the Federal agency is in compliance with any policies, principles, and guidelines established by the Director under this subtitle, or otherwise necessary to carry out the duties, responsibilities, and authorities of the Director applicable to the Federal information infrastructure. CommentsClose CommentsPermalink

‘SEC. 245. ADDITIONAL AUTHORITIES OF THE DIRECTOR OF THE NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

‘(a) Access to Information- Unless otherwise directed by the President-- CommentsClose CommentsPermalink





‘(1) the Director shall access, receive, and analyze law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or national information infrastructure from Federal agencies and, consistent with applicable law, State and local governments (including law enforcement agencies), and private entities, including information provided by any contractor to a Federal agency regarding the security of the agency information infrastructure; CommentsClose CommentsPermalink





‘(2) any Federal agency in possession of law enforcement information, intelligence information, terrorism information, or any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or national information infrastructure shall provide that information to the Director in a timely manner; and CommentsClose CommentsPermalink





‘(3) the Director, in coordination with the Director of the Office of Management and Budget, the Attorney General, the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee), the Director of National Intelligence, and the Archivist of the United States, shall establish guidelines to ensure that information is transferred, stored, and preserved in accordance with applicable law and-- CommentsClose CommentsPermalink





‘(A) in accordance with applicable laws relating to the protection of trade secrets and other applicable laws; and CommentsClose CommentsPermalink





‘(B) in a manner that protects the privacy and civil liberties of United States persons and intelligence sources and methods. CommentsClose CommentsPermalink





‘(b) Operational Evaluations- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director-- CommentsClose CommentsPermalink





‘(A) subject to paragraph (2), shall develop, maintain, and enhance capabilities to evaluate the security of the Federal information infrastructure as described insection 3554(a)(3) of title 44, United States Code, including the ability to conduct risk-based penetration testing and vulnerability assessments; CommentsClose CommentsPermalink





‘(B) in carrying out subparagraph (A), may request technical assistance from the Director of the Federal Bureau of Investigation, the Director of the National Security Agency, the head of any other Federal agency that may provide support, and any nongovernmental entity contracting with the Department or another Federal agency; and CommentsClose CommentsPermalink





‘(C) in consultation with the Attorney General and the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee), shall develop guidelines to ensure compliance with all applicable laws relating to the privacy of United States persons in carrying out the operational evaluations under subparagraph (A). CommentsClose CommentsPermalink





‘(2) OPERATIONAL EVALUATIONS- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director may conduct risk-based operational evaluations of the agency information infrastructure of any Federal agency, at a time determined by the Director, in consultation with the head of the Federal agency, using the capabilities developed under paragraph (1)(A). CommentsClose CommentsPermalink





‘(B) ANNUAL EVALUATION REQUIREMENT- If the Director conducts an operational evaluation under subparagraph (A) or an operational evaluation at the request of a Federal agency to meet the requirements ofsection 3554 of title 44, United States Code, the operational evaluation shall satisfy the requirements of section 3554 for the Federal agency for the year of the evaluation, unless otherwise specified by the Director. CommentsClose CommentsPermalink





‘(c) Corrective Measures and Mitigation Plans- If the Director determines that a Federal agency is not in compliance with applicable policies, principles, standards, and guidelines applicable to the Federal information infrastructure-- CommentsClose CommentsPermalink





‘(1) the Director, in consultation with the Director of the Office of Management and Budget, may direct the head of the Federal agency to-- CommentsClose CommentsPermalink





‘(A) take corrective measures to meet the policies, principles, standards, and guidelines; and CommentsClose CommentsPermalink





‘(B) develop a plan to remediate or mitigate any vulnerabilities addressed by the policies, principles, standards, and guidelines; CommentsClose CommentsPermalink





‘(2) within such time period as the Director shall prescribe, the head of the Federal agency shall-- CommentsClose CommentsPermalink





‘(A) implement a corrective measure or develop a mitigation plan in accordance with paragraph (1); or CommentsClose CommentsPermalink





‘(B) submit to the Director, the Director of the Office of Management and Budget, the Inspector General for the Federal agency, and the appropriate committees of Congress a report indicating why the Federal agency has not implemented the corrective measure or developed a mitigation plan; and CommentsClose CommentsPermalink





‘(3) after providing notice to the head of the affected Federal agency, the Director may direct the isolation of any component of the agency information infrastructure, consistent with the contingency or continuity of operation plans applicable to the agency information infrastructure, until corrective measures are taken or mitigation plans approved by the Director are put in place, if-- CommentsClose CommentsPermalink





‘(A) the head of the Federal agency has failed to comply with the corrective measures prescribed under paragraph (1); and CommentsClose CommentsPermalink





‘(B) the failure to comply presents a significant danger to the Federal information infrastructure. CommentsClose CommentsPermalink

‘SEC. 246. INFORMATION SHARING.

‘(a) Federal Agencies- CommentsClose CommentsPermalink





‘(1) INFORMATION SHARING PROGRAM- Consistent with the responsibilities described in section 242 and 244, the Director, in consultation with the other members of the Chief Information Officers Council established undersection 3603 of title 44, United States Code, and the Federal Information Security Taskforce, shall establish a program for sharing information with and between the Center and other Federal agencies that includes processes and procedures, including standard operating procedures-- CommentsClose CommentsPermalink





‘(A) under which the Director regularly shares with each Federal agency-- CommentsClose CommentsPermalink





‘(i) analysis and reports on the composite security state of the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, which shall include information relating to threats, vulnerabilities, incidents, or anomalous activities; CommentsClose CommentsPermalink





‘(ii) any available analysis and reports regarding the security of the agency information infrastructure; and CommentsClose CommentsPermalink





‘(iii) means and methods of preventing, responding to, mitigating, and remediating vulnerabilities; and CommentsClose CommentsPermalink





‘(B) under which the Director may request information from Federal agencies concerning the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure necessary to carry out the duties of the Director under this subtitle or any other provision of law. CommentsClose CommentsPermalink





‘(2) CONTENTS- The program established under this section shall include-- CommentsClose CommentsPermalink





‘(A) timeframes for the sharing of information under paragraph (1); CommentsClose CommentsPermalink





‘(B) guidance on what information shall be shared, including information regarding incidents; CommentsClose CommentsPermalink





‘(C) a tiered structure that provides guidance for the sharing of urgent information; and CommentsClose CommentsPermalink





‘(D) processes and procedures under which the Director or the head of a Federal agency may report noncompliance with the program to the Director of Cyberspace Policy. CommentsClose CommentsPermalink





‘(3) US-CERT- The Director of the US-CERT shall ensure that the head of each Federal agency has continual access to data collected by the US-CERT regarding the agency information infrastructure of the Federal agency. CommentsClose CommentsPermalink





‘(4) FEDERAL AGENCIES- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The head of a Federal agency shall comply with all processes and procedures established under this subsection regarding notification to the Director relating to incidents. CommentsClose CommentsPermalink





‘(B) IMMEDIATE NOTIFICATION REQUIRED- Unless otherwise directed by the President, any Federal agency with a national security system shall immediately notify the Director regarding any incident affecting the risk-based security of the national security system. CommentsClose CommentsPermalink





‘(b) State and Local Governments, Private Sector, and International Partners- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director, shall establish processes and procedures, including standard operating procedures, to promotensure bidirectional information sharing with State and local governments, private entities, and international partners of the United States on-- CommentsClose CommentsPermalink





‘(A) threats, vulnerabilities, incidents, and anomalous activities affecting the national information infrastructure; and CommentsClose CommentsPermalink





‘(B) means and methods of preventing, responding to, and mitigating and remediating vulnerabilities. CommentsClose CommentsPermalink





‘(2) CONTENTS- The processes and procedures established under paragraph (1) shall include-- CommentsClose CommentsPermalink





‘(A) means or methods of accessing classified or unclassified information, as appropriate and in accordance with applicable laws regarding trade secrets, that will provide situational awareness of the security of the Federal information infrastructure and the national information infrastructure relating to threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the Federal information infrastructure or the national information infrastructure; CommentsClose CommentsPermalink





‘(B) a mechanism, established in consultation with the heads of the relevant sector-specific agencies, sector coordinating councils, and information sharing and analysis centers, by which owners and operators of covered critical infrastructure shall report incidents in the information infrastructure for covered critical infrastructure, to the extent the incident might indicate an actual or potential cyber vulnerability, or exploitation of that vulnerability; and‘(C under subsection (c)(1)(A); CommentsClose CommentsPermalink





‘(C) guidance on the form, content, and priority of incident reports that shall be submitted under subsection (c)(1)(A), which shall-- CommentsClose CommentsPermalink





‘(i) include appropriate mechanisms to protect-- CommentsClose CommentsPermalink





‘(I) information in accordance with section 251; CommentsClose CommentsPermalink





‘(II) personally identifiable information; and CommentsClose CommentsPermalink





‘(III) trade secrets; and CommentsClose CommentsPermalink





‘(ii) prioritize the reporting of incidents based on the risk the incident poses to the disruption of the reliable operation of the covered critical infrastructure; CommentsClose CommentsPermalink





‘(D) a procedure for notifying an information technology provider if a vulnerability is detected in the product or service produced by the information technology provider and, where possible, working with the information technology provider to remediate the vulnerability before any public disclosure of the vulnerability so as to minimize the opportunity for the vulnerability to be exploited; and CommentsClose CommentsPermalink





‘(E) an evaluation of the need to provide security clearances to employees of State and local governments, private entities, and international partners to carry out this subsection. CommentsClose CommentsPermalink





‘(3) GUIDELINES- The Director, in consultation with the Attorney General and the Director of National Intelligence, the Director of National Intelligence, and the Privacy Officer established under section 242(e), shall develop guidelines to protect the privacy and civil liberties of United States persons and intelligence sources and methods, while carrying out this subsection. CommentsClose CommentsPermalink





‘(c) Incidents- CommentsClose CommentsPermalink





‘(1) NON-FEDERAL ENTITIES- CommentsClose CommentsPermalink





‘(A) IN GENERAL- CommentsClose CommentsPermalink





‘(i) MANDATORY REPORTING- Subject to clause (ii), the owner or operator of covered critical infrastructure shall report any incident affecting the information infrastructure of covered critical infrastructure to the extent the incident might indicate an actual or potential cyber vulnerabilityrisk, or exploitation of a cyber vulnerabilityrisk, in accordance with the policies and procedures for the mechanism established under subsection (b)(2)(B) and guidelines developed under subsection (b)(3). CommentsClose CommentsPermalink





‘(ii) LIMITATION- Clause (i) shall not authorize the Director, the Center, the Department, or any other Federal entity to-- CommentsClose CommentsPermalink





‘(I) compel the disclosure of information relating to an incident unless otherwise authorized by law; or CommentsClose CommentsPermalink





‘(II) intercept a wire, oral, or electronic communication (as those terms are defined insection 2510 of title 18, United States Code), access a stored electronic or wire communication, install or use a pen register or trap and trace device, or conduct electronic surveillance (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C.1801)) relating to an incident unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), or any other provision of law. CommentsClose CommentsPermalink





‘(B) REPORTING PROCEDURES- The Director shall establish procedures that enable and encourage the owner or operator of national information infrastructure to report to the Director regarding incidents affecting such information infrastructure. CommentsClose CommentsPermalink





‘(2) INFORMATION PROTECTION- Notwithstanding any other provision of law, information reported under paragraph (1) shall be protected from unauthorized disclosure, in accordance with section 251. CommentsClose CommentsPermalink





‘(d) Additional Responsibilities- In accordance with section 251, tThe Director shall-- CommentsClose CommentsPermalink





‘(1) share data collected on the Federal information infrastructure with the National Science Foundation and other accredited research institutions for the sole purpose of cybersecurity research in a manner that protects privacy and civil liberties of United States persons and intelligence sources and methods; CommentsClose CommentsPermalink





‘(2) establish a website to provide an opportunity for the public to provide-- CommentsClose CommentsPermalink





‘(A) input about the operations of the Center; and CommentsClose CommentsPermalink





‘(B) recommendations for improvements of the Center; and CommentsClose CommentsPermalink





‘(3) in coordination with the Secretary of Defense, the Director of National Intelligence, the Secretary of State, and the Attorney General, develop information sharing pilot programs with international partners of the United States. CommentsClose CommentsPermalink

‘SEC. 247. PRIVATE SECTOR ASSISTANCE.

‘(a) In General- The Director, in consultation with the Director of the National Institute of Standards and Technology, the Director of the National Security Agency, the head of any relevant sector-specific agency, the National Cybersecurity Advisory Council, State and local governments, and any private entities the Director determines appropriate, shall establish a program to promote, and provide technical assistance authorized under section 242(f)(1)(S) relating to the implementation of, best practices and related standards and guidelines for securing the national information infrastructure, including the costs and benefits associated with the implementation of the best practices and related standards and guidelines. CommentsClose CommentsPermalink





‘(b) Analysis and Improvement of Standards and Guidelines- For purposes of the program established under subsection (a), the Director shall-- CommentsClose CommentsPermalink





‘(1) regularly assess and evaluate cybersecurity standards and guidelines issued by private sector organizations, recognized international and domestic standards setting organizations, and Federal agencies; and CommentsClose CommentsPermalink





‘(2) in coordination with the National Institute of Standards and Technology, encourage the development of, and recommend changes to, the standards and guidelines described in paragraph (1) for securing the national information infrastructure. CommentsClose CommentsPermalink





‘(c) Guidance and Technical Assistance- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director shall promote best practices and related standards and guidelines to assist owners and operators of national information infrastructure in increasing the security of the national information infrastructure and protecting against and mitigating or remediating known vulnerabilities. CommentsClose CommentsPermalink





‘(2) REQUIREMENT- Technical assistance provided under section 242(f)(1)(S) and best practices promoted under this section shall be prioritized based on risk. CommentsClose CommentsPermalink





‘(d) Criteria- In promoting best practices or recommending changes to standards and guidelines under this section, the Director shall ensure that best practices, and related standards and guidelines-- CommentsClose CommentsPermalink





‘(1) address cybersecurity in a comprehensive, risk-based manner; CommentsClose CommentsPermalink





‘(2) include consideration of the cost of implementing such best practices or of implementing recommended changes to standards and guidelines; CommentsClose CommentsPermalink





‘(3) increase the ability of the owners or operators of national information infrastructure to protect against and mitigate or remediate known vulnerabilities; CommentsClose CommentsPermalink





‘(4) are suitable, as appropriate, for implementation by small business concerns; CommentsClose CommentsPermalink





‘(5) as necessary and appropriate, are sector specific; CommentsClose CommentsPermalink





‘(6) to the maximum extent possible, incorporate standards and guidelines established by private sector organizations, recognized international and domestic standards setting organizations, and Federal agencies; CommentsClose CommentsPermalink





and‘(7 ‘(7) consider voluntary programs by internet service providers to assist individuals using the internet service providers in the identification and mitigation of cyber threats and vulnerabilities, with the consent of the individual users; and CommentsClose CommentsPermalink





‘(8) provide sufficient flexibility to permit a range of security solutions. CommentsClose CommentsPermalink

‘SEC. 248. CYBER VULNERABILITIERISKS TO COVERED CRITICAL INFRASTRUCTURE.

‘(a) Identification of Cyber VulnerabilitieRisks- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Based on the risk-based assessments conducted under section 242(f)(1)(T)(i), the Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, and in consultation with the National Cybersecurity Advisory Council and any private sector entity determined appropriate by the Director, shall, on a continuous and sector-by-sector basis, identify and evaluate the cyber vulnerabilitiesrisks to covered critical infrastructure. CommentsClose CommentsPermalink





‘(2) FACTORS TO BE CONSIDERED- In identifying and evaluating cyber vulnerabilitierisks under paragraph (1), the Director shall consider-- CommentsClose CommentsPermalink





‘(A) the perceivactual or assessed threat, including a consideration of adversary capabilities and intent, preparedness, target attractiveness, and deterrence capabilities; CommentsClose CommentsPermalink





‘(B) the potential extent and likelihood of death, injury, or serious adverse effects to human health and safety caused by a disruption of the reliable operation of covered critical infrastructure;‘(C) the reliable operation of covered critical infrastructure; CommentsClose CommentsPermalink





‘(C) the threat to or potential impact on national security caused by a disruption of the reliable operation of covered critical infrastructure; CommentsClose CommentsPermalink





‘(D) the extent to which the disruption of the reliable operation of covered critical infrastructure will disrupt the reliable operation of other covered critical infrastructure; CommentsClose CommentsPermalink





‘(E) the potential for harm to the economy that would result from a disruption of the reliable operation of covered critical infrastructure; and CommentsClose CommentsPermalink





‘(F) other risk-based security factors that the Director, in consultation with the head of the sector-specific agency with responsibility for the covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, determine to be appropriate and necessary to protect public health and safety, critical infrastructure, or national and economic security. CommentsClose CommentsPermalink





‘(3) REPORT- CommentsClose CommentsPermalink





‘(A) IN GENERAL- Not later than 180 days after the date of enactment of this subtitle, and annually thereafter, the Director, in coordination with the head of the sector-specific agency with responsibility for the covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall submit to the appropriate committees of Congress a report on the findings of the identification and evaluation of cyber vulnerabilitierisks under this subsection. Each report submitted under this paragraph shall be submitted in an unclassified form, but may include a classified annex. CommentsClose CommentsPermalink





‘(B) INPUT- For purposes of the reports required under subparagraph (A), the Director shall create a process under which owners and operators of covered critical infrastructure may provide input on the findings of the reports. CommentsClose CommentsPermalink





‘(b) Risk-Basedbased Security Performance Requirements- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Not later than 270 days after the date of the enactment of this subtitle, in coordination with the heads of the sector-specific agencies with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, and in consultation with the National Cybersecurity Advisory Council and any private sector entity determined appropriate by the Director, the Director shall issue interim final regulations establishing risk-based security performance requirements to secure covered critical infrastructure against cyber vulnerabilitiesrisks through the adoption of security measures that satisfy the security performance requirements identified by the Director. CommentsClose CommentsPermalink





‘(2) PROCEDURES- The regulations issued under this subsection shall-- CommentsClose CommentsPermalink





‘(A) include a process under which owners and operators of covered critical infrastructure are informed of identified cyber vulnerabilitierisks and security performance requirements designed to remediate or mitigate the cyber vulnerabilitierisks, in combination with best practices recommended under section 247; CommentsClose CommentsPermalink





‘(B) establish a process for owners and operators of covered critical infrastructure to select security measures, including any best practices recommended under section 247, that, in combination, satisfy the security performance requirements established by the Director under this subsection; CommentsClose CommentsPermalink





‘(C) establish a process for owners and operators of covered critical infrastructure to develop response plans for a national cyber emergency declared under section 249; CommentsClose CommentsPermalink





and‘(D) establish a process by‘(D) establish a process under which the Director-- CommentsClose CommentsPermalink





‘(i) is notified of the security measures selected by the owner or operator of covered critical infrastructure under subparagraph (B); and CommentsClose CommentsPermalink





‘(ii) may determine whether the proposed security measures satisfy the security performance requirements established by the Director under this subsection; and CommentsClose CommentsPermalink





‘(E) establish a process under which the Director-- CommentsClose CommentsPermalink





‘(i) identifies to owners and operators of covered critical infrastructure cyber risks that are not capable of effective remediation or mitigation using available best practices or security measures; CommentsClose CommentsPermalink





‘(ii) provides owners and operators of covered critical infrastructure the opportunity to develop best practices or security measures to remediate or mitigate the cyber risks identified in clause (i) without the prior approval of the Director and without affecting the compliance of the covered critical infrastructure with the requirements under this section; CommentsClose CommentsPermalink





