Cybersecurity and Internet Freedom Act of 2011 - Internet Freedom Act - Declares that neither the President, the Director of the National Center for Cybersecurity and Communications, nor any officer or employee of the U.S. government shall have the authority to shut down the Internet.
Establishes in the Executive Office of the President an Office of Cyberspace Policy, which shall: (1) develop a national strategy to increase the security and resiliency of cyberspace; (2) oversee, coordinate, and integrate federal policies and activities relating to cyberspace security and resiliency; (3) ensure that all federal agencies comply with appropriate guidelines, policies, and directives from the Department of Homeland Security (DHS), other federal agencies with responsibilities relating to cyberspace security or resiliency, and the National Center for Cybersecurity and Communications (established by this Act); and (4) ensure that federal agencies have access to, receive, and appropriately disseminate law enforcement, intelligence, terrorism, and any other information relevant to the security of specified federal, military, and intelligence information infrastructure.
Requires the President to appoint a Director of Cyberspace Policy.
Provides for access by the Director to specified cybersecurity-related information.
Requires the Director to submit an annual report describing the activities, ongoing projects, and plans of the federal government designed to meet national strategy goals and objectives.
Amends the Homeland Security Act of 2002 (HSA) to establish within DHS a National Center for Cybersecurity and Communications (NCCC), which shall be headed by a Director, who shall: (1) work cooperatively with the private sector and lead the federal effort to secure, protect, and ensure the resiliency of the federal and national information infrastructure; and (2) work with the Assistant Secretary for Infrastructure Protection to coordinate the information, communications, and physical infrastructure protection responsibilities and activities of NCCC and the Office of Infrastructure Protection. Transfers to NCCC the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System.
Establishes within NCCC the United States Computer Emergency Readiness Team, which shall: (1) collect, coordinate, and disseminate information on risks to specified federal information infrastructure and security controls; and (2) establish a mechanism for engagement with the private sector.
Requires the NCCC Director to: (1) establish a program for sharing information with and between NCCC and other federal agencies; (2) develop guidelines to protect the privacy and civil liberties of U.S. persons and intelligence sources and methods; (3) establish a program to promote and provide technical assistance relating to the implementation of best practices and related standards and guidelines for securing the national information infrastructure; and (4) identify and evaluate the cyber risks to covered critical infrastructure on a continuous and sector-by-sector basis and issue regulations establishing risk-based security performance requirements to secure covered critical infrastructure against cyber risks.
Authorizes the President to issue a declaration of a national cyber emergency to covered critical infrastructure if there is an ongoing or imminent action by any individual or entity to exploit a cyber risk in a manner that attempts to disrupt the operation of the information infrastructure essential to the reliable operation of covered critical infrastructure. Requires the President to notify the owners and operators of the infrastructure of the nature of the emergency, consistent with the protection of intelligence sources and methods. Requires the NCCC Director to take specified steps, including immediately directing the owners and operators to implement required response plans and to ensure that emergency actions represent the least disruptive means feasible to operations.
Prohibits any other federal entity, pursuant to such authority, from: (1) restricting or prohibiting communications over, and not specifically directed to or from, covered critical infrastructure unless the Director determines that no other emergency action will preserve the reliable operation of such infrastructure or the national information infrastructure; (2) controlling covered critical infrastructure; (3) compelling the disclosure of information unless specifically authorized by law; or (4) intercepting a wire, oral, or electronic communication, accessing a stored electronic or wire communication, installing or using a pen register or trap and trace device, or conducting electronic surveillance relating to an incident unless otherwise authorized by specified statutes.
Requires the President to ensure that any declaration or extension is reported to the appropriate congressional committees before the Director mandates any emergency measure or actions. Terminates such an emergency measure or action 30 days after the President's declaration and authorizes extensions for not more than 3 additional 30-day periods under certain conditions if approved by a joint resolution by Congress.
Requires each owner or operator of covered critical infrastructure to certify to the NCCC Director whether the owner or operator has developed and implemented approved security measures and any applicable emergency measures or actions required for any cyber risks and national cyber emergencies. Sets forth civil penalties for violations. Requires the DHS Secretary and the private sector to develop, periodically update, and implement a supply chain risk management strategy designed to ensure the security of the federal information infrastructure.
Sets forth provisions regarding the information security authority and functions of the NCCC Director and executive agency responsibilities. Requires the Director to annually oversee, coordinate, and develop guidance for the effective implementation of operational evaluations of the federal information infrastructure and agency information security programs and practices to determine their effectiveness. Authorizes the Director to order the isolation of any component of the federal information infrastructure if: (1) an agency does not implement measures in an approved risk-based plan; and (2) the failure to comply presents a significant danger to the federal information infrastructure.
Establishes in the executive branch a Federal Information Security Taskforce, which shall be the principal interagency forum for collaboration regarding best practices and recommendations for agency information security and the security of the federal information infrastructure. Requires each agency with an Inspector General appointed under the Inspector General Act of 1978 to assess the adequacy and effectiveness of the information security program and evaluations. Requires the assessments to be performed in accordance with standards developed by the Government Accountability Office, in collaboration with the Council of Inspectors General on Integrity and Efficiency, with assistance from the Taskforce. Provides for the delegation of the Director's authorities to the Secretary of Defense and the Director of the Central Intelligence Agency (CIA) under specified circumstances where unauthorized access, use, disclosure, disruption, modification, or destruction of information would have a debilitating impact on the missions of the Department of Defense (DOD) and the CIA.
Requires the Director of the Office of Personnel Management (OPM) and the NCCC Director to assess the readiness and capacity of the federal workforce to meet the needs of the cybersecurity mission of the federal government. Requires the OPM Director to develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of federal cybersecurity personnel. Requires the head of each federal agency to: (1) develop a strategic cybersecurity workforce plan as part of its performance plan; and (2) measure and collect information on indicators of the effectiveness of the recruitment and hiring of a workforce needed to fulfill the agency's cybersecurity mission.
Requires the OPM Director, in coordination with: (1) the NCCC Director, to develop and issue comprehensive occupation classifications for federal employees engaged in cybersecurity missions; and (2) the NCCC Director, the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council (CIOC), to establish a cybersecurity awareness and education curriculum that shall be required for all federal employees and contractors engaged in the design, development, or operation of agency information infrastructure.
Amends HSA to direct the Under Secretary for Science and Technology, in coordination with the NCCC Director, to carry out a research and development program for the purpose of improving the security of information infrastructure.
Directs the DHS Secretary to establish a National Cybersecurity Advisory Council to advise the NCCC Director.
Amends HSA to direct the Secretary: (1) in establishing and maintaining a prioritized critical information infrastructure list, to consider cyber risks and consequences by sector; and (2) to establish and maintain a list of systems or assets that constitute covered critical infrastructure.
Sets forth provisions regarding: (1) identification of covered critical infrastructure, compliance with requirements regarding such designation, and development of a process under which an owner or operator of a system or asset that may constitute covered critical infrastructure may request that it be identified as such; and (2) the use of acquisition authorities by NCCC and a semiannual reporting requirement.
Requires the Administrator for Electronic Government and Information Technology, in coordination with CIOC, the Taskforce, and the Council on Inspectors General on Integrity and Efficiency, to evaluate and report on agency adoption and implementation of appropriate information security related policies, memoranda, and directives issued by the Office of Management and Budget (OMB).
[Congressional Bills 112th Congress]
[From the U.S. Government Publishing Office]
[S. 413 Introduced in Senate (IS)]
112th CONGRESS
1st Session
S. 413
To amend the Homeland Security Act of 2002 and other laws to enhance
the security and resiliency of the cyber and communications
infrastructure of the United States.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
February 17, 2011
Mr. Lieberman (for himself, Ms. Collins, and Mr. Carper) introduced the
following bill; which was read twice and referred to the Committee on
Homeland Security and Governmental Affairs
_______________________________________________________________________
A BILL
To amend the Homeland Security Act of 2002 and other laws to enhance
the security and resiliency of the cyber and communications
infrastructure of the United States.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Cybersecurity and Internet Freedom
Act of 2011''.
SEC. 2. INTERNET FREEDOM ACT.
(a) Short Title.--This section may be cited as the ``Internet
Freedom Act''.
(b) Findings.--Congress finds that--
(1) the Internet is vital to almost every facet of the
daily lives of the people of the United States, from the water
we drink to the power we use to the ways we communicate;
(2) in the modern world, the Internet is essential to the
free flow of ideas and information;
(3) it is vital that the Internet, and the access of the
people of the United States to the Internet, be protected to
ensure the reliability of the critical services that rely upon
this network and the availability of the information and
communications that travel over this network;
(4) the Internet has developed into a robust network within
the United States, with thousands of providers, making it
technically impossible to shut down the Internet;
(5) although the United States must ensure the security of
the Nation and its critical infrastructure, the actions of the
Government must not encroach on rights guaranteed by the First
Amendment to the Constitution of the United States;
(6) cyber attacks are a real and evolving threat to the
information infrastructure and economy of the Nation;
(7) the Sergeant at Arms of the Senate reported in March
2010 that the computer systems of executive branch agencies of
the Federal Government and Congress are probed or attacked an
average of 1,800,000,000 times per month;
(8) experts estimate that cyber attacks can produce
$8,000,000,000 in annual losses to the national economy;
(9) in the event of a cyber attack, it is essential that
the law clearly and unambiguously delineate limits on what the
Federal Government can and cannot do to protect the information
infrastructure that is essential to the reliable operation of
the Internet and the critical infrastructure of the Nation; and
(10) neither the President, the Director of the National
Center for Cybersecurity and Communications, nor any other
officer or employee of the Federal Government should have the
authority to shut down the Internet.
(c) Limitation.--Notwithstanding any provision of this Act, an
amendment made by this Act, or section 706 of the Communications Act of
1934 (47 U.S.C. 606), neither the President, the Director of the
National Center for Cybersecurity and Communications, or any officer or
employee of the United States Government shall have the authority to
shut down the Internet.
SEC. 3. TABLE OF CONTENTS.
The table of contents for this Act is as follows:
Sec. 1. Short title.
Sec. 2. Internet Freedom Act.
Sec. 3. Table of contents.
Sec. 4. Definitions.
TITLE I--OFFICE OF CYBERSPACE POLICY
Sec. 101. Establishment of the Office of Cyberspace Policy.
Sec. 102. Appointment and responsibilities of the Director.
Sec. 103. Prohibition on political campaigning.
Sec. 104. Review of Federal agency budget requests relating to the
National Strategy.
Sec. 105. Access to intelligence.
Sec. 106. Consultation.
Sec. 107. Reports to Congress.
TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS
Sec. 201. Cybersecurity.
TITLE III--FEDERAL INFORMATION SECURITY MANAGEMENT
Sec. 301. Coordination of Federal information policy.
TITLE IV--RECRUITMENT AND PROFESSIONAL DEVELOPMENT
Sec. 401. Definitions.
Sec. 402. Assessment of cybersecurity workforce.
Sec. 403. Strategic cybersecurity workforce planning.
Sec. 404. Cybersecurity occupation classifications.
Sec. 405. Measures of cybersecurity hiring effectiveness.
Sec. 406. Training and education.
Sec. 407. Cybersecurity incentives.
Sec. 408. Recruitment and retention program for the National Center for
Cybersecurity and Communications.
TITLE V--OTHER PROVISIONS
Sec. 501. Cybersecurity research and development.
Sec. 502. Prioritized critical information infrastructure.
Sec. 503. National Center for Cybersecurity and Communications
acquisition authorities.
Sec. 504. Evaluation of the effective implementation of Office of
Management and Budget information security
related policies and directives.
Sec. 505. Technical and conforming amendments.
SEC. 4. DEFINITIONS.
In this Act:
(1) Appropriate congressional committees.--The term
``appropriate congressional committees'' means--
(A) the Committee on Homeland Security and
Governmental Affairs of the Senate;
(B) the Committee on Homeland Security of the House
of Representatives;
(C) the Committee on Oversight and Government
Reform of the House of Representatives; and
(D) any other congressional committee with
jurisdiction over the particular matter.
(2) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given that term in section
1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)).
(3) Cyberspace.--The term ``cyberspace'' means the
interdependent network of information infrastructure, and
includes the Internet, telecommunications networks, computer
systems, and embedded processors and controllers in critical
industries.
(4) Director.--The term ``Director'' means the Director of
Cyberspace Policy established under section 101.
(5) Federal agency.--The term ``Federal agency''--
(A) means any executive department, Government
corporation, Government controlled corporation, or
other establishment in the executive branch of the
Government (including the Executive Office of the
President), or any independent regulatory agency; and
(B) does not include the governments of the
District of Columbia and of the territories and
possessions of the United States and their various
subdivisions.
(6) Federal information infrastructure.--The term ``Federal
information infrastructure''--
(A) means information infrastructure that is owned,
operated, controlled, or licensed for use by, or on
behalf of, any Federal agency, including information
systems used or operated by another entity on behalf of
a Federal agency; and
(B) does not include--
(i) a national security system; or
(ii) information infrastructure that is
owned, operated, controlled, or licensed for
use by, or on behalf of, the Department of
Defense, a military department, or another
element of the intelligence community.
(7) Incident.--The term ``incident'' has the meaning given
that term in section 3551 of title 44, United States Code, as
added by this Act.
(8) Information infrastructure.--The term ``information
infrastructure'' means the underlying framework that
information systems and assets rely on to process, transmit,
receive, or store information electronically, including
programmable electronic devices and communications networks and
any associated hardware, software, or data.
(9) Information security.--The term ``information
security'' means protecting information and information systems
from disruption or unauthorized access, use, disclosure,
modification, or destruction in order to provide--
(A) integrity, by guarding against improper
information modification or destruction, including by
ensuring information nonrepudiation and authenticity;
(B) confidentiality, by preserving authorized
restrictions on access and disclosure, including means
for protecting personal privacy and proprietary
information; and
(C) availability, by ensuring timely and reliable
access to and use of information.
(10) Information technology.--The term ``information
technology'' has the meaning given that term in section 11101
of title 40, United States Code.
(11) Intelligence community.--The term ``intelligence
community'' has the meaning given that term under section 3(4)
of the National Security Act of 1947 (50 U.S.C. 401a(4)).
(12) Key resources.--The term ``key resources'' has the
meaning given that term in section 2 of the Homeland Security
Act of 2002 (6 U.S.C. 101).
(13) National center for cybersecurity and
communications.--The term ``National Center for Cybersecurity
and Communications'' means the National Center for
Cybersecurity and Communications established under section
242(a) of the Homeland Security Act of 2002, as added by this
Act.
(14) National information infrastructure.--The term
``national information infrastructure'' means information
infrastructure--
(A) that is owned, operated, or controlled within
or from the United States; and
(B) that is not owned, operated, controlled, or
licensed for use by a Federal agency.
(15) National security system.--The term ``national
security system'' has the meaning given that term in section
3551 of title 44, United States Code, as added by this Act.
(16) National strategy.--The term ``National Strategy''
means the national strategy to increase the security and
resiliency of cyberspace developed under section 101(a)(1).
(17) Office.--The term ``Office'' means the Office of
Cyberspace Policy established under section 101.
(18) Resiliency.--The term ``resiliency'' means the ability
to eliminate or reduce the magnitude or duration of a
disruptive event, including the ability to prevent, prepare
for, respond to, and recover from the event.
(19) Risk.--The term ``risk'' means the potential for an
unwanted outcome resulting from an incident, as determined by
the likelihood of the occurrence of the incident and the
associated consequences, including potential for an adverse
outcome assessed as a function of threats, vulnerabilities, and
consequences associated with an incident.
(20) Risk-based security.--The term ``risk-based security''
has the meaning given that term in section 3551 of title 44,
United States Code, as added by this Act.
TITLE I--OFFICE OF CYBERSPACE POLICY
SEC. 101. ESTABLISHMENT OF THE OFFICE OF CYBERSPACE POLICY.
(a) Establishment of Office.--There is established in the Executive
Office of the President an Office of Cyberspace Policy which shall--
(1) develop, not later than 1 year after the date of
enactment of this Act, and update as needed, but not less
frequently than once every 2 years, a national strategy to
increase the security and resiliency of cyberspace, that
includes goals and objectives relating to--
(A) computer network operations, including
offensive activities, defensive activities, and other
activities;
(B) information assurance;
(C) protection of critical infrastructure and key
resources;
(D) research and development priorities;
(E) law enforcement;
(F) diplomacy;
(G) homeland security;
(H) protection of privacy and civil liberties;
(I) military and intelligence activities; and
(J) identity management and authentication;
(2) oversee, coordinate, and integrate all policies and
activities of the Federal Government across all instruments of
national power relating to ensuring the security and resiliency
of cyberspace, including--
(A) diplomatic, economic, military, intelligence,
homeland security, and law enforcement policies and
activities within and among Federal agencies; and
(B) offensive activities, defensive activities, and
other policies and activities necessary to ensure
effective capabilities to operate in cyberspace;
(3) ensure that all Federal agencies comply with
appropriate guidelines, policies, and directives from the
Department of Homeland Security, other Federal agencies with
responsibilities relating to cyberspace security or resiliency,
and the National Center for Cybersecurity and Communications;
and
(4) ensure that Federal agencies have access to, receive,
and appropriately disseminate law enforcement information,
intelligence information, terrorism information, and any other
information (including information relating to incidents
provided under subsections (a)(4) and (c) of section 246 of the
Homeland Security Act of 2002, as added by this Act) relevant
to--
(A) the security of the Federal information
infrastructure or the national information
infrastructure; and
(B) the security of--
(i) information infrastructure that is
owned, operated, controlled, or licensed for
use by, or on behalf of, the Department of
Defense, a military department, or another
element of the intelligence community; or
(ii) a national security system.
(b) Director of Cyberspace Policy.--
(1) In general.--There shall be a Director of Cyberspace
Policy, who shall be the head of the Office.
(2) Executive schedule position.--Section 5312 of title 5,
United States Code, is amended by adding at the end the
following:
``Director of Cyberspace Policy.''.
SEC. 102. APPOINTMENT AND RESPONSIBILITIES OF THE DIRECTOR.
(a) Appointment.--
(1) In general.--The Director shall be appointed by the
President, by and with the advice and consent of the Senate.
(2) Qualifications.--The President shall appoint the
Director from among individuals who have demonstrated ability
and knowledge in information technology, cybersecurity, and the
operations, security, and resiliency of communications
networks.
(3) Prohibition.--No person shall serve as Director while
serving in any other position in the Federal Government.
(b) Responsibilities.--The Director shall--
(1) advise the President regarding the establishment of
policies, goals, objectives, and priorities for securing the
information infrastructure of the Nation;
(2) advise the President and other entities within the
Executive Office of the President regarding mechanisms to
build, and improve the resiliency and efficiency of, the
information and communication industry of the Nation, in
collaboration with the private sector, while promoting national
economic interests;
(3) work with Federal agencies to--
(A) oversee, coordinate, and integrate the
implementation of the National Strategy, including
coordination with--
(i) the Department of Homeland Security;
(ii) the Department of Defense;
(iii) the Department of Commerce;
(iv) the Department of State;
(v) the Department of Justice;
(vi) the Department of Energy;
(vii) through the Director of National
Intelligence, the intelligence community; and
(viii) and any other Federal agency with
responsibilities relating to the National
Strategy; and
(B) resolve any disputes that arise between Federal
agencies relating to the National Strategy or other
matters within the responsibility of the Office;
(4) if the policies or activities of a Federal agency are
not in compliance with the responsibilities of the Federal
agency under the National Strategy--
(A) notify the Federal agency;
(B) transmit a copy of each notification under
subparagraph (A) to the President and the appropriate
congressional committees; and
(C) coordinate the efforts to bring the Federal
agency into compliance;
(5) ensure the adequacy of protections for privacy and
civil liberties in carrying out the responsibilities of the
Director under this title, including through consultation with
the Privacy and Civil Liberties Oversight Board established
under section 1061 of the National Security Intelligence Reform
Act of 2004 (42 U.S.C. 2000ee);
(6) upon reasonable request, appear before any duly
constituted committees of the Senate or of the House of
Representatives;
(7) recommend to the Office of Management and Budget or the
head of a Federal agency actions (including requests to
Congress relating to the reprogramming of funds) that the
Director determines are necessary to ensure risk-based security
of--
(A) the Federal information infrastructure;
(B) information infrastructure that is owned,
operated, controlled, or licensed for use by, or on
behalf of, the Department of Defense, a military
department, or another element of the intelligence
community; or
(C) a national security system;
(8) advise the Administrator of the Office of E-Government
and Information Technology and the Administrator of the Office
of Information and Regulatory Affairs on the development, and
oversee the implementation, of policies, principles, standards,
guidelines, and budget priorities for information technology
functions and activities of the Federal Government;
(9) coordinate and ensure, to the maximum extent
practicable, that the standards and guidelines developed for
national security systems and the standards and guidelines
under section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3) are complementary and
unified;
(10) in consultation with the Administrator of the Office
of Information and Regulatory Affairs, coordinate efforts of
Federal agencies relating to the development of regulations,
rules, requirements, or other actions applicable to the
national information infrastructure to ensure, to the maximum
extent practicable, that the efforts are complementary;
(11) coordinate the activities of the Office of Science and
Technology Policy, the National Economic Council, the Office of
Management and Budget, the National Security Council, the
Homeland Security Council, and the United States Trade
Representative related to the National Strategy and other
matters within the purview of the Office;
(12) carry out the responsibilities for national security
and emergency preparedness communications described in section
706 of the Communications Act of 1934 (47 U.S.C. 606) to ensure
integration and coordination; and
(13) as assigned by the President, other duties relating to
the security and resiliency of cyberspace.
(c) Conforming Regulations and Orders.--The President shall amend
the regulations and orders issued under section 706 of the
Communications Act of 1934 (47 U.S.C. 606) in accordance with
subsection (b)(12).
SEC. 103. PROHIBITION ON POLITICAL CAMPAIGNING.
Section 7323(b)(2)(B) of title 5, United States Code, is amended--
(1) in clause (i), by striking ``or'' at the end;
(2) in clause (ii), by striking the period at the end and
inserting ``; or''; and
(3) by adding at the end the following:
``(iii) notwithstanding the exception under
subparagraph (A) (relating to an appointment
made by the President, by and with the advice
and consent of the Senate), the Director of
Cyberspace Policy.''.
SEC. 104. REVIEW OF FEDERAL AGENCY BUDGET REQUESTS RELATING TO THE
NATIONAL STRATEGY.
(a) In General.--For each fiscal year, the head of each Federal
agency shall transmit to the Director a copy of any portion of the
budget of the Federal agency intended to implement the National
Strategy at the same time as that budget request is submitted to the
Office of Management and Budget in the preparation of the budget of the
President submitted to Congress under section 1105(a) of title 31,
United States Code.
(b) Timely Submissions.--The head of each Federal agency shall
ensure the timely development and submission to the Director of each
proposed budget under this section, in such format as may be designated
by the Director with the concurrence of the Director of the Office of
Management and Budget.
(c) Adequacy of the Proposed Budget Requests.--With the assistance
of, and in coordination with, the Office of E-Government and
Information Technology and the National Center for Cybersecurity and
Communications, the Director shall review each budget submission to
assess the adequacy of the proposed request with regard to
implementation of the National Strategy, including the overall
sufficiency of the requests to implement effectively the National
Strategy across all Federal agencies.
