115 HR 3359 RH: Cybersecurity and Infrastructure Security Agency Act of 2017 U.S. House of Representatives 2017-07-24 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
IB Union Calendar No. 336 115th CONGRESS1st Session H. R. 3359 [Report No. 115–454, Part I] IN THE HOUSE OF REPRESENTATIVES July 24, 2017 Mr. McCaul (for himself, Mr. Thompson of Mississippi, Mr. Ratcliffe, Mr. Richmond, Mr. Katko, Mr. Hurd, Mr. Donovan, Mr. Gallagher, Mr. Higgins of Louisiana, Mr. Garrett, and Mr. Fitzpatrick) introduced the following bill; which was referred to the Committee on Homeland Security, and in addition to the Committees on Energy and Commerce, Oversight and Government Reform, and Transportation and Infrastructure, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned December 11, 2017Additional sponsor: Mr. King of New York December 11, 2017 Reported from the Committee on Homeland Security December 11, 2017The Committees on Energy and Commerce, Oversight and Government Reform, and Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printedA BILL To amend the Homeland Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes.
1.
Short title
This Act may be cited as the Cybersecurity and Infrastructure Security Agency Act of 2017.
2.
Cybersecurity and Infrastructure Security Agency
(a)
In general
The Homeland Security Act of 2002 is amended by adding at the end the following new title: <enum>XXII</enum><header>Cybersecurity and Infrastructure Security Agency</header> <subtitle id="H872923D0F7E444ECB12AA97D0D023BE3"><enum>A</enum><header>Cybersecurity and Infrastructure Security</header> <section id="H897C6AF6AD6C4142B37B0CFCD51811C5"><enum>2201.</enum><header>Definitions</header><text display-inline="no-display-inline">In this subtitle:</text> <paragraph id="H3B4A58590DFA4CBF9B02210CC0DBB538"><enum>(1)</enum><header>Critical infrastructure information</header><text>The term <quote>critical infrastructure information</quote> has the meaning given such term in section 2215.</text> </paragraph><paragraph id="H5049623F69E145818F278F90C90664B0"><enum>(2)</enum><header>Critical infrastructure risk</header><text>The term <quote>critical infrastructure risk</quote> means threats to and vulnerabilities of critical infrastructure and any related consequences, including consequences caused by or resulting from an act of terrorism.</text> </paragraph><paragraph id="H8507A012F4D6467AB9791FD82F4FB8D8"><enum>(3)</enum><header>Cybersecurity risk</header><text>The term <quote>cybersecurity risk</quote> has the meaning given such term in section 2209.</text> </paragraph><paragraph id="H9FBD9DF35C574FA2BB6FDA1F33B4BA1C"><enum>(4)</enum><header>Cybersecurity threat</header><text>The term <quote>cybersecurity threat</quote> has the meaning given such term in paragraph (5) of section 102 of the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<external-xref legal-doc="public-law" parsable-cite="pl/114/113">Public Law 114–113</external-xref>; <external-xref legal-doc="usc" parsable-cite="usc/6/1501">6 U.S.C. 1501</external-xref>)).</text> </paragraph><paragraph id="H8D0547548D8147C4A108FC7B29230761"><enum>(5)</enum><header>Federal entity</header><text>The term <quote>Federal entity</quote> has the meaning given such term in paragraph (8) of section 102 of the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<external-xref legal-doc="public-law" parsable-cite="pl/114/113">Public Law 114–113</external-xref>; <external-xref legal-doc="usc" parsable-cite="usc/6/1501">6 U.S.C. 1501</external-xref>)).</text> </paragraph><paragraph id="H50D4767882904FAFB2D8C9255966F2FD"><enum>(6)</enum><header>Non-Federal entity</header><text>The term <quote>non-Federal entity</quote> has the meaning given such term in paragraph (14) of section 102 of the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<external-xref legal-doc="public-law" parsable-cite="pl/114/113">Public Law 114–113</external-xref>; <external-xref legal-doc="usc" parsable-cite="usc/6/1501">6 U.S.C. 1501</external-xref>)).</text> </paragraph><paragraph id="H3C0BDEE57DD94A25A36BD79C4058D9FE"><enum>(7)</enum><header>Sharing</header><text>The term <quote>sharing</quote> has the meaning given such term in section 2209.</text> </paragraph><paragraph id="H51EB75A89DEE4018BCEEDC622A0C793F"><enum>(8)</enum><header>National cybersecurity asset response activities</header><text>The term <quote>national cybersecurity asset response activities</quote> means—</text> <subparagraph id="H9328865D47E649A195209C4BF53AC7AA"><enum>(A)</enum><text>furnishing technical assistance to entities affected by cybersecurity risks to protect assets, mitigate vulnerabilities, and reduce impacts of cyber incidents;</text> </subparagraph><subparagraph id="HBDE983E2B86E462AAD6E3EA9220F0344"><enum>(B)</enum><text>identifying other entities that may be at risk of an incident and assessing risk to the same or similar vulnerabilities;</text> </subparagraph><subparagraph id="HB7C6A25A9A12432DA85BD7E6C6A0C63B"><enum>(C)</enum><text>assessing potential cybersecurity risks to a sector or region, including potential cascading effects, and developing courses of action to mitigate such risks;</text> </subparagraph><subparagraph id="H15502515C6314F15971EBA8CE046B0A1"><enum>(D)</enum><text>facilitating information sharing and operational coordination with threat response; and</text> </subparagraph><subparagraph id="HAA3483B9C6F543B5B221FD3B41528E53"><enum>(E)</enum><text>providing guidance on how best to utilize Federal resources and capabilities in a timely, effective manner to speed recovery from cybersecurity risks.</text> </subparagraph></paragraph></section><section id="H367924BF587E4265A63664E497B5EEFC"><enum>2202.