[Congressional Bills 113th Congress]
[From the U.S. Government Publishing Office]
[S. 2519 Engrossed in Senate (ES)]
113th CONGRESS
2d Session
S. 2519
_______________________________________________________________________
AN ACT
To codify an existing operations center for cybersecurity.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``National Cybersecurity Protection
Act of 2014''.
SEC. 2. DEFINITIONS.
In this Act--
(1) the term ``Center'' means the national cybersecurity
and communications integration center under section 226 of the
Homeland Security Act of 2002, as added by section 3;
(2) the term ``critical infrastructure'' has the meaning
given that term in section 2 of the Homeland Security Act of
2002 (6 U.S.C. 101);
(3) the term ``cybersecurity risk'' has the meaning given
that term in section 226 of the Homeland Security Act of 2002,
as added by section 3;
(4) the term ``information sharing and analysis
organization'' has the meaning given that term in section
212(5) of the Homeland Security Act of 2002 (6 U.S.C. 131(5));
(5) the term ``information system'' has the meaning given
that term in section 3502(8) of title 44, United States Code;
and
(6) the term ``Secretary'' means the Secretary of Homeland
Security.
SEC. 3. NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER.
(a) In General.--Subtitle C of title II of the Homeland Security
Act of 2002 (6 U.S.C. 141 et seq.) is amended by adding at the end the
following:
``SEC. 226. NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION
CENTER.
``(a) Definitions.--In this section--
``(1) the term `cybersecurity risk' means threats to and
vulnerabilities of information or information systems and any
related consequences caused by or resulting from unauthorized
access, use, disclosure, degradation, disruption, modification,
or destruction of information or information systems, including
such related consequences caused by an act of terrorism;
``(2) the term `incident' means an occurrence that--
``(A) actually or imminently jeopardizes, without
lawful authority, the integrity, confidentiality, or
availability of information on an information system;
or
``(B) constitutes a violation or imminent threat of
violation of law, security policies, security
procedures, or acceptable use policies;
``(3) the term `information sharing and analysis
organization' has the meaning given that term in section
212(5); and
``(4) the term `information system' has the meaning given
that term in section 3502(8) of title 44, United States Code.
``(b) Center.--There is in the Department a national cybersecurity
and communications integration center (referred to in this section as
the `Center') to carry out certain responsibilities of the Under
Secretary appointed under section 103(a)(1)(H).
``(c) Functions.--The cybersecurity functions of the Center shall
include--
``(1) being a Federal civilian interface for the multi-
directional and cross-sector sharing of information related to
cybersecurity risks, incidents, analysis, and warnings for
Federal and non-Federal entities;
``(2) providing shared situational awareness to enable
real-time, integrated, and operational actions across the
Federal Government and non-Federal entities to address
cybersecurity risks and incidents to Federal and non-Federal
entities;
``(3) coordinating the sharing of information related to
cybersecurity risks and incidents across the Federal
Government;
``(4) facilitating cross-sector coordination to address
cybersecurity risks and incidents, including cybersecurity
risks and incidents that may be related or could have
consequential impacts across multiple sectors;
``(5)(A) conducting integration and analysis, including
cross-sector integration and analysis, of cybersecurity risks
and incidents; and
``(B) sharing the analysis conducted under subparagraph (A)
with Federal and non-Federal entities;
``(6) upon request, providing timely technical assistance,
risk management support, and incident response capabilities to
Federal and non-Federal entities with respect to cybersecurity
risks and incidents, which may include attribution, mitigation,
and remediation; and
``(7) providing information and recommendations on security
and resilience measures to Federal and non-Federal entities,
including information and recommendations to--
``(A) facilitate information security; and
``(B) strengthen information systems against
cybersecurity risks and incidents.
``(d) Composition.--
``(1) In general.--The Center shall be composed of--
``(A) appropriate representatives of Federal
entities, such as--
``(i) sector-specific agencies;
``(ii) civilian and law enforcement
agencies; and
``(iii) elements of the intelligence
community, as that term is defined under
section 3(4) of the National Security Act of
1947 (50 U.S.C. 3003(4));
``(B) appropriate representatives of non-Federal
entities, such as--
``(i) State and local governments;
``(ii) information sharing and analysis
organizations; and
``(iii) owners and operators of critical
information systems;
``(C) components within the Center that carry out
cybersecurity and communications activities;
``(D) a designated Federal official for operational
coordination with and across each sector; and
``(E) other appropriate representatives or
entities, as determined by the Secretary.
``(2) Incidents.--In the event of an incident, during
exigent circumstances the Secretary may grant a Federal or non-
Federal entity immediate temporary access to the Center.