(d) Inadequate Budget Requests.--If the Director concludes that a
budget request submitted under subsection (a) is inadequate, in whole
or in part, to implement the objectives of the National Strategy, the
Director shall submit to the Director of the Office of Management and
Budget and the head of the Federal agency submitting the budget request
a written description of funding levels and specific initiatives that
would, in the determination of the Director, make the request adequate.
SEC. 105. ACCESS TO INTELLIGENCE.
The Director shall have access to law enforcement information,
intelligence information, terrorism information, and any other
information (including information relating to incidents provided under
subsections (a)(4) and (c) of section 246 of the Homeland Security Act
of 2002, as added by this Act) that is obtained by, or in the
possession of, any Federal agency that the Director determines relevant
to the security of--
(1) the Federal information infrastructure;
(2) information infrastructure that is owned, operated,
controlled, or licensed for use by, or on behalf of, the
Department of Defense, a military department, or another
element of the intelligence community;
(3) a national security system; or
(4) national information infrastructure.
SEC. 106. CONSULTATION.
(a) In General.--The Director may consult and obtain
recommendations from, as needed, such Presidential and other advisory
entities as the Director determines will assist in carrying out the
mission of the Office, including--
(1) the National Security Telecommunications Advisory
Committee;
(2) the National Infrastructure Advisory Council;
(3) the Privacy and Civil Liberties Oversight Board;
(4) the President's Intelligence Advisory Board;
(5) the Critical Infrastructure Partnership Advisory
Council;
(6) the Committee on Foreign Investment in the United
States;
(7) the Information Security and Privacy Advisory Board;
(8) the National Cybersecurity Advisory Council established
under section 239 of the Homeland Security Act of 2002, as
added by this Act; and
(9) any other entity that may provide assistance to the
Director.
(b) National Strategy.--In developing and updating the National
Strategy the Director shall consult with the National Cybersecurity
Advisory Council and, as appropriate, State and local governments and
private entities.
SEC. 107. REPORTS TO CONGRESS.
(a) In General.--The Director shall submit an annual report to the
appropriate congressional committees describing the activities, ongoing
projects, and plans of the Federal Government designed to meet the
goals and objectives of the National Strategy.
(b) Classified Annex.--A report submitted under this section shall
be submitted in an unclassified form, but may include a classified
annex, if necessary.
(c) Public Report.--An unclassified version of each report
submitted under this section shall be made available to the public.
TITLE II--NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS
SEC. 201. CYBERSECURITY.
Title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et
seq.) is amended by adding at the end the following:
``Subtitle E--Cybersecurity
``SEC. 241. DEFINITIONS.
``In this subtitle--
``(1) the term `agency information infrastructure' means
the Federal information infrastructure of a particular Federal
agency;
``(2) the term `appropriate committees of Congress' means
the Committee on Homeland Security and Governmental Affairs of
the Senate and the Committee on Homeland Security of the House
of Representatives;
``(3) the term `Center' means the National Center for
Cybersecurity and Communications established under section
242(a);
``(4) the term `covered critical infrastructure' means a
system or asset identified by the Secretary as covered critical
infrastructure under section 254;
``(5) the term `cyber risk' means any risk to information
infrastructure, including physical or personnel risks and
security vulnerabilities, that, if exploited or not mitigated,
could pose a significant risk of disruption to the operation of
information infrastructure essential to the reliable operation
of covered critical infrastructure;
``(6) the term `Director' means the Director of the Center
appointed under section 242(b)(1);
``(7) the term `Federal agency'--
``(A) means any executive department, military
department, Government corporation, Government
controlled corporation, or other establishment in the
executive branch of the Government (including the
Executive Office of the President), or any independent
regulatory agency; and
``(B) does not include the governments of the
District of Columbia and of the territories and
possessions of the United States and their various
subdivisions;
``(8) the term `Federal information infrastructure'--
``(A) means information infrastructure that is
owned, operated, controlled, or licensed for use by, or
on behalf of, any Federal agency, including information
systems used or operated by another entity on behalf of
a Federal agency; and
``(B) does not include--
``(i) a national security system; or
``(ii) information infrastructure that is
owned, operated, controlled, or licensed for
use by, or on behalf of, the Department of
Defense, a military department, or another
element of the intelligence community;
``(9) the term `incident' has the meaning given that term
in section 3551 of title 44, United States Code;
``(10) the term `information infrastructure' means the
underlying framework that information systems and assets rely
on to process, transmit, receive, or store information
electronically, including--
``(A) programmable electronic devices and
communications networks; and
``(B) any associated hardware, software, or data;
``(11) the term `information security' means protecting
information and information systems from disruption or
unauthorized access, use, disclosure, modification, or
destruction in order to provide--
``(A) integrity, by guarding against improper
information modification or destruction, including by
ensuring information nonrepudiation and authenticity;
``(B) confidentiality, by preserving authorized
restrictions on access and disclosure, including means
for protecting personal privacy and proprietary
information; and
``(C) availability, by ensuring timely and reliable
access to and use of information;
``(12) the term `information sharing and analysis center'
means a self-governed forum whose members work together within
a specific sector of critical infrastructure to identify,
analyze, and share with other members and the Federal
Government critical information relating to threats,
vulnerabilities, or incidents to the security and resiliency of
the critical infrastructure that comprises the specific sector;
``(13) the term `information system' has the meaning given
that term in section 3502 of title 44, United States Code;
``(14) the term `intelligence community' has the meaning
given that term in section 3(4) of the National Security Act of
1947 (50 U.S.C. 401a(4));
``(15) the term `management controls' means safeguards or
countermeasures for an information system that focus on the
management of risk and the management of information system
security;
``(16) the term `National Cybersecurity Advisory Council'
means the National Cybersecurity Advisory Council established
under section 239;
``(17) the term `national cyber emergency' means an actual
or imminent action by any individual or entity to exploit a
cyber risk in a manner that disrupts, attempts to disrupt, or
poses a significant risk of disruption to the operation of the
information infrastructure essential to the reliable operation
of covered critical infrastructure;
``(18) the term `national information infrastructure' means
information infrastructure--
``(A) that is owned, operated, or controlled within
or from the United States; and
``(B) that is not owned, operated, controlled, or
licensed for use by a Federal agency;
``(19) the term `national security system' has the meaning
given that term in section 3551 of title 44, United States
Code;
``(20) the term `operational controls' means the safeguards
and countermeasures for an information system that are
primarily implemented and executed by individuals not systems;
``(21) the term `sector-specific agency' means the relevant
Federal agency responsible for infrastructure protection
activities in a designated critical infrastructure sector or
key resources category under the National Infrastructure
Protection Plan, or any other appropriate Federal agency
identified by the President after the date of enactment of this
subtitle;
``(22) the term `sector coordinating councils' means self-
governed councils that are composed of representatives of key
stakeholders within a specific sector of critical
infrastructure that serve as the principal private sector
policy coordination and planning entities with the Federal
Government relating to the security and resiliency of the
critical infrastructure that comprise that sector;
``(23) the term `security controls' means the management,
operational, and technical controls prescribed for an
information system to protect the information security of the
system;
``(24) the term `small business concern' has the meaning
given that term under section 3 of the Small Business Act (15
U.S.C. 632);
``(25) the term `technical controls' means the safeguards
or countermeasures for an information system that are primarily
implemented and executed by the information system through
mechanisms contained in the hardware, software, or firmware
components of the system;
``(26) the term `terrorism information' has the meaning
given that term in section 1016 of the Intelligence Reform and
Terrorism Prevention Act of 2004 (6 U.S.C. 485);
``(27) the term `United States person' has the meaning
given that term in section 101 of the Foreign Intelligence
Surveillance Act of 1978 (50 U.S.C. 1801); and
``(28) the term `US-CERT' means the United States Computer
Emergency Readiness Team established under section 244.
``SEC. 242. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.
``(a) Establishment.--
``(1) In general.--There is established within the
Department a National Center for Cybersecurity and
Communications.
``(2) Operational entity.--The Center may--
``(A) enter into contracts for the procurement of
property and services for the Center; and
``(B) appoint employees of the Center in accordance
with the civil service laws of the United States.
``(b) Director.--
``(1) In general.--The Center shall be headed by a
Director, who shall be appointed by the President, by and with
the advice and consent of the Senate.
``(2) Reporting to secretary.--The Director shall report
directly to the Secretary and serve as the principal advisor to
the Secretary on cybersecurity and the operations, security,
and resiliency of the information infrastructure and
communications infrastructure of the United States.
``(3) Presidential advice.--The Director shall regularly
advise the President on the exercise of the authorities
provided under this subtitle or any other provision of law
relating to the security of the Federal information
infrastructure or an agency information infrastructure.
``(4) Qualifications.--The Director shall be appointed from
among individuals who have--
``(A) a demonstrated ability in and knowledge of
information technology, cybersecurity, and the
operations, security and resiliency of communications
networks; and
``(B) significant executive leadership and
management experience in the public or private sector.
``(5) Limitation on service.--
``(A) In general.--Subject to subparagraph (B), the
individual serving as the Director may not, while so
serving, serve in any other capacity in the Federal
Government, except to the extent that the individual
serving as Director is doing so in an acting capacity.
``(B) Exception.--The Director may serve on any
commission, board, council, or similar entity with
responsibilities or duties relating to cybersecurity or
the operations, security, and resiliency of the
information infrastructure and communications
infrastructure of the United States at the direction of
the President or as otherwise provided by law.
``(c) Deputy Directors.--
``(1) In general.--There shall be not less than 2 Deputy
Directors for the Center, who shall report to the Director.
``(2) Infrastructure protection.--
``(A) Appointment.--There shall be a Deputy
Director appointed by the Secretary, who shall have
expertise in infrastructure protection.
``(B) Responsibilities.--The Deputy Director
appointed under subparagraph (A) shall--
``(i) assist the Director and the Assistant
Secretary for Infrastructure Protection in
coordinating, managing, and directing the
information, communications, and physical
infrastructure protection responsibilities and
activities of the Department, including
activities under Homeland Security Presidential
Directive-7, or any successor thereto, and the
National Infrastructure Protection Plan, or any
successor thereto;
``(ii) review the budget for the Center and
the Office of Infrastructure Protection before
submission of the budget to the Secretary to
ensure that activities are appropriately
coordinated;
``(iii) develop, update periodically, and
submit to the appropriate committees of
Congress a strategic plan detailing how
critical infrastructure protection activities
will be coordinated between the Center, the
Office of Infrastructure Protection, and the
private sector;
``(iv) subject to the direction of the
Director resolve conflicts between the Center
and the Office of Infrastructure Protection
relating to the information, communications,
and physical infrastructure protection
responsibilities of the Center and the Office
of Infrastructure Protection; and
``(v) perform such other duties as the
Director may assign.
``(C) Annual evaluation.--The Assistant Secretary
for Infrastructure Protection shall submit annually to
the Director an evaluation of the performance of the
Deputy Director appointed under subparagraph (A).
``(3) Intelligence community.--The Director of National
Intelligence shall identify an employee of an element of the
intelligence community to serve as a Deputy Director of the
Center. The employee shall be detailed to the Center on a
reimbursable basis for such period as is agreed to by the
Director and the Director of National Intelligence, and, while
serving as Deputy Director, shall report directly to the
Director of the Center.
``(d) Liaison Officers.--
``(1) In general.--The Secretary of Defense, the Attorney
General, the Secretary of Commerce, and the Director of
National Intelligence shall detail personnel to the Center to
act as full-time liaisons with the Department of Defense, the
Department of Justice, the National Institute of Standards and
Technology, and elements of the intelligence community to
assist in coordination between and among the Center, the
Department of Defense, the Department of Justice, the National
Institute of Standards and Technology, and elements of the
intelligence community.
``(2) Private sector.--
``(A) In general.--Consistent with applicable law
and ethics requirements, and except as provided in
subparagraph (B), the Director may authorize
representatives from private sector entities to
participate in the activities of the Center to improve
the information sharing, analysis, and coordination of
activities of the US-CERT.
``(B) Limitation.--A representative from a private
sector entity authorized to participate in the
activities of the Center under subparagraph (A) may not
participate in any activities of the Center under
section 248, 249, or 250.
``(e) Privacy Officer.--
``(1) In general.--The Director, in consultation with the
Secretary, shall designate a full-time privacy officer, who
shall report to the Director.
``(2) Duties.--The privacy officer designated under
paragraph (1) shall have primary responsibility for
implementation by the Center of the privacy policy for the
Department established by the Privacy Officer appointed under
section 222.
``(f) Duties of Director.--
``(1) In general.--The Director shall--
``(A) working cooperatively with the private
sector, lead the Federal effort to secure, protect, and
ensure the resiliency of the Federal information
infrastructure, national information infrastructure,
and communications infrastructure of the United States,
including communications networks;
``(B) assist in the identification, remediation,
and mitigation of vulnerabilities to the Federal
information infrastructure and the national information
infrastructure;
``(C) provide dynamic, comprehensive, and
continuous situational awareness of the security status
of the Federal information infrastructure, national
information infrastructure, information infrastructure
that is owned, operated, controlled, or licensed for
use by, or on behalf of, the Department of Defense, a
military department, or another element of the
intelligence community, and information infrastructure
located outside the United States the disruption of
which could result in national or regional catastrophic
damage in the United States by sharing and integrating
classified and unclassified information, including
information relating to threats, vulnerabilities,
traffic, trends, incidents, and other anomalous
activities affecting the infrastructure or systems, on
a routine and continuous basis with--
``(i) the National Threat Operations Center
of the National Security Agency;
``(ii) the United States Cyber Command,
including the Joint Task Force-Global Network
Operations;
``(iii) the Cyber Crime Center of the
Department of Defense;
``(iv) the National Cyber Investigative
Joint Task Force;
``(v) the Intelligence Community Incident
Response Center;
``(vi) any other Federal agency, or
component thereof, identified by the Director;
and
``(vii) any non-Federal entity, including,
where appropriate, information sharing and
analysis centers, identified by the Director,
with the concurrence of the owner or operator
of that entity and consistent with applicable
law;
``(D) work with the entities described in
subparagraph (C) to establish policies and procedures
that enable information sharing between and among the
entities;
``(E)(i) develop, in coordination with the
Assistant Secretary for Infrastructure Protection,
other Federal agencies, the private sector, and State
and local governments, a national incident response
plan that details the roles of Federal agencies, State
and local governments, and the private sector,
including plans to be executed in response to a
declaration of a national cyber emergency by the
President under section 249; and
``(ii) establish mechanisms for assisting owners or
operators of critical infrastructure, including covered
critical infrastructure, in the deployment of emergency
measures or other actions, including measures to
restore the critical infrastructure in the event of the
destruction or a serious disruption of the critical
infrastructure;
``(F) conduct risk-based assessments of the Federal
information infrastructure with respect to acts of
terrorism, natural disasters, and other large-scale
disruptions and provide the results of the assessments
to the Director of Cyberspace Policy and to affected
Federal agencies;
``(G) develop, oversee the implementation of, and
enforce policies, principles, and guidelines on
information security for the Federal information
infrastructure, including timely adoption of and
compliance with standards developed by the National
Institute of Standards and Technology under section 20
of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3);
``(H) provide assistance to the National Institute
of Standards and Technology in developing standards
under section 20 of the National Institute of Standards
and Technology Act (15 U.S.C. 278g-3);
``(I) provide to Federal agencies mandatory
security controls to mitigate and remediate
vulnerabilities of and incidents affecting the Federal
information infrastructure;
``(J) subject to paragraph (2), and as needed,
assist the Director of the Office of Management and
Budget and the Director of Cyberspace Policy in
conducting analysis and prioritization of budgets,
resources, and policies relating to the security of the
Federal information infrastructure;
``(K) in accordance with section 253, develop,
periodically update, and implement a supply chain risk
management strategy to enhance, in a risk-based and
cost-effective manner, the security of the
communications and information technology products and
services purchased by the Federal Government;
``(L) notify the Director of Cyberspace Policy of
any incident involving the Federal information
infrastructure, information infrastructure that is
owned, operated, controlled, or licensed for use by, or
on behalf of, the Department of Defense, a military
department, or another element of the intelligence
community, or the national information infrastructure
that could compromise or significantly affect economic
or national security;
``(M) consult, in coordination with the Director of
Cyberspace Policy, with appropriate international
partners to enhance the security of the Federal
information infrastructure, national information
infrastructure, and information infrastructure located
outside the United States the disruption of which could
result in national or regional catastrophic damage in
the United States;
``(N)(i) coordinate and integrate information to
analyze the composite security state of the Federal
information infrastructure and information
infrastructure that is owned, operated, controlled, or
licensed for use by, or on behalf of, the Department of
Defense, a military department, or another element of
the intelligence community;
``(ii) ensure the information required under clause
(i) and section 3553(c)(1)(A) of title 44, United
States Code, including the views of the Director on the
adequacy and effectiveness of information security
throughout the Federal information infrastructure and
information infrastructure that is owned, operated,
controlled, or licensed for use by, or on behalf of,
the Department of Defense, a military department, or
another element of the intelligence community, is
available on an automated and continuous basis through
the system maintained under section 3552(a)(3)(D) of
title 44, United States Code;
``(iii) in conjunction with the quadrennial
homeland security review required under section 707,
and at such other times determined appropriate by the
Director, analyze the composite security state of the
national information infrastructure and submit to the
President, Congress, and the Secretary a report
regarding actions necessary to enhance the composite
security state of the national information
infrastructure based on the analysis; and
``(iv) foster collaboration and serve as the
primary contact between the Federal Government, State
and local governments, and private entities on matters
relating to the security of the Federal information
infrastructure and the national information
infrastructure;
``(O) oversee the development, implementation, and
management of security requirements for Federal
agencies relating to the external access points to or
from the Federal information infrastructure;
``(P) establish, develop, and oversee the
capabilities and operations within the US-CERT as
required by section 244;
``(Q) oversee the operations of the National
Communications System, as described in Executive Order
12472 (49 Fed. Reg. 13471; relating to the assignment
of national security and emergency preparedness
telecommunications functions), as amended by Executive
Order 13286 (68 Fed. Reg. 10619) and Executive Order
13407 (71 Fed. Reg. 36975), or any successor thereto,
including planning for and providing communications for
the Federal Government under all circumstances,
including crises, emergencies, attacks, recoveries, and
reconstitutions;
``(R) ensure, in coordination with the privacy
officer designated under subsection (e), the Privacy
Officer appointed under section 222, and the Director
of the Office of Civil Rights and Civil Liberties
appointed under section 705, that the activities of the
Center comply with all policies, regulations, and laws
protecting the privacy and civil liberties of United
States persons;
``(S) subject to the availability of resources, in
accordance with applicable law relating to the
protection of trade secrets, and at the discretion of
the Director, provide voluntary technical assistance--
``(i) at the request of an owner or
operator of covered critical infrastructure, to
assist the owner or operator in complying with
sections 248 and 249, including implementing
required security or emergency measures and
developing response plans for national cyber
emergencies declared under section 249; and
``(ii) at the request of the owner or
operator of national information infrastructure
that is not covered critical infrastructure,
and based on risk, to assist the owner or
operator in implementing best practices, and
related standards and guidelines, recommended
under section 247 and other measures necessary
to mitigate or remediate vulnerabilities of the
information infrastructure and the consequences
of efforts to exploit the vulnerabilities;
``(T)(i) conduct, in consultation with the National
Cybersecurity Advisory Council, the head of appropriate
sector-specific agencies, and any private sector entity
determined appropriate by the Director, risk-based
assessments of national information infrastructure and
information infrastructure located outside the United
States the disruption of which could result in national
or regional catastrophic damage in the United States,
on a sector-by-sector basis, with respect to acts of
terrorism, natural disasters, and other large-scale
disruptions or financial harm, which shall identify and
prioritize risks to the national information
infrastructure and information infrastructure located
outside the United States the disruption of which could
result in national or regional catastrophic damage in
the United States, including vulnerabilities and
associated consequences; and
``(ii) coordinate and evaluate the mitigation or
remediation of vulnerabilities and consequences
identified under clause (i);
``(U) regularly evaluate and assess technologies
designed to enhance the protection of the Federal
information infrastructure and national information
infrastructure, including an assessment of the cost-
effectiveness of the technologies;
``(V) promote the use of the best practices
recommended under section 247 to State and local
governments and the private sector;
``(W) develop and implement outreach and awareness
programs on cybersecurity, including--
``(i) a public education campaign to
increase the awareness of cybersecurity, cyber
safety, and cyber ethics, which shall include
use of the Internet, social media,
entertainment, and other media to reach the
public;
``(ii) an education campaign to increase
the understanding of State and local
governments and private sector entities of the
costs of failing to ensure effective security
of information infrastructure and cost-
effective methods to mitigate and remediate
vulnerabilities; and
``(iii) outcome-based performance measures
to determine the success of the programs;
``(X) develop and implement a national
cybersecurity exercise program that includes--
``(i) the participation of State and local
governments, international partners of the
United States, and the private sector;
``(ii) an after action report analyzing
lessons learned from exercises and identifying
vulnerabilities to be remediated or mitigated;
and
``(iii) oversight, in coordination with the
Director of the Office of Cyberspace Policy, of
the efforts by Federal agencies to address
deficiencies identified in the after action
reports required under clause (ii);
``(Y) coordinate with the Assistant Secretary for
Infrastructure Protection to ensure that--
``(i) cybersecurity is appropriately
addressed in carrying out the infrastructure
protection responsibilities described in
section 201(d); and
``(ii) the operations of the Center and the
Office of Infrastructure Protection avoid
duplication and use, to the maximum extent
practicable, joint mechanisms for information
sharing and coordination with the private
sector;
``(Z) oversee the activities of the Office of
Emergency Communications established under section
1801;
``(AA) in coordination with the Director of the
Office of Cyberspace Policy and the heads of relevant
Federal agencies, develop and implement an identity
management strategy for cyberspace, which shall
include, at a minimum, research and development goals,
an analysis of appropriate protections for privacy and
civil liberties, and mechanisms to develop and
disseminate best practices and standards relating to
identity management, including usability and
transparency; and
``(BB) perform such other duties as the Secretary
may direct relating to the security and resiliency of
the information and communications infrastructure of
the United States.
``(2) Budget analysis.--In conducting analysis and
prioritization of budgets under paragraph (1)(J), the
Director--
``(A) in coordination with the Director of the
Office of Management and Budget, may access information
from any Federal agency regarding the finances, budget,
and programs of the Federal agency relevant to the
security of the Federal information infrastructure;
``(B) may make recommendations to the Director of
the Office of Management and Budget and the Director of
Cyberspace Policy regarding the budget for each Federal
agency to ensure that adequate funding is devoted to
securing the Federal information infrastructure, in
accordance with policies, principles, and guidelines
established by the Director under this subtitle; and
``(C) shall provide copies of any recommendations
made under subparagraph (B) to--
``(i) the Committee on Appropriations of
the Senate;
``(ii) the Committee on Appropriations of
the House of Representatives; and
``(iii) the appropriate committees of
Congress.
