Public Law 115–278: To amend the Homeland Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes. Public Law278 Public Law 115–278132 Stat. 4168 2018-11-16 2018-11-16 United States Government Publishing OfficeNational Archives and Records AdministrationOffice of the Federal Registertext/xmlENPursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain. GPO Locator to USLM Converter 4.15.31;Stage2.202507022026-01-02 115public ?4167PUBLIC LAW 115–278—NOV. 16, 2018 CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY ACT OF 2018 132 STAT. 4168 Public Law115–278 115th Congress
An Act To amend the Homeland Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes.

Nov. 16, 2018

[H.R. 3359]

   Be it enacted by the Senate and House of Representa­tives of the United States of America in Congress assembled,

Cybersecurity and Infrastructure Security Agency Act of 2018.
SECTION 1.

6 USC 101 note.

SHORT TITLE.  This Act may be cited as the “Cybersecurity and Infrastructure Security Agency Act of 2018”.
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY.(a) In General.—The Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended by adding at the end the following:<num class="fontsize14 bold" value="XXII">“TITLE XXII—</num><heading class="fontsize14 bold">CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY</heading><subtitle id="y6fc7e529-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658178"><num class="fontsize14 bold" value="A">“Subtitle A—</num><heading class="fontsize14 bold">Cybersecurity and Infrastructure Security</heading><section class="indentUp2 firstIndent-2" id="y6fc7e52a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658144"><num class="bold" value="2201">“SEC. 2201. </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc7e52b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180"><ref href="/us/usc/t6/s651">6 USC 651</ref>.</p></sidenote><heading class="bold">DEFINITIONS.</heading><chapeau class=" fontsize10" style="-uslm-lc:I658120">  “In this subtitle:</chapeau><paragraph class="indentDown1 fontsize10" id="y6fc7e52c-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">Critical infrastructure information</inline>.—</heading><content>The term ‘<term>critical infrastructure information</term>’ has the meaning given the term in section 2222.</content></paragraph> <paragraph class="indentDown1 fontsize10" id="y6fc7e52d-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Cybersecurity risk</inline>.—</heading><content>The term ‘<term>cybersecurity risk</term>’ has the meaning given the term in section 2209.</content></paragraph> <paragraph class="indentDown1 fontsize10" id="y6fc7e52e-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><heading class="fontsize10"><inline class="smallCaps">Cybersecurity threat</inline>.—</heading><content>The term ‘<term>cybersecurity threat</term>’ has the meaning given the term in section 102(5) of the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<ref href="/us/pl/114/113">Public Law 114–113</ref>; <ref href="/us/usc/t6/s1501">6 U.S.C. 1501</ref>)).</content></paragraph> <paragraph class="indentDown1 fontsize10" id="y6fc7e52f-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="4">“(4) </num><heading class="fontsize10"><inline class="smallCaps">National cybersecurity asset response activities</inline>.—</heading><chapeau>The term ‘<term>national cybersecurity asset response activities</term>’ means—</chapeau><subparagraph class="fontsize10" id="y6fc7e530-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><content>furnishing cybersecurity technical assistance to entities affected by cybersecurity risks to protect assets, mitigate vulnerabilities, and reduce impacts of cyber incidents;</content></subparagraph> <subparagraph class="fontsize10" id="y6fc7e531-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><content>identifying other entities that may be at risk of an incident and assessing risk to the same or similar vulnerabilities;<page identifier="/us/stat/132/4169">132 STAT. 4169</page></content></subparagraph> <subparagraph class="fontsize10" id="y6fc7e532-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><content>assessing potential cybersecurity risks to a sector or region, including potential cascading effects, and developing courses of action to mitigate such risks;</content></subparagraph> <subparagraph class="fontsize10" id="y6fc7e533-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="D">“(D) </num><content>facilitating information sharing and operational coordination with threat response; and</content></subparagraph> <subparagraph class="fontsize10" id="y6fc7e534-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="E">“(E) </num><content>providing guidance on how best to utilize Federal resources and capabilities in a timely, effective manner to speed recovery from cybersecurity risks.</content></subparagraph> </paragraph> <paragraph class="indentDown1 fontsize10" id="y6fc7e535-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="5">“(5) </num><heading class="fontsize10"><inline class="smallCaps">Sector-specific agency</inline>.—</heading><content>The term ‘<term>Sector-Specific Agency</term>’ means a Federal department or agency, designated by law or presidential directive, with responsibility for providing institutional knowledge and specialized expertise of a sector, as well as leading, facilitating, or supporting programs and associated activities of its designated critical infrastructure sector in the all hazards environment in coordination with the Department.</content></paragraph> <paragraph class="indentDown1 fontsize10" id="y6fc7e536-e834-11f0-a1e4-69761a48a15a" role="definitions" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="6">“(6) </num><heading class="fontsize10"><inline class="smallCaps">Sharing</inline>.—</heading><content>The term ‘<term>sharing</term>’ has the meaning given the term in section 2209.</content></paragraph> </section> <section class="indentUp2 firstIndent-2" id="y6fc7e537-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658144"><num class="bold" value="2202">“SEC. 2202. </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc7e538-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180"><ref href="/us/usc/t6/s652">6 USC 652</ref>.</p></sidenote><heading class="bold">CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY.</heading><subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc7e539-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="a">“(a) </num><heading class="fontsize10"><inline class="smallCaps">Redesignation</inline>.—</heading><paragraph class="fontsize10" id="y6fc7e53a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>The National Protection and Programs Directorate of the Department shall, on and after the date of the enactment of this subtitle, be known as the ‘Cybersecurity and Infrastructure Security Agency’ (in this subtitle referred to as the ‘Agency’).</content></paragraph> <paragraph class="fontsize10" id="y6fc7e53b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">References</inline>.—</heading><content>Any reference to the National Protection and Programs Directorate of the Department in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Cybersecurity and Infrastructure Security Agency of the Department.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc7e53c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="b">“(b) </num><heading class="fontsize10"><inline class="smallCaps">Director</inline>.—</heading><paragraph class="fontsize10" id="y6fc7e53d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>The Agency shall be headed by a Director of Cybersecurity and Infrastructure Security (in this subtitle referred to as the ‘Director’), who shall report to the Secretary.</content></paragraph> <paragraph class="fontsize10" id="y6fc7e53e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Reference</inline>.—</heading><content>Any reference to an Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and any other related program of the Department as described in section 103(a)(1)(H) as in effect on the day before the date of enactment of this subtitle in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Director of Cybersecurity and Infrastructure Security of the Department.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc7e53f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="c">“(c) </num><heading class="fontsize10"><inline class="smallCaps">Responsibilities</inline><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc7e540-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Coordination.</p></sidenote>.—</heading><chapeau>The Director shall—</chapeau><paragraph class="fontsize10" id="y6fc7e541-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><content>lead cybersecurity and critical infrastructure security programs, operations, and associated policy for the Agency, including national cybersecurity asset response activities;</content></paragraph> <paragraph class="fontsize10" id="y6fc7e542-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><content>coordinate with Federal entities, including Sector-Specific Agencies, and non-Federal entities, including international entities, to carry out the cybersecurity and critical infrastructure activities of the Agency, as appropriate;</content></paragraph> <paragraph class="fontsize10" id="y6fc7e543-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><content>carry out the responsibilities of the Secretary to secure Federal information and information systems consistent with law, including <ref href="/us/usc/t44/ch35/schII">subchapter II of chapter 35 of title 44, United States Code</ref>, and the Cybersecurity Act of 2015 (contained <page identifier="/us/stat/132/4170">132 STAT. 4170</page> in division N of the Consolidated Appropriations Act, 2016 (<ref href="/us/pl/114/113">Public Law 114–113</ref>));</content></paragraph> <paragraph class="fontsize10" id="y6fc80c54-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="4">“(4) </num><content>coordinate a national effort to secure and protect against critical infrastructure risks, consistent with subsection (e)(1)(E);</content></paragraph> <paragraph class="fontsize10" id="y6fc80c55-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="5">“(5) </num><content>upon request, provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and, where appropriate, provide those analyses, expertise, and other technical assistance in coordination with Sector-Specific Agencies and other Federal departments and agencies;</content></paragraph> <paragraph class="fontsize10" id="y6fc80c56-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="6">“(6) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c57-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Collaboration.