```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

   ENHANCING PREPAREDNESS AND RESPONSE CAPABILITIES TO ADDRESS CYBER 
                                THREATS

=======================================================================

                              JOINT HEARING

                               BEFORE THE
                               
                       SUBCOMMITTEE ON EMERGENCY
                        PREPAREDNESS, RESPONSE,
                           AND COMMUNICATIONS

                                AND THE

                     SUBCOMMITTEE ON CYBERSECURITY,
                       INFRASTRUCTURE PROTECTION,
                       AND SECURITY TECHNOLOGIES

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 24, 2016

                               __________

                           Serial No. 114-71

                               __________

       Printed for the use of the Committee on Homeland Security

[[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________
                               
                               
                     U.S  GOVERNMENT PUBLISHING OFFICE
23-243 PDF                     WASHINGTON : 2017                     
___________________________________________________________________________________________
For sale by the Superintendent of Documents, U.S. Government Publishing Office, 
http://bookstore.gpo.gov. For more information, contact the GPO Customer Contact Center,
U.S. Government Publishing Office. Phone 202-512-1800, or 866-512-1800 (toll-free). 
E-mail, [email protected].  

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Lou Barletta, Pennsylvania           Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania            Filemon Vela, Texas
Curt Clawson, Florida                Bonnie Watson Coleman, New Jersey
John Katko, New York                 Kathleen M. Rice, New York
Will Hurd, Texas                     Norma J. Torres, California
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Daniel M. Donovan, Jr., New York
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

  SUBCOMMITTEE ON EMERGENCY PREPAREDNESS, RESPONSE, AND COMMUNICATIONS

               Daniel M. Donovan, Jr., New York, Chairman
Tom Marino, Pennsylvania             Donald M. Payne, Jr., New Jersey
Mark Walker, North Carolina          Bonnie Watson Coleman, New Jersey
Barry Loudermilk, Georgia            Kathleen M. Rice, New York
Martha McSally, Arizona              Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
             Kerry A. Kinirons, Subcommittee Staff Director
                    Kris Carlson, Subcommittee Clerk
           Moira Bergin, Minority Subcommittee Staff Director

                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                    John Ratcliffe, Texas, Chairman
Peter T. King, New York              Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             Loretta Sanchez, California
Scott Perry, Pennsylvania            Sheila Jackson Lee, Texas
Curt Clawson, Florida                James R. Langevin, Rhode Island
Daniel M. Donovan, Jr., New York     Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Brett DeWitt, Subcommittee Staff Director
                    Katie Rashid, Subcommittee Clerk
       Christopher Schepis, Minority Subcommittee Staff Director
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Daniel M. Donovan, Jr., a Representative in 
  Congress From the State of New York, and Chairman, Subcommittee 
  on Emergency Preparedness, Response, and Communications:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Donald M. Payne, Jr., a Representative in Congress 
  From the State of New Jersey, and Ranking Member, Subcommittee 
  on Emergency Preparedness, Response, and Communications:
  Oral Statement.................................................     3
  Prepared Statement.............................................     5
The Honorable John Ratcliffe, a Representative in Congress From 
  the State of Texas, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     5
  Prepared Statement.............................................     7
The Honorable Cedric L. Richmond, a Representative in Congress 
  From the State of Louisiana, and Ranking Member, Subcommittee 
  on Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Prepared Statement.............................................     8
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     9

                               Witnesses

Mr. Mark Ghilarducci, Director, Emergency Services, Office of the 
  Governor of California:
  Oral Statement.................................................    10
  Prepared Statement.............................................    13
Mr. Daniel J. Cooney, Assistant Deputy Superintendent, Office of 
  Counter Terrorism, New York State Police:
  Oral Statement.................................................    17
  Prepared Statement.............................................    18
Brigadier General Steven Spano, (Retired, USAF), President and 
  Chief Operating Officer, Center for Internet Security:
  Oral Statement.................................................    22
  Prepared Statement.............................................    23
Mr. Mark Raymond, Vice President, National Association of State 
  Chief Information Officers:
  Oral Statement.................................................    28
  Prepared Statement.............................................    30
Mr. Robert Galvin, Chief Technology Officer, Port Authority of 
  New York and New Jersey:
  Oral Statement.................................................    33
  Prepared Statement.............................................    34

 
   ENHANCING PREPAREDNESS AND RESPONSE CAPABILITIES TO ADDRESS CYBER 
                                THREATS

                              ----------                              

                         Tuesday, May 24, 2016

     U.S. House of Representatives,        
      Committee on Homeland Security,      
   Subcommittee on Emergency Preparedness, 
          Response, and Communications, and
     Subcommittee on Cybersecurity, Infrastructure 
             Protection, and Security Technologies,
                                            Washington, DC.
    The subcommittees met, pursuant to call, at 10:07 a.m., in 
Room 311, Cannon House Office Building, Hon. Daniel M. Donovan 
[Chairman of the Subcommittee on Emergency Preparedness, 
Response, and Communications] presiding.
    Present: Representatives Donovan, Walker, McSally, 
Ratcliffe, Watson Coleman, Jackson Lee, Langevin, and Payne.
    Mr. Donovan. The Subcommittees on Emergency Preparedness, 
Response, and Communications and Cybersecurity, Infrastructure 
Protection, and Security Technologies will come to order. The 
subcommittees are meeting today to receive testimony regarding 
efforts to enhance preparedness and response capabilities to 
address cyber threats.
    I now recognize myself for an opening statement. First, I 
would like to thank Chairman Ratcliffe and Ranking Member 
Richmond for working with me and Ranking Member Payne on this 
issue. Also, I would like to thank all out of our witnesses 
today for coming to join us in this important discussion.
    We are all aware the cyber threat is real, from both state 
and non-state actors. The countless cyber attacks against the 
United States and its citizens, including major attacks against 
Target, Home Depot, OPM, and Anthem are just the tip of the 
iceberg.
    I believe that the number and magnitude of attacks will 
only increase, especially as more and more of our lives become 
connected to the internet. It is imperative that we ensure that 
our State and local officials, as well as our first responders, 
are prepared to protect against and respond to a cyber attack.
    Furthermore, we are seeing an increase in the number of 
cyber attacks that, if successful, can cause widespread 
physical damages to a community and require a whole-of-
community response. Already, state and non-state actors have 
attempted to interfere with 9-1-1 call centers, sent out 
inaccurate alerts and warnings, and tried to take over the 
controls of a dam. While we have taken numerous steps to 
enhance our capabilities, we have a long way to go in 
addressing these threats.
    As a member of Chairman Ratcliffe's subcommittee, I have 
heard about the progress the Federal Government, States, and 
localities have made in enhancing our cybersecurity 
capabilities. But I am left scratching my head when I see that 
for the fourth year in a row, the National preparedness report 
released by FEMA indicates that States continue to report 
cybersecurity as the lowest core capability.
    What is preventing us from reaching the appropriate level 
of cybersecurity? What obstacles are States facing, and what 
can we do to help? I am especially interested in learning more 
about what happens after a cyber attack that has physical 
consequences. Who is in charge of the response, and how are 
first responders coordinating with cyber officials who are 
trying to mitigate the attack? I know States like California 
have set up a task force to answer these exact questions.
    Additionally, in 2012, the National-Level Exercise looked 
at the Nation's ability to respond to a large-scale cyber 
attack with physical consequences. One of the key 
recommendations from this exercise was to finalize a cyber 
response plan that clearly defines the roles and 
responsibilities of all of the potential response entities.
    Four years since that exercise and 6 years since the 
interim draft of the National cyber incident response plan was 
released, we do not have a finalized and approved plan. 
Developing and finalizing this plan needs to be a priority of 
the Federal Government. I understand that the Department plans 
to finally begin stakeholder engagement on the development of 
the final plan in the coming weeks. I certainly hope that they 
will be engaging with all of today's witnesses to get their 
feedback.
    Also, I have heard that while sharing cyber information is 
becoming more prevalent, there is still confusion on who States 
should talk to when an incident occurs. The sharing of cyber-
related information with the emergency management and first 
response communities is, at best, ad hoc.
    These people are going to be the first on the scene and 
should have insight into whether the incident they are 
responding to has been caused by a cyber attack. Can States 
utilize their fusion centers to be a force multiplier to 
disseminate critical cyber information? I know that my State is 
taking this approach, and I am interested to hear if it has 
been successful.