‘(iii) in accordance with applicable law relating to the protection of trade secrets, permits owners and operators of covered critical infrastructure to report to the Center the development of effective best practices or security measures to remediate or mitigate the cyber risks identified under clause (i); and CommentsClose CommentsPermalink





‘(iv) incorporates the best practices and security measures developed into the risk-based security performance requirements under this section. CommentsClose CommentsPermalink





‘(3) INTERNATIONAL COOPERATION ON SECURING COVERED CRITICAL INFRASTRUCTURE- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall-- CommentsClose CommentsPermalink





‘(i) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of covered critical infrastructure that is information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States and the government of the country in which the covered critical infrastructure is located of any cyber vulnerabilities to the covered criticalinformation infrastructure is located of any cyber risks to the information infrastructure; and CommentsClose CommentsPermalink





‘(ii) coordinate with the government of the country in which the covered criticalinformation infrastructure is located and, as appropriate, the owner or operator of the covered criticalinformation infrastructure, regarding the implementation of security measures or other measures to the covered critical infrastructure to mitigate or remediate cyber vulnerabilities.‘(B)information infrastructure to mitigate or remediate cyber risks. CommentsClose CommentsPermalink





‘(B) INTERNATIONAL AGREEMENTS- The Director shall carry out the this paragraphis paragraph in a manner consistent with applicable international agreements. CommentsClose CommentsPermalink





‘(4) RISK-BASED SECURITY PERFORMANCE REQUIREMENTS- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The security performance requirements established by the Director under this subsection shall be-- CommentsClose CommentsPermalink





‘(i) based on the factors listed in subsection (a)(2); and CommentsClose CommentsPermalink





‘(ii) designed to remediate or mitigate identified cyber vulnerabilitierisks and any associated consequences of an exploitation based on such vulnerabilitierisks. CommentsClose CommentsPermalink





‘(B) CONSULTATION- In establishing security performance requirements under this subsection, the Director shall, to the maximum extent practicable, consult with-- CommentsClose CommentsPermalink





‘(i) the Director of the National Security Agency; CommentsClose CommentsPermalink





‘(ii) the Director of the National Institute of Standards and Technology; CommentsClose CommentsPermalink





‘(iii) the National Cybersecurity Advisory Council; CommentsClose CommentsPermalink





‘(iv) the heads of sector-specific agencies; and CommentsClose CommentsPermalink





‘(v) the heads of Federal agencies that are not a sector-specific agencysector-specific agencies with responsibilities for regulating the covered critical infrastructure. CommentsClose CommentsPermalink





‘(C) ALTERNATIVE MEASURES- CommentsClose CommentsPermalink





‘(i) IN GENERAL- The owners and operators of covered critical infrastructure shall have flexibility to implement any security measure, or combination thereof, to satisfy the security performance requirements described in subparagraph (A) and the Director may not disapprove under this section any proposed security measures, or combination thereof, based on the presence or absence of any particular security measure if the proposed security measures, or combination thereof, satisfy the security performance requirements established by the Director under this section or are consistent with the process for addressing new or evolving cyber risks established under paragraph (2)(E). CommentsClose CommentsPermalink





‘(ii) RECOMMENDED SECURITY MEASURES- The Director may recommend to an owner and operator of covered critical infrastructure a specific security measure, or combination thereof, that will satisfy the security performance requirements established by the Director. The absence of the recommended security measures, or combination thereof, may not serve as the basis for a disapproval of the security measure, or combination thereof, proposed by the owner or operator of covered critical infrastructure if the proposed security measure, or combination thereof, otherwise satisfies the security performance requirements established by the Director under this section. CommentsClose CommentsPermalink

‘SEC. 249. NATIONAL CYBER EMERGENCIES.

‘(a) Declaration- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The President may issue a declaration of a national cyber emergency to covered critical infrastructure if there is an ongoing or imminent action by any individual or entity to exploit a cyber risk in a manner that disrupts, attempts to disrupt, or poses a significant risk of disruption to the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure. Any declaration under this section shall specify the covered critical infrastructure subject to the national cyber emergency. CommentsClose CommentsPermalink





‘(2) NOTIFICATION- Upon issuing a declaration under paragraph (1), the President shall, consistent with the protection of intelligence sources and methods, notify the owners and operators of the specified covered critical infrastructure and any other relevant private sector entity of the nature of the national cyber emergency. CommentsClose CommentsPermalink





‘(3) AUTHORITIES- If the President issues a declaration under paragraph (1), the Director shall-- CommentsClose CommentsPermalink





‘(A) immediately direct the owners and operators of covered critical infrastructure subject to the declaration under paragraph (1) to implement response plans required under section 248(b)(2)(C); CommentsClose CommentsPermalink





‘(B) develop and coordinate emergency measures or actions necessary to preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of covered critical infrastructure; CommentsClose CommentsPermalink





‘(C) ensure that emergency measures or actions directed under this section represent the least disruptive means feasible to the operations of the covered critical infrastructure and to the national information infrastructure; CommentsClose CommentsPermalink





‘(D) subject to subsection (fg), direct actions by other Federal agencies to respond to the national cyber emergency; CommentsClose CommentsPermalink





‘(E) coordinate with officials of State and local governments, international partners of the United States, and private owners and operators of covered critical infrastructure specified in the declaration, and other relevant private section entities to respond to the national cyber emergency; CommentsClose CommentsPermalink





‘(F) initiate a process under section 248 to address the cyber vulnerability that may berisk that may be exploited by the national cyber emergency; and CommentsClose CommentsPermalink





‘(G) provide voluntary technical assistance, if requested, under section 242(f)(1)(S). CommentsClose CommentsPermalink





‘(4) REIMBURSEMENT- A Federal agency shall be reimbursed for expenditures under this section from funds appropriated for the purposes of this section. Any funds received by a Federal agency as reimbursement for services or supplies furnished under the authority of this section shall be deposited to the credit of the appropriation or appropriations available on the date of the deposit for the services or supplies. CommentsClose CommentsPermalink





‘(5) CONSULTATION- In carrying out this section, the Director shall consult with the Secretary, the Secretary of Defense, the Director of the National Security Agency, the Director of the National Institute of Standards and Technology, and any other official, as directed by the President. CommentsClose CommentsPermalink





‘(6) PROHIBITED ACTIONS- The authority to direct compliance with an emergency measure or action under this section shall not authorize the Director, the Center, the Department, or any other Federal entity to-- CommentsClose CommentsPermalink





‘(A) restrict or prohibit communications carried by, or over, covered critical infrastructure and not specifically directed to or from the covered critical infrastructure unless the Director determines that no other emergency measure or action will preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of the covered critical infrastructure or the national information infrastructure; CommentsClose CommentsPermalink





‘(B) control covered critical infrastructure; CommentsClose CommentsPermalink





‘(C) compel the disclosure of information unless specifically authorized by law; or CommentsClose CommentsPermalink





‘(D) intercept a wire, oral, or electronic communication (as those terms are defined insection 2510 of title 18, United States Code), access a stored electronic or wire communication, install or use a pen register or trap and trace device, or conduct electronic surveillance (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C.1801)) relating to an incident unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.). CommentsClose CommentsPermalink





‘(7) PRIVACY- In carrying out this section, the Director shall ensure that the privacy and civil liberties of United States persons are protected. CommentsClose CommentsPermalink





‘(b) Discontinuance of Emergency Measures- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Any emergency measure or action developed under this section shall cease to have effect not later than 30 days after the date on which the President issued the declaration of a national cyber emergency, unless-- CommentsClose CommentsPermalink





‘(A) the Director affirms in writing that the emergencydetails in writing why the emergency measure or action remains necessary to address the identified national cyber emergency; and CommentsClose CommentsPermalink





‘(B) the President issues a written order or directive reaffirming the national cyber emergency, the continuing nature of the national cyber emergency, or the need to continue the adoption of the emergency measure or action. CommentsClose CommentsPermalink





‘(2) EXTENSIONS- An emergency measure or action extended in accordance with paragraph (1) may-- CommentsClose CommentsPermalink





‘(A) remain in effect for not more than 30 days after the date on which the emergency measure or action was to cease to have effect; and CommentsClose CommentsPermalink





‘(B) be extended forunless a joint resolution described in subsection (f)(1) is enacted, be extended for not more than 3 additional 30-day periods, if the requirements of paragraph (1) and subsection (d) are met. CommentsClose CommentsPermalink





‘(c) Compliance With Emergency Measures- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Subject to paragraph (2), the owner or operator of covered critical infrastructure shall immediately comply with any emergency measure or action developed by the Director under this section during the pendency of any declaration by the President under subsection (a)(1) or an extension under subsection (b)(2). CommentsClose CommentsPermalink





‘(2) ALTERNATIVE MEASURES- CommentsClose CommentsPermalink





‘(A) IN GENERAL- If the Director determines that a proposed security measure, or any combination thereof, submitted by the owner or operator of covered critical infrastructure in accordance with the process established under section 248(b)(2) addresses the cyber vulnerabilitywill effectively mitigate or remediate the cyber risk associated with the national cyber emergency that is the subject of the declaration under this section, or effectively mitigate or remediate the consequences of the potential disruption of the covered critical infrastructure based on the cyber risk at least as effectively as the emergency measures or actions directed by the Director under this section, the owner or operator may comply with paragraph (1) of this subsection by implementing the proposed security measure, or combination thereof, approved by the Director under the process established under section 248. CommentsClose CommentsPermalink





‘(B) COMPLIANCE PENDING SUBMISSION OR APPROVAL- Before submission of a proposed security measure, or combination thereof, and during the pendency of any review by the Director under the process established under section 248, the owner or operator of covered critical infrastructure shall remain in compliance with any emergency measure or action developed by the Director under this section during the pendency of any declaration by the President under subsection (a)(1) or an extension under subsection (b)(2), until such time as the Director has approved an alternative proposed security measure, or combination thereof, under this paragraph. CommentsClose CommentsPermalink





‘(3) INTERNATIONAL COOPERATION ON NATIONAL CYBER EMERGENCIES- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall-- CommentsClose CommentsPermalink





‘(i) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of covered critical infrastructure that is information infrastructure located outside ofthe United States the disruption of which could result in national or regional catastrophic damage in the United States and the government of the country in which the covered critical infrastructure is located of any national cyber emergency affecting the covered critical infrastructureinformation infrastructure is located of any cyber risks to the information infrastructure that led to the declaration of a national cyber emergency; and CommentsClose CommentsPermalink





‘(ii) coordinate with the government of the country in which the covered criticalinformation infrastructure is located and, as appropriate, the owner or operator of the covered criticalinformation infrastructure, regarding the implementation of emergency measures or actions necessary to preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of the covered critical infrastructurecovered critical infrastructure that is the subject of the national cyber emergency. CommentsClose CommentsPermalink





‘(B) INTERNATIONAL AGREEMENTS- The Director shall carry out this paragraph in a manner consistent with applicable international agreements. CommentsClose CommentsPermalink





‘(4) LIMITATION ON COMPLIANCE AUTHORITY- The authority to direct compliance with an emergency measure or action under this section shall not authorize the Director, the Center, the Department, or any other Federal entity to compel the disclosure of information or conduct surveillance unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), or any other provision of law.

‘(d) Reporting- CommentsClose CommentsPermalink




‘(1) IN GENERAL- Except as provided in paragraph (2), the President shall ensure that any declaration under subsection (a)(1) or any extension under subsection (b)(2) is reported to the appropriate committees of Congress before the Director mandates any emergency measure or actions under subsection (a)(3). CommentsClose CommentsPermalink





‘(2) EXCEPTION- If notice cannot be given under paragraph (1) before mandating any emergency measure or actions under subsection (a)(3), the President shall provide the report required under paragraph (1) as soon as possible, along with a statement of the reasons for not providing notice in accordance with paragraph (1). CommentsClose CommentsPermalink





‘(3) CONTENTS- Each report under this subsection shall describe-- CommentsClose CommentsPermalink





‘(A) the nature of the national cyber emergency; CommentsClose CommentsPermalink





‘(B) the reasons that risk-based security requirements under section 248 are not sufficient to address the national cyber emergency; CommentsClose CommentsPermalink





and‘(C) the actions necessary to ‘(C) the actions necessary to preserve the reliable operation and mitigate the consequences of the potential disruption of covered critical infrastructure; and CommentsClose CommentsPermalink





‘(D) in the case of an extension of a national cyber emergency under subsection (b)(2)-- CommentsClose CommentsPermalink





‘(i) why the emergency measures or actions continue to be necessary to address the national cyber emergency; and CommentsClose CommentsPermalink





‘(ii) when the President expects the national cyber emergency to abate. CommentsClose CommentsPermalink





‘(e) Statutory Defenses and Civil Liability Limitations for Compliance With Emergency Measures- CommentsClose CommentsPermalink





‘(1) DEFINITIONS- In this subsection-- CommentsClose CommentsPermalink





‘(A) the term ‘covered civil action’-- CommentsClose CommentsPermalink





‘(i) means a civil action filed in a Federal or State court against a covered entity; and CommentsClose CommentsPermalink





‘(ii) does not include an action brought under section 2520 or 2707 of title 18, United States Code, or section 110 or 308 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1810 and 1828); CommentsClose CommentsPermalink





‘(B) the term ‘covered entity’ means any entity that owns or operates covered critical infrastructure, including any owner, operator, officer, employee, agent, landlord, custodian, provider of information technology, or other person acting for or on behalf of that entity with respect to the covered critical infrastructure; and CommentsClose CommentsPermalink





‘(C) the term ‘noneconomic damages’ means damages for losses for physical and emotional pain, suffering, inconvenience, physical impairment, mental anguish, disfigurement, loss of enjoyment of life, loss of society and companionship, loss of consortium, hedonic damages, injury to reputation, and any other nonpecuniary losses. CommentsClose CommentsPermalink





‘(2) APPLICATION OF LIMITATIONS ON CIVIL LIABILITY- The limitations on civil liability under paragraph (3) apply if-- CommentsClose CommentsPermalink





‘(A) the President has issued a declaration of national cyber emergency under subsection (a)(1); CommentsClose CommentsPermalink





‘(B) the Director has-- CommentsClose CommentsPermalink





‘(i) issued emergency measures or actions for which compliance is required under subsection (c)(1); or CommentsClose CommentsPermalink





‘(ii) approved security measures under subsection (c)(2); CommentsClose CommentsPermalink





‘(C) the covered entity is in compliance with-- CommentsClose CommentsPermalink





‘(i) the emergency measures or actions required under subsection (c)(1); or CommentsClose CommentsPermalink





‘(ii) security measures which the Director has approved under subsection (c)(2); and CommentsClose CommentsPermalink





‘(D)(i) the Director certifies to the court in which the covered civil action is pending that the actions taken by the covered entity during the period covered by the declaration under subsection (a)(1) were consistent with-- CommentsClose CommentsPermalink





‘(I) emergency measures or actions for which compliance is required under subsection (c)(1); or CommentsClose CommentsPermalink





‘(II) security measures which the Director has approved under subsection (c)(2); or CommentsClose CommentsPermalink





‘(ii) notwithstanding the lack of a certification, the covered entity demonstrates by a preponderance of the evidence that the actions taken during the period covered by the declaration under subsection (a)(1) are consistent with the implementation of-- CommentsClose CommentsPermalink





‘(I) emergency measures or actions for which compliance is required under subsection (c)(1); or CommentsClose CommentsPermalink





‘(II) security measures which the Director has approved under subsection (c)(2). CommentsClose CommentsPermalink





‘(3) LIMITATIONS ON CIVIL LIABILITY- In any covered civil action that is related to any incident associated with a cyber vulnerabilityrisk covered by a declaration of a national cyber emergency and for which Director has issued emergency measures or actions for which compliance is required under subsection (c)(1) or for which the Director has approved security measures under subsection (c)(2), or that is the direct consequence of actions taken in good faith for the purpose of implementing security measures or actions which the Director has approved under subsection (c)(2)-- CommentsClose CommentsPermalink





‘(A) the covered entity shall not be liable for any punitive damages intended to punish or deter, exemplary damages, or other damages not intended to compensate a plaintiff for actual losses; and CommentsClose CommentsPermalink





‘(B) noneconomic damages may be awarded against a defendant only in an amount directly proportional to the percentage of responsibility of such defendant for the harm to the plaintiff, and no plaintiff may recover noneconomic damages unless the plaintiff suffered physical harm. CommentsClose CommentsPermalink





‘(4) CIVIL ACTIONS ARISING OUT OF IMPLEMENTATION OF EMERGENCY MEASURES OR ACTIONS- A covered civil action may not be maintained against a covered entity that is the direct consequence of actions taken in good faith for the purpose of implementing specific emergency measures or actions for which compliance is required under subsection (c)(1), if-- CommentsClose CommentsPermalink





‘(A) the President has issued a declaration of national cyber emergency under subsection (a)(1) and the action was taken during the period covered by that declaration; CommentsClose CommentsPermalink





‘(B) the Director has issued emergency measures or actions for which compliance is required under subsection (c)(1) or that the Director has approved under subsection (c)(2); CommentsClose CommentsPermalink





‘(C) the covered entity is in compliance with the emergency measures required under subsection (c)(1) or that the Director has approved under subsection (c)(2); and CommentsClose CommentsPermalink





‘(D)(i) the Director certifies to the court in which the covered civil action is pending that the actions taken by the entity during the period covered by the declaration under subsection (a)(1) were consistent with the implementation of emergency measures or actions for which compliance is required under subsection (c)(1) or that the Director has approved under subsection (c)(2); or CommentsClose CommentsPermalink





‘(ii) notwithstanding the lack of a certification, the entity demonstrates by a preponderance of the evidence that the actions taken during the period covered by the declaration under subsection (a)(1) are consistent with the implementation of emergency measures or actions for which compliance is required under subsection (c)(1).‘(5) or that the Director has approved under subsection (c)(2). CommentsClose CommentsPermalink





‘(5) CERTAIN ACTIONS NOT SUBJECT TO LIMITATIONS ON LIABILITY- CommentsClose CommentsPermalink





‘(A) ADDITIONAL OR INTERVENING ACTS- Paragraphs (2) through (4) shall not apply to a civil action relating to any additional or intervening acts or omissions by any covered entity. CommentsClose CommentsPermalink





‘(B) SERIOUS OR SUBSTANTIAL DAMAGE- Paragraph (4) shall not apply to any civil action brought by an individual-- CommentsClose CommentsPermalink





‘(i) whose recovery is otherwise precluded by application of paragraph (4); and CommentsClose CommentsPermalink





‘(ii) who has suffered-- CommentsClose CommentsPermalink





‘(I) serious physical injury or death; or CommentsClose CommentsPermalink





‘(II) substantial damage or destruction to his primary residence. CommentsClose CommentsPermalink





‘(C) RULE OF CONSTRUCTION- Recovery available under subparagraph (B) shall be limited to those damages available under subparagraphs (A) and (B) of paragraph (3), except that neither reasonable and necessary medical benefits nor lifetime total benefits for lost employment income due to permanent and total disability shall be limited herein. CommentsClose CommentsPermalink





‘(D) INDEMNIFICATION- In any civil action brought under subparagraph (B), the United States shall defend and indemnify any covered entity. Any covered entity defended and indemnified under this subparagraph shall fully cooperate with the United States in the defense by the United States in any proceeding and shall be reimbursed the reasonable costs associated with such cooperation. CommentsClose CommentsPermalink





‘(f) Joint Resolution To Extend Cyber Emergency- CommentsClose CommentsPermalink





‘(1) IN GENERAL- For purposes of subsection (b)(2)(B), a joint resolution described in this paragraph means only a joint resolution-- CommentsClose CommentsPermalink