</enum><header>Cybersecurity and Infrastructure Security Agency</header> <subsection id="HB7252B7F5A6148449995279F6C13C375"><enum>(a)</enum><header>Redesignation</header> <paragraph id="H88ECBD5EA11246B7A99308D55747A45D"><enum>(1)</enum><header>In general</header><text>The National Protection and Programs Directorate of the Department shall, on and after the date of the enactment of this subtitle, be known as the <quote>Cybersecurity and Infrastructure Security Agency</quote> (in this subtitle referred to as the <quote>Agency</quote>).</text> </paragraph><paragraph id="H1A9F6D60748A402BA0B0C359C2D9B9C9"><enum>(2)</enum><header>References</header><text>Any reference to the National Protection and Programs Directorate of the Department in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Cybersecurity and Infrastructure Security Agency of the Department.</text> </paragraph></subsection><subsection id="H73D6848C0EAA4C01B33BF41C8C802CFA"><enum>(b)</enum><header>Director</header> <paragraph commented="no" id="H13D98B636D8243C787DE5E28C2A907CD"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">The Agency shall be headed by a Director of Cybersecurity and Infrastructure Security (in this subtitle referred to as the <quote>Director</quote>), who shall report to the Secretary.</text> </paragraph><paragraph id="H4C384D1740654A5C9BD5E2BA5E21F864"><enum>(2)</enum><header>Reference</header><text>Any reference to an Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and any other related program of the Department as described in section 103(a)(1)(H) as in effect on the day before the date of the enactment of this subtitle in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Director of Cybersecurity and Infrastructure Security of the Department.</text> </paragraph></subsection><subsection id="H3EF19294E5D041EF86CC16BB348E9F00"><enum>(c)</enum><header>Responsibilities</header><text>The Director shall—</text> <paragraph id="H23CB0884CB12444A970CE7E2F11F9EF3"><enum>(1)</enum><text>lead cybersecurity and critical infrastructure security programs, operations, and associated policy for the Agency, including national cybersecurity asset response activities;</text> </paragraph><paragraph commented="no" id="H5F9517CEBEF54FA88CD77CEA8C1676AA"><enum>(2)</enum><text>coordinate with Federal entities and non-Federal entities, including international entities, to carry out the cybersecurity and critical infrastructure activities of the Agency, as appropriate;</text> </paragraph><paragraph commented="no" id="HD873DFBF652B42E1A7CBEDB04C90C6D5"><enum>(3)</enum><text display-inline="yes-display-inline">carry out the Secretary’s responsibilities to secure Federal information and information systems consistent with law, including subchapter II of <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/44/35">chapter 35</external-xref> of title 44, United States Code, and the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<external-xref legal-doc="public-law" parsable-cite="pl/114/113">Public Law 114–113</external-xref>));</text> </paragraph><paragraph commented="no" id="HC124EDF2A6434FBC801811D76F8B7B6A"><enum>(4)</enum><text>coordinate a national effort to secure and protect against critical infrastructure risks;</text> </paragraph><paragraph id="H1DC8084D32A447FEBAC80E027F9F51A6"><enum>(5)</enum><text>upon request provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and, where appropriate, provide such analyses, expertise, and other technical assistance in coordination with critical infrastructure sector specific agencies and other Federal departments and agencies;</text> </paragraph><paragraph id="H494D5D914F07438F814FB40A053EECFB"><enum>(6)</enum><text>to the extent required by law, exercise duties in coordination with sector-specific agencies;</text> </paragraph><paragraph id="H56EB5E8AA6AB497588C94EF0B27FBC5C"><enum>(7)</enum><text>maintain and utilize mechanisms for the regular and ongoing consultation and collaboration among the Agency’s Divisions to further operational coordination, integrated situational awareness, and improved integration across the Agency in accordance with this Act;</text> </paragraph><paragraph id="H96026525374F46DE9606C4E9D58AC03C"><enum>(8)</enum><text>develop, coordinate, and implement—</text> <subparagraph id="HE4166ADBD6E2463499BCE067005AA7E4"><enum>(A)</enum><text>comprehensive strategic plans for the activities of the Agency; and</text> </subparagraph><subparagraph id="H54D762DC42AA41E8A7F788FC124F4DB0"><enum>(B)</enum><text>risk assessments;</text> </subparagraph></paragraph><paragraph id="HAD5AD734E5A44FD2854AD23636FE5629"><enum>(9)</enum><text>carry out emergency communications responsibilities, in accordance with title XVIII;</text> </paragraph><paragraph id="H0D7244FFBF8E4584904F7D35DC8E4B07"><enum>(10)</enum><text display-inline="yes-display-inline">carry out cybersecurity, infrastructure security, and emergency communications stakeholder outreach and engagement; and</text> </paragraph><paragraph id="H0B42032D8BFF410FB0FBD605B1BCB226"><enum>(11)</enum><text>carry out such other duties and powers prescribed by law or delegated by the Secretary.</text> </paragraph></subsection><subsection id="HBA3B3220EB8B4C6CA9DC548503E09316"><enum>(d)</enum><header>Deputy director</header><text>There shall be in the Agency a Deputy Director of Cybersecurity and Infrastructure Security who shall—</text> <paragraph id="H0B0A0695A0494AE1B00933FB7A669F0C"><enum>(1)</enum><text>assist the Director in the management of the Agency; and</text> </paragraph><paragraph id="H495367A3792E43549E13B416CC0361E9"><enum>(2)</enum><text>report to the Director.