    A few years ago, Secretary Johnson made a statement that I 
feel is still true today. He said, ``Cybersecurity is a shared 
responsibility, and it boils down to this: In cybersecurity, 
the more systems we secure, the more secure we are. We are all 
connected on-line, and a vulnerability in one place can cause a 
problem in many other places. So everyone needs to work on 
this. Government officials and business leaders, security 
professionals and utility owners and operators.'' That is why 
we are here today.
    I want to thank all the witnesses for testifying today, and 
I look forward to highlighting the good work that you are all 
doing to enhance your cybersecurity capabilities and learning 
about what areas are still a challenge and how the Federal 
Government can help in mitigating those gaps.
    [The statement of Chairman Donovan follows:]
              Statement of Chairman Daniel M. Donovan, Jr.
                              May 24, 2016
    First, I'd like to thank Chairman Ratcliffe and Ranking Member 
Richmond for working with me and Ranking Member Payne on this issue. 
Also, I would like to thank all the witnesses for coming today to join 
in this important discussion.
    As we are all aware, the cyber threat is real from both state and 
non-state actors. The countless cyber attacks against the United States 
and its citizens, including major attacks against Target, Home Depot, 
OPM, and Anthem, are just the tip of the iceberg. I believe that the 
number and magnitude of attacks will only increase, especially as more 
and more of our lives become connected to the internet. It is 
imperative that we ensure that our State and local officials as well as 
our first responders are prepared to protect against and respond to a 
cyber attack.
    Furthermore, we are seeing an increase in the number of cyber 
attacks that if successful can cause wide-spread physical damages to a 
community and require a whole-of-community response. Already, state and 
non-state actors have attempted to interfere with 9-1-1 call centers, 
send out inaccurate alerts and warnings, and tried to take over the 
controls of a dam. While we have taken numerous steps to enhance our 
capabilities, we have a long way to go in addressing these threats.
    As a Member of Chairman Ratcliffe's subcommittee, I have heard 
about the progress the Federal Government, States, and localities have 
made in enhancing our cybersecurity capabilities, but I'm left 
scratching my head when I see for the fourth year in a row, the 
National Preparedness Report, released by FEMA, indicates that States 
continue to report cybersecurity as the lowest core capability. What is 
preventing us for reaching the appropriate level of cybersecurity? What 
obstacles are States facing and what can we do to help?
    I'm especially interested in learning more about what happens after 
a cyber attack that has physical consequences. Who is in charge of the 
response and how are first responders coordinating with cyber officials 
who are trying to mitigate the attack? I know States like California 
have set up task forces to answer these exact questions.
    Additionally, in 2012, the National Level Exercise looked at the 
Nation's ability to respond to a large-scale cyber attack with physical 
consequences. One of the key recommendations from this exercise was to 
finalize a cyber response plan that clearly defines the roles and 
responsibilities of the all the potential response entities.
    Four years since the exercise and 6 years since the interim draft 
of the National Cyber Incident Response Plan (NCIRP) was released, we 
still do not have a finalized and approved NCIRP. Developing and 
finalizing this plan needs to be a priority of the Federal Government. 
I understand that the Department plans to finally begin stakeholder 
engagement on the development of the final plan in the coming weeks. I 
certainly hope they will be engaging with all of the witnesses at 
today's hearing to get their feedback.
    Also, I have heard that while sharing cyber information is becoming 
more prevalent, there is still confusion on who States should talk to 
when an incident occurs and the sharing of cyber-related information 
with the emergency management and first responder communities is ad hoc 
at best.
    These people are going to be the first on the scene and should have 
insight into whether the incident they are responding to has been 
caused by a cyber attack. Can States utilize their fusion centers to be 
a force multiplier to disseminate critical cyber information? I know my 
State is taking this approach and I'm interested to hear if it has been 
successful.
    A few years ago, Secretary Johnson made a statement that I feel is 
still true today. He said ``[c]byersecurity is a shared responsibility, 
and it boils down to this: In cybersecurity, the more systems we 
secure, the more secure we are. We are all connected on-line and a 
vulnerability in one place can cause a problem in many other places. So 
everyone needs to work on this: Government officials and business 
leaders, security professionals and utility owners and operators.'' And 
that is why we are here today.
    I want to thank all the witnesses for testifying today and I look 
forward to highlighting the good work you all are doing to enhance your 
cybersecurity capabilities and learning about what areas are still a 
challenge and how the Federal Government can help in mitigating those 
gaps.

    Mr. Donovan. The Chair now recognizes the gentleman from 
New Jersey, Mr. Payne, for an opening statement he may have.
    Mr. Payne. Good morning. I would like to thank Chairmen 
Donovan and Ratcliffe for holding today's hearings to assess 
our ability to respond to cyber threats. The last time our 
subcommittee held a joint hearing on the subject was in the 
113th Congress, about 3 years ago. What we have learned is that 
cyber threats are the new frontier of disaster response.
    Our legacy response doctrine from the National Response 
Framework to the Stafford Act are rooted in the era that 
predates reliance on cyber networks and growing threats posed 
by sophisticated actors. Despite our best efforts to ensure 
that our National preparedness doctrine is responsive to 
evolving threats, it has not kept pace with cyber threats.
    My district is rich with critical infrastructure, all of 
which rely on cyber networks. Within 2 miles, we have major 
transit systems, chemical facilities, and refineries mixed 
among homes, schools, and hospitals. A hack of any one of these 
targets could have devastating, cascading effects and could 
risk overwhelming our brave first responders. We know that the 
threat is real.
    Earlier this year, Iranian hackers breached the Bowman 
Avenue's Dam network in Rye, New York. Fortunately, the dam was 
off-line for repair when the authorities discovered this 
breach. But I am worried that it is only a matter of time 
before the hackers are successful, and we need to be prepared 
when they are.
    I applaud efforts at the State level to confront cyber 
threats head on. Some States, like California and my home State 
of New Jersey, have established State-level cyber information-
sharing centers modeled after the National Cybersecurity and 
Communications Integration Center, or NCCIC. I would be 
interested to learn whether these centers facilitate improved 
information sharing and encourage better relationships among 
non-traditional partners who would play an important role in 
cyber response.
    At the same time, I would be remiss if I did not note that 
while States annually indicate that they lack the confidence in 
their cybersecurity capabilities in the National preparedness 
report, very few invest homeland security grant funding to 
address the capability gap. I would be interested in 
understanding why. Is it because the Federal Government has not 
provided adequate guidance on how to address the threat or 
whether the amount of grant funds available after cuts to grant 
programs in the recent years prevent States from investing in 
cyber capability?
    The witnesses at that hearing made two points that stuck 
with me: First, the witnesses emphasized that the response to 
cyber attacks will require people from chief information 
officers to emergency managers to private-sector partners to 
break out of their silos and coordinate with non-traditional 
partners; second, they said that the existing disaster response 
guidance does not adequately address the complexities of 
responding to cyber events these days.
    I look forward to hearing our witnesses' opinions on how 
the National Incident Management System, the National Response 
Framework, and other disaster management doctrine should be 
updated to reflect the unique qualities of a cyber event. I 
appreciate the witnesses for being here today, and I look 
forward to their testimony.
    With that, Mr. Chair, I yield back.
    [The statement of Ranking Member Payne follows:]
            Statement of Ranking Member Donald M. Payne, Jr.
                              May 24, 2016
    The last time our subcommittees held a joint hearing on this 
subject was during the 113th Congress--about 3 years ago. What we 
learned is that cyber threats are the new frontier of disaster 
response.
    Our legacy response doctrine--from the National Response Framework 
to the Stafford Act--are rooted in an era that predates reliance on 
cyber networks and growing threats posed by sophisticated hackers. 
Despite our best efforts to ensure that our National preparedness 
doctrine is responsive to evolving threats, it has not kept pace with 
cyber threats.
    My district is rich with critical infrastructure, all of which rely 
on cyber networks. Within 2 miles, we have major transit systems, 
chemical facilities, and refineries mixed among homes, schools, and 
hospitals. A hack of any one of these targets could have devastating 
cascading effects and could risk overwhelming our brave first 
responders.
    And we know the threat is real. Earlier this year, Iranian hackers 
breached the Bowman Avenue Dam network in Rye, New York. Fortunately, 
the dam was off-line for repair when the authorities discovered the 
breach. But I am worried it is only a matter of time before the hackers 
are successful--and we need to be prepared when they are.
    I applaud efforts at the State level to confront the cyber threat 
head on. Some States--like California and my home State of New Jersey--
have established State-level cyber information-sharing centers modeled 
after the National Cybersecurity and Communications Integration Center. 
I will be interested to learn whether these centers facilitate improved 
information sharing and encourage better relationships among non-
traditional partners who would play important roles in a cyber 
response.