‘(A) the title of which is as follows: ‘Joint resolution approving the extension of a cyber emergency’; and CommentsClose CommentsPermalink





‘(B) the matter after the resolving clause of which is as follows: ‘That Congress approves the continuation of the emergency measure or action issued by the Director of the National Center for Cybersecurity and Communications on XXXXXXXXXXXX for not longer than an additional 120-day period.’, the blank space being filled in with the date on which the emergency measure or action to which the joint resolution applies was issued. CommentsClose CommentsPermalink





‘(2) PROCEDURE- CommentsClose CommentsPermalink





‘(A) NO REFERRAL- A joint resolution described in paragraph (1) shall not be referred to a committee in either House of Congress and shall immediately be placed on the calendar. CommentsClose CommentsPermalink





‘(B) CONSIDERATION- CommentsClose CommentsPermalink





‘(i) DEBATE LIMITATION- A motion to proceed to a joint resolution described in paragraph (1) is highly privileged in the House of Representatives and is privileged in the Senate and is not debatable. The motion is not subject to a motion to postpone. In the Senate, consideration of the joint resolution, and on all debatable motions and appeals in connection therewith, shall be limited to not more than 10 hours, which shall be divided equally between the majority leader and the minority leader, or their designees. A motion further to limit debate is in order and not debatable. All points of order against the joint resolution (and against consideration of the joint resolution) are waived. An amendment to, or a motion to postpone, or a motion to proceed to the consideration of other business, or a motion to recommit the joint resolution is not in order. CommentsClose CommentsPermalink





‘(ii) PASSAGE- In the Senate, immediately following the conclusion of the debate on a joint resolution described in paragraph (1), and a single quorum call at the conclusion of the debate if requested in accordance with the rules of the Senate, the vote on passage of the joint resolution shall occur. CommentsClose CommentsPermalink





‘(iii) APPEALS- Appeals from the decisions of the Chair relating to the application of the rules of the Senate to the procedure relating to a joint resolution described in paragraph (1) shall be decided without debate. CommentsClose CommentsPermalink





‘(C) OTHER HOUSE ACTS FIRST- If, before the passage by 1 House of a joint resolution of that House described in paragraph (1), that House receives from the other House a joint resolution described in paragraph (1)-- CommentsClose CommentsPermalink





‘(i) the procedure in that House shall be the same as if no joint resolution had been received from the other House; and CommentsClose CommentsPermalink





‘(ii) the vote on final passage shall be on the joint resolution of the other House. CommentsClose CommentsPermalink





‘(D) MAJORITY REQUIRED FOR ADOPTION- A joint resolution considered under this subsection shall require an affirmative vote of a majority of the Members, duly chosen and sworn, for adoption. CommentsClose CommentsPermalink





‘(3) RULEMAKING- This subsection is enacted by Congress-- CommentsClose CommentsPermalink





‘(A) as an exercise of the rulemaking power of the Senate and the House of Representatives, respectively, and is deemed to be part of the rules of each House, respectively but applicable only with respect to the procedure to be followed in that House in the case of a joint resolution described in paragraph (1), and it supersedes other rules only to the extent that it is inconsistent with such rules; and CommentsClose CommentsPermalink





‘(B) with full recognition of the constitutional right of either House to change the rules (so far as they relate to the procedure of that House) at any time, in the same manner, and to the same extent as in the case of any other rule of that House. CommentsClose CommentsPermalink





‘(g) Rule of Construction- Nothing in this section shall be construed to-- CommentsClose CommentsPermalink





‘(1) alter or supersede the authority of the Secretary of Defense, the Attorney General, or the Director of National Intelligence in responding to a national cyber emergency; or CommentsClose CommentsPermalink





‘(2) limit the authority of the Director under section 248, after a declaration issued under this section expires. CommentsClose CommentsPermalink

‘SEC. 250. ENFORCEMENT.

‘(a) Annual Certification of Compliance- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Not later than 6 months after the date on which the Director promulgates regulations under section 248(b), and every year thereafter, each owner or operator of covered critical infrastructure shall certify in writing to the Director whether the owner or operator has developed and implemented, or is implementing, security measures approved by the Director under section 248 and any applicable emergency measures or actions required under section 249 for any cyber vulnerabilitierisks and national cyber emergencies. CommentsClose CommentsPermalink





‘(2) FAILURE TO COMPLY- If an owner or operator of covered critical infrastructure fails to submit a certification in accordance with paragraph (1), or if the certification indicates the owner or operator is not in compliance, the Director may issue an order requiring the owner or operator to submit proposed security measures under section 248 or comply with specific emergency measures or actions under section 249. CommentsClose CommentsPermalink





‘(b) Risk-Bbased Evaluations- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Consistent with the factors described in paragraph (3), the Director may perform an evaluation of the information infrastructure of any specific system or asset constituting covered critical infrastructure to assess the validity of a certification of compliance submitted under subsection (a)(1). CommentsClose CommentsPermalink





‘(2) DOCUMENT REVIEW AND INSPECTION- An evaluation performed under paragraph (1) may include-- CommentsClose CommentsPermalink





‘(A) a review of all documentation submitted to justify an annual certification of compliance submitted under subsection (a)(1); and CommentsClose CommentsPermalink





‘(B) a physical or electronic inspection of relevant information infrastructure to which the security measures required under section 248 or the emergency measures or actions required under section 249 apply. CommentsClose CommentsPermalink





‘(3) EVALUATION SELECTION FACTORS- In determining whether sufficient risk exists to justify an evaluation under this subsection, the Director shall consider-- CommentsClose CommentsPermalink





‘(A) the specific cyber vulnerabilitierisks affecting or potentially affecting the information infrastructure of the specific system or asset constituting covered critical infrastructure; CommentsClose CommentsPermalink





‘(B) any reliable intelligence or other information indicating a cyber vulnerabilityrisk or credible national cyber emergency to the information infrastructure of the specific system or asset constituting covered critical infrastructure; CommentsClose CommentsPermalink





‘(C) actual knowledge or reasonable suspicion that the certification of compliance submitted by a specific owner or operator of covered critical infrastructure is false or otherwise inaccurate; CommentsClose CommentsPermalink





‘(D) a request by a specific owner or operator of covered critical infrastructure for such an evaluation; and CommentsClose CommentsPermalink





‘(E) such other risk-based factors as identified by the Director. CommentsClose CommentsPermalink





‘(4) SECTOR-SPECIFIC AGENCIES- To carry out the risk-based evaluation authorized under this subsection, the Director may use the resources of a sector-specific agency with responsibility for the covered critical infrastructure or any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure with the concurrence of the head of the agency. CommentsClose CommentsPermalink





‘(5) INFORMATION PROTECTION- Information provided to the Director during the course of an evaluation under this subsection shall be protected from disclosure in accordance with section 251. CommentsClose CommentsPermalink





‘(c) Civil Penalties- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Any person who violates section 248 or 249 shall be liable for a civil penalty. CommentsClose CommentsPermalink





‘(2) NO PRIVATE RIGHT OF ACTION- Nothing in this section confers upon any person, except the Director, a right of action against an owner or operator of covered critical infrastructure to enforce any provision of this subtitle. CommentsClose CommentsPermalink





‘(d) Limitation on Civil Liability- CommentsClose CommentsPermalink





‘(1) DEFINITION- In this subsection-- CommentsClose CommentsPermalink





‘(A) the term ‘covered civil action’-- CommentsClose CommentsPermalink





‘(i) means a civil action filed in a Federal or State court against a covered entity; and CommentsClose CommentsPermalink





‘(ii) does not include an action brought under section 2520 or 2707 of title 18, United States Code, or section 110 or 308 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1810 and 1828); CommentsClose CommentsPermalink





‘(B) the term ‘covered entity’ means any entity that owns or operates covered critical infrastructure, including any owner, operator, officer, employee, agent, landlord, custodian, provider of information technology, or other person acting for or on behalf of that entity with respect to the covered critical infrastructure; and CommentsClose CommentsPermalink





‘(C) the term ‘noneconomic damages’ means damages for losses for physical and emotional pain, suffering, inconvenience, physical impairment, mental anguish, disfigurement, loss of enjoyment of life, loss of society and companionship, loss of consortium, hedonic damages, injury to reputation, and any other nonpecuniary losses. CommentsClose CommentsPermalink





‘(2) LIMITATIONS ON CIVIL LIABILITY- If a covered entity experiences an incident related to a cyber vulnerability identified risk identified under section 248(a), in any covered civil action for damages directly caused by the incident related to that cyber vulnerabilityrisk-- CommentsClose CommentsPermalink





‘(A) the covered entity shall not be liable for any punitive damages intended to punish or deter, exemplary damages, or other damages not intended to compensate a plaintiff for actual losses; and CommentsClose CommentsPermalink





‘(B) noneconomic damages may be awarded against a defendant only in an amount directly proportional to the percentage of responsibility of such defendant for the harm to the plaintiff, and no plaintiff may recover noneconomic damages unless the plaintiff suffered physical harm. CommentsClose CommentsPermalink





‘(3) APPLICATION- This subsection shall apply to claims made by any individual or nongovernmental entity, including claims made by a State or local government agency on behalf of such individuals or nongovernmental entities, against a covered entity-- CommentsClose CommentsPermalink





‘(A) whose proposed security measures, or combination thereof, satisfy the security performance requirements established under subsection 248(b) and have been approved by the Director; CommentsClose CommentsPermalink





‘(B) that has been evaluated under subsection (b) and has been found by the Director to have implemented the proposed security measures approved under section 248; and CommentsClose CommentsPermalink





‘(C) that is in actual compliance with the approved security measures at the time of the incident related to that cyber vulnerability.‘(4) risk. CommentsClose CommentsPermalink





‘(4) LIMITATION- This subsection shall only apply to harm directly caused by the incident related to the cyber vulnerability and shall notrisk and shall not apply to damages caused by any additional or intervening acts or omissions by the covered entity. CommentsClose CommentsPermalink





‘(5) RULE OF CONSTRUCTION- Except as provided under paragraph (3), nothing in this subsection shall be construed to abrogate or limit any right, remedy, or authority that the Federal Government or any State or local government, or any entity or agency thereof, may possess under any law, or that any individual is authorized by law to bring on behalf of the government. CommentsClose CommentsPermalink





‘(e) Report to Congress- The Director shall submit an annual report to the appropriate committees of Congress on the implementation and enforcement of the risk-based performance requirements of covered critical infrastructure under subsection 248(b) and this section including-- CommentsClose CommentsPermalink





‘(1) the level of compliance of covered critical infrastructure with the risk-based security performance requirements issued under section 248(b); CommentsClose CommentsPermalink





‘(2) how frequently the evaluation authority under subsection (b) was utilized and a summary of the aggregate results of the evaluations; and CommentsClose CommentsPermalink





‘(3) any civil penalties imposed on covered critical infrastructure. CommentsClose CommentsPermalink

‘SEC. 251. PROTECTION OF INFORMATION.

‘(a) Definition- In this section, the term ‘covered information’-- CommentsClose CommentsPermalink





‘(1) means-- CommentsClose CommentsPermalink





‘(A) any information required to be submitted under sections 246, 248, and 249 to the Center by the owners and operators of covered critical infrastructure; and CommentsClose CommentsPermalink





‘(B) any information submitted to the Center under the processes and procedures established under section 246 by State and local governments, private entities, and international partners of the United States regarding threats, vulnerabilities, and incidents affecting-- CommentsClose CommentsPermalink





‘(i) the Federal information infrastructure; CommentsClose CommentsPermalink





‘(ii) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; or CommentsClose CommentsPermalink





‘(iii) the national information infrastructure; and CommentsClose CommentsPermalink





‘(2) shall not include any information described under paragraph (1), if that information is submitted to-- CommentsClose CommentsPermalink





‘(A) conceal violations of law, inefficiency, or administrative error; CommentsClose CommentsPermalink





‘(B) prevent embarrassment to a person, organization, or agency; or CommentsClose CommentsPermalink





‘(C) interfere with competition in the private sector. CommentsClose CommentsPermalink





‘(b) Voluntarily Shared Critical Infrastructure Information- Covered information submitted in accordance with this section shall be treated as voluntarily shared critical infrastructure information under section 214, except that the requirement of section 214 that the information be voluntarily submitted, including the requirement for an express statement, shall not be required for submissions of covered information. CommentsClose CommentsPermalink





‘(c) Guidelines- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Subject to paragraph (2), the Director shall develop and issue guidelines, in consultation with the Secretary, Attorney General, and the National Cybersecurity Advisory Council, as necessary to implement this section. CommentsClose CommentsPermalink





‘(2) REQUIREMENTS- The guidelines developed under this section shall-- CommentsClose CommentsPermalink





‘(A) consistent with section 214(e)(2)(D) and (g) and the guidelines developed under section 246(b)(3processes, procedures, and guidelines developed under section 246(b), include provisions for information sharing among Federal, State, and local and officials, private entities, or international partners of the United States necessary to carry out the authorities and responsibilities of the Director; CommentsClose CommentsPermalink





‘(B) be consistent, to the maximum extent possible, with policy guidance and implementation standards developed by the National Archives and Records Administration for controlled unclassified information, including with respect to marking, safeguarding, dissemination and dispute resolution; and CommentsClose CommentsPermalink





‘(C) describe, with as much detail as possible, the categories and type of information entities should voluntarily submit under subsections (b) and (c)(1)(B) of section 246. CommentsClose CommentsPermalink





‘(d) Process for Reporting Security Problems- CommentsClose CommentsPermalink





‘(1) ESTABLISHMENT OF PROCESS- The Director shall establish through regulation, and provide information to the public regarding, a process by which any person may submit a report to the Secretary regarding cybersecurity threats, vulnerabilities, and incidents affecting-- CommentsClose CommentsPermalink





‘(A) the Federal information infrastructure; CommentsClose CommentsPermalink





‘(B) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; or CommentsClose CommentsPermalink





‘(C) national information infrastructure. CommentsClose CommentsPermalink





‘(2) ACKNOWLEDGMENT OF RECEIPT- If a report submitted under paragraph (1) identifies the person making the report, the Director shall respond promptly to such person and acknowledge receipt of the report. CommentsClose CommentsPermalink





‘(3) STEPS TO ADDRESS PROBLEM- The Director shall review and consider the information provided in any report submitted under paragraph (1) and, at the sole, unreviewable discretion of the Director, determine what, if any, steps are necessary or appropriate to address any problems or deficiencies identified. CommentsClose CommentsPermalink





‘(4) DISCLOSURE OF IDENTITY- CommentsClose CommentsPermalink





‘(A) IN GENERAL- Except as provided in subparagraph (B), or with the written consent of the person, the Secretary may not disclose the identity of a person who has provided information described in paragraph (1). CommentsClose CommentsPermalink





‘(B) REFERRAL TO THE ATTORNEY GENERAL- The Secretary shall disclose to the Attorney General the identity of a person described under subparagraph (A) if the matter is referred to the Attorney General for enforcement. The Director shall provide reasonable advance notice to the affected person if disclosure of that person’s identity is to occur, unless such notice would risk compromising a criminal or civil enforcement investigation or proceeding. CommentsClose CommentsPermalink





‘(e) Rules of Construction- Nothing in this section shall be construed to-- CommentsClose CommentsPermalink





‘(1) limit or otherwise affect the right, ability, duty, or obligation of any entity to use or disclose any information of that entity, including in the conduct of any judicial or other proceeding; CommentsClose CommentsPermalink





‘(2) prevent the classification of information submitted under this section if that information meets the standards for classification under Executive Order 12958 or any successor of that order or affect measures and controls relating to the protection of classified information as prescribed by Federal statute or under Executive Order 12958, or any successor of that order; CommentsClose CommentsPermalink





‘(3) limit the right of an individual to make any disclosure-- CommentsClose CommentsPermalink





‘(A) protected or authorized under section 2302(b)(8) or 7211 of title 5, United States Code; CommentsClose CommentsPermalink





‘(B) to an appropriate official of information that the individual reasonably believes evidences a violation of any law, rule, or regulation, gross mismanagement, or substantial and specific danger to public health, safety, or security, and that is protected under any Federal or State law (other than those referenced in subparagraph (A)) that shields the disclosing individual against retaliation or discrimination for having made the disclosure if such disclosure is not specifically prohibited by law and if such information is not specifically required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs; or CommentsClose CommentsPermalink





‘(C) to the Special Counsel, the inspector general of an agency, or any other employee designated by the head of an agency to receive similar disclosures; CommentsClose CommentsPermalink





‘(4) prevent the Director from using information required to be submitted under sections 246, 248, or 249 for enforcement of this subtitle, including enforcement proceedings subject to appropriate safeguards; CommentsClose CommentsPermalink





‘(5) authorize information to be withheld from Congress, the Government Accountability Office, or Inspector General of the Department; CommentsClose CommentsPermalink





or‘(6 ‘(6) affect protections afforded to trade secrets under any other provision of law; or CommentsClose CommentsPermalink





‘(7) create a private right of action for enforcement of any provision of this section. CommentsClose CommentsPermalink





‘(f) Audit- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Not later than 1 year after the date of enactment of the Protecting Cyberspace as a National Asset Act of 2010, the Inspector General of the Department shall conduct an audit of the management of information submitted under subsection (b) and report the findings to appropriate committees of Congress. CommentsClose CommentsPermalink





‘(2) CONTENTS- The audit under paragraph (1) shall include assessments of-- CommentsClose CommentsPermalink





‘(A) whether the information is adequately safeguarded against inappropriate disclosure; CommentsClose CommentsPermalink





‘(B) the processes for marking and disseminating the information and resolving any disputes; CommentsClose CommentsPermalink





‘(C) how the information is used for the purposes of this section, and whether that use is effective; CommentsClose CommentsPermalink





‘(D) whether information sharing has been effective to fulfill the purposes of this section; CommentsClose CommentsPermalink





‘(E) whether the kinds of information submitted have been appropriate and useful, or overbroad or overnarrow; CommentsClose CommentsPermalink





‘(F) whether the information protections allow for adequate accountability and transparency of the regulatory, enforcement, and other aspects of implementing this subtitle; and CommentsClose CommentsPermalink





‘(G) any other factors at the discretion of the Inspector General. CommentsClose CommentsPermalink

‘SEC. 252. SECTOR-SPECIFIC AGENCIES.

‘(a) In General- The head of each sector-specific agency and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating covered critical infrastructure shall coordinate with the Director on any activities of the sector-specific agency or Federal agency that relate to the efforts of the agency regarding security or resiliency of the national information infrastructure, including critical infrastructure and covered critical infrastructure, within or under the supervision of the agency. CommentsClose CommentsPermalink





‘(b) Duplicative Reporting Requirements- The head of each sector-specific agency and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating covered critical infrastructure shall coordinate with the Director to eliminate and avoid the creation of duplicate reporting or compliance requirements relating to the security or resiliency of the national information infrastructure, including critical infrastructure and covered critical infrastructure, within or under the supervision of the agency. CommentsClose CommentsPermalink





‘(c) Requirements- CommentsClose CommentsPermalink





‘(1) IN GENERAL- To the extent that the head of each sector-specific agency and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating covered critical infrastructure has the authority to establish regulations, rules, or requirements or other required actions that are applicable to the security of national information infrastructure, including critical infrastructure and covered critical infrastructure, the head of that agency shall-- CommentsClose CommentsPermalink





‘(A) notify the Director in a timely fashion of the intent to establish the regulations, rules, requirements, or other required actions; CommentsClose CommentsPermalink





‘(B) coordinate with the Director to ensure that the regulations, rules, requirements, or other required actions are consistent with, and do not conflict or impede, the activities of the Director under sections 247, 248, and 249; and CommentsClose CommentsPermalink





‘(C) in coordination with the Director, ensure that the regulations, rules, requirements, or other required actions are implemented, as they relate to covered critical infrastructure, in accordance with subsection (a). CommentsClose CommentsPermalink





‘(2) COORDINATION- Coordination under paragraph (1)(B) shall include the active participation of the Director in the process for developing regulations, rules, requirements, or other required actions. CommentsClose CommentsPermalink





‘(3) RULE OF CONSTRUCTION- Nothing in this section shall be construed to provide additional authority for any sector-specific agency or any Federal agency that is not a sector-specific agency with responsibilities for regulating national information infrastructure, including critical infrastructure or covered critical infrastructure, to establish standards or other measures that are applicable to the security of national information infrastructure not otherwise authorized by law. CommentsClose CommentsPermalink

‘SEC. 253. STRATEGY FOR FEDERAL CYBERSECURITY SUPPLY CHAIN MANAGEMENT.

