Most commented sections:

• Paragraph 20 (2 comments)
• Paragraph 16 (1 comments)

S 413 ISCommentsClose CommentsPermalink

112th CONGRESSCommentsClose CommentsPermalink

1st SessionCommentsClose CommentsPermalink

S. 413CommentsClose CommentsPermalink

To amend the Homeland Security Act of 2002 and other laws to enhance the security and resiliency of the cyber and communications infrastructure of the United States.CommentsClose CommentsPermalink

IN THE SENATE OF THE UNITED STATESCommentsClose CommentsPermalink

February 17, 2011CommentsClose CommentsPermalink

Mr. LIEBERMAN (for himself, Ms. COLLINS, and Mr. CARPER) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental AffairsCommentsClose CommentsPermalink

A BILLCommentsClose CommentsPermalink

To amend the Homeland Security Act of 2002 and other laws to enhance the security and resiliency of the cyber and communications infrastructure of the United States.CommentsClose CommentsPermalink

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,CommentsClose CommentsPermalink

SECTION 1. SHORT TITLE.

This Act may be cited as the ‘Cybersecurity and Internet Freedom Act of 2011’.CommentsClose CommentsPermalink

SEC. 2. INTERNET FREEDOM ACT.

(a) Short Title- This section may be cited as the ‘Internet Freedom Act’.CommentsClose CommentsPermalink





(b) Findings- Congress finds that--CommentsClose CommentsPermalink





(1) the Internet is vital to almost every facet of the daily lives of the people of the United States, from the water we drink to the power we use to the ways we communicate;CommentsClose CommentsPermalink





(2) in the modern world, the Internet is essential to the free flow of ideas and information;CommentsClose CommentsPermalink





(3) it is vital that the Internet, and the access of the people of the United States to the Internet, be protected to ensure the reliability of the critical services that rely upon this network and the availability of the information and communications that travel over this network;CommentsClose CommentsPermalink





(4) the Internet has developed into a robust network within the United States, with thousands of providers, making it technically impossible to shut down the Internet;CommentsClose CommentsPermalink





(5) although the United States must ensure the security of the Nation and its critical infrastructure, the actions of the Government must not encroach on rights guaranteed by the First Amendment to the Constitution of the United States;CommentsClose CommentsPermalink





(6) cyber attacks are a real and evolving threat to the information infrastructure and economy of the Nation;CommentsClose CommentsPermalink





(7) the Sergeant at Arms of the Senate reported in March 2010 that the computer systems of executive branch agencies of the Federal Government and Congress are probed or attacked an average of 1,800,000,000 times per month;CommentsClose CommentsPermalink





(8) experts estimate that cyber attacks can produce $8,000,000,000 in annual losses to the national economy;CommentsClose CommentsPermalink





(9) in the event of a cyber attack, it is essential that the law clearly and unambiguously delineate limits on what the Federal Government can and cannot do to protect the information infrastructure that is essential to the reliable operation of the Internet and the critical infrastructure of the Nation; andCommentsClose CommentsPermalink





(10) neither the President, the Director of the National Center for Cybersecurity and Communications, nor any other officer or employee of the Federal Government should have the authority to shut down the Internet.CommentsClose CommentsPermalink





(c) Limitation- Notwithstanding any provision of this Act, an amendment made by this Act, or section 706 of the Communications Act of 1934 (47 U.S.C. 606), neither the President, the Director of the National Center for Cybersecurity and Communications, or any officer or employee of the United States Government shall have the authority to shut down the Internet.CommentsClose CommentsPermalink

SEC. 3. TABLE OF CONTENTS.

The table of contents for this Act is as follows:CommentsClose CommentsPermalink





Sec. 1. Short title.CommentsClose CommentsPermalink





Sec. 2. Internet Freedom Act.CommentsClose CommentsPermalink





Sec. 3. Table of contents.CommentsClose CommentsPermalink





Sec. 4. Definitions.CommentsClose CommentsPermalink

TITLE I--OFFICE OF CYBERSPACE POLICY

Sec. 101. Establishment of the Office of Cyberspace Policy.CommentsClose CommentsPermalink





Sec. 102. Appointment and responsibilities of the Director.CommentsClose CommentsPermalink





Sec. 103. Prohibition on political campaigning.CommentsClose CommentsPermalink





Sec. 104. Review of Federal agency budget requests relating to the National Strategy.CommentsClose CommentsPermalink





Sec. 105. Access to intelligence.CommentsClose CommentsPermalink





Sec. 106. Consultation.CommentsClose CommentsPermalink





Sec. 107. Reports to Congress.CommentsClose CommentsPermalink

TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS

Sec. 201. Cybersecurity.CommentsClose CommentsPermalink

TITLE III--FEDERAL INFORMATION SECURITY MANAGEMENT

Sec. 301. Coordination of Federal information policy.CommentsClose CommentsPermalink

TITLE IV--RECRUITMENT AND PROFESSIONAL DEVELOPMENT

Sec. 401. Definitions.CommentsClose CommentsPermalink





Sec. 402. Assessment of cybersecurity workforce.CommentsClose CommentsPermalink





Sec. 403. Strategic cybersecurity workforce planning.CommentsClose CommentsPermalink





Sec. 404. Cybersecurity occupation classifications.CommentsClose CommentsPermalink





Sec. 405. Measures of cybersecurity hiring effectiveness.CommentsClose CommentsPermalink





Sec. 406. Training and education.CommentsClose CommentsPermalink





Sec. 407. Cybersecurity incentives.CommentsClose CommentsPermalink





Sec. 408. Recruitment and retention program for the National Center for Cybersecurity and Communications.CommentsClose CommentsPermalink

TITLE V--OTHER PROVISIONS

Sec. 501. Cybersecurity research and development.CommentsClose CommentsPermalink





Sec. 502. Prioritized critical information infrastructure.CommentsClose CommentsPermalink





Sec. 503. National Center for Cybersecurity and Communications acquisition authorities.CommentsClose CommentsPermalink





Sec. 504. Evaluation of the effective implementation of Office of Management and Budget information security related policies and directives.CommentsClose CommentsPermalink





Sec. 505. Technical and conforming amendments.CommentsClose CommentsPermalink

SEC. 4. DEFINITIONS.

In this Act:CommentsClose CommentsPermalink





(1) APPROPRIATE CONGRESSIONAL COMMITTEES- The term ‘appropriate congressional committees’ means--CommentsClose CommentsPermalink





(A) the Committee on Homeland Security and Governmental Affairs of the Senate;CommentsClose CommentsPermalink





(B) the Committee on Homeland Security of the House of Representatives;CommentsClose CommentsPermalink





(C) the Committee on Oversight and Government Reform of the House of Representatives; andCommentsClose CommentsPermalink





(D) any other congressional committee with jurisdiction over the particular matter.CommentsClose CommentsPermalink





(2) CRITICAL INFRASTRUCTURE- The term ‘critical infrastructure’ has the meaning given that term in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)).CommentsClose CommentsPermalink





(3) CYBERSPACE- The term ‘cyberspace’ means the interdependent network of information infrastructure, and includes the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries.CommentsClose CommentsPermalink





(4) DIRECTOR- The term ‘Director’ means the Director of Cyberspace Policy established under section 101.CommentsClose CommentsPermalink





(5) FEDERAL AGENCY- The term ‘Federal agency’--CommentsClose CommentsPermalink





(A) means any executive department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; andCommentsClose CommentsPermalink





(B) does not include the governments of the District of Columbia and of the territories and possessions of the United States and their various subdivisions.CommentsClose CommentsPermalink





(6) FEDERAL INFORMATION INFRASTRUCTURE- The term ‘Federal information infrastructure’--CommentsClose CommentsPermalink





(A) means information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; andCommentsClose CommentsPermalink





(B) does not include--CommentsClose CommentsPermalink





(i) a national security system; orCommentsClose CommentsPermalink





(ii) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community.CommentsClose CommentsPermalink





(7) INCIDENT- The term ‘incident’ has the meaning given that term in section 3551 of title 44, United States Code, as added by this Act.CommentsClose CommentsPermalink





(8) INFORMATION INFRASTRUCTURE- The term ‘information infrastructure’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including programmable electronic devices and communications networks and any associated hardware, software, or data.CommentsClose CommentsPermalink





(9) INFORMATION SECURITY- The term ‘information security’ means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide--CommentsClose CommentsPermalink





(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity;CommentsClose CommentsPermalink





(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; andCommentsClose CommentsPermalink





(C) availability, by ensuring timely and reliable access to and use of information.CommentsClose CommentsPermalink





(10) INFORMATION TECHNOLOGY- The term ‘information technology’ has the meaning given that term in section 11101 of title 40, United States Code.CommentsClose CommentsPermalink





(11) INTELLIGENCE COMMUNITY- The term ‘intelligence community’ has the meaning given that term under section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)).CommentsClose CommentsPermalink





(12) KEY RESOURCES- The term ‘key resources’ has the meaning given that term in section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101).CommentsClose CommentsPermalink





(13) NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS- The term ‘National Center for Cybersecurity and Communications’ means the National Center for Cybersecurity and Communications established under section 242(a) of the Homeland Security Act of 2002, as added by this Act.CommentsClose CommentsPermalink





(14) NATIONAL INFORMATION INFRASTRUCTURE- The term ‘national information infrastructure’ means information infrastructure--CommentsClose CommentsPermalink





(A) that is owned, operated, or controlled within or from the United States; andCommentsClose CommentsPermalink





(B) that is not owned, operated, controlled, or licensed for use by a Federal agency.CommentsClose CommentsPermalink





(15) NATIONAL SECURITY SYSTEM- The term ‘national security system’ has the meaning given that term in section 3551 of title 44, United States Code, as added by this Act.CommentsClose CommentsPermalink





(16) NATIONAL STRATEGY- The term ‘National Strategy’ means the national strategy to increase the security and resiliency of cyberspace developed under section 101(a)(1).CommentsClose CommentsPermalink





(17) OFFICE- The term ‘Office’ means the Office of Cyberspace Policy established under section 101.CommentsClose CommentsPermalink





(18) RESILIENCY- The term ‘resiliency’ means the ability to eliminate or reduce the magnitude or duration of a disruptive event, including the ability to prevent, prepare for, respond to, and recover from the event.CommentsClose CommentsPermalink





(19) RISK- The term ‘risk’ means the potential for an unwanted outcome resulting from an incident, as determined by the likelihood of the occurrence of the incident and the associated consequences, including potential for an adverse outcome assessed as a function of threats, vulnerabilities, and consequences associated with an incident.CommentsClose CommentsPermalink





(20) RISK-BASED SECURITY- The term ‘risk-based security’ has the meaning given that term in section 3551 of title 44, United States Code, as added by this Act.CommentsClose CommentsPermalink

TITLE I--OFFICE OF CYBERSPACE POLICYCommentsClose CommentsPermalink

SEC. 101. ESTABLISHMENT OF THE OFFICE OF CYBERSPACE POLICY.