    At the same time, I would be remiss if I did not note that while 
States annually indicate that they lack confidence in their 
cybersecurity capabilities in the National Preparedness Report, very 
few invest Homeland Security Grant funding to address that capability 
gap.
    I will be interested in understanding why--is it because the 
Federal Government has not provided adequate guidance on how to address 
the threat or whether the amount of grant funds available after cuts to 
grant programs in recent years prevents States from investing in cyber 
capabilities?
    While I am on the subject of grant funds, I have been outspoken 
about my opposition to the proposed cuts to the Homeland Security Grant 
Program as well as the Port and Transit Security Grants. I have serious 
concerns that the proposed cuts would only further jeopardize whatever 
progress States and other grantees are making to address cyber threats, 
and I will be interested in the witness' thoughts on that point.
    Finally, as I indicated, our subcommittees held a joint hearing on 
responding to a cyber attack about 3 years ago. The witnesses at that 
hearing made 2 points that stuck with me.
    First, the witnesses emphasized that a response to a cyber attack 
will require people--from chief information officers to emergency 
manager to private-sector partners--to break out of their silos and 
coordinate with non-traditional partners. Second, they said that 
existing disaster response guidance does not adequately address the 
complexities of responding to a cyber event.
    I look forward to hearing our witness' opinions on how the National 
Incident Management System, the National Response Framework, and other 
disaster management doctrine should be updated to reflect the unique 
qualities of a cyber event.

    Mr. Donovan. The gentleman yields.
    The Chair now recognizes the Chairman of the Subcommittee 
on Cybersecurity, Infrastructure Protection, and Security 
Technologies, the gentleman from Texas, Mr. Ratcliffe, for an 
opening statement he may have.
    Mr. Ratcliffe. Good morning, everyone. I want to thank 
Chairman Donovan, Ranking Member Payne, for working with me and 
with Ranking Member Richmond on putting this issue together 
today.
    I also want to thank the witnesses for being here today. I 
am looking forward to hearing your testimony.
    On the Subcommittee on Cybersecurity, Infrastructure 
Protection, and Security Technologies, we talk a lot about the 
variety and high number of growing cyber threats that are out 
there. But today, we are going to hear about the other part of 
the equation, which includes the people, the hours, the 
programs designed and dedicated to preparing for and responding 
to the dangers that these cyber threats pose.
    Hopefully, having this discussion at a National level, will 
help bring to light some of the best practices and most evident 
areas for improvement at every level of government, whether it 
be the Federal, State, or local level. Because the truth is, 
every level of government is constantly having to face and 
respond to these threats, so we all need to be working together 
to understand the tactics and techniques and procedures that 
hackers are using so that we are better equipped to face the 
threats of tomorrow.
    It is important that we spend as much time and energy 
thinking about the solutions that secure Americans as we do 
examining the dangers. The purpose of today's hearing is to 
focus on seeking those solutions to make Americans safer. In 
that spirit, we are constantly seeking to improve upon and 
expand the programs and partnerships in both the private sector 
and State and local governments that function to help keep 
Americans safe. These partnerships are the nuts and bolts to 
secure Americans against the havoc that is possible if a bad 
actor were to successfully disrupt or damage one of the many 
systems that we rely upon for everyday life, like our water and 
our power.
    What we are hoping to gain from today's hearing is what 
more we can be doing to further these partnerships and 
programs. The importance of the flow of information can't be 
stressed enough, as information is the currency with which 
security and insecurity is established in today's digital age.
    As fast as the bad actors are moving in cyber space, we 
have to be constantly moving faster to stay ahead of them, and 
right now we are not. While they have to only be right one time 
to cause damage, we have to always be resilient and stand 
perpetually ready with a plan and with answers. I am glad to be 
having this joint hearing to highlight the interconnectedness 
of the response plans that are in place in case of a 
devastating cyber event, and the first responders who carry 
them out.
    At the Federal level, we have the ability to push out and 
develop plans beyond the capability currently available to the 
50 States. But it is the responders already in those areas who 
will be the first people that those most directly affected will 
see if a catastrophic cyber attack occurs.
    As Chairman Donovan mentioned, the draft National incident 
response plan, or NCIRP, was delivered to the White House in 
fall 2009, and in March 2010, an interim draft was released but 
not approved, subject to on-going review by the administration. 
It has now been 6 years since the release of the interim draft 
with stakeholder engagement just now starting. Six years is 
entirely too long for any type of response plan to sit on a 
shelf in the White House, but it is especially dangerous in the 
case of cyber.
    In 2014, Congress passed a law to require this cyber 
incident response plan to be finalized. Clearly, the 
administration, by not finalizing this plan doesn't seem to be 
taking cyber incident response planning seriously. It begs the 
very obvious questions: What if there is a significant cyber 
attack in the United States? Does every level of government 
know their role? And how cyber response will be coordinated?
    We are neither too ignorant nor too proud to think that a 
major cyber event is outside the realm of possibility right 
now. So I would like to take this moment to convey that we are 
watching the development of this document very closely.
    Look, it is very apparent that we have a lot more work to 
do. Securing our States from cyber threats now includes 
entirely new roles and responsibilities that didn't exist 50 
years ago. Discussing, examining, and encouraging the programs 
and partnerships that Americans rely upon is absolutely 
critical to being able to preserve and guarantee the American 
way of life.
    I look forward to hearing from our witnesses today to learn 
what more we can and what we should be doing to advance the 
security of the American people.
    Thank you. I yield back.
    [The statement of Chairman Ratcliffe follows:]
                  Statement of Chairman John Ratcliffe
                              May 24, 2016
    Good morning, I want to thank Chairman Donovan and Ranking Member 
Payne for working with myself and Ranking Member Richmond on this 
issue. I also want to thank the witnesses for coming today to speak on 
this important topic. On the Subcommittee on Cybersecurity, 
Infrastructure Protection, and Security Technology, which I chair, we 
often discuss the wide variety and high number of cyber threats that 
are out there and growing. Today, we are going to hear about the other 
part of the equation, which is the people, the hours, and programs 
designed and dedicated to preparing for and responding to the dangers 
that these cyber threats pose.
    Hopefully having this discussion at a National level will help 
bring to light some of the best practices and most evident areas for 
improvement that will be applicable to every level of government 
whether it be at the Federal, State, or local level. Because the truth 
is, every level of government is constantly having to face and respond 
to these threats. We all need to work together to understand the 
tactics, techniques, and procedures of hackers in order to better equip 
ourselves and face the threats of tomorrow.
    It is important that we spend as much time and energy thinking 
about the solutions that secure Americans as we do on the examination 
of the dangers. The purpose of today's hearing is to focus on seeking 
those solutions to make America safer. In that spirit, we are 
constantly seeking to improve upon and expand the programs and 
partnerships with both the private sector and State and local 
governments that function to make Americans safe. These partnerships 
are the nuts and bolts to secure Americans against the havoc that is 
possible should a bad actor successfully disrupt or damage one of the 
many systems that we rely on for everyday life such as our water and 
our power.
    What we are hoping to gain from today's hearing is what more we can 
be doing to further these partnerships and programs. The importance of 
the flow of information cannot be stressed enough as information is the 
currency with which security and insecurity is established in today's 
age. As fast as the bad actors are moving in cyber space, we have to be 
constantly moving faster to stay ahead of them. While they only have to 
be right once to do damage, we must be resilient and stand perpetually 
ready with a plan and with answers.
    I'm glad to be having this joint hearing to highlight the 
interconnectedness of the response plans that are in place in the case 
of a devastating cyber event, and the first responders who carry them 
out. At the Federal level we have the ability to push out and develop 
plans beyond the capability currently available to States, but it is 
the responders already in the area who will be the first people that 
those most directly affected will see when a catastrophic cyber attack 
occurs.
    As Mr. Donovan mentioned, the draft National Incident Response Plan 
or NCIRP was delivered to the White House in the fall of 2009. In March 
2010, a draft interim was released but not approved, subject to on-
going review by the administration. It has now been 6 years since the 
release of the interim draft, with stakeholder engagement just now 
starting. While 6 years is entirely too long for any type of response 
plan to sit on a shelf in the White House, it is especially dangerous 
in the case of cyber. In 2014, Congress passed a law to require this 
cyber incident response plan to be finalized. Clearly, this 
administration, by not finalizing this plan, does not take cyber 
incident response planning seriously. It begs the very obvious question 
``What if there is a significant cyber attack in the United States? 
Does every level of government know their role and how cyber response 
will be coordinated?'' We are neither too ignorant nor too proud to 
think that a major cyber incident is outside of the realm of 
possibility so I would like to take this moment to convey that we are 
watching the development of this document very closely.