‘(a) In General- The Secretary, in consultation with the Director of Cyberspace Policy, the Director, the Secretary of Defense, the Secretary of Commerce, the Secretary of State, the Director of National Intelligence, the Administrator of General Services, the Administrator for Federal Procurement Policy, the other members of the Chief Information Officers Council established undersection 3603 of title 44, United States Code, the Chief Acquisition Officers Council established under section 16A of the Office of Federal Procurement Policy Act (41 U.S.C. 414b), the Chief Financial Officers Council established under section 302 of the Chief Financial Officers Act of 1990 (31 U.S.C. 901 note), and the private sector, shall develop, periodically update, and implement a supply chain risk management strategy designed to ensure, based on mission criticality and cost effectiveness, the security of the Federal information infrastructure, including protection against unauthorized access to, alteration of information in, disruption of operations of, interruption of communications or services of, and insertion of malicious software, engineering vulnerabilities, or otherwise corrupting software, hardware, services, or products intended for use in Federal information infrastructure. CommentsClose CommentsPermalink





‘(b) Contents- The supply chain risk management strategy developed under subsection (a) shall-- CommentsClose CommentsPermalink





‘(1) address risks in the supply chain during the entire life cycle of any part of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(2) place particular emphasis on-- CommentsClose CommentsPermalink





‘(A) securing critical information systems and the Federal information infrastructure; CommentsClose CommentsPermalink





‘(B) developing processes that-- CommentsClose CommentsPermalink





‘(i) incorporate all-source intelligence analysis into assessments of the supply chain for the Federal information infrastructure; CommentsClose CommentsPermalink





‘(ii) assess risks from potential suppliers providing critical components or services of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(iii) assess risks from individual components, including all subcomponents, or software used in or affecting the Federal information infrastructure; CommentsClose CommentsPermalink





‘(iv) manage the quality, configuration, and security of software, hardware, and systems of the Federal information infrastructure throughout the life cycle of the software, hardware, or system, including components or subcomponents from secondary and tertiary sources; CommentsClose CommentsPermalink





‘(v) detect the occurrence, reduce the likelihood of occurrence, and mitigate or remediate the risks associated with products containing counterfeit components or malicious functions; CommentsClose CommentsPermalink





‘(vi) enhance developmental and operational test and evaluation capabilities, including software vulnerability detection methods and automated methods and tools that shall be integrated into acquisition policy practices by Federal agencies and, where appropriate, make the capabilities available for use by the private sector; and CommentsClose CommentsPermalink





‘(vii) protect the intellectual property and trade secrets of suppliers of information and communications technology products and services; CommentsClose CommentsPermalink





‘(C) the use of internationally-recognized standards and standards developed by the private sector and developing a process, with the National Institute for Standards and Technology, to make recommendations for improvements of the standards; CommentsClose CommentsPermalink





‘(D) identifying acquisition practices of Federal agencies that increase risks in the supply chain and developing a process to provide recommendations for revisions to those processes; and CommentsClose CommentsPermalink





‘(E) sharing with the private sector, to the fullest extent possible, the threats identified in the supply chain and working with the private sector to develop responses to those threats as identified; and CommentsClose CommentsPermalink





‘(3) to the maximum extent practicable, promote the ability of Federal agencies to procure authentic commercial off the shelf information and communications technology products and services from a diverse pool of suppliers. CommentsClose CommentsPermalink





‘(c) Implementation- The Federal Acquisition Regulatory Council established under section 25(a) of the Office of Federal Procurement Policy Act (41 U.S.C. 421(a)) shall-- CommentsClose CommentsPermalink





‘(1) amend the Federal Acquisition Regulation issued under section 25 of that Act to-- CommentsClose CommentsPermalink





‘(A) incorporate, where relevant, the supply chain risk management strategy developed under subsection (a) to improve security throughout the acquisition process; and CommentsClose CommentsPermalink





‘(B) direct that all software and hardware purchased by the Federal Government shall comply with standards developed or be interoperable with automated tools approved by the National Institute of Standards and Technology, to continually enhance security; and CommentsClose CommentsPermalink





‘(2) develop a clause or set of clauses for inclusion in solicitations, contracts, and task and delivery orders that sets forth the responsibility of the contractor under the Federal Acquisition Regulation provisions implemented under this subsection. CommentsClose CommentsPermalink





‘(d) Preferences for Acquisition of Commercial Items- The strategy developed under this section, and any actions taken under subsection (c), shall be consistent with the preferences for the acquisition of commercial items undersection 2377 of title 10, United States Code, and section 314B of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 264b).’. CommentsClose CommentsPermalink

TITLE III--FEDERAL INFORMATION SECURITY MANAGEMENT CommentsClose CommentsPermalink

SEC. 301. COORDINATION OF FEDERAL INFORMATION POLICY.

(a) Findings- Congress finds that-- CommentsClose CommentsPermalink





(1) since 2002 the Federal Government has experienced multiple high-profile incidents that resulted in the theft of sensitive information amounting to more than the entire print collection contained in the Library of Congress, including personally identifiable information, advanced scientific research, and prenegotiated United States diplomatic positions; and CommentsClose CommentsPermalink





(2) chapter 35 of title 44, United States Code, must be amended to increase the coordination of Federal agency activities and to enhance situational awareness throughout the Federal Government using more effective enterprise-wide automated monitoring, detection, and response capabilities. CommentsClose CommentsPermalink





(b) In General- Chapter 35 of title 44, United States Code, is amended by striking subchapters II and III and inserting the following: CommentsClose CommentsPermalink

‘SUBCHAPTER II--INFORMATION SECURITY

‘Sec. 3550. Purposes

‘The purposes of this subchapter are to-- CommentsClose CommentsPermalink





‘(1) provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support the Federal information infrastructure and the operations and assets of agencies; CommentsClose CommentsPermalink





‘(2) recognize the highly networked nature of the current Federal information infrastructure and provide effective Government-wide management and oversight of the related information security risks, including coordination of information security efforts throughout the civilian, national security, and law enforcement communities; CommentsClose CommentsPermalink





‘(3) provide for development and maintenance of prioritized and risk-based security controls required to protect Federal information infrastructure and information systems; and CommentsClose CommentsPermalink





‘(4) provide a mechanism for improved oversight of Federal agency information security programs;. CommentsClose CommentsPermalink





‘(5) acknowledge that commercially developed information security products offer advanced, dynamic, robust, and effective information security solutions, reflecting market solutions for the protection of critical information infrastructures important to the national defense and economic security of the Nation that are designed, built, and operated by the private sector; and CommentsClose CommentsPermalink





‘(6) recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products. CommentsClose CommentsPermalink

‘Sec. 3551. Definitions

‘(a) In General- Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter. CommentsClose CommentsPermalink





‘(b) Additional Definitions- In this subchapter: CommentsClose CommentsPermalink





‘(1) The term ‘agency information infrastructure’-- CommentsClose CommentsPermalink





‘(A) means information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, an agency, including information systems used or operated by another entity on behalf of the agency; and CommentsClose CommentsPermalink





‘(B) does not include national security systems. CommentsClose CommentsPermalink





‘(2) The term ‘automated and continuous monitoring’ means monitoring at a frequency and sufficiency such that the data exchange requires little to no human involvement and is not interrupted; CommentsClose CommentsPermalink





‘(3) The term ‘incident’ means an occurrence that-- CommentsClose CommentsPermalink





‘(A) actually or potentialimminently jeopardizes-- CommentsClose CommentsPermalink





‘(i) the information security of an information system; or‘(ii) the information the system information infrastructure; or CommentsClose CommentsPermalink





‘(ii) the information that information infrastructure processes, stores, receives, or transmits; or CommentsClose CommentsPermalink





‘(B) constitutes a violation or threat of violation of security policies, security procedures, or acceptable use policies applicable to information infrastructure. CommentsClose CommentsPermalink





‘(4) The term ‘information infrastructure’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including programmable electronic devices and communications networks and any associated hardware, software, or data. CommentsClose CommentsPermalink





‘(5) The term ‘information security’ means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide-- CommentsClose CommentsPermalink





‘(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity; CommentsClose CommentsPermalink





‘(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and CommentsClose CommentsPermalink





‘(C) availability, by ensuring timely and reliable access to and use of information. CommentsClose CommentsPermalink





‘(6) The term ‘information technology’ has the meaning given that term in section 11101 of title 40. CommentsClose CommentsPermalink





‘(7) The term ‘management controls’ means safeguards or countermeasures for an information system that focus on the management of risk and the management of information system security. CommentsClose CommentsPermalink





‘(8)(A) The term ‘national security system’ means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency-- CommentsClose CommentsPermalink





‘(i) the function, operation, or use of which-- CommentsClose CommentsPermalink





‘(I) involves intelligence activities; CommentsClose CommentsPermalink





‘(II) involves cryptologic activities related to national security; CommentsClose CommentsPermalink





‘(III) involves command and control of military forces; CommentsClose CommentsPermalink





‘(IV) involves equipment that is an integral part of a weapon or weapons system; or CommentsClose CommentsPermalink





‘(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or CommentsClose CommentsPermalink





‘(ii) that is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy. CommentsClose CommentsPermalink





‘(B) Subparagraph (A)(i)(V) does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications). CommentsClose CommentsPermalink





‘(9) The term ‘operational controls’ means the safeguards and countermeasures for an information system that are primarily implemented and executed by individuals, not systems. CommentsClose CommentsPermalink





‘(10) The term ‘risk’ means the potential for an unwanted outcome resulting from an incident, as determined by the likelihood of the occurrence of the incident and the associated consequences, including potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident CommentsClose CommentsPermalink





.‘(11) The term ‘risk-based security’ means security commensurate with the risk and magnitude of harm resulting from the loss, misuse, or unauthorized access to, or modification, of information, including assuring that systems and applications used by the agency operate effectively and provide appropriate confidentiality, integrity, and availability. CommentsClose CommentsPermalink





‘(12) The term ‘security controls’ means the management, operational, and technical controls prescribed for an information system to protect the information security of the system. CommentsClose CommentsPermalink





‘(13) The term ‘technical controls’ means the safeguards or countermeasures for an information system that are primarily implemented and executed by the information system through mechanism contained in the hardware, software, or firmware components of the system. CommentsClose CommentsPermalink

‘Sec. 3552. Authority and functions of the National Center for Cybersecurity and Communications

‘(a) In General- The Director of the National Center for Cybersecurity and Communications shall-- CommentsClose CommentsPermalink





‘(1) develop, oversee the implementation of, and enforce policies, principles, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards developed under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) and subtitle E of title II of the Homeland Security Act of 2002; CommentsClose CommentsPermalink





‘(2) provide to agencies security controls that agencies shall be required to be implemented to mitigate and remediate vulnerabilities, attacks, and exploitations discovered as a result of activities required under this subchapter or subtitle E of title II of the Homeland Security Act of 2002; CommentsClose CommentsPermalink





‘(3) to the extent practicable-- CommentsClose CommentsPermalink





‘(A) prioritize the policies, principles, standards, and guidelines promulgated under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3), paragraph (1), and subtitle E of title II of the Homeland Security Act of 2002, based upon the risk of an incident; and CommentsClose CommentsPermalink





‘(B) develop guidance that requires agencies to monitor, including automated and continuous monitoring of, the effective implementation of policies, principles, standards, and guidelines developed under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3), paragraph (1), and subtitle E of title II of the Homeland Security Act of 2002; CommentsClose CommentsPermalink





‘(C) ensure the effective operation of technical capabilities within the National Center for Cybersecurity and Communications to enable automated and continuous monitoring of any information collected as a result of the guidance developed under subparagraph (B) and use the information to enhance the risk-based security of the Federal information infrastructure; and CommentsClose CommentsPermalink





‘(D) ensure the effective operation of a secure system that satisfies information reporting requirements under sections 3553(c) and 3556(c); CommentsClose CommentsPermalink





‘(4) require agencies, consistent with the standards developed under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) or paragraph (1) and the requirements of this subchapter, to identify and provide information security protections commensurate with the risk resulting from the disruption or unauthorized access, use, disclosure, modification, or destruction of-- CommentsClose CommentsPermalink





‘(A) information collected or maintained by or on behalf of an agency; or CommentsClose CommentsPermalink





‘(B) information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency; CommentsClose CommentsPermalink





‘(5) oversee agency compliance with the requirements of this subchapter, including coordinating with the Office of Management and Budget to use any authorized action under section 11303 of title 40 to enforce accountability for compliance with such requirements; CommentsClose CommentsPermalink





‘(6) review, at least annually, and approve or disapprove, agency information security programs required under section 3553(b); and CommentsClose CommentsPermalink





‘(7) coordinate information security policies and procedures with the Administrator for Electronic Government and the Administrator for the Office of Information and Regulatory Affairs with related information resources management policies and procedures. CommentsClose CommentsPermalink





‘(b) National Security Systems- The authorities of the Director of the National Center for Cybersecurity and Communications under this section shall not apply to national security systems. CommentsClose CommentsPermalink

‘Sec. 3553. Agency responsibilities

‘(a) In General- The head of each agency shall-- CommentsClose CommentsPermalink





‘(1) be responsible for-- CommentsClose CommentsPermalink





‘(A) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of-- CommentsClose CommentsPermalink





‘(i) information collected or maintained by or on behalf of the agency; and CommentsClose CommentsPermalink





‘(ii) agency information infrastructure; CommentsClose CommentsPermalink





‘(B) complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines, including-- CommentsClose CommentsPermalink





‘(i) information security requirements, including security controls, developed by the Director of the National Center for Cybersecurity and Communications under section 3552, subtitle E of title II of the Homeland Security Act of 2002, or any other provision of law; CommentsClose CommentsPermalink





‘(ii) information security policies, principles, standards, and guidelines promulgated under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) and section 3552(a)(1); CommentsClose CommentsPermalink





‘(iii) information security standards and guidelines for national security systems issued in accordance with law and as directed by the President; and CommentsClose CommentsPermalink





‘(iv) ensuring the standards implemented for information systems and national security systems of the agency are complementary and uniform, to the extent practicable; CommentsClose CommentsPermalink





‘(C) ensuring that information security management processes are integrated with agency strategic and operational planning and budget processes, including policies, procedures, and practices described in subsection (c)(1)(C); CommentsClose CommentsPermalink





‘(D) as appropriate, maintaining secure facilities that have the capability of accessing, sending, receiving, and storing classified information; CommentsClose CommentsPermalink





‘(E) maintaining a sufficient number of personnel with security clearances, at the appropriate levels, to access, send, receive and analyze classified information to carry out the responsibilities of this subchapter; and CommentsClose CommentsPermalink





‘(F) ensuring that information security performance indicators and measures are included in the annual performance evaluations of all managers, senior managers, senior executive service personnel, and political appointees; CommentsClose CommentsPermalink





‘(2) ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under the control of those officials, including through-- CommentsClose CommentsPermalink





‘(A) assessing the risk and magnitude of the harm that could result from the disruption or unauthorized access, use, disclosure, modification, or destruction of such information or information systems; CommentsClose CommentsPermalink





‘(B) determining the levels of information security appropriate to protect such information and information systems in accordance with policies, principles, standards, and guidelines promulgated under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3), section 3552(a)(1), and subtitle E of title II of the Homeland Security Act of 2002, for information security categorizations and related requirements; CommentsClose CommentsPermalink





‘(C) implementing policies and procedures to cost effectively reduce risks to an acceptable level; CommentsClose CommentsPermalink





‘(D) periodically testing and evaluating information security controls and techniques to ensure that such controls and techniques are operating effectively; and CommentsClose CommentsPermalink





‘(E) withholding all bonus and cash awards to senior agency officials accountable for the operation of such agency information infrastructure that are recognized by the Chief Information Security Officer as impairing the risk-based security information, information system, or agency information infrastructure; CommentsClose CommentsPermalink





‘(3) delegate to a senior agency officer designated as the Chief Information Security Officer the authority and budget necessary to ensure and enforce compliance with the requirements imposed on the agency under this subchapter, subtitle E of title II of the Homeland Security Act of 2002, or any other provision of law, including-- CommentsClose CommentsPermalink





‘(A) overseeing the establishment, maintenance, and management of a security operations center that has technical capabilities that can, through automated and continuous monitoring-- CommentsClose CommentsPermalink





‘(i) detect, report, respond to, contain, remediate, and mitigate incidents that impair risk-based security of the information, information systems, and agency information infrastructure, in accordance with policy provided by the Director of the National Center for Cybersecurity and Communications; CommentsClose CommentsPermalink





‘(ii) monitor and, on a risk-based basis, mitigate and remediate the vulnerabilities of every information system within the agency information infrastructure; CommentsClose CommentsPermalink





‘(iii) continually evaluate risks posed to information collected or maintained by or on behalf of the agency and information systems and hold senior agency officials accountable for ensuring the risk-based security of such information and information systems; CommentsClose CommentsPermalink





‘(iv) collaborate with the National Center for Cybersecurity and Communications and appropriateDirector of the National Center for Cybersecurity and Communications and appropriate public and private sector security operations centers to address incidents that impact the security of information and information systems that extend beyond the control of the agency; and CommentsClose CommentsPermalink





‘(v) report any incident described under clauses (i) and (ii), as directed by the policy of the National Center for Cybersecurity and Communications orDirector of the National Center for Cybersecurity and Communications and the Inspector General of the agency; CommentsClose CommentsPermalink





‘(B) collaborating with the Administrator for E-Government and the Chief Information Officer to establish, maintain, and update an enterprise network, system, storage, and security architecture, that can be accessed by the National Cybersecurity Communications Center and includes-- CommentsClose CommentsPermalink





‘(i) information on how security controls are implemented throughout the agency information infrastructure; and CommentsClose CommentsPermalink





‘(ii) information on how the controls described under subparagraph (A) maintain the appropriate level of confidentiality, integrity, and availability of information and information systems based on-- CommentsClose CommentsPermalink





‘(I) the policy of the Director of the National Center for Cybersecurity and Communications; and CommentsClose CommentsPermalink





‘(II) the standards or guidance developed by the National Institute of Standards and Technology; CommentsClose CommentsPermalink





‘(C) developing, maintaining, and overseeing an agency-wide information security program as required by subsection (b); CommentsClose CommentsPermalink





‘(D) developing, maintaining, and overseeing information security policies, procedures, and control techniques to address all applicable requirements, including those issued under section 3552; CommentsClose CommentsPermalink





‘(E) training, consistent with the requirements of section 406 of the Protecting Cyberspace as a National Asset Act of 2010, and overseeing personnel with significant responsibilities for information security with respect to such responsibilities; and CommentsClose CommentsPermalink