</text> </paragraph></subsection><subsection commented="no" id="HE0AC349665EE43228FE1E85F3E140383"><enum>(e)</enum><header>Cybersecurity and infrastructure security authorities of the Secretary</header> <paragraph commented="no" id="H7F44B9CC7C084BEFA0BBF4F6F5011004"><enum>(1)</enum><header>In general</header><text display-inline="yes-display-inline">The responsibilities of the Secretary relating to cybersecurity and infrastructure security shall include the following:</text> <subparagraph commented="no" id="H93C5901781BE414296AE1935D26F1176"><enum>(A)</enum><text>To access, receive, and analyze law enforcement information, intelligence information, and other information from Federal Government agencies, State, local, tribal, and territorial government agencies (including law enforcement agencies), and private sector entities, and to integrate such information, in support of the mission responsibilities of the Department, in order to—</text> <clause commented="no" id="H6D955BF810A04D7C9C40154B5A9FDF87"><enum>(i)</enum><text>identify and assess the nature and scope of terrorist threats to the homeland;</text> </clause><clause commented="no" id="H7A9D5E5216BC43A792AB777D70964497"><enum>(ii)</enum><text>detect and identify threats of terrorism against the United States; and</text> </clause><clause commented="no" id="H00051284AE8C400B9A471D23FC1E5496"><enum>(iii)</enum><text>understand such threats in light of actual and potential vulnerabilities of the homeland.</text> </clause></subparagraph><subparagraph commented="no" id="H379BBD7A091C4981987BC7E24E50ADCF"><enum>(B)</enum><text>To carry out comprehensive assessments of the vulnerabilities of the key resources and critical infrastructure of the United States, including the performance of risk assessments to determine the risks posed by particular types of terrorist attacks within the United States (including an assessment of the probability of success of such attacks and the feasibility and potential efficacy of various countermeasures to such attacks).</text> </subparagraph><subparagraph commented="no" id="H65344B6AF12B429FB065B52336E1C691"><enum>(C)</enum><text>To integrate relevant information, analysis, and vulnerability assessments (regardless of whether such information, analysis, or assessments are provided or produced by the Department) in order to identify priorities for protective and support measures by the Department, other Federal Government agencies, State, local, tribal, and territorial government agencies and authorities, the private sector, and other entities regarding terrorist and other threats to homeland security.</text> </subparagraph><subparagraph commented="no" id="HE0C047220AE746C9B88819696A3A1357"><enum>(D)</enum><text>To ensure, pursuant to section 202, the timely and efficient access by the Department to all information necessary to discharge the responsibilities under this title, including obtaining such information from other Federal Government agencies.</text> </subparagraph><subparagraph commented="no" id="H6081489C6676448097C32202B4D156BC"><enum>(E)</enum><text>To develop a comprehensive national plan for securing the key resources and critical infrastructure of the United States, including power production, generation, and distribution systems, information technology and telecommunications systems (including satellites), electronic financial and property record storage and transmission systems, emergency preparedness communications systems, and the physical and technological assets that support such systems.</text> </subparagraph><subparagraph commented="no" id="H23BE3CDB566C4E819A8148CEA57D7210"><enum>(F)</enum><text>To recommend measures necessary to protect the key resources and critical infrastructure of the United States in coordination with other Federal Government agencies and in cooperation with State, local, tribal, and territorial government agencies and authorities, the private sector, and other entities.</text> </subparagraph><subparagraph commented="no" id="H372C42E7648641B8849A14B3429290FB"><enum>(G)</enum><text>To review, analyze, and make recommendations for improvements to the policies and procedures governing the sharing of law enforcement information, and other information relating to homeland security within the Federal Government and between Federal Government agencies and State, local, tribal, and territorial government agencies and authorities.</text> </subparagraph><subparagraph commented="no" id="HCD88758F9940423488EE53D61E65498A"><enum>(H)</enum><text>To disseminate, as appropriate, information analyzed by the Department within the Department, to other Federal Government agencies with responsibilities relating to homeland security, and to State, local, tribal, and territorial government agencies and private sector entities with such responsibilities in order to assist in the deterrence, prevention, preemption of, or response to, terrorist attacks against the United States.</text> </subparagraph><subparagraph commented="no" id="H8ECBD67DF5C443518D6694E92E5B6C2F"><enum>(I)</enum><text>To consult with State, local, tribal, and territorial government agencies and private sector entities to ensure appropriate exchanges of information, including law enforcement-related information, relating to threats of terrorism against the United States.</text> </subparagraph><subparagraph commented="no" id="HDE7FBE58F6644D5B99237A1BCA9571BF"><enum>(J)</enum><text>To ensure that any material received pursuant to this Act is protected from unauthorized disclosure and handled and used only for the performance of official duties.</text> </subparagraph><subparagraph commented="no" id="H3B82E773F5644B9BB0AC05FDBF40A5C6"><enum>(K)</enum><text>To request additional information from other Federal Government agencies, State, local, tribal, and territorial government agencies, and the private sector relating to threats of terrorism in the United States, or relating to other areas of responsibility assigned by the Secretary, including the entry into cooperative agreements through the Secretary to obtain such information.</text> </subparagraph><subparagraph commented="no" id="H0759E41BEDFD458CB42D81C484E9CFBD"><enum>(L)</enum><text>To establish and utilize, in conjunction with the chief information officer of the Department, a secure communications and information technology infrastructure, including data-mining and other advanced analytical tools, in order to access, receive, and analyze data and information in furtherance of the responsibilities under this section, and to disseminate information acquired and analyzed by the Department, as appropriate.