(a) Establishment of Office- There is established in the Executive Office of the President an Office of Cyberspace Policy which shall--CommentsClose CommentsPermalink





(1) develop, not later than 1 year after the date of enactment of this Act, and update as needed, but not less frequently than once every 2 years, a national strategy to increase the security and resiliency of cyberspace, that includes goals and objectives relating to--CommentsClose CommentsPermalink





(A) computer network operations, including offensive activities, defensive activities, and other activities;CommentsClose CommentsPermalink





(B) information assurance;CommentsClose CommentsPermalink





(C) protection of critical infrastructure and key resources;CommentsClose CommentsPermalink





(D) research and development priorities;CommentsClose CommentsPermalink





(E) law enforcement;CommentsClose CommentsPermalink





(F) diplomacy;CommentsClose CommentsPermalink





(G) homeland security;CommentsClose CommentsPermalink





(H) protection of privacy and civil liberties;CommentsClose CommentsPermalink





(I) military and intelligence activities; andCommentsClose CommentsPermalink





(J) identity management and authentication;CommentsClose CommentsPermalink





(2) oversee, coordinate, and integrate all policies and activities of the Federal Government across all instruments of national power relating to ensuring the security and resiliency of cyberspace, including--CommentsClose CommentsPermalink





(A) diplomatic, economic, military, intelligence, homeland security, and law enforcement policies and activities within and among Federal agencies; andCommentsClose CommentsPermalink





(B) offensive activities, defensive activities, and other policies and activities necessary to ensure effective capabilities to operate in cyberspace;CommentsClose CommentsPermalink





(3) ensure that all Federal agencies comply with appropriate guidelines, policies, and directives from the Department of Homeland Security, other Federal agencies with responsibilities relating to cyberspace security or resiliency, and the National Center for Cybersecurity and Communications; andCommentsClose CommentsPermalink





(4) ensure that Federal agencies have access to, receive, and appropriately disseminate law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246 of the Homeland Security Act of 2002, as added by this Act) relevant to--CommentsClose CommentsPermalink





(A) the security of the Federal information infrastructure or the national information infrastructure; andCommentsClose CommentsPermalink





(B) the security of--CommentsClose CommentsPermalink





(i) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; orCommentsClose CommentsPermalink





(ii) a national security system.CommentsClose CommentsPermalink





(b) Director of Cyberspace Policy-CommentsClose CommentsPermalink





(1) IN GENERAL- There shall be a Director of Cyberspace Policy, who shall be the head of the Office.CommentsClose CommentsPermalink





(2) EXECUTIVE SCHEDULE POSITION- Section 5312 of title 5, United States Code, is amended by adding at the end the following:CommentsClose CommentsPermalink





‘Director of Cyberspace Policy.’.CommentsClose CommentsPermalink

SEC. 102. APPOINTMENT AND RESPONSIBILITIES OF THE DIRECTOR.

(a) Appointment-CommentsClose CommentsPermalink





(1) IN GENERAL- The Director shall be appointed by the President, by and with the advice and consent of the Senate.CommentsClose CommentsPermalink





(2) QUALIFICATIONS- The President shall appoint the Director from among individuals who have demonstrated ability and knowledge in information technology, cybersecurity, and the operations, security, and resiliency of communications networks.CommentsClose CommentsPermalink





(3) PROHIBITION- No person shall serve as Director while serving in any other position in the Federal Government.CommentsClose CommentsPermalink





(b) Responsibilities- The Director shall--CommentsClose CommentsPermalink





(1) advise the President regarding the establishment of policies, goals, objectives, and priorities for securing the information infrastructure of the Nation;CommentsClose CommentsPermalink





(2) advise the President and other entities within the Executive Office of the President regarding mechanisms to build, and improve the resiliency and efficiency of, the information and communication industry of the Nation, in collaboration with the private sector, while promoting national economic interests;CommentsClose CommentsPermalink





(3) work with Federal agencies to--CommentsClose CommentsPermalink





(A) oversee, coordinate, and integrate the implementation of the National Strategy, including coordination with--CommentsClose CommentsPermalink





(i) the Department of Homeland Security;CommentsClose CommentsPermalink





(ii) the Department of Defense;CommentsClose CommentsPermalink





(iii) the Department of Commerce;CommentsClose CommentsPermalink





(iv) the Department of State;CommentsClose CommentsPermalink





(v) the Department of Justice;CommentsClose CommentsPermalink





(vi) the Department of Energy;CommentsClose CommentsPermalink





(vii) through the Director of National Intelligence, the intelligence community; andCommentsClose CommentsPermalink





(viii) and any other Federal agency with responsibilities relating to the National Strategy; andCommentsClose CommentsPermalink





(B) resolve any disputes that arise between Federal agencies relating to the National Strategy or other matters within the responsibility of the Office;CommentsClose CommentsPermalink





(4) if the policies or activities of a Federal agency are not in compliance with the responsibilities of the Federal agency under the National Strategy--CommentsClose CommentsPermalink





(A) notify the Federal agency;CommentsClose CommentsPermalink





(B) transmit a copy of each notification under subparagraph (A) to the President and the appropriate congressional committees; andCommentsClose CommentsPermalink





(C) coordinate the efforts to bring the Federal agency into compliance;CommentsClose CommentsPermalink





(5) ensure the adequacy of protections for privacy and civil liberties in carrying out the responsibilities of the Director under this title, including through consultation with the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee);CommentsClose CommentsPermalink





(6) upon reasonable request, appear before any duly constituted committees of the Senate or of the House of Representatives;CommentsClose CommentsPermalink





(7) recommend to the Office of Management and Budget or the head of a Federal agency actions (including requests to Congress relating to the reprogramming of funds) that the Director determines are necessary to ensure risk-based security of--CommentsClose CommentsPermalink





(A) the Federal information infrastructure;CommentsClose CommentsPermalink





(B) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community; orCommentsClose CommentsPermalink





(C) a national security system;CommentsClose CommentsPermalink





(8) advise the Administrator of the Office of E-Government and Information Technology and the Administrator of the Office of Information and Regulatory Affairs on the development, and oversee the implementation, of policies, principles, standards, guidelines, and budget priorities for information technology functions and activities of the Federal Government;CommentsClose CommentsPermalink





(9) coordinate and ensure, to the maximum extent practicable, that the standards and guidelines developed for national security systems and the standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) are complementary and unified;CommentsClose CommentsPermalink





(10) in consultation with the Administrator of the Office of Information and Regulatory Affairs, coordinate efforts of Federal agencies relating to the development of regulations, rules, requirements, or other actions applicable to the national information infrastructure to ensure, to the maximum extent practicable, that the efforts are complementary;CommentsClose CommentsPermalink





(11) coordinate the activities of the Office of Science and Technology Policy, the National Economic Council, the Office of Management and Budget, the National Security Council, the Homeland Security Council, and the United States Trade Representative related to the National Strategy and other matters within the purview of the Office;CommentsClose CommentsPermalink





(12) carry out the responsibilities for national security and emergency preparedness communications described in section 706 of the Communications Act of 1934 (47 U.S.C. 606) to ensure integration and coordination; andCommentsClose CommentsPermalink





(13) as assigned by the President, other duties relating to the security and resiliency of cyberspace.CommentsClose CommentsPermalink





(c) Conforming Regulations and Orders- The President shall amend the regulations and orders issued under section 706 of the Communications Act of 1934 (47 U.S.C. 606) in accordance with subsection (b)(12).CommentsClose CommentsPermalink

SEC. 103. PROHIBITION ON POLITICAL CAMPAIGNING.

Section 7323(b)(2)(B) of title 5, United States Code, is amended--CommentsClose CommentsPermalink





(1) in clause (i), by striking ‘or’ at the end;CommentsClose CommentsPermalink





(2) in clause (ii), by striking the period at the end and inserting ‘; or’; andCommentsClose CommentsPermalink





(3) by adding at the end the following:CommentsClose CommentsPermalink





‘(iii) notwithstanding the exception under subparagraph (A) (relating to an appointment made by the President, by and with the advice and consent of the Senate), the Director of Cyberspace Policy.’.CommentsClose CommentsPermalink

SEC. 104. REVIEW OF FEDERAL AGENCY BUDGET REQUESTS RELATING TO THE NATIONAL STRATEGY.

(a) In General- For each fiscal year, the head of each Federal agency shall transmit to the Director a copy of any portion of the budget of the Federal agency intended to implement the National Strategy at the same time as that budget request is submitted to the Office of Management and Budget in the preparation of the budget of the President submitted to Congress under section 1105(a) of title 31, United States Code.CommentsClose CommentsPermalink





(b) Timely Submissions- The head of each Federal agency shall ensure the timely development and submission to the Director of each proposed budget under this section, in such format as may be designated by the Director with the concurrence of the Director of the Office of Management and Budget.CommentsClose CommentsPermalink





(c) Adequacy of the Proposed Budget Requests- With the assistance of, and in coordination with, the Office of E-Government and Information Technology and the National Center for Cybersecurity and Communications, the Director shall review each budget submission to assess the adequacy of the proposed request with regard to implementation of the National Strategy, including the overall sufficiency of the requests to implement effectively the National Strategy across all Federal agencies.CommentsClose CommentsPermalink





(d) Inadequate Budget Requests- If the Director concludes that a budget request submitted under subsection (a) is inadequate, in whole or in part, to implement the objectives of the National Strategy, the Director shall submit to the Director of the Office of Management and Budget and the head of the Federal agency submitting the budget request a written description of funding levels and specific initiatives that would, in the determination of the Director, make the request adequate.CommentsClose CommentsPermalink

SEC. 105. ACCESS TO INTELLIGENCE.

The Director shall have access to law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246 of the Homeland Security Act of 2002, as added by this Act) that is obtained by, or in the possession of, any Federal agency that the Director determines relevant to the security of--CommentsClose CommentsPermalink





(1) the Federal information infrastructure;CommentsClose CommentsPermalink





(2) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community;CommentsClose CommentsPermalink





(3) a national security system; orCommentsClose CommentsPermalink





(4) national information infrastructure.CommentsClose CommentsPermalink

SEC. 106. CONSULTATION.

(a) In General- The Director may consult and obtain recommendations from, as needed, such Presidential and other advisory entities as the Director determines will assist in carrying out the mission of the Office, including--CommentsClose CommentsPermalink





(1) the National Security Telecommunications Advisory Committee;CommentsClose CommentsPermalink





(2) the National Infrastructure Advisory Council;CommentsClose CommentsPermalink





(3) the Privacy and Civil Liberties Oversight Board;CommentsClose CommentsPermalink





(4) the President’s Intelligence Advisory Board;CommentsClose CommentsPermalink





(5) the Critical Infrastructure Partnership Advisory Council;CommentsClose CommentsPermalink





(6) the Committee on Foreign Investment in the United States;CommentsClose CommentsPermalink





(7) the Information Security and Privacy Advisory Board;CommentsClose CommentsPermalink





(8) the National Cybersecurity Advisory Council established under section 239 of the Homeland Security Act of 2002, as added by this Act; andCommentsClose CommentsPermalink





(9) any other entity that may provide assistance to the Director.CommentsClose CommentsPermalink





(b) National Strategy- In developing and updating the National Strategy the Director shall consult with the National Cybersecurity Advisory Council and, as appropriate, State and local governments and private entities.CommentsClose CommentsPermalink

SEC. 107. REPORTS TO CONGRESS.

(a) In General- The Director shall submit an annual report to the appropriate congressional committees describing the activities, ongoing projects, and plans of the Federal Government designed to meet the goals and objectives of the National Strategy.CommentsClose CommentsPermalink





(b) Classified Annex- A report submitted under this section shall be submitted in an unclassified form, but may include a classified annex, if necessary.CommentsClose CommentsPermalink





(c) Public Report- An unclassified version of each report submitted under this section shall be made available to the public.CommentsClose CommentsPermalink

TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONSCommentsClose CommentsPermalink

SEC. 201. CYBERSECURITY.

Title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding at the end the following:CommentsClose CommentsPermalink

‘Subtitle E--CybersecurityCommentsClose CommentsPermalink

‘SEC. 241. DEFINITIONS.