‘(F) assisting senior agency officers concerning their responsibilities under paragraph (2); CommentsClose CommentsPermalink





‘(4) ensure that the Chief Information Security Officer has a sufficient number of cleared and trained personnel with technical skills identified by the National Center for CybersecurityDirector of the National Center for Cybersecurity and Communications as critical to maintaining the risk-based security of agency information infrastructure as required by the subchapter and other applicable laws; CommentsClose CommentsPermalink





‘(5) ensure that the agency Chief Information Security Officer, in coordination with appropriate senior agency officials, reports not less than annually to the head of the agency on the effectiveness of the agency information security program, including progress of remedial actions; CommentsClose CommentsPermalink





‘(6) ensure that the Chief Information Security Officer-- CommentsClose CommentsPermalink





‘(A) possesses necessary qualifications, including education, professional certifications, training, experience, and the security clearance required to administer the functions described under this subchapter; and CommentsClose CommentsPermalink





‘(B) has information security duties as the primary duty of that officer; and CommentsClose CommentsPermalink





‘(7) ensure that components of that agency establish and maintain an automated reporting mechanism that allows the Chief Information Security Officer with responsibility for the entire agency, and all components thereof, to implement, monitor, and hold senior agency officers accountable for the implementation of appropriate security policies, procedures, and controls of agency components. CommentsClose CommentsPermalink





‘(b) Agency-Wwide Information Security Program- Each agency shall develop, document, and implement an agency-wide information security program, approved by the Director of the National Center for Cybersecurity and Communications under section 3552(a)(6) and consistent with components across and within agencies, to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source, that includes-- CommentsClose CommentsPermalink





‘(1) frequent assessments, at least twice each month-- CommentsClose CommentsPermalink





‘(A) of the risk and magnitude of the harm that could result from the disruption or unauthorized access, use, disclosure, modification, or destruction of information and information systems that support the operations and assets of the agency; and CommentsClose CommentsPermalink





‘(B) that assess whether information or information systems should be removed or migrated to more secure networks or standards and make recommendations to the head of the agency and the Director of the National Center for Cybersecurity and Communications based on that assessment; CommentsClose CommentsPermalink





‘(2) consistent with guidance developed under section 3554, vulnerability assessments and penetration tests commensurate with the risk posed to an agency information infrastructure; CommentsClose CommentsPermalink





‘(3) ensure that information security vulnerabilities are remediated or mitigated based on the risk posed to the agency; CommentsClose CommentsPermalink





‘(4) policies and procedures that-- CommentsClose CommentsPermalink





‘(A) are informed and revised by the assessments required under paragraphs (1) and (2); CommentsClose CommentsPermalink





‘(B) cost effectively reduce information security risks to an acceptable level; CommentsClose CommentsPermalink





‘(C) ensure that information security is addressed throughout the life cycle of each agency information system; and CommentsClose CommentsPermalink





‘(D) ensure compliance with-- CommentsClose CommentsPermalink





‘(i) the requirements of this subchapter; CommentsClose CommentsPermalink





‘(ii) policies and procedures prescribed by the Director of the National Center for Cybersecurity and Communications; CommentsClose CommentsPermalink





‘(iii) minimally acceptable system configuration requirements, as determined by the Director of the National Center for Cybersecurity and Communications; and CommentsClose CommentsPermalink





‘(iv) any other applicable requirements, including standards and guidelines for national security systems issued in accordance with law and as directed by the President; CommentsClose CommentsPermalink





‘(5) subordinate plans for providing risk-based information security for networks, facilities, and systems or groups of information systems, as appropriate; CommentsClose CommentsPermalink





‘(6) role-based security awareness training, consistent with the requirements of section 406 of the Protecting Cyberspace as a National Asset Act of 2010, to inform personnel with access to the agency network, including contractors and other users of information systems that support the operations and assets of the agency, of-- CommentsClose CommentsPermalink





‘(A) information security risks associated with agency activities; and CommentsClose CommentsPermalink





‘(B) agency responsibilities in complying with agency policies and procedures designed to reduce those risks; CommentsClose CommentsPermalink





‘(7) periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a rigor and frequency depending on risk, which shall include-- CommentsClose CommentsPermalink





‘(A) testing and evaluation not less than twice each year of security controls of information collected or maintained by or on behalf of the agency and every information system identified in the inventory required under section 3505(c); CommentsClose CommentsPermalink





‘(B) the effectiveness of ongoing monitoring, including automated and continuous monitoring, vulnerability scanning, and intrusion detection and prevention of incidents posed to the risk-based security of information and information systems as required under subsection (a)(3); and CommentsClose CommentsPermalink





‘(C) testing relied on in-- CommentsClose CommentsPermalink





‘(i) an operational evaluation under section 3554; CommentsClose CommentsPermalink





‘(ii) an independent assessment under section 3556; or CommentsClose CommentsPermalink





‘(iii) another evaluation, to the extent specified by the Director of the National Center for Cybersecurity and Communications; CommentsClose CommentsPermalink





‘(8) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; CommentsClose CommentsPermalink





‘(9) procedures for detecting, reporting, and responding to incidents, consistent with requirements issued under section 3552, that include-- CommentsClose CommentsPermalink





‘(A) to the extent practicable, automated and continuous monitoring of the use of information and information systems; CommentsClose CommentsPermalink





‘(B) requirements for mitigating risks and remediating vulnerabilities associated with such incidents systemically within the agency information infrastructure before substantial damage is done; and CommentsClose CommentsPermalink





‘(C) notifying and coordinating with the Director of the National Center for Cybersecurity and Communications, as required by this subchapter, subtitle E of title II of the Homeland Security Act of 2002, and any other provision of law; and CommentsClose CommentsPermalink





‘(10) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. CommentsClose CommentsPermalink





‘(c) Agency Reporting- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Each agency shall-- CommentsClose CommentsPermalink





‘(A) ensure that information relating to the adequacy and effectiveness of information security policies, procedures, and practices, is available to the entities identified under paragraph (2) through the system developed under section 3552(a)(3), including information relating to-- CommentsClose CommentsPermalink





‘(i) compliance with the requirements of this subchapter; CommentsClose CommentsPermalink





‘(ii) the effectiveness of the information security policies, procedures, and practices of the agency based on a determination of the aggregate effect of identified deficiencies and vulnerabilities; CommentsClose CommentsPermalink





‘(iii) an identification and analysis of any significant deficiencies identified in such policies, procedures, and practices; CommentsClose CommentsPermalink





‘(iv) an identification of any vulnerability that could impair the risk-based security of the agency information infrastructure; and CommentsClose CommentsPermalink





‘(v) results of any operational evaluation conducted under section 3554 and plans of action to address the deficiencies and vulnerabilities identified as a result of such operational evaluation; CommentsClose CommentsPermalink





‘(B) follow the policy, guidance, and standards of the Director of the National Center for Cybersecurity and Communications, in consultation with the Federal Information Security Taskforce, to continually update, and ensure the electronic availability of both a classified and unclassified version of the information required under subparagraph (A); CommentsClose CommentsPermalink





‘(C) ensure the information under subparagraph (A) addresses the adequacy and effectiveness of information security policies, procedures, and practices in plans and reports relating to-- CommentsClose CommentsPermalink





‘(i) annual agency budgets; CommentsClose CommentsPermalink





‘(ii) information resources management of this subchapter; CommentsClose CommentsPermalink





‘(iii) information technology management and procurement under this chapter or any other applicable provision of law; CommentsClose CommentsPermalink





‘(iv) subtitle E of title II of the Homeland Security Act of 2002; CommentsClose CommentsPermalink





‘(v) program performance under sections 1105 and 1115 through 1119 of title 31, and sections 2801 and 2805 of title 39; CommentsClose CommentsPermalink





‘(vi) financial management under chapter 9 of title 31, and the Chief Financial Officers Act of 1990 (31 U.S.C. 501 note; Public Law 101-576) (and the amendments made by that Act); CommentsClose CommentsPermalink





‘(vii) financial management systems under the Federal Financial Management Improvement Act (31 U.S.C. 3512 note); CommentsClose CommentsPermalink





‘(viii) internal accounting and administrative controls under section 3512 of title 31; and CommentsClose CommentsPermalink





‘(ix) performance ratings, salaries, and bonuses provided to the senior managers and supporting personnel taking into account program performance as it relates to complying with this subchapter; and CommentsClose CommentsPermalink





‘(D) report any significant deficiency in a policy, procedure, or practice identified under subparagraph (A) or (B)-- CommentsClose CommentsPermalink





‘(i) as a material weakness in reporting under section 3512 of title 31; and CommentsClose CommentsPermalink





‘(ii) if relating to financial management systems, as an instance of a lack of substantial compliance under the Federal Financial Management Improvement Act (31 U.S.C. 3512 note). CommentsClose CommentsPermalink





‘(2) ADEQUACY AND EFFECTIVENESS INFORMATION- Information required under paragraph (1)(A) shall, to the extent possible and in accordance with applicable law, policy, guidance, and standards, be available on an automated and continuous basis to-- CommentsClose CommentsPermalink





‘(A) the National Center for Cybersecurity and Communications;‘(BDirector of the National Center for Cybersecurity and Communications; CommentsClose CommentsPermalink





‘(B) the Office of Management and Budget; CommentsClose CommentsPermalink





‘(C) the Committee on Homeland Security and Governmental Affairs of the Senate; CommentsClose CommentsPermalink





‘(CD) the Committee on Government Oversight and Reform of the House of Representatives; CommentsClose CommentsPermalink





‘(DE) the Committee on Homeland Security of the House of Representatives; CommentsClose CommentsPermalink





‘(EF) other appropriate authorization and appropriations committees of Congress; CommentsClose CommentsPermalink





‘(FG) the Inspector General of the Federal agency; and CommentsClose CommentsPermalink





‘(GH) the Comptroller General. CommentsClose CommentsPermalink





‘(d) Inclusions in Performance Plans- CommentsClose CommentsPermalink





‘(1) IN GENERAL- In addition to the requirements of subsection (c), each agency, in consultation with the Director of the National Center for Cybersecurity and Communications, shall include as part of the performance plan required under section 1115 of title 31 a description of the time periods the resources, including budget, staffing, and training, that are necessary to implement the program required under subsection (b). CommentsClose CommentsPermalink





‘(2) RISK ASSESSMENTS- The description under paragraph (1) shall be based on the risk and vulnerability assessments required under subsection (b) and evaluations required under section 3554. CommentsClose CommentsPermalink





‘(e) Notice and Comment- Each agency shall provide the public with timely notice and opportunities for comment on proposed information security policies and procedures to the extent that such policies and procedures affect communication with the public. CommentsClose CommentsPermalink





‘(f) More Stringent Standards- The head of an agency may employ standards for the cost effective information security for information systems within or under the supervision of that agency that are more stringent than the standards the Director of the National Center for Cybersecurity and Communications prescribes under this subchapter, subtitle E of title II of the Homeland Security Act of 2002, or any other provision of law, if the more stringent standards-- CommentsClose CommentsPermalink





‘(1) contain at least the applicable standards made compulsory and binding by the Director of the National Center for Cybersecurity and Communications; and CommentsClose CommentsPermalink





‘(2) are otherwise consistent with policies and guidelines issued under section 3552. CommentsClose CommentsPermalink

‘Sec. 3554. Annual operational evaluation

‘(a) Guidance- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Each yearNot later than 1 year after the date of enactment of the Protecting Cyberspace as a National Asset Act of 2010 and each year thereafter, the Director of the National Center for Cybersecurity and Communications shall oversee, coordinate, and develop guidance for the effective implementation of operational evaluations of the Federal information infrastructure and agency information security programs and practices to determine the effectiveness of such program and practices. CommentsClose CommentsPermalink





‘(2) COLLABORATION IN DEVELOPMENT- In developing guidance for the operational evaluations described under this section, the National Center for Cybersecurity and Communications shall Director of the National Center for Cybersecurity and Communications shall collaborate with the Federal Information Security Taskforce and the Council of Inspectors General on Integrity and Efficiency, and other agencies as necessary, to develop and update risk-based performance indicators and measures that assess the adequacy and effectiveness of information security of an agency and the Federal information infrastructure. CommentsClose CommentsPermalink





‘(3) CONTENTS OF OPERATIONAL EVALUATION- Each operational evaluation under this section-- CommentsClose CommentsPermalink





‘(A) shall be prioritized based on risk; and CommentsClose CommentsPermalink





‘(B) shall-- CommentsClose CommentsPermalink





‘(i) test the effectiveness of agency information security policies, procedures, and practices of the information systems of the agency, or a representative subset of those information systems; CommentsClose CommentsPermalink





‘(ii) assess (based on the results of the testing) compliance with-- CommentsClose CommentsPermalink





‘(I) the requirements of this subchapter; and CommentsClose CommentsPermalink





‘(II) related information security policies, procedures, standards, and guidelines; CommentsClose CommentsPermalink





‘(iii) evaluate whether agencies-- CommentsClose CommentsPermalink





‘(I) effectively monitor, detect, analyze, protect, report, and respond to vulnerabilities and incidents; CommentsClose CommentsPermalink





‘(II) report to and collaborate with the appropriate public and private security operation centers, the Director of the National Center for Cybersecurity and Communications, and law enforcement agencies; and CommentsClose CommentsPermalink





‘(III) remediate or mitigate the risk posed by attacks and exploitations in a timely fashion in order to prevent future vulnerabilities and incidents; and CommentsClose CommentsPermalink





‘(iv) identify deficiencies of agency information security policies, procedures, and controls on the agency information infrastructure. CommentsClose CommentsPermalink





‘(b) Conduct an Operational Evaluation- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Except as provided under paragraph (2), and in consultation with the Chief Information Officer and senior officials responsible for the affected systems, the Chief Information Security Officer of each agency shall not less than annually-- CommentsClose CommentsPermalink





‘(A) conduct an operational evaluation of the agency information infrastructure for vulnerabilities, attacks, and exploitations of the agency information infrastructure; CommentsClose CommentsPermalink





‘(B) evaluate the ability of the agency to monitor, detect, correlate, analyze, report, and respond to incidents; and CommentsClose CommentsPermalink





‘(C) report to the head of the agency, the Director of the National Center for Cybersecurity and Communications, the Chief Information Officer, and the Inspector General for the agency the findings of the operational evaluation. CommentsClose CommentsPermalink





‘(2) SATISFACTION OF REQUIREMENTS BY OTHER EVALUATION- Unless otherwise specified by the Director of the National Center for Cybersecurity and Communications, if the Director of the National Center for Cybersecurity and Communications conducts an operational evaluation of the agency information infrastructure under section 245(b)(2)(A) of the Homeland Security Act of 2002, the Chief Information Security Officer may deem the requirements of paragraph (1) satisfied for the year in which the operational evaluation described under this paragraph is conducted. CommentsClose CommentsPermalink





‘(c) Corrective Measures Mitigation and Remediation Plans- CommentsClose CommentsPermalink





‘(1) IN GENERAL- In consultation with the National Center for Cybersecurity and Communications and the Chief InformationDirector of the National Center for Cybersecurity and Communications and the Chief Information Officer, Chief Information Security Officers shall remediate or mitigate vulnerabilities in accordance with this subsection. CommentsClose CommentsPermalink





‘(2) RISK-BASED PLAN- After an operational evaluation is conducted under this section or under section 245(b) of the Homeland Security Act of 2002, the agency shall submit to the Director of the National Center for Cybersecurity and Communications in a timely fashion a risk-based plan for addressing recommendations and mitigating and remediating vulnerabilities identified as a result of such operational evaluation, including a timeline and budget for implementing such plan. CommentsClose CommentsPermalink





‘(3) APPROVAL OR DISAPPROVAL- Not later than 15 days after receiving a plan submitted under paragraph (2), the National Center for Cybersecurity and Communications shall--‘(A) Director of the National Center for Cybersecurity and Communications shall-- CommentsClose CommentsPermalink





‘(A) approve or disprove the agency plan; and CommentsClose CommentsPermalink





‘(B) comment on the adequacy and effectiveness of the plan. CommentsClose CommentsPermalink





‘(4) ISOLATION FROM INFRASTRUCTURE- CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director of the National Center for Cybersecurity and Communications may, consistent with the contingency or continuity of operation plans applicable to such agency information infrastructure, order the isolation of any component of the Federal information infrastructure from any other Federal information infrastructure, if-- CommentsClose CommentsPermalink





‘(i) an agency does not implement measures in a risk-based plan approved under this subsection; and CommentsClose CommentsPermalink





‘(ii) the failure to comply presents a significant danger to the Federal information infrastructure. CommentsClose CommentsPermalink





‘(B) DURATION- An isolation under subparagraph (A) shall remain in effect until-- CommentsClose CommentsPermalink





‘(i) the Director of the National Center for Cybersecurity and Communications determines that corrective measures have been implemented; or CommentsClose CommentsPermalink





‘(ii) an updated risk-based plan is approved by the Director of the National Center for Cybersecurity and Communications and implemented by the agency. CommentsClose CommentsPermalink





‘(d) Operational Guidance- The Director of the National Center for Cybersecurity and Communications shall-- CommentsClose CommentsPermalink





‘(1) not later than 180 days after the date of enactment of the Protecting Cyberspace as a National Asset Act of 2010, develop operational guidance for operational evaluations as required under this section that are risk-based and cost effective; and CommentsClose CommentsPermalink





‘(2) periodically evaluate and ensure information is available on an automated and continuous basis through the system required under section 3552(a)(3)(D) to Congress on-- CommentsClose CommentsPermalink





‘(A) the adequacy and effectiveness of the operational evaluations conducted under this section or section 245(b) of the Homeland Security Act of 2002; and CommentsClose CommentsPermalink





‘(B) possible executive and legislative actions for cost-effectively managing the risks to the Federal information infrastructure. CommentsClose CommentsPermalink

‘Sec. 3555. Federal Information Security Taskforce

‘(a) Establishment- There is established in the executive branch a Federal Information Security Taskforce. CommentsClose CommentsPermalink





‘(b) Membership- The members of the Federal Information Security Taskforce shall be full-time senior Government employees and shall be as follows: CommentsClose CommentsPermalink





‘(1) The Director of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘(2) The Administrator of the Office of Electronic Government of the Office of Management and Budget. CommentsClose CommentsPermalink





‘(3) The Chief Information Security Officer of each agency described under section 901(b) of title 31. CommentsClose CommentsPermalink





‘(4) The Chief Information Security Officer of the Department of the Army, the Department of the Navy, and the Department of the Air Force. CommentsClose CommentsPermalink





‘(5) A representative from the Office of Cyberspace Policy. CommentsClose CommentsPermalink





‘(6) A representative from the Office of the Director of National Intelligence. CommentsClose CommentsPermalink





‘(7) A representative from the United States Cyber Command. CommentsClose CommentsPermalink





‘(8) A representative from the National Security Agency. CommentsClose CommentsPermalink





‘(9) A representative from the United States Computer Emergency Readiness Team. CommentsClose CommentsPermalink





‘(10) A representative from the Intelligence Community Incident Response Center. CommentsClose CommentsPermalink





‘(11) A representative from the Committee on National Security Systems. CommentsClose CommentsPermalink





‘(12) A representative from the National Institute for Standards and Technology. CommentsClose CommentsPermalink





‘(13) A representative from the Council of Inspectors General on Integrity and Efficiency. CommentsClose CommentsPermalink





‘(14) A representative from State and local government. CommentsClose CommentsPermalink





‘(15) Any other officer or employee of the United States designated by the chairperson. CommentsClose CommentsPermalink