</text> </subparagraph><subparagraph commented="no" id="H520C14AB250949FD9515B0F8333A9959"><enum>(M)</enum><text>To ensure, in conjunction with the chief information officer of the Department, that any information databases and analytical tools developed or utilized by the Department—</text> <clause commented="no" id="H14C084F2397F4D42B4A51DE618EEED3F"><enum>(i)</enum><text>are compatible with one another and with relevant information databases of other Federal Government agencies; and</text> </clause><clause commented="no" id="H89424F151BD94B1892BBE098BDF85AF4"><enum>(ii)</enum><text>treat information in such databases in a manner that complies with applicable Federal law on privacy.</text> </clause></subparagraph><subparagraph commented="no" id="H4E6059C101054229854B3077FE738499"><enum>(N)</enum><text>To coordinate training and other support to the elements and personnel of the Department, other Federal Government agencies, and State, local, tribal, and territorial government agencies that provide information to the Department, or are consumers of information provided by the Department, in order to facilitate the identification and sharing of information revealed in their ordinary duties and the optimal utilization of information received from the Department.</text> </subparagraph><subparagraph commented="no" id="HF52D10D2D5424811B88566A98ABAE4E7"><enum>(O)</enum><text>To coordinate with Federal, State, local, tribal, and territorial law enforcement agencies, and the private sector, as appropriate.</text> </subparagraph><subparagraph commented="no" id="H793574E9DD0247D2A33FB1C446B35B29"><enum>(P)</enum><text>To exercise the authorities and oversight of the functions, personnel, assets, and liabilities of those components transferred to the Department pursuant to section 201(g).</text> </subparagraph><subparagraph commented="no" id="H526156FABE134E58884354FA2CAF1E5A"><enum>(Q)</enum><text>To carry out the functions of the national cybersecurity and communications integration center under section 2209.</text> </subparagraph><subparagraph id="HBEEC529F4FAC46B1AA863CF99ABD1036"><enum>(R)</enum><text>To carry out requirements of the Chemical Facilities Anti-Terrorism Standards Program established under title XXI and the secure handling of ammonium nitrate established under subtitle J of title VIII.</text> </subparagraph></paragraph><paragraph commented="no" id="H96638A359DB34ABEB20F8D74ACCF487E"><enum>(2)</enum><header>Modification</header><text>The Secretary may modify the functions specified in sections 2203(b) and 2204(b) upon certifying to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate 60 days prior to any such modification that such modification is necessary for carrying out the activities of the Agency.</text> </paragraph><paragraph commented="no" id="HF4769B88284A4E219EBA006DA42E8CA1"><enum>(3)</enum><header>Staff</header> <subparagraph commented="no" id="HFAAE5BFA88A64B77B46D77BC0DFC1560"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">The Secretary shall provide the Agency with a staff of analysts having appropriate expertise and experience to assist the Agency in discharging its responsibilities under this section.</text> </subparagraph><subparagraph commented="no" id="H80DDBD271D2A434ABFA27377DF8D1568"><enum>(B)</enum><header>Private sector analysts</header><text display-inline="yes-display-inline">Analysts under this subsection may include analysts from the private sector.</text> </subparagraph><subparagraph commented="no" id="H31C7DCC9B216497A88251B468DF986A9"><enum>(C)</enum><header>Security clearances</header><text display-inline="yes-display-inline">Analysts under this subsection shall possess security clearances appropriate for their work under this section.</text> </subparagraph></paragraph><paragraph commented="no" id="HEF70D53673BD4EBCB974048691DF5F63"><enum>(4)</enum><header>Detail of personnel</header> <subparagraph commented="no" id="H9D2FD4A757BC40F4A0C48CC0C1D3F63C"><enum>(A)</enum><header>In general</header><text display-inline="yes-display-inline">In order to assist the Agency in discharging its responsibilities under this section, personnel of the Federal agencies referred to in subparagraph (B) may be detailed to the Agency for the performance of analytic functions and related duties.</text> </subparagraph><subparagraph commented="no" id="H2D098556235B4B2083A6678E052760B0"><enum>(B)</enum><header>Agencies specified</header><text display-inline="yes-display-inline">The Federal agencies referred to in subparagraph (A) are the following:</text> <clause commented="no" id="HF1F262556A4241ADB791BE1760E3C78A"><enum>(i)</enum><text>The Department of State.</text> </clause><clause commented="no" id="H69877F535DFF40318755E8C58FB28E20"><enum>(ii)</enum><text>The Central Intelligence Agency.</text> </clause><clause commented="no" id="H19A7753CB27948EC944C26D7A25A3F36"><enum>(iii)</enum><text>The Federal Bureau of Investigation.</text> </clause><clause commented="no" id="HFB1910A49C334486982F9E1EC64A1081"><enum>(iv)</enum><text>The National Security Agency.</text> </clause><clause commented="no" id="HEC3B00C6963448609A2D7126BF74EDC2"><enum>(v)</enum><text>The National Geospatial-Intelligence Agency.</text> </clause><clause commented="no" id="H718A53C21C9B455A8623CFBF27EC0AA2"><enum>(vi)</enum><text>The Defense Intelligence Agency.</text> </clause><clause commented="no" id="HD88131AF563E4295A92ECEA07C6099B2"><enum>(vii)</enum><text>Any other agency of the Federal Government that the President considers appropriate.</text> </clause></subparagraph><subparagraph commented="no" id="H55347B825CB54E80B07280585F7498EC"><enum>(C)</enum><header>Interagency agreements</header><text display-inline="yes-display-inline">The Secretary and the head of an agency specified in subparagraph (B) may enter into agreements for the purpose of detailing personnel under this paragraph.