``(e) Principles.--In carrying out the functions under subsection
(c), the Center shall ensure--
``(1) to the extent practicable, that--
``(A) timely, actionable, and relevant information
related to cybersecurity risks, incidents, and analysis
is shared;
``(B) when appropriate, information related to
cybersecurity risks, incidents, and analysis is
integrated with other relevant information and tailored
to the specific characteristics of a sector;
``(C) activities are prioritized and conducted
based on the level of risk;
``(D) industry sector-specific, academic, and
national laboratory expertise is sought and receives
appropriate consideration;
``(E) continuous, collaborative, and inclusive
coordination occurs--
``(i) across sectors; and
``(ii) with--
``(I) sector coordinating councils;
``(II) information sharing and
analysis organizations; and
``(III) other appropriate non-
Federal partners;
``(F) as appropriate, the Center works to develop
and use mechanisms for sharing information related to
cybersecurity risks and incidents that are technology-
neutral, interoperable, real-time, cost-effective, and
resilient; and
``(G) the Center works with other agencies to
reduce unnecessarily duplicative sharing of information
related to cybersecurity risks and incidents;
``(2) that information related to cybersecurity risks and
incidents is appropriately safeguarded against unauthorized
access; and
``(3) that activities conducted by the Center comply with
all policies, regulations, and laws that protect the privacy
and civil liberties of United States persons.
``(f) No Right or Benefit.--
``(1) In general.--The provision of assistance or
information to, and inclusion in the Center of, governmental or
private entities under this section shall be at the sole and
unreviewable discretion of the Under Secretary appointed under
section 103(a)(1)(H).
``(2) Certain assistance or information.--The provision of
certain assistance or information to, or inclusion in the
Center of, one governmental or private entity pursuant to this
section shall not create a right or benefit, substantive or
procedural, to similar assistance or information for any other
governmental or private entity.''.
(b) Technical and Conforming Amendment.--The table of contents in
section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 note)
is amended by inserting after the item relating to section 225 the
following:
``Sec. 226. National cybersecurity and communications integration
center.''.
SEC. 4. RECOMMENDATIONS REGARDING NEW AGREEMENTS.
(a) In General.--Not later than 180 days after the date of
enactment of this Act, the Secretary shall submit recommendations on
how to expedite the implementation of information-sharing agreements
for cybersecurity purposes between the Center and non-Federal entities
(referred to in this section as ``cybersecurity information-sharing
agreements'') to--
(1) the Committee on Homeland Security and Governmental
Affairs and the Committee on the Judiciary of the Senate; and
(2) the Committee on Homeland Security and the Committee on
the Judiciary of the House of Representatives.
(b) Contents.--In submitting recommendations under subsection (a),
the Secretary shall--
(1) address the development and utilization of a scalable
form that retains all privacy and other protections in
cybersecurity information-sharing agreements that are in effect
as of the date on which the Secretary submits the
recommendations, including Cooperative Research and Development
Agreements; and
(2) include in the recommendations any additional
authorities or resources that may be needed to carry out the
implementation of any new cybersecurity information-sharing
agreements.
SEC. 5. ANNUAL REPORT.
Not later than 1 year after the date of enactment of this Act, and
every year thereafter for 3 years, the Secretary shall submit to the
Committee on Homeland Security and Governmental Affairs and the
Committee on the Judiciary of the Senate, the Committee on Homeland
Security and the Committee on the Judiciary of the House of
Representatives, and the Comptroller General of the United States a
report on the Center, which shall include--
(a) information on the Center, including--
(1) an assessment of the capability and capacity of the
Center to carry out its cybersecurity mission under this Act;
(2) the number of representatives from non-Federal entities
that are participating in the Center, including the number of
representatives from States, nonprofit organizations, and
private sector entities, respectively;
(3) the number of requests from non-Federal entities to
participate in the Center and the response to such requests;
(4) the average length of time taken to resolve requests
described in paragraph (3);
(5) the identification of--
(A) any delay in resolving requests described in
paragraph (3) involving security clearance processing;
and
(B) the agency involved with a delay described in
subparagraph (A);
(6) a description of any other obstacles or challenges to
resolving requests described in paragraph (3) and a summary of
the reasons for denials of any such requests;
(7) the extent to which the Department is engaged in
information sharing with each critical infrastructure sector,
including--
(A) the extent to which each sector has
representatives at the Center;
(B) the extent to which owners and operators of
critical infrastructure in each critical infrastructure
sector participate in information sharing at the
Center; and
(C) the volume and range of activities with respect
to which the Secretary has collaborated with the sector
coordinating councils and the sector-specific agencies
to promote greater engagement with the Center; and
(8) the policies and procedures established by the Center
to safeguard privacy and civil liberties.
SEC. 6. GAO REPORT.
Not later than 2 years after the date of enactment of this Act, the
Comptroller General of the United States shall submit to the Committee
on Homeland Security and Governmental Affairs of the Senate and the
Committee on Homeland Security of the House of Representatives a report
on the effectiveness of the Center in carrying out its cybersecurity
mission.
