Cyber Defense of Federal Networks Act of 2015

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cyber Defense of Federal Networks 
Act of 2015''.

SEC. 2. CYBER DEFENSE OF FEDERAL NETWORKS.

    (a) In General.--Subtitle C of title II of the Homeland Security 
Act of 2002 (6 U.S.C. 141 et seq.) is amended by adding at the end the 
following new sections:

``SEC. 230. CYBERSECURITY PLANS.

    ``(a) Intrusion Detection and Response Plan.--Not later than one 
year after the date of the enactment of this section, the Secretary, in 
coordination with the Director of the Office of Management and Budget, 
shall develop and implement an intrusion detection and response plan to 
detect, identify, and remove intruders in agency information systems. 
The Secretary, in coordination with the Director, shall update such 
plan as necessary.
    ``(b) Exception.--The intrusion detection and response plan 
required under subsection (a) shall not apply to the Department of 
Defense or an element of the intelligence community.
    ``(c) Definitions.--In this section and sections 231, 232, and 233:
            ``(1) Agency.--The term `agency' has the meaning given such 
        term in section 3502 of title 44, United States Code.
            ``(2) Cybersecurity risk.--The term `cybersecurity risk' 
        has the meaning given such term in the second section 226 
        (relating to the national cybersecurity and communications 
        integration center).
            ``(3) Information system.--The term `information system' 
        has the meaning given such term in the second section 226 
        (relating to the national cybersecurity and communications 
        integration center).
            ``(4) Intelligence community.--The term `intelligence 
        community' has the meaning given such term in section 3(4) of 
        the National Security Act of 1947 (50 U.S.C. 3003(4)).

``SEC. 231. ADVANCED INTERNAL DEFENSES.

    ``(a) Advanced Network Security Tools.--
            ``(1) In general.--The Secretary shall include in the 
        Department's efforts to continuously diagnose and mitigate 
        cybersecurity risks advanced network security tools to improve 
        visibility of network activity, including through the use of 
        commercial and free or open source tools, to detect and 
        mitigate intrusions and anomalous activity in agencies' 
        information systems.
            ``(2) Development of plan.--The Secretary, in coordination 
        with the Director of the Office of Management and Budget, shall 
        develop and implement a plan to ensure advanced network 
        security tools, including tools described in paragraph (1), to 
        detect and mitigate intrusions and anomalous activity are 
        available for use by each agency.
    ``(b) Prioritizing Advanced Security Tools.--The Secretary, in 
coordination with the Director of the Office of Management and Budget, 
and in consultation with the heads of appropriate agencies, shall--
            ``(1) review and update operational capabilities to ensure 
        appropriate prioritization and use of network security 
        monitoring tools within such agency networks; and
            ``(2) brief the Committee on Homeland Security of the House 
        of Representatives and the Committee on Homeland Security and 
        Governmental Affairs of the Senate on such prioritization and 
        use.
    ``(c) Improved Metrics.--The Secretary, in coordination with the 
Director of the Office of Management and Budget, shall review and 
update the metrics used to measure security under section 3554 of title 
44, United States Code, to include measures of intrusion and incident 
detection and response times.
    ``(d) Transparency and Accountability.--The Secretary, in 
coordination with the Director of the Office of Management and Budget, 
shall increase transparency to the public on agency cybersecurity 
postures, including by increasing the number of metrics available on 
Federal Government performance websites and, to the greatest extent 
practicable, displaying metrics for agencies.
    ``(e) Maintenance of Technologies.--Subparagraph (B) of section 
3553(b)(6) of title 44, United States Code, is amended by inserting `, 
operating, and maintaining' after `deploying'.

``SEC. 232. FEDERAL CYBERSECURITY BEST PRACTICES.

    ``The Secretary, in consultation with the Director of the Office of 
Management and Budget, shall regularly assess and require 
implementation of best practices for--
            ``(1) securing agency information systems against 
        intrusion; and
            ``(2) preventing data exfiltration from such systems in the 
        event of an intrusion.

``SEC. 233. ASSESSMENT; REPORTS.