</text> </subparagraph><subparagraph commented="no" id="H3E7AF38379994ECB9BD7328D772C6DC2"><enum>(D)</enum><header>Basis</header><text display-inline="yes-display-inline">The detail of personnel under this paragraph may be on a reimbursable or non-reimbursable basis.</text> </subparagraph></paragraph></subsection><subsection id="H2474EC5A3CD8406E923C407CD67C5353"><enum>(f)</enum><header>Composition</header><text>The Agency shall be composed of the following divisions:</text> <paragraph id="H9CAA99F2825546D4A736BBAF14017D06"><enum>(1)</enum><text>The Cybersecurity Division, headed by an Assistant Director.</text> </paragraph><paragraph id="HFD90D5D24F3A4C74AB67876055683CA8"><enum>(2)</enum><text>The Infrastructure Security Division, headed by an Assistant Director.</text> </paragraph><paragraph id="H5075271453B74FCFB93DB982F3AC86D4"><enum>(3)</enum><text>The Emergency Communications Division under title XVIII, headed by an Assistant Director.</text> </paragraph></subsection><subsection id="H1547E0243E8740B798D4E5C977272086"><enum>(g)</enum><header>Co-Location</header><text display-inline="yes-display-inline">To the maximum extent practicable, the Director shall examine the establishment of central locations in geographical regions with a significant Agency presence. When establishing such locations, the Director shall coordinate with component heads and the Under Secretary for Management to co-locate or partner on any new real property leases, renewing any existing leases, or agreeing to extend or newly occupy any Federal space or new construction.</text> </subsection><subsection id="H4F22ACE5EC914AAEB3053B81F04E3DCB"><enum>(h)</enum><header>Privacy</header> <paragraph id="H844497C3FF6E400DBB8D56E7AC9BF09C"><enum>(1)</enum><header>In general</header><text>There shall be a Privacy Officer of the Agency with primary responsibility for privacy policy and compliance for the Agency.</text> </paragraph><paragraph id="HF8AEB442FCAE4CC79D1619364361E4D4"><enum>(2)</enum><header>Responsibilities</header><text>The responsibilities of the Privacy Officer of the Agency shall include—</text> <subparagraph id="H4597FC60481346BC82CD64F213F77EBF"><enum>(A)</enum><text>assuring that the use of technologies by the Agency sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of personal information;</text> </subparagraph><subparagraph id="HE0AFE7ABCC6F4F8F8C2FE09BD23E658A"><enum>(B)</enum><text>assuring that personal information contained in Privacy Act systems of records of the Agency is handled in full compliance with fair information practices as specified in the Privacy Act of 1974;</text> </subparagraph><subparagraph id="H8BAB151F3FD048D4A58BC1CE22F4E00B"><enum>(C)</enum><text>evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Agency; and</text> </subparagraph><subparagraph id="H7F042D9439214E05929E8CC9AC097139"><enum>(D)</enum><text>conducting a privacy impact assessment of proposed rules of the Agency on the privacy of personal information, including the type of personal information collected and the number of people affected.</text> </subparagraph></paragraph></subsection><subsection id="H8C2A87F0E1D24498A8AEA78E49B633FF"><enum>(i)</enum><header>Savings</header><text>Nothing in this title may be construed as affecting in any manner the authority, existing on the day before the date of the enactment of this title, of any other component of the Department or any other Federal department or agency.</text> </subsection></section><section id="H562229EB0C9E4D6DB51053A184E40B28"><enum>2203.</enum><header>Cybersecurity Division</header> <subsection id="HDAD03D0204C84F2A96D052BABF7429F2"><enum>(a)</enum><header>Establishment</header> <paragraph id="H0F913363114F4DD097835715315EE5F9"><enum>(1)</enum><header>In general</header><text>There is established in the Agency a Cybersecurity Division.</text> </paragraph><paragraph id="H57E09B31ABBB43D19BF7C23AAF1CFA70"><enum>(2)</enum><header>Assistant Director</header><text>The Cybersecurity Division shall be headed by an Assistant Director for Cybersecurity (in this subtitle referred to as the <quote>Assistant Director</quote>), who shall—</text> <subparagraph id="HBFBB0C6410B64E7B9CBDB5C41A0E317E"><enum>(A)</enum><text>be at the level of Assistant Secretary within the Department; and</text> </subparagraph><subparagraph id="HC3766C03432C4A1DABFC601146A7FDEF"><enum>(B)</enum><text>report to the Director.</text> </subparagraph></paragraph><paragraph id="HE198304CA1EE4AF5968F7F9613521C9E"><enum>(3)</enum><header>Reference</header><text>Any reference to the Assistant Secretary for Cybersecurity and Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Cybersecurity.</text> </paragraph></subsection><subsection commented="no" id="H0EA4024C59924A9EAF816FF6D90AE715"><enum>(b)</enum><header>Functions</header><text>The Assistant Director shall—</text> <paragraph commented="no" id="H99B90DA9B2B1407498D1EC558F743689"><enum>(1)</enum><text>direct the cybersecurity efforts of the Agency;</text> </paragraph><paragraph commented="no" id="H1F70CB680D754C25A0F1D399A0654797"><enum>(2)</enum><text>carry out activities, at the direction of the Director, related to the security of information and information systems for Federal entities consistent with law, including subchapter II of <external-xref legal-doc="usc-chapter" parsable-cite="usc-chapter/44/35">chapter 35</external-xref> of title 44, United States Code, and the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<external-xref legal-doc="public-law" parsable-cite="pl/114/113">Public Law 114–113</external-xref>));</text> </paragraph><paragraph commented="no" id="HA34DFDFDBDFE49FB873790AF6A73A83E"><enum>(3)</enum><text>fully participate in the mechanisms required under subsection (c)(7) of section 2202; and</text> </paragraph><paragraph commented="no" id="H71C8C2A0AF044610937BA58B995F386A"><enum>(4)</enum><text>carry out such other duties and powers as prescribed by the Director.