SEC. 7. CYBER INCIDENT RESPONSE PLAN; CLEARANCES; BREACHES.
(a) Cyber Incident Response Plan; Clearances.--Subtitle C of title
II of the Homeland Security Act of 2002 (6 U.S.C. 141 et seq.), as
amended by section 3, is amended by adding at the end the following:
``SEC. 227. CYBER INCIDENT RESPONSE PLAN.
``The Under Secretary appointed under section 103(a)(1)(H) shall,
in coordination with appropriate Federal departments and agencies,
State and local governments, sector coordinating councils, information
sharing and analysis organizations (as defined in section 212(5)),
owners and operators of critical infrastructure, and other appropriate
entities and individuals, develop, regularly update, maintain, and
exercise adaptable cyber incident response plans to address
cybersecurity risks (as defined in section 226) to critical
infrastructure.
``SEC. 228. CLEARANCES.
``The Secretary shall make available the process of application for
security clearances under Executive Order 13549 (75 Fed. Reg. 162;
relating to a classified national security information program) or any
successor Executive Order to appropriate representatives of sector
coordinating councils, sector information sharing and analysis
organizations (as defined in section 212(5)), owners and operators of
critical infrastructure, and any other person that the Secretary
determines appropriate.''.
(b) Breaches.--
(1) Requirements.--The Director of the Office of Management
and Budget shall ensure that data breach notification policies
and guidelines are updated periodically and require--
(A) except as provided in paragraph (4), notice by
the affected agency to each committee of Congress
described in section 3544(c)(1) of title 44, United
States Code, the Committee on the Judiciary of the
Senate, and the Committee on Homeland Security and the
Committee on the Judiciary of the House of
Representatives, which shall--
(i) be provided expeditiously and not later
than 30 days after the date on which the agency
discovered the unauthorized acquisition or
access; and
(ii) include--
(I) information about the breach,
including a summary of any information
that the agency knows on the date on
which notification is provided about
how the breach occurred;
(II) an estimate of the number of
individuals affected by the breach,
based on information that the agency
knows on the date on which notification
is provided, including an assessment of
the risk of harm to affected
individuals;
(III) a description of any
circumstances necessitating a delay in
providing notice to affected
individuals; and
(IV) an estimate of whether and
when the agency will provide notice to
affected individuals; and
(B) notice by the affected agency to affected
individuals, pursuant to data breach notification
policies and guidelines, which shall be provided as
expeditiously as practicable and without unreasonable
delay after the agency discovers the unauthorized
acquisition or access.
(2) National security; law enforcement; remediation.--The
Attorney General, the head of an element of the intelligence
community (as such term is defined under section 3(4) of the
National Security Act of 1947 (50 U.S.C. 3003(4)), or the
Secretary may delay the notice to affected individuals under
paragraph (1)(B) if the notice would disrupt a law enforcement
investigation, endanger national security, or hamper security
remediation actions.
(3) OMB report.--During the first 2 years beginning after
the date of enactment of this Act, the Director of the Office
of Management and Budget shall, on an annual basis--
(A) assess agency implementation of data breach
notification policies and guidelines in aggregate; and
(B) include the assessment described in clause (i)
in the report required under section 3543(a)(8) of
title 44, United States Code.
(4) Exception.--Any element of the intelligence community
(as such term is defined under section 3(4) of the National
Security Act of 1947 (50 U.S.C. 3003(4)) that is required to
provide notice under paragraph (1)(A) shall only provide such
notice to appropriate committees of Congress.
(c) Rule of Construction.--Nothing in the amendment made by
subsection (a) or in subsection (b)(1) shall be construed to alter any
authority of a Federal agency or department.
(d) Technical and Conforming Amendment.--The table of contents in
section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 note),
as amended by section 3, is amended by inserting after the item
relating to section 226 the following:
``Sec. 227. Cyber incident response plan.
``Sec. 228. Clearances.''.
SEC. 8. RULES OF CONSTRUCTION.
(a) Prohibition on New Regulatory Authority.--Nothing in this Act
or the amendments made by this Act shall be construed to grant the
Secretary any authority to promulgate regulations or set standards
relating to the cybersecurity of private sector critical infrastructure
that was not in effect on the day before the date of enactment of this
Act.
(b) Private Entities.--Nothing in this Act or the amendments made
by this Act shall be construed to require any private entity--
(1) to request assistance from the Secretary; or
(2) that requested such assistance from the Secretary to
implement any measure or recommendation suggested by the
Secretary.
Passed the Senate December 10, 2014.
Attest:
Secretary.
113th CONGRESS
2d Session
S. 2519
_______________________________________________________________________
AN ACT
To codify an existing operations center for cybersecurity.