‘(c) Chairperson and Vice-Cchairperson- CommentsClose CommentsPermalink





‘(1) CHAIRPERSON- The Director of the National Center for Cybersecurity and Communications shall act as chairperson of the Federal Information Security Taskforce. CommentsClose CommentsPermalink





‘(2) VICE-CHAIRPERSON- The vice chairperson of the Federal Information Security Taskforce shall-- CommentsClose CommentsPermalink





‘(A) be selected by the Federal Information Security Taskforce from among its members; CommentsClose CommentsPermalink





‘(B) serve a 1-year term and may serve multiple terms; and CommentsClose CommentsPermalink





‘(C) serve as a liaison to the Chief Information Officer, Council of the Inspectors General on Integrity and Efficiency, Committee on National Security Systems, and other councils or committees as appointed by the chairperson. CommentsClose CommentsPermalink





‘(d) Functions- The Federal Information Security Taskforce shall-- CommentsClose CommentsPermalink





‘(1) be the principal interagency forum for collaboration regarding best practices and recommendations for agency information security and the security of the Federal information infrastructure; CommentsClose CommentsPermalink





‘(2) assist in the development of and annually evaluate guidance to fulfill the requirements under sections 3554 and 3556; CommentsClose CommentsPermalink





‘(3) share experiences and innovative approaches relating to threats against the Federal information infrastructure, information sharing and information security best practices, penetration testing regimes, and incident response, mitigation, and remediation; CommentsClose CommentsPermalink





‘(4) promote the development and use of standard performance indicators and measures for agency information security that-- CommentsClose CommentsPermalink





‘(A) are outcome-based; CommentsClose CommentsPermalink





‘(B) focus on risk management; CommentsClose CommentsPermalink





‘(C) align with the business and program goals of the agency; CommentsClose CommentsPermalink





‘(D) measure improvements in the agency security posture over time; and CommentsClose CommentsPermalink





‘(E) reduce burdensome and inefficient performance indicators and measures; CommentsClose CommentsPermalink





‘(5) recommend to the Office of Personnel Management the necessary qualifications to be established for Chief Information Security Officers to be capable of administering the functions described under this subchapter including education, training, and experience; CommentsClose CommentsPermalink





‘(6) enhance information system processes by establishing a prioritized baseline of information security measures and controls that can be continuously monitored through automated mechanisms; and CommentsClose CommentsPermalink





‘(7) evaluate the effectiveness and efficiency of any reporting and compliance requirements that are required by law related to the information security of Federal information infrastructure; and CommentsClose CommentsPermalink





‘(8) submit proposed enhancements developed under paragraphs (1) through (7) to the Director of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘(e) Termination- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Except as provided under paragraph (2), the Federal Information Security Taskforce shall terminate 4 years after the date of enactment of the Protecting Cyberspace as a National Asset Act of 2010. CommentsClose CommentsPermalink





‘(2) EXTENSION- The President may-- CommentsClose CommentsPermalink





‘(A) extend the Federal Information Security Taskforce by executive order; and CommentsClose CommentsPermalink





‘(B) make more than 1 extension under this paragraph for any period as the President may determine. CommentsClose CommentsPermalink

‘Sec. 3556. Independent Assessments

‘(a) In General- CommentsClose CommentsPermalink





‘(1) INSPECTORS GENERAL ASSESSMENTS- Not less than every 2 years, each agency with an Inspector General appointed under the Inspector General Act of 1978 (5 U.S.C. App.) or any other law shall assess the adequacy and effectiveness of the information security program developed under section 3553(b) and (c), and evaluations conducted under section 3554. CommentsClose CommentsPermalink





‘(2) INDEPENDENT ASSESSMENTS- For each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the assessment. CommentsClose CommentsPermalink





‘(b) Standards- The assessments required under subsection (a) shall be performed in accordance with standards developed by the Government Accountability Office, in collaboration with the Council of Inspectors General on Integrity and Efficiency and with assistance from the Federal Information Security Taskforce. CommentsClose CommentsPermalink





‘(c) Existing Assessments- The assessments required byunder this section may be based in whole or in part on an audit, evaluation, or report relating to programs or practices of the applicable agency. CommentsClose CommentsPermalink





‘(c) Inspectors General Reporting- Inspectorsd) Reporting of Information- CommentsClose CommentsPermalink





‘(1) INSPECTORS GENERAL REPORTING- Each Inspector General shall ensure information obtained as a result of the assessment required under this section, or any other relevant information, is -- CommentsClose CommentsPermalink





‘(A) provided to the head of the agency, the agency Chief Information Security Officer, and the agency Chief Information Officer; and CommentsClose CommentsPermalink





‘(B) available through the system required under section 3552(a)(3)(D) to Congress and the National Center for Cybersecurity and CommunicationsDirector of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘(2) HEADS OF AGENCIES REPORTING- If an assessment described under subsection (a)(2) is performed, the head of the agency shall comply with the requirements of paragraph (1)(A) and (B). CommentsClose CommentsPermalink

‘Sec. 3557. Protection of Information

‘In complying with this subchapter, agencies, evaluators, and Inspectors General shall take appropriate actions to ensure the protection of information which, if disclosed, may adversely affect information security. Protections under this chapter shall be commensurate with the risk and comply with all applicable laws and regulations. CommentsClose CommentsPermalink

‘Sec. 3558. Department of Defense and Central Intelligence Agency systems

‘(a) In General- The authorities of the Director of the National Center for Cybersecurity and Communications under this subchapter shall be delegated to-- CommentsClose CommentsPermalink





‘(1) the Secretary of Defense in the case of systems described under subsection (b); and CommentsClose CommentsPermalink





‘(2) the Director of the Central Intelligence Agency in the case of systems described under subsection (c). CommentsClose CommentsPermalink





‘(b) Department of Defense Systems- The systems described under this subsection are systems that are operated by the Department of Defense, a contractor of the Department of Defense, or another entity on behalf of the Department of Defense that processes any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Department of Defense. CommentsClose CommentsPermalink





‘(c) Central Intelligence Agency Systems- The systems described under this subsection are systems that are operated by the Central Intelligence Agency, a contractor of the Central Intelligence Agency, or another entity on behalf of the Central Intelligence Agency that processes any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Central Intelligence Agency.’. CommentsClose CommentsPermalink





(c) Technical and Conforming Amendments- CommentsClose CommentsPermalink





(1) TABLE OF SECTIONS- The table of sections for chapter 35 of title 44, United States Code, is amended by striking the matter relating to subchapters II and III and inserting the following: CommentsClose CommentsPermalink

‘subchapter ii--information security

‘3550. Purposes. CommentsClose CommentsPermalink





‘3551. Definitions. CommentsClose CommentsPermalink





‘3552. Authority and functions of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘3553. Agency responsibilities. CommentsClose CommentsPermalink





‘3554. Annual operational evaluation. CommentsClose CommentsPermalink





‘3555. Federal Information Security Taskforce. CommentsClose CommentsPermalink





‘3556. Independent assessments. CommentsClose CommentsPermalink





‘3557. Protection of information. CommentsClose CommentsPermalink





‘3558. Department of Defense and Central Intelligence Agency systems.’. CommentsClose CommentsPermalink





(2) OTHER REFERENCES- CommentsClose CommentsPermalink





(A) Section 1001(c)(1)(A) of the Homeland Security Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended by striking ‘section 3532(3)’ and inserting ‘section 3551(b)’. CommentsClose CommentsPermalink





(B)Section 2222(j)(6) of title 10, United States Code, is amended by striking ‘section 3542(b)(2))’ and inserting ‘section 3551(b)’. CommentsClose CommentsPermalink





(C)Section 2223(c)(3) of title 10, United States Code, is amended, by striking ‘section 3542(b)(2))’ and inserting ‘section 3551(b)’. CommentsClose CommentsPermalink





(D)Section 2315 of title 10, United States Code, is amended by striking ‘section 3542(b)(2))’ and inserting ‘section 3551(b)’. CommentsClose CommentsPermalink





(E) Section 20(a)(2) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) is amended by striking ‘section 3532(b)(2)’ and inserting ‘section 3551(b)’. CommentsClose CommentsPermalink





(F) Section 21(b)(2) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-4(b)(2)) is amended by striking ‘Institute and’ and inserting ‘Institute, the Director of the National Center on Cybersecurity and Communications, and’. CommentsClose CommentsPermalink





(G) Section 21(b)(3) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-4(b)(3)) is amended by inserting ‘the Director of the National Center on Cybersecurity and Communications,’ after ‘the Director of the National Security Agency,’. CommentsClose CommentsPermalink





(H) Section 8(d)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7406(d)(1)) is amended by striking ‘section 3534(b)’ and inserting ‘section 3553(b)’. CommentsClose CommentsPermalink





(3) HOMELAND SECURITY ACT OF 2002- CommentsClose CommentsPermalink





(A) TITLE X- The Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended by striking title X. CommentsClose CommentsPermalink





(B) TABLE OF CONTENTS- The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended by striking the matter relating to title X. CommentsClose CommentsPermalink





(d) Repeal of Other Standards- CommentsClose CommentsPermalink





(1) IN GENERAL-Section 11331 of title 40, United States Code, is repealed. CommentsClose CommentsPermalink





(2) TECHNICAL AND CONFORMING AMENDMENTS- CommentsClose CommentsPermalink





(A) Section 20(c)(3) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(c)(3)) is amended by striking ‘under section 11331 of title 40, United States Code’. CommentsClose CommentsPermalink





(B) Section 20(d)(1) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(d)(1)) is amended by striking ‘the Director of the Office of Management and Budget for promulgation under section 11331 of title 40, United States Code’ and inserting ‘the Secretary of Commerce for promulgation’. CommentsClose CommentsPermalink





(C)Section 11302(d) of title 40, United States Code, is amended by striking ‘under section 11331 of this title and’. CommentsClose CommentsPermalink





(D) Section 1874A (e)(2)(A)(ii) of the Social Security Act (42 U.S.C.1395kk-1 (e)(2)(A)(ii)) is amended by striking ‘section 11331 of title 40, United States Code’ and inserting ‘section 3552 of title 44, United States Code’. CommentsClose CommentsPermalink





(E)Section 3504(g)(2) of title 44, United States Code, is amended by striking ‘section 11331 of title 40’ and inserting ‘section 3552 of title 44’. CommentsClose CommentsPermalink





(F)Section 3504(h)(1) of title 44, United States Code, is amended by inserting ‘, the Director of the National Center for Cybersecurity and Communications,’ after ‘the National Institute of Standards and Technology’. CommentsClose CommentsPermalink





(G)Section 3504(h)(1)(B) of title 44, United States Code, is amended by striking ‘under section 11331 of title 40’ and inserting ‘section 3552 of title 44’. CommentsClose CommentsPermalink





(H)Section 3518(d) of title 44, United States Code, is amended by striking ‘sections 11331 and 11332’ and inserting ‘section 11332’. CommentsClose CommentsPermalink





(I)Section 3602(f)(8) of title 44, United States Code, is amended by striking ‘under section 11331 of title 40. CommentsClose CommentsPermalink





(J)Section 3603(f)(5) of title 44, United States Code, is amended by striking ‘and promulgated under section 11331 of title 40,’. CommentsClose CommentsPermalink

TITLE IV--RECRUITMENT AND PROFESSIONAL DEVELOPMENT CommentsClose CommentsPermalink

SEC. 401. DEFINITIONS.

In this title: CommentsClose CommentsPermalink





(1) CYBERSECURITY MISSION- The term ‘cybersecurity mission’ means the activities of the Federal Government that encompass the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as such activities relate to the security and stability of cyberspace. CommentsClose CommentsPermalink





(2) FEDERAL AGENCY’S CYBERSECURITY MISSION- The term ‘Federal agency’s cybersecurity mission’ means, with respect to any Federal agency, the portion of the cybersecurity mission that is the responsibility of the Federal agency. CommentsClose CommentsPermalink

SEC. 402. ASSESSMENT OF CYBERSECURITY WORKFORCE.

(a) In General- The Director of the Office of Personnel Management and the Director shall assess the readiness and capacity of the Federal workforce to meet the needs of the cybersecurity mission of the Federal Government. CommentsClose CommentsPermalink





(b) Strategy- CommentsClose CommentsPermalink





(1) IN GENERAL- Not later than 180 days after the date of enactment of this Act, the Director of the Office of Personnel Management shall develop and implementThe Director of the Office of Personnel Management, in consultation with the Director and the Director of the Office of Management and Budget, shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of Federal cybersecurity personnel. CommentsClose CommentsPermalink





(2) CONTENTS- The strategy developed under paragraph (1) shall include-- CommentsClose CommentsPermalink





(A) a 5-year plan on recruitment of personnel for the Federal workforce; and CommentsClose CommentsPermalink





(B) 10-year and 20-year projections of workforce needs. CommentsClose CommentsPermalink





(3) DATES FOR COMPLETION- The strategy under this subsection shall be-- CommentsClose CommentsPermalink





(A) completed not later than 180 days after the date of enactment of this Act; and CommentsClose CommentsPermalink





(B) updated as needed. CommentsClose CommentsPermalink

SEC. 403. STRATEGIC CYBERSECURITY WORKFORCE PLANNING.

(a) Federal Agency Development of Strategic Cybersecurity Workforce Plans- Not later than 180 days after the date of enactment of this Act and in every subsequent year, and subject to subsection (c)(2), the head of each Federal agency shall develop a strategic cybersecurity workforce plan as part of the Federal agency performance plan required undersection 1115 of title 31, United States Code. CommentsClose CommentsPermalink





(b) Interagency CoordinationBasis and Guidance for Plans- Each Federal agency shall develop a plan prepared under subsection (a)--(1) on the basis of the assessment developed under section 402 and any subsequent guidance fromissued by the Director of the Office of Personnel Management and the Director; and(2), in consultation with the Director and the Director of the Office of Management and Budget. CommentsClose CommentsPermalink





(c) Contents of the Plan- CommentsClose CommentsPermalink





(1) IN GENERAL- ESubject to paragraph (2), each plan prepared under subsection (a) shall include-- CommentsClose CommentsPermalink





(A) a description of the Federal agency’s cybersecurity mission; CommentsClose CommentsPermalink





(B) subject to paragraph (2), a description and analysis, relating to the specialized workforce needed by the Federal agency to fulfill the Federal agency’s cybersecurity mission, including-- CommentsClose CommentsPermalink





(i) the workforce needs of the Federal agency on the date of the report, and 10-year and 20-year projections of workforce needs; CommentsClose CommentsPermalink





(ii) hiring projections to meet workforce needs, including, for at least a 2-year period, specific occupation and grade levels; CommentsClose CommentsPermalink





(iii) long-term and short-term strategic goals to address critical skills deficiencies, including analysis of the numbers of and reasons for attrition of employees; CommentsClose CommentsPermalink





(iv) recruitment strategies, including the use of student internships, part-time employment, student loan reimbursement, and telework, to attract highly qualified candidates from diverse backgrounds and geographic locations; CommentsClose CommentsPermalink





(v) an assessment of the sources and availability of individuals with needed expertise; CommentsClose CommentsPermalink





(vi) ways to streamline the hiring process; CommentsClose CommentsPermalink





(vii) the barriers to recruiting and hiring individuals qualified in cybersecurity and recommendations to overcome the barriers; and CommentsClose CommentsPermalink





(viii) a training and development plan, consistent with the curriculum developed under section 406, to enhance and improve the knowledge of employees. CommentsClose CommentsPermalink





(2) FEDERAL AGENCIES WITH SMALL SPECIALIZED WORKFORCE- In accordance with guidance provided by the Director of the Office of Personnel Management, a Federal agency that issued under subsection (b), a Federal agency that needs only a small specialized workforce to fulfill the Federal agency’s cybersecurity mission may, in lieu of developing a separate strategic cybersecurity workforce plan, present the workforce plan component referred to in paragraph (1)(A) and those components referred to in paragraph (1)(B) that are relevant and appropriate to the circumstances of the agency as part of the Federal agency performance plan required undersection 1115 of title 31, United States Code. CommentsClose CommentsPermalink

SEC. 404. CYBERSECURITY OCCUPATION CLASSIFICATIONS.

(a) In General- Not later than 1 year after the date of enactment of this Act, the Director of the Office of Personnel Management, in coordination with the Director, shall develop and issue comprehensive occupation classifications for Federal employees engaged in cybersecurity missions. CommentsClose CommentsPermalink





(b) Applicability of Classifications- The Director of the Office of Personnel Management shall ensure that the comprehensive occupation classifications issued under subsection (a) may be used throughout the Federal Government. CommentsClose CommentsPermalink

SEC. 405. MEASURES OF CYBERSECURITY HIRING EFFECTIVENESS.

(a) In General- The head of each Federal agency shall measure, and collect information on, indicators of the effectiveness of the recruitment and hiring by the Federal agency of a workforce needed to fulfill the Federal agency’s cybersecurity mission. CommentsClose CommentsPermalink





(b) Types of Information- The indicators of effectiveness measured and subject to collection of information under subsection (a) shall include indicators with respect to the following: CommentsClose CommentsPermalink





(1) RECRUITING AND HIRING- In relation to recruiting and hiring by the Federal agency-- CommentsClose CommentsPermalink





(A) the ability to reach and recruit well-qualified individuals from diverse talent pools; CommentsClose CommentsPermalink





(B) the use and impact of special hiring authorities and flexibilities to recruit the most qualified applicants, including the use of student internship and scholarship programs for permanent hires; CommentsClose CommentsPermalink





(C) the use and impact of special hiring authorities and flexibilities to recruit diverse candidates, including criteria such as the veteran status, race, ethnicity, gender, disability, or national origin of the candidates; and CommentsClose CommentsPermalink





(D) the educational level, and source of applicants. CommentsClose CommentsPermalink





(2) SUPERVISORS- In relation to the supervisors of the positions being filled-- CommentsClose CommentsPermalink





(A) satisfaction with the quality of the applicants interviewed and hired; CommentsClose CommentsPermalink





(B) satisfaction with the match between the skills of the individuals and the needs of the Federal agency; CommentsClose CommentsPermalink





(C) satisfaction of the supervisors with the hiring process and hiring outcomes; CommentsClose CommentsPermalink





(D) whether any mission-critical deficiencies were addressed by the individuals and the connection between the deficiencies and the performance of the Federal agency; and CommentsClose CommentsPermalink





(E) the satisfaction of the supervisors with the period of time elapsed to fill the positions. CommentsClose CommentsPermalink





(3) APPLICANTS- The satisfaction of applicants with the hiring process, including clarity of job announcements, any reasons for withdrawal of an application, the user-friendliness of the application process, communication regarding status of applications, and the timeliness of offers of employment. CommentsClose CommentsPermalink





(4) HIRED INDIVIDUALS- In relation to the individuals hired-- CommentsClose CommentsPermalink





(A) satisfaction with the hiring process; CommentsClose CommentsPermalink





(B) satisfaction with the process of starting employment in the position for which the individual was hired; CommentsClose CommentsPermalink





(C) attrition; and CommentsClose CommentsPermalink





(D) the results of exit interviews. CommentsClose CommentsPermalink





(c) Reports- CommentsClose CommentsPermalink





(1) IN GENERAL- The head of each Federal agency shall submit the information collected under this section to the Director of the Office of Personnel Management on an annual basis and in accordance with the regulations issued under subsection (d). CommentsClose CommentsPermalink





(2) AVAILABILITY OF RECRUITING AND HIRING INFORMATION- CommentsClose CommentsPermalink





(A) IN GENERAL- The Director of the Office of Personnel Management shall prepare an annual report containing the information received under paragraph (1) in a consistent format to allow for a comparison of hiring effectiveness and experience across demographic groups and Federal agencies. CommentsClose CommentsPermalink





(B) SUBMISSION- The Director of the Office of Personnel Management shall-- CommentsClose CommentsPermalink





(i) not later than 90 days after the receipt of all information required to be submitted under paragraph (1), make the report prepared under subparagraph (A) publicly available, including on the website of the Office of Personnel Management; and CommentsClose CommentsPermalink





(ii) before the date on which the report prepared under subparagraph (A) is made publicly available, submit the report to Congress. CommentsClose CommentsPermalink





(d) Regulations- CommentsClose CommentsPermalink





(1) IN GENERAL- Not later than 180 days after the date of enactment of this Act, the Director of the Office of Personnel Management shall issue regulations establishing the methodology, timing, and reporting of the data required to be submitted under this section. CommentsClose CommentsPermalink





(2) SCOPE AND DETAIL OF REQUIRED INFORMATION- The regulations under paragraph (1) shall delimit the scope and detail of the information that a Federal agency is required to collect and submit under this section, taking account of the size and complexity of the workforce that the Federal agency needs to fulfill the Federal agency’s cybersecurity mission. CommentsClose CommentsPermalink

SEC. 406. TRAINING AND EDUCATION.