</p></sidenote><content>develop and utilize mechanisms for active and frequent collaboration between the Agency and Sector-Specific Agencies to ensure appropriate coordination, situational awareness, and communications with Sector-Specific Agencies;</content></paragraph> <paragraph class="fontsize10" id="y6fc80c58-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="7">“(7) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c59-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Consultation.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c5a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Collaboration.</p></sidenote><content>maintain and utilize mechanisms for the regular and ongoing consultation and collaboration among the Divisions of the Agency to further operational coordination, integrated situational awareness, and improved integration across the Agency in accordance with this Act;</content></paragraph> <paragraph class="fontsize10" id="y6fc80c5b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="8">“(8) </num><chapeau>develop, coordinate, and implement—</chapeau><subparagraph class="fontsize10" id="y6fc80c5c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c5d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Strategic plans.</p></sidenote><content>comprehensive strategic plans for the activities of the Agency; and</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c5e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c5f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Risk assessments.</p></sidenote><content>risk assessments by and for the Agency;</content></subparagraph> </paragraph> <paragraph class="fontsize10" id="y6fc80c60-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="9">“(9) </num><content>carry out emergency communications responsibilities, in accordance with title XVIII;</content></paragraph> <paragraph class="fontsize10" id="y6fc80c61-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="10">“(10) </num><content>carry out cybersecurity, infrastructure security, and emergency communications stakeholder outreach and engagement and coordinate that outreach and engagement with critical infrastructure Sector-Specific Agencies, as appropriate; and</content></paragraph> <paragraph class="fontsize10" id="y6fc80c62-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="11">“(11) </num><content>carry out such other duties and powers prescribed by law or delegated by the Secretary.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc80c63-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="d">“(d) </num><heading class="fontsize10"><inline class="smallCaps">Deputy Director</inline>.—</heading><chapeau>There shall be in the Agency a Deputy Director of Cybersecurity and Infrastructure Security who shall—</chapeau><paragraph class="fontsize10" id="y6fc80c64-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><content>assist the Director in the management of the Agency; and</content></paragraph> <paragraph class="fontsize10" id="y6fc80c65-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><content>report to the Director.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc80c66-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="e">“(e) </num><heading class="fontsize10"><inline class="smallCaps">Cybersecurity and Infrastructure Security Authorities of the Secretary</inline>.—</heading><paragraph class="fontsize10" id="y6fc80c67-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><chapeau>The responsibilities of the Secretary relating to cybersecurity and infrastructure security shall include the following:</chapeau><subparagraph class="fontsize10" id="y6fc80c68-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><chapeau>To access, receive, and analyze law enforcement information, intelligence information, and other information from Federal Government agencies, State, local, tribal, and territorial government agencies, including law enforcement agencies, and private sector entities, and to integrate that information, in support of the mission responsibilities of the Department, in order to—</chapeau><clause class="fontsize10" id="y6fc80c69-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="i">“(i) </num><content>identify and assess the nature and scope of terrorist threats to the homeland;</content></clause> <clause class="fontsize10" id="y6fc80c6a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="ii">“(ii) </num><content>detect and identify threats of terrorism against the United States; and</content></clause> <clause class="fontsize10" id="y6fc80c6b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="iii">“(iii) </num><content>understand those threats in light of actual and potential vulnerabilities of the homeland.</content></clause> </subparagraph> <subparagraph class="fontsize10" id="y6fc80c6c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c6d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Assessments.</p></sidenote><content>To carry out comprehensive assessments of the vulnerabilities of the key resources and critical infrastructure of the United States, including the performance of <page identifier="/us/stat/132/4171">132 STAT. 4171</page> risk assessments to determine the risks posed by particular types of terrorist attacks within the United States, including an assessment of the probability of success of those attacks and the feasibility and potential efficacy of various countermeasures to those attacks. At the discretion of the Secretary, such assessments may be carried out in coordination with Sector-Specific Agencies.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c6e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c6f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Recommenda-</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c70-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">tions.</p></sidenote><content>To integrate relevant information, analysis, and vulnerability assessments, regardless of whether the information, analysis, or assessments are provided or produced by the Department, in order to make recommendations, including prioritization, for protective and support measures by the Department, other Federal Government agencies, State, local, tribal, and territorial government agencies and authorities, the private sector, and other entities regarding terrorist and other threats to homeland security.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c71-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="D">“(D) </num><content>To ensure, pursuant to section 202, the timely and efficient access by the Department to all information necessary to discharge the responsibilities under this title, including obtaining that information from other Federal Government agencies.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c72-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="E">“(E) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c73-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Coordination.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c74-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Plan.</p></sidenote><content>To develop, in coordination with the Sector-Specific Agencies with available expertise, a comprehensive national plan for securing the key resources and critical infrastructure of the United States, including power production, generation, and distribution systems, information technology and telecommunications systems (including satellites), electronic financial and property record storage and transmission systems, emergency communications systems, and the physical and technological assets that support those systems.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c75-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="F">“(F) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c76-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Recommenda-</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c77-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">tions.</p></sidenote><content>To recommend measures necessary to protect the key resources and critical infrastructure of the United States in coordination with other Federal Government agencies, including Sector-Specific Agencies, and in cooperation with State, local, tribal, and territorial government agencies and authorities, the private sector, and other entities.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c78-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="G">“(G) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c79-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Review.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c7a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Analysis.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c7b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Recommenda-</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c7c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">tions.</p></sidenote><content>To review, analyze, and make recommendations for improvements to the policies and procedures governing the sharing of information relating to homeland security within the Federal Government and between Federal Government agencies and State, local, tribal, and territorial government agencies and authorities.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c7d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="H">“(H) </num><content>To disseminate, as appropriate, information analyzed by the Department within the Department to other Federal Government agencies with responsibilities relating to homeland security and to State, local, tribal, and territorial government agencies and private sector entities with those responsibilities in order to assist in the deterrence, prevention, or preemption of, or response to, terrorist attacks against the United States.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c7e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="I">“(I) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c7f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Consultation.</p></sidenote><content>To consult with State, local, tribal, and territorial government agencies and private sector entities to ensure appropriate exchanges of information, including law <page identifier="/us/stat/132/4172">132 STAT. 4172</page> enforcement-related information, relating to threats of terrorism against the United States.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c80-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="J">“(J) </num><content>To ensure that any material received pursuant to this Act is protected from unauthorized disclosure and handled and used only for the performance of official duties.