``(g) Use of Mechanisms for Collaboration.--In carrying out the
responsibilities and authorities of the Director under this subtitle,
to the maximum extent practicable, the Director shall use mechanisms
for collaboration and information sharing (including mechanisms
relating to the identification and communication of threats,
vulnerabilities, and associated consequences) established by other
components of the Department or other Federal agencies to avoid
unnecessary duplication or waste.
``(h) Sufficiency of Resources Plan.--
``(1) Report.--Not later than 120 days after the date of
enactment of this subtitle, the Director of the Office of
Management and Budget shall submit to the appropriate
committees of Congress and the Comptroller General of the
United States a report on the resources and staff necessary to
carry out fully the responsibilities under this subtitle.
``(2) Comptroller general review.--
``(A) In general.--The Comptroller General of the
United States shall evaluate the reasonableness and
adequacy of the report submitted by the Director under
paragraph (1).
``(B) Report.--Not later than 60 days after the
date on which the report is submitted under paragraph
(1), the Comptroller General shall submit to the
appropriate committees of Congress a report containing
the findings of the review under subparagraph (A).
``(i) Functions Transferred.--There are transferred to the Center
the National Cyber Security Division, the Office of Emergency
Communications, and the National Communications System, including all
the functions, personnel, assets, authorities, and liabilities of the
National Cyber Security Division, the Office of Emergency
Communications, and the National Communications System.
``(j) Assistant to the Director for State, Local, and Private
Sector Outreach.--The Director shall identify a senior official in the
Center who--
``(1) shall report directly to the Director; and
``(2) in coordination with the Special Assistant to the
Secretary appointed under section 102(f), shall--
``(A) advise the Director on policies and
regulations, rules, requirements or other actions
affecting the private sector, including the economic
impact;
``(B) work with individual businesses and other
nongovernmental organizations to foster dialogue with
the Center;
``(C) foster partnerships and facilitate
communication between the Center and State and local
governments and private sector entities;
``(D) coordinate and maintain communication and
interaction with State and local governments and
private sector entities on matters relating to the
security of the Federal information infrastructure and
the national information infrastructure;
``(E) assist the Director in sharing best
practices, guidelines, and other important information
relating to the policies, goals, and activities of the
Center;
``(F) assist the Director in developing and
implementing the national cybersecurity exercise
program under subsection (f)(1)(X) as it relates to
State and local governments and private sector
entities;
``(G) assist the Director in developing the
national incident response plan under subsection
(f)(1)(E) as it relates to State and local governments
and private sector entities;
``(H) assist the Director in information sharing
activities of the Center as it relates to State and
local governments and private sector entities; and
``(I) perform any other duties, as directed by the
Director.
``SEC. 243. PHYSICAL AND CYBER INFRASTRUCTURE COLLABORATION.
``(a) In General.--The Director and the Assistant Secretary for
Infrastructure Protection shall coordinate the information,
communications, and physical infrastructure protection responsibilities
and activities of the Center and the Office of Infrastructure
Protection.
``(b) Oversight.--The Secretary shall ensure that the coordination
described in subsection (a) occurs.
``SEC. 244. UNITED STATES COMPUTER EMERGENCY READINESS TEAM.
``(a) Establishment of Office.--There is established within the
Center, the United States Computer Emergency Readiness Team, which
shall be headed by a Director, who shall be selected from the Senior
Executive Service by the Secretary.
``(b) Responsibilities.--The US-CERT shall--
``(1) collect, coordinate, and disseminate information on--
``(A) risks to the Federal information
infrastructure, information infrastructure that is
owned, operated, controlled, or licensed for use by, or
on behalf of, the Department of Defense, a military
department, or another element of the intelligence
community, or the national information infrastructure;
and
``(B) security controls to enhance the security of
the Federal information infrastructure or the national
information infrastructure against the risks identified
in subparagraph (A); and
``(2) establish a mechanism for engagement with the private
sector.
``(c) Monitoring, Analysis, Warning, and Response.--
``(1) Duties.--Subject to paragraph (2), the US-CERT
shall--
``(A) provide analysis and reports to Federal
agencies on the security of the Federal information
infrastructure;
``(B) provide continuous, automated monitoring of
the Federal information infrastructure at external
Internet access points, which shall include detection
and warning of threats, vulnerabilities, traffic,
trends, incidents, and other anomalous activities
affecting the information security of the Federal
information infrastructure;
``(C) warn Federal agencies of threats,
vulnerabilities, incidents, and anomalous activities
that could affect the Federal information
infrastructure;
``(D) develop, recommend, and deploy security
controls to mitigate or remediate vulnerabilities;
``(E) support Federal agencies in conducting risk
assessments of the agency information infrastructure;
``(F) disseminate to Federal agencies risk analyses
of incidents that could impair the risk-based security
of the Federal information infrastructure;
``(G) develop and acquire predictive analytic tools
to evaluate threats, vulnerabilities, traffic, trends,
incidents, and anomalous activities;
``(H) aid in the detection of, and warn owners or
operators of national information infrastructure
regarding, threats, vulnerabilities, and incidents,
affecting the national information infrastructure,
including providing--
``(i) timely, targeted, and actionable
notifications of threats, vulnerabilities, and
incidents;
``(ii) notifications under this
subparagraph; and
``(iii) recommended security controls to
mitigate or remediate vulnerabilities; and
``(I) respond to assistance requests from Federal
agencies and, subject to the availability of resources,
owners or operators of the national information
infrastructure to--
``(i) isolate, mitigate, or remediate
incidents;
``(ii) recover from damages and mitigate or
remediate vulnerabilities; and
``(iii) evaluate security controls and
other actions taken to secure information
infrastructure and incorporate lessons learned
into best practices, policies, principles, and
guidelines.
``(2) Requirement.--With respect to the Federal information
infrastructure, the US-CERT shall conduct the activities
described in paragraph (1) in a manner consistent with the
responsibilities of the head of a Federal agency described in
section 3553 of title 44, United States Code.
``(3) Report.--Not later than 1 year after the date of
enactment of this subtitle, and every year thereafter, the
Secretary shall--
``(A) in conjunction with the Inspector General of
the Department, conduct an independent audit or review
of the activities of the US-CERT under paragraph
(1)(B), which shall include, at a minimum, an
assessment of whether and to what extent the activities
authorized under paragraph (1)(B) have monitored
communications other than communications to or from a
Federal agency; and
``(B) submit to the appropriate committees of
Congress and the President a report regarding the audit
or review under subparagraph (A).
``(4) Classified annex.--A report submitted under paragraph
(3) shall be submitted in an unclassified form, but may include
a classified annex, if necessary.
``(d) Procedures for Federal Government.--Not later than 90 days
after the date of enactment of this subtitle, the head of each Federal
agency shall establish procedures for the Federal agency that ensure
that the US-CERT can perform the functions described in subsection (c)
in relation to the Federal agency.
``(e) Operational Updates.--The US-CERT shall provide unclassified
and, as appropriate, classified updates regarding the composite
security state of the Federal information infrastructure to the Federal
Information Security Taskforce.
``(f) Federal Points of Contact.--The Director of the US-CERT shall
designate a principal point of contact within the US-CERT for each
Federal agency to--
``(1) maintain communication;
``(2) ensure cooperative engagement and information
sharing; and
``(3) respond to inquiries or requests.
``(g) Requests for Information or Physical Access.--
``(1) Information access.--Upon request of the Director of
the US-CERT, the head of a Federal agency or an Inspector
General for a Federal agency shall provide any law enforcement
information, intelligence information, terrorism information,
or any other information (including information relating to
incidents provided under subsections (a)(4) and (c) of section
246) relevant to the security of the Federal information
infrastructure or the national information infrastructure
necessary to carry out the duties, responsibilities, and
authorities under this subtitle.
``(2) Physical access.--Upon request of the Director, and
in consultation with the head of a Federal agency, the Federal
agency shall provide physical access to any facility of the
Federal agency necessary to determine whether the Federal
agency is in compliance with any policies, principles, and
guidelines established by the Director under this subtitle, or
otherwise necessary to carry out the duties, responsibilities,
and authorities of the Director applicable to the Federal
information infrastructure.
``SEC. 245. ADDITIONAL AUTHORITIES OF THE DIRECTOR OF THE NATIONAL
CENTER FOR CYBERSECURITY AND COMMUNICATIONS.
``(a) Access to Information.--Unless otherwise directed by the
President--
``(1) the Director shall access, receive, and analyze law
enforcement information, intelligence information, terrorism
information, and any other information (including information
relating to incidents provided under subsections (a)(4) and (c)
of section 246) relevant to the security of the Federal
information infrastructure, information infrastructure that is
owned, operated, controlled, or licensed for use by, or on
behalf of, the Department of Defense, a military department, or
another element of the intelligence community, or national
information infrastructure from Federal agencies and,
consistent with applicable law, State and local governments
(including law enforcement agencies), and private entities,
including information provided by any contractor to a Federal
agency regarding the security of the agency information
infrastructure;
``(2) any Federal agency in possession of law enforcement
information, intelligence information, terrorism information,
or any other information (including information relating to
incidents provided under subsections (a)(4) and (c) of section
246) relevant to the security of the Federal information
infrastructure, information infrastructure that is owned,
operated, controlled, or licensed for use by, or on behalf of,
the Department of Defense, a military department, or another
element of the intelligence community, or national information
infrastructure shall provide that information to the Director
in a timely manner; and
``(3) the Director, in coordination with the Director of
the Office of Management and Budget, the Attorney General, the
Privacy and Civil Liberties Oversight Board established under
section 1061 of the National Security Intelligence Reform Act
of 2004 (42 U.S.C. 2000ee), the Director of National
Intelligence, and the Archivist of the United States, shall
establish guidelines to ensure that information is transferred,
stored, and preserved--
``(A) in accordance with applicable laws relating
to the protection of trade secrets and other applicable
laws; and
``(B) in a manner that protects the privacy and
civil liberties of United States persons and
intelligence sources and methods.
``(b) Operational Evaluations.--
``(1) In general.--The Director--
``(A) subject to paragraph (2), shall develop,
maintain, and enhance capabilities to evaluate the
security of the Federal information infrastructure as
described in section 3554(a)(3) of title 44, United
States Code, including the ability to conduct risk-
based penetration testing and vulnerability
assessments;
``(B) in carrying out subparagraph (A), may request
technical assistance from the Director of the Federal
Bureau of Investigation, the Director of the National
Security Agency, the head of any other Federal agency
that may provide support, and any nongovernmental
entity contracting with the Department or another
Federal agency; and
``(C) in consultation with the Attorney General and
the Privacy and Civil Liberties Oversight Board
established under section 1061 of the National Security
Intelligence Reform Act of 2004 (42 U.S.C. 2000ee),
shall develop guidelines to ensure compliance with all
applicable laws relating to the privacy of United
States persons in carrying out the operational
evaluations under subparagraph (A).
``(2) Operational evaluations.--
``(A) In general.--The Director may conduct risk-
based operational evaluations of the agency information
infrastructure of any Federal agency, at a time
determined by the Director, in consultation with the
head of the Federal agency, using the capabilities
developed under paragraph (1)(A).
``(B) Annual evaluation requirement.--If the
Director conducts an operational evaluation under
subparagraph (A) or an operational evaluation at the
request of a Federal agency to meet the requirements of
section 3554 of title 44, United States Code, the
operational evaluation shall satisfy the requirements
of section 3554 for the Federal agency for the year of
the evaluation, unless otherwise specified by the
Director.
``(c) Corrective Measures and Mitigation Plans.--If the Director
determines that a Federal agency is not in compliance with applicable
policies, principles, standards, and guidelines applicable to the
Federal information infrastructure--
``(1) the Director, in consultation with the Director of
the Office of Management and Budget, may direct the head of the
Federal agency to--
``(A) take corrective measures to meet the
policies, principles, standards, and guidelines; and
``(B) develop a plan to remediate or mitigate any
vulnerabilities addressed by the policies, principles,
standards, and guidelines;
``(2) within such time period as the Director shall
prescribe, the head of the Federal agency shall--
``(A) implement a corrective measure or develop a
mitigation plan in accordance with paragraph (1); or
``(B) submit to the Director, the Director of the
Office of Management and Budget, the Inspector General
for the Federal agency, and the appropriate committees
of Congress a report indicating why the Federal agency
has not implemented the corrective measure or developed
a mitigation plan; and
``(3) after providing notice to the head of the affected
Federal agency, the Director may direct the isolation of any
component of the agency information infrastructure, consistent
with the contingency or continuity of operation plans
applicable to the agency information infrastructure, until
corrective measures are taken or mitigation plans approved by
the Director are put in place, if--
``(A) the head of the Federal agency has failed to
comply with the corrective measures prescribed under
paragraph (1); and
``(B) the failure to comply presents a significant
danger to the Federal information infrastructure.
``SEC. 246. INFORMATION SHARING.
``(a) Federal Agencies.--
``(1) Information sharing program.--Consistent with the
responsibilities described in sections 242 and 244, the
Director, in consultation with the other members of the Chief
Information Officers Council established under section 3603 of
title 44, United States Code, and the Federal Information
Security Taskforce, shall establish a program for sharing
information with and between the Center and other Federal
agencies that includes processes and procedures, including
standard operating procedures--
``(A) under which the Director regularly shares
with each Federal agency--
``(i) analysis and reports on the composite
security state of the Federal information
infrastructure and information infrastructure
that is owned, operated, controlled, or
licensed for use by, or on behalf of, the
Department of Defense, a military department,
or another element of the intelligence
community, which shall include information
relating to threats, vulnerabilities,
incidents, or anomalous activities;
``(ii) any available analysis and reports
regarding the security of the agency
information infrastructure; and
``(iii) means and methods of preventing,
responding to, mitigating, and remediating
vulnerabilities; and
``(B) under which the Director may request
information from Federal agencies concerning the
security of the Federal information infrastructure,
information infrastructure that is owned, operated,
controlled, or licensed for use by, or on behalf of,
the Department of Defense, a military department, or
another element of the intelligence community, or the
national information infrastructure necessary to carry
out the duties of the Director under this subtitle or
any other provision of law.
``(2) Contents.--The program established under this section
shall include--
``(A) timeframes for the sharing of information
under paragraph (1);
``(B) guidance on what information shall be shared,
including information regarding incidents;
``(C) a tiered structure that provides guidance for
the sharing of urgent information; and
``(D) processes and procedures under which the
Director or the head of a Federal agency may report
noncompliance with the program to the Director of
Cyberspace Policy.
``(3) US-CERT.--The Director of the US-CERT shall ensure
that the head of each Federal agency has continual access to
data collected by the US-CERT regarding the agency information
infrastructure of the Federal agency.
``(4) Federal agencies.--
``(A) In general.--The head of a Federal agency
shall comply with all processes and procedures
established under this subsection regarding
notification to the Director relating to incidents.
``(B) Immediate notification required.--Unless
otherwise directed by the President, any Federal agency
with a national security system shall immediately
notify the Director regarding any incident affecting
the risk-based security of the national security
system.
``(b) State and Local Governments, Private Sector, and
International Partners.--
``(1) In general.--The Director shall establish processes
and procedures, including standard operating procedures, to
ensure bidirectional information sharing with State and local
governments, private entities, and international partners of
the United States on--
``(A) threats, vulnerabilities, incidents, and
anomalous activities affecting the national information
infrastructure; and
``(B) means and methods of preventing, responding
to, and mitigating and remediating vulnerabilities.
``(2) Contents.--The processes and procedures established
under paragraph (1) shall include--
``(A) means or methods of accessing classified or
unclassified information, as appropriate and in
accordance with applicable laws regarding trade
secrets, that will provide situational awareness of the
security of the Federal information infrastructure and
the national information infrastructure relating to
threats, vulnerabilities, traffic, trends, incidents,
and other anomalous activities affecting the Federal
information infrastructure or the national information
infrastructure;
``(B) a mechanism, established in consultation with
the heads of the relevant sector-specific agencies,
sector coordinating councils, and information sharing
and analysis centers, by which owners and operators of
covered critical infrastructure shall report incidents
in the information infrastructure for covered critical
infrastructure under subsection (c)(1)(A);
``(C) guidance on the form, content, and priority
of incident reports that shall be submitted under
subsection (c)(1)(A), which shall--
``(i) include appropriate mechanisms to
protect--
``(I) information in accordance
with section 251;
``(II) personally identifiable
information; and
``(III) trade secrets; and
``(ii) prioritize the reporting of
incidents based on the risk the incident poses
to the disruption of the reliable operation of
the covered critical infrastructure;
``(D) a procedure for notifying an information
technology provider if a vulnerability is detected in
the product or service produced by the information
technology provider and, where possible, working with
the information technology provider to remediate the
vulnerability before any public disclosure of the
vulnerability so as to minimize the opportunity for the
vulnerability to be exploited; and
``(E) an evaluation of the need to provide security
clearances to employees of State and local governments,
private entities, and international partners to carry
out this subsection.
``(3) Guidelines.--The Director, in consultation with the
Attorney General, the Director of National Intelligence, and
the Privacy Officer established under section 242(e), shall
develop guidelines to protect the privacy and civil liberties
of United States persons and intelligence sources and methods,
while carrying out this subsection.
``(c) Incidents.--
``(1) Non-federal entities.--
``(A) In general.--
``(i) Mandatory reporting.--Subject to
clause (ii), the owner or operator of covered
critical infrastructure shall report any
incident affecting the information
infrastructure of covered critical
infrastructure to the extent the incident might
indicate an actual or potential cyber risk, or
exploitation of a cyber risk, in accordance
with the policies and procedures for the
mechanism established under subsection
(b)(2)(B) and guidelines developed under
subsection (b)(3).
``(ii) Limitation.--Clause (i) shall not
authorize the Director, the Center, the
Department, or any other Federal entity to--
``(I) compel the disclosure of
information relating to an incident
unless otherwise authorized by law; or
``(II) intercept a wire, oral, or
electronic communication (as those
terms are defined in section 2510 of
title 18, United States Code), access a
stored electronic or wire
communication, install or use a pen
register or trap and trace device, or
conduct electronic surveillance (as
defined in section 101 of the Foreign
Intelligence Surveillance Act of 1978
(50 U.S.C. 1801)) relating to an
incident, unless otherwise authorized
under chapter 119, chapter 121, or
chapter 206 of title 18, United States
Code, or the Foreign Intelligence
Surveillance Act of 1978 (50 U.S.C.
1801 et seq.).
``(B) Reporting procedures.--The Director shall
establish procedures that enable and encourage the
owner or operator of national information
infrastructure to report to the Director regarding
incidents affecting such information infrastructure.
``(2) Information protection.--Notwithstanding any other
provision of law, information reported under paragraph (1)
shall be protected from unauthorized disclosure, in accordance
with section 251.
``(d) Additional Responsibilities.--The Director shall--
``(1) share data collected on the Federal information
infrastructure with the National Science Foundation and other
accredited research institutions for the sole purpose of
cybersecurity research in a manner that protects privacy and
civil liberties of United States persons and intelligence
sources and methods;
``(2) establish a website to provide an opportunity for the
public to provide--
``(A) input about the operations of the Center; and
``(B) recommendations for improvements of the
Center; and
``(3) in coordination with the Secretary of Defense, the
Director of National Intelligence, the Secretary of State, and
the Attorney General, develop information sharing pilot
programs with international partners of the United States.
``SEC. 247. PRIVATE SECTOR ASSISTANCE.
``(a) In General.--The Director, in consultation with the Director
of the National Institute of Standards and Technology, the Director of
the National Security Agency, the head of any relevant sector-specific
agency, the National Cybersecurity Advisory Council, State and local
governments, and any private entities the Director determines
appropriate, shall establish a program to promote, and provide
technical assistance authorized under section 242(f)(1)(S) relating to
the implementation of, best practices and related standards and
guidelines for securing the national information infrastructure,
including the costs and benefits associated with the implementation of
the best practices and related standards and guidelines.
``(b) Analysis and Improvement of Standards and Guidelines.--For
purposes of the program established under subsection (a), the Director
shall--
``(1) regularly assess and evaluate cybersecurity standards
and guidelines issued by private sector organizations,
recognized international and domestic standards setting
organizations, and Federal agencies; and
``(2) in coordination with the National Institute of
Standards and Technology, encourage the development of, and
recommend changes to, the standards and guidelines described in
paragraph (1) for securing the national information
infrastructure.
``(c) Guidance and Technical Assistance.--
``(1) In general.--The Director shall promote best
practices and related standards and guidelines to assist owners
and operators of national information infrastructure in
increasing the security of the national information
infrastructure and protecting against and mitigating or
remediating known vulnerabilities.
``(2) Requirement.--Technical assistance provided under
section 242(f)(1)(S) and best practices promoted under this
section shall be prioritized based on risk.
``(d) Criteria.--In promoting best practices or recommending
changes to standards and guidelines under this section, the Director
shall ensure that best practices, and related standards and
guidelines--
``(1) address cybersecurity in a comprehensive, risk-based
manner;
``(2) include consideration of the cost of implementing
such best practices or of implementing recommended changes to
standards and guidelines;
``(3) increase the ability of the owners or operators of
national information infrastructure to protect against and
mitigate or remediate known vulnerabilities;
``(4) are suitable, as appropriate, for implementation by
small business concerns;
``(5) as necessary and appropriate, are sector specific;
``(6) to the maximum extent possible, incorporate standards
and guidelines established by private sector organizations,
recognized international and domestic standards setting
organizations, and Federal agencies;
``(7) consider voluntary programs by internet service
providers to assist individuals using the internet service
providers in the identification and mitigation of cyber threats
and vulnerabilities, with the consent of the individual users;
and
``(8) provide sufficient flexibility to permit a range of
security solutions.
``SEC. 248. CYBER RISKS TO COVERED CRITICAL INFRASTRUCTURE.
``(a) Identification of Cyber Risks.--
``(1) In general.--Based on the risk-based assessments
conducted under section 242(f)(1)(T)(i), the Director, in
coordination with the head of the sector-specific agency with
responsibility for covered critical infrastructure and the head
of any Federal agency that is not a sector-specific agency with
responsibilities for regulating the covered critical
infrastructure, and in consultation with the National
Cybersecurity Advisory Council and any private sector entity
determined appropriate by the Director, shall, on a continuous
and sector-by-sector basis, identify and evaluate the cyber
risks to covered critical infrastructure.
``(2) Factors to be considered.--In identifying and
evaluating cyber risks under paragraph (1), the Director shall
consider--
``(A) the actual or assessed threat, including a
consideration of adversary capabilities and intent,
preparedness, target attractiveness, and deterrence
capabilities;
``(B) the extent and likelihood of death, injury,
or serious adverse effects to human health and safety
caused by a disruption of the reliable operation of
covered critical infrastructure;
``(C) the threat to or impact on national security
caused by a disruption of the reliable operation of
covered critical infrastructure;
``(D) the extent to which the disruption of the
reliable operation of covered critical infrastructure
will disrupt the reliable operation of other covered
critical infrastructure;
``(E) the harm to the economy that would result
from a disruption of the reliable operation of covered
critical infrastructure; and
``(F) other risk-based security factors that the
Director, in consultation with the head of the sector-
specific agency with responsibility for the covered
critical infrastructure and the head of any Federal
agency that is not a sector-specific agency with
responsibilities for regulating the covered critical
infrastructure, determine to be appropriate and
necessary to protect public health and safety, critical
infrastructure, or national and economic security.