(a) Training- CommentsClose CommentsPermalink





(1) FEDERAL GOVERNMENT EMPLOYEES AND FEDERAL CONTRACTORS- The Director of the Office of Personnel Management, in conjunction with the Director of the National Center for Cybersecurity and Communications, the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council established undersection 3603 of title 44, United States Code, shall establish a cybersecurity awareness and education curriculum that shall be required for all Federal employees and contractors engaged in the design, development, or operation of agency information infrastructure, as defined under section 3551 of title 44, United States Code. CommentsClose CommentsPermalink





(2) CONTENTS- The curriculum established under paragraph (1) may include-- CommentsClose CommentsPermalink





(A) role-based security awareness training; CommentsClose CommentsPermalink





(B) recommended cybersecurity practices; CommentsClose CommentsPermalink





(C) cybersecurity recommendations for traveling abroad; CommentsClose CommentsPermalink





(D) unclassified counterintelligence information; CommentsClose CommentsPermalink





(E) information regarding industrial espionage; CommentsClose CommentsPermalink





(F) information regarding malicious activity online; CommentsClose CommentsPermalink





(G) information regarding cybersecurity and law enforcement; CommentsClose CommentsPermalink





(H) identity management information; CommentsClose CommentsPermalink





(I) information regarding supply chain security; CommentsClose CommentsPermalink





(J) information security risks associated with the activities of Federal employees; and CommentsClose CommentsPermalink





(K) the responsibilities of Federal employees in complying with policies and procedures designed to reduce information security risks identified under subparagraph (J). CommentsClose CommentsPermalink





(3) FEDERAL CYBERSECURITY PROFESSIONALS- The Director of the Office of Personnel Management in conjunction with the Director of the National Center for Cybersecurity and Communications, the Director of National Intelligence, the Secretary of Defense, the Director of the Office of Management and Budget, and, as appropriate, colleges, universities, and nonprofit organizations with cybersecurity training expertise, shall develop a program, to provide training to improve and enhance the skills and capabilities of Federal employees engaged in the cybersecurity mission, including training specific to the acquisition workforce. CommentsClose CommentsPermalink





(4) HEADS OF FEDERAL AGENCIES- Not later than 30 days after the date on which an individual is appointed to a position at level I or II of the Executive Schedule, the Director of the National Center for Cybersecurity and Communications and the Director of National Intelligence, or their designees, shall provide that individual with a cybersecurity threat briefing. CommentsClose CommentsPermalink





(5) CERTIFICATION- The head of each Federal agency shall include in the annual report required undersection 3553(c) of title 44, United States Code, a certification regarding whether all officers, employees, and contractors of the Federal agency have completed the training required under this subsection. CommentsClose CommentsPermalink





(b) Education- CommentsClose CommentsPermalink





(1) FEDERAL EMPLOYEES- The Director of the Office of Personnel Management, in coordination with the Secretary of Education, the Director of the National Science Foundation, and the Director, shall develop and implement a strategy to provide Federal employees who work in cybersecurity missions with the opportunity to obtain additional education. CommentsClose CommentsPermalink





(2) K THROUGH 12- The Secretary of Education, in coordination with the Director of the National Center for Cybersecurity and Communications and State and local governments, shall develop curriculum standards, guidelines, and recommended courses to address cyber safety, cybersecurity, and cyber ethics for students in kindergarten through grade 12. CommentsClose CommentsPermalink





(3) UNDERGRADUATE, GRADUATE, VOCATIONAL, AND TECHNICAL INSTITUTIONS- CommentsClose CommentsPermalink





(A) SECRETARY OF EDUCATION- The Secretary of Education, in coordination with the Director of the National Center for Cybersecurity and Communications, shall-- CommentsClose CommentsPermalink





(i) develop curriculum standards and guidelines to address cyber safety, cybersecurity, and cyber ethics for all students enrolled in undergraduate, graduate, vocational, and technical institutions in the United States; and CommentsClose CommentsPermalink





(ii) analyze and develop recommended courses for students interested in pursuing careers in information technology, communications, computer science, engineering, math, and science, as those subjects relate to cybersecurity. CommentsClose CommentsPermalink





(B) OFFICE OF PERSONNEL MANAGEMENT- The Director of the Office of Personnel Management, in coordination with the Director, shall develop strategies and programs-- CommentsClose CommentsPermalink





(i) to recruit students from undergraduate, graduate, vocational, and technical institutions in the United States to serve as Federal employees engaged in cyber missions; and CommentsClose CommentsPermalink





(ii) that provide internship and part-time work opportunities with the Federal Government for students at the undergraduate, graduate, vocational, and technical institutions in the United States. CommentsClose CommentsPermalink





(c) Cyber Talent Competitions and Challenges- CommentsClose CommentsPermalink





(1) IN GENERAL- The Director of the National Center for Cybersecurity and Communications shall establish a program to ensure the effective operation of national and statewide competitions and challenges that seek to identify, develop, and recruit talented individuals to work in Federal agencies, State and local government agencies, and the private sector to perform duties relating to the security of the Federal information infrastructure or the national information infrastructure. CommentsClose CommentsPermalink





(2) GROUPS AND INDIVIDUALS- The program under this subsection shall include-- CommentsClose CommentsPermalink





(A) high school students; CommentsClose CommentsPermalink





(B) undergraduate students; CommentsClose CommentsPermalink





(C) graduate students; CommentsClose CommentsPermalink





(D) academic and research institutions; CommentsClose CommentsPermalink





(E) veterans; and CommentsClose CommentsPermalink





(F) other groups or individuals as the Director may determine. CommentsClose CommentsPermalink





(3) SUPPORT OF OTHER COMPETITIONS AND CHALLENGES- The program under this subsection may support other competitions and challenges not established under this subsection through affiliation and cooperative agreements with-- CommentsClose CommentsPermalink





(A) Federal agencies; CommentsClose CommentsPermalink





(B) regional, State, or community school programs supporting the development of cyber professionals; or CommentsClose CommentsPermalink





(C) other private sector organizations. CommentsClose CommentsPermalink





(4) AREAS OF TALENT- The program under this subsection shall seek to identify, develop, and recruit exceptional talent relating to-- CommentsClose CommentsPermalink





(A) ethical hacking; CommentsClose CommentsPermalink





(B) penetration testing; CommentsClose CommentsPermalink





(C) vulnerability Assessment; CommentsClose CommentsPermalink





(D) continuity of system operations; CommentsClose CommentsPermalink





(E) cyber forensics; and CommentsClose CommentsPermalink





(F) offensive and defensive cyber operations. CommentsClose CommentsPermalink

SEC. 407. CYBERSECURITY INCENTIVES.

(a) Awards- In making cash awards under chapter 45 of title 5, United States Code, the President or the head of a Federal agency, in consultation with the Director, shall consider the success of an employee in fulfilling the objectives of the National Strategy, in a manner consistent with any policies, guidelines, procedures, instructions, or standards established by the President. CommentsClose CommentsPermalink





(b) Other Incentives- The head of each Federal agency shall adopt best practices, developed by the Director of the National Center for Cybersecurity and Communications and the Office of Management and Budget, regarding effective ways to educate and motivate employees of the Federal Government to demonstrate leadership in cybersecurity, including-- CommentsClose CommentsPermalink





(1) promotions and other nonmonetary awards; and CommentsClose CommentsPermalink





(2) publicizing information sharing accomplishments by individual employees and, if appropriate, the tangible benefits that resulted. CommentsClose CommentsPermalink

SEC. 408. RECRUITMENT AND RETENTION PROGRAM FOR THE NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

(a) Definitions- In this section: CommentsClose CommentsPermalink





(1) CENTER- The term ‘Center’ means the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





(2) DEPARTMENT- The term ‘Department’ means the Department of Homeland Security. CommentsClose CommentsPermalink





(3) DIRECTOR- The term ‘Director’ means the Director of the Center. CommentsClose CommentsPermalink





(4) ENTRY LEVEL POSITION- The term ‘entry level position’ means a position that-- CommentsClose CommentsPermalink





(A) is established by the Director in the Center; and CommentsClose CommentsPermalink





(B) is classified at GS-7, GS-8, or GS-9 of the General Schedule. CommentsClose CommentsPermalink





(5) SECRETARY- The term ‘Secretary’ means the Secretary of Homeland Security. CommentsClose CommentsPermalink





(6) SENIOR POSITION- The term ‘senior position’ means a position that-- CommentsClose CommentsPermalink





(A) is established by the Director in the Center; and CommentsClose CommentsPermalink





(B) is not established undersection 5108 of title 5, United States Code, but is similar in duties and responsibilities for positions established under that section. CommentsClose CommentsPermalink





(b) Recruitment and Retention Program- CommentsClose CommentsPermalink





(1) ESTABLISHMENT- The Director may establish a program to assist in the recruitment and retention of highly skilled personnel to carry out the functions of the Center. CommentsClose CommentsPermalink





(2) CONSULTATION AND CONSIDERATIONS- In establishing a program under this section, the Director shall-- CommentsClose CommentsPermalink





(A) consult with the Secretary; and CommentsClose CommentsPermalink





(B) consider-- CommentsClose CommentsPermalink





(i) national and local employment trends; CommentsClose CommentsPermalink





(ii) the availability and quality of candidates; CommentsClose CommentsPermalink





(iii) any specialized education or certifications required for positions; CommentsClose CommentsPermalink





(iv) whether there is a shortage of certain skills; and CommentsClose CommentsPermalink





(v) such other factors as the Director determines appropriate. CommentsClose CommentsPermalink





(c) Hiring and Special Pay Authorities- CommentsClose CommentsPermalink





(1) DIRECT HIRE AUTHORITY- Without regard to the civil service laws (other than sections 3303 and 3328 of title 5, United States Code), the Director may appoint not more than 500 employees under this subsection to carry out the functions of the Center. CommentsClose CommentsPermalink





(2) RATES OF PAY- CommentsClose CommentsPermalink





(A) ENTRY LEVEL POSITIONS- The Director may fix the pay of the employees appointed to entry level positions under this subsection without regard to chapter 51 and subchapter III of chapter 53 of title 5, United States Code, relating to classification of positions and General Schedule pay rates, except that the rate of pay for any such employee may not exceed the maximum rate of basic pay payable for a position at GS-10 of the General Schedule while that employee is in an entry level position. CommentsClose CommentsPermalink





(B) SENIOR POSITIONS- CommentsClose CommentsPermalink





(i) IN GENERAL- The Director may fix the pay of the employees appointed to senior positions under this subsection without regard to chapter 51 and subchapter III of chapter 53 of title 5, United States Code, relating to classification of positions and General Schedule pay rates, except that the rate of pay for any such employee may not exceed the maximum rate of basic pay payable undersection 5376 of title 5, United States Code. CommentsClose CommentsPermalink





(ii) HIGHER MAXIMUM RATES- CommentsClose CommentsPermalink





(I) IN GENERAL- Notwithstanding the limitation on rates of pay under clause (i)-- CommentsClose CommentsPermalink

(aa) not more than 20 employees, identified by the Director, may be paid at a rate of pay not to exceed the maximum rate of basic pay payable for a position at level I of the Executive Schedule undersection 5312 of title 5, United States Code; and CommentsClose CommentsPermalink

(bb) not more than 5 employees, identified by the Director with the approval of the Secretary, may be paid at a rate of pay not to exceed the maximum rate of basic pay payable for the Vice President undersection 104 of title 3, United States Code. CommentsClose CommentsPermalink

(II) NONDELEGATION OF AUTHORITY- The Secretary or the Director may not delegate any authority under this clause. CommentsClose CommentsPermalink





(d) Conversion to Competitive Service- CommentsClose CommentsPermalink





(1) DEFINITION- In this subsection, the term ‘qualified employee’ means any individual appointed to an excepted service position in the Department who performs functions relating to the security of the Federal information infrastructure or national information infrastructure. CommentsClose CommentsPermalink





(2) COMPETITIVE CIVIL SERVICE STATUS- In consultation with the Director, the Secretary may grant competitive civil service status to a qualified employee if that employee is -- CommentsClose CommentsPermalink





(A) employed in the Center; or CommentsClose CommentsPermalink





(B) transferring to the Center. CommentsClose CommentsPermalink





(e) Retention Bonuses- CommentsClose CommentsPermalink





(1) AUTHORITY- Notwithstandingsection 5754 of title 5, United States Code, the Director may-- CommentsClose CommentsPermalink





(A) pay a retention bonus under that section to any individual appointed under this subsection, if the Director determines that, in the absence of a retention bonus, there is a high risk that the individual would likely leave employment with the Department; and CommentsClose CommentsPermalink





(B) exercise the authorities of the Office of Personnel Management and the head of an agency under that section with respect to retention bonuses paid under this subsection. CommentsClose CommentsPermalink





(2) LIMITATIONS ON AMOUNT OF ANNUAL BONUSES- CommentsClose CommentsPermalink





(A) DEFINITIONS- In this paragraph: CommentsClose CommentsPermalink





(i) MAXIMUM TOTAL PAY- The term ‘maximum total pay’ means-- CommentsClose CommentsPermalink





(I) in the case of an employee described under subsection(c)(2)(B)(i), the total amount of pay paid in a calendar year at the maximum rate of basic pay payable for a position at level I of the Executive Schedule undersection 5312 of title 5, United States Code; CommentsClose CommentsPermalink





(II) in the case of an employee described under subsection(c)(2)(B)(ii)(I)(aa), the total amount of pay paid in a calendar year at the maximum rate of basic pay payable for a position at level I of the Executive Schedule undersection 5312 of title 5, United States Code; and CommentsClose CommentsPermalink





(III) in the case of an employee described under subsection(c)(2)(B)(ii)(I)(bb), the total amount of pay paid in a calendar year at the maximum rate of basic pay payable for the Vice President undersection 104 of title 3, United States Code. CommentsClose CommentsPermalink





(ii) TOTAL COMPENSATION- The term ‘total compensation’ means-- CommentsClose CommentsPermalink





(I) the amount of pay paid to an employee in any calendar year; and CommentsClose CommentsPermalink





(II) the amount of all retention bonuses paid to an employee in any calendar year. CommentsClose CommentsPermalink





(B) LIMITATION- The Director may not pay a retention bonus under this subsection to an employee that would result in the total compensation of that employee exceeding maximum total pay. CommentsClose CommentsPermalink





(f) Termination of Authority- The authority to make appointments and pay retention bonuses under this section shall terminate 3 years after the date of enactment of this Act. CommentsClose CommentsPermalink





(g) Reports- CommentsClose CommentsPermalink





(1) PLAN FOR EXECUTION OF AUTHORITIES- Not later than 120 days of enactment of this Act, the Director shall submit a report to the appropriate committees of Congress with a plan for the execution of the authorities provided under this section. CommentsClose CommentsPermalink





(2) ANNUAL REPORT- Not later than 6 months after the date of enactment of this Act, and every year thereafter, the Director shall submit to the appropriate committees of Congress a detailed report that-- CommentsClose CommentsPermalink





(A) discusses how the actions taken during the period of the report are fulfilling the critical hiring needs of the Center; CommentsClose CommentsPermalink





(B) assesses metrics relating to individuals hired under the authority of this section, including-- CommentsClose CommentsPermalink





(i) the numbers of individuals hired; CommentsClose CommentsPermalink





(ii) the turnover in relevant positions; CommentsClose CommentsPermalink





(iii) with respect to each individual hired-- CommentsClose CommentsPermalink





(I) the position for which hired; CommentsClose CommentsPermalink





(II) the salary paid; CommentsClose CommentsPermalink





(III) any retention bonus paid and the amount of the bonus; CommentsClose CommentsPermalink





(IV) the geographic location from which hired; CommentsClose CommentsPermalink





(V) the immediate past salary; and CommentsClose CommentsPermalink





(VI) whether the individual was a noncareer appointee in the Senior Executive Service or an appointee to a position of a confidential or policy-determining character under schedule C of subpart C of part 213 of title 5 of the Code of Federal Regulations before the hiring; and CommentsClose CommentsPermalink





(iv) whether public notice for recruitment was made, and if so-- CommentsClose CommentsPermalink





(I) the total number of qualified applicants; CommentsClose CommentsPermalink





(II) the number of veteran preference eligible candidates who applied; CommentsClose CommentsPermalink





(III) the time from posting to job offer; and CommentsClose CommentsPermalink





(IV) statistics on diversity, including age, disability, race, gender, and national origin, of individuals hired under the authority of this section to the extent such statistics are available; and CommentsClose CommentsPermalink





(C) includes rates of pay set in accordance with subsection (c). CommentsClose CommentsPermalink

TITLE V--OTHER PROVISIONS CommentsClose CommentsPermalink

SEC. 501. CONSULTATION ON CYBERSECURITY MATTERS.

The Chairman of the Federal Trade Commission, the Chairman of the Federal Communications Commission, and the head of any other Federal agency determined appropriate by the President shall consult with the Director of the National Center for Cybersecurity and Communications regarding any regulation, rule, or requirement to be issued or other action to be required by the Federal agency relating to the security and resiliency of the national information infrastructure.

SEC. 502. CYBERSECURITY RESEARCH AND DEVELOPMENT.

Subtitle D of title II of the Homeland Security Act of 2002 (6 U.S.C. 161 et seq.) is amended by adding at the end the following: CommentsClose CommentsPermalink

‘SEC. 238. CYBERSECURITY RESEARCH AND DEVELOPMENT.