‘In this subtitle--CommentsClose CommentsPermalink





‘(1) the term ‘agency information infrastructure’ means the Federal information infrastructure of a particular Federal agency;CommentsClose CommentsPermalink





‘(2) the term ‘appropriate committees of Congress’ means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives;CommentsClose CommentsPermalink





‘(3) the term ‘Center’ means the National Center for Cybersecurity and Communications established under section 242(a);CommentsClose CommentsPermalink





‘(4) the term ‘covered critical infrastructure’ means a system or asset identified by the Secretary as covered critical infrastructure under section 254;CommentsClose CommentsPermalink





‘(5) the term ‘cyber risk’ means any risk to information infrastructure, including physical or personnel risks and security vulnerabilities, that, if exploited or not mitigated, could pose a significant risk of disruption to the operation of information infrastructure essential to the reliable operation of covered critical infrastructure;CommentsClose CommentsPermalink





‘(6) the term ‘Director’ means the Director of the Center appointed under section 242(b)(1);CommentsClose CommentsPermalink





‘(7) the term ‘Federal agency’--CommentsClose CommentsPermalink





‘(A) means any executive department, military department, Government corporation, Government controlled corporation, or other establishment in the executive branch of the Government (including the Executive Office of the President), or any independent regulatory agency; andCommentsClose CommentsPermalink





‘(B) does not include the governments of the District of Columbia and of the territories and possessions of the United States and their various subdivisions;CommentsClose CommentsPermalink





‘(8) the term ‘Federal information infrastructure’--CommentsClose CommentsPermalink





‘(A) means information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; andCommentsClose CommentsPermalink





‘(B) does not include--CommentsClose CommentsPermalink





‘(i) a national security system; orCommentsClose CommentsPermalink





‘(ii) information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community;CommentsClose CommentsPermalink





‘(9) the term ‘incident’ has the meaning given that term in section 3551 of title 44, United States Code;CommentsClose CommentsPermalink





‘(10) the term ‘information infrastructure’ means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including--CommentsClose CommentsPermalink





‘(A) programmable electronic devices and communications networks; andCommentsClose CommentsPermalink





‘(B) any associated hardware, software, or data;CommentsClose CommentsPermalink





‘(11) the term ‘information security’ means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide--CommentsClose CommentsPermalink





‘(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity;CommentsClose CommentsPermalink





‘(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; andCommentsClose CommentsPermalink





‘(C) availability, by ensuring timely and reliable access to and use of information;CommentsClose CommentsPermalink





‘(12) the term ‘information sharing and analysis center’ means a self-governed forum whose members work together within a specific sector of critical infrastructure to identify, analyze, and share with other members and the Federal Government critical information relating to threats, vulnerabilities, or incidents to the security and resiliency of the critical infrastructure that comprises the specific sector;CommentsClose CommentsPermalink





‘(13) the term ‘information system’ has the meaning given that term in section 3502 of title 44, United States Code;CommentsClose CommentsPermalink





‘(14) the term ‘intelligence community’ has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4));CommentsClose CommentsPermalink





‘(15) the term ‘management controls’ means safeguards or countermeasures for an information system that focus on the management of risk and the management of information system security;CommentsClose CommentsPermalink





‘(16) the term ‘National Cybersecurity Advisory Council’ means the National Cybersecurity Advisory Council established under section 239;CommentsClose CommentsPermalink





‘(17) the term ‘national cyber emergency’ means an actual or imminent action by any individual or entity to exploit a cyber risk in a manner that disrupts, attempts to disrupt, or poses a significant risk of disruption to the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure;CommentsClose CommentsPermalink





‘(18) the term ‘national information infrastructure’ means information infrastructure--CommentsClose CommentsPermalink





‘(A) that is owned, operated, or controlled within or from the United States; andCommentsClose CommentsPermalink





‘(B) that is not owned, operated, controlled, or licensed for use by a Federal agency;CommentsClose CommentsPermalink





‘(19) the term ‘national security system’ has the meaning given that term in section 3551 of title 44, United States Code;CommentsClose CommentsPermalink





‘(20) the term ‘operational controls’ means the safeguards and countermeasures for an information system that are primarily implemented and executed by individuals not systems;CommentsClose CommentsPermalink





‘(21) the term ‘sector-specific agency’ means the relevant Federal agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category under the National Infrastructure Protection Plan, or any other appropriate Federal agency identified by the President after the date of enactment of this subtitle;CommentsClose CommentsPermalink





‘(22) the term ‘sector coordinating councils’ means self-governed councils that are composed of representatives of key stakeholders within a specific sector of critical infrastructure that serve as the principal private sector policy coordination and planning entities with the Federal Government relating to the security and resiliency of the critical infrastructure that comprise that sector;CommentsClose CommentsPermalink





‘(23) the term ‘security controls’ means the management, operational, and technical controls prescribed for an information system to protect the information security of the system;CommentsClose CommentsPermalink





‘(24) the term ‘small business concern’ has the meaning given that term under section 3 of the Small Business Act (15 U.S.C. 632);CommentsClose CommentsPermalink





‘(25) the term ‘technical controls’ means the safeguards or countermeasures for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system;CommentsClose CommentsPermalink





‘(26) the term ‘terrorism information’ has the meaning given that term in section 1016 of the Intelligence Reform and Terrorism Prevention Act of 2004 (6 U.S.C. 485);CommentsClose CommentsPermalink





‘(27) the term ‘United States person’ has the meaning given that term in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801); andCommentsClose CommentsPermalink





‘(28) the term ‘US-CERT’ means the United States Computer Emergency Readiness Team established under section 244.CommentsClose CommentsPermalink

‘SEC. 242. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

‘(a) Establishment-CommentsClose CommentsPermalink





‘(1) IN GENERAL- There is established within the Department a National Center for Cybersecurity and Communications.CommentsClose CommentsPermalink





‘(2) OPERATIONAL ENTITY- The Center may--CommentsClose CommentsPermalink





‘(A) enter into contracts for the procurement of property and services for the Center; andCommentsClose CommentsPermalink





‘(B) appoint employees of the Center in accordance with the civil service laws of the United States.CommentsClose CommentsPermalink





‘(b) Director-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Center shall be headed by a Director, who shall be appointed by the President, by and with the advice and consent of the Senate.CommentsClose CommentsPermalink





‘(2) REPORTING TO SECRETARY- The Director shall report directly to the Secretary and serve as the principal advisor to the Secretary on cybersecurity and the operations, security, and resiliency of the information infrastructure and communications infrastructure of the United States.CommentsClose CommentsPermalink





‘(3) PRESIDENTIAL ADVICE- The Director shall regularly advise the President on the exercise of the authorities provided under this subtitle or any other provision of law relating to the security of the Federal information infrastructure or an agency information infrastructure.CommentsClose CommentsPermalink





‘(4) QUALIFICATIONS- The Director shall be appointed from among individuals who have--CommentsClose CommentsPermalink





‘(A) a demonstrated ability in and knowledge of information technology, cybersecurity, and the operations, security and resiliency of communications networks; andCommentsClose CommentsPermalink





‘(B) significant executive leadership and management experience in the public or private sector.CommentsClose CommentsPermalink





‘(5) LIMITATION ON SERVICE-CommentsClose CommentsPermalink





‘(A) IN GENERAL- Subject to subparagraph (B), the individual serving as the Director may not, while so serving, serve in any other capacity in the Federal Government, except to the extent that the individual serving as Director is doing so in an acting capacity.CommentsClose CommentsPermalink





‘(B) EXCEPTION- The Director may serve on any commission, board, council, or similar entity with responsibilities or duties relating to cybersecurity or the operations, security, and resiliency of the information infrastructure and communications infrastructure of the United States at the direction of the President or as otherwise provided by law.CommentsClose CommentsPermalink





‘(c) Deputy Directors-CommentsClose CommentsPermalink





‘(1) IN GENERAL- There shall be not less than 2 Deputy Directors for the Center, who shall report to the Director.CommentsClose CommentsPermalink





‘(2) INFRASTRUCTURE PROTECTION-CommentsClose CommentsPermalink





‘(A) APPOINTMENT- There shall be a Deputy Director appointed by the Secretary, who shall have expertise in infrastructure protection.CommentsClose CommentsPermalink





‘(B) RESPONSIBILITIES- The Deputy Director appointed under subparagraph (A) shall--CommentsClose CommentsPermalink





‘(i) assist the Director and the Assistant Secretary for Infrastructure Protection in coordinating, managing, and directing the information, communications, and physical infrastructure protection responsibilities and activities of the Department, including activities under Homeland Security Presidential Directive-7, or any successor thereto, and the National Infrastructure Protection Plan, or any successor thereto;CommentsClose CommentsPermalink





‘(ii) review the budget for the Center and the Office of Infrastructure Protection before submission of the budget to the Secretary to ensure that activities are appropriately coordinated;CommentsClose CommentsPermalink





‘(iii) develop, update periodically, and submit to the appropriate committees of Congress a strategic plan detailing how critical infrastructure protection activities will be coordinated between the Center, the Office of Infrastructure Protection, and the private sector;CommentsClose CommentsPermalink





‘(iv) subject to the direction of the Director resolve conflicts between the Center and the Office of Infrastructure Protection relating to the information, communications, and physical infrastructure protection responsibilities of the Center and the Office of Infrastructure Protection; andCommentsClose CommentsPermalink





‘(v) perform such other duties as the Director may assign.CommentsClose CommentsPermalink





‘(C) ANNUAL EVALUATION- The Assistant Secretary for Infrastructure Protection shall submit annually to the Director an evaluation of the performance of the Deputy Director appointed under subparagraph (A).CommentsClose CommentsPermalink





‘(3) INTELLIGENCE COMMUNITY- The Director of National Intelligence shall identify an employee of an element of the intelligence community to serve as a Deputy Director of the Center. The employee shall be detailed to the Center on a reimbursable basis for such period as is agreed to by the Director and the Director of National Intelligence, and, while serving as Deputy Director, shall report directly to the Director of the Center.CommentsClose CommentsPermalink





‘(d) Liaison Officers-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Secretary of Defense, the Attorney General, the Secretary of Commerce, and the Director of National Intelligence shall detail personnel to the Center to act as full-time liaisons with the Department of Defense, the Department of Justice, the National Institute of Standards and Technology, and elements of the intelligence community to assist in coordination between and among the Center, the Department of Defense, the Department of Justice, the National Institute of Standards and Technology, and elements of the intelligence community.CommentsClose CommentsPermalink





‘(2) PRIVATE SECTOR-CommentsClose CommentsPermalink





‘(A) IN GENERAL- Consistent with applicable law and ethics requirements, and except as provided in subparagraph (B), the Director may authorize representatives from private sector entities to participate in the activities of the Center to improve the information sharing, analysis, and coordination of activities of the US-CERT.CommentsClose CommentsPermalink





‘(B) LIMITATION- A representative from a private sector entity authorized to participate in the activities of the Center under subparagraph (A) may not participate in any activities of the Center under section 248, 249, or 250.CommentsClose CommentsPermalink





‘(e) Privacy Officer-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director, in consultation with the Secretary, shall designate a full-time privacy officer, who shall report to the Director.CommentsClose CommentsPermalink





‘(2) DUTIES- The privacy officer designated under paragraph (1) shall have primary responsibility for implementation by the Center of the privacy policy for the Department established by the Privacy Officer appointed under section 222.CommentsClose CommentsPermalink





‘(f) Duties of Director-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director shall--CommentsClose CommentsPermalink





‘(A) working cooperatively with the private sector, lead the Federal effort to secure, protect, and ensure the resiliency of the Federal information infrastructure, national information infrastructure, and communications infrastructure of the United States, including communications networks;CommentsClose CommentsPermalink





‘(B) assist in the identification, remediation, and mitigation of vulnerabilities to the Federal information infrastructure and the national information infrastructure;CommentsClose CommentsPermalink





‘(C) provide dynamic, comprehensive, and continuous situational awareness of the security status of the Federal information infrastructure, national information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States by sharing and integrating classified and unclassified information, including information relating to threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the infrastructure or systems, on a routine and continuous basis with--CommentsClose CommentsPermalink





‘(i) the National Threat Operations Center of the National Security Agency;CommentsClose CommentsPermalink





‘(ii) the United States Cyber Command, including the Joint Task Force-Global Network Operations;CommentsClose CommentsPermalink





‘(iii) the Cyber Crime Center of the Department of Defense;CommentsClose CommentsPermalink





‘(iv) the National Cyber Investigative Joint Task Force;CommentsClose CommentsPermalink





‘(v) the Intelligence Community Incident Response Center;CommentsClose CommentsPermalink





‘(vi) any other Federal agency, or component thereof, identified by the Director; andCommentsClose CommentsPermalink





‘(vii) any non-Federal entity, including, where appropriate, information sharing and analysis centers, identified by the Director, with the concurrence of the owner or operator of that entity and consistent with applicable law;CommentsClose CommentsPermalink





‘(D) work with the entities described in subparagraph (C) to establish policies and procedures that enable information sharing between and among the entities;CommentsClose CommentsPermalink





‘(E)(i) develop, in coordination with the Assistant Secretary for Infrastructure Protection, other Federal agencies, the private sector, and State and local governments, a national incident response plan that details the roles of Federal agencies, State and local governments, and the private sector, including plans to be executed in response to a declaration of a national cyber emergency by the President under section 249; andCommentsClose CommentsPermalink