</text> </paragraph></subsection></section><section id="HE61946E84EC64C6593885D5E5AD41656"><enum>2204.</enum><header>Infrastructure Security Division</header> <subsection id="H3F0D5F9534CD4295BF9D39A1EEE408B5"><enum>(a)</enum><header>Establishment</header> <paragraph id="H7928726F0B2D4A2FA5919DC4098B40DB"><enum>(1)</enum><header>In general</header><text>There is established in the Agency an Infrastructure Security Division.</text> </paragraph><paragraph id="H46BA27FC917A4E0281311C892DA11A19"><enum>(2)</enum><header>Assistant Director</header><text>The Infrastructure Security Division shall be headed by an Assistant Director of Infrastructure Security (in this section referred to as the <quote>Assistant Director</quote>), who shall—</text> <subparagraph id="HBC8DD0874255494494F36DFD7C9EE3A4"><enum>(A)</enum><text display-inline="yes-display-inline">be at the level of Assistant Secretary within the Department; and</text> </subparagraph><subparagraph id="H6EE46FBB91FD4DC6BDEAFFAD622B5F20"><enum>(B)</enum><text>report to the Director.</text> </subparagraph></paragraph><paragraph id="H895D5C8739124E3591B97DD3FC10FDF6"><enum>(3)</enum><header>Reference</header><text>Any reference to the Assistant Secretary for Infrastructure Protection in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Infrastructure Security.</text> </paragraph></subsection><subsection id="H6F017C61EFD142EE866F8501E9DE0D51"><enum>(b)</enum><header>Functions</header><text>The Assistant Director shall—</text> <paragraph id="HC4D645D3F6FB44F68B6731FA418C98D6"><enum>(1)</enum><text>direct the critical infrastructure security efforts of the Agency;</text> </paragraph><paragraph id="H4233F159042A488DAA17E8FF67230F4A"><enum>(2)</enum><text display-inline="yes-display-inline">carry out efforts, at the direction of the Director, to secure the United States high-risk chemicals and chemical facilities consistent with law, including the Chemical Facilities Anti-Terrorism Standards Program established under title XXI and the secure handling of ammonium nitrate established under subtitle J of title VIII;</text> </paragraph><paragraph id="HBF8E40B260C341BAAD860BD6C9BDC038"><enum>(3)</enum><text>fully participate in the mechanisms required under subsection (c)(7) of section 2202; and</text> </paragraph><paragraph id="HB80C142CCFBE4932AE9037522F834DF1"><enum>(4)</enum><text>carry out such other duties and powers as prescribed by the Director.</text></paragraph></subsection></section></subtitle>. (b)
Treatment of certain positions
(1)
Under Secretary
The individual serving as the Under Secretary appointed pursuant to section 103(a)(1)(H) of the Homeland Security Act of 2002 (6 U.S.C. 113(a)(1)) of the Department of Homeland Security on the day before the date of the enactment of this Act may continue to serve as the Director of the Cybersecurity and Infrastructure Security Agency of the Department on and after such date. (2)
Director for Emergency Communications
The individual serving as the Director for Emergency Communications of the Department of Homeland Security on the day before the date of the enactment of this Act may continue to serve as the Assistant Director for Emergency Communications of the Department on and after such date. (3)
Assistant Secretary for Cybersecurity and Communications
The individual serving as the Assistant Secretary for Cybersecurity and Communications on the day before the date of the enactment of this Act may continue to serve as the Assistant Director for Cybersecurity on and after such date. (4)
Assistant Secretary for Infrastructure Security
The individual serving as the Assistant Secretary for Infrastructure Protection on the day before the date of the enactment of this Act may continue to serve as the Assistant Director for Infrastructure Security on and after such date. (c)
Reference
Any reference to— (1)the Office of Emergency Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Emergency Communications Division; and (2)the Director for Emergency Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Emergency Communications. (d)
Oversight
The Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall provide to Congress, in accordance with the deadlines specified in paragraphs (1) and (2), information on the following: (1)Not later than 90 days after the date of the enactment of this Act, information on the Agency’s mechanisms for regular and ongoing consultation and collaboration, as required pursuant to section 2202(c)(7) of the Homeland Security Act of 2002 (as added by this Act). (2)Not later than one year after the date of the enactment of this Act, the activities of the Agency’s consultation and collaboration mechanisms and how such mechanisms have impacted operational coordination, situational awareness, and integration across the Agency. (e)
Cyber workforce
Not later than 90 days after the date of the enactment of this subtitle, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall submit to Congress a report detailing how the Agency is meeting legislative requirements under the Cybersecurity Workforce Assessment Act (Public Law 113–246) and the Homeland Security Cybersecurity Workforce Assessment Act (enacted as section 4 of the Border Patrol Agent Pay Reform Act of 2014; Public Law 113–277) to address cyber workforce needs. (f)
Facility
Not later than 180 days after the date of the enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall report to Congress on the most efficient and effective methods of consolidating Agency facilities, personnel, and programs to most effectively carry out the Agency’s mission. (g)
Conforming amendments to the Homeland Security Act of 2002