``(3) Report.--
``(A) In general.--Not later than 180 days after
the date of enactment of this subtitle, and annually
thereafter, the Director, in coordination with the head
of the sector-specific agency with responsibility for
the covered critical infrastructure and the head of any
Federal agency that is not a sector-specific agency
with responsibilities for regulating the covered
critical infrastructure, shall submit to the
appropriate committees of Congress a report on the
findings of the identification and evaluation of cyber
risks under this subsection. Each report submitted
under this paragraph shall be submitted in an
unclassified form, but may include a classified annex.
``(B) Input.--For purposes of the reports required
under subparagraph (A), the Director shall create a
process under which owners and operators of covered
critical infrastructure may provide input on the
findings of the reports.
``(b) Risk-Based Security Performance Requirements.--
``(1) In general.--Not later than 270 days after the date
of the enactment of this subtitle, in coordination with the
heads of the sector-specific agencies with responsibility for
covered critical infrastructure and the head of any Federal
agency that is not a sector-specific agency with
responsibilities for regulating the covered critical
infrastructure, and in consultation with the National
Cybersecurity Advisory Council and any private sector entity
determined appropriate by the Director, the Director shall
issue interim final regulations establishing risk-based
security performance requirements to secure covered critical
infrastructure against cyber risks through the adoption of
security measures that satisfy the security performance
requirements identified by the Director.
``(2) Procedures.--The regulations issued under this
subsection shall--
``(A) include a process under which owners and
operators of covered critical infrastructure are
informed of identified cyber risks and security
performance requirements designed to remediate or
mitigate the cyber risks, in combination with best
practices recommended under section 247;
``(B) establish a process for owners and operators
of covered critical infrastructure to select security
measures, including any best practices recommended
under section 247, that, in combination, satisfy the
security performance requirements established by the
Director under this subsection;
``(C) establish a process for owners and operators
of covered critical infrastructure to develop response
plans for a national cyber emergency declared under
section 249;
``(D) establish a process under which the
Director--
``(i) is notified of the security measures
selected by the owner or operator of covered
critical infrastructure under subparagraph (B);
and
``(ii) may determine whether the proposed
security measures satisfy the security
performance requirements established by the
Director under this subsection; and
``(E) establish a process under which the
Director--
``(i) identifies to owners and operators of
covered critical infrastructure cyber risks
that are not capable of effective remediation
or mitigation using available best practices or
security measures;
``(ii) provides owners and operators of
covered critical infrastructure the opportunity
to develop best practices or security measures
to remediate or mitigate the cyber risks
identified in clause (i) without the prior
approval of the Director and without affecting
the compliance of the covered critical
infrastructure with the requirements under this
section;
``(iii) in accordance with applicable law
relating to the protection of trade secrets,
permits owners and operators of covered
critical infrastructure to report to the Center
the development of effective best practices or
security measures to remediate or mitigate the
cyber risks identified under clause (i); and
``(iv) incorporates the best practices and
security measures developed into the risk-based
security performance requirements under this
section.
``(3) International cooperation on securing covered
critical infrastructure.--
``(A) In general.--The Director, in coordination
with the head of the sector-specific agency with
responsibility for covered critical infrastructure and
the head of any Federal agency that is not a sector-
specific agency with responsibilities for regulating
the covered critical infrastructure, shall--
``(i) consistent with the protection of
intelligence sources and methods and other
sensitive matters, inform the owner or operator
of information infrastructure located outside
the United States the disruption of which could
result in national or regional catastrophic
damage in the United States and the government
of the country in which the information
infrastructure is located of any cyber risks to
the information infrastructure; and
``(ii) coordinate with the government of
the country in which the information
infrastructure is located and, as appropriate,
the owner or operator of the information
infrastructure, regarding the implementation of
security measures or other measures to the
information infrastructure to mitigate or
remediate cyber risks.
``(B) International agreements.--The Director shall
carry out this paragraph in a manner consistent with
applicable international agreements.
``(4) Risk-based security performance requirements.--
``(A) In general.--The security performance
requirements established by the Director under this
subsection shall be--
``(i) based on the factors listed in
subsection (a)(2); and
``(ii) designed to remediate or mitigate
identified cyber risks and any associated
consequences of an exploitation based on such
risks.
``(B) Consultation.--In establishing security
performance requirements under this subsection, the
Director shall, to the maximum extent practicable,
consult with--
``(i) the Director of the National Security
Agency;
``(ii) the Director of the National
Institute of Standards and Technology;
``(iii) the National Cybersecurity Advisory
Council;
``(iv) the heads of sector-specific
agencies; and
``(v) the heads of Federal agencies that
are not sector-specific agencies with
responsibilities for regulating the covered
critical infrastructure.
``(C) Alternative measures.--
``(i) In general.--The owners and operators
of covered critical infrastructure shall have
flexibility to implement any security measure,
or combination thereof, to satisfy the security
performance requirements described in
subparagraph (A) and the Director may not
disapprove under this section any proposed
security measures, or combination thereof,
based on the presence or absence of any
particular security measure if the proposed
security measures, or combination thereof,
satisfy the security performance requirements
established by the Director under this section
or are consistent with the process for
addressing new or evolving cyber risks
established under paragraph (2)(E).
``(ii) Recommended security measures.--The
Director may recommend to an owner and operator
of covered critical infrastructure a specific
security measure, or combination thereof, that
will satisfy the security performance
requirements established by the Director. The
absence of the recommended security measures,
or combination thereof, may not serve as the
basis for a disapproval of the security
measure, or combination thereof, proposed by
the owner or operator of covered critical
infrastructure if the proposed security
measure, or combination thereof, otherwise
satisfies the security performance requirements
established by the Director under this section.
``SEC. 249. NATIONAL CYBER EMERGENCIES.
``(a) Declaration.--
``(1) In general.--The President may issue a declaration of
a national cyber emergency to covered critical infrastructure
if there is an ongoing or imminent action by any individual or
entity to exploit a cyber risk in a manner that disrupts,
attempts to disrupt, or poses a significant risk of disruption
to the operation of the information infrastructure essential to
the reliable operation of covered critical infrastructure. Any
declaration under this section shall specify the covered
critical infrastructure subject to the national cyber
emergency.
``(2) Notification.--Upon issuing a declaration under
paragraph (1), the President shall, consistent with the
protection of intelligence sources and methods, notify the
owners and operators of the specified covered critical
infrastructure and any other relevant private sector entity of
the nature of the national cyber emergency.
``(3) Authorities.--If the President issues a declaration
under paragraph (1), the Director shall--
``(A) immediately direct the owners and operators
of covered critical infrastructure subject to the
declaration under paragraph (1) to implement response
plans required under section 248(b)(2)(C);
``(B) develop and coordinate emergency measures or
actions necessary to preserve the reliable operation,
and mitigate or remediate the consequences of the
potential disruption, of covered critical
infrastructure;
``(C) ensure that emergency measures or actions
directed under this section represent the least
disruptive means feasible to the operations of the
covered critical infrastructure and to the national
information infrastructure;
``(D) subject to subsection (g), direct actions by
other Federal agencies to respond to the national cyber
emergency;
``(E) coordinate with officials of State and local
governments, international partners of the United
States, owners and operators of covered critical
infrastructure specified in the declaration, and other
relevant private section entities to respond to the
national cyber emergency;
``(F) initiate a process under section 248 to
address the cyber risk that may be exploited by the
national cyber emergency; and
``(G) provide voluntary technical assistance, if
requested, under section 242(f)(1)(S).
``(4) Reimbursement.--A Federal agency shall be reimbursed
for expenditures under this section from funds appropriated for
the purposes of this section. Any funds received by a Federal
agency as reimbursement for services or supplies furnished
under the authority of this section shall be deposited to the
credit of the appropriation or appropriations available on the
date of the deposit for the services or supplies.
``(5) Consultation.--In carrying out this section, the
Director shall consult with the Secretary, the Secretary of
Defense, the Director of the National Security Agency, the
Director of the National Institute of Standards and Technology,
and any other official, as directed by the President.
``(6) Prohibited actions.--The authority to direct
compliance with an emergency measure or action under this
section shall not authorize the Director, the Center, the
Department, or any other Federal entity to--
``(A) restrict or prohibit communications carried
by, or over, covered critical infrastructure and not
specifically directed to or from the covered critical
infrastructure unless the Director determines that no
other emergency measure or action will preserve the
reliable operation, and mitigate or remediate the
consequences of the potential disruption, of the
covered critical infrastructure or the national
information infrastructure;
``(B) control covered critical infrastructure;
``(C) compel the disclosure of information unless
specifically authorized by law; or
``(D) intercept a wire, oral, or electronic
communication (as those terms are defined in section
2510 of title 18, United States Code), access a stored
electronic or wire communication, install or use a pen
register or trap and trace device, or conduct
electronic surveillance (as defined in section 101 of
the Foreign Intelligence Surveillance Act of 1978 (50
U.S.C. 1801)) relating to an incident, unless otherwise
authorized under chapter 119, chapter 121, or chapter
206 of title 18, United States Code, or the Foreign
Intelligence Surveillance Act of 1978 (50 U.S.C. 1801
et seq.).
``(7) Privacy.--In carrying out this section, the Director
shall ensure that the privacy and civil liberties of United
States persons are protected.
``(b) Discontinuance of Emergency Measures.--
``(1) In general.--Any emergency measure or action
developed under this section shall cease to have effect not
later than 30 days after the date on which the President issued
the declaration of a national cyber emergency, unless--
``(A) the Director details in writing why the
emergency measure or action remains necessary to
address the identified national cyber emergency; and
``(B) the President issues a written order or
directive reaffirming the national cyber emergency, the
continuing nature of the national cyber emergency, or
the need to continue the adoption of the emergency
measure or action.
``(2) Extensions.--An emergency measure or action extended
in accordance with paragraph (1) may--
``(A) remain in effect for not more than 30 days
after the date on which the emergency measure or action
was to cease to have effect; and
``(B) unless a joint resolution described in
subsection (f)(1) is enacted, be extended for not more
than 3 additional 30-day periods, if the requirements
of paragraph (1) and subsection (d) are met.
``(c) Compliance With Emergency Measures.--
``(1) In general.--Subject to paragraph (2), the owner or
operator of covered critical infrastructure shall immediately
comply with any emergency measure or action developed by the
Director under this section during the pendency of any
declaration by the President under subsection (a)(1) or an
extension under subsection (b)(2).
``(2) Alternative measures.--
``(A) In general.--If the Director determines that
a proposed security measure, or any combination
thereof, submitted by the owner or operator of covered
critical infrastructure in accordance with the process
established under section 248(b)(2) will effectively
mitigate or remediate the cyber risk associated with
the national cyber emergency that is the subject of the
declaration under this section, or effectively mitigate
or remediate the consequences of the potential
disruption of the covered critical infrastructure based
on the cyber risk at least as effectively as the
emergency measures or actions directed by the Director
under this section, the owner or operator may comply
with paragraph (1) of this subsection by implementing
the proposed security measure, or combination thereof,
approved by the Director under the process established
under section 248.
``(B) Compliance pending submission or approval.--
Before submission of a proposed security measure, or
combination thereof, and during the pendency of any
review by the Director under the process established
under section 248, the owner or operator of covered
critical infrastructure shall remain in compliance with
any emergency measure or action developed by the
Director under this section during the pendency of any
declaration by the President under subsection (a)(1) or
an extension under subsection (b)(2), until such time
as the Director has approved an alternative proposed
security measure, or combination thereof, under this
paragraph.
``(3) International cooperation on national cyber
emergencies.--
``(A) In general.--The Director, in coordination
with the head of the sector-specific agency with
responsibility for covered critical infrastructure and
the head of any Federal agency that is not a sector-
specific agency with responsibilities for regulating
the covered critical infrastructure, shall--
``(i) consistent with the protection of
intelligence sources and methods and other
sensitive matters, inform the owner or operator
of information infrastructure located outside
the United States the disruption of which could
result in national or regional catastrophic
damage in the United States and the government
of the country in which the information
infrastructure is located of any cyber risks to
the information infrastructure that led to the
declaration of a national cyber emergency; and
``(ii) coordinate with the government of
the country in which the information
infrastructure is located and, as appropriate,
the owner or operator of the information
infrastructure, regarding the implementation of
emergency measures or actions necessary to
preserve the reliable operation, and mitigate
or remediate the consequences of the potential
disruption, of covered critical infrastructure
that is the subject of the national cyber
emergency.
``(B) International agreements.--The Director shall
carry out this paragraph in a manner consistent with
applicable international agreements.
``(d) Reporting.--
``(1) In general.--Except as provided in paragraph (2), the
President shall ensure that any declaration under subsection
(a)(1) or any extension under subsection (b)(2) is reported to
the appropriate committees of Congress before the Director
mandates any emergency measure or actions under subsection
(a)(3).
``(2) Exception.--If notice cannot be given under paragraph
(1) before mandating any emergency measure or actions under
subsection (a)(3), the President shall provide the report
required under paragraph (1) as soon as possible, along with a
statement of the reasons for not providing notice in accordance
with paragraph (1).
``(3) Contents.--Each report under this subsection shall
describe--
``(A) the nature of the national cyber emergency;
``(B) the reasons that risk-based security
requirements under section 248 are not sufficient to
address the national cyber emergency;
``(C) the actions necessary to preserve the
reliable operation and mitigate the consequences of the
potential disruption of covered critical
infrastructure; and
``(D) in the case of an extension of a national
cyber emergency under subsection (b)(2)--
``(i) why the emergency measures or actions
continue to be necessary to address the
national cyber emergency; and
``(ii) when the President expects the
national cyber emergency to abate.
``(e) Statutory Defenses and Civil Liability Limitations for
Compliance With Emergency Measures.--
``(1) Definitions.--In this subsection--
``(A) the term `covered civil action'--
``(i) means a civil action filed in a
Federal or State court against a covered
entity; and
``(ii) does not include an action brought
under section 2520 or 2707 of title 18, United
States Code, or section 110 or 308 of the
Foreign Intelligence Surveillance Act of 1978
(50 U.S.C. 1810 and 1828);
``(B) the term `covered entity' means any entity
that owns or operates covered critical infrastructure,
including any owner, operator, officer, employee,
agent, landlord, custodian, provider of information
technology, or other person acting for or on behalf of
that entity with respect to the covered critical
infrastructure; and
``(C) the term `noneconomic damages' means damages
for losses for physical and emotional pain, suffering,
inconvenience, physical impairment, mental anguish,
disfigurement, loss of enjoyment of life, loss of
society and companionship, loss of consortium, hedonic
damages, injury to reputation, and any other
nonpecuniary losses.
``(2) Application of limitations on civil liability.--The
limitations on civil liability under paragraph (3) apply if--
``(A) the President has issued a declaration of
national cyber emergency under subsection (a)(1);
``(B) the Director has--
``(i) issued emergency measures or actions
for which compliance is required under
subsection (c)(1); or
``(ii) approved security measures under
subsection (c)(2);
``(C) the covered entity is in compliance with--
``(i) the emergency measures or actions
required under subsection (c)(1); or
``(ii) security measures which the Director
has approved under subsection (c)(2); and
``(D)(i) the Director certifies to the court in
which the covered civil action is pending that the
actions taken by the covered entity during the period
covered by the declaration under subsection (a)(1) were
consistent with--
``(I) emergency measures or actions for
which compliance is required under subsection
(c)(1); or
``(II) security measures which the Director
has approved under subsection (c)(2); or
``(ii) notwithstanding the lack of a certification,
the covered entity demonstrates by a preponderance of
the evidence that the actions taken during the period
covered by the declaration under subsection (a)(1) are
consistent with the implementation of--
``(I) emergency measures or actions for
which compliance is required under subsection
(c)(1); or
``(II) security measures which the Director
has approved under subsection (c)(2).
``(3) Limitations on civil liability.--In any covered civil
action that is related to any incident associated with a cyber
risk covered by a declaration of a national cyber emergency and
for which Director has issued emergency measures or actions for
which compliance is required under subsection (c)(1) or for
which the Director has approved security measures under
subsection (c)(2), or that is the direct consequence of actions
taken in good faith for the purpose of implementing security
measures or actions which the Director has approved under
subsection (c)(2)--
``(A) the covered entity shall not be liable for
any punitive damages intended to punish or deter,
exemplary damages, or other damages not intended to
compensate a plaintiff for actual losses; and
``(B) noneconomic damages may be awarded against a
defendant only in an amount directly proportional to
the percentage of responsibility of such defendant for
the harm to the plaintiff, and no plaintiff may recover
noneconomic damages unless the plaintiff suffered
physical harm.
``(4) Civil actions arising out of implementation of
emergency measures or actions.--A covered civil action may not
be maintained against a covered entity that is the direct
consequence of actions taken in good faith for the purpose of
implementing specific emergency measures or actions for which
compliance is required under subsection (c)(1), if--
``(A) the President has issued a declaration of
national cyber emergency under subsection (a)(1) and
the action was taken during the period covered by that
declaration;
``(B) the Director has issued emergency measures or
actions for which compliance is required under
subsection (c)(1) or that the Director has approved
under subsection (c)(2);
``(C) the covered entity is in compliance with the
emergency measures required under subsection (c)(1) or
that the Director has approved under subsection (c)(2);
and
``(D)(i) the Director certifies to the court in
which the covered civil action is pending that the
actions taken by the entity during the period covered
by the declaration under subsection (a)(1) were
consistent with the implementation of emergency
measures or actions for which compliance is required
under subsection (c)(1) or that the Director has
approved under subsection (c)(2); or
``(ii) notwithstanding the lack of a certification,
the entity demonstrates by a preponderance of the
evidence that the actions taken during the period
covered by the declaration under subsection (a)(1) are
consistent with the implementation of emergency
measures or actions for which compliance is required
under subsection (c)(1) or that the Director has
approved under subsection (c)(2).
``(5) Certain actions not subject to limitations on
liability.--
``(A) Additional or intervening acts.--Paragraphs
(2) through (4) shall not apply to a civil action
relating to any additional or intervening acts or
omissions by any covered entity.
``(B) Serious or substantial damage.--Paragraph (4)
shall not apply to any civil action brought by an
individual--
``(i) whose recovery is otherwise precluded
by application of paragraph (4); and
``(ii) who has suffered--
``(I) serious physical injury or
death; or
``(II) substantial damage or
destruction to his primary residence.
``(C) Rule of construction.--Recovery available
under subparagraph (B) shall be limited to those
damages available under subparagraphs (A) and (B) of
paragraph (3), except that neither reasonable and
necessary medical benefits nor lifetime total benefits
for lost employment income due to permanent and total
disability shall be limited herein.
``(D) Indemnification.--In any civil action brought
under subparagraph (B), the United States shall defend
and indemnify any covered entity. Any covered entity
defended and indemnified under this subparagraph shall
fully cooperate with the United States in the defense
by the United States in any proceeding and shall be
reimbursed the reasonable costs associated with such
cooperation.
``(f) Joint Resolution To Extend Cyber Emergency.--
``(1) In general.--For purposes of subsection (b)(2)(B), a
joint resolution described in this paragraph means only a joint
resolution--
``(A) the title of which is as follows: `Joint
resolution approving the extension of a cyber
emergency'; and
``(B) the matter after the resolving clause of
which is as follows: `That Congress approves the
continuation of the emergency measure or action issued
by the Director of the National Center for
Cybersecurity and Communications on ____________ for
not longer than an additional 120-day period.', the
blank space being filled in with the date on which the
emergency measure or action to which the joint
resolution applies was issued.
``(2) Procedure.--
``(A) No referral.--A joint resolution described in
paragraph (1) shall not be referred to a committee in
either House of Congress and shall immediately be
placed on the calendar.
``(B) Consideration.--
``(i) Debate limitation.--A motion to
proceed to a joint resolution described in
paragraph (1) is highly privileged in the House
of Representatives and is privileged in the
Senate and is not debatable. The motion is not
subject to a motion to postpone. In the Senate,
consideration of the joint resolution, and on
all debatable motions and appeals in connection
therewith, shall be limited to not more than 10
hours, which shall be divided equally between
the majority leader and the minority leader, or
their designees. A motion further to limit
debate is in order and not debatable. All
points of order against the joint resolution
(and against consideration of the joint
resolution) are waived. An amendment to, or a
motion to postpone, or a motion to proceed to
the consideration of other business, or a
motion to recommit the joint resolution is not
in order.
``(ii) Passage.--In the Senate, immediately
following the conclusion of the debate on a
joint resolution described in paragraph (1),
and a single quorum call at the conclusion of
the debate if requested in accordance with the
rules of the Senate, the vote on passage of the
joint resolution shall occur.
``(iii) Appeals.--Appeals from the
decisions of the Chair relating to the
application of the rules of the Senate to the
procedure relating to a joint resolution
described in paragraph (1) shall be decided
without debate.
``(C) Other house acts first.--If, before the
passage by 1 House of a joint resolution of that House
described in paragraph (1), that House receives from
the other House a joint resolution described in
paragraph (1)--
``(i) the procedure in that House shall be
the same as if no joint resolution had been
received from the other House; and
``(ii) the vote on final passage shall be
on the joint resolution of the other House.
``(D) Majority required for adoption.--A joint
resolution considered under this subsection shall
require an affirmative vote of a majority of the
Members, duly chosen and sworn, for adoption.
``(3) Rulemaking.--This subsection is enacted by Congress--
``(A) as an exercise of the rulemaking power of the
Senate and the House of Representatives, respectively,
and is deemed to be part of the rules of each House,
respectively but applicable only with respect to the
procedure to be followed in that House in the case of a
joint resolution described in paragraph (1), and it
supersedes other rules only to the extent that it is
inconsistent with such rules; and
``(B) with full recognition of the constitutional
right of either House to change the rules (so far as
they relate to the procedure of that House) at any
time, in the same manner, and to the same extent as in
the case of any other rule of that House.
``(g) Rule of Construction.--Nothing in this section shall be
construed to--
``(1) alter or supersede the authority of the Secretary of
Defense, the Attorney General, or the Director of National
Intelligence in responding to a national cyber emergency; or
``(2) limit the authority of the Director under section
248, after a declaration issued under this section expires.
``SEC. 250. ENFORCEMENT.
``(a) Annual Certification of Compliance.--
``(1) In general.--Not later than 6 months after the date
on which the Director promulgates regulations under section
248(b), and every year thereafter, each owner or operator of
covered critical infrastructure shall certify in writing to the
Director whether the owner or operator has developed and
implemented, or is implementing, security measures approved by
the Director under section 248 and any applicable emergency
measures or actions required under section 249 for any cyber
risks and national cyber emergencies.
``(2) Failure to comply.--If an owner or operator of
covered critical infrastructure fails to submit a certification
in accordance with paragraph (1), or if the certification
indicates the owner or operator is not in compliance, the
Director may issue an order requiring the owner or operator to
submit proposed security measures under section 248 or comply
with specific emergency measures or actions under section 249.
``(b) Risk-Based Evaluations.--
``(1) In general.--Consistent with the factors described in
paragraph (3), the Director may perform an evaluation of the
information infrastructure of any specific system or asset
constituting covered critical infrastructure to assess the
validity of a certification of compliance submitted under
subsection (a)(1).