‘(ii) establish mechanisms for assisting owners or operators of critical infrastructure, including covered critical infrastructure, in the deployment of emergency measures or other actions, including measures to restore the critical infrastructure in the event of the destruction or a serious disruption of the critical infrastructure;CommentsClose CommentsPermalink





‘(F) conduct risk-based assessments of the Federal information infrastructure with respect to acts of terrorism, natural disasters, and other large-scale disruptions and provide the results of the assessments to the Director of Cyberspace Policy and to affected Federal agencies;CommentsClose CommentsPermalink





‘(G) develop, oversee the implementation of, and enforce policies, principles, and guidelines on information security for the Federal information infrastructure, including timely adoption of and compliance with standards developed by the National Institute of Standards and Technology under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3);CommentsClose CommentsPermalink





‘(H) provide assistance to the National Institute of Standards and Technology in developing standards under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3);CommentsClose CommentsPermalink





‘(I) provide to Federal agencies mandatory security controls to mitigate and remediate vulnerabilities of and incidents affecting the Federal information infrastructure;CommentsClose CommentsPermalink





‘(J) subject to paragraph (2), and as needed, assist the Director of the Office of Management and Budget and the Director of Cyberspace Policy in conducting analysis and prioritization of budgets, resources, and policies relating to the security of the Federal information infrastructure;CommentsClose CommentsPermalink





‘(K) in accordance with section 253, develop, periodically update, and implement a supply chain risk management strategy to enhance, in a risk-based and cost-effective manner, the security of the communications and information technology products and services purchased by the Federal Government;CommentsClose CommentsPermalink





‘(L) notify the Director of Cyberspace Policy of any incident involving the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure that could compromise or significantly affect economic or national security;CommentsClose CommentsPermalink





‘(M) consult, in coordination with the Director of Cyberspace Policy, with appropriate international partners to enhance the security of the Federal information infrastructure, national information infrastructure, and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States;CommentsClose CommentsPermalink





‘(N)(i) coordinate and integrate information to analyze the composite security state of the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community;CommentsClose CommentsPermalink





‘(ii) ensure the information required under clause (i) and section 3553(c)(1)(A) of title 44, United States Code, including the views of the Director on the adequacy and effectiveness of information security throughout the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, is available on an automated and continuous basis through the system maintained under section 3552(a)(3)(D) of title 44, United States Code;CommentsClose CommentsPermalink





‘(iii) in conjunction with the quadrennial homeland security review required under section 707, and at such other times determined appropriate by the Director, analyze the composite security state of the national information infrastructure and submit to the President, Congress, and the Secretary a report regarding actions necessary to enhance the composite security state of the national information infrastructure based on the analysis; andCommentsClose CommentsPermalink





‘(iv) foster collaboration and serve as the primary contact between the Federal Government, State and local governments, and private entities on matters relating to the security of the Federal information infrastructure and the national information infrastructure;CommentsClose CommentsPermalink





‘(O) oversee the development, implementation, and management of security requirements for Federal agencies relating to the external access points to or from the Federal information infrastructure;CommentsClose CommentsPermalink





‘(P) establish, develop, and oversee the capabilities and operations within the US-CERT as required by section 244;CommentsClose CommentsPermalink





‘(Q) oversee the operations of the National Communications System, as described in Executive Order 12472 (49 Fed. Reg. 13471; relating to the assignment of national security and emergency preparedness telecommunications functions), as amended by Executive Order 13286 (68 Fed. Reg. 10619) and Executive Order 13407 (71 Fed. Reg. 36975), or any successor thereto, including planning for and providing communications for the Federal Government under all circumstances, including crises, emergencies, attacks, recoveries, and reconstitutions;CommentsClose CommentsPermalink





‘(R) ensure, in coordination with the privacy officer designated under subsection (e), the Privacy Officer appointed under section 222, and the Director of the Office of Civil Rights and Civil Liberties appointed under section 705, that the activities of the Center comply with all policies, regulations, and laws protecting the privacy and civil liberties of United States persons;CommentsClose CommentsPermalink





‘(S) subject to the availability of resources, in accordance with applicable law relating to the protection of trade secrets, and at the discretion of the Director, provide voluntary technical assistance--CommentsClose CommentsPermalink





‘(i) at the request of an owner or operator of covered critical infrastructure, to assist the owner or operator in complying with sections 248 and 249, including implementing required security or emergency measures and developing response plans for national cyber emergencies declared under section 249; andCommentsClose CommentsPermalink





‘(ii) at the request of the owner or operator of national information infrastructure that is not covered critical infrastructure, and based on risk, to assist the owner or operator in implementing best practices, and related standards and guidelines, recommended under section 247 and other measures necessary to mitigate or remediate vulnerabilities of the information infrastructure and the consequences of efforts to exploit the vulnerabilities;CommentsClose CommentsPermalink





‘(T)(i) conduct, in consultation with the National Cybersecurity Advisory Council, the head of appropriate sector-specific agencies, and any private sector entity determined appropriate by the Director, risk-based assessments of national information infrastructure and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States, on a sector-by-sector basis, with respect to acts of terrorism, natural disasters, and other large-scale disruptions or financial harm, which shall identify and prioritize risks to the national information infrastructure and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States, including vulnerabilities and associated consequences; andCommentsClose CommentsPermalink





‘(ii) coordinate and evaluate the mitigation or remediation of vulnerabilities and consequences identified under clause (i);CommentsClose CommentsPermalink





‘(U) regularly evaluate and assess technologies designed to enhance the protection of the Federal information infrastructure and national information infrastructure, including an assessment of the cost-effectiveness of the technologies;CommentsClose CommentsPermalink





‘(V) promote the use of the best practices recommended under section 247 to State and local governments and the private sector;CommentsClose CommentsPermalink





‘(W) develop and implement outreach and awareness programs on cybersecurity, including--CommentsClose CommentsPermalink





‘(i) a public education campaign to increase the awareness of cybersecurity, cyber safety, and cyber ethics, which shall include use of the Internet, social media, entertainment, and other media to reach the public;CommentsClose CommentsPermalink





‘(ii) an education campaign to increase the understanding of State and local governments and private sector entities of the costs of failing to ensure effective security of information infrastructure and cost-effective methods to mitigate and remediate vulnerabilities; andCommentsClose CommentsPermalink





‘(iii) outcome-based performance measures to determine the success of the programs;CommentsClose CommentsPermalink





‘(X) develop and implement a national cybersecurity exercise program that includes--CommentsClose CommentsPermalink





‘(i) the participation of State and local governments, international partners of the United States, and the private sector;CommentsClose CommentsPermalink





‘(ii) an after action report analyzing lessons learned from exercises and identifying vulnerabilities to be remediated or mitigated; andCommentsClose CommentsPermalink





‘(iii) oversight, in coordination with the Director of the Office of Cyberspace Policy, of the efforts by Federal agencies to address deficiencies identified in the after action reports required under clause (ii);CommentsClose CommentsPermalink





‘(Y) coordinate with the Assistant Secretary for Infrastructure Protection to ensure that--CommentsClose CommentsPermalink





‘(i) cybersecurity is appropriately addressed in carrying out the infrastructure protection responsibilities described in section 201(d); andCommentsClose CommentsPermalink





‘(ii) the operations of the Center and the Office of Infrastructure Protection avoid duplication and use, to the maximum extent practicable, joint mechanisms for information sharing and coordination with the private sector;CommentsClose CommentsPermalink





‘(Z) oversee the activities of the Office of Emergency Communications established under section 1801;CommentsClose CommentsPermalink





‘(AA) in coordination with the Director of the Office of Cyberspace Policy and the heads of relevant Federal agencies, develop and implement an identity management strategy for cyberspace, which shall include, at a minimum, research and development goals, an analysis of appropriate protections for privacy and civil liberties, and mechanisms to develop and disseminate best practices and standards relating to identity management, including usability and transparency; andCommentsClose CommentsPermalink





‘(BB) perform such other duties as the Secretary may direct relating to the security and resiliency of the information and communications infrastructure of the United States.CommentsClose CommentsPermalink





‘(2) BUDGET ANALYSIS- In conducting analysis and prioritization of budgets under paragraph (1)(J), the Director--CommentsClose CommentsPermalink





‘(A) in coordination with the Director of the Office of Management and Budget, may access information from any Federal agency regarding the finances, budget, and programs of the Federal agency relevant to the security of the Federal information infrastructure;CommentsClose CommentsPermalink





‘(B) may make recommendations to the Director of the Office of Management and Budget and the Director of Cyberspace Policy regarding the budget for each Federal agency to ensure that adequate funding is devoted to securing the Federal information infrastructure, in accordance with policies, principles, and guidelines established by the Director under this subtitle; andCommentsClose CommentsPermalink





‘(C) shall provide copies of any recommendations made under subparagraph (B) to--CommentsClose CommentsPermalink





‘(i) the Committee on Appropriations of the Senate;CommentsClose CommentsPermalink





‘(ii) the Committee on Appropriations of the House of Representatives; andCommentsClose CommentsPermalink





‘(iii) the appropriate committees of Congress.CommentsClose CommentsPermalink





‘(g) Use of Mechanisms for Collaboration- In carrying out the responsibilities and authorities of the Director under this subtitle, to the maximum extent practicable, the Director shall use mechanisms for collaboration and information sharing (including mechanisms relating to the identification and communication of threats, vulnerabilities, and associated consequences) established by other components of the Department or other Federal agencies to avoid unnecessary duplication or waste.CommentsClose CommentsPermalink





‘(h) Sufficiency of Resources Plan-CommentsClose CommentsPermalink





‘(1) REPORT- Not later than 120 days after the date of enactment of this subtitle, the Director of the Office of Management and Budget shall submit to the appropriate committees of Congress and the Comptroller General of the United States a report on the resources and staff necessary to carry out fully the responsibilities under this subtitle.CommentsClose CommentsPermalink





‘(2) COMPTROLLER GENERAL REVIEW-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Comptroller General of the United States shall evaluate the reasonableness and adequacy of the report submitted by the Director under paragraph (1).CommentsClose CommentsPermalink





‘(B) REPORT- Not later than 60 days after the date on which the report is submitted under paragraph (1), the Comptroller General shall submit to the appropriate committees of Congress a report containing the findings of the review under subparagraph (A).CommentsClose CommentsPermalink





‘(i) Functions Transferred- There are transferred to the Center the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System, including all the functions, personnel, assets, authorities, and liabilities of the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System.CommentsClose CommentsPermalink





‘(j) Assistant to the Director for State, Local, and Private Sector Outreach- The Director shall identify a senior official in the Center who--CommentsClose CommentsPermalink





‘(1) shall report directly to the Director; andCommentsClose CommentsPermalink





‘(2) in coordination with the Special Assistant to the Secretary appointed under section 102(f), shall--CommentsClose CommentsPermalink





‘(A) advise the Director on policies and regulations, rules, requirements or other actions affecting the private sector, including the economic impact;CommentsClose CommentsPermalink





‘(B) work with individual businesses and other nongovernmental organizations to foster dialogue with the Center;CommentsClose CommentsPermalink





‘(C) foster partnerships and facilitate communication between the Center and State and local governments and private sector entities;CommentsClose CommentsPermalink





‘(D) coordinate and maintain communication and interaction with State and local governments and private sector entities on matters relating to the security of the Federal information infrastructure and the national information infrastructure;CommentsClose CommentsPermalink





‘(E) assist the Director in sharing best practices, guidelines, and other important information relating to the policies, goals, and activities of the Center;CommentsClose CommentsPermalink





‘(F) assist the Director in developing and implementing the national cybersecurity exercise program under subsection (f)(1)(X) as it relates to State and local governments and private sector entities;CommentsClose CommentsPermalink





‘(G) assist the Director in developing the national incident response plan under subsection (f)(1)(E) as it relates to State and local governments and private sector entities;CommentsClose CommentsPermalink





‘(H) assist the Director in information sharing activities of the Center as it relates to State and local governments and private sector entities; andCommentsClose CommentsPermalink





‘(I) perform any other duties, as directed by the Director.CommentsClose CommentsPermalink

‘SEC. 243. PHYSICAL AND CYBER INFRASTRUCTURE COLLABORATION.