    It is very apparent that we have a lot more work to do. Securing 
our States from cyber threats now includes entirely new roles and 
responsibilities that didn't exist 50 years ago. Discussing, examining, 
and encouraging the programs and partnerships that Americans rely on is 
absolutely crucial in guaranteeing the solvency of our ways of life. I 
look forward to hearing from the witnesses to learn what more can and 
should be done to advance the security of the American people.

    Mr. Donovan. The gentleman yields back.
    The Chair recognizes the gentleman from New Jersey, Mr. 
Payne.
    Mr. Payne. Mr. Chairman, I ask unanimous consent to submit 
the gentleman from Louisiana, the Ranking Member, Mr. 
Richmond's statement into the record.
    Mr. Donovan. Without objection, so ordered.
    [The statement of Ranking Member Richmond follows:]
             Statement of Ranking Member Cedric L. Richmond
                              May 24, 2016
    In developing policy and budgeting for cyber preparedness and 
response, it is crucial we know what needs protecting, how badly 
protection is needed, and what kinds of redundancies can be made 
available.
    For critical infrastructure entities, after knowing what machines 
are operating on a network, what applications they are running, and 
what privileges have been established, the posture of cybersecurity for 
each of these entities and systems networks is key.
    Also, for critical infrastructure enterprises and supply chains, 
the advent of, ``bring your own devices'', along with the growing 
sophistication of smart phones and tablets involved in day-to-day 
infrastructure operations, compounds cybersecurity efforts and 
increases our resiliency challenges.
    Knowing where to devote efforts to protect our information security 
in critical infrastructure organizations is a core choice, particularly 
in determining how much defense to commit to the perimeter, and how 
much to commit to internal threats.
    Consider the potential for adversaries to employ countermeasures . 
. . as defenses are installed on our systems, we must acknowledge that 
we are dealing with a thinking and competitive opponent in the cyber 
world . . . and that as we install measures to thwart hackers that very 
act tends to induce countermeasures from our foes, as hackers probe for 
ways around or through our new defenses.
    As new versions of cyber attacks emerge affecting critical 
infrastructure, it will be important to have the DHS Industrial Control 
Systems Computer Emergency Response Teams, or ICS-CERT, and the Joint 
Interagency Task Force consisting of the National Institute of 
Standards and Technology, or NIST, the Department of Defense, and the 
intelligence community, clearly delineate and prioritize their roles in 
protecting critical infrastructure, and to have that as well-defined as 
possible.
    A good place to start is to build a body of cyber knowledge on how 
various critical infrastructure cyber systems are likely to fail, which 
is a necessary prerequisite to preventing failure, and then share that 
information among all sectors.
    Most experts tell us this is a daunting proposition, in light of 
the fast pace and range of cyber threat vectors that present themselves 
daily, but we must try.
    In closing, any critical infrastructure sector that is prepared to 
share what went wrong and what could be done better next time, will 
create the most likely scenario to produce higher levels of 
cybersecurity and resiliency for future regional and National cyber 
emergency situations.

    Mr. Donovan. Other Members of the subcommittees are 
reminded that opening statements may be submitted for the 
record.
    [The statement of Ranking Member Thompson follows:]
             Statement of Ranking Member Bennie G. Thompson
                              May 24, 2016
    Over the past 15 years, the Nation has experienced man-made and 
natural disasters that caused damage beyond our expectations and 
overwhelmed the response capabilities of the impacted communities. 
After each disaster--from the 9/11 attacks and Hurricane Katrina to the 
Boston Marathon bombings and Hurricane Sandy--we take the lessons 
learned and adjust the response plans so that we are better prepared 
for the next version of the same event.
    Preparing to respond to those kinds of events has become almost 
routine. We assess terror threats and the potential for various natural 
disasters. We conduct vulnerability assessments of our communities, and 
we hone, train, and exercise our disaster response plans. The doctrine 
guiding how we prevent, protect against, mitigate, respond to, and 
recover from more conventional disasters is well-established and 
incorporates important lessons learned from past events.
    Unfortunately, National guidance of a similar caliber is lacking 
for a response to a cyber attack. When I am home in Mississippi, local 
emergency managers tell me that roles and responsibilities are not 
clearly defined for a cyber response and that the statutory authority 
for the Federal Government to render aid to affected States is murky at 
best.
    We need to do better. The frequency of cyber attacks is increasing 
and the attacks are becoming more sophisticated. I fear a cyber Katrina 
if we do not establish a ``whole community approach'' to prevent, 
respond to, and recover from cyber attacks soon, before hackers disable 
part of the electric grid, gain control of one of our transit systems, 
or infiltrate our water treatment facilities.
    Addressing the growing cyber threat and equipping emergency 
managers with the tools they need to effectively respond to disasters 
triggered by hackers will require at least 3 changes.
    First, we have to improve information sharing. Second, we have to 
improve communication among the emergency response community and non-
traditional response partners, including private-sector infrastructure 
owners and chief information officers. Third, we have to do a better 
job defining roles, responsibilities, and authorities related to a 
cyber response.
    Late last year, the House of Representatives took an important step 
advancing those objectives by passing H.R. 3878, the Strengthening 
Cybersecurity Information Sharing and Coordination in Our Ports Act.
    Introduced by Congresswoman Torres, H.R. 3878 would improve 
information sharing and cooperation in addressing cybersecurity risks 
at our Nation's ports by directing DHS to establish voluntary 
guidelines for reporting of cybersecurity risks, implement a maritime 
cybersecurity risk model, and make recommendations on enhancing the 
sharing of cyber information.
    The legislation also directs the Coast Guard to ensure area 
maritime security and facility security plans address cybersecurity 
risks. H.R. 3878, along with several other important pieces of 
cybersecurity legislation from this committee, has passed the House is 
currently pending in the Senate. I urge our Senate colleagues to act on 
these bills before the summer recess.
    In the mean time, I am eager to learn from our witnesses about 
existing challenges in developing response plans for cyber events and 
what the Federal Government can do to help.

    Mr. Donovan. We are pleased to have a distinguished panel 
before us today on this important topic. Mark Ghilarducci 
serves as the director of the California Governors Office of 
Emergency Services, a position he has held since July 1, 2013. 
As a member of the cabinet, Director Ghilarducci serves as the 
Governor's Homeland Security Adviser, and oversees State-wide 
public safety, emergency management, emergency communications, 
counterterrorism efforts, and a State threat assessment system. 
Mr. Ghilarducci previously served as the secretary of the 
California Emergency Management Agency. Welcome, sir.
    Lieutenant Colonel Daniel J. Cooney currently serves in the 
Office of Counterterrorism of the New York State Police. He 
serves as adviser to the director of the New York State Office 
of Homeland Security and oversees the staff of the New York 
State Intelligence Center, New York's fusion center. He has 
been a New York State police officer for 23 years, and has been 
awarded a master's degree in security studies from the Naval 
Postgraduate School. Welcome, Colonel.
    Brigadier General Steven J. Spano is president and chief 
information officer of the Center for Internet Security. Most 
recently, he served as the general manager for defense and 
national security for Amazon Web Services Worldwide Public 
Sector. Prior to Amazon Web Services, General Spano served over 
28 years in United States Air Force in a variety of leadership 
roles. He retired in 2011 from Air Force combat command where 
he served as the director of communications. Welcome, General, 
and thank you for your service to our country.
    Mr. Mark Raymond began serving as the chief information 
officer for the State of Connecticut Department of 
Administrative Services, Bureau of Enterprise Systems and 
Technology on June 2, 2011. He has over 2 decades of technology 
and business experience consulting in New York, Connecticut, 
and Massachusetts; that includes working in the areas of 
finance, payroll, human services, budgeting, procurement, human 
services revenue, and transportation. As a consultant, he has 
worked with Federal agencies, including the United States 
Treasury, Federal Highway Administration, National Highway 
Traffic Safety Administration, and the U.S. Department of 
Transportation. Welcome, sir.
    Mr. Robert Galvin serves as the chief technology officer 
for the Port Authority of New York and New Jersey, a position 
he has held since December 2013. In this capability, he 
provides oversight, direction, and management for all of the 
agency's technology, information systems, and technology 
service delivery. Prior to joining the Port Authority, Mr. 
Galvin served as the chief technology officer at the New York 
City School Construction Authority.
    The witnesses' full written statements will appear in the 
record. The Chair now recognizes Mr. Ghilarducci for 5 minutes.