‘(a) Establishment of Research and Development Program- The Under Secretary for Science and Technology, in coordination with the Director of the National Center for Cybersecurity and Communications, shall carry out a research and development program for the purpose of improving the security of information infrastructure. CommentsClose CommentsPermalink





‘(b) Eligible Projects- The research and development program carried out under subsection (a) may include projects to-- CommentsClose CommentsPermalink





‘(1) advance the development and accelerate the deployment of more secure versions of fundamental Internet protocols and architectures, including for the secure domain name addressing system and routing security; CommentsClose CommentsPermalink





‘(2) improve and create technologies for detecting and analyzing attacks or intrusions, including analysis of malicious software; CommentsClose CommentsPermalink





‘(3) improve and create mitigation and recovery methodologies, including techniques for containment of attacks and development of resilient networks and systems; CommentsClose CommentsPermalink





‘(4) develop and support infrastructure and tools to support cybersecurity research and development efforts, including modeling, testbeds, and data sets for assessment of new cybersecurity technologies; CommentsClose CommentsPermalink





‘(5) assist the development and support of technologies to reduce vulnerabilities in process control systems; CommentsClose CommentsPermalink





‘(6) understand human behavioral factors that can affect cybersecurity technology and practices; CommentsClose CommentsPermalink





‘(7) test, evaluate, and facilitate, with appropriate protections for any proprietary information concerning the technologies, the transfer of technologies associated with the engineering of less vulnerable software and securing the information technology software development lifecycle; CommentsClose CommentsPermalink





‘(8) assist the development of identity management and attribution technologies; CommentsClose CommentsPermalink





‘(9) assist the development of technologies designed to increase the security and resiliency of telecommunications networks; CommentsClose CommentsPermalink





‘(10) advance the protection of privacy and civil liberties in cybersecurity technology and practices; and CommentsClose CommentsPermalink





‘(11) address other risks identified by the Director of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘(c) Coordination With Other Research Initiatives- The Under Secretary-- CommentsClose CommentsPermalink





‘(1) shall ensure that the research and development program carried out under subsection (a) is consistent with the national strategy to increase the security and resilience of cyberspace developed by the Director of Cyberspace Policy under section 101 of the Protecting Cyberspace as a National Asset Act of 2010, or any succeeding strategy; CommentsClose CommentsPermalink





‘(2) shall, to the extent practicable, coordinate the research and development activities of the Department with other ongoing research and development security-related initiatives, including research being conducted by-- CommentsClose CommentsPermalink





‘(A) the National Institute of Standards and Technology; CommentsClose CommentsPermalink





‘(B) the National Science Foundation; CommentsClose CommentsPermalink





‘(C) the National Academy of Sciences; CommentsClose CommentsPermalink





‘(CD) other Federal agencies, as defined under section 241; CommentsClose CommentsPermalink





‘(DE) other Federal and private research laboratories, research entities, and universities and institutions of higher education, and relevant nonprofit organizations; and CommentsClose CommentsPermalink





‘(EF) international partners of the United States; CommentsClose CommentsPermalink





‘(3) shall carry out any research and development project under subsection (a) through a reimbursable agreement with an appropriate Federal agency, as defined under section 241, if the Federal agency-- CommentsClose CommentsPermalink





‘(A) is sponsoring a research and development project in a similar area; or CommentsClose CommentsPermalink





‘(B) has a unique facility or capability that would be useful in carrying out the project; CommentsClose CommentsPermalink





‘(4) may make grants to, or enter into cooperative agreements, contracts, other transactions, or reimbursable agreements with, the entities described in paragraph (2); and CommentsClose CommentsPermalink





‘(5) shall submit a report to the appropriate committees of Congress on a review of the cybersecurity activities, and the capacity, of the national laboratories and other research entities available to the Department to determine if the establishment of a national laboratory dedicated to cybersecurity research and development is necessary. CommentsClose CommentsPermalink





‘(d) Privacy and Civil Rights and Civil Liberties Issues- CommentsClose CommentsPermalink





‘(1) CONSULTATION- In carrying out research and development projects under subsection (a), the Under Secretary shall consult with the Privacy Officer appointed under section 222 and the Officer for Civil Rights and Civil Liberties of the Department appointed under section 705. CommentsClose CommentsPermalink





‘(2) PRIVACY IMPACT ASSESSMENTS- In accordance with sections 222 and 705, the Privacy Officer shall conduct privacy impact assessments and the Officer for Civil Rights and Civil Liberties shall conduct reviews, as appropriate, for research and development projects carried out under subsection (a) that the Under Secretary determines could have an impact on privacy, civil rights, or civil liberties. CommentsClose CommentsPermalink

‘SEC. 239. NATIONAL CYBERSECURITY ADVISORY COUNCIL.

‘(a) Establishment- Not later than 90 days after the date of enactment of this section, the Secretary shall establish an advisory committee under section 871 on private sector cybersecurity, to be known as the National Cybersecurity Advisory Council (in this section referred to as the ‘Council’). CommentsClose CommentsPermalink





‘(b) Responsibilities- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Council shall advise the Director of the National Center for Cybersecurity and Communications on the implementation of the cybersecurity provisions affecting the private sector under this subtitle and subtitle E. CommentsClose CommentsPermalink





‘(2) INCENTIVES AND REGULATIONS- The Council shall advise the Director of the National Center for Cybersecurity and Communications and appropriate committees of Congress (as defined in section 241) and any other congressional committee with jurisdiction over the particular matter regarding how market incentives and regulations may be implemented to enhance the cybersecurity and economic security of the Nation. CommentsClose CommentsPermalink





‘(c) Membership- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The members of the Council shall be appointed the Director of the National Center for Cybersecurity and Communications and shall, to the extent practicable, represent a geographic and substantive cross-section of owners and operators of critical infrastructure and others with expertise in cybersecurity, including, as appropriate-- CommentsClose CommentsPermalink





‘(A) representatives of covered critical infrastructure (as defined under section 241); CommentsClose CommentsPermalink





‘(B) academic institutions with expertise in cybersecurity; CommentsClose CommentsPermalink





‘(C) Federal, State, and local government agencies with expertise in cybersecurity; CommentsClose CommentsPermalink





‘(D) a representative of the National Security Telecommunications Advisory Council, as established by Executive Order 12382 (47 Fed. Reg. 40531; relating to the establishment of the advisory council), as amended by Executive Order 13286 (68 Fed. Reg. 10619), as in effect on August 3, 2009, or any successor entity; CommentsClose CommentsPermalink





‘(E) a representative of the Communications Sector Coordinating Council, or any successor entity; CommentsClose CommentsPermalink





‘(F) a representative of the Information Technology Sector Coordinating Council, or any successor entity; CommentsClose CommentsPermalink





‘(G) individuals, acting in their personal capacity, with demonstrated technical expertise in cybersecurity; and CommentsClose CommentsPermalink





‘(H) such other individuals as the Director determines to be appropriate, including owners of small business concerns (as defined under section 3 of the Small Business Act (15 U.S.C. 632)). CommentsClose CommentsPermalink





‘(2) TERM- The members of the Council shall be appointed for 2 year terms and may be appointed to consecutive terms. CommentsClose CommentsPermalink





‘(3) LEADERSHIP- The Chairperson and Vice-Chairperson of the Council shall be selected by members of the Council from among the members of the Council and shall serve 2-year terms. CommentsClose CommentsPermalink





‘(d) Applicability of Federal Advisory Committee Act- The Federal Advisory Committee Act (5 U.S.C. App.) shall not apply to the Council.’. CommentsClose CommentsPermalink

SEC. 5032. PRIORITIZED CRITICAL INFORMATION INFRASTRUCTURE.

(a) In General- Section 210E(a)(2) of the Homeland Security Act of 2002 (6 U.S.C. 124l(a)(2)) is amended-- CommentsClose CommentsPermalink





(1) by striking ‘In accordance’ and inserting the following: CommentsClose CommentsPermalink





‘(A) IN GENERAL- In accordance’; and CommentsClose CommentsPermalink





(2) by adding at the end the following: CommentsClose CommentsPermalink





‘(B) CONSIDERATIONS- In establishing and maintaining a list under subparagraph (A), the Secretary, in coordination with the Director of the National Center for Cybersecurity and Communications and in consultation with the National Cybersecurity Advisory Council, shall--‘(i) consider cyber vulnerabilities and Communications, shall consider cyber risks and consequences by sector, including-- CommentsClose CommentsPermalink





‘(Ii) the factors listed in section 248(a)(2); CommentsClose CommentsPermalink





‘(IIii) interdependencies between components of covered critical infrastructure (as defined under section 241); and CommentsClose CommentsPermalink





‘(III) any other security related factor determined appropriate byiii) the potential for the destruction or disruption of the system or asset to cause-- CommentsClose CommentsPermalink





‘(I) a mass casualty event which includes an extraordinary number of fatalities; CommentsClose CommentsPermalink





‘(II) severe economic consequences; CommentsClose CommentsPermalink





‘(III) mass evacuations with a prolonged absence; or CommentsClose CommentsPermalink





‘(IV) severe degradation of national security capabilities, including intelligence and defense functions.’. CommentsClose CommentsPermalink





(b) Covered Critical Infrastructure- Title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.) (as amended by section 201 of this Act) is further amended by adding at the end the following: CommentsClose CommentsPermalink

‘SEC. 254. COVERED CRITICAL INFRASTRUCTURE.

‘(a) Identification of Covered Critical Infrastructure- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Subject to paragraphs (2) and (3), the Secretary, in coordination with sector-specific agencies and in consultation with the National Cybersecurity Advisory Council and other appropriate representatives of State and local governments and the private sector, shall establish and maintain a list of systems or assets that constitute covered critical infrastructure for purposes of this subtitle. CommentsClose CommentsPermalink





‘(2) REQUIREMENTS- CommentsClose CommentsPermalink





‘(A) IN GENERAL- A system or asset may not be identified as covered critical infrastructure under this section unless such system or asset meets each of the requirements under subparagraph (B)(i), (ii), and (iii). CommentsClose CommentsPermalink





‘(B) REQUIREMENTS- The requirements referred to under subparagraph (A) are that-- CommentsClose CommentsPermalink





‘(i) the destruction or the disruption of the reliable operation of the system or asset would cause national or regional catastrophic effects identified under section 210E(a)(2)(B)(iii); CommentsClose CommentsPermalink





‘(ii) the system or asset is on the Secretary; and

‘(ii) add covered critical infrastructure to or delete covered critical infrastructure from the list based on the factors listed in clause (i) for purposes of sections 248 and 249.

‘(C) NOTIFICATION- The Secretary--

‘(i)prioritized critical infrastructure list established by the Secretary under section 210E(a)(2); and CommentsClose CommentsPermalink




‘(iii)(I) the system or asset is a component of the national information infrastructure; or CommentsClose CommentsPermalink





‘(II) the national information infrastructure is essential to the reliable operation of the system or asset. CommentsClose CommentsPermalink





‘(3) LIMITATION- A system or asset may not be identified as covered critical infrastructure under this section based solely on activities protected by the first amendment to the United States Constitution. CommentsClose CommentsPermalink





‘(b) Notification- CommentsClose CommentsPermalink





‘(1) IDENTIFICATION OF SYSTEM OR ASSET- If the Secretary identifies any system or asset as covered critical infrastructure under subsection (a), the Secretary shall promptly notify the owner or operator of that system or asset of that identification. CommentsClose CommentsPermalink





‘(2) SYSTEM OR ASSET NO LONGER COVERED CRITICAL INFRASTRUCTURE- If the Secretary determines that any system or asset that was identified as covered critical infrastructure under subsection (a) no longer constitutes covered critical infrastructure, the Secretary shall promptly notify the owner or operator of any system or asset added under subparagraph (B)(ii) to the list established and maintained under subparagraph (A) as soon as is practicable;

‘(ii) shall develop a mechanism for an owner or operator notified under clause (i) to provide relevant information to the Secretary and the Director of the National Center for Cybersecurity and Communications relating to the inclusion of the system or asset on the list, including any information that the owner or operator believes may have led to the improper inclusion of the system or asset on the list; and

‘(iii) at the sole andthat system or asset of that determination. CommentsClose CommentsPermalink




‘(c) Redress- CommentsClose CommentsPermalink





‘(1) IN GENERAL- Subject to paragraphs (2), (3), and (4), the Secretary shall develop a mechanism, consistent with subchapter II of chapter 5 of title 5, United States Code, for an owner or operator notified under subsection (b)(1) to appeal the identification of a system or asset as covered critical infrastructure under this section. CommentsClose CommentsPermalink





‘(2) COMPLIANCE- The owner or operator of a system or asset identified as covered critical infrastructure shall comply with any requirement of this subtitle relating to covered critical infrastructure until such time as the system or asset is no longer identified as covered critical infrastructure by the Secretary, based on-- CommentsClose CommentsPermalink





‘(A) an appeal under this subsection; or CommentsClose CommentsPermalink





‘(B) a determination of the Secretary unrelated to an appeal. CommentsClose CommentsPermalink





‘(3) ABUSE OF DISCRETION- In order to prevail in any appeal under this subsection, the owner or operator of the system or asset identified as covered critical infrastructure shall be required to demonstrate an abuse of discretion by the Secretary. CommentsClose CommentsPermalink





‘(4) FINAL APPEAL- A final decision in any appeal under this subsection shall be a final agency action that shall not be subject to judicial review. CommentsClose CommentsPermalink





‘(d) Addition of Systems or Assets- CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Secretary shall develop a process under which any owner or operator of a system or asset that may constitute covered critical infrastructure may-- CommentsClose CommentsPermalink





‘(A) request that such system or asset be identified by the Secretary as covered critical infrastructure under this section; and CommentsClose CommentsPermalink





‘(B) submit material supporting such a request to the Director of the Center for consideration by the Secretary in carrying out this section. CommentsClose CommentsPermalink





‘(2) FINAL DECISION- A decision to identify any system or asset as covered critical infrastructure based on a request submitted under this subsection-- CommentsClose CommentsPermalink





‘(A) is committed to the sole, unreviewable discretion of the Secretary, may revise the list based on information provided in clause (ii); and CommentsClose CommentsPermalink





‘(B) shall not be subject to-- CommentsClose CommentsPermalink





‘(i) an appeal under subsection (c); or CommentsClose CommentsPermalink





‘(ii) judicial review.’. CommentsClose CommentsPermalink

SEC. 5043. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS ACQUISITION AUTHORITIES.

(a) In General- The National Center for Cybersecurity and Communications is authorized to use the authorities under subsections (c)(1) and (d)(1)(B) ofsection 2304 of title 10, United States Code, instead of the authorities under subsections (c)(1) and (d)(1)(B) of section 303 of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 253), subject to all other requirements of section 303 of the Federal Property and Administrative Services Act of 1949. CommentsClose CommentsPermalink





(b) Guidelines- Not later than 90 days after the date of enactment of this Act, the chief procurement officer of the Department of Homeland Security shall issue guidelines for use of the authority under subsection (a). CommentsClose CommentsPermalink





(c) Termination- The National Center for Cybersecurity and Communications may not use the authority under subsection (a) on and after the date that is 3 years after the date of enactment of this Act. CommentsClose CommentsPermalink





(d) Reporting- CommentsClose CommentsPermalink





(1) IN GENERAL- On a semiannual basis, the Director of the National Center for Cybersecurity and Communications shall submit a report on use of the authority granted by subsection (a) to-- CommentsClose CommentsPermalink





(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and CommentsClose CommentsPermalink





(B) the Committee on Homeland Security of the House of Representatives. CommentsClose CommentsPermalink





(2) CONTENTS- Each report submitted under paragraph (1) shall include, at a minimum-- CommentsClose CommentsPermalink





(A) the number of contract actions taken under the authority under subsection (a) during the period covered by the report; and CommentsClose CommentsPermalink





(B) for each contract action described in subparagraph (A)-- CommentsClose CommentsPermalink





(i) the total dollar value of the contract action; CommentsClose CommentsPermalink





(ii) a summary of the market research conducted by the National Center for Cybersecurity and Communications, including a list of all offerors who were considered and those who actually submitted bids, in order to determine that use of the authority was appropriate; and CommentsClose CommentsPermalink





(iii) a copy of the justification and approval documents required by section 303(f) of the Federal Property and Administrative Services Act of 1949 (41 U.S.C. 253(f)). CommentsClose CommentsPermalink





(3) CLASSIFIED ANNEX- A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary. CommentsClose CommentsPermalink

SEC. 504. EVALUATION OF THE EFFECTIVE IMPLEMENTATION OF OFFICE OF MANAGEMENT AND BUDGET INFORMATION SECURITY RELATED POLICIES AND DIRECTIVES.

SEC. 505. TECHNICAL AND CONFORMING AMENDMENTS.

(a) Elimination of Assistant Secretary for Cybersecurity and Communications- The Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended-- CommentsClose CommentsPermalink





(1) in section 103(a)(8) (6 U.S.C. 113(a)(8)), by striking ‘, cybersecurity,’; CommentsClose CommentsPermalink





(2) in section 514 (6 U.S.C. 321c)-- CommentsClose CommentsPermalink





(A) by striking subsection (b); and CommentsClose CommentsPermalink





(B) by redesignating subsection (c) as subsection (b); and CommentsClose CommentsPermalink





(3) in section 1801(b) (6 U.S.C. 571(b)), by striking ‘shall report to the Assistant Secretary for Cybersecurity and Communications’ and inserting ‘shall report to the Director of the National Center for Cybersecurity and Communications’. CommentsClose CommentsPermalink





(b) CIO Council-Section 3603(b) of title 44, United States Code, is amended-- CommentsClose CommentsPermalink





(1) by redesignating paragraph (7) as paragraph (8); and CommentsClose CommentsPermalink





(2) by inserting after paragraph (6) the following: CommentsClose CommentsPermalink





‘(7) The Director of the National Center for Cybersecurity and Communications.’. CommentsClose CommentsPermalink





(c) Repeal- The Homeland Security Act of 2002 (6 U.S.C. 101 et seq) is amended-- CommentsClose CommentsPermalink





(1) by striking section 223 (6 U.S.C. 143); and CommentsClose CommentsPermalink





(2) by redesignating sections 224 and 225 (6 U.S.C. 144 and 145) as sections 223 and 224, respectively. CommentsClose CommentsPermalink





(d) Technical Correction- Section 1802(a) of the Homeland Security Act of 2002 (6 U.S.C. 572(a)) is amended in the matter preceding paragraph (1) by striking ‘Department of’. CommentsClose CommentsPermalink





(e) Executive Schedule Position-Section 5313 of title 5, United States Code, is amended by adding at the end the following: CommentsClose CommentsPermalink





‘Director of the National Center for Cybersecurity and Communications.’. CommentsClose CommentsPermalink





(f) Table of Contents- The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended-- CommentsClose CommentsPermalink





(1) by striking the items relating to sections 223, 224, and 225 and inserting the following: CommentsClose CommentsPermalink





‘Sec. 223. NET guard. CommentsClose CommentsPermalink





‘Sec. 224. Cyber Security Enhancements Act of 2002.’; and CommentsClose CommentsPermalink





(2) by inserting after the item relating to section 237 the following: CommentsClose CommentsPermalink





‘Sec. 238. Cybersecurity research and development. CommentsClose CommentsPermalink





‘Sec. 239. National Cybersecurity Advisory Council. CommentsClose CommentsPermalink

‘Subtitle E--Cybersecurity

‘Sec. 241. Definitions. CommentsClose CommentsPermalink





‘Sec. 242. National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘Sec. 243. Physical and cyber infrastructure collaboration. CommentsClose CommentsPermalink





‘Sec. 244. United States Computer Emergency Readiness Team. CommentsClose CommentsPermalink





‘Sec. 245. Additional authorities of the Director of the National Center for Cybersecurity and Communications. CommentsClose CommentsPermalink





‘Sec. 246. Information sharing. CommentsClose CommentsPermalink





‘Sec. 247. Private sector assistance. CommentsClose CommentsPermalink





‘Sec. 248. Cyber vulnerabilitierisks to covered critical infrastructure. CommentsClose CommentsPermalink





‘Sec. 249. National cyber emergencies.. CommentsClose CommentsPermalink





‘Sec. 250. Enforcement. CommentsClose CommentsPermalink





‘Sec. 251. Protection of information. CommentsClose CommentsPermalink





‘Sec. 252. Sector-specific agencies. CommentsClose CommentsPermalink





‘Sec. 253. Strategy for Federal cybersecurity supply chain management. CommentsClose CommentsPermalink





’. ‘Sec. 254. Covered critical infrastructure.’. CommentsClose CommentsPermalink