‘(a) In General- The Director and the Assistant Secretary for Infrastructure Protection shall coordinate the information, communications, and physical infrastructure protection responsibilities and activities of the Center and the Office of Infrastructure Protection.CommentsClose CommentsPermalink





‘(b) Oversight- The Secretary shall ensure that the coordination described in subsection (a) occurs.CommentsClose CommentsPermalink

‘SEC. 244. UNITED STATES COMPUTER EMERGENCY READINESS TEAM.

‘(a) Establishment of Office- There is established within the Center, the United States Computer Emergency Readiness Team, which shall be headed by a Director, who shall be selected from the Senior Executive Service by the Secretary.CommentsClose CommentsPermalink





‘(b) Responsibilities- The US-CERT shall--CommentsClose CommentsPermalink





‘(1) collect, coordinate, and disseminate information on--CommentsClose CommentsPermalink





‘(A) risks to the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure; andCommentsClose CommentsPermalink





‘(B) security controls to enhance the security of the Federal information infrastructure or the national information infrastructure against the risks identified in subparagraph (A); andCommentsClose CommentsPermalink





‘(2) establish a mechanism for engagement with the private sector.CommentsClose CommentsPermalink





‘(c) Monitoring, Analysis, Warning, and Response-CommentsClose CommentsPermalink





‘(1) DUTIES- Subject to paragraph (2), the US-CERT shall--CommentsClose CommentsPermalink





‘(A) provide analysis and reports to Federal agencies on the security of the Federal information infrastructure;CommentsClose CommentsPermalink





‘(B) provide continuous, automated monitoring of the Federal information infrastructure at external Internet access points, which shall include detection and warning of threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the information security of the Federal information infrastructure;CommentsClose CommentsPermalink





‘(C) warn Federal agencies of threats, vulnerabilities, incidents, and anomalous activities that could affect the Federal information infrastructure;CommentsClose CommentsPermalink





‘(D) develop, recommend, and deploy security controls to mitigate or remediate vulnerabilities;CommentsClose CommentsPermalink





‘(E) support Federal agencies in conducting risk assessments of the agency information infrastructure;CommentsClose CommentsPermalink





‘(F) disseminate to Federal agencies risk analyses of incidents that could impair the risk-based security of the Federal information infrastructure;CommentsClose CommentsPermalink





‘(G) develop and acquire predictive analytic tools to evaluate threats, vulnerabilities, traffic, trends, incidents, and anomalous activities;CommentsClose CommentsPermalink





‘(H) aid in the detection of, and warn owners or operators of national information infrastructure regarding, threats, vulnerabilities, and incidents, affecting the national information infrastructure, including providing--CommentsClose CommentsPermalink





‘(i) timely, targeted, and actionable notifications of threats, vulnerabilities, and incidents;CommentsClose CommentsPermalink





‘(ii) notifications under this subparagraph; andCommentsClose CommentsPermalink





‘(iii) recommended security controls to mitigate or remediate vulnerabilities; andCommentsClose CommentsPermalink





‘(I) respond to assistance requests from Federal agencies and, subject to the availability of resources, owners or operators of the national information infrastructure to--CommentsClose CommentsPermalink





‘(i) isolate, mitigate, or remediate incidents;CommentsClose CommentsPermalink





‘(ii) recover from damages and mitigate or remediate vulnerabilities; andCommentsClose CommentsPermalink





‘(iii) evaluate security controls and other actions taken to secure information infrastructure and incorporate lessons learned into best practices, policies, principles, and guidelines.CommentsClose CommentsPermalink





‘(2) REQUIREMENT- With respect to the Federal information infrastructure, the US-CERT shall conduct the activities described in paragraph (1) in a manner consistent with the responsibilities of the head of a Federal agency described in section 3553 of title 44, United States Code.CommentsClose CommentsPermalink





‘(3) REPORT- Not later than 1 year after the date of enactment of this subtitle, and every year thereafter, the Secretary shall--CommentsClose CommentsPermalink





‘(A) in conjunction with the Inspector General of the Department, conduct an independent audit or review of the activities of the US-CERT under paragraph (1)(B), which shall include, at a minimum, an assessment of whether and to what extent the activities authorized under paragraph (1)(B) have monitored communications other than communications to or from a Federal agency; andCommentsClose CommentsPermalink





‘(B) submit to the appropriate committees of Congress and the President a report regarding the audit or review under subparagraph (A).CommentsClose CommentsPermalink





‘(4) CLASSIFIED ANNEX- A report submitted under paragraph (3) shall be submitted in an unclassified form, but may include a classified annex, if necessary.CommentsClose CommentsPermalink





‘(d) Procedures for Federal Government- Not later than 90 days after the date of enactment of this subtitle, the head of each Federal agency shall establish procedures for the Federal agency that ensure that the US-CERT can perform the functions described in subsection (c) in relation to the Federal agency.CommentsClose CommentsPermalink





‘(e) Operational Updates- The US-CERT shall provide unclassified and, as appropriate, classified updates regarding the composite security state of the Federal information infrastructure to the Federal Information Security Taskforce.CommentsClose CommentsPermalink





‘(f) Federal Points of Contact- The Director of the US-CERT shall designate a principal point of contact within the US-CERT for each Federal agency to--CommentsClose CommentsPermalink





‘(1) maintain communication;CommentsClose CommentsPermalink





‘(2) ensure cooperative engagement and information sharing; andCommentsClose CommentsPermalink





‘(3) respond to inquiries or requests.CommentsClose CommentsPermalink





‘(g) Requests for Information or Physical Access-CommentsClose CommentsPermalink





‘(1) INFORMATION ACCESS- Upon request of the Director of the US-CERT, the head of a Federal agency or an Inspector General for a Federal agency shall provide any law enforcement information, intelligence information, terrorism information, or any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure or the national information infrastructure necessary to carry out the duties, responsibilities, and authorities under this subtitle.CommentsClose CommentsPermalink





‘(2) PHYSICAL ACCESS- Upon request of the Director, and in consultation with the head of a Federal agency, the Federal agency shall provide physical access to any facility of the Federal agency necessary to determine whether the Federal agency is in compliance with any policies, principles, and guidelines established by the Director under this subtitle, or otherwise necessary to carry out the duties, responsibilities, and authorities of the Director applicable to the Federal information infrastructure.CommentsClose CommentsPermalink

‘SEC. 245. ADDITIONAL AUTHORITIES OF THE DIRECTOR OF THE NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

‘(a) Access to Information- Unless otherwise directed by the President--CommentsClose CommentsPermalink





‘(1) the Director shall access, receive, and analyze law enforcement information, intelligence information, terrorism information, and any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or national information infrastructure from Federal agencies and, consistent with applicable law, State and local governments (including law enforcement agencies), and private entities, including information provided by any contractor to a Federal agency regarding the security of the agency information infrastructure;CommentsClose CommentsPermalink





‘(2) any Federal agency in possession of law enforcement information, intelligence information, terrorism information, or any other information (including information relating to incidents provided under subsections (a)(4) and (c) of section 246) relevant to the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or national information infrastructure shall provide that information to the Director in a timely manner; andCommentsClose CommentsPermalink





‘(3) the Director, in coordination with the Director of the Office of Management and Budget, the Attorney General, the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee), the Director of National Intelligence, and the Archivist of the United States, shall establish guidelines to ensure that information is transferred, stored, and preserved--CommentsClose CommentsPermalink





‘(A) in accordance with applicable laws relating to the protection of trade secrets and other applicable laws; andCommentsClose CommentsPermalink





‘(B) in a manner that protects the privacy and civil liberties of United States persons and intelligence sources and methods.CommentsClose CommentsPermalink





‘(b) Operational Evaluations-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director--CommentsClose CommentsPermalink





‘(A) subject to paragraph (2), shall develop, maintain, and enhance capabilities to evaluate the security of the Federal information infrastructure as described in section 3554(a)(3) of title 44, United States Code, including the ability to conduct risk-based penetration testing and vulnerability assessments;CommentsClose CommentsPermalink





‘(B) in carrying out subparagraph (A), may request technical assistance from the Director of the Federal Bureau of Investigation, the Director of the National Security Agency, the head of any other Federal agency that may provide support, and any nongovernmental entity contracting with the Department or another Federal agency; andCommentsClose CommentsPermalink





‘(C) in consultation with the Attorney General and the Privacy and Civil Liberties Oversight Board established under section 1061 of the National Security Intelligence Reform Act of 2004 (42 U.S.C. 2000ee), shall develop guidelines to ensure compliance with all applicable laws relating to the privacy of United States persons in carrying out the operational evaluations under subparagraph (A).CommentsClose CommentsPermalink





‘(2) OPERATIONAL EVALUATIONS-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director may conduct risk-based operational evaluations of the agency information infrastructure of any Federal agency, at a time determined by the Director, in consultation with the head of the Federal agency, using the capabilities developed under paragraph (1)(A).CommentsClose CommentsPermalink





‘(B) ANNUAL EVALUATION REQUIREMENT- If the Director conducts an operational evaluation under subparagraph (A) or an operational evaluation at the request of a Federal agency to meet the requirements of section 3554 of title 44, United States Code, the operational evaluation shall satisfy the requirements of section 3554 for the Federal agency for the year of the evaluation, unless otherwise specified by the Director.CommentsClose CommentsPermalink





‘(c) Corrective Measures and Mitigation Plans- If the Director determines that a Federal agency is not in compliance with applicable policies, principles, standards, and guidelines applicable to the Federal information infrastructure--CommentsClose CommentsPermalink





‘(1) the Director, in consultation with the Director of the Office of Management and Budget, may direct the head of the Federal agency to--CommentsClose CommentsPermalink





‘(A) take corrective measures to meet the policies, principles, standards, and guidelines; andCommentsClose CommentsPermalink





‘(B) develop a plan to remediate or mitigate any vulnerabilities addressed by the policies, principles, standards, and guidelines;CommentsClose CommentsPermalink





‘(2) within such time period as the Director shall prescribe, the head of the Federal agency shall--CommentsClose CommentsPermalink





‘(A) implement a corrective measure or develop a mitigation plan in accordance with paragraph (1); orCommentsClose CommentsPermalink





‘(B) submit to the Director, the Director of the Office of Management and Budget, the Inspector General for the Federal agency, and the appropriate committees of Congress a report indicating why the Federal agency has not implemented the corrective measure or developed a mitigation plan; andCommentsClose CommentsPermalink





‘(3) after providing notice to the head of the affected Federal agency, the Director may direct the isolation of any component of the agency information infrastructure, consistent with the contingency or continuity of operation plans applicable to the agency information infrastructure, until corrective measures are taken or mitigation plans approved by the Director are put in place, if--CommentsClose CommentsPermalink





‘(A) the head of the Federal agency has failed to comply with the corrective measures prescribed under paragraph (1); andCommentsClose CommentsPermalink





‘(B) the failure to comply presents a significant danger to the Federal information infrastructure.CommentsClose CommentsPermalink

‘SEC. 246. INFORMATION SHARING.