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c81-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="K">“(K) </num><content>To request additional information from other Federal Government agencies, State, local, tribal, and territorial government agencies, and the private sector relating to threats of terrorism in the United States, or relating to other areas of responsibility assigned by the Secretary, including the entry into cooperative agreements through the Secretary to obtain such information.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c82-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="L">“(L) </num><content>To establish and utilize, in conjunction with the Chief Information Officer of the Department, a secure communications and information technology infrastructure, including data-mining and other advanced analytical tools, in order to access, receive, and analyze data and information in furtherance of the responsibilities under this section, and to disseminate information acquired and analyzed by the Department, as appropriate.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c83-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="M">“(M) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c84-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Coordination.</p></sidenote><content>To coordinate training and other support to the elements and personnel of the Department, other Federal Government agencies, and State, local, tribal, and territorial government agencies that provide information to the Department, or are consumers of information provided by the Department, in order to facilitate the identification and sharing of information revealed in their ordinary duties and the optimal utilization of information received from the Department.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c85-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="N">“(N) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c86-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Coordination.</p></sidenote><content>To coordinate with Federal, State, local, tribal, and territorial law enforcement agencies, and the private sector, as appropriate.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c87-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="O">“(O) </num><content>To exercise the authorities and oversight of the functions, personnel, assets, and liabilities of those components transferred to the Department pursuant to section 201(g).</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c88-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="P">“(P) </num><content>To carry out the functions of the national cybersecurity and communications integration center under section 2209.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c89-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="Q">“(Q) </num><content>To carry out the requirements of the Chemical Facility Anti-Terrorism Standards Program established under title XXI and the secure handling of ammonium nitrate program established under subtitle J of title VIII, or any successor programs.</content></subparagraph> </paragraph> <paragraph class="fontsize10" id="y6fc80c8a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c8b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Certification.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c8c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Briefing.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c8d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Public information.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc80c8e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Time period.</p></sidenote><heading class="fontsize10"><inline class="smallCaps">Reallocation</inline>.—</heading><content>The Secretary may reallocate within the Agency the functions specified in sections 2203(b) and 2204(b), consistent with the responsibilities provided in paragraph (1), upon certifying to and briefing the appropriate congressional committees, and making available to the public, at least 60 days prior to the reallocation that the reallocation is necessary for carrying out the activities of the Agency.</content></paragraph> <paragraph class="fontsize10" id="y6fc80c8f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><heading class="fontsize10"><inline class="smallCaps">Staff</inline>.—</heading><subparagraph class="fontsize10" id="y6fc80c90-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>The Secretary shall provide the Agency with a staff of analysts having appropriate expertise and experience to assist the Agency in discharging the responsibilities of the Agency under this section.<page identifier="/us/stat/132/4173">132 STAT. 4173</page></content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c91-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><heading class="fontsize10"><inline class="smallCaps">Private sector analysts</inline>.—</heading><content>Analysts under this subsection may include analysts from the private sector.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c92-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><heading class="fontsize10"><inline class="smallCaps">Security clearances</inline>.—</heading><content>Analysts under this subsection shall possess security clearances appropriate for their work under this section.</content></subparagraph> </paragraph> <paragraph class="fontsize10" id="y6fc80c93-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="4">“(4) </num><heading class="fontsize10"><inline class="smallCaps">Detail of personnel</inline>.—</heading><subparagraph class="fontsize10" id="y6fc80c94-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>In order to assist the Agency in discharging the responsibilities of the Agency under this section, personnel of the Federal agencies described in subparagraph (B) may be detailed to the Agency for the performance of analytic functions and related duties.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c95-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><heading class="fontsize10"><inline class="smallCaps">Agencies</inline>.—</heading><chapeau>The Federal agencies described in this subparagraph are—</chapeau><clause class="fontsize10" id="y6fc80c96-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="i">“(i) </num><content>the Department of State;</content></clause> <clause class="fontsize10" id="y6fc80c97-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="ii">“(ii) </num><content>the Central Intelligence Agency;</content></clause> <clause class="fontsize10" id="y6fc80c98-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="iii">“(iii) </num><content>the Federal Bureau of Investigation;</content></clause> <clause class="fontsize10" id="y6fc80c99-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="iv">“(iv) </num><content>the National Security Agency;</content></clause> <clause class="fontsize10" id="y6fc80c9a-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="v">“(v) </num><content>the National Geospatial-Intelligence Agency;</content></clause> <clause class="fontsize10" id="y6fc80c9b-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="vi">“(vi) </num><content>the Defense Intelligence Agency;</content></clause> <clause class="fontsize10" id="y6fc80c9c-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="vii">“(vii) </num><content>Sector-Specific Agencies; and</content></clause> <clause class="fontsize10" id="y6fc80c9d-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658126"><num class="fontsize10" style="-uslm-lc:emspace2" value="viii">“(viii) </num><content>any other agency of the Federal Government that the President considers appropriate.</content></clause> </subparagraph> <subparagraph class="fontsize10" id="y6fc80c9e-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><heading class="fontsize10"><inline class="smallCaps">Interagency agreements</inline>.—</heading><content>The Secretary and the head of a Federal agency described in subparagraph (B) may enter into agreements for the purpose of detailing personnel under this paragraph.</content></subparagraph> <subparagraph class="fontsize10" id="y6fc80c9f-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="D">“(D) </num><heading class="fontsize10"><inline class="smallCaps">Basis</inline>.—</heading><content>The detail of personnel under this paragraph may be on a reimbursable or non-reimbursable basis.</content></subparagraph> </paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc80ca0-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="f">“(f) </num><heading class="fontsize10"><inline class="smallCaps">Composition</inline>.—</heading><chapeau>The Agency shall be composed of the following divisions:</chapeau><paragraph class="fontsize10" id="y6fc80ca1-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><content>The Cybersecurity Division, headed by an Assistant Director.</content></paragraph> <paragraph class="fontsize10" id="y6fc80ca2-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><content>The Infrastructure Security Division, headed by an Assistant Director.</content></paragraph> <paragraph class="fontsize10" id="y6fc80ca3-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><content>The Emergency Communications Division under title XVIII, headed by an Assistant Director.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc80ca4-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="g">“(g) </num><heading class="fontsize10"><inline class="smallCaps">Co-location</inline>.—</heading><paragraph class="fontsize10" id="y6fc80ca5-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>To the maximum extent practicable, the Director shall examine the establishment of central locations in geographical regions with a significant Agency presence.</content></paragraph> <paragraph class="fontsize10" id="y6fc80ca6-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Coordination</inline>.—</heading><content>When establishing the central locations described in paragraph (1), the Director shall coordinate with component heads and the Under Secretary for Management to co-locate or partner on any new real property leases, renewing any occupancy agreements for existing leases, or agreeing to extend or newly occupy any Federal space or new construction.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc80ca7-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="h">“(h) </num><heading class="fontsize10"><inline class="smallCaps">Privacy</inline>.