 STATEMENT OF MARK GHILARDUCCI, DIRECTOR, EMERGENCY SERVICES, 
              OFFICE OF THE GOVERNOR OF CALIFORNIA

    Mr. Ghilarducci. Okay. Well, good morning, Chairman and 
distinguished Members of the subcommittee. Mark Ghilarducci, 
and I am the director of OES in California. I am here today on 
behalf of the National Emergency Management Association, which 
represents State emergency management directors of the 50 
States, territories in the District of Columbia.
    I appreciate the opportunity to come before you today to 
discuss concerns related to the consequences of a cyber attack 
and the role of emergency management community in responding to 
this unique and evolving threat. As our lives, our systems, our 
critical infrastructure, as well as our emergency management 
coordination and communication platforms become more and more 
integrated with and dependent upon the Internet of Things, so 
does the proliferation of threats and complexities from cyber 
attacks, and, of course, the need to continue to evolve 
capabilities and countermeasures.
    These emerging threats, ushered in by advancements in 
technology, are a challenge for emergency management at a time 
when the adversary is unpredictable, asymmetrical, and very 
active. The range of threat actors, the methods of attack, 
targeted systems, and victims are ever-expanding. Because 
information systems are now the backbone of critical 
infrastructure in the United States, we are at an age of 
transitioning into next generation public safety due to its 
significance to National and economic security.
    Of concern to the emergency management community is the 
threat and potential cascading impacts of a cyber attack to our 
critical infrastructure systems. Lifelines and assets, whether 
physical or virtual, by actors with malicious intent to exploit 
vulnerabilities, disrupt or destroy control systems, or 
incapacitate the delivery of essential services, all which 
places the security and safety of our communities, our 
citizens, and the economy at great jeopardy.
    Like the consequences of other asymmetrical terrorist 
threats, consequence management of cyber attacks is challenging 
due to its unpredictable and ubiquitous nature. It requires a 
considered and coordinated effort of collaborative planning, 
risk identification and management, communications, information 
sharing, interdiction, response and mitigation.
    As information technology becomes increasingly integrated 
with physical infrastructure operations, emergency management 
must plan and prepare for the increased risk for large-scale or 
high-impact events and that cascading impacts that could harm 
or disrupt services, or worse, cause fatalities or destruction 
in our communities. Widespread and long-term power outages, 
loss of water telecommunications systems, disruption of public 
health or public safety systems, destruction of control 
systems, interruption of food production and distribution, and/
or the movement of commodities or people are just a few 
potential consequences of a successful cyber attack on our 
critical infrastructure; all consequences emergency management 
must consider, plan, and prepare for.
    There is no doubt that the potential aftermath of a 
significant cyber attack resulting in physical consequences 
will challenge existing hierarchies, dependencies, reporting 
structures, and planning assumptions. Emergency managers will 
need to leverage all necessary local, State, and private-sector 
resources; implement redundant capabilities for continuity of 
operations, and possible continuity of Government; and will 
require Federal support for both technical and Stafford Act 
assistance. But it remains unclear today how the consequences 
of an attack will be defined and meet requirements for Stafford 
Act assistance.
    Another challenge facing State emergency management and 
homeland security organizations is the ability to effectively 
manage cyber risk as it is not possible to eliminate it. Like 
many other hazards, both natural and human-caused, State 
leaders must build cybersecurity systems, communication, and 
information capabilities, and procedures designed to not only 
preempt attacks through adequate cyber defense systems, but 
enable an organization to withstand attacks when they succeed, 
or, in other words, to build cyber resilience.
    A logical approach to cybersecurity preparedness and 
incident response begins at all levels of government and in 
partnership with the private sector. As the Federal Government 
continues to build its capabilities, policies, and strategies, 
it has left States to build cybersecurity capacities with 
limited resources, trained personnel, and guidance or a 
specific blueprint to follow, all while facing threat actors 
who are advanced, nimble, quick to adapt, and overcome defenses 
in intending to do harm to private citizens and government 
services.
    Dedicated cybersecurity grants for planning and operational 
capabilities, developing, training, and supporting the 
blueprint of a workforce of cyber warriors, as well as 
identified post-event, remediation funding streams that do not 
currently exist, but are absolutely necessary to ensure States 
are prepared to adequately build cyber capabilities and 
defenses, this needs to be a priority.
    For example, in California, one key cybersecurity 
capability we recently stood up is the California Cybersecurity 
Integration Center as a way to measure our whole-of-Government 
and public/private sector integration approach. The Cal-CSIC, 
as it is called, integrates critical cybersecurity functions 
directly impacting my ability to manage both the homeland 
security and emergency management portfolios in California.
    It is co-located with the California State Threat 
Assessment Center, our State's primary fusion center, which 
maximizes information sharing and allows for communications to 
be properly vetted and classified, ensuring conductivity and 
information sharing between the intelligence community, law 
enforcement, and California's other 5 regional fusion centers, 
and it expands upon our current capabilities focused 
specifically on protecting California.
    It resides within our homeland security division, aligned 
with DHS's organizational structure, and integrates both the 
academic and private sectors. It provides a State-wide nexus 
for cyber threat information sharing for the State of 
California, our critical infrastructure sector partners that 
provide essential services, our 
9-1-1 system, the intelligence community, and law enforcement.
    It promotes proactive situational awareness of the cyber 
threat, cyber hygiene, and best cybersecurity practices, and it 
augments the State Emergency Operation Center during 
activations for emergency incidents through systems analysis 
and resilient communication. Most importantly, it provides 
support to our State's emergency support Function 18, the 
component of the State emergency plan that focuses on the 
impacts and countermeasures related to a major cyber attack.
    A key element for success of this capability, but, 
nonetheless, a challenge we are working with, is establishing a 
blueprint for integrating desperate agency sector efforts and 
mission sets into a unified, coordinated, and streamlined 
operation that reflects the full intelligence cycle from 
collection analysis to dissemination that supports situational 
awareness and the complete emergency management cycle.
    The Cal-CSIC design forces collaboration between all of the 
major State agencies and sector representatives that have a 
role in cybersecurity through protocols and the integration of 
respective cybersecurity staff. This partnership forces down 
the silos and stovepipes and generates a level of collaboration 
on the cyber front not seen before in our State government, 
which helps to define the roles and responsibilities of each 
organization during cyber events at a State-wide significance.
    As well, through partnerships with the National 
Cybersecurity Communications Integration Center and a multi-
State information-sharing analysis center, the Cal-CSIC 
addresses prevention, protection, response, and recovery while 
providing detail on cyber threats and trends specifically to 
California. The Cal-CSIC can use this analysis to notify 
residents of current threats and how to prevent and mitigate 
those threats.
    The consolidation of National, State, and local cyber 
threat data will provide a more strategic picture benefiting 
prevention and response. To further our resiliency platform, we 
are also moving to implement the DHS and CCIC cyber hygiene 
campaign across California's State agencies and departments.
    In closing, collaboration, coordination, training, 
planning, clear protocols, real-time information sharing, and 
processing of indicators of attack are essential elements of a 
robust cybersecurity and emergency management posture for all 
governments. Linking up critical infrastructure assessors and 
analysis, and analysts with cybersecurity personnel and 
emergency planners also needs to be approached holistically and 
sustainably.
    At all levels, Government must be prepared to deal with an 
ever-changing and increasingly complex set of challenges that 
test our traditional approaches to emergency preparedness and 
response to disasters. Changing demographics, emerging 
technologies, and the interdependencies of our infrastructure 
and systems create vulnerabilities that defer from those of the 
past.
    The cyber threats facing our Nation are not subsiding, but, 
in fact, are evolving in such a way that these threats demand 
purposeful, proactive action, adequate funding support, and a 
more forward-thinking and collaborative approach at all 
government levels and critical infrastructure sectors. This has 
to be one team, one fight.
    Thank you.
    [The prepared statement of Mr. Ghilarducci follows:]
                 Prepared Statement of Mark Ghilarducci
                              May 24, 2016
                              introduction
    Thank you Mr. Chairman, Ranking Member, and distinguished Members 
of the committee. My name is Mark Ghilarducci, and I am the director of 
the Governor's Office of Emergency Services as well as the Homeland 
Security Advisor to Governor Jerry Brown for the State of California.
    I am here on behalf of the National Emergency Management 
Association (NEMA), which represents the emergency management directors 
of the 50 States, territories, and District of Columbia. NEMA's 
members, many of whom, like me, also serve as Homeland Security 
Advisors, are prepared to deal with an ever-changing and increasingly 
complex set of challenges that test traditional approaches to natural 
and man-made disasters. I appreciate the chance to come before you 
today to discuss the current concerns related to consequences of cyber 
attacks and the role of the emergency management community in 
responding to these unique events.
                           where are we now?