``(2) Document review and inspection.--An evaluation
performed under paragraph (1) may include--
``(A) a review of all documentation submitted to
justify an annual certification of compliance submitted
under subsection (a)(1); and
``(B) a physical or electronic inspection of
relevant information infrastructure to which the
security measures required under section 248 or the
emergency measures or actions required under section
249 apply.
``(3) Evaluation selection factors.--In determining whether
sufficient risk exists to justify an evaluation under this
subsection, the Director shall consider--
``(A) the specific cyber risks affecting or
potentially affecting the information infrastructure of
the specific system or asset constituting covered
critical infrastructure;
``(B) any reliable intelligence or other
information indicating a cyber risk or credible
national cyber emergency to the information
infrastructure of the specific system or asset
constituting covered critical infrastructure;
``(C) actual knowledge or reasonable suspicion that
the certification of compliance submitted by a specific
owner or operator of covered critical infrastructure is
false or otherwise inaccurate;
``(D) a request by a specific owner or operator of
covered critical infrastructure for such an evaluation;
and
``(E) such other risk-based factors as identified
by the Director.
``(4) Sector-specific agencies.--To carry out the risk-
based evaluation authorized under this subsection, the Director
may use the resources of a sector-specific agency with
responsibility for the covered critical infrastructure or any
Federal agency that is not a sector-specific agency with
responsibilities for regulating the covered critical
infrastructure with the concurrence of the head of the agency.
``(5) Information protection.--Information provided to the
Director during the course of an evaluation under this
subsection shall be protected from disclosure in accordance
with section 251.
``(c) Civil Penalties.--
``(1) In general.--Any person who violates section 248 or
249 shall be liable for a civil penalty.
``(2) No private right of action.--Nothing in this section
confers upon any person, except the Director, a right of action
against an owner or operator of covered critical infrastructure
to enforce any provision of this subtitle.
``(d) Limitation on Civil Liability.--
``(1) Definition.--In this subsection--
``(A) the term `covered civil action'--
``(i) means a civil action filed in a
Federal or State court against a covered
entity; and
``(ii) does not include an action brought
under section 2520 or 2707 of title 18, United
States Code, or section 110 or 308 of the
Foreign Intelligence Surveillance Act of 1978
(50 U.S.C. 1810 and 1828);
``(B) the term `covered entity' means any entity
that owns or operates covered critical infrastructure,
including any owner, operator, officer, employee,
agent, landlord, custodian, provider of information
technology, or other person acting for or on behalf of
that entity with respect to the covered critical
infrastructure; and
``(C) the term `noneconomic damages' means damages
for losses for physical and emotional pain, suffering,
inconvenience, physical impairment, mental anguish,
disfigurement, loss of enjoyment of life, loss of
society and companionship, loss of consortium, hedonic
damages, injury to reputation, and any other
nonpecuniary losses.
``(2) Limitations on civil liability.--If a covered entity
experiences an incident related to a cyber risk identified
under section 248(a), in any covered civil action for damages
directly caused by the incident related to that cyber risk--
``(A) the covered entity shall not be liable for
any punitive damages intended to punish or deter,
exemplary damages, or other damages not intended to
compensate a plaintiff for actual losses; and
``(B) noneconomic damages may be awarded against a
defendant only in an amount directly proportional to
the percentage of responsibility of such defendant for
the harm to the plaintiff, and no plaintiff may recover
noneconomic damages unless the plaintiff suffered
physical harm.
``(3) Application.--This subsection shall apply to claims
made by any individual or nongovernmental entity, including
claims made by a State or local government agency on behalf of
such individuals or nongovernmental entities, against a covered
entity--
``(A) whose proposed security measures, or
combination thereof, satisfy the security performance
requirements established under subsection 248(b) and
have been approved by the Director;
``(B) that has been evaluated under subsection (b)
and has been found by the Director to have implemented
the proposed security measures approved under section
248; and
``(C) that is in actual compliance with the
approved security measures at the time of the incident
related to that cyber risk.
``(4) Limitation.--This subsection shall only apply to harm
directly caused by the incident related to the cyber risk and
shall not apply to damages caused by any additional or
intervening acts or omissions by the covered entity.
``(5) Rule of construction.--Except as provided under
paragraph (3), nothing in this subsection shall be construed to
abrogate or limit any right, remedy, or authority that the
Federal Government or any State or local government, or any
entity or agency thereof, may possess under any law, or that
any individual is authorized by law to bring on behalf of the
government.
``(e) Report to Congress.--The Director shall submit an annual
report to the appropriate committees of Congress on the implementation
and enforcement of the risk-based security performance requirements of
covered critical infrastructure under subsection 248(b) and this
section including--
``(1) the level of compliance of covered critical
infrastructure with the risk-based security performance
requirements issued under section 248(b);
``(2) how frequently the evaluation authority under
subsection (b) was utilized and a summary of the aggregate
results of the evaluations; and
``(3) any civil penalties imposed on covered critical
infrastructure.
``SEC. 251. PROTECTION OF INFORMATION.
``(a) Definition.--In this section, the term `covered
information'--
``(1) means--
``(A) any information required to be submitted
under sections 246, 248, and 249 to the Center by the
owners and operators of covered critical
infrastructure; and
``(B) any information submitted to the Center under
the processes and procedures established under section
246 by State and local governments, private entities,
and international partners of the United States
regarding threats, vulnerabilities, and incidents
affecting--
``(i) the Federal information
infrastructure;
``(ii) information infrastructure that is
owned, operated, controlled, or licensed for
use by, or on behalf of, the Department of
Defense, a military department, or another
element of the intelligence community; or
``(iii) the national information
infrastructure; and
``(2) shall not include any information described under
paragraph (1), if that information is submitted to--
``(A) conceal violations of law, inefficiency, or
administrative error;
``(B) prevent embarrassment to a person,
organization, or agency; or
``(C) interfere with competition in the private
sector.
``(b) Voluntarily Shared Critical Infrastructure Information.--
Covered information submitted in accordance with this section shall be
treated as voluntarily shared critical infrastructure information under
section 214, except that the requirement of section 214 that the
information be voluntarily submitted, including the requirement for an
express statement, shall not be required for submissions of covered
information.
``(c) Guidelines.--
``(1) In general.--Subject to paragraph (2), the Director
shall develop and issue guidelines, in consultation with the
Secretary, the Attorney General, and the National Cybersecurity
Advisory Council, as necessary to implement this section.
``(2) Requirements.--The guidelines developed under this
section shall--
``(A) consistent with subsections (e)(2)(D) and (g)
of section 214 and the processes, procedures, and
guidelines developed under section 246(b), include
provisions for information sharing among Federal,
State, and local and officials, private entities, or
international partners of the United States necessary
to carry out the authorities and responsibilities of
the Director;
``(B) be consistent, to the maximum extent
possible, with policy guidance and implementation
standards developed by the National Archives and
Records Administration for controlled unclassified
information, including with respect to marking,
safeguarding, dissemination and dispute resolution; and
``(C) describe, with as much detail as possible,
the categories and type of information entities should
voluntarily submit under subsections (b) and (c)(1)(B)
of section 246.
``(d) Process for Reporting Security Problems.--
``(1) Establishment of process.--The Director shall
establish through regulation, and provide information to the
public regarding, a process by which any person may submit a
report to the Secretary regarding cybersecurity threats,
vulnerabilities, and incidents affecting--
``(A) the Federal information infrastructure;
``(B) information infrastructure that is owned,
operated, controlled, or licensed for use by, or on
behalf of, the Department of Defense, a military
department, or another element of the intelligence
community; or
``(C) national information infrastructure.
``(2) Acknowledgment of receipt.--If a report submitted
under paragraph (1) identifies the person making the report,
the Director shall respond promptly to such person and
acknowledge receipt of the report.
``(3) Steps to address problem.--The Director shall review
and consider the information provided in any report submitted
under paragraph (1) and, at the sole, unreviewable discretion
of the Director, determine what, if any, steps are necessary or
appropriate to address any problems or deficiencies identified.
``(4) Disclosure of identity.--
``(A) In general.--Except as provided in
subparagraph (B), or with the written consent of the
person, the Secretary may not disclose the identity of
a person who has provided information described in
paragraph (1).
``(B) Referral to the attorney general.--The
Secretary shall disclose to the Attorney General the
identity of a person described under subparagraph (A)
if the matter is referred to the Attorney General for
enforcement. The Director shall provide reasonable
advance notice to the affected person if disclosure of
that person's identity is to occur, unless such notice
would risk compromising a criminal or civil enforcement
investigation or proceeding.
``(e) Rules of Construction.--Nothing in this section shall be
construed to--
``(1) limit or otherwise affect the right, ability, duty,
or obligation of any entity to use or disclose any information
of that entity, including in the conduct of any judicial or
other proceeding;
``(2) prevent the classification of information submitted
under this section if that information meets the standards for
classification under Executive Order 12958 or any successor of
that order or affect measures and controls relating to the
protection of classified information as prescribed by Federal
statute or under Executive Order 12958, or any successor of
that order;
``(3) limit the right of an individual to make any
disclosure--
``(A) protected or authorized under section
2302(b)(8) or 7211 of title 5, United States Code;
``(B) to an appropriate official of information
that the individual reasonably believes evidences a
violation of any law, rule, or regulation, gross
mismanagement, or substantial and specific danger to
public health, safety, or security, and that is
protected under any Federal or State law (other than
those referenced in subparagraph (A)) that shields the
disclosing individual against retaliation or
discrimination for having made the disclosure if such
disclosure is not specifically prohibited by law and if
such information is not specifically required by
Executive order to be kept secret in the interest of
national defense or the conduct of foreign affairs; or
``(C) to the Special Counsel, the inspector general
of an agency, or any other employee designated by the
head of an agency to receive similar disclosures;
``(4) prevent the Director from using information required
to be submitted under sections 246, 248, or 249 for enforcement
of this subtitle, including enforcement proceedings subject to
appropriate safeguards;
``(5) authorize information to be withheld from Congress,
the Government Accountability Office, or Inspector General of
the Department;
``(6) affect protections afforded to trade secrets under
any other provision of law; or
``(7) create a private right of action for enforcement of
any provision of this section.
``(f) Audit.--
``(1) In general.--Not later than 1 year after the date of
enactment of the Cybersecurity and Internet Freedom Act of
2011, the Inspector General of the Department shall conduct an
audit of the management of information submitted under
subsection (b) and report the findings to appropriate
committees of Congress.
``(2) Contents.--The audit under paragraph (1) shall
include assessments of--
``(A) whether the information is adequately
safeguarded against inappropriate disclosure;
``(B) the processes for marking and disseminating
the information and resolving any disputes;
``(C) how the information is used for the purposes
of this section, and whether that use is effective;
``(D) whether information sharing has been
effective to fulfill the purposes of this section;
``(E) whether the kinds of information submitted
have been appropriate and useful, or overbroad or
overnarrow;
``(F) whether the information protections allow for
adequate accountability and transparency of the
regulatory, enforcement, and other aspects of
implementing this subtitle; and
``(G) any other factors at the discretion of the
Inspector General.
``SEC. 252. SECTOR-SPECIFIC AGENCIES.
``(a) In General.--The head of each sector-specific agency and the
head of any Federal agency that is not a sector-specific agency with
responsibilities for regulating covered critical infrastructure shall
coordinate with the Director on any activities of the sector-specific
agency or Federal agency that relate to the efforts of the agency
regarding security or resiliency of the national information
infrastructure, including critical infrastructure and covered critical
infrastructure, within or under the supervision of the agency.
``(b) Duplicative Reporting Requirements.--The head of each sector-
specific agency and the head of any Federal agency that is not a
sector-specific agency with responsibilities for regulating covered
critical infrastructure shall coordinate with the Director to eliminate
and avoid the creation of duplicate reporting or compliance
requirements relating to the security or resiliency of the national
information infrastructure, including critical infrastructure and
covered critical infrastructure, within or under the supervision of the
agency.
``(c) Requirements.--
``(1) In general.--To the extent that the head of each
sector-specific agency and the head of any Federal agency that
is not a sector-specific agency with responsibilities for
regulating covered critical infrastructure has the authority to
establish regulations, rules, or requirements or other required
actions that are applicable to the security of national
information infrastructure, including critical infrastructure
and covered critical infrastructure, the head of that agency
shall--
``(A) notify the Director in a timely fashion of
the intent to establish the regulations, rules,
requirements, or other required actions;
``(B) coordinate with the Director to ensure that
the regulations, rules, requirements, or other required
actions are consistent with, and do not conflict or
impede, the activities of the Director under sections
247, 248, and 249; and
``(C) in coordination with the Director, ensure
that the regulations, rules, requirements, or other
required actions are implemented, as they relate to
covered critical infrastructure, in accordance with
subsection (a).
``(2) Coordination.--Coordination under paragraph (1)(B)
shall include the active participation of the Director in the
process for developing regulations, rules, requirements, or
other required actions.
``(3) Rule of construction.--Nothing in this section shall
be construed to provide additional authority for any sector-
specific agency or any Federal agency that is not a sector-
specific agency with responsibilities for regulating national
information infrastructure, including critical infrastructure
or covered critical infrastructure, to establish standards or
other measures that are applicable to the security of national
information infrastructure not otherwise authorized by law.
``SEC. 253. STRATEGY FOR FEDERAL CYBERSECURITY SUPPLY CHAIN MANAGEMENT.
``(a) In General.--The Secretary, in consultation with the Director
of Cyberspace Policy, the Director, the Secretary of Defense, the
Secretary of Commerce, the Secretary of State, the Director of National
Intelligence, the Administrator of General Services, the Administrator
for Federal Procurement Policy, the other members of the Chief
Information Officers Council established under section 3603 of title
44, United States Code, the Chief Acquisition Officers Council
established under section 1311 of title 41, United States Code, the
Chief Financial Officers Council established under section 302 of the
Chief Financial Officers Act of 1990 (31 U.S.C. 901 note), and the
private sector, shall develop, periodically update, and implement a
supply chain risk management strategy designed to ensure, based on
mission criticality and cost effectiveness, the security of the Federal
information infrastructure, including protection against unauthorized
access to, alteration of information in, disruption of operations of,
interruption of communications or services of, and insertion of
malicious software, engineering vulnerabilities, or otherwise
corrupting software, hardware, services, or products intended for use
in Federal information infrastructure.
``(b) Contents.--The supply chain risk management strategy
developed under subsection (a) shall--
``(1) address risks in the supply chain during the entire
life cycle of any part of the Federal information
infrastructure;
``(2) place particular emphasis on--
``(A) securing critical information systems and the
Federal information infrastructure;
``(B) developing processes that--
``(i) incorporate all-source intelligence
analysis into assessments of the supply chain
for the Federal information infrastructure;
``(ii) assess risks from potential
suppliers providing critical components or
services of the Federal information
infrastructure;
``(iii) assess risks from individual
components, including all subcomponents, or
software used in or affecting the Federal
information infrastructure;
``(iv) manage the quality, configuration,
and security of software, hardware, and systems
of the Federal information infrastructure
throughout the life cycle of the software,
hardware, or system, including components or
subcomponents from secondary and tertiary
sources;
``(v) detect the occurrence, reduce the
likelihood of occurrence, and mitigate or
remediate the risks associated with products
containing counterfeit components or malicious
functions;
``(vi) enhance developmental and
operational test and evaluation capabilities,
including software vulnerability detection
methods and automated methods and tools that
shall be integrated into acquisition policy
practices by Federal agencies and, where
appropriate, make the capabilities available
for use by the private sector; and
``(vii) protect the intellectual property
and trade secrets of suppliers of information
and communications technology products and
services;
``(C) the use of internationally recognized
standards and standards developed by the private sector
and developing a process, with the National Institute
for Standards and Technology, to make recommendations
for improvements of the standards;
``(D) identifying acquisition practices of Federal
agencies that increase risks in the supply chain and
developing a process to provide recommendations for
revisions to those processes; and
``(E) sharing with the private sector, to the
fullest extent possible, the threats identified in the
supply chain and working with the private sector to
develop responses to those threats as identified; and
``(3) to the maximum extent practicable, promote the
ability of Federal agencies to procure authentic commercial off
the shelf information and communications technology products
and services from a diverse pool of suppliers.
``(c) Implementation.--The Federal Acquisition Regulatory Council
established under section 1302(a) of title 41, United States Code,
shall--
``(1) amend the Federal Acquisition Regulation maintained
under section 1303(a)(1) of title 41, United States Code, to--
``(A) incorporate, where relevant, the supply chain
risk management strategy developed under subsection (a)
to improve security throughout the acquisition process;
and
``(B) direct that all software and hardware
purchased by the Federal Government shall comply with
standards developed or be interoperable with automated
tools approved by the National Institute of Standards
and Technology, to continually enhance security; and
``(2) develop a clause or set of clauses for inclusion in
solicitations, contracts, and task and delivery orders that
sets forth the responsibility of the contractor under the
Federal Acquisition Regulation provisions implemented under
this subsection.
``(d) Preferences for Acquisition of Commercial Items.--The
strategy developed under this section, and any actions taken under
subsection (c), shall be consistent with the preferences for the
acquisition of commercial items under section 2377 of title 10, United
States Code, and section 3307 of title 41, United States Code.''.
TITLE III--FEDERAL INFORMATION SECURITY MANAGEMENT
SEC. 301. COORDINATION OF FEDERAL INFORMATION POLICY.
(a) Findings.--Congress finds that--
(1) since 2002 the Federal Government has experienced
multiple high-profile incidents that resulted in the theft of
sensitive information amounting to more than the entire print
collection contained in the Library of Congress, including
personally identifiable information, advanced scientific
research, and prenegotiated United States diplomatic positions;
and
(2) chapter 35 of title 44, United States Code, must be
amended to increase the coordination of Federal agency
activities and to enhance situational awareness throughout the
Federal Government using more effective enterprise-wide
automated monitoring, detection, and response capabilities.
(b) In General.--Chapter 35 of title 44, United States Code, is
amended by striking subchapters II and III and inserting the following:
``SUBCHAPTER II--INFORMATION SECURITY
``Sec. 3550. Purposes
``The purposes of this subchapter are to--
``(1) provide a comprehensive framework for ensuring the
effectiveness of information security controls over information
resources that support the Federal information infrastructure
and the operations and assets of agencies;
``(2) recognize the highly networked nature of the current
Federal information infrastructure and provide effective
Government-wide management and oversight of the related
information security risks, including coordination of
information security efforts throughout the civilian, national
security, and law enforcement communities;
``(3) provide for development and maintenance of
prioritized and risk-based security controls required to
protect Federal information infrastructure and information
systems; and
``(4) provide a mechanism for improved oversight of Federal
agency information security programs.
``(5) acknowledge that commercially developed information
security products offer advanced, dynamic, robust, and
effective information security solutions, reflecting market
solutions for the protection of critical information
infrastructures important to the national defense and economic
security of the Nation that are designed, built, and operated
by the private sector; and
``(6) recognize that the selection of specific technical
hardware and software information security solutions should be
left to individual agencies from among commercially developed
products.
``Sec. 3551. Definitions
``(a) In General.--Except as provided under subsection (b), the
definitions under section 3502 shall apply to this subchapter.
``(b) Additional Definitions.--In this subchapter:
``(1) The term `agency information infrastructure'--
``(A) means information infrastructure that is
owned, operated, controlled, or licensed for use by, or
on behalf of, an agency, including information systems
used or operated by another entity on behalf of the
agency; and
``(B) does not include national security systems.
``(2) The term `automated and continuous monitoring' means
monitoring at a frequency and sufficiency such that the data
exchange requires little to no human involvement and is not
interrupted.
``(3) The term `incident' means an occurrence that--
``(A) actually or imminently jeopardizes--
``(i) the information security of
information infrastructure; or
``(ii) the information that information
infrastructure processes, stores, receives, or
transmits; or
``(B) constitutes a violation of security policies,
security procedures, or acceptable use policies
applicable to information infrastructure.
``(4) The term `information infrastructure' means the
underlying framework that information systems and assets rely
on to process, transmit, receive, or store information
electronically, including programmable electronic devices and
communications networks and any associated hardware, software,
or data.
``(5) The term `information security' means protecting
information and information systems from disruption or
unauthorized access, use, disclosure, modification, or
destruction in order to provide--
``(A) integrity, by guarding against improper
information modification or destruction, including by
ensuring information nonrepudiation and authenticity;
``(B) confidentiality, by preserving authorized
restrictions on access and disclosure, including means
for protecting personal privacy and proprietary
information; and
``(C) availability, by ensuring timely and reliable
access to and use of information.
``(6) The term `information technology' has the meaning
given that term in section 11101 of title 40.
``(7) The term `management controls' means safeguards or
countermeasures for an information system that focus on the
management of risk and the management of information system
security.
``(8)(A) The term `national security system' means any
information system (including any telecommunications system)
used or operated by an agency or by a contractor of an agency,
or other organization on behalf of an agency--
``(i) the function, operation, or use of which--
``(I) involves intelligence activities;
``(II) involves cryptologic activities
related to national security;
``(III) involves command and control of
military forces;
``(IV) involves equipment that is an
integral part of a weapon or weapons system; or
``(V) subject to subparagraph (B), is
critical to the direct fulfillment of military
or intelligence missions; or
``(ii) that is protected at all times by procedures
established for information that have been specifically
authorized under criteria established by an Executive
order or an Act of Congress to be kept classified in
the interest of national defense or foreign policy.
``(B) Subparagraph (A)(i)(V) does not include a system that
is to be used for routine administrative and business
applications (including payroll, finance, logistics, and
personnel management applications).
``(9) The term `operational controls' means the safeguards
and countermeasures for an information system that are
primarily implemented and executed by individuals, not systems.
``(10) The term `risk' means the potential for an unwanted
outcome resulting from an incident, as determined by the
likelihood of the occurrence of the incident and the associated
consequences, including potential for an adverse outcome
assessed as a function of threats, vulnerabilities, and
consequences associated with an incident.
``(11) The term `risk-based security' means security
commensurate with the risk and magnitude of harm resulting from
the loss, misuse, or unauthorized access to, or modification,
of information, including assuring that systems and
applications used by the agency operate effectively and provide
appropriate confidentiality, integrity, and availability.
``(12) The term `security controls' means the management,
operational, and technical controls prescribed for an
information system to protect the information security of the
system.
``(13) The term `technical controls' means the safeguards
or countermeasures for an information system that are primarily
implemented and executed by the information system through
mechanism contained in the hardware, software, or firmware
components of the system.
``Sec. 3552. Authority and functions of the National Center for
Cybersecurity and Communications
``(a) In General.--The Director of the National Center for
Cybersecurity and Communications shall--
``(1) develop, oversee the implementation of, and enforce
policies, principles, and guidelines on information security,
including through ensuring timely agency adoption of and
compliance with standards developed under section 20 of the
National Institute of Standards and Technology Act (15 U.S.C.