—</heading><paragraph class="fontsize10" id="y6fc80ca8-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>There shall be a Privacy Officer of the Agency with primary responsibility for privacy policy and compliance for the Agency.</content></paragraph> <paragraph class="fontsize10" id="y6fc80ca9-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Responsibilities</inline><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc80caa-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Personal information.</p></sidenote>.—</heading><chapeau>The responsibilities of the Privacy Officer of the Agency shall include—</chapeau><subparagraph class="fontsize10" id="y6fc80cab-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><content>assuring that the use of technologies by the Agency sustain, and do not erode, privacy protections relating to the use, collection, and disclosure of personal information;<page identifier="/us/stat/132/4174">132 STAT. 4174</page></content></subparagraph> <subparagraph class="fontsize10" id="y6fc833bc-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><content>assuring that personal information contained in systems of records of the Agency is handled in full compliance as specified in <ref href="/us/usc/t5/s552a">section 552a of title 5, United States Code</ref> (commonly known as the ‘Privacy Act of 1974’);</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833bd-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833be-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Evaluation.</p></sidenote><content>evaluating legislative and regulatory proposals involving collection, use, and disclosure of personal information by the Agency; and</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833bf-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="D">“(D) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833c0-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Assessment.</p></sidenote><content>conducting a privacy impact assessment of proposed rules of the Agency on the privacy of personal information, including the type of personal information collected and the number of people affected.</content></subparagraph> </paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc833c1-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="i">“(i) </num><heading class="fontsize10"><inline class="smallCaps">Savings</inline>.—</heading><content>Nothing in this title may be construed as affecting in any manner the authority, existing on the day before the date of enactment of this title, of any other component of the Department or any other Federal department or agency, including the authority provided to the Sector-Specific Agency specified in section 61003(c) of division F of the Fixing America’s Surface Transportation Act (<ref href="/us/usc/t6/s121">6 U.S.C. 121 note</ref>; <ref href="/us/pl/114/94">Public Law 114–94</ref>).</content></subsection> </section> <section class="indentUp2 firstIndent-2" id="y6fc833c2-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658144"><num class="bold" value="2203">“SEC. 2203. </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833c3-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180"><ref href="/us/usc/t6/s653">6 USC 653</ref>.</p></sidenote><heading class="bold">CYBERSECURITY DIVISION.</heading><subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc833c4-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="a">“(a) </num><heading class="fontsize10"><inline class="smallCaps">Establishment</inline>.—</heading><paragraph class="fontsize10" id="y6fc833c5-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>There is established in the Agency a Cybersecurity Division.</content></paragraph> <paragraph class="fontsize10" id="y6fc833c6-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Assistant director</inline>.—</heading><chapeau>The Cybersecurity Division shall be headed by an Assistant Director for Cybersecurity (in this section referred to as the ‘Assistant Director’), who shall—</chapeau><subparagraph class="fontsize10" id="y6fc833c7-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><content>be at the level of Assistant Secretary within the Department;</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833c8-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833c9-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Appointment.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc833ca-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">President.</p></sidenote><content>be appointed by the President without the advice and consent of the Senate; and</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833cb-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><content>report to the Director.</content></subparagraph> </paragraph> <paragraph class="fontsize10" id="y6fc833cc-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><heading class="fontsize10"><inline class="smallCaps">Reference</inline>.—</heading><content>Any reference to the Assistant Secretary for Cybersecurity and Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Cybersecurity.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc833cd-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="b">“(b) </num><heading class="fontsize10"><inline class="smallCaps">Functions</inline>.—</heading><chapeau>The Assistant Director shall—</chapeau><paragraph class="fontsize10" id="y6fc833ce-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><content>direct the cybersecurity efforts of the Agency;</content></paragraph> <paragraph class="fontsize10" id="y6fc833cf-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><content>carry out activities, at the direction of the Director, related to the security of Federal information and Federal information systems consistent with law, including <ref href="/us/usc/t44/ch35/schII">subchapter II of chapter 35 of title 44, United States Code</ref>, and the Cybersecurity Act of 2015 (contained in division N of the Consolidated Appropriations Act, 2016 (<ref href="/us/pl/114/113">Public Law 114–113</ref>));</content></paragraph> <paragraph class="fontsize10" id="y6fc833d0-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><content>fully participate in the mechanisms required under section 2202(c)(7); and</content></paragraph> <paragraph class="fontsize10" id="y6fc833d1-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="4">“(4) </num><content>carry out such other duties and powers as prescribed by the Director.</content></paragraph> </subsection> </section> <section class="indentUp2 firstIndent-2" id="y6fc833d2-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658144"><num class="bold" value="2204">“SEC. 2204. </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833d3-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180"><ref href="/us/usc/t6/s654">6 USC 654</ref>.</p></sidenote><heading class="bold">INFRASTRUCTURE SECURITY DIVISION.</heading><subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc833d4-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="a">“(a) </num><heading class="fontsize10"><inline class="smallCaps">Establishment</inline>.—</heading><paragraph class="fontsize10" id="y6fc833d5-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><heading class="fontsize10"><inline class="smallCaps">In general</inline>.—</heading><content>There is established in the Agency an Infrastructure Security Division.</content></paragraph> <paragraph class="fontsize10" id="y6fc833d6-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><heading class="fontsize10"><inline class="smallCaps">Assistant director</inline>.—</heading><chapeau>The Infrastructure Security Division shall be headed by an Assistant Director for Infrastructure Security (in this section referred to as the ‘Assistant Director’), who shall—<page identifier="/us/stat/132/4175">132 STAT. 4175</page></chapeau><subparagraph class="fontsize10" id="y6fc833d7-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="A">“(A) </num><content>be at the level of Assistant Secretary within the Department;</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833d8-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="B">“(B) </num><sidenote><p class="leftAlign firstIndent0 fontsize8" id="x6fc833d9-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">Appointment.</p><p class="leftAlign firstIndent0 fontsize8" id="x6fc833da-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658180">President.</p></sidenote><content>be appointed by the President without the advice and consent of the Senate; and</content></subparagraph> <subparagraph class="fontsize10" id="y6fc833db-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658124"><num class="fontsize10" style="-uslm-lc:emspace2" value="C">“(C) </num><content>report to the Director.</content></subparagraph> </paragraph> <paragraph class="fontsize10" id="y6fc833dc-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><heading class="fontsize10"><inline class="smallCaps">Reference</inline>.—</heading><content>Any reference to the Assistant Secretary for Infrastructure Protection in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Infrastructure Security.</content></paragraph> </subsection> <subsection class="indentDown2 firstIndent0 fontsize10" id="y6fc833dd-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658120"><num class="fontsize10" style="-uslm-lc:emspace2" value="b">“(b) </num><heading class="fontsize10"><inline class="smallCaps">Functions</inline>.—</heading><chapeau>The Assistant Director shall—</chapeau><paragraph class="fontsize10" id="y6fc833de-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="1">“(1) </num><content>direct the critical infrastructure security efforts of the Agency;</content></paragraph> <paragraph class="fontsize10" id="y6fc833df-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="2">“(2) </num><content>carry out, at the direction of the Director, the Chemical Facilities Anti-Terrorism Standards Program established under title XXI and the secure handling of ammonium nitrate program established under subtitle J of title VIII, or any successor programs;</content></paragraph> <paragraph class="fontsize10" id="y6fc833e0-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="3">“(3) </num><content>fully participate in the mechanisms required under section 2202(c)(7); and</content></paragraph> <paragraph class="fontsize10" id="y6fc833e1-e834-11f0-a1e4-69761a48a15a" style="-uslm-lc:I658122"><num class="fontsize10" style="-uslm-lc:emspace2" value="4">“(4) </num><content>carry out such other duties and powers as prescribed by the Director.”</content></paragraph> </subsection> </section> </subtitle> . (b) Treatment of Certain Positions.—(1) Under secretary