    We are witnessing a more diverse array of threats than at any other 
time in history. The skill, speed, and adaptability of these threats 
are challenging our defense in ways we have not seen before. The 
emerging threat landscape for the Nation is characterized both by 
standing threats, as well as dynamic and fluid ones ushered in by 
advancements in technology. As we witness our society make 
unprecedented advancements in innovation, we become more and more 
reliant on information technology and increasingly vulnerable to 
devices that are developed and distributed with minimal security 
requirements. The ranges of threat actors, methods of attack, targeted 
systems, and victims are also expanding.
    We are transitioning into Next Generation Public Safety, and 
information systems are now the backbone of National and economic 
security in the United States. Our success as a Nation depends upon 
critical infrastructure functioning reliably at all times. The threat 
to this infrastructure by those with malicious intent to exploit 
vulnerabilities, steal information and money, and disrupt, destroy, or 
threaten the delivery of essential services are unlike any other. 
Cybersecurity threats exploit the risks associated with the increased 
complexity and connectivity of these systems, which places our Nation's 
security, economy, and public safety at greater risk.
    This risk affects both the private and public sectors. We have seen 
``Ransomware'' in the public and private sector in California and 
across the United States designed to prevent public and private 
institutions from accessing their own data. Criminal tools and malware 
are increasingly being discovered on State and local government 
networks.
    As information technology becomes increasingly integrated with 
physical infrastructure operations, there is increased risk for wide-
scale or high-impact events that could cause harm or disrupt services 
upon which our economy and the daily lives of millions of Americans 
depend. Long-term power outages, loss of water, and disruption in the 
movement of goods, services, and people as a result of disrupted 
transportation systems are a few of the potential consequences of a 
successful cyber attack on our critical infrastructure.
    The aftermath of a cyber event with physical consequences will 
challenge existing hierarchies, reporting structures, and planning 
assumptions. In the event of an incident, most emergency managers will 
turn to the Robert T. Stafford Disaster Relief and Emergency Assistance 
Act (Pub. L. 92-288) for Federal assistance, but unless the 
consequences of a cyber attack have large-scale physical consequences, 
funds from the Stafford Act will be limited.
    Many of the fixes, whether administrative or legislatively 
initiated, throughout the last few years seem to only address the 
prevention and preparedness side of cybersecurity. While the pre-event 
aspects of cybersecurity maintain a high level of importance, so too 
will the post-event considerations especially when considering the 
potential disastrous physical consequences of a cyber attack.
 current challenges facing state emergency management/homeland security
    While cybersecurity and cyber response capabilities continually 
rate very low in FEMA's annual National Preparedness Report, 
identifying the capability gaps and needs is often a difficult task for 
State and local government and has limited measurable improvement 
toward the National Preparedness Goal.
   Cyber risk must be managed as it is not possible to 
        eliminate; the diverse possibilities of malicious actors 
        penetrating, intruding, and circumventing from the inside 
        continue to grow and will hold every internet communication 
        technology system at risk for years to come.
   The risk calculus employed by some State and local 
        organizations does not adequately address the top cyber threats 
        or systemic interdependencies across critical infrastructure 
        sectors.
   State leaders must accept the predictability of cyber 
        attacks, and build security systems and procedures that can not 
        only preempt attacks through cyber defense, but enable 
        organizations to withstand attacks when they succeed, or in 
        other words build cyber resilience.
   A coordinated approach to cybersecurity preparedness and 
        incident response is in its nascent stages, even at the Federal 
        level. As the Federal Government is still working to build 
        Federal institutions, policy, and strategy, it has left States 
        to build cybersecurity capacities with limited resources and 
        trained personnel, and a lack of guidance or successful 
        blueprint to follow--all while facing threat actors who are 
        advanced, nimble, quick to adapt and overcome defenses and who 
        intend to harm private citizens and Government services.
   A dedicated cybersecurity grant funding stream would also 
        ensure States were prepared to adequately build their cyber 
        capabilities and defenses. Currently there is no funding 
        dedicated specifically to this priority.
   States are still playing catch-up in developing a ``whole-
        of-Government,'' State-wide approach to cybersecurity.
     best practices at the state level/on-going efforts to improve 
                               resilience
    I am excited to discuss some California examples of best practices 
we are implementing to ensure the Golden State is safe and secure and 
cyber resilient.
   Cyber Hygiene Partnership with DHS's National Cybersecurity 
        Communications Integration Center (NCCIC).--We are moving to 
        embrace and implement the DHS's National Cybersecurity 
        Communications Integration Center's Cyber Hygiene campaign 
        across California State Agencies. Working with NCCIC staff, we 
        are working to push this program to all of California's State 
        executive agencies as a start. This program is voluntary, but 
        it will allow us to baseline State agencies' vulnerabilities 
        and provide an overall State profile for a majority of public-
        facing assets. This is a good metric for performance and will 
        help our team develop a long-term State strategy. To date, only 
        13 organizations across all of California are taking advantage 
        of this Federal program.
   Integrating and Automating Data Feeds.--One of the things we 
        are spearheading in California is a Cal OES-supported project 
        at our California fusion centers that supports automating cyber 
        threat intelligence, as we believe that is a fundamental facet 
        to cyber resilience on all levels of Government. We must get 
        past the manual human-to-human transactions that continue to 
        dominate State and local cyber information sharing and move 
        towards an automated cyber threat intelligence design, which we 
        believe should anchor States' resilience and inform cyber 
        response efforts. We are also working, in conjunction with DHS/
        NCCIC, on a program called Automated Indicator Sharing 
        Initiative, which shares observable cyber ``indicators'' to 
        also help bolster the State's defense through a machine 
        indicator exchange.
   California Cybersecurity Integration Center (Cal-CSIC).--We 
        recently stood up our California Cybersecurity Integration 
        Center (Cal-CSIC) (pronounced Cal-SICK) as a way to mature this 
        approach, but one of the biggest challenges we face is 
        establishing a blueprint for integrating disparate efforts and 
        mission sets into a unified, coordinated, and streamlined 
        operation that reflects the full intelligence cycle from 
        collection, analysis, to dissemination, and that supports a 
        robust cyber response.
    The Cal-CSIC does the following critical cybersecurity functions, 
directly impacting my ability to manage both the homeland security and 
emergency management portfolios in California:
   Expands upon current capabilities in our State's primary 
        fusion center to build out a cybersecurity center focused 
        specifically on protecting California.
   Resides within the Cal OES Homeland Security Division, 
        aligning with DHS's organizational structure.
   Its co-location with the California State Threat Assessment 
        Center (STAC) allows for communications to be properly vetted 
        and classified, ensuring connectivity between the intelligence 
        community, law enforcement, and fusion centers.
   Provides a State-wide nexus for cyber threat information 
        sharing for the State of California, intelligence community, 
        and law enforcement.
   Promotes situational awareness of cyber threats, cyber 
        hygiene, and best cybersecurity practices for all California 
        organizations.
   Augments the State Operations Center activities during 
        emergency incidents through media analysis and resilient 
        communications.
   Marries our critical infrastructure analysts and assessors 
        to our cybersecurity professionals to create a novel holistic 
        security assessments capability.
    The National Cybersecurity Communications Integration Center 
(NCICC) and Multi-State Information Sharing Analysis Center (MS-ISAC) 
operate as focal points for cyber and physical protection of Federal, 
State, local, Tribal, territorial government (FSLTT) and Critical 
Infrastructure/Key Resources (CI/KR) network, storage, and 
communications systems and seeks to address prevention, protection, 
response, and recovery.
    The Cal-CSIC will address prevention, protection, response, and 
recovery while providing detail on cyber threats and trends 
specifically to California. The Cal-CSIC can use this analysis to 
notify residents of current threats and how to prevent and mitigate 
those threats. The consolidation of National and State cyber threat 
data will provide a more strategic picture benefitting prevention and 
response. The NCCIC will also be a partner in the Cal-CSIC as will 
other Federal agencies to ensure for real-time collaboration and 
coordination that is needed.
    The Cal-CSIC design forces collaboration between all of the major 
State agencies that have a role in cybersecurity because those agencies 
have, or are going to, embed their cybersecurity staff there. This 
partnership will force down the siloes and stove pipes, and generate a 
level of collaboration on the cyber front not seen before in State 
government, which helps to define the roles and responsibilities of 
each agency during cyber events of State-wide significance.
   Governor's Cybersecurity Task Force.--This task force 
        facilitates cybersecurity outreach to private industry, 
        academic, law enforcement, and Government partners both inside 
        and outside of California. The Governor's Cybersecurity Task 
        Force is a public-private partnership that serves as the 
        advisory body to the Cal-CSIC to raise awareness of new threats 
        and mitigation techniques.