278g-3) and subtitle E of title II of the Homeland Security Act
of 2002;
``(2) provide to agencies security controls that agencies
shall be required to be implemented to mitigate and remediate
vulnerabilities, attacks, and exploitations discovered as a
result of activities required under this subchapter or subtitle
E of title II of the Homeland Security Act of 2002;
``(3) to the extent practicable--
``(A) prioritize the policies, principles,
standards, and guidelines promulgated under section 20
of the National Institute of Standards and Technology
Act (15 U.S.C. 278g-3), paragraph (1), and subtitle E
of title II of the Homeland Security Act of 2002, based
upon the risk of an incident; and
``(B) develop guidance that requires agencies to
monitor, including automated and continuous monitoring
of, the effective implementation of policies,
principles, standards, and guidelines developed under
section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3), paragraph (1), and
subtitle E of title II of the Homeland Security Act of
2002;
``(C) ensure the effective operation of technical
capabilities within the National Center for
Cybersecurity and Communications to enable automated
and continuous monitoring of any information collected
as a result of the guidance developed under
subparagraph (B) and use the information to enhance the
risk-based security of the Federal information
infrastructure; and
``(D) ensure the effective operation of a secure
system that satisfies information reporting
requirements under sections 3553(c) and 3556(c);
``(4) require agencies, consistent with the standards
developed under section 20 of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3) or paragraph
(1) and the requirements of this subchapter, to identify and
provide information security protections commensurate with the
risk resulting from the disruption or unauthorized access, use,
disclosure, modification, or destruction of--
``(A) information collected or maintained by or on
behalf of an agency; or
``(B) information systems used or operated by an
agency or by a contractor of an agency or other
organization on behalf of an agency;
``(5) oversee agency compliance with the requirements of
this subchapter, including coordinating with the Office of
Management and Budget to use any authorized action under
section 11303 of title 40 to enforce accountability for
compliance with such requirements;
``(6) review, at least annually, and approve or disapprove,
agency information security programs required under section
3553(b); and
``(7) coordinate information security policies and
procedures with the Administrator for Electronic Government and
the Administrator for the Office of Information and Regulatory
Affairs with related information resources management policies
and procedures.
``(b) National Security Systems.--The authorities of the Director
of the National Center for Cybersecurity and Communications under this
section shall not apply to national security systems.
``Sec. 3553. Agency responsibilities
``(a) In General.--The head of each agency shall--
``(1) be responsible for--
``(A) providing information security protections
commensurate with the risk and magnitude of the harm
resulting from unauthorized access, use, disclosure,
disruption, modification, or destruction of--
``(i) information collected or maintained
by or on behalf of the agency; and
``(ii) agency information infrastructure;
``(B) complying with the requirements of this
subchapter and related policies, procedures, standards,
and guidelines, including--
``(i) information security requirements,
including security controls, developed by the
Director of the National Center for
Cybersecurity and Communications under section
3552, subtitle E of title II of the Homeland
Security Act of 2002, or any other provision of
law;
``(ii) information security policies,
principles, standards, and guidelines
promulgated under section 20 of the National
Institute of Standards and Technology Act (15
U.S.C. 278g-3) and section 3552(a)(1);
``(iii) information security standards and
guidelines for national security systems issued
in accordance with law and as directed by the
President; and
``(iv) ensuring the standards implemented
for information systems and national security
systems of the agency are complementary and
uniform, to the extent practicable;
``(C) ensuring that information security management
processes are integrated with agency strategic and
operational planning and budget processes, including
policies, procedures, and practices described in
subsection (c)(1)(C);
``(D) as appropriate, maintaining secure facilities
that have the capability of accessing, sending,
receiving, and storing classified information;
``(E) maintaining a sufficient number of personnel
with security clearances, at the appropriate levels, to
access, send, receive and analyze classified
information to carry out the responsibilities of this
subchapter; and
``(F) ensuring that information security
performance indicators and measures are included in the
annual performance evaluations of all managers, senior
managers, senior executive service personnel, and
political appointees;
``(2) ensure that senior agency officials provide
information security for the information and information
systems that support the operations and assets under the
control of those officials, including through--
``(A) assessing the risk and magnitude of the harm
that could result from the disruption or unauthorized
access, use, disclosure, modification, or destruction
of such information or information systems;
``(B) determining the levels of information
security appropriate to protect such information and
information systems in accordance with policies,
principles, standards, and guidelines promulgated under
section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g-3), section 3552(a)(1),
and subtitle E of title II of the Homeland Security Act
of 2002, for information security categorizations and
related requirements;
``(C) implementing policies and procedures to cost
effectively reduce risks to an acceptable level;
``(D) periodically testing and evaluating
information security controls and techniques to ensure
that such controls and techniques are operating
effectively; and
``(E) withholding all bonus and cash awards to
senior agency officials accountable for the operation
of such agency information infrastructure that are
recognized by the Chief Information Security Officer as
impairing the risk-based security information,
information system, or agency information
infrastructure;
``(3) delegate to a senior agency officer designated as the
Chief Information Security Officer the authority and budget
necessary to ensure and enforce compliance with the
requirements imposed on the agency under this subchapter,
subtitle E of title II of the Homeland Security Act of 2002, or
any other provision of law, including--
``(A) overseeing the establishment, maintenance,
and management of a security operations center that has
technical capabilities that can, through automated and
continuous monitoring--
``(i) detect, report, respond to, contain,
remediate, and mitigate incidents that impair
risk-based security of the information,
information systems, and agency information
infrastructure, in accordance with policy
provided by the Director of the National Center
for Cybersecurity and Communications;
``(ii) monitor and, on a risk-based basis,
mitigate and remediate the vulnerabilities of
every information system within the agency
information infrastructure;
``(iii) continually evaluate risks posed to
information collected or maintained by or on
behalf of the agency and information systems
and hold senior agency officials accountable
for ensuring the risk-based security of such
information and information systems;
``(iv) collaborate with the Director of the
National Center for Cybersecurity and
Communications and appropriate public and
private sector security operations centers to
address incidents that impact the security of
information and information systems that extend
beyond the control of the agency; and
``(v) report any incident described under
clauses (i) and (ii), as directed by the policy
of the Director of the National Center for
Cybersecurity and Communications and the
Inspector General of the agency;
``(B) collaborating with the Administrator for E-
Government and the Chief Information Officer to
establish, maintain, and update an enterprise network,
system, storage, and security architecture, that can be
accessed by the National Cybersecurity Communications
Center and includes--
``(i) information on how security controls
are implemented throughout the agency
information infrastructure; and
``(ii) information on how the controls
described under subparagraph (A) maintain the
appropriate level of confidentiality,
integrity, and availability of information and
information systems based on--
``(I) the policy of the Director of
the National Center for Cybersecurity
and Communications; and
``(II) the standards or guidance
developed by the National Institute of
Standards and Technology;
``(C) developing, maintaining, and overseeing an
agency-wide information security program as required by
subsection (b);
``(D) developing, maintaining, and overseeing
information security policies, procedures, and control
techniques to address all applicable requirements,
including those issued under section 3552;
``(E) training, consistent with the requirements of
section 406 of the Cybersecurity and Internet Freedom
Act of 2011, and overseeing personnel with significant
responsibilities for information security with respect
to such responsibilities; and
``(F) assisting senior agency officers concerning
their responsibilities under paragraph (2);
``(4) ensure that the Chief Information Security Officer
has a sufficient number of cleared and trained personnel with
technical skills identified by the Director of the National
Center for Cybersecurity and Communications as critical to
maintaining the risk-based security of agency information
infrastructure as required by the subchapter and other
applicable laws;
``(5) ensure that the agency Chief Information Security
Officer, in coordination with appropriate senior agency
officials, reports not less than annually to the head of the
agency on the effectiveness of the agency information security
program, including progress of remedial actions;
``(6) ensure that the Chief Information Security Officer--
``(A) possesses necessary qualifications, including
education, professional certifications, training,
experience, and the security clearance required to
administer the functions described under this
subchapter; and
``(B) has information security duties as the
primary duty of that officer; and
``(7) ensure that components of that agency establish and
maintain an automated reporting mechanism that allows the Chief
Information Security Officer with responsibility for the entire
agency, and all components thereof, to implement, monitor, and
hold senior agency officers accountable for the implementation
of appropriate security policies, procedures, and controls of
agency components.
``(b) Agency-Wide Information Security Program.--Each agency shall
develop, document, and implement an agency-wide information security
program, approved by the Director of the National Center for
Cybersecurity and Communications under section 3552(a)(6) and
consistent with components across and within agencies, to provide
information security for the information and information systems that
support the operations and assets of the agency, including those
provided or managed by another agency, contractor, or other source,
that includes--
``(1) frequent assessments, at least twice each month--
``(A) of the risk and magnitude of the harm that
could result from the disruption or unauthorized
access, use, disclosure, modification, or destruction
of information and information systems that support the
operations and assets of the agency; and
``(B) that assess whether information or
information systems should be removed or migrated to
more secure networks or standards and make
recommendations to the head of the agency and the
Director of the National Center for Cybersecurity and
Communications based on that assessment;
``(2) consistent with guidance developed under section
3554, vulnerability assessments and penetration tests
commensurate with the risk posed to an agency information
infrastructure;
``(3) ensure that information security vulnerabilities are
remediated or mitigated based on the risk posed to the agency;
``(4) policies and procedures that--
``(A) are informed and revised by the assessments
required under paragraphs (1) and (2);
``(B) cost effectively reduce information security
risks to an acceptable level;
``(C) ensure that information security is addressed
throughout the life cycle of each agency information
system; and
``(D) ensure compliance with--
``(i) the requirements of this subchapter;
``(ii) policies and procedures prescribed
by the Director of the National Center for
Cybersecurity and Communications;
``(iii) minimally acceptable system
configuration requirements, as determined by
the Director of the National Center for
Cybersecurity and Communications; and
``(iv) any other applicable requirements,
including standards and guidelines for national
security systems issued in accordance with law
and as directed by the President;
``(5) subordinate plans for providing risk-based
information security for networks, facilities, and systems or
groups of information systems, as appropriate;
``(6) role-based security awareness training, consistent
with the requirements of section 406 of the Cybersecurity and
Internet Freedom Act of 2011, to inform personnel with access
to the agency network, including contractors and other users of
information systems that support the operations and assets of
the agency, of--
``(A) information security risks associated with
agency activities; and
``(B) agency responsibilities in complying with
agency policies and procedures designed to reduce those
risks;
``(7) periodic testing and evaluation of the effectiveness
of information security policies, procedures, and practices, to
be performed with a rigor and frequency depending on risk,
which shall include--
``(A) testing and evaluation not less than twice
each year of security controls of information collected
or maintained by or on behalf of the agency and every
information system identified in the inventory required
under section 3505(c);
``(B) the effectiveness of ongoing monitoring,
including automated and continuous monitoring,
vulnerability scanning, and intrusion detection and
prevention of incidents posed to the risk-based
security of information and information systems as
required under subsection (a)(3); and
``(C) testing relied on in--
``(i) an operational evaluation under
section 3554;
``(ii) an independent assessment under
section 3556; or
``(iii) another evaluation, to the extent
specified by the Director of the National
Center for Cybersecurity and Communications;
``(8) a process for planning, implementing, evaluating, and
documenting remedial action to address any deficiencies in the
information security policies, procedures, and practices of the
agency;
``(9) procedures for detecting, reporting, and responding
to incidents, consistent with requirements issued under section
3552, that include--
``(A) to the extent practicable, automated and
continuous monitoring of the use of information and
information systems;
``(B) requirements for mitigating risks and
remediating vulnerabilities associated with such
incidents systemically within the agency information
infrastructure before substantial damage is done; and
``(C) notifying and coordinating with the Director
of the National Center for Cybersecurity and
Communications, as required by this subchapter,
subtitle E of title II of the Homeland Security Act of
2002, and any other provision of law; and
``(10) plans and procedures to ensure continuity of
operations for information systems that support the operations
and assets of the agency.
``(c) Agency Reporting.--
``(1) In general.--Each agency shall--
``(A) ensure that information relating to the
adequacy and effectiveness of information security
policies, procedures, and practices, is available to
the entities identified under paragraph (2) through the
system developed under section 3552(a)(3), including
information relating to--
``(i) compliance with the requirements of
this subchapter;
``(ii) the effectiveness of the information
security policies, procedures, and practices of
the agency based on a determination of the
aggregate effect of identified deficiencies and
vulnerabilities;
``(iii) an identification and analysis of
any significant deficiencies identified in such
policies, procedures, and practices;
``(iv) an identification of any
vulnerability that could impair the risk-based
security of the agency information
infrastructure; and
``(v) results of any operational evaluation
conducted under section 3554 and plans of
action to address the deficiencies and
vulnerabilities identified as a result of such
operational evaluation;
``(B) follow the policy, guidance, and standards of
the Director of the National Center for Cybersecurity
and Communications, in consultation with the Federal
Information Security Taskforce, to continually update,
and ensure the electronic availability of both a
classified and unclassified version of the information
required under subparagraph (A);
``(C) ensure the information under subparagraph (A)
addresses the adequacy and effectiveness of information
security policies, procedures, and practices in plans
and reports relating to--
``(i) annual agency budgets;
``(ii) information resources management of
this subchapter;
``(iii) information technology management
and procurement under this chapter or any other
applicable provision of law;
``(iv) subtitle E of title II of the
Homeland Security Act of 2002;
``(v) program performance under sections
1105 and 1115 through 1119 of title 31, and
sections 2801 and 2805 of title 39;
``(vi) financial management under chapter 9
of title 31, and the Chief Financial Officers
Act of 1990 (31 U.S.C. 501 note; Public Law
101-576) (and the amendments made by that Act);
``(vii) financial management systems under
the Federal Financial Management Improvement
Act (31 U.S.C. 3512 note);
``(viii) internal accounting and
administrative controls under section 3512 of
title 31; and
``(ix) performance ratings, salaries, and
bonuses provided to the senior managers and
supporting personnel taking into account
program performance as it relates to complying
with this subchapter; and
``(D) report any significant deficiency in a
policy, procedure, or practice identified under
subparagraph (A) or (B)--
``(i) as a material weakness in reporting
under section 3512 of title 31; and
``(ii) if relating to financial management
systems, as an instance of a lack of
substantial compliance under the Federal
Financial Management Improvement Act (31 U.S.C.
3512 note).
``(2) Adequacy and effectiveness information.--Information
required under paragraph (1)(A) shall, to the extent possible
and in accordance with applicable law, policy, guidance, and
standards, be available on an automated and continuous basis
to--
``(A) the Director of the National Center for
Cybersecurity and Communications;
``(B) the Office of Management and Budget;
``(C) the Committee on Homeland Security and
Governmental Affairs of the Senate;
``(D) the Committee on Government Oversight and
Reform of the House of Representatives;
``(E) the Committee on Homeland Security of the
House of Representatives;
``(F) other appropriate authorization and
appropriations committees of Congress;
``(G) the Inspector General of the Federal agency;
and
``(H) the Comptroller General.
``(d) Inclusions in Performance Plans.--
``(1) In general.--In addition to the requirements of
subsection (c), each agency, in consultation with the Director
of the National Center for Cybersecurity and Communications,
shall include as part of the performance plan required under
section 1115 of title 31 a description of the time periods the
resources, including budget, staffing, and training, that are
necessary to implement the program required under subsection
(b).
``(2) Risk assessments.--The description under paragraph
(1) shall be based on the risk and vulnerability assessments
required under subsection (b) and evaluations required under
section 3554.
``(e) Notice and Comment.--Each agency shall provide the public
with timely notice and opportunities for comment on proposed
information security policies and procedures to the extent that such
policies and procedures affect communication with the public.
``(f) More Stringent Standards.--The head of an agency may employ
standards for the cost effective information security for information
systems within or under the supervision of that agency that are more
stringent than the standards the Director of the National Center for
Cybersecurity and Communications prescribes under this subchapter,
subtitle E of title II of the Homeland Security Act of 2002, or any
other provision of law, if the more stringent standards--
``(1) contain at least the applicable standards made
compulsory and binding by the Director of the National Center
for Cybersecurity and Communications; and
``(2) are otherwise consistent with policies and guidelines
issued under section 3552.
``Sec. 3554. Annual operational evaluation
``(a) Guidance.--
``(1) In general.--Not later than 1 year after the date of
enactment of the Cybersecurity and Internet Freedom Act of 2011
and each year thereafter, the Director of the National Center
for Cybersecurity and Communications shall oversee, coordinate,
and develop guidance for the effective implementation of
operational evaluations of the Federal information
infrastructure and agency information security programs and
practices to determine the effectiveness of such program and
practices.
``(2) Collaboration in development.--In developing guidance
for the operational evaluations described under this section,
the Director of the National Center for Cybersecurity and
Communications shall collaborate with the Federal Information
Security Taskforce and the Council of Inspectors General on
Integrity and Efficiency, and other agencies as necessary, to
develop and update risk-based performance indicators and
measures that assess the adequacy and effectiveness of
information security of an agency and the Federal information
infrastructure.
``(3) Contents of operational evaluation.--Each operational
evaluation under this section--
``(A) shall be prioritized based on risk; and
``(B) shall--
``(i) test the effectiveness of agency
information security policies, procedures, and
practices of the information systems of the
agency, or a representative subset of those
information systems;
``(ii) assess (based on the results of the
testing) compliance with--
``(I) the requirements of this
subchapter; and
``(II) related information security
policies, procedures, standards, and
guidelines;
``(iii) evaluate whether agencies--
``(I) effectively monitor, detect,
analyze, protect, report, and respond
to vulnerabilities and incidents;
``(II) report to and collaborate
with the appropriate public and private
security operation centers, the
Director of the National Center for
Cybersecurity and Communications, and
law enforcement agencies; and
``(III) remediate or mitigate the
risk posed by attacks and exploitations
in a timely fashion in order to prevent
future vulnerabilities and incidents;
and
``(iv) identify deficiencies of agency
information security policies, procedures, and
controls on the agency information
infrastructure.
``(b) Conduct an Operational Evaluation.--
``(1) In general.--Except as provided under paragraph (2),
and in consultation with the Chief Information Officer and
senior officials responsible for the affected systems, the
Chief Information Security Officer of each agency shall not
less than annually--
``(A) conduct an operational evaluation of the
agency information infrastructure for vulnerabilities,
attacks, and exploitations of the agency information
infrastructure;
``(B) evaluate the ability of the agency to
monitor, detect, correlate, analyze, report, and
respond to incidents; and
``(C) report to the head of the agency, the
Director of the National Center for Cybersecurity and
Communications, the Chief Information Officer, and the
Inspector General for the agency the findings of the
operational evaluation.
``(2) Satisfaction of requirements by other evaluation.--
Unless otherwise specified by the Director of the National
Center for Cybersecurity and Communications, if the Director of
the National Center for Cybersecurity and Communications
conducts an operational evaluation of the agency information
infrastructure under section 245(b)(2)(A) of the Homeland
Security Act of 2002, the Chief Information Security Officer
may deem the requirements of paragraph (1) satisfied for the
year in which the operational evaluation described under this
paragraph is conducted.
``(c) Corrective Measures Mitigation and Remediation Plans.--
``(1) In general.--In consultation with the Director of the
National Center for Cybersecurity and Communications and the
Chief Information Officer, Chief Information Security Officers
shall remediate or mitigate vulnerabilities in accordance with
this subsection.
``(2) Risk-based plan.--After an operational evaluation is
conducted under this section or under section 245(b) of the
Homeland Security Act of 2002, the agency shall submit to the
Director of the National Center for Cybersecurity and
Communications in a timely fashion a risk-based plan for
addressing recommendations and mitigating and remediating
vulnerabilities identified as a result of such operational
evaluation, including a timeline and budget for implementing
such plan.
``(3) Approval or disapproval.--Not later than 15 days
after receiving a plan submitted under paragraph (2), the
Director of the National Center for Cybersecurity and
Communications shall--
``(A) approve or disprove the agency plan; and
``(B) comment on the adequacy and effectiveness of
the plan.
``(4) Isolation from infrastructure.--
``(A) In general.--The Director of the National
Center for Cybersecurity and Communications may,
consistent with the contingency or continuity of
operation plans applicable to such agency information
infrastructure, order the isolation of any component of
the Federal information infrastructure from any other
Federal information infrastructure, if--
``(i) an agency does not implement measures
in a risk-based plan approved under this
subsection; and
``(ii) the failure to comply presents a
significant danger to the Federal information
infrastructure.
``(B) Duration.--An isolation under subparagraph
(A) shall remain in effect until--
``(i) the Director of the National Center
for Cybersecurity and Communications determines
that corrective measures have been implemented;
or
``(ii) an updated risk-based plan is
approved by the Director of the National Center
for Cybersecurity and Communications and
implemented by the agency.
``(d) Operational Guidance.--The Director of the National Center
for Cybersecurity and Communications shall--
``(1) not later than 180 days after the date of enactment
of the Cybersecurity and Internet Freedom Act of 2011, develop
operational guidance for operational evaluations as required
under this section that are risk-based and cost effective; and
``(2) periodically evaluate and ensure information is
available on an automated and continuous basis through the
system required under section 3552(a)(3)(D) to Congress on--
``(A) the adequacy and effectiveness of the
operational evaluations conducted under this section or
section 245(b) of the Homeland Security Act of 2002;
and
``(B) possible executive and legislative actions
for cost-effectively managing the risks to the Federal
information infrastructure.
``Sec. 3555. Federal Information Security Taskforce
``(a) Establishment.--There is established in the executive branch
a Federal Information Security Taskforce.
``(b) Membership.--The members of the Federal Information Security
Taskforce shall be full-time senior Government employees and shall be
as follows:
``(1) The Director of the National Center for Cybersecurity
and Communications.
``(2) The Administrator of the Office of Electronic
Government of the Office of Management and Budget.
``(3) The Chief Information Security Officer of each agency
described under section 901(b) of title 31.
``(4) The Chief Information Security Officer of the
Department of the Army, the Department of the Navy, and the
Department of the Air Force.
``(5) A representative from the Office of Cyberspace
Policy.
``(6) A representative from the Office of the Director of
National Intelligence.
``(7) A representative from the United States Cyber
Command.
``(8) A representative from the National Security Agency.
``(9) A representative from the United States Computer
Emergency Readiness Team.
``(10) A representative from the Intelligence Community
Incident Response Center.
``(11) A representative from the Committee on National
Security Systems.
``(12) A representative from the National Institute for
Standards and Technology.
``(13) A representative from the Council of Inspectors
General on Integrity and Efficiency.
``(14) A representative from State and local government.
``(15) Any other officer or employee of the United States
designated by the chairperson.
``(c) Chairperson and Vice-Chairperson.--
``(1) Chairperson.--The Director of the National Center for
Cybersecurity and Communications shall act as chairperson of
the Federal Information Security Taskforce.
``(2) Vice-chairperson.--The vice-chairperson of the
Federal Information Security Taskforce shall--
``(A) be selected by the Federal Information
Security Taskforce from among its members;
``(B) serve a 1-year term and may serve multiple
terms; and
``(C) serve as a liaison to the Chief Information
Officer, Council of the Inspectors General on Integrity
and Efficiency, Committee on National Security Systems,
and other councils or committees as appointed by the
chairperson.