6 USC 652 note.

.—The individual serving as the Under Secretary appointed pursuant to section 103(a)(1)(H) of the Homeland Security Act of 2002 (6 U.S.C. 113(a)(1)(H)) of the Department of Homeland Security on the day before the date of enactment of this Act may continue to serve as the Director of Cybersecurity and Infrastructure Security of the Department on and after such date. (2) Director for emergency

6 USC 571 note.

communications.—The individual serving as the Director for Emergency Communications of the Department of Homeland Security on the day before the date of enactment of this Act may continue to serve as the Assistant Director for Emergency Communications of the Department on and after such date. (3) Assistant secretary for cybersecurity and communications

6 USC 653 note.

.—The individual serving as the Assistant Secretary for Cybersecurity and Communications on the day before the date of enactment of this Act may continue to serve as the Assistant Director for Cybersecurity on and after such date. (4) Assistant secretary for infrastructure protection

6 USC 654 note.

.—The individual serving as the Assistant Secretary for Infrastructure Protection on the day before the date of enactment of this Act may continue to serve as the Assistant Director for Infrastructure Security on and after such date. (c) Reference

6 USC 571 note.

.—Any reference to—(1) the Office of Emergency Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Emergency Communications Division; and (2) the Director for Emergency Communications in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Assistant Director for Emergency Communications. (d) Oversight

Deadlines.

.—The Director of Cybersecurity and Infrastructure Security of the Department of Homeland Security shall provide 132 STAT. 4176 to Congress, in accordance with the deadlines specified in paragraphs (1) through (6), information on the following:(1)

Briefing.

Not later than 60 days after the date of enactment of this Act, a briefing on the activities of the Agency relating to the development and use of the mechanisms required pursuant to section 2202(c)(6) of the Homeland Security Act of 2002 (as added by subsection (a)). (2)

Briefing.

Not later than 1 year after the date of the enactment of this Act, a briefing on the activities of the Agency relating to the use and improvement by the Agency of the mechanisms required pursuant to section 2202(c)(6) of the Homeland Security Act of 2002 and how such activities have impacted coordination, situational awareness, and communications with Sector-Specific Agencies. (3) Not later than 90 days after the date of the enactment of this Act, information on the mechanisms of the Agency for regular and ongoing consultation and collaboration, as required pursuant to section 2202(c)(7) of the Homeland Security Act of 2002 (as added by subsection (a)). (4) Not later than 1 year after the date of the enactment of this Act, information on the activities of the consultation and collaboration mechanisms of the Agency as required pursuant to section 2202(c)(7) of the Homeland Security Act of 2002, and how such mechanisms have impacted operational coordination, situational awareness, and integration across the Agency. (5) Not later than 180 days after the date of enactment of this Act, information, which shall be made publicly available and updated as appropriate, on the mechanisms and structures of the Agency responsible for stakeholder outreach and engagement, as required under section 2202(c)(10) of the Homeland Security Act of 2002 (as added by subsection (a)). (e) Cyber Workforce

Coordination.

Reports.

.—Not later than 90 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, in coordination with the Director of the Office of Personnel Management, shall submit to Congress a report detailing how the Agency is meeting legislative requirements under the Cybersecurity Workforce Assessment Act (Public Law 113–246; 128 Stat. 2880) and the Homeland Security Cybersecurity Workforce Assessment Act (enacted as section 4 of the Border Patrol Agent Pay Reform Act of 2014; Public Law 113–277) to address cyber workforce needs. (f) Facility

Reports.