‘(a) Federal Agencies-CommentsClose CommentsPermalink





‘(1) INFORMATION SHARING PROGRAM- Consistent with the responsibilities described in sections 242 and 244, the Director, in consultation with the other members of the Chief Information Officers Council established under section 3603 of title 44, United States Code, and the Federal Information Security Taskforce, shall establish a program for sharing information with and between the Center and other Federal agencies that includes processes and procedures, including standard operating procedures--CommentsClose CommentsPermalink





‘(A) under which the Director regularly shares with each Federal agency--CommentsClose CommentsPermalink





‘(i) analysis and reports on the composite security state of the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, which shall include information relating to threats, vulnerabilities, incidents, or anomalous activities;CommentsClose CommentsPermalink





‘(ii) any available analysis and reports regarding the security of the agency information infrastructure; andCommentsClose CommentsPermalink





‘(iii) means and methods of preventing, responding to, mitigating, and remediating vulnerabilities; andCommentsClose CommentsPermalink





‘(B) under which the Director may request information from Federal agencies concerning the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure necessary to carry out the duties of the Director under this subtitle or any other provision of law.CommentsClose CommentsPermalink





‘(2) CONTENTS- The program established under this section shall include--CommentsClose CommentsPermalink





‘(A) timeframes for the sharing of information under paragraph (1);CommentsClose CommentsPermalink





‘(B) guidance on what information shall be shared, including information regarding incidents;CommentsClose CommentsPermalink





‘(C) a tiered structure that provides guidance for the sharing of urgent information; andCommentsClose CommentsPermalink





‘(D) processes and procedures under which the Director or the head of a Federal agency may report noncompliance with the program to the Director of Cyberspace Policy.CommentsClose CommentsPermalink





‘(3) US-CERT- The Director of the US-CERT shall ensure that the head of each Federal agency has continual access to data collected by the US-CERT regarding the agency information infrastructure of the Federal agency.CommentsClose CommentsPermalink





‘(4) FEDERAL AGENCIES-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The head of a Federal agency shall comply with all processes and procedures established under this subsection regarding notification to the Director relating to incidents.CommentsClose CommentsPermalink





‘(B) IMMEDIATE NOTIFICATION REQUIRED- Unless otherwise directed by the President, any Federal agency with a national security system shall immediately notify the Director regarding any incident affecting the risk-based security of the national security system.CommentsClose CommentsPermalink





‘(b) State and Local Governments, Private Sector, and International Partners-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director shall establish processes and procedures, including standard operating procedures, to ensure bidirectional information sharing with State and local governments, private entities, and international partners of the United States on--CommentsClose CommentsPermalink





‘(A) threats, vulnerabilities, incidents, and anomalous activities affecting the national information infrastructure; andCommentsClose CommentsPermalink





‘(B) means and methods of preventing, responding to, and mitigating and remediating vulnerabilities.CommentsClose CommentsPermalink





‘(2) CONTENTS- The processes and procedures established under paragraph (1) shall include--CommentsClose CommentsPermalink





‘(A) means or methods of accessing classified or unclassified information, as appropriate and in accordance with applicable laws regarding trade secrets, that will provide situational awareness of the security of the Federal information infrastructure and the national information infrastructure relating to threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities affecting the Federal information infrastructure or the national information infrastructure;CommentsClose CommentsPermalink





‘(B) a mechanism, established in consultation with the heads of the relevant sector-specific agencies, sector coordinating councils, and information sharing and analysis centers, by which owners and operators of covered critical infrastructure shall report incidents in the information infrastructure for covered critical infrastructure under subsection (c)(1)(A);CommentsClose CommentsPermalink





‘(C) guidance on the form, content, and priority of incident reports that shall be submitted under subsection (c)(1)(A), which shall--CommentsClose CommentsPermalink





‘(i) include appropriate mechanisms to protect--CommentsClose CommentsPermalink





‘(I) information in accordance with section 251;CommentsClose CommentsPermalink





‘(II) personally identifiable information; andCommentsClose CommentsPermalink





‘(III) trade secrets; andCommentsClose CommentsPermalink





‘(ii) prioritize the reporting of incidents based on the risk the incident poses to the disruption of the reliable operation of the covered critical infrastructure;CommentsClose CommentsPermalink





‘(D) a procedure for notifying an information technology provider if a vulnerability is detected in the product or service produced by the information technology provider and, where possible, working with the information technology provider to remediate the vulnerability before any public disclosure of the vulnerability so as to minimize the opportunity for the vulnerability to be exploited; andCommentsClose CommentsPermalink





‘(E) an evaluation of the need to provide security clearances to employees of State and local governments, private entities, and international partners to carry out this subsection.CommentsClose CommentsPermalink





‘(3) GUIDELINES- The Director, in consultation with the Attorney General, the Director of National Intelligence, and the Privacy Officer established under section 242(e), shall develop guidelines to protect the privacy and civil liberties of United States persons and intelligence sources and methods, while carrying out this subsection.CommentsClose CommentsPermalink





‘(c) Incidents-CommentsClose CommentsPermalink





‘(1) NON-FEDERAL ENTITIES-CommentsClose CommentsPermalink





‘(A) IN GENERAL-CommentsClose CommentsPermalink





‘(i) MANDATORY REPORTING- Subject to clause (ii), the owner or operator of covered critical infrastructure shall report any incident affecting the information infrastructure of covered critical infrastructure to the extent the incident might indicate an actual or potential cyber risk, or exploitation of a cyber risk, in accordance with the policies and procedures for the mechanism established under subsection (b)(2)(B) and guidelines developed under subsection (b)(3).CommentsClose CommentsPermalink





‘(ii) LIMITATION- Clause (i) shall not authorize the Director, the Center, the Department, or any other Federal entity to--CommentsClose CommentsPermalink





‘(I) compel the disclosure of information relating to an incident unless otherwise authorized by law; orCommentsClose CommentsPermalink





‘(II) intercept a wire, oral, or electronic communication (as those terms are defined in section 2510 of title 18, United States Code), access a stored electronic or wire communication, install or use a pen register or trap and trace device, or conduct electronic surveillance (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801)) relating to an incident, unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, or the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.).CommentsClose CommentsPermalink





‘(B) REPORTING PROCEDURES- The Director shall establish procedures that enable and encourage the owner or operator of national information infrastructure to report to the Director regarding incidents affecting such information infrastructure.CommentsClose CommentsPermalink





‘(2) INFORMATION PROTECTION- Notwithstanding any other provision of law, information reported under paragraph (1) shall be protected from unauthorized disclosure, in accordance with section 251.CommentsClose CommentsPermalink





‘(d) Additional Responsibilities- The Director shall--CommentsClose CommentsPermalink





‘(1) share data collected on the Federal information infrastructure with the National Science Foundation and other accredited research institutions for the sole purpose of cybersecurity research in a manner that protects privacy and civil liberties of United States persons and intelligence sources and methods;CommentsClose CommentsPermalink





‘(2) establish a website to provide an opportunity for the public to provide--CommentsClose CommentsPermalink





‘(A) input about the operations of the Center; andCommentsClose CommentsPermalink





‘(B) recommendations for improvements of the Center; andCommentsClose CommentsPermalink





‘(3) in coordination with the Secretary of Defense, the Director of National Intelligence, the Secretary of State, and the Attorney General, develop information sharing pilot programs with international partners of the United States.CommentsClose CommentsPermalink

‘SEC. 247. PRIVATE SECTOR ASSISTANCE.

‘(a) In General- The Director, in consultation with the Director of the National Institute of Standards and Technology, the Director of the National Security Agency, the head of any relevant sector-specific agency, the National Cybersecurity Advisory Council, State and local governments, and any private entities the Director determines appropriate, shall establish a program to promote, and provide technical assistance authorized under section 242(f)(1)(S) relating to the implementation of, best practices and related standards and guidelines for securing the national information infrastructure, including the costs and benefits associated with the implementation of the best practices and related standards and guidelines.CommentsClose CommentsPermalink





‘(b) Analysis and Improvement of Standards and Guidelines- For purposes of the program established under subsection (a), the Director shall--CommentsClose CommentsPermalink





‘(1) regularly assess and evaluate cybersecurity standards and guidelines issued by private sector organizations, recognized international and domestic standards setting organizations, and Federal agencies; andCommentsClose CommentsPermalink





‘(2) in coordination with the National Institute of Standards and Technology, encourage the development of, and recommend changes to, the standards and guidelines described in paragraph (1) for securing the national information infrastructure.CommentsClose CommentsPermalink





‘(c) Guidance and Technical Assistance-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The Director shall promote best practices and related standards and guidelines to assist owners and operators of national information infrastructure in increasing the security of the national information infrastructure and protecting against and mitigating or remediating known vulnerabilities.CommentsClose CommentsPermalink





‘(2) REQUIREMENT- Technical assistance provided under section 242(f)(1)(S) and best practices promoted under this section shall be prioritized based on risk.CommentsClose CommentsPermalink





‘(d) Criteria- In promoting best practices or recommending changes to standards and guidelines under this section, the Director shall ensure that best practices, and related standards and guidelines--CommentsClose CommentsPermalink





‘(1) address cybersecurity in a comprehensive, risk-based manner;CommentsClose CommentsPermalink





‘(2) include consideration of the cost of implementing such best practices or of implementing recommended changes to standards and guidelines;CommentsClose CommentsPermalink





‘(3) increase the ability of the owners or operators of national information infrastructure to protect against and mitigate or remediate known vulnerabilities;CommentsClose CommentsPermalink





‘(4) are suitable, as appropriate, for implementation by small business concerns;CommentsClose CommentsPermalink





‘(5) as necessary and appropriate, are sector specific;CommentsClose CommentsPermalink





‘(6) to the maximum extent possible, incorporate standards and guidelines established by private sector organizations, recognized international and domestic standards setting organizations, and Federal agencies;CommentsClose CommentsPermalink





‘(7) consider voluntary programs by internet service providers to assist individuals using the internet service providers in the identification and mitigation of cyber threats and vulnerabilities, with the consent of the individual users; andCommentsClose CommentsPermalink





‘(8) provide sufficient flexibility to permit a range of security solutions.CommentsClose CommentsPermalink

‘SEC. 248. CYBER RISKS TO COVERED CRITICAL INFRASTRUCTURE.

‘(a) Identification of Cyber Risks-CommentsClose CommentsPermalink





‘(1) IN GENERAL- Based on the risk-based assessments conducted under section 242(f)(1)(T)(i), the Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, and in consultation with the National Cybersecurity Advisory Council and any private sector entity determined appropriate by the Director, shall, on a continuous and sector-by-sector basis, identify and evaluate the cyber risks to covered critical infrastructure.CommentsClose CommentsPermalink





‘(2) FACTORS TO BE CONSIDERED- In identifying and evaluating cyber risks under paragraph (1), the Director shall consider--CommentsClose CommentsPermalink





‘(A) the actual or assessed threat, including a consideration of adversary capabilities and intent, preparedness, target attractiveness, and deterrence capabilities;CommentsClose CommentsPermalink





‘(B) the extent and likelihood of death, injury, or serious adverse effects to human health and safety caused by a disruption of the reliable operation of covered critical infrastructure;CommentsClose CommentsPermalink





‘(C) the threat to or impact on national security caused by a disruption of the reliable operation of covered critical infrastructure;CommentsClose CommentsPermalink





‘(D) the extent to which the disruption of the reliable operation of covered critical infrastructure will disrupt the reliable operation of other covered critical infrastructure;CommentsClose CommentsPermalink





‘(E) the harm to the economy that would result from a disruption of the reliable operation of covered critical infrastructure; andCommentsClose CommentsPermalink





‘(F) other risk-based security factors that the Director, in consultation with the head of the sector-specific agency with responsibility for the covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, determine to be appropriate and necessary to protect public health and safety, critical infrastructure, or national and economic security.CommentsClose CommentsPermalink





‘(3) REPORT-CommentsClose CommentsPermalink





‘(A) IN GENERAL- Not later than 180 days after the date of enactment of this subtitle, and annually thereafter, the Director, in coordination with the head of the sector-specific agency with responsibility for the covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall submit to the appropriate committees of Congress a report on the findings of the identification and evaluation of cyber risks under this subsection. Each report submitted under this paragraph shall be submitted in an unclassified form, but may include a classified annex.CommentsClose CommentsPermalink





‘(B) INPUT- For purposes of the reports required under subparagraph (A), the Director shall create a process under which owners and operators of covered critical infrastructure may provide input on the findings of the reports.CommentsClose CommentsPermalink





‘(b) Risk-Based Security Performance Requirements-CommentsClose CommentsPermalink





‘(1) IN GENERAL- Not later than 270 days after the date of the enactment of this subtitle, in coordination with the heads of the sector-specific agencies with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, and in consultation with the National Cybersecurity Advisory Council and any private sector entity determined appropriate by the Director, the Director shall issue interim final regulations establishing risk-based security performance requirements to secure covered critical infrastructure against cyber risks through the adoption of security measures that satisfy the security performance requirements identified by the Director.CommentsClose CommentsPermalink





‘(2) PROCEDURES- The regulations issued under this subsection shall--CommentsClose CommentsPermalink





‘(A) include a process under which owners and operators of covered critical infrastructure are informed of identified cyber risks and security performance requirements designed to remediate or mitigate the cyber risks, in combination with best practices recommended under section 247;CommentsClose CommentsPermalink





‘(B) establish a process for owners and operators of covered critical infrastructure to select security measures, including any best practices recommended under section 247, that, in combination, satisfy the security performance requirements established by the Director under this subsection;CommentsClose CommentsPermalink





‘(C) establish a process for owners and operators of covered critical infrastructure to develop response plans for a national cyber emergency declared under section 249;CommentsClose CommentsPermalink





‘(D) establish a process under which the Director--CommentsClose CommentsPermalink





‘(i) is notified of the security measures selected by the owner or operator of covered critical infrastructure under subparagraph (B); andCommentsClose CommentsPermalink





‘(ii) may determine whether the proposed security measures satisfy the security performance requirements established by the Director under this subsection; andCommentsClose CommentsPermalink





‘(E) establish a process under which the Director--CommentsClose CommentsPermalink





‘(i) identifies to owners and operators of covered critical infrastructure cyber risks that are not capable of effective remediation or mitigation using available best practices or security measures;CommentsClose CommentsPermalink





‘(ii) provides owners and operators of covered critical infrastructure the opportunity to develop best practices or security measures to remediate or mitigate the cyber risks identified in clause (i) without the prior approval of the Director and without affecting the compliance of the covered critical infrastructure with the requirements under this section;CommentsClose CommentsPermalink





‘(iii) in accordance with applicable law relating to the protection of trade secrets, permits owners and operators of covered critical infrastructure to report to the Center the development of effective best practices or security measures to remediate or mitigate the cyber risks identified under clause (i); andCommentsClose CommentsPermalink





‘(iv) incorporates the best practices and security measures developed into the risk-based security performance requirements under this section.CommentsClose CommentsPermalink





‘(3) INTERNATIONAL COOPERATION ON SECURING COVERED CRITICAL INFRASTRUCTURE-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall--CommentsClose CommentsPermalink





‘(i) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States and the government of the country in which the information infrastructure is located of any cyber risks to the information infrastructure; andCommentsClose CommentsPermalink





‘(ii) coordinate with the government of the country in which the information infrastructure is located and, as appropriate, the owner or operator of the information infrastructure, regarding the implementation of security measures or other measures to the information infrastructure to mitigate or remediate cyber risks.CommentsClose CommentsPermalink





‘(B) INTERNATIONAL AGREEMENTS- The Director shall carry out this paragraph in a manner consistent with applicable international agreements.CommentsClose CommentsPermalink





‘(4) RISK-BASED SECURITY PERFORMANCE REQUIREMENTS-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The security performance requirements established by the Director under this subsection shall be--CommentsClose CommentsPermalink





‘(i) based on the factors listed in subsection (a)(2); andCommentsClose CommentsPermalink





‘(ii) designed to remediate or mitigate identified cyber risks and any associated consequences of an exploitation based on such risks.CommentsClose CommentsPermalink





‘(B) CONSULTATION- In establishing security performance requirements under this subsection, the Director shall, to the maximum extent practicable, consult with--CommentsClose CommentsPermalink





‘(i) the Director of the National Security Agency;CommentsClose CommentsPermalink





‘(ii) the Director of the National Institute of Standards and Technology;CommentsClose CommentsPermalink





‘(iii) the National Cybersecurity Advisory Council;CommentsClose CommentsPermalink





‘(iv) the heads of sector-specific agencies; andCommentsClose CommentsPermalink





‘(v) the heads of Federal agencies that are not sector-specific agencies with responsibilities for regulating the covered critical infrastructure.CommentsClose CommentsPermalink





‘(C) ALTERNATIVE MEASURES-CommentsClose CommentsPermalink





‘(i) IN GENERAL- The owners and operators of covered critical infrastructure shall have flexibility to implement any security measure, or combination thereof, to satisfy the security performance requirements described in subparagraph (A) and the Director may not disapprove under this section any proposed security measures, or combination thereof, based on the presence or absence of any particular security measure if the proposed security measures, or combination thereof, satisfy the security performance requirements established by the Director under this section or are consistent with the process for addressing new or evolving cyber risks established under paragraph (2)(E).CommentsClose CommentsPermalink





‘(ii) RECOMMENDED SECURITY MEASURES- The Director may recommend to an owner and operator of covered critical infrastructure a specific security measure, or combination thereof, that will satisfy the security performance requirements established by the Director. The absence of the recommended security measures, or combination thereof, may not serve as the basis for a disapproval of the security measure, or combination thereof, proposed by the owner or operator of covered critical infrastructure if the proposed security measure, or combination thereof, otherwise satisfies the security performance requirements established by the Director under this section.CommentsClose CommentsPermalink

‘SEC. 249. NATIONAL CYBER EMERGENCIES.

‘(a) Declaration-CommentsClose CommentsPermalink





‘(1) IN GENERAL- The President may issue a declaration of a national cyber emergency to covered critical infrastructure if there is an ongoing or imminent action by any individual or entity to exploit a cyber risk in a manner that disrupts, attempts to disrupt, or poses a significant risk of disruption to the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure. Any declaration under this section shall specify the covered critical infrastructure subject to the national cyber emergency.CommentsClose CommentsPermalink





‘(2) NOTIFICATION- Upon issuing a declaration under paragraph (1), the President shall, consistent with the protection of intelligence sources and methods, notify the owners and operators of the specified covered critical infrastructure and any other relevant private sector entity of the nature of the national cyber emergency.CommentsClose CommentsPermalink





‘(3) AUTHORITIES- If the President issues a declaration under paragraph (1), the Director shall--CommentsClose CommentsPermalink





‘(A) immediately direct the owners and operators of covered critical infrastructure subject to the declaration under paragraph (1) to implement response plans required under section 248(b)(2)(C);CommentsClose CommentsPermalink





‘(B) develop and coordinate emergency measures or actions necessary to preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of covered critical infrastructure;CommentsClose CommentsPermalink





‘(C) ensure that emergency measures or actions directed under this section represent the least disruptive means feasible to the operations of the covered critical infrastructure and to the national information infrastructure;CommentsClose CommentsPermalink





‘(D) subject to subsection (g), direct actions by other Federal agencies to respond to the national cyber emergency;CommentsClose CommentsPermalink





‘(E) coordinate with officials of State and local governments, international partners of the United States, owners and operators of covered critical infrastructure specified in the declaration, and other relevant private section entities to respond to the national cyber emergency;CommentsClose CommentsPermalink





‘(F) initiate a process under section 248 to address the cyber risk that may be exploited by the national cyber emergency; andCommentsClose CommentsPermalink





‘(G) provide voluntary technical assistance, if requested, under section 242(f)(1)(S).CommentsClose CommentsPermalink





‘(4) REIMBURSEMENT- A Federal agency shall be reimbursed for expenditures under this section from funds appropriated for the purposes of this section. Any funds received by a Federal agency as reimbursement for services or supplies furnished under the authority of this section shall be deposited to the credit of the appropriation or appropriations available on the date of the deposit for the services or supplies.CommentsClose CommentsPermalink





‘(5) CONSULTATION- In carrying out this section, the Director shall consult with the Secretary, the Secretary of Defense, the Director of the National Security Agency, the Director of the National Institute of Standards and Technology, and any other official, as directed by the President.CommentsClose CommentsPermalink





‘(6) PROHIBITED ACTIONS- The authority to direct compliance with an emergency measure or action under this section shall not authorize the Director, the Center, the Department, or any other Federal entity to--CommentsClose CommentsPermalink





‘(A) restrict or prohibit communications carried by, or over, covered critical infrastructure and not specifically directed to or from the covered critical infrastructure unless the Director determines that no other emergency measure or action will preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of the covered critical infrastructure or the national information infrastructure;CommentsClose CommentsPermalink





‘(B) control covered critical infrastructure;CommentsClose CommentsPermalink





‘(C) compel the disclosure of information unless specifically authorized by law; orCommentsClose CommentsPermalink





‘(D) intercept a wire, oral, or electronic communication (as those terms are defined in section 2510 of title 18, United States Code), access a stored electronic or wire communication, install or use a pen register or trap and trace device, or conduct electronic surveillance (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801)) relating to an incident, unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, or the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.).CommentsClose CommentsPermalink





‘(7) PRIVACY- In carrying out this section, the Director shall ensure that the privacy and civil liberties of United States persons are protected.CommentsClose CommentsPermalink





‘(b) Discontinuance of Emergency Measures-CommentsClose CommentsPermalink





‘(1) IN GENERAL- Any emergency measure or action developed under this section shall cease to have effect not later than 30 days after the date on which the President issued the declaration of a national cyber emergency, unless--CommentsClose CommentsPermalink





‘(A) the Director details in writing why the emergency measure or action remains necessary to address the identified national cyber emergency; andCommentsClose CommentsPermalink





‘(B) the President issues a written order or directive reaffirming the national cyber emergency, the continuing nature of the national cyber emergency, or the need to continue the adoption of the emergency measure or action.CommentsClose CommentsPermalink





‘(2) EXTENSIONS- An emergency measure or action extended in accordance with paragraph (1) may--CommentsClose CommentsPermalink





‘(A) remain in effect for not more than 30 days after the date on which the emergency measure or action was to cease to have effect; andCommentsClose CommentsPermalink





‘(B) unless a joint resolution described in subsection (f)(1) is enacted, be extended for not more than 3 additional 30-day periods, if the requirements of paragraph (1) and subsection (d) are met.CommentsClose CommentsPermalink





‘(c) Compliance With Emergency Measures-CommentsClose CommentsPermalink





‘(1) IN GENERAL- Subject to paragraph (2), the owner or operator of covered critical infrastructure shall immediately comply with any emergency measure or action developed by the Director under this section during the pendency of any declaration by the President under subsection (a)(1) or an extension under subsection (b)(2).CommentsClose CommentsPermalink





‘(2) ALTERNATIVE MEASURES-CommentsClose CommentsPermalink





‘(A) IN GENERAL- If the Director determines that a proposed security measure, or any combination thereof, submitted by the owner or operator of covered critical infrastructure in accordance with the process established under section 248(b)(2) will effectively mitigate or remediate the cyber risk associated with the national cyber emergency that is the subject of the declaration under this section, or effectively mitigate or remediate the consequences of the potential disruption of the covered critical infrastructure based on the cyber risk at least as effectively as the emergency measures or actions directed by the Director under this section, the owner or operator may comply with paragraph (1) of this subsection by implementing the proposed security measure, or combination thereof, approved by the Director under the process established under section 248.CommentsClose CommentsPermalink





‘(B) COMPLIANCE PENDING SUBMISSION OR APPROVAL- Before submission of a proposed security measure, or combination thereof, and during the pendency of any review by the Director under the process established under section 248, the owner or operator of covered critical infrastructure shall remain in compliance with any emergency measure or action developed by the Director under this section during the pendency of any declaration by the President under subsection (a)(1) or an extension under subsection (b)(2), until such time as the Director has approved an alternative proposed security measure, or combination thereof, under this paragraph.CommentsClose CommentsPermalink





‘(3) INTERNATIONAL COOPERATION ON NATIONAL CYBER EMERGENCIES-CommentsClose CommentsPermalink





‘(A) IN GENERAL- The Director, in coordination with the head of the sector-specific agency with responsibility for covered critical infrastructure and the head of any Federal agency that is not a sector-specific agency with responsibilities for regulating the covered critical infrastructure, shall--CommentsClose CommentsPermalink





‘(i) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States and the government of the country in which the information infrastructure is located of any cyber risks to the information infrastructure that led to the declaration of a national cyber emergency; andCommentsClose CommentsPermalink





‘(ii) coordinate with the government of the country in which the information infrastructure is located and, as appropriate, the owner or operator of the information infrastructure, regarding the implementation of emergency measures or actions necessary to preserve the reliable operation, and mitigate or remediate the consequences of the potential disruption, of covered critical infrastructure that is the subject of the national cyber emergency.CommentsClose CommentsPermalink





‘(B) INTERNATIONAL AGREEMENTS- The Director shall carry out this paragraph in a manner consistent with applicable international agreements.CommentsClose CommentsPermalink





‘(d) Reporting-CommentsClose CommentsPermalink





‘(1) IN GENERAL- Except as provided in paragraph (2), the President shall ensure that any declaration under subsection (a)(1) or any extension under subsection (b)(2) is reported to the appropriate committees of Congress before the Director mandates any emergency measure or actions under subsection (a)(3).CommentsClose CommentsPermalink





‘(2) EXCEPTION- If notice cannot be given under paragraph (1) before mandating any emergency measure or actions under subsection (a)(3), the President shall provide the report required under paragraph (1) as soon as possible, along with a statement of the reasons for not providing notice in accordance with paragraph (1).CommentsClose CommentsPermalink





‘(3) CONTENTS- Each report under this subsection shall describe--CommentsClose CommentsPermalink





‘(A) the nature of the national cyber emergency;CommentsClose CommentsPermalink





‘(B) the reasons that risk-based security requirements under section 248 are not sufficient to address the national cyber emergency;CommentsClose CommentsPermalink





‘(C) the actions necessary to preserve the reliable operation and mitigate the consequences of the potential disruption of covered critical infrastructure; andCommentsClose CommentsPermalink





‘(D) in the case of an extension of a national cyber emergency under subsection (b)(2)--CommentsClose CommentsPermalink





‘(i) why the emergency measures or actions continue to be necessary to address the national cyber emergency; andCommentsClose CommentsPermalink





‘(ii) when the President expects the national cyber emergency to abate.CommentsClose CommentsPermalink





‘(e) Statutory Defenses and Civil Liability Limitations for Compliance With Emergency Measures-CommentsClose CommentsPermalink





‘(1) DEFINITIONS- In this subsection--CommentsClose CommentsPermalink





‘(A) the term ‘covered civil action’--CommentsClose CommentsPermalink





‘(i) means a civil action filed in a Federal or State court against a covered entity; andCommentsClose CommentsPermalink





‘(ii) does not include an action brought under section 2520 or 2707 of title 18, United States Code, or section 110 or 308 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1810 and 1828);CommentsClose CommentsPermalink





‘(B) the term ‘covered entity’ means any entity that owns or operates covered critical infrastructure, including any owner, operator, officer, employee, agent, landlord, custodian, provider of information technology, or other person acting for or on behalf of that entity with respect to the covered critical infrastructure; andCommentsClose CommentsPermalink





‘(C) the term ‘noneconomic damages’ means damages for losses for physical and emotional pain, suffering, inconvenience, physical impairment, mental anguish, disfigurement, loss of enjoyment of life, loss of society and companionship, loss of consortium, hedonic damages, injury to reputation, and any other nonpecuniary losses.CommentsClose CommentsPermalink





‘(2) APPLICATION OF LIMITATIONS ON CIVIL LIABILITY- The limitations on civil liability under paragraph (3) apply if--CommentsClose CommentsPermalink





‘(A) the President has issued a declaration of national cyber emergency under subsection (a)(1);CommentsClose CommentsPermalink





‘(B) the Director has--CommentsClose CommentsPermalink





‘(i) issued emergency measures or actions for which compliance is required under subsection (c)(1); orCommentsClose CommentsPermalink





‘(ii) approved security measures under subsection (c)(2);CommentsClose CommentsPermalink





‘(C) the covered entity is in compliance with--CommentsClose CommentsPermalink





‘(i) the emergency measures or actions required under subsection (c)(1); orCommentsClose CommentsPermalink





‘(ii) security measures which the Director has approved under subsection (c)(2); andCommentsClose CommentsPermalink





‘(D)(i) the Director certifies to the court in which the covered civil action is pending that the actions taken by the covered entity during the period covered by the declaration under subsection (a)(1) were consistent with--CommentsClose CommentsPermalink





‘(I) emergency measures or actions for which compliance is required under subsection (c)(1); orCommentsClose CommentsPermalink





‘(II) security measures which the Director has approved under subsection (c)(2); orCommentsClose CommentsPermalink





‘(ii) notwithstanding the lack of a certification, the covered entity demonstrates by a preponderance of the evidence that the actions taken during the period covered by the declaration under subsection (a)(1) are consistent with the implementation of--CommentsClose CommentsPermalink





‘(I) emergency measures or actions for which compliance is required under subsection (c)(1); orCommentsClose CommentsPermalink





‘(II) security measures which the Director has approved under subsection (c)(2).CommentsClose CommentsPermalink





‘(3) LIMITATIONS ON CIVIL LIABILITY- In any covered civil action that is related to any incident associated with a cyber risk covered by a declaration of a national cyber emergency and for which Director has issued emergency measures or actions for which compliance is required under subsection (c)(1) or for which the Director has approved security measures under subsection (c)(2), or that is the direct consequence of actions taken in good faith for the purpose of implementing security measures or actions which the Director has approved under subsection (c)(2)--CommentsClose CommentsPermalink





‘(A) the covered entity shall not be liable for any punitive damages intended to punish or deter, exemplary damages, or other damages not intended to compensate a plaintiff for actual losses; andCommentsClose CommentsPermalink





‘(B) noneconomic damages may be awarded against a defendant only in an amount directly proportional to the percentage of responsibility of such defendant for the harm to the plaintiff, and no plaintiff may recover noneconomic damages unless the plaintiff suffered physical harm.CommentsClose CommentsPermalink





‘(4) CIVIL ACTIONS ARISING OUT OF IMPLEMENTATION OF EMERGENCY MEASURES OR ACTIONS- A covered civil action may not be maintained against a covered entity that is the direct consequence of actions taken in good faith for the purpose of implementing specific emergency measures or actions for which compliance is required under subsection (c)(1), if--CommentsClose CommentsPermalink





‘(A) the President has issued a declaration of national cyber emergency under subsection (a)(1) and the action was taken during the period covered by that declaration;CommentsClose CommentsPermalink





‘(B) the Director has issued emergency measures or actions for which compliance is required under subsection (c)(1) or that the Director has approved under subsection (c)(2);CommentsClose CommentsPermalink





‘(C) the covered entity is in compliance with the emergency measures required under subsection (c)(1) or that the Director has approved under subsection (c)(2); andCommentsClose CommentsPermalink





‘(D)(i) the Director certifies to the court in which the covered civil action is pending that the actions taken by the entity during the period covered by the declaration under subsection (a)(1) were consistent with the implementation of emergency measures or actions for which compliance is required under subsection (c)(1) or that the Director has approved under subsection (c)(2); orCommentsClose CommentsPermalink





‘(ii) notwithstanding the lack of a certification, the entity demonstrates by a preponderance of the evidence that the actions taken during the period covered by the declaration under subsection (a)(1) are consistent with the implementation of emergency measures or actions for which compliance is required under subsection (c)(1) or that the Director has approved under subsection (c)(2).CommentsClose CommentsPermalink





‘(5) CERTAIN ACTIONS NOT SUBJECT TO LIMITATIONS ON LIABILITY-CommentsClose CommentsPermalink





‘(A) ADDITIONAL OR INTERVENING ACTS- Paragraphs (2) through (4) shall not apply to a civil action relating to any additional or intervening acts or omissions by any covered entity.CommentsClose CommentsPermalink





‘(B) SERIOUS OR SUBSTANTIAL DAMAGE- Paragraph (4) shall not apply to any civil action brought by an individual--CommentsClose CommentsPermalink





‘(i) whose recovery is otherwise precluded by application of paragraph (4); andCommentsClose CommentsPermalink





‘(ii) who has suffered--CommentsClose CommentsPermalink





‘(I) serious physical injury or death; orCommentsClose CommentsPermalink





‘(II) substantial damage or destruction to his primary residence.CommentsClose CommentsPermalink





‘(C) RULE OF CONSTRUCTION- Recovery available under subparagraph (B) shall be limited to those damages available under subparagraphs (A) and (B) of paragraph (3), except that neither reasonable and necessary medical benefits nor lifetime total benefits for lost employment income due to permanent and total disability shall be limited herein.CommentsClose CommentsPermalink





‘(D) INDEMNIFICATION- In any civil action brought under subparagraph (B), the United States shall defend and indemnify any covered entity. Any covered entity defended and indemnified under this subparagraph shall fully cooperate with the United States in the defense by the United States in any proceeding and shall be reimbursed the reasonable costs associated with such cooperation.CommentsClose CommentsPermalink





‘(f) Joint Resolution To Extend Cyber Emergency-CommentsClose CommentsPermalink





‘(1) IN GENERAL- For purposes of subsection (b)(2)(B), a joint resolution described in this paragraph means only a joint resolution--CommentsClose CommentsPermalink





‘(A) the title of which is as follows: ‘Joint resolution approving the extension of a cyber emergency’; andCommentsClose CommentsPermalink





‘(B) the matter after the resolving clause of which is as follows: ‘That Congress approves the continuation of the emergency measure or action issued by the Director of the National Center for Cybersecurity and Communications on XXXXXXXXXXXX for not longer than an additional 120-day period.’, the blank space being filled in with the date on which the emergency measure or action to which the joint resolution applies was issued.CommentsClose CommentsPermalink





‘(2) PROCEDURE-CommentsClose CommentsPermalink





‘(A) NO REFERRAL- A joint resolution described in paragraph (1) shall not be referred to a committee in either House of Congress and shall immediately be placed on the calendar.CommentsClose CommentsPermalink





‘(B) CONSIDERATION-CommentsClose CommentsPermalink





‘(i) DEBATE LIMITATION- A motion to proceed to a joint resolution described in paragraph (1) is highly privileged in the House of Representatives and is privileged in the Senate and is not debatable. The motion is not subject to a motion to postpone. In the Senate, consideration of the joint resolution, and on all debatable motions and appeals in connection therewith, shall be limited to not more than 10 hours, which shall be divided equally between the majority leader and the minority leader, or their designees. A motion further to limit debate is in order and not debatable. All points of order against the joint resolution (and against consideration of the joint resolution) are waived. An amendment to, or a motion to postpone, or a motion to proceed to the consideration of other business, or a motion to recommit the joint resolution is not in order.CommentsClose CommentsPermalink





‘(ii) PASSAGE- In the Senate, immediately following the conclusion of the debate on a joint resolution described in paragraph (1), and a single quorum call at the conclusion of the debate if requested in accordance with the rules of the Senate, the vote on passage of the joint resolution shall occur.CommentsClose CommentsPermalink





‘(iii) APPEALS- Appeals from the decisions of the Chair relating to the application of the rules of the Senate to the procedure relating to a joint resolution described in paragraph (1) shall be decided without debate.CommentsClose CommentsPermalink





‘(C) OTHER HOUSE ACTS FIRST- If, before the passage by 1 House of a joint resolution of that House described in paragraph (1), that House receives from the other House a joint resolution described in paragraph (1)--CommentsClose CommentsPermalink





‘(i) the procedure in that House shall be the same as if no joint resolution had been received from the other House; andCommentsClose CommentsPermalink





‘(ii) the vote on final passage shall be on the joint resolution of the other House.CommentsClose CommentsPermalink





‘(D) MAJORITY REQUIRED FOR ADOPTION- A joint resolution considered under this subsection shall require an affirmative vote of a majority of the Members, duly chosen and sworn, for adoption.CommentsClose CommentsPermalink





‘(3) RULEMAKING- This subsection is enacted by Congress--CommentsClose CommentsPermalink





‘(A) as an exercise of the rulemaking power of the Senate and the House of Representatives, respectively, and is deemed to be part of the rules of each House, respectively but applicable only with respect to the procedure to be followed in that House in the case of a joint resolution described in paragraph (1), and it supersedes other rules only to the extent that it is inconsistent with such rules; andCommentsClose CommentsPermalink





‘(B) with full recognition of the constitutional right of either House to change the rules (so far as they relate to the procedure of that House) at any time, in the same manner, and to the same extent as in the case of any other rule of that House.CommentsClose CommentsPermalink





‘(g) Rule of Construction- Nothing in this section shall be construed to--CommentsClose CommentsPermalink





‘(1) alter or supersede the authority of the Secretary of Defense, the Attorney General, or the Director of National Intelligence in responding to a national cyber emergency; orCommentsClose CommentsPermalink





‘(2) limit the authority of the Director under section 248, after a declaration issued under this section expires.CommentsClose CommentsPermalink