    ``(a) Definitions.--In this section:
            ``(1) Appropriate congressional committees.--The term 
        `appropriate congressional committees' means the Committee on 
        Homeland Security of the House of Representatives and the 
        Committee on Homeland Security and Governmental Affairs of the 
        Senate.
            ``(2) Intrusion assessments.--The term `intrusion 
        assessments' means actions taken under the intrusion detection 
        and response plan described in section 230 to detect, identify, 
        and remove intruders in agency information systems.
            ``(3) Intrusion detection and response plan.--The term 
        `intrusion detection and response plan' means the intrusion 
        detection and response plan described in section 230.
    ``(b) GAO Assessment.--Not later than three years after the date of 
the enactment of this section, the Comptroller General of the United 
States shall conduct a study and publish a report on the effectiveness 
of the approach and strategy of the Department's capabilities and plans 
in securing agency information systems, including in the plans and 
assessments under sections 230, 231, and 232.
    ``(c) Report to Congress.--The Secretary, in coordination with the 
Director of the Office of Management and Budget, shall--
            ``(1) not later than six months after the date of the 
        enactment of this section and 30 days after any update thereto, 
        submit to the appropriate congressional committees the 
        intrusion detection and response plan described in section 230; 
        and
            ``(2) not later than one year after the date of the 
        enactment of this section and annually thereafter, submit to 
        Congress--
                    ``(A) a description of the implementation of such 
                intrusion detection and response plan;
                    ``(B) the findings of the intrusion assessments 
                conducted pursuant to such intrusion detection and 
                response plan;
                    ``(C) a description of the advanced network 
                security tools referred to in section 231;
                    ``(D) information relating to the results of the 
                assessment of the Secretary of Federal cybersecurity 
                best practices under section 232; and
                    ``(E) the improved metrics referred to in section 
                231.''.
    (b) Definitions.--Paragraphs (1) and (2) of the second section 226 
of the Homeland Security Act of 2002 (6 U.S.C. 148; relating to the 
national cybersecurity and communications integration center) are 
amended to read as follows:
            ``(1)(A) except as provided in subparagraph (B), the term 
        `cybersecurity risk' means threats to and vulnerabilities of 
        information or information systems and any related consequences 
        caused by or resulting from unauthorized access, use, 
        disclosure, degradation, disruption, modification, or 
        destruction of such information or information systems, 
        including such related consequences caused by an act of 
        terrorism; and
            ``(B) such term does not include any action that solely 
        involves a violation of a consumer term of service or a 
        consumer licensing agreement;
            ``(2) the term `incident' means an occurrence that actually 
        or imminently jeopardizes, without lawful authority, the 
        integrity, confidentiality, or availability of information on 
        an information system, or actually or imminently jeopardizes, 
        without lawful authority, an information system;''.
    (c) Clerical Amendments.--The table of contents for subtitle C of 
title II of the Homeland Security Act of 2002 is amended by adding at 
the end the following new items:

``Sec. 230. Cybersecurity plans.
``Sec. 231. Advanced internal defenses.
``Sec. 232. Federal cybersecurity best practices.
``Sec. 233. Assessment; reports.''.

SEC. 3. DUTIES OF THE SECRETARY OF HOMELAND SECURITY RELATED TO 
              INFORMATION SECURITY.

    Section 3553(b)(6) of title 44, United States Code, is amended by 
striking subparagraphs (C) and (D) and inserting the following:
                    ``(C) providing incident detection, analysis, 
                mitigation, and response information, disseminating 
                related homeland security information, and providing 
                remote or onsite technical assistance to the head of an 
                agency;
                    ``(D) compiling and analyzing data on agency 
                information security and disseminating related homeland 
                security information;
                    ``(E) developing and conducting targeted risk 
                assessments, including assessments of the risk of 
                terrorism, and operational evaluations for agency 
                information and information systems in consultation 
                with the heads of other agencies or governmental and 
                private entities that own and operate such systems, 
                that may include threat, vulnerability, and impact 
                assessments;
                    ``(F) in conjunction with other agencies and the 
                private sector, assessing and fostering the development 
                of information security technologies and capabilities 
                for use across multiple agencies; and
                    ``(G) coordinating with appropriate agencies and 
                officials to ensure, to the maximum extent feasible, 
                that policies and directives issued under paragraph (2) 
                are complementary with--
                            ``(i) standards and guidelines developed 
                        for national security systems; and
                            ``(ii) policies and directives issued by 
                        the Secretary of Defense and the Director of 
                        National Intelligence under subsection (e)(1); 
                        and''.

SEC. 4. DIRECTIVES AND IMMINENT THREATS.

    Section 3553 of title 44, United States Code, is amended by adding 
at the end the following:
    ``(h) Direction to Agencies.--
            ``(1) Authority.--
                    ``(A) In general.--Notwithstanding section 3554, 
                and subject to subparagraph (B), in response to a known 
                or reasonably suspected information security threat, 
                vulnerability, risk, or incident, including an act of 
                terrorism, that represents a substantial threat to the 
                information security of an agency, the Secretary may 
                issue a directive to the head of an agency to take any 
                lawful action with respect to the operation of the 
                information system, including such systems owned or 
                operated by another entity on behalf of an agency, that 
                collects, processes, stores, transmits, disseminates, 
                or otherwise maintains agency information, for the 
                purpose of protecting the information system from, or 
                mitigating, an information security threat or an act of 
                terrorism.
                    ``(B) Exception.--The authorities of the Secretary 
                under this subsection shall not apply to a system 
                described in paragraph (2) or (3) of subsection (e).
            ``(2) Procedures for use of authority.--The Secretary 
        shall--
                    ``(A) in coordination with the Director and in 
                consultation with Federal contractors, as appropriate, 
                establish procedures under which a directive may be 
                issued under this subsection, which shall include--
                            ``(i) thresholds and other criteria;
                            ``(ii) privacy and civil liberties 
                        protections; and
                            ``(iii) providing notice to potentially 
                        affected third parties;
                    ``(B) specify the reasons for the required action 
                and the duration of the directive;
                    ``(C) minimize the impact of a directive under this 
                subsection by--
                            ``(i) adopting the least intrusive means 
                        possible under the circumstances to secure the 
                        agency information systems; and
                            ``(ii) limiting the directive to the 
                        shortest period practicable; and
                    ``(D) notify the Director and the head of any 
                affected agency immediately upon the issuance of a 
                directive under this subsection.
            ``(3) Imminent threats.--
                    ``(A) In general.--If the Secretary determines that 
                there is an imminent threat, including a threat of 
                terrorism, to agency information systems and a 
                directive under this subsection is not reasonably 
                likely to result in a timely response to the threat, 
                the Secretary may authorize the use of protective 
                capabilities under the control of the Secretary for 
                communications or other system traffic transiting to or 
                from or stored on an agency information system without 
                prior consultation with the affected agency for the 
                purpose of ensuring the security of the information, 
                information system, or other agency information 
                systems.
                    ``(B) Limitation on delegation.--The authority 
                under this paragraph may not be delegated to an 
                official in a position lower than an Assistant 
                Secretary of the Department of Homeland Security.
                    ``(C) Notice.--The Secretary shall immediately 
                notify the Director and the head and chief information 
                officer (or equivalent official) of each affected 
                agency of--
                            ``(i) any action taken under this 
                        subsection; and
                            ``(ii) the reasons for and duration and 
                        nature of the action.
                    ``(D) Other law.--Any action of the Secretary under 
                this paragraph shall be consistent with applicable law.
            ``(4) Limitation.--The Secretary may direct or authorize 
        lawful action or protective capability under this subsection 
        only to--
                    ``(A) protect agency information from unauthorized 
                access, use, disclosure, disruption, modification, or 
                destruction; or
                    ``(B) require the remediation of or protect against 
                identified information security risks, including acts 
                of terrorism, with respect to--
                            ``(i) information collected or maintained 
                        by or on behalf of an agency; or
                            ``(ii) that portion of an information 
                        system used or operated by an agency or by a 
                        contractor of an agency or other organization 
                        on behalf of an agency.''.

SEC. 5. REPORT TO CONGRESS REGARDING DHS FUNCTIONS.

    Section 3553 of title 44, United States Code, as amended by section 
3, is further amended by adding at the end the following new 
subsection:
    ``(i) Annual Report to Congress.--Not later than February 1 of 
every year, the Secretary shall report to the Committee on Homeland 
Security of the House of Representatives and the Committee on Homeland 
Security and Governmental Affairs of the Senate, regarding the specific 
actions the Secretary has taken pursuant to subsections (b) and (h).''.

Summary: Cyber Defense of Federal Networks Act of 2015 Amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS), in coordination with the Office of Management and Budget (OMB), to implement plans to: (1) detect, identify, and remove intruders in federal agencies' information systems. And (2) make advanced network security tools available for agencies to improve visibility of network activity to detect and mitigate intrusions and anomalous activity. Directs DHS to coordinate with the OMB to: (1) update government information security metrics to include measures of intrusion and incident detection and response times, and (2) display additional metrics about agency cybersecurity postures on federal government performance websites. Authorizes DHS, upon an agency's request, to operate and maintain technology that is deployed to agencies to diagnose and mitigate cyber threats and vulnerabilities. Requires DHS to regularly assess and require implementation of best practices for securing agency information systems and preventing data exfiltration. Redefines for purposes of DHS's national cybersecurity and communications integration center: (1) cybersecurity risk to exclude actions that solely involve a violation of a consumer term of service or a consumer licensing agreement. And (2) incident to include occurrences that actually or imminently jeopardize, without lawful authority, an information system, thereby replacing a standard that currently includes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies. Requires DHS to assist agencies in implementing information security practices by: (1) providing incident detection, analysis, mitigation, and response information, disseminating related homeland security information, and providing remote or onsite technical assistance. (2) developing and conducting impact assessments in consultation with other governmental and private entities, (3) assessing and fostering technologies for use across multiple agencies. And (4) ensuring that policies are coordinated with standards for national security systems and policies of the Department of Defense (DOD) and the Director of National Intelligence. Authorizes the DHS Secretary to: (1) issue a directive to an agency to take any lawful action with respect to the operation of an agency's information system in response to a known or reasonably suspected information security threat, vulnerability, risk, or incident, including an act of terrorism, that represents a substantial threat to information security. Or (2) authorize, without prior consultation with the affected agency, the use of protective capabilities under the Secretary's control for communications or system traffic transiting to or from or stored on an agency information system if there is an imminent threat and a directive is unlikely to be timely. Exempts DOD and the intelligence community from such procedures.