``(d) Functions.--The Federal Information Security Taskforce
shall--
``(1) be the principal interagency forum for collaboration
regarding best practices and recommendations for agency
information security and the security of the Federal
information infrastructure;
``(2) assist in the development of and annually evaluate
guidance to fulfill the requirements under sections 3554 and
3556;
``(3) share experiences and innovative approaches relating
to threats against the Federal information infrastructure,
information sharing and information security best practices,
penetration testing regimes, and incident response, mitigation,
and remediation;
``(4) promote the development and use of standard
performance indicators and measures for agency information
security that--
``(A) are outcome-based;
``(B) focus on risk management;
``(C) align with the business and program goals of
the agency;
``(D) measure improvements in the agency security
posture over time; and
``(E) reduce burdensome and inefficient performance
indicators and measures;
``(5) recommend to the Office of Personnel Management the
necessary qualifications to be established for Chief
Information Security Officers to be capable of administering
the functions described under this subchapter including
education, training, and experience;
``(6) enhance information system processes by establishing
a prioritized baseline of information security measures and
controls that can be continuously monitored through automated
mechanisms; and
``(7) evaluate the effectiveness and efficiency of any
reporting and compliance requirements that are required by law
related to the information security of Federal information
infrastructure; and
``(8) submit proposed enhancements developed under
paragraphs (1) through (7) to the Director of the National
Center for Cybersecurity and Communications.
``(e) Termination.--
``(1) In general.--Except as provided under paragraph (2),
the Federal Information Security Taskforce shall terminate 4
years after the date of enactment of the Cybersecurity and
Internet Freedom Act of 2011.
``(2) Extension.--The President may--
``(A) extend the Federal Information Security
Taskforce by executive order; and
``(B) make more than 1 extension under this
paragraph for any period as the President may
determine.
``Sec. 3556. Independent Assessments
``(a) In General.--
``(1) Inspectors general assessments.--Not less than every
2 years, each agency with an Inspector General appointed under
the Inspector General Act of 1978 (5 U.S.C. App.) or any other
law shall assess the adequacy and effectiveness of the
information security program developed under section 3553 (b)
and (c), and evaluations conducted under section 3554.
``(2) Independent assessments.--For each agency to which
paragraph (1) does not apply, the head of the agency shall
engage an independent external auditor to perform the
assessment.
``(b) Standards.--The assessments required under subsection (a)
shall be performed in accordance with standards developed by the
Government Accountability Office, in collaboration with the Council of
Inspectors General on Integrity and Efficiency and with assistance from
the Federal Information Security Taskforce.
``(c) Existing Assessments.--The assessments required under this
section may be based in whole or in part on an audit, evaluation, or
report relating to programs or practices of the applicable agency.
``(d) Reporting of Information.--
``(1) Inspectors general reporting.--Each Inspector General
shall ensure information obtained as a result of the assessment
required under this section, or any other relevant information,
is--
``(A) provided to the head of the agency, the
agency Chief Information Security Officer, and the
agency Chief Information Officer; and
``(B) available through the system required under
section 3552(a)(3)(D) to Congress and the Director of
the National Center for Cybersecurity and
Communications.
``(2) Heads of agencies reporting.--If an assessment
described under subsection (a)(2) is performed, the head of the
agency shall comply with the requirements of paragraph (1) (A)
and (B).
``Sec. 3557. Protection of Information
``In complying with this subchapter, agencies, evaluators, and
Inspectors General shall take appropriate actions to ensure the
protection of information which, if disclosed, may adversely affect
information security. Protections under this chapter shall be
commensurate with the risk and comply with all applicable laws and
regulations.
``Sec. 3558. Department of Defense and Central Intelligence Agency
systems
``(a) In General.--The authorities of the Director of the National
Center for Cybersecurity and Communications under this subchapter shall
be delegated to--
``(1) the Secretary of Defense in the case of systems
described under subsection (b); and
``(2) the Director of the Central Intelligence Agency in
the case of systems described under subsection (c).
``(b) Department of Defense Systems.--The systems described under
this subsection are systems that are operated by the Department of
Defense, a contractor of the Department of Defense, or another entity
on behalf of the Department of Defense that processes any information
the unauthorized access, use, disclosure, disruption, modification, or
destruction of which would have a debilitating impact on the mission of
the Department of Defense.
``(c) Central Intelligence Agency Systems.--The systems described
under this subsection are systems that are operated by the Central
Intelligence Agency, a contractor of the Central Intelligence Agency,
or another entity on behalf of the Central Intelligence Agency that
processes any information the unauthorized access, use, disclosure,
disruption, modification, or destruction of which would have a
debilitating impact on the mission of the Central Intelligence
Agency.''.
(c) Technical and Conforming Amendments.--
(1) Table of sections.--The table of sections for chapter
35 of title 44, United States Code, is amended by striking the
matter relating to subchapters II and III and inserting the
following:
``subchapter ii--information security
``3550. Purposes.
``3551. Definitions.
``3552. Authority and functions of the National Center for
Cybersecurity and Communications.
``3553. Agency responsibilities.
``3554. Annual operational evaluation.
``3555. Federal Information Security Taskforce.
``3556. Independent assessments.
``3557. Protection of information.
``3558. Department of Defense and Central Intelligence Agency
systems.''.
(2) Other references.--
(A) Section 1001(c)(1)(A) of the Homeland Security
Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended by
striking ``section 3532(3)'' and inserting ``section
3551(b)''.
(B) Section 2222(j)(6) of title 10, United States
Code, is amended by striking ``section 3542(b)(2))''
and inserting ``section 3551(b)''.
(C) Section 2223(c)(3) of title 10, United States
Code, is amended, by striking ``section 3542(b)(2))''
and inserting ``section 3551(b)''.
(D) Section 2315 of title 10, United States Code,
is amended by striking ``section 3542(b)(2))'' and
inserting ``section 3551(b)''.
(E) Section 20(a)(2) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3) is
amended by striking ``section 3532(b)(2)'' and
inserting ``section 3551(b)''.
(F) Section 21(b)(2) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-4(b)(2))
is amended by striking ``Institute and'' and inserting
``Institute, the Director of the National Center on
Cybersecurity and Communications, and''.
(G) Section 21(b)(3) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-4(b)(3))
is amended by inserting ``the Director of the National
Center on Cybersecurity and Communications,'' after
``the Director of the National Security Agency,''.
(H) Section 8(d)(1) of the Cyber Security Research
and Development Act (15 U.S.C. 7406(d)(1)) is amended
by striking ``section 3534(b)'' and inserting ``section
3553(b)''.
(3) Homeland security act of 2002.--
(A) Title x.--The Homeland Security Act of 2002 (6
U.S.C. 101 et seq.) is amended by striking title X.
(B) Table of contents.--The table of contents in
section 1(b) of the Homeland Security Act of 2002 (6
U.S.C. 101 et seq.) is amended by striking the matter
relating to title X.
(d) Repeal of Other Standards.--
(1) In general.--Section 11331 of title 40, United States
Code, is repealed.
(2) Technical and conforming amendments.--
(A) Section 20(c)(3) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3(c)(3))
is amended by striking ``under section 11331 of title
40, United States Code''.
(B) Section 20(d)(1) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3(d)(1))
is amended by striking ``the Director of the Office of
Management and Budget for promulgation under section
11331 of title 40, United States Code'' and inserting
``the Secretary of Commerce for promulgation''.
(C) Section 11302(d) of title 40, United States
Code, is amended by striking ``under section 11331 of
this title and''.
(D) Section 1874A (e)(2)(A)(ii) of the Social
Security Act (42 U.S.C.1395kk-1 (e)(2)(A)(ii)) is
amended by striking ``section 11331 of title 40, United
States Code'' and inserting ``section 3552 of title 44,
United States Code''.
(E) Section 3504(g)(2) of title 44, United States
Code, is amended by striking ``section 11331 of title
40'' and inserting ``section 3552 of title 44''.
(F) Section 3504(h)(1) of title 44, United States
Code, is amended by inserting ``, the Director of the
National Center for Cybersecurity and Communications,''
after ``the National Institute of Standards and
Technology''.
(G) Section 3504(h)(1)(B) of title 44, United
States Code, is amended by striking ``under section
11331 of title 40'' and inserting ``section 3552 of
title 44''.
(H) Section 3518(d) of title 44, United States
Code, is amended by striking ``sections 11331 and
11332'' and inserting ``section 11332''.
(I) Section 3602(f)(8) of title 44, United States
Code, is amended by striking ``under section 11331 of
title 40.
(J) Section 3603(f)(5) of title 44, United States
Code, is amended by striking ``and promulgated under
section 11331 of title 40,''.
TITLE IV--RECRUITMENT AND PROFESSIONAL DEVELOPMENT
SEC. 401. DEFINITIONS.
In this title:
(1) Cybersecurity mission.--The term ``cybersecurity
mission'' means the activities of the Federal Government that
encompass the full range of threat reduction, vulnerability
reduction, deterrence, international engagement, incident
response, resiliency, and recovery policies and activities,
including computer network operations, information assurance,
law enforcement, diplomacy, military, and intelligence missions
as such activities relate to the security and stability of
cyberspace.
(2) Federal agency's cybersecurity mission.--The term
``Federal agency's cybersecurity mission'' means, with respect
to any Federal agency, the portion of the cybersecurity mission
that is the responsibility of the Federal agency.
SEC. 402. ASSESSMENT OF CYBERSECURITY WORKFORCE.
(a) In General.--The Director of the Office of Personnel Management
and the Director shall assess the readiness and capacity of the Federal
workforce to meet the needs of the cybersecurity mission of the Federal
Government.
(b) Strategy.--
(1) In general.--The Director of the Office of Personnel
Management, in consultation with the Director and the Director
of the Office of Management and Budget, shall develop a
comprehensive workforce strategy that enhances the readiness,
capacity, training, and recruitment and retention of Federal
cybersecurity personnel.
(2) Contents.--The strategy developed under paragraph (1)
shall include--
(A) a 5-year plan on recruitment of personnel for
the Federal workforce; and
(B) 10-year and 20-year projections of workforce
needs.
(3) Dates for completion.--The strategy under this
subsection shall be--
(A) completed not later than 180 days after the
date of enactment of this Act; and
(B) updated as needed.
SEC. 403. STRATEGIC CYBERSECURITY WORKFORCE PLANNING.
(a) Federal Agency Development of Strategic Cybersecurity Workforce
Plans.--Not later than 180 days after the date of enactment of this Act
and in every subsequent year, and subject to subsection (c)(2), the
head of each Federal agency shall develop a strategic cybersecurity
workforce plan as part of the Federal agency performance plan required
under section 1115 of title 31, United States Code.
(b) Basis and Guidance for Plans.--Each Federal agency shall
develop a plan prepared under subsection (a) on the basis of the
assessment developed under section 402 and any subsequent guidance
issued by the Director of the Office of Personnel Management, in
consultation with the Director and the Director of the Office of
Management and Budget.
(c) Contents of the Plan.--
(1) In general.--Subject to paragraph (2), each plan
prepared under subsection (a) shall include--
(A) a description of the Federal agency's
cybersecurity mission;
(B) a description and analysis, relating to the
specialized workforce needed by the Federal agency to
fulfill the Federal agency's cybersecurity mission,
including--
(i) the workforce needs of the Federal
agency on the date of the report, and 10-year
and 20-year projections of workforce needs;
(ii) hiring projections to meet workforce
needs, including, for at least a 2-year period,
specific occupation and grade levels;
(iii) long-term and short-term strategic
goals to address critical skills deficiencies,
including analysis of the numbers of and
reasons for attrition of employees;
(iv) recruitment strategies, including the
use of student internships, part-time
employment, student loan reimbursement, and
telework, to attract highly qualified
candidates from diverse backgrounds and
geographic locations;
(v) an assessment of the sources and
availability of individuals with needed
expertise;
(vi) ways to streamline the hiring process;
(vii) the barriers to recruiting and hiring
individuals qualified in cybersecurity and
recommendations to overcome the barriers; and
(viii) a training and development plan,
consistent with the curriculum developed under
section 406, to enhance and improve the
knowledge of employees.
(2) Federal agencies with small specialized workforce.--In
accordance with guidance issued under subsection (b), a Federal
agency that needs only a small specialized workforce to fulfill
the Federal agency's cybersecurity mission may, in lieu of
developing a separate strategic cybersecurity workforce plan,
present the workforce plan component referred to in paragraph
(1)(A) and those components referred to in paragraph (1)(B)
that are relevant and appropriate to the circumstances of the
agency as part of the Federal agency performance plan required
under section 1115 of title 31, United States Code.
SEC. 404. CYBERSECURITY OCCUPATION CLASSIFICATIONS.
(a) In General.--Not later than 1 year after the date of enactment
of this Act, the Director of the Office of Personnel Management, in
coordination with the Director, shall develop and issue comprehensive
occupation classifications for Federal employees engaged in
cybersecurity missions.
(b) Applicability of Classifications.--The Director of the Office
of Personnel Management shall ensure that the comprehensive occupation
classifications issued under subsection (a) may be used throughout the
Federal Government.
SEC. 405. MEASURES OF CYBERSECURITY HIRING EFFECTIVENESS.
(a) In General.--The head of each Federal agency shall measure, and
collect information on, indicators of the effectiveness of the
recruitment and hiring by the Federal agency of a workforce needed to
fulfill the Federal agency's cybersecurity mission.
(b) Types of Information.--The indicators of effectiveness measured
and subject to collection of information under subsection (a) shall
include indicators with respect to the following:
(1) Recruiting and hiring.--In relation to recruiting and
hiring by the Federal agency--
(A) the ability to reach and recruit well-qualified
individuals from diverse talent pools;
(B) the use and impact of special hiring
authorities and flexibilities to recruit the most
qualified applicants, including the use of student
internship and scholarship programs for permanent
hires;
(C) the use and impact of special hiring
authorities and flexibilities to recruit diverse
candidates, including criteria such as the veteran
status, race, ethnicity, gender, disability, or
national origin of the candidates; and
(D) the educational level, and source of
applicants.
(2) Supervisors.--In relation to the supervisors of the
positions being filled--
(A) satisfaction with the quality of the applicants
interviewed and hired;
(B) satisfaction with the match between the skills
of the individuals and the needs of the Federal agency;
(C) satisfaction of the supervisors with the hiring
process and hiring outcomes;
(D) whether any mission-critical deficiencies were
addressed by the individuals and the connection between
the deficiencies and the performance of the Federal
agency; and
(E) the satisfaction of the supervisors with the
period of time elapsed to fill the positions.
(3) Applicants.--The satisfaction of applicants with the
hiring process, including clarity of job announcements, any
reasons for withdrawal of an application, the user-friendliness
of the application process, communication regarding status of
applications, and the timeliness of offers of employment.
(4) Hired individuals.--In relation to the individuals
hired--
(A) satisfaction with the hiring process;
(B) satisfaction with the process of starting
employment in the position for which the individual was
hired;
(C) attrition; and
(D) the results of exit interviews.
(c) Reports.--
(1) In general.--The head of each Federal agency shall
submit the information collected under this section to the
Director of the Office of Personnel Management on an annual
basis and in accordance with the regulations issued under
subsection (d).
(2) Availability of recruiting and hiring information.--
(A) In general.--The Director of the Office of
Personnel Management shall prepare an annual report
containing the information received under paragraph (1)
in a consistent format to allow for a comparison of
hiring effectiveness and experience across demographic
groups and Federal agencies.
(B) Submission.--The Director of the Office of
Personnel Management shall--
(i) not later than 90 days after the
receipt of all information required to be
submitted under paragraph (1), make the report
prepared under subparagraph (A) publicly
available, including on the website of the
Office of Personnel Management; and
(ii) before the date on which the report
prepared under subparagraph (A) is made
publicly available, submit the report to
Congress.
(d) Regulations.--
(1) In general.--Not later than 180 days after the date of
enactment of this Act, the Director of the Office of Personnel
Management shall issue regulations establishing the
methodology, timing, and reporting of the data required to be
submitted under this section.
(2) Scope and detail of required information.--The
regulations under paragraph (1) shall delimit the scope and
detail of the information that a Federal agency is required to
collect and submit under this section, taking account of the
size and complexity of the workforce that the Federal agency
needs to fulfill the Federal agency's cybersecurity mission.
SEC. 406. TRAINING AND EDUCATION.
(a) Training.--
(1) Federal government employees and federal contractors.--
The Director of the Office of Personnel Management, in
conjunction with the Director of the National Center for
Cybersecurity and Communications, the Director of National
Intelligence, the Secretary of Defense, and the Chief
Information Officers Council established under section 3603 of
title 44, United States Code, shall establish a cybersecurity
awareness and education curriculum that shall be required for
all Federal employees and contractors engaged in the design,
development, or operation of agency information infrastructure,
as defined under section 3551 of title 44, United States Code.
(2) Contents.--The curriculum established under paragraph
(1) may include--
(A) role-based security awareness training;
(B) recommended cybersecurity practices;
(C) cybersecurity recommendations for traveling
abroad;
(D) unclassified counterintelligence information;
(E) information regarding industrial espionage;
(F) information regarding malicious activity
online;
(G) information regarding cybersecurity and law
enforcement;
(H) identity management information;
(I) information regarding supply chain security;
(J) information security risks associated with the
activities of Federal employees; and
(K) the responsibilities of Federal employees in
complying with policies and procedures designed to
reduce information security risks identified under
subparagraph (J).
(3) Federal cybersecurity professionals.--The Director of
the Office of Personnel Management in conjunction with the
Director of the National Center for Cybersecurity and
Communications, the Director of National Intelligence, the
Secretary of Defense, the Director of the Office of Management
and Budget, and, as appropriate, colleges, universities, and
nonprofit organizations with cybersecurity training expertise,
shall develop a program, to provide training to improve and
enhance the skills and capabilities of Federal employees
engaged in the cybersecurity mission, including training
specific to the acquisition workforce.
(4) Heads of federal agencies.--Not later than 30 days
after the date on which an individual is appointed to a
position at level I or II of the Executive Schedule, the
Director of the National Center for Cybersecurity and
Communications and the Director of National Intelligence, or
their designees, shall provide that individual with a
cybersecurity threat briefing.
(5) Certification.--The head of each Federal agency shall
include in the annual report required under section 3553(c) of
title 44, United States Code, a certification regarding whether
all officers, employees, and contractors of the Federal agency
have completed the training required under this subsection.
(b) Education.--
(1) Federal employees.--The Director of the Office of
Personnel Management, in coordination with the Secretary of
Education, the Director of the National Science Foundation, and
the Director, shall develop and implement a strategy to provide
Federal employees who work in cybersecurity missions with the
opportunity to obtain additional education.
(2) K through 12.--The Secretary of Education, in
coordination with the Director of the National Center for
Cybersecurity and Communications and State and local
governments, shall develop curriculum standards, guidelines,
and recommended courses to address cyber safety, cybersecurity,
and cyber ethics for students in kindergarten through grade 12.
(3) Undergraduate, graduate, vocational, and technical
institutions.--
(A) Secretary of education.--The Secretary of
Education, in coordination with the Director of the
National Center for Cybersecurity and Communications,
shall--
(i) develop curriculum standards and
guidelines to address cyber safety,
cybersecurity, and cyber ethics for all
students enrolled in undergraduate, graduate,
vocational, and technical institutions in the
United States; and
(ii) analyze and develop recommended
courses for students interested in pursuing
careers in information technology,
communications, computer science, engineering,
math, and science, as those subjects relate to
cybersecurity.
(B) Office of personnel management.--The Director
of the Office of Personnel Management, in coordination
with the Director, shall develop strategies and
programs--
(i) to recruit students from undergraduate,
graduate, vocational, and technical
institutions in the United States to serve as
Federal employees engaged in cyber missions;
and
(ii) that provide internship and part-time
work opportunities with the Federal Government
for students at the undergraduate, graduate,
vocational, and technical institutions in the
United States.
(c) Cyber Talent Competitions and Challenges.--
(1) In general.--The Director of the National Center for
Cybersecurity and Communications shall establish a program to
ensure the effective operation of national and statewide
competitions and challenges that seek to identify, develop, and
recruit talented individuals to work in Federal agencies, State
and local government agencies, and the private sector to
perform duties relating to the security of the Federal
information infrastructure or the national information
infrastructure.
(2) Groups and individuals.--The program under this
subsection shall include--
(A) high school students;
(B) undergraduate students;
(C) graduate students;
(D) academic and research institutions;
(E) veterans; and
(F) other groups or individuals as the Director may
determine.
(3) Support of other competitions and challenges.--The
program under this subsection may support other competitions
and challenges not established under this subsection through
affiliation and cooperative agreements with--
(A) Federal agencies;
(B) regional, State, or community school programs
supporting the development of cyber professionals; or
(C) other private sector organizations.
(4) Areas of talent.--The program under this subsection
shall seek to identify, develop, and recruit exceptional talent
relating to--
(A) ethical hacking;
(B) penetration testing;
(C) vulnerability assessment;
(D) continuity of system operations;
(E) cyber forensics; and
(F) offensive and defensive cyber operations.
SEC. 407. CYBERSECURITY INCENTIVES.
(a) Awards.--In making cash awards under chapter 45 of title 5,
United States Code, the President or the head of a Federal agency, in
consultation with the Director, shall consider the success of an
employee in fulfilling the objectives of the National Strategy, in a
manner consistent with any policies, guidelines, procedures,
instructions, or standards established by the President.
(b) Other Incentives.--The head of each Federal agency shall adopt
best practices, developed by the Director of the National Center for
Cybersecurity and Communications and the Office of Management and
Budget, regarding effective ways to educate and motivate employees of
the Federal Government to demonstrate leadership in cybersecurity,
including--
(1) promotions and other nonmonetary awards; and
(2) publicizing information sharing accomplishments by
individual employees and, if appropriate, the tangible benefits
that resulted.
SEC. 408. RECRUITMENT AND RETENTION PROGRAM FOR THE NATIONAL CENTER FOR
CYBERSECURITY AND COMMUNICATIONS.
(a) Definitions.--In this section:
(1) Center.--The term ``Center'' means the National Center
for Cybersecurity and Communications.
(2) Department.--The term ``Department'' means the
Department of Homeland Security.
(3) Director.--The term ``Director'' means the Director of
the Center.
(4) Entry level position.--The term ``entry level
position'' means a position that--
(A) is established by the Director in the Center;
and
(B) is classified at GS-7, GS-8, or GS-9 of the
General Schedule.
(5) Secretary.--The term ``Secretary'' means the Secretary
of Homeland Security.
(6) Senior position.--The term ``senior position'' means a
position that--
(A) is established by the Director in the Center;
and
(B) is not established under section 5108 of title
5, United States Code, but is similar in duties and
responsibilities for positions established under that
section.
(b) Recruitment and Retention Program.--
(1) Establishment.--The Director may establish a program to
assist in the recruitment and retention of highly skilled
personnel to carry out the functions of the Center.
(2) Consultation and considerations.--In establishing a
program under this section, the Director shall--
(A) consult with the Secretary; and
(B) consider--
(i) national and local employment trends;
(ii) the availability and quality of
candidates;
(iii) any specialized education or
certifications required for positions;
(iv) whether there is a shortage of certain
skills; and
(v) such other factors as the Director
determines appropriate.
(c) Hiring and Special Pay Authorities.--
(1) Direct hire authority.--Without regard to the civil
service laws (other than sections 3303 and 3328 of title 5,
United States Code), the Director may appoint not more than 500
employees under this subsection to carry out the functions of
the Center.