.—Not later than 180 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security shall report to Congress on the most efficient and effective methods of consolidating Agency facilities, personnel, and programs to most effectively carry out the Agency’s mission. (g) Technical and Conforming Amendments to the Homeland Security Act of 2002.—The Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended—(1) by amending section 103(a)(1)(H) (6 U.S.C. 113(a)(1)(H)) to read as follows:“(H) A Director of the Cybersecurity and Infrastructure Security Agency.” ; (2) in title II (6 U.S.C. 121 et seq.)—(A) in the title heading, by striking “AND INFRASTRUCTURE PROTECTION”;132 STAT. 4177 (B) in the subtitle A heading, by striking “and Infrastructure Protection”; (C) in section 201 (6 U.S.C. 121)—(i) in the section heading, by striking “and infrastructure protection”; (ii) in subsection (a)—(I) in the subsection heading, by striking “and Infrastructure Protection”; and (II) by striking “and an Office of Infrastructure Protection”; (iii) in subsection (b)—(I) in the subsection heading, by striking “and Assistant Secretary for Infrastructure Protection”; and (II) by striking paragraph (3); (iv) in subsection (c)—(I) by striking “and infrastructure protection”; and (II) by striking “or the Assistant Secretary for Infrastructure Protection, as appropriate”; (v) in subsection (d)—(I) in the subsection heading, by striking “and Infrastructure Protection”; (II) in the matter preceding paragraph (1), by striking “and infrastructure protection”; (III) by striking paragraphs (5), (6), and (25); (IV) by redesignating paragraphs (7) through (24) as paragraphs (5) through (22), respectively; (V) by redesignating paragraph (26) as paragraph (23); and (VI) in paragraph (23)(B)(i), as so redesignated, by striking “section 319” and inserting “section 320”; (vi) in subsection (e)(1), by striking “and the Office of Infrastructure Protection”; and (vii) in subsection (f)(1), by striking “and the Office of Infrastructure Protection”; (D) in section 202 (6 U.S.C. 122)—(i) in subsection (c), in the matter preceding paragraph (1), by striking “Director of Central Intelligence” and inserting “Director of National Intelligence”; and (ii) in subsection (d)(2), by striking “Director of Central Intelligence” and inserting “Director of National Intelligence”; (E) in section 204 (6 U.S.C. 124a)—(i) in subsection (c)(1), in the matter preceding subparagraph (A), by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of the Cybersecurity and Infrastructure Security Agency”; and (ii) in subsection (d)(1), in the matter preceding subparagraph (A), by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of the Cybersecurity and Infrastructure Security Agency”; (F) in section 210A(c)(2)(B) (6 U.S.C. 124h(c)(2)(B)), by striking “Office of Infrastructure Protection” and 132 STAT. 4178 inserting “Cybersecurity and Infrastructure Security Agency”; (G) by redesignating section 210E (6 U.S.C. 124l) as section 2214

6 USC 664.

 and transferring such section to appear after section 2213 (as redesignated by subparagraph (I)); (H)

6 USC 671–674.

in subtitle B, by redesignating sections 211 through 215 (6 U.S.C. 101 note, and 131 through 134) as sections 2221 through 2225, respectively, and transferring such subtitle, including the enumerator and heading of subtitle B and such sections, to appear after section 2214 (as redesignated by subparagraph (G)); (I)

6 USC 655–663.

by redesignating sections 223 through 230 (6 U.S.C. 143 through 151) as sections 2205 through 2213, respectively, and transferring such sections to appear after section 2204, as added by this Act; (J)