    Sometimes, simply assembling the right players to have the tough 
conversations is half the battle. In this case, educating cybersecurity 
professionals about emergency management, and vice versa, remains a 
significant challenge. This is why the State of California created the 
Governor's Cybersecurity Task Force to be wide-reaching, pairing up 
local emergency management experts with cybersecurity professionals to 
collaborate on the bigger strategic questions. It has made a tremendous 
impact, but more work needs to be done to align State and local defense 
with Federal efforts.
                     recommendations for the future
    As a Nation we must map out a comprehensive collaborative strategy 
that delivers timely, cost-effective, and actionable responses. This 
will strengthen our National security by better preparing us to respond 
to potential disruptions that would have cascading consequences on the 
country. Collaboration, employee cybersecurity training, enterprise 
defense-in-depth, and real-time information sharing and processing of 
indicators of attacks are essential elements of a robust cybersecurity 
posture for all governments. Marrying critical infrastructure assessors 
and analysts with cybersecurity personnel also will breed unique and 
nuanced synergies by approaching the problem holistically. This would 
include:
   Review current statutory authorities for emergency 
        management personnel and ensure resources can and will be 
        available to respond to a cyber attack.
   Encourage information sharing between intelligence and 
        operational officials to ensure stovepipes do not unnecessarily 
        hinder collaboration and integrated planning.
   Coordinate with State and local officials to ensure their 
        priorities are included in legislative reforms and changes 
        within the administration's cybersecurity policies.
   Avoid mandating State and local governments without also 
        providing Federal funding.
   Provide adequate and sustainable funding to ensure for the 
        development of robust cybersecurity interdiction, response and 
        preparedness/education systems at the State and local levels, 
        to better inform and empower communities, where the 
        consequences of cyber attacks are most impactful.
   Ensure that we communicate to American citizens our 
        commitment to protecting their privacy, when incorporating 
        emerging technology--specifically, the Internet of Things or 
        ``smart devices.''
    While these devices maximize efficiency and carry the allure of 
convenience, we must incorporate the benefits of innovative technology 
into State and local government with the utmost appreciation for their 
potential to threaten data privacy, data integrity, or continuation of 
services. This also opens vulnerabilities by allowing threat actors to 
not only steal data, but also, manipulate it. Threat actors almost 
certainly will adapt and introduce new tactics that will challenge our 
defenses so we must seize the opportunities to implant past 
intelligence from cybersecurity investigations back into the 
intelligence cycle for further analysis and dissemination.
                               conclusion
    At all levels, Government must be prepared to deal with an ever-
changing and increasingly complex set of challenges that test our 
traditional approaches to emergency preparedness and responses to 
disaster. Capability, experience, and flexibility are critical in 
dealing with emerging issues and the unknown. Changing demographics, 
emerging technologies, and the interdependencies of our infrastructure 
and systems create vulnerabilities that differ from those of the past. 
The cyber threats facing our Nation are evolving in such a way that 
demands purposeful action and a more forward-thinking approach in our 
National preparedness efforts.
    I appreciate the opportunity to testify before you today and stand 
ready to answer any questions the committee may have.

    Mr. Donovan. Thank you, Mr. Ghilarducci.
    The Chair now recognizes Lieutenant Colonel Cooney for 5 
minutes.

STATEMENT OF DANIEL J. COONEY, ASSISTANT DEPUTY SUPERINTENDENT, 
       OFFICE OF COUNTER TERRORISM, NEW YORK STATE POLICE

    Mr. Cooney. Good morning, Chairman Donovan, Ranking Member 
Payne, Chairman Ratcliffe, and Members of the subcommittees. 
Thank you for inviting me to testify today.
    My name is Dan Cooney. I am a lieutenant colonel with the 
New York State Police responsible for overseeing the New York 
State Intelligence Center or NYSIC, the State's designated 
fusion center, which is staffed by approximately 90 
individuals, drawn from nearly 20 law enforcement and homeland 
security agencies at the local, State, and Federal levels.
    Since we opened our doors in 2003 as one of the Nation's 
first fusion centers, NYSIC has maintained an all-crimes 
approach with the ultimate goal of preventing criminal and 
terrorist activity in our State, and supporting our partners' 
on-going law enforcement investigations.
    The New York State Police has long had a computer crimes 
unit. NYSIC incorporated cyber threat intelligence into its 
mission in 2014 by creating a cyber analysis unit when the 
NYSIC had just moved to co-locate with the Center for Internet 
Security and the Multi-state Information Sharing and Analysis 
Center.
    Our approach is based on partnerships, intelligence 
production, and outreach. To further our outreach, NYSIC 
spearheaded creation of the New York State cyber partners 
working group, which meets monthly and is comprised of State 
and Federal Government law enforcement, homeland security, and 
information technology personnel, and a National Guard.
    As the intelligence center, our role is to take the lead in 
developing cyber intelligence products for both the technical 
and nontechnical audiences, and we leverage the partnerships 
formed through this group to accomplish this mission.
    The NYSIC also relies on National cyber information-sharing 
networks. Routinely, we access the National Fusion Center 
Association's cyber intelligence network through which over 250 
Federal, State, and local law enforcement members act as a 
virtual fusion center, utilizing a cloud service provided by 
the homeland security information network to share cyber threat 
intelligence in real time at the ``For Official Use Only,'' or 
FOUO level.
    Within the State, our distribution lists are separated by 
sector and between technical and nontechnical audiences to 
ensure recipients receive exactly the information they need: 
Actionable intelligence for IT staff, so they can deploy 
appropriate prevention or mitigation controls; and more 
strategic information on trends in cyber actors' tactics, 
techniques, and procedures for executives and policy makers to 
better inform policy decisions and resource allocation.
    NYSIC's intelligence liaison officer network maintains 
points of contact in fire, EMS, and emergency management 
agencies in each county with whom we engage in 2-way threat 
information sharing. Additionally, nearly all of the 500-plus 
law enforcement agencies in New York State have a designated 
field intelligence officer that regularly communicates with the 
NYSIC. More technical products are shared directly with county 
chief information security officers.
    At both the fusion center and across State agencies, New 
York State is sharing more information more effectively than 
ever before. Despite a constantly changing environment, we have 
made excellent progress. But I want to highlight two specific 
areas for continued growth from the full statement I submitted 
on the record.
    First, the information-sharing lessons of the last 13 years 
in the counterterrorism space must be applied to cybersecurity 
today. At the State level, the fusion center is DHS's single 
point of contact for terrorism-related information, and we know 
from where within DHS this information is coming. This is not 
yet the case with cyber threat information, and more often than 
not, the fusion centers do not receive cybersecurity 
intelligence information in a timely manner. The more 
information that fusion centers receive, the more we can share 
with agencies and businesses within our State, allowing us to 
close the current intelligence gaps, and push information to 
smaller entities that direct Federal sharing currently does not 
reach.
    Second, we observe a large amount of cyber threat 
information is Classified. While fusion centers have the 
capability to receive Classified documents, we cannot share 
useful contents with many of our customers unless the 
classification is downgraded.
    On behalf of New York's fusion center and as part of the 
larger National network of fusion centers, thank you for this 
opportunity to speak before your subcommittees, and I welcome 
any questions.
    [The prepared statement of Mr. Cooney follows:]
                 Prepared Statement of Daniel J. Cooney
                              May 24, 2016
    Good morning Chairman Donovan, Ranking Member Payne, Chairman 
Ratcliffe, Ranking Member Richmond, and Members of the subcommittees: 
My name is Dan Cooney and I am an assistant deputy superintendent with 
the New York State Police, responsible for overseeing the New York 
State Intelligence Center, the State's designated fusion center. Thank 
you for inviting me to speak today about our cyber threat information 
and intelligence-sharing efforts.
    The New York State Intelligence Center, or ``NYSIC'', is managed by 
the New York State Police and staffed by approximately 90 people 
representing nearly 20 law enforcement, homeland security agencies at 
the local, State, and Federal levels. Since we opened our doors in 2003 
as one of the first fusion centers in the Nation we have maintained an 
``all-crimes'' approach, with the ultimate goal of preventing criminal 
and terrorist activity in our State and supporting our partners' on-
going law enforcement investigations. We are primarily responsible for 
supporting the 57 counties outside New York City, but we work closely 
with our New York City Police Department colleagues on New York City-
based issues.