The Homeland Security Act of 2002 is amended— (1)in title I, by amending subparagraph (H) of section 103(a)(1) (6 U.S.C. 113(a)(1)) to read as follows: (H)A Director of the Cybersecurity and Infrastructure Security Agency.; (2)in title II (6 U.S.C. 121 et seq.)— (A)in the title heading, by striking and infrastructure protection; (B)in the subtitle A heading, by striking and infrastructure protection; (C)in section 201 (6 U.S.C. 121)— (i)in the section heading, by striking and infrastructure protection; (ii)in subsection (a)— (I)in the heading, by striking and infrastructure protection; and (II)by striking and an Office of Infrastructure Protection; (iii)in subsection (b)— (I)in the heading, by striking and Assistant Secretary for Infrastructure Protection; and (II)by striking paragraph (3); (iv)in subsection (c)— (I)by striking and infrastructure protection; and (II)by striking or the Assistant Secretary for Infrastructure Protection, as appropriate; (v)in subsection (d)— (I)in the heading, by striking and infrastructure protection; (II)in the matter preceding paragraph (1), by striking and infrastructure protection; (III)by striking paragraphs (5) and (6) and redesignating paragraphs (7) through (26) as paragraphs (5) through (24), respectively; (IV)by striking paragraph (23), as so redesignated; and (V)by redesignating paragraph (24), as so redesignated, as paragraph (23); (vi)in subsection (e)(1), by striking and the Office of Infrastructure Protection; and (vii)in subsection (f)(1), by striking and the Office of Infrastructure Protection; (D)in section 204 (6 U.S.C. 124a)— (i)in subsection (c)(1), in the matter preceding subparagraph (A), by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; and (ii)in subsection (d)(1), in the matter preceding subparagraph (A), by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; (E)in subparagraph (B) of section 210A(c)(2) (6 U.S.C. 124h(c)(2)), by striking Office of Infrastructure Protection and inserting Cybersecurity and Infrastructure Security Agency; (F)by transferring section 210E (6 U.S.C. 124) to appear after section 2212 (as redesignated by subparagraph (G) of this paragraph) and redesignating such section 210E as section 2214; (G)in subtitle B, by redesignating sections 211 through 215 (6 U.S.C. 101 note through 134) as sections 2221 through 2225, respectively, and inserting such redesignated sections, including the enumerator and heading of subtitle B (containing such redesignated sections), after section 2213, as redesignated by subparagraph (E) of this paragraph; and (H)by redesignating sections 223 through 230 (6 U.S.C. 143 through 151) as sections 2205 through 2213, respectively, and inserting such redesignated sections after section 2204, as added by this Act; (3)in title III, in paragraph (3) of section 302 (6 U.S.C. 182), by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; (4)in title V— (A)in section 514 (6 U.S.C. 321(c)), by— (i)striking subsection (b); and (ii)redesignating subsection (c) as subsection (b); (B)in section 523 (6 U.S.C. 321I)— (i)in subsection (a), in the matter preceding paragraph (1), by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; and (ii)in subsection (c), by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; and (C)in section 524(a)(2)(B) (6 U.S.C. 321m(a)(2)(B)), in the matter preceding clause (i)— (i)by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; and (ii)by striking of the Assistant Secretary and inserting of the Director; (5)in title VIII, in section 899B(a) (6 U.S.C. 488a(a)), by inserting at the end the following new sentence: Such regulations shall be carried out by the Cybersecurity and Infrastructure Security Agency.; (6)in title XVIII (6 U.S.C. 571 et seq.)— (A)in section 1801 (6 U.S.C. 571)— (i)in the section heading, by striking Office of Emergency Communications and inserting Emergency Communications Division; (ii)in subsection (a)— (I)by striking Office of Emergency Communications and inserting Emergency Communications Division; and (II)by adding at the end the following new sentence: The Division shall be located in the Cybersecurity and Infrastructure Security Agency.; (iii)in subsection (b)— (I)in the first sentence, by inserting Assistant before Director; and (II)in the second sentence, by striking Assistant Secretary for Cybersecurity and Communications and inserting Director of the Cybersecurity and Infrastructure Security Agency; (iv)in subsection (c)— (I)in the matter preceding paragraph (1), by inserting Assistant before Director; (II)in paragraph (14), by striking and at the end; (III)by redesignating paragraph (15) as paragraph (16); and (IV)by inserting after paragraph (14) the following new paragraph: (15)fully participate in the mechanisms required under subsection (c)(7) of section 2202; and; (v)in subsection (d), by inserting Assistant before Director; and (vi)in subsection (e), in the matter preceding paragraph (1), by inserting Assistant before Director; (B)in sections 1802 through 1805 (6 U.S.C. 575), by striking Director for Emergency Communications each place it appears and inserting Assistant Director for Emergency Communications; (C)in section 1809 (6 U.S.C. 579)— (i)by striking Director for Emergency Communications and inserting Assistant Director for Emergency Communications; and (ii)by striking Office of Emergency Communications each place it appears and inserting Emergency Communications Division; and (D)in section 1810 (6 U.S.C. 580)— (i)in subsection (a)(1), by striking Director of the Office of Emergency Communications (referred to in this section as the Director) and inserting Assistant Director for the Emergency Communications Division (referred to in this section as the Assistant Director); (ii)in subsection (c), by striking Office of Emergency Communications and inserting Emergency Communications Division; and (iii)by striking Director each place it appears and inserting Assistant Director; (7)in title XXI (6 U.S.C. 621 et seq.)