6 USC 124m.

by redesignating section 210F as section 210E; and (K) by redesignating subtitles C and D as subtitles B and C, respectively; (3) in title III (6 U.S.C. 181 et seq.)—(A) in section 302 (6 U.S.C. 182)—(i) by striking “biological,,” each place that term appears and inserting “biological,”; and (ii) in paragraph (3), by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of the Cybersecurity and Infrastructure Security Agency”; (B) by redesignating the second section 319 (6 U.S.C. 195f) (relating to EMP and GMD mitigation research and development) as section 320; and (C) in section 320(c)(1), as so redesignated, by striking “Section 214” and inserting “Section 2224”; (4) in title V (6 U.S.C. 311 et seq.)—(A) in section 508(d)(2)(D) (6 U.S.C. 318(d)(2)(D)), by striking “The Director of the Office of Emergency Communications of the Department of Homeland Security” and inserting “The Assistant Director for Emergency Communications”; (B) in section 514 (6 U.S.C. 321c)—(i) by striking subsection (b); and (ii) by redesignating subsection (c) as subsection (b); and (C) in section 523 (6 U.S.C. 321l)—(i) in subsection (a), in the matter preceding paragraph (1), by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of Cybersecurity and Infrastructure Security”; and (ii) in subsection (c), by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of Cybersecurity and Infrastructure Security”; (5) in title VIII (6 U.S.C. 361 et seq.)—(A) in section 884(d)(4)(A)(ii) (6 U.S.C. 464(d)(4)(A)(ii)), by striking “Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department” and inserting “Director of Cybersecurity and Infrastructure Security”; and132 STAT. 4179 (B) in section 899B(a) (6 U.S.C. 488a(a)), by adding at the end the following: “Such regulations shall be carried out by the Cybersecurity and Infrastructure Security Agency.”; (6) in title XVIII (6 U.S.C. 571 et seq.)—(A) in section 1801 (6 U.S.C. 571)—(i) in the section heading, by striking “office of emergency communications” and inserting “emergency communications division”; (ii) in subsection (a)—(I) by striking “Office of Emergency Communications” and inserting “Emergency Communications Division”; and (II) by adding at the end the following: “The Division shall be located in the Cybersecurity and Infrastructure Security Agency.”; (iii) by amending subsection (b) to read as follows:“(b) Assistant Director.—The head of the Division shall be the Assistant Director for Emergency Communications. The Assistant Director shall report to the Director of Cybersecurity and Infrastructure Security. All decisions of the Assistant Director that entail the exercise of significant authority shall be subject to the approval of the Director of Cybersecurity and Infrastructure Security.” ; (iv) in subsection (c)—(I) in the matter preceding paragraph (1), by inserting “Assistant” before “Director”; (II) in paragraph (14), by striking “and” at the end; (III) in paragraph (15), by striking the period at the end and inserting “; and”; and (IV) by inserting after paragraph (15) the following:“(16) fully participate in the mechanisms required under section 2202(c)(7).” ; (v) in subsection (d), in the matter preceding paragraph (1), by inserting “Assistant” before “Director”; and (vi) in subsection (e), in the matter preceding paragraph (1), by inserting “Assistant” before “Director”; (B) in sections 1802 through 1805 (6 U.S.C. 572 through 575), by striking “Director for Emergency Communications” each place that term appears and inserting “Assistant Director for Emergency Communications”; (C) in section 1809 (6 U.S.C. 579)—(i) by striking “Director of Emergency Communications” each place that term appears and inserting “Assistant Director for Emergency Communications”; (ii) in subsection (b)—(I) by striking “Director for Emergency Communications” and inserting “Assistant Director for Emergency Communications”; and (II) by striking “Office of Emergency Communications” and inserting “Emergency Communications Division”; (iii) in subsection (e)(3), by striking “the Director” and inserting “the Assistant Director”; and (iv) in subsection (m)(1)—132 STAT. 4180(I) by striking “The Director” and inserting “The Assistant Director”; (II) by striking “the Director determines” and inserting “the Assistant Director determines”; and (III) by striking “Office of Emergency Communications” and inserting “Cybersecurity and Infrastructure Security Agency”; (D) in section 1810 (6 U.S.C. 580)—(i) in subsection (a)(1), by striking “Director of the Office of Emergency Communications (referred to in this section as the ‘Director’)” and inserting “Assistant Director for Emergency Communications (referred to in this section as the ‘Assistant Director’)”; (ii) in subsection (c), by striking “Office of Emergency Communications” and inserting “Emergency Communications Division”; and (iii) by striking “Director” each place that term appears and inserting “Assistant Director”; (7) in title XX (6 U.S.C. 601 et seq.)—(A) in paragraph (4)(A)(iii)(II) of section 2001 (6 U.S.C. 601), by striking “section 210E(a)(2)” and inserting “section 2214(a)(2)”; (B) in section 2008(a)(3) (6 U.S.C. 609(a)(3)), by striking “section 210E(a)(2)” and inserting “section 2214(a)(2)”; and (C) in section 2021 (6 U.S.C. 611)—(i) by striking subsection (c); and (ii) by redesignating subsection (d) as subsection (c); (8) in title XXI (6 U.S.C. 621 et seq.)—(A) in section 2102(a)(1) (6 U.S.C. 622(a)(1)), by inserting “, which shall be located in the Cybersecurity and Infrastructure Security Agency” before the period at the end; and (B) in section 2104(c)(2) (6 U.S.C. 624(c)(2)), by striking “Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department appointed under section 103(a)(1)(H)” and inserting “Director of Cybersecurity and Infrastructure Security”; and (9) in title XXII, as added by this Act—(A) in subtitle A—(i) in section 2205, as so redesignated—(I) in the matter preceding paragraph (1)—(aa) by striking “section 201” and inserting “section 2202”; and (bb) by striking “Under Secretary appointed under section 103(a)(1)(H)” and inserting “Director of Cybersecurity and Infrastructure Security”; and (II) in paragraph (1)(B), by striking “and” at the end; (ii) in section 2206, as so redesignated, by striking “Assistant Secretary for Infrastructure Protection” and inserting “Director of Cybersecurity and Infrastructure Security”; (iii) in section 2209, as so redesignated—132 STAT. 4181(I) by striking “Under Secretary appointed under section 103(a)(1)(H)” each place that term appears and inserting “Director”; (II) in subsection (a)(4), by striking “section 212(5)” and inserting “section 2222(5)”; (III) in subsection (b), by adding at the end the following: “The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Assistant Director for Cybersecurity.”; and (IV) in subsection (c)(11), by striking “Office of Emergency Communications” and inserting “Emergency Communications Division”; (iv) in section 2210, as so redesignated—(I) by striking “section 227” each place that term appears and inserting “section 2209”; and (II) in subsection (c)—(aa) by striking “Under Secretary appointed under section 103(a)(1)(H)” and inserting “Director of Cybersecurity and Infrastructure Security”; and (bb) by striking “section 212(5)” and inserting “section 2222(5)”; (v) in section 2211(b)(2)(A), as so redesignated, by striking “the section 227” and inserting “section 2209”; (vi) in section 2212, as so redesignated, by striking “section 212(5)” and inserting “section 2222(5)”; (vii) in section 2213(a), as so redesignated—(I) in paragraph (3), by striking “section 228” and inserting “section 2210”; and (II) in paragraph (4), by striking “section 227” and inserting “section 2209”; and (viii) in section 2214, as so redesignated—(I) by striking subsection (e); and (II) by redesignating subsection (f) as subsection (e); and (B) in subtitle B—(i) in section 2222(8), as so redesignated, by striking “section 227” and inserting “section 2209”; and (ii) in section 2224(h), as so redesignated, by striking “section 213” and inserting “section 2223”; (h) Technical and Conforming Amendments to Other Laws.—(1) Cybersecurity act of 2015.—The Cybersecurity Act of 2015 (6 U.S.C. 1501 et seq.) is amended—(A) in section 202(2) (6 U.S.C. 131 note)—(i) by striking “section 227” and inserting “section 2209”; and (ii) by striking “, as so redesignated by section 223(a)(3) of this division”; (B) in section 207(2) (Public Law 114–113; 129 Stat. 2962)—(i) by striking “section 227” and inserting “section 2209”; and (ii) by striking “, as redesignated by section 223(a) of this division,”;132 STAT. 4182 (C) in section 208 (Public Law 114–113; 129 Stat. 2962), by striking “Under Secretary appointed under section 103(a)(1)(H) of the Homeland Security Act of 2002 (6 U.S.C. 113(a)(1)(H))” and inserting “Director of Cybersecurity and Infrastructure Security of the Department”; (D) in section 222 (6 U.S.C. 1521)—(i) in paragraph (2)—(I) by striking “section 228” and inserting “section 2210”; and (II) by striking “, as added by section 223(a)(4) of this division”; and (ii) in paragraph (4)—(I) by striking “section 227” and inserting “section 2209”; and (II) by striking “, as so redesignated by section 223(a)(3) of this division”; (E) in section 223(b) (6 U.S.C. 151 note)—(i) by striking “section 230(b)(1) of the Homeland Security Act of 2002, as added by subsection (a)” each place that term appears and inserting “section 2213(b)(1) of the Homeland Security Act of 2002”; and (ii) in paragraph (1)(B), by striking “section 230(b)(2) of the Homeland Security Act of 2002, as added by subsection (a)” and inserting “section 2213(b)(2) of the Homeland Security Act of 2002”; (F) in section 226 (6 U.S.C. 1524)—(i) in subsection (a)—(I) in paragraph (1)—(aa) by striking “section 230” and inserting “section 2213”; and (bb) by striking “, as added by section 223(a)(6) of this division”; (II) in paragraph (4)—(aa) by striking “section 228(b)(1)” and inserting “section 2210(b)(1)”; and (bb) by striking “, as added by section 223(a)(4) of this division”; and (III) in paragraph (5)—(aa) by striking “section 230(b)” and inserting “section 2213(b)”; and (bb) by striking “, as added by section 223(a)(6) of this division”; and (ii) in subsection (c)(1)(A)(vi)—(I) by striking “section 230(c)(5)” and inserting “section 2213(c)(5)”; and (II) by striking “, as added by section 223(a)(6) of this division”; (G) in section 227 (6 U.S.C. 1525)—(i) in subsection (a)—(I) by striking “section 230” and inserting “section 2213”; and (II) by striking “, as added by section 223(a)(6) of this division,”; and (ii) in subsection (b)—(I) by striking “section 230(d)(2)” and inserting “section 2213(d)(2)”; and132 STAT. 4183 (II) by striking “, as added by section 223(a)(6) of this division,”; and (H) in section 404 (6 U.S.C. 1532)—(i) by striking “Director for Emergency Communications” each place that term appears and inserting “Assistant Director for Emergency Communications”; and (ii) in subsection (a)—(I) by striking “section 227” and inserting “section 2209”; and (II) by striking “, as redesignated by section 223(a)(3) of this division,”. (2) Small business act.—Section 21(a)(8)(B) of the Small Business Act (15 U.S.C. 648(a)(8)(B)) is amended by striking “section 227(a) of the Homeland Security Act of 2002 (6 U.S.C. 148(a))” and inserting “section 2209(a) of the Homeland Security Act of 2002”. (3) Title 5.—Subchapter II of chapter 53 of title 5, United States Code, is amended—(A) in section 5314, by inserting after “Under Secretaries, Department of Homeland Security.” the following:

  “Director, Cybersecurity and Infrastructure Security Agency.”