(2) Rates of pay.--
(A) Entry level positions.--The Director may fix
the pay of the employees appointed to entry level
positions under this subsection without regard to
chapter 51 and subchapter III of chapter 53 of title 5,
United States Code, relating to classification of
positions and General Schedule pay rates, except that
the rate of pay for any such employee may not exceed
the maximum rate of basic pay payable for a position at
GS-10 of the General Schedule while that employee is in
an entry level position.
(B) Senior positions.--
(i) In general.--The Director may fix the
pay of the employees appointed to senior
positions under this subsection without regard
to chapter 51 and subchapter III of chapter 53
of title 5, United States Code, relating to
classification of positions and General
Schedule pay rates, except that the rate of pay
for any such employee may not exceed the
maximum rate of basic pay payable under section
5376 of title 5, United States Code.
(ii) Higher maximum rates.--
(I) In general.--Notwithstanding
the limitation on rates of pay under
clause (i)--
(aa) not more than 20
employees, identified by the
Director, may be paid at a rate
of pay not to exceed the
maximum rate of basic pay
payable for a position at level
I of the Executive Schedule
under section 5312 of title 5,
United States Code; and
(bb) not more than 5
employees, identified by the
Director with the approval of
the Secretary, may be paid at a
rate of pay not to exceed the
maximum rate of basic pay
payable for the Vice President
under section 104 of title 3,
United States Code.
(II) Nondelegation of authority.--
The Secretary or the Director may not
delegate any authority under this
clause.
(d) Conversion to Competitive Service.--
(1) Definition.--In this subsection, the term ``qualified
employee'' means any individual appointed to an excepted
service position in the Department who performs functions
relating to the security of the Federal information
infrastructure or national information infrastructure.
(2) Competitive civil service status.--In consultation with
the Director, the Secretary may grant competitive civil service
status to a qualified employee if that employee is--
(A) employed in the Center; or
(B) transferring to the Center.
(e) Retention Bonuses.--
(1) Authority.--Notwithstanding section 5754 of title 5,
United States Code, the Director may--
(A) pay a retention bonus under that section to any
individual appointed under this subsection, if the
Director determines that, in the absence of a retention
bonus, there is a high risk that the individual would
likely leave employment with the Department; and
(B) exercise the authorities of the Office of
Personnel Management and the head of an agency under
that section with respect to retention bonuses paid
under this subsection.
(2) Limitations on amount of annual bonuses.--
(A) Definitions.--In this paragraph:
(i) Maximum total pay.--The term ``maximum
total pay'' means--
(I) in the case of an employee
described under subsection
(c)(2)(B)(i), the total amount of pay
paid in a calendar year at the maximum
rate of basic pay payable for a
position at level I of the Executive
Schedule under section 5312 of title 5,
United States Code;
(II) in the case of an employee
described under subsection
(c)(2)(B)(ii)(I)(aa), the total amount
of pay paid in a calendar year at the
maximum rate of basic pay payable for a
position at level I of the Executive
Schedule under section 5312 of title 5,
United States Code; and
(III) in the case of an employee
described under subsection
(c)(2)(B)(ii)(I)(bb), the total amount
of pay paid in a calendar year at the
maximum rate of basic pay payable for
the Vice President under section 104 of
title 3, United States Code.
(ii) Total compensation.--The term ``total
compensation'' means--
(I) the amount of pay paid to an
employee in any calendar year; and
(II) the amount of all retention
bonuses paid to an employee in any
calendar year.
(B) Limitation.--The Director may not pay a
retention bonus under this subsection to an employee
that would result in the total compensation of that
employee exceeding maximum total pay.
(f) Termination of Authority.--The authority to make appointments
and pay retention bonuses under this section shall terminate 3 years
after the date of enactment of this Act.
(g) Reports.--
(1) Plan for execution of authorities.--Not later than 120
days after the date of enactment of this Act, the Director
shall submit a report to the appropriate committees of Congress
with a plan for the execution of the authorities provided under
this section.
(2) Annual report.--Not later than 6 months after the date
of enactment of this Act, and every year thereafter, the
Director shall submit to the appropriate committees of Congress
a detailed report that--
(A) discusses how the actions taken during the
period of the report are fulfilling the critical hiring
needs of the Center;
(B) assesses metrics relating to individuals hired
under the authority of this section, including--
(i) the numbers of individuals hired;
(ii) the turnover in relevant positions;
(iii) with respect to each individual
hired--
(I) the position for which hired;
(II) the salary paid;
(III) any retention bonus paid and
the amount of the bonus;
(IV) the geographic location from
which hired;
(V) the immediate past salary; and
(VI) whether the individual was a
noncareer appointee in the Senior
Executive Service or an appointee to a
position of a confidential or policy-
determining character under schedule C
of subpart C of part 213 of title 5 of
the Code of Federal Regulations before
the hiring; and
(iv) whether public notice for recruitment
was made, and if so--
(I) the total number of qualified
applicants;
(II) the number of veteran
preference eligible candidates who
applied;
(III) the time from posting to job
offer; and
(IV) statistics on diversity,
including age, disability, race,
gender, and national origin, of
individuals hired under the authority
of this section to the extent such
statistics are available; and
(C) includes rates of pay set in accordance with
subsection (c).
TITLE V--OTHER PROVISIONS
SEC. 501. CYBERSECURITY RESEARCH AND DEVELOPMENT.
Subtitle D of title II of the Homeland Security Act of 2002 (6
U.S.C. 161 et seq.) is amended by adding at the end the following:
``SEC. 238. CYBERSECURITY RESEARCH AND DEVELOPMENT.
``(a) Establishment of Research and Development Program.--The Under
Secretary for Science and Technology, in coordination with the Director
of the National Center for Cybersecurity and Communications, shall
carry out a research and development program for the purpose of
improving the security of information infrastructure.
``(b) Eligible Projects.--The research and development program
carried out under subsection (a) may include projects to--
``(1) advance the development and accelerate the deployment
of more secure versions of fundamental Internet protocols and
architectures, including for the secure domain name addressing
system and routing security;
``(2) improve and create technologies for detecting and
analyzing attacks or intrusions, including analysis of
malicious software;
``(3) improve and create mitigation and recovery
methodologies, including techniques for containment of attacks
and development of resilient networks and systems;
``(4) develop and support infrastructure and tools to
support cybersecurity research and development efforts,
including modeling, testbeds, and data sets for assessment of
new cybersecurity technologies;
``(5) assist the development and support of technologies to
reduce vulnerabilities in process control systems;
``(6) understand human behavioral factors that can affect
cybersecurity technology and practices;
``(7) test, evaluate, and facilitate, with appropriate
protections for any proprietary information concerning the
technologies, the transfer of technologies associated with the
engineering of less vulnerable software and securing the
information technology software development lifecycle;
``(8) assist the development of identity management and
attribution technologies;
``(9) assist the development of technologies designed to
increase the security and resiliency of telecommunications
networks;
``(10) advance the protection of privacy and civil
liberties in cybersecurity technology and practices; and
``(11) address other risks identified by the Director of
the National Center for Cybersecurity and Communications.
``(c) Coordination With Other Research Initiatives.--The Under
Secretary--
``(1) shall ensure that the research and development
program carried out under subsection (a) is consistent with the
national strategy to increase the security and resilience of
cyberspace developed by the Director of Cyberspace Policy under
section 101 of the Cybersecurity and Internet Freedom Act of
2011, or any succeeding strategy;
``(2) shall, to the extent practicable, coordinate the
research and development activities of the Department with
other ongoing research and development security-related
initiatives, including research being conducted by--
``(A) the National Institute of Standards and
Technology;
``(B) the National Science Foundation;
``(C) the National Academy of Sciences;
``(D) other Federal agencies, as defined under
section 241;
``(E) other Federal and private research
laboratories, research entities, and universities and
institutions of higher education, and relevant
nonprofit organizations; and
``(F) international partners of the United States;
``(3) shall carry out any research and development project
under subsection (a) through a reimbursable agreement with an
appropriate Federal agency, as defined under section 241, if
the Federal agency--
``(A) is sponsoring a research and development
project in a similar area; or
``(B) has a unique facility or capability that
would be useful in carrying out the project;
``(4) may make grants to, or enter into cooperative
agreements, contracts, other transactions, or reimbursable
agreements with, the entities described in paragraph (2); and
``(5) shall submit a report to the appropriate committees
of Congress on a review of the cybersecurity activities, and
the capacity, of the national laboratories and other research
entities available to the Department to determine if the
establishment of a national laboratory dedicated to
cybersecurity research and development is necessary.
``(d) Privacy and Civil Rights and Civil Liberties Issues.--
``(1) Consultation.--In carrying out research and
development projects under subsection (a), the Under Secretary
shall consult with the Privacy Officer appointed under section
222 and the Officer for Civil Rights and Civil Liberties of the
Department appointed under section 705.
``(2) Privacy impact assessments.--In accordance with
sections 222 and 705, the Privacy Officer shall conduct privacy
impact assessments and the Officer for Civil Rights and Civil
Liberties shall conduct reviews, as appropriate, for research
and development projects carried out under subsection (a) that
the Under Secretary determines could have an impact on privacy,
civil rights, or civil liberties.
``SEC. 239. NATIONAL CYBERSECURITY ADVISORY COUNCIL.
``(a) Establishment.--Not later than 90 days after the date of
enactment of this section, the Secretary shall establish an advisory
committee under section 871 on private sector cybersecurity, to be
known as the National Cybersecurity Advisory Council (in this section
referred to as the `Council').
``(b) Responsibilities.--
``(1) In general.--The Council shall advise the Director of
the National Center for Cybersecurity and Communications on the
implementation of the cybersecurity provisions affecting the
private sector under this subtitle and subtitle E.
``(2) Incentives and regulations.--The Council shall advise
the Director of the National Center for Cybersecurity and
Communications and appropriate committees of Congress (as
defined in section 241) and any other congressional committee
with jurisdiction over the particular matter regarding how
market incentives and regulations may be implemented to enhance
the cybersecurity and economic security of the Nation.
``(c) Membership.--
``(1) In general.--The members of the Council shall be
appointed the Director of the National Center for Cybersecurity
and Communications and shall, to the extent practicable,
represent a geographic and substantive cross-section of owners
and operators of critical infrastructure and others with
expertise in cybersecurity, including, as appropriate--
``(A) representatives of covered critical
infrastructure (as defined under section 241);
``(B) academic institutions with expertise in
cybersecurity;
``(C) Federal, State, and local government agencies
with expertise in cybersecurity;
``(D) a representative of the National Security
Telecommunications Advisory Council, as established by
Executive Order 12382 (47 Fed. Reg. 40531; relating to
the establishment of the advisory council), as amended
by Executive Order 13286 (68 Fed. Reg. 10619), as in
effect on August 3, 2009, or any successor entity;
``(E) a representative of the Communications Sector
Coordinating Council, or any successor entity;
``(F) a representative of the Information
Technology Sector Coordinating Council, or any
successor entity;
``(G) individuals, acting in their personal
capacity, with demonstrated technical expertise in
cybersecurity; and
``(H) such other individuals as the Director
determines to be appropriate, including owners of small
business concerns (as defined under section 3 of the
Small Business Act (15 U.S.C. 632)).
``(2) Term.--The members of the Council shall be appointed
for 2 year terms and may be appointed to consecutive terms.
``(3) Leadership.--The Chairperson and Vice-Chairperson of
the Council shall be selected by members of the Council from
among the members of the Council and shall serve 2-year terms.
``(d) Applicability of Federal Advisory Committee Act.--The Federal
Advisory Committee Act (5 U.S.C. App.) shall not apply to the
Council.''.
SEC. 502. PRIORITIZED CRITICAL INFORMATION INFRASTRUCTURE.
(a) In General.--Section 210E(a)(2) of the Homeland Security Act of
2002 (6 U.S.C. 124l(a)(2)) is amended--
(1) by striking ``In accordance'' and inserting the
following:
``(A) In general.--In accordance''; and
(2) by adding at the end the following:
``(B) Considerations.--In establishing and
maintaining a list under subparagraph (A), the
Secretary, in coordination with the Director of the
National Center for Cybersecurity and Communications,
shall consider cyber risks and consequences by sector,
including--
``(i) the factors listed in section
248(a)(2);
``(ii) interdependencies between components
of covered critical infrastructure (as defined
under section 241); and
``(iii) the potential for the destruction
or disruption of the system or asset to cause--
``(I) a mass casualty event which
includes an extraordinary number of
fatalities;
``(II) severe economic
consequences;
``(III) mass evacuations with a
prolonged absence; or
``(IV) severe degradation of
national security capabilities,
including intelligence and defense
functions.''.
(b) Covered Critical Infrastructure.--Title II of the Homeland
Security Act of 2002 (6 U.S.C. 121 et seq.) (as amended by section 201
of this Act) is further amended by adding at the end the following:
``SEC. 254. COVERED CRITICAL INFRASTRUCTURE.
``(a) Identification of Covered Critical Infrastructure.--
``(1) In general.--Subject to paragraphs (2) and (3), the
Secretary, in coordination with sector-specific agencies and in
consultation with the National Cybersecurity Advisory Council
and other appropriate representatives of State and local
governments and the private sector, shall establish and
maintain a list of systems or assets that constitute covered
critical infrastructure for purposes of this subtitle.
``(2) Requirements.--
``(A) In general.--A system or asset may not be
identified as covered critical infrastructure under
this section unless such system or asset meets each of
the requirements under subparagraph (B) (i), (ii), and
(iii).
``(B) Requirements.--The requirements referred to
under subparagraph (A) are that--
``(i) the destruction or the disruption of
the reliable operation of the system or asset
would cause national or regional catastrophic
effects identified under section
210E(a)(2)(B)(iii);
``(ii) the system or asset is on the
prioritized critical infrastructure list
established by the Secretary under section
210E(a)(2); and
``(iii)(I) the system or asset is a
component of the national information
infrastructure; or
``(II) the national information
infrastructure is essential to the reliable
operation of the system or asset.
``(3) Limitation.--A system or asset may not be identified
as covered critical infrastructure under this section based
solely on activities protected by the first amendment to the
United States Constitution.
``(b) Notification.--
``(1) Identification of system or asset.--If the Secretary
identifies any system or asset as covered critical
infrastructure under subsection (a), the Secretary shall
promptly notify the owner or operator of that system or asset
of that identification.
``(2) System or asset no longer covered critical
infrastructure.--If the Secretary determines that any system or
asset that was identified as covered critical infrastructure
under subsection (a) no longer constitutes covered critical
infrastructure, the Secretary shall promptly notify the owner
or operator of that system or asset of that determination.
``(c) Redress.--
``(1) In general.--Subject to paragraphs (2) and (3), the
Secretary shall develop a mechanism, consistent with subchapter
II of chapter 5 of title 5, United States Code, for an owner or
operator notified under subsection (b)(1) to appeal the
identification of a system or asset as covered critical
infrastructure under this section.
``(2) Appeal to federal court.--A civil action seeking
judicial review of a final agency action taken under the
mechanism developed under paragraph (1) shall be filed in the
United States District Court for the District of Columbia.
``(3) Compliance.--The owner or operator of a system or
asset identified as covered critical infrastructure shall
comply with any requirement of this subtitle relating to
covered critical infrastructure until such time as the system
or asset is no longer identified as covered critical
infrastructure, based on--
``(A) an appeal under paragraph (1);
``(B) a determination of the Secretary unrelated to
an appeal; or
``(C) a final judgment entered in a civil action
seeking judicial review brought in accordance with
paragraph (2).
``(d) Addition of Systems or Assets.--
``(1) In general.--The Secretary shall develop a process
under which any owner or operator of a system or asset that may
constitute covered critical infrastructure may--
``(A) request that such system or asset be
identified by the Secretary as covered critical
infrastructure under this section; and
``(B) submit material supporting such a request to
the Director of the Center for consideration by the
Secretary in carrying out this section.
``(2) Final decision.--A decision to identify any system or
asset as covered critical infrastructure based on a request
submitted under this subsection--
``(A) is committed to the sole, unreviewable
discretion of the Secretary; and
``(B) shall not be subject to--
``(i) an appeal under subsection (c); or
``(ii) judicial review.''.
SEC. 503. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS
ACQUISITION AUTHORITIES.
(a) In General.--The National Center for Cybersecurity and
Communications is authorized to use the authorities under subsections
(c)(1) and (d)(1)(B) of section 2304 of title 10, United States Code,
instead of the authorities under subsections (a)(1) and (b)(2) of
section 3304 of title 41, United States Code, subject to all other
requirements of sections 3301 and 3304 of title 41, United States Code.
(b) Guidelines.--Not later than 90 days after the date of enactment
of this Act, the chief procurement officer of the Department of
Homeland Security shall issue guidelines for use of the authority under
subsection (a).
(c) Termination.--The National Center for Cybersecurity and
Communications may not use the authority under subsection (a) on and
after the date that is 3 years after the date of enactment of this Act.
(d) Reporting.--
(1) In general.--On a semiannual basis, the Director of the
National Center for Cybersecurity and Communications shall
submit a report on use of the authority granted by subsection
(a) to--
(A) the Committee on Homeland Security and
Governmental Affairs of the Senate; and
(B) the Committee on Homeland Security of the House
of Representatives.
(2) Contents.--Each report submitted under paragraph (1)
shall include, at a minimum--
(A) the number of contract actions taken under the
authority under subsection (a) during the period
covered by the report; and
(B) for each contract action described in
subparagraph (A)--
(i) the total dollar value of the contract
action;
(ii) a summary of the market research
conducted by the National Center for
Cybersecurity and Communications, including a
list of all offerors who were considered and
those who actually submitted bids, in order to
determine that use of the authority was
appropriate; and
(iii) a copy of the justification and
approval documents required by section 3304(e)
of title 41, United States Code.
(3) Classified annex.--A report submitted under this
subsection shall be submitted in an unclassified form, but may
include a classified annex, if necessary.
SEC. 504. EVALUATION OF THE EFFECTIVE IMPLEMENTATION OF OFFICE OF
MANAGEMENT AND BUDGET INFORMATION SECURITY RELATED
POLICIES AND DIRECTIVES.
(a) In General.--The Administrator for Electronic Government and
Information Technology, in coordination with the Chief Information
Officers Council, the Federal Information Security Taskforce, and
Council on Inspectors General on Integrity and Efficiency, shall
evaluate agency adoption and effective implementation of appropriate
information security related policies, memoranda, and directives issued
by the Office of Management and Budget including--
(1) OMB Memorandum M-10-15, FY 2010 Reporting Instructions
for the Federal Information Security Management Act and Agency
Privacy Management, issued April 21, 2010;
(2) OMB Memorandum M-09-32, Update on the Trusted Internet
Connections Initiative, issued September 17, 2009;
(3) OMB Memorandum M-09-02, Information Technology
Management Structure and Governance Framework, issued October
21, 2008;
(4) OMB Memorandum M-08-23, Securing the Federal
Government's Domain Name System Infrastructure, issued April
22, 2008;
(5) OMB Memorandum M-08-22, Guidance on the Federal Desktop
Core Configuration (FDCC), issued August 11, 2008;
(6) OMB Memorandum M-07-16, Safeguarding Against and
Responding to the Breach of Personally Identifiable
Information, issued May 22, 2007;
(7) OMB Memorandum M-07-06, Validating and Monitoring
Agency Issuance of Personal Identity Verification Credentials,
issued January 11, 2007;
(8) OMB Memorandum M-04-26, Personal Use Policies and
``File Sharing'' Technology, issued September 8, 2004; and
(9) OMB Memorandum M-03-22, OMB Guidance for Implementing
the Privacy Provisions of the E-Government Act of 2002, issued
September 26, 2003.
(b) Report.--Not later than 1 year after the date of enactment of
this Act, the Office of Management and Budget shall submit a report on
the evaluation required under subsection (a) to the appropriate
congressional committees which shall include--
(1) an examination of whether Federal agencies have
effectively implemented information security policies;
(2) identification of and reasons why Federal agencies are
not in compliance with information security policies;
(3) the extent to which contractors working on behalf of
Federal agencies are in compliance and effectively implementing
information security policies; and
(4) recommended legislative and executive branch actions.
SEC. 505. TECHNICAL AND CONFORMING AMENDMENTS.
(a) Elimination of Assistant Secretary for Cybersecurity and
Communications.--The Homeland Security Act of 2002 (6 U.S.C. 101 et
seq.) is amended--
(1) in section 103(a)(8) (6 U.S.C. 113(a)(8)), by striking
``, cybersecurity,'';
(2) in section 514 (6 U.S.C. 321c)--
(A) by striking subsection (b); and
(B) by redesignating subsection (c) as subsection
(b); and
(3) in section 1801(b) (6 U.S.C. 571(b)), by striking
``shall report to the Assistant Secretary for Cybersecurity and
Communications'' and inserting ``shall report to the Director
of the National Center for Cybersecurity and Communications''.
(b) CIO Council.--Section 3603(b) of title 44, United States Code,
is amended--
(1) by redesignating paragraph (7) as paragraph (8); and
(2) by inserting after paragraph (6) the following:
``(7) The Director of the National Center for Cybersecurity
and Communications.''.
(c) Repeal.--The Homeland Security Act of 2002 (6 U.S.C. 101 et
seq.) is amended--
(1) by striking section 223 (6 U.S.C. 143); and
(2) by redesignating sections 224 and 225 (6 U.S.C. 144 and
145) as sections 223 and 224, respectively.
(d) Technical Correction.--Section 1802(a) of the Homeland Security
Act of 2002 (6 U.S.C. 572(a)) is amended in the matter preceding
paragraph (1) by striking ``Department of''.
(e) Executive Schedule Position.--Section 5313 of title 5, United
States Code, is amended by adding at the end the following:
``Director of the National Center for Cybersecurity and
Communications.''.
(f) Table of Contents.--The table of contents in section 1(b) of
the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended--
(1) by striking the items relating to sections 223, 224,
and 225 and inserting the following:
``Sec. 223. NET guard.
``Sec. 224. Cyber Security Enhancements Act of 2002.'';
and
(2) by inserting after the item relating to section 237 the
following:
``Sec. 238. Cybersecurity research and development.
``Sec. 239. National Cybersecurity Advisory Council.
``Subtitle E--Cybersecurity
``Sec. 241. Definitions.
``Sec. 242. National Center for Cybersecurity and Communications.
``Sec. 243. Physical and cyber infrastructure collaboration.
``Sec. 244. United States Computer Emergency Readiness Team.
``Sec. 245. Additional authorities of the Director of the National
Center for Cybersecurity and
Communications.
``Sec. 246. Information sharing.
``Sec. 247. Private sector assistance.
``Sec. 248. Cyber risks to covered critical infrastructure.
``Sec. 249. National cyber emergencies.
``Sec. 250. Enforcement.
``Sec. 251. Protection of information.
``Sec. 252. Sector-specific agencies.
``Sec. 253. Strategy for Federal cybersecurity supply chain management.
``Sec. 254. Covered critical infrastructure.''.
<all>
Introduced in Senate
Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Committee on Homeland Security and Governmental Affairs. Hearings held. Hearings printed: S.Hrg. 112-221.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line