From OpenCongress Wiki

Bill provisions

Office of Cyberspace Policy

The bill would establish an Office of Cyberspace Policy in the Executive Office of the President, headed by a Director of Cyberspace Policy (appointed by the President and confirmed by the Senate). The Director will be responsible for:

• developing a national strategy to improve national cybersecurity
• coordinating federal cybersecurity activities
• advising the President on matters related to cybersecurity
• submitting an annual report to Congress on the activities of his office.^[1]

The Director will have access to any information possessed by a federal agency that he deems relevant to cybersecurity.^[2]

National Center for Cybersecurity and Communications

The bill would establish a National Center for Cybersecurity and Communications within the Department of Homeland Security, headed by a Director (again, appointed by the President and confirmed by the Senate). The Director of the NCCC will:

• be responsible for leading the federal effort to secure information infrastructure in the United States
• be responsible for "developing, overseeing, and enforcing information security throughout the federal government" (formerly the responsibility of the OMB Office of Electronic Government and Information Technology)
• have access to any information possessed by a federal agency that is relevant to his responsibilities.
• establish security performance requirements, and ensure that covered critical infrastructure meets them (through measures selected by operators of that infrastructure)
• work with heads of other federal agencies, to coordinate cybersecurity regulations

Within the NCCC would be established the United States Computer Emergency Readiness Team (US-CERT), headed by a Director. It will work with other federal agencies, state and local governments, and the private sector. It will be responsible for monitoring the security of networks of federal agencies, and for warning operators of the national information infrastructure of detected risks.^[1]

National Cyber Emergencies

If the President declares a national cyber emergency, the Director of the NCCC will issue emergency measures necessary to secure covered critical infrastructure. The emergency measures must be the least disruptive means feasible, and cannot override the Wiretap Act, the Electronic Communications Privacy Act, or the Foreign Intelligence Surveillance Act of 1978.^[1] Operators of this infrastructure would have to comply immediately with the emergency measures.^[2]

The measures would expire after 30 days unless the Director of the NCCC or the President affirms that there is still a threat or that the measures are still necessary. For any declaration or extension, the President would have to provide a report to the appropriate committees of Congress describing the nature of the emergency, why current security requirements are insufficient, and what actions are necessary to handle the situation.^[1]

CISOs and the Federal Information Security Taskforce

Agencies would delegate a senior official to be the Chief Information Security Officer (CISO), who would have the authority to develop and enforce information security policies throughout the department. The CISO's authority would extend to contractors working on the agency's behalf.

The bill would establish a Federal Information Security Taskforce, headed by the Director of the NCCC and comprised of (among many others) the CISO of each agency, US-CERT, and any other person designated by the chairperson. Unless extended by an Executive Order or act of Congress, the Taskforce will terminate after four years.^[1]

Bill history

Senate Action

Sen. Joseph Lieberman (I-CT) introduced the bill on June 10, 2010.^[3]

Articles and resources

See also

References

1. ↑ ^{1.0 1.1 1.2 1.3 1.4} Senate Committee on Homeland Security & Governmental Affairs section-by-section summary of Protecting Cyberspace as a National Asset Act of 2010
2. ↑ ^2.0 2.1 Text of the Protecting Cyberspace as a National Asset Act of 2010 on OpenCongress
3. ↑ OpenCongress’ info page on Protecting Cyberspace as a National Asset Act of 2010

External resources

External articles