; and (B) in section 5315, by inserting after “Assistant Secretaries, Department of Homeland Security.” the following:

  “Assistant Director for Cybersecurity, Cybersecurity and Infrastructure Security Agency.

  “Assistant Director for Infrastructure Security, Cybersecurity and Infrastructure Security Agency.”

. (i) Table of Contents Amendments.—The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public Law 107–296; 116 Stat. 2135) is amended—(1) by striking the item relating to title II and inserting the following: “TITLE II— (2) by striking the item relating to subtitle A of title II and inserting the following: “Subtitle A— (3) by striking the item relating to section 201 and inserting the following: “Sec. 201.  (4) by striking the items relating to sections 210E and 210F and inserting the following: “Sec. 210E.  (5) by striking the items relating to subtitle B of title II and sections 211 through 215; (6) by striking the items relating to section 223 through section 230; (7) by striking the item relating to subtitle C and inserting the following:132 STAT. 4184 “Subtitle B— (8) by striking the item relating to subtitle D and inserting the following: “Subtitle C— (9) by striking the items relating to sections 317, 319, 318, and 319 and inserting the following: “Sec. 317.  “Sec. 318.  “Sec. 319.  “Sec. 320.  (10) by striking the item relating to section 1801 and inserting the following: “Sec. 1801.  (11) by adding at the end the following: “TITLE XXII— “Subtitle A— “Sec. 2201.  “Sec. 2202.  “Sec. 2203.  “Sec. 2204.  “Sec. 2205.  “Sec. 2206.  “Sec. 2207.  “Sec. 2208.  “Sec. 2209.  “Sec. 2210.  “Sec. 2211.  “Sec. 2212.  “Sec. 2213.  “Sec. 2214.  “Subtitle B— “Sec. 2221.  “Sec. 2222.  “Sec. 2223.  “Sec. 2224.  “Sec. 2225. 
SEC. 3.

6 USC 452 note.

TRANSFER OF OTHER ENTITIES.(a)

Effective date.

Office of Biometric Identity Management.—The Office of Biometric Identity Management of the Department of Homeland Security located in the National Protection and Programs Directorate of the Department of Homeland Security on the day before the date of enactment of this Act is hereby transferred to the Management Directorate of the Department. (b) Federal Protective Service.—(1) In general

Deadline.

Determination.

.—Not later than 90 days after the completion of the Government Accountability Office review of the organizational placement of the Federal Protective Service (authorized under section 1315 of title 40, United States Code), the Secretary of Homeland Security shall determine the appropriate placement of the Service within the Department of Homeland Security and commence the transfer of the Service to such component, directorate, or other office of the Department that the Secretary so determines appropriate. (2) Exception.

Determination.

Deadlines.

—If the Secretary of Homeland Security determines pursuant to paragraph (1) that no component, directorate, or other office of the Department of Homeland Security 132 STAT. 4185 is an appropriate placement for the Federal Protective Service, the Secretary shall—(A) provide to the Committee on Homeland Security and the Committee on Transportation and Infrastructure of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate and the Office of Management and Budget a detailed explanation, in writing, of the reason for such determination that includes—(i) information on how the Department considered the Government Accountability Office review described in such paragraph; (ii)

Lists.

a list of the components, directorates, or other offices of the Department that were considered for such placement; and (iii) information on why each such component, directorate, or other office of the Department was determined to not be an appropriate placement for the Service; (B)

Coordination plan.

Determination.

not later than 120 days after the completion of the Government Accountability Office review described in such paragraph, develop and submit to the committees specified in subparagraph (A) and the Office of Management and Budget a plan to coordinate with other appropriate Federal agencies, including the General Services Administration, to determine a more appropriate placement for the Service; and (C)

Recommenda-

tions.

not later than 180 days after the completion of such Government Accountability Office review, submit to such committees and the Office of Management and Budget a recommendation regarding the appropriate placement of the Service within the executive branch of the Federal Government.
SEC. 4. DHS REPORT ON CLOUD-BASED CYBERSECURITY.(a) Definition.—In this section, the term “Department” means the Department of Homeland Security. (b)

Coordination.

Report.—Not later than 120 days after the date of enactment of this Act, the Secretary of Homeland Security, in coordination with the Director of the Office of Management and Budget and the Administrator of General Services, shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Government Reform and the Committee on Homeland Security of the House of Representatives a report on the leadership role of the Department in cloud-based cybersecurity deployments for civilian Federal departments and agencies, which shall include—(1) information on the plan of the Department for ensuring access to a security operations center as a service capability in accordance with the December 19, 2017 Report to the President on Federal IT Modernization issued by the American Technology Council; (2) information on what service capabilities under paragraph (1) the Department will prioritize, including—(A)

Criteria.

criteria the Department will use to evaluate capabilities offered by the private sector; and132 STAT. 4186 (B) how Federal government- and private sector-provided capabilities will be integrated to enable visibility and consistency of such capabilities across all cloud and on premise environments, as called for in the report described in paragraph (1); and (3) information on how the Department will adapt the current capabilities of, and future enhancements to, the intrusion detection and prevention system of the Department and the Continuous Diagnostics and Mitigation Program of the Department to secure civilian Federal government networks in a cloud environment.
SEC. 5.

6 USC 651 note.

RULE OF CONSTRUCTION.  Nothing in this Act or an amendment made by this Act may be construed as—(1) conferring new authorities to the Secretary of Homeland Security, including programmatic, regulatory, or enforcement authorities, outside of the authorities in existence on the day before the date of enactment of this Act; (2) reducing or limiting the programmatic, regulatory, or enforcement authority vested in any other Federal agency by statute; or (3) affecting in any manner the authority, existing on the day before the date of enactment of this Act, of any other Federal agency or component of the Department of Homeland Security.
SEC. 6. PROHIBITION ON ADDITIONAL FUNDING.  No additional funds are authorized to be appropriated to carry out this Act or the amendments made by this Act. This Act and the amendments made by this Act shall be carried out using amounts otherwise authorized.
Approved November 16, 2018.
LEGISLATIVE HISTORY—H.R. 3359: HOUSE REPORTS: ┐No. 115–454, Pt. 1 (Comm. on Homeland Security). CONGRESSIONAL RECORD: Vol. 163 (2017):

Dec. 11, considered and passed House.

Vol. 164 (2018):

Oct. 3, considered and passed Senate, amended.

Nov. 13, House concurred in Senate amendment.

 DAILY COMPILATION OF PRESIDENTIAL DOCUMENTS (2018):

Nov. 16, Presidential remarks.

 ○