— (A)in section 2101 (6 U.S.C. 621)— (i)by redesignating paragraphs (4) through (14) as paragraphs (5) through (15), respectively; and (ii)by inserting after paragraph (3) the following new paragraph: (4)the term Director means the Director of the Cybersecurity and Infrastructure Security Agency;; (B)in paragraph (1) of section 2102(a) (6 U.S.C. 622(a)), by inserting at the end the following new sentence: Such Program shall be located in the Cybersecurity and Infrastructure Security Agency.; and (C)in paragraph (2) of section 2104(c) (6 U.S.C. 624(c)), by striking Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department appointed under section 103(a)(1)(H) and inserting Director of the Cybersecurity and Infrastructure Security Agency ; and (8)in title XXII, as added by this Act— (A)in section 2205, as so redesignated, in the matter preceding paragraph (1), by striking Under Secretary appointed under section 103(a)(1)(H) and inserting Director of the Cybersecurity and Infrastructure Security Agency; (B)in section 2206, as so redesignated, by striking Assistant Secretary for Infrastructure Protection and inserting Director of the Cybersecurity and Infrastructure Security Agency; (C)in section 2209, as so redesignated— (i)by striking Under Secretary appointed under section 103(a)(1)(H) each place it appears and inserting Director of the Cybersecurity and Infrastructure Security Agency; (ii)in subsection (b), by adding at the end the following new sentences: The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Assistant Director for Cybersecurity.; and (iii)in subsection (c)(11), by striking Office of Emergency Communications and inserting Emergency Communications Division; (D)in section 2210, as so redesignated— (i)by striking section 227 each place it appears and inserting section 2209; and (ii)in subsection (c), by striking Under Secretary appointed under section 103(a)(1)(H) and inserting Director of the Cybersecurity and Infrastructure Security Agency; (E)in section 2211, as so redesignated, by striking section 212(5) and inserting section 2215(5); and (F)in section 2212, as so redesignated, in subsection (a)— (i)in paragraph (3), by striking section 228 and inserting section 2210; and (ii)in paragraph (4), by striking section 227 and inserting section 2209. (h)
Conforming amendment to title 5, United States Code
Section 5314 of title 5, United States Code, is amended by inserting after Under Secretaries, Department of Homeland Security. the following new item: Director, Cybersecurity and Infrastructure Security Agency.. (i)
Clerical amendments
The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended— (1)in title II— (A)in the item relating to the title heading, by striking AND INFRASTRUCTURE PROTECTION; (B)in the item relating to the heading of subtitle A, by striking and Infrastructure Protection; (C)in the item relating to section 201, by striking and Infrastructure Protection; (D)by striking the item relating to section 210E; (E)by striking the items relating to subtitle B of title II; and (F)by striking the items relating to section 223 through section 230; and (2)by adding at the end the following new items: TITLE XXII—CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY Subtitle A—Cybersecurity and Infrastructure Security Sec. 2201. Definitions. Sec. 2202. Cybersecurity and Infrastructure Security Agency. Sec. 2203. Cybersecurity Division. Sec. 2204. Infrastructure Security Division. Sec. 2205. Enhancement of Federal and non-Federal cybersecurity. Sec. 2206. Net guard. Sec. 2207. Cybersecurity Enhancement Act of 2002. Sec. 2208. Cybersecurity recruitment and retention. Sec. 2209. National cybersecurity and communications integration center. Sec. 2210. Cybersecurity plans. Sec. 2211. Cybersecurity strategy. Sec. 2212. Clearances. Sec. 2213. Federal intrusion detection and prevention system. Sec. 2214. National Asset Database. Subtitle B—Critical Infrastructure Information Sec. 2221. Short title. Sec. 2222. Definitions. Sec. 2223. Designation of critical infrastructure protection program. Sec. 2224. Protection of voluntarily shared critical infrastructure information. Sec. 2225. No private right of action..
3.
Transfer of other entities
(a)
Office of Biometric Identity Management
The Office of Biometric Identity Management of the Department of Homeland Security located in the National Protection and Programs Directorate of the Department of Homeland Security on the day before the date of the enactment of this Act is hereby transferred to the Management Directorate of the Department. (b)
Federal Protective Service
The Secretary of Homeland Security is authorized to transfer the Federal Protective Service, as authorized under section 1315 of title 40, United States Code, to any component, directorate, or other office of the Department of Homeland Security that the Secretary determines appropriate.
4.
Rule of construction
Nothing in this Act may be construed as— (1)conferring new authorities to the Secretary of Homeland Security, including programmatic, regulatory, or enforcement authorities, outside of the authorities in existence on the day before the date of the enactment of this Act; (2)reducing or limiting the programmatic, regulatory, or enforcement authority vested in any other Federal agency by statute; or (3)affecting in any manner the authority, existing on the day before the date of the enactment of this Act, of any other Federal agency or component of the Department of Homeland Security.
5.
Prohibition on additional funding
No additional funds are authorized to be appropriated to carry out this Act or the amendments made by this Act. This Act and such amendments shall be carried out using amounts otherwise authorized.
December 11, 2017 Reported from the Committee on Homeland SecurityDecember 11, 2017The Committees on Energy and Commerce, Oversight and Government Reform, and Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed