IIB 

★(Star Print)

114TH CONGRESS 

1ST SESSION H. R. 3878 

IN THE SENATE OF THE UNITED STATES 

DECEMBER 17, 2015 

Received; read twice and referred to the Committee on Commerce, Science, 

and Transportation 

AN ACT 

To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


tkelley on DSK3SPTVN1PROD with BILLS
2 

HR 3878 RFS1S 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Strengthening Cyber3 security Information Sharing and Coordination in Our 

4 Ports Act of 2015’’. 

5 SEC. 2. IMPROVING CYBERSECURITY RISK ASSESSMENTS, 

6 INFORMATION SHARING, AND COORDINA7 TION. 

8 The Secretary of Homeland Security shall— 

9 (1) develop and implement a maritime cyberse10 curity risk assessment model within 120 days after 

11 the date of the enactment of this Act, consistent 

12 with the National Institute of Standards and Tech13 nology Framework for Improving Critical Infrastruc14 ture Cybersecurity and any update to that document 

15 pursuant to Public Law 113–274, to evaluate cur16 rent and future cybersecurity risks (as that term is 

17 defined in the second section 226 of the Homeland 

18 Security Act of 2002 (6 U.S.C. 148)); 

19 (2) evaluate, on a periodic basis but not less 

20 than once every two years, the effectiveness of the 

21 cybersecurity risk assessment model established 

22 under paragraph (1); 

23 (3) seek to ensure participation of at least one 

24 information sharing and analysis organization (as 

25 that term is defined in section 212 of the Homeland 

26 Security Act of 2002 (6 U.S.C. 131)) representing 


tkelley on DSK3SPTVN1PROD with BILLS
3 

HR 3878 RFS1S 

1 the maritime community in the National Cybersecu2 rity and Communications Integration Center, pursu3 ant to subsection (d)(1)(B) of the second section 

4 226 of the Homeland Security Act of 2002 (6 

5 U.S.C. 148); 

6 (4) establish guidelines for voluntary reporting 

7 of maritime-related cybersecurity risks and incidents 

8 (as such terms are defined in the second section 226 

9 of the Homeland Security Act of 2002 (6 U.S.C. 

10 148)) to the Center (as that term is defined sub11 section (b) of the second section 226 of the Home12 land Security Act of 2002 (6 U.S.C. 148)), and 

13 other appropriate Federal agencies; and 

14 (5) request the National Maritime Security Ad15 visory Committee established under section 70112 of 

16 title 46, United States Code, to report and make 

17 recommendations to the Secretary on enhancing the 

18 sharing of information related to cybersecurity risks 

19 and incidents between relevant Federal agencies and 

20 State, local, and tribal governments and consistent 

21 with the responsibilities of the Center (as that term 

22 is defined subsection (b) of the second section 226 

23 of the Homeland Security Act of 2002 (6 U.S.C. 

24 148)); relevant public safety and emergency response 

25 agencies; relevant law enforcement and security orVerDate Sep 11 2014 21:45 Feb 01, 2016 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3878.RFS H3878

tkelley on DSK3SPTVN1PROD with BILLS
4 

HR 3878 RFS1S 

1 ganizations; maritime industry; port owners and op2 erators; and terminal owners and operators. 

3 SEC. 3. CYBERSECURITY ENHANCEMENTS TO MARITIME 

4 SECURITY ACTIVITIES. 

5 The Secretary of Homeland Security, acting through 

6 the Commandant of the Coast Guard, shall direct— 

7 (1) each Area Maritime Security Advisory Com8 mittee established under section 70112 of title 46, 

9 United States Code, to facilitate the sharing of cy10 bersecurity risks and incidents to address port-spe11 cific cybersecurity risks, which may include the es12 tablishment of a working group of members of Area 

13 Maritime Security Advisory Committees to address 

14 port-specific cybersecurity vulnerabilities; and 

15 (2) that any area maritime security plan and 

16 facility security plan required under section 70103 

17 of title 46, United States Code approved after the 

18 development of the cybersecurity risk assessment 

19 model required by paragraph (1) of section 2 include 

20 a mitigation plan to prevent, manage, and respond 

21 to cybersecurity risks. 

22 SEC. 4. VULNERABILITY ASSESSMENTS AND SECURITY 

23 PLANS. 

24 Title 46, United States Code, is amended— 


tkelley on DSK3SPTVN1PROD with BILLS
5 

HR 3878 RFS1S 

1 (1) in section 70102(b)(1)(C), by inserting ‘‘cy2 bersecurity,’’ after ‘‘physical security,’’; and 

3 (2) in section 70103(c)(3)(C), by striking 

4 ‘‘and’’ after the semicolon at the end of clause (iv), 

5 by redesignating clause (v) as clause (vi), and by in6 serting after clause (iv) the following: 

7 ‘‘(v) prevention, management, and re8 sponse to cybersecurity risks; and’’. 

Passed the House of Representatives December 16, 

2015. 

Attest: KAREN L. HAAS, 

Clerk. 


tkelley on DSK3SPTVN1PROD with BILLS