    NYSIC incorporated cyber threat intelligence into its mission in 
2014 by creating a Cyber Analysis Unit. The catalyst was two-fold: We 
recognized the need to dedicate resources to the growing threat of 
cyber attacks, and we had just co-located with the Center for Internet 
Security and the Multi-State Information Sharing and Analysis Center 
(MS-ISAC), which the U.S. Department of Homeland Security has 
designated as the cybersecurity information sharing and analysis center 
for State, local, Tribal, and territorial governments. This provided a 
timely opportunity for us to learn best practices from top 
cybersecurity experts. Over time, we were able to staff the unit with 
an Investigator and 4 intelligence analysts who possess a mix of 
specialized technical knowledge or intelligence and analysis 
experience, a hiring model that has worked well. Our approach is based 
on partnerships, intelligence production, and outreach, and I will 
highlight a few examples of the benefits to the State's cybersecurity 
efforts.
             best practices in information-sharing efforts
    The New York State Police has long had a Computer Crimes Unit, and 
other agencies in New York have worked on cyber threats for some time. 
We have worked to bolster our relationships with other agencies, not 
only to learn from them, but to ensure proper information sharing, 
identify collaborative opportunities, and avoid duplication of effort. 
To that end, the NYSIC spearheaded the creation of the New York State 
Cyber Partners Working Group. This group of State and Federal 
Government agencies--including law enforcement, homeland security, 
information technology and the National Guard, to name a few--formally 
meets on a monthly basis to review cyber threat intelligence and 
discuss training, exercise and joint project opportunities. As the 
intelligence center, our role is to take the lead in developing cyber 
intelligence products for both technical and non-technical audiences, 
and we leverage the partnerships formed through this group to develop 
and share intelligence. The Cyber Partners Working Group also joins 
together for training and exercises. NYSIC, along with its working 
group partners, has participated in table-top and National-level full-
scale cyber-related exercises, as both observers and participants. 
Examples include GridEx III, Cyberstorm V, and New York agency-specific 
tabletops.
    Effective State and Federal collaboration is also vital to 
confronting these challenges. For example, recently NYSIC and its State 
and Federal partners collaborated on the production and dissemination 
of a joint cyber intelligence bulletin detailing the analyses of 
detected malware. During the analysis, which determined the malware was 
a well-documented downloader and credential stealing Trojan, an 
encrypted file was discovered. Encryption often prevents further 
investigation; however in this case the team obtained a tool from a 
partner agency that allowed us to decrypt the file. The file revealed 
specific and actionable data that could protect IT assets. The NYSIC 
published these findings as a joint cyber intelligence bulletin and 
received positive feedback from recipients.
    The NYSIC also relies on National cyber information-sharing 
networks. Routinely, we access the National Fusion Center Association's 
Cyber Intelligence Network (CIN), which is a relatively new network of 
fusion center cyber analysts, to ascertain whether the intelligence we 
are developing in New York may be part of a broader trend. The CIN is 
comprised of over 250 Federal, State, and local law enforcement members 
who focus on cyber crimes. These members come together and act as a 
Virtual Fusion Center utilizing a cloud service provided by the 
Homeland Security Information Network (HSIN) to share real-time cyber 
threat intelligence in support of an incident, event, or mission. This 
level of cyber threat information sharing was impossible only a few 
years ago, yet now is becoming routine.
    There are several instances in which the CIN collaborated during 
high-profile events to great effect. For example, the CIN launched the 
HSIN's secure, web-conferencing platform, called CINAWARE, in response 
to Distributed Denial of Service (DDoS) attacks launched by cyber 
hacktivists against several State and local government networks which 
included law enforcement and emergency medical service entities that 
were responding to an incident. The CIN immediately began sharing real-
time intelligence on the attacks with the relevant local agencies. The 
National Fusion Center Association reports that more than 350 
individuals from fusion centers and other Federal, State, and local 
agencies around the country participated in the CINAWARE room over a 
period of several weeks, with an average of 50 to 90 users in the room 
at any given time. The room was supported 24/7, which included 
overnight support from the MS-ISAC. During that period, more than 250 
queries were submitted and answered via the CINAWARWE room, enabling 
rapid sharing of information with decision makers. Leaders in State, 
local, and Federal agencies were consistently briefed on the 
information from the CINAWARE room.
    Since that event, the CINAWARE room on HSIN has been opened to 
support the response to the Vikingdom DDoS attacks against State and 
local networks across the country, the sharing of cyber-specific 
information related to the Paris Bombings, and to support the law 
enforcement and homeland security mission for Super Bowl 50. The CIN 
also facilitates daily sharing throughout the country of indicators of 
system-compromise identified in discrete geographic regions, issues and 
responds to Requests for Information, and acts as a team of subject-
matter experts to support local operations. All of this sharing occurs 
between fusion centers utilizing the Federal platform, HSIN, and occurs 
at the For Official Use Only (FOUO) level.
    Similarly, the NYSIC's co-location with the Center for Internet 
Security and the MS-ISAC allows our staff to walk downstairs and talk 
with their intelligence or operations analysts about Nation-wide 
reporting and how it may impact New York State. Any relevant, sharable 
information these networks provide NYSIC ultimately benefits our Cyber 
Partners Working Group and the State's broader cybersecurity prevention 
efforts.
    This intelligence is of limited use, however, if we cannot provide 
it to consumers and decision makers. Equally as important is 
communication with those outside of NYSIC. The NYSIC team is constantly 
meeting and briefing local governments and private critical 
infrastructure sectors on cybersecurity concerns. Participants leave 
with contact information needed to build distribution lists for 
intelligence products. Our distribution lists are separated by sector, 
and between technical and non-technical audiences, to ensure recipients 
receive exactly the information they need. We provide IT staff with 
actionable intelligence that can be cross-referenced with traffic on 
their networks, so they can deploy appropriate prevention or mitigation 
controls. Other partners, such as executives, appreciate more strategic 
information on trends in cyber actors' tactics, techniques, and 
procedures relevant to their sectors that can help inform better policy 
decisions. We listen to their feedback and tailor our intelligence 
products appropriately.
    The NYSIC Cyber Analysis Unit may receive or develop intelligence 
that is particularly relevant to the first responder community, or a 
subset thereof. For the Fire/EMS/Emergency Management agencies in New 
York, our team leverages NYSIC's Intelligence Liaison Officer (ILO) 
network--points of contact in each county from those 3 disciplines that 
participate in two-way sharing of threat information with our center. 
We educate them on cyber threat reporting and the types of technical 
and analytical support NYSIC can provide. For example, we crafted a 
cyber bulletin distributed specifically to 9-1-1 call centers with an 
``E-911'' capability based on our receipt of threat and vulnerability 
information relevant to technology that is employed.
    Information specific to law enforcement is pushed to agencies in 
the field using another outreach program called the Field Intelligence 
Officer (FIO) program. In support of this program, nearly all of the 
more than 500 law enforcement agencies in New York has a designated FIO 
that regularly communicates with the NYSIC to advance the homeland 
security and counter-terrorism mission. We utilize these members to 
share cyber information in their jurisdictions as well. More technical 
products, which may include vulnerability and consequence information, 
are shared directly with county Chief Information Security Officers 
(CISOs).
    New York State is currently working to expand its information 
sharing with the health care sector--both public- and privately-owned 
facilities. The NYSIC is finding that this sector is willing to partner 
with the State to discuss intelligence requirements, information 
sharing, training opportunities, and best practices in mitigating cyber 
threats.
      recommendations for continued growth in information sharing
    New York State has made significant strides in building its 
cybersecurity capabilities, both at the fusion center and across State 
agencies. We are sharing more information more effectively than ever 
before. Policies and best practices have been developed by consensus 
through multilateral and interagency policy bodies and professional 
associations. They are reinforced through daily engagements between 
Federal, State, local, and private-sector partners. Despite a 
constantly-changing environment we have made excellent progress.
    In order to build upon our successful efforts, we have identified 4 
areas for continued growth.
    First, information-sharing regarding cyber threats between the 
Federal Government and the States should be further streamlined. The 
information-sharing lessons of the last 13 years in the counter-
terrorism space must be applied in the cybersecurity today. In 2003, as 
the first New York State fusion center director, I remember working 
through information-sharing issues with DHS, FBI, and others. 
Ultimately, an agreed-upon vertical information-sharing pathway was 
developed between Federal partners and the fusion centers. At the State 
level, the fusion center is DHS's single point of contact for 
terrorism-related information, and we know from which subset of DHS to 
expect information. This is not yet the case with cyber threat 
information. There are many entities within DHS that gather, analyze, 
and disseminate various types of cyber threat intelligence, whether 
it's tactical indicators of compromise, strategic intelligence 
assessments, or organizing outreach campaigns with private-sector 
entities in our jurisdiction. Given this information--whether it is raw 
information or finished intelligence--does not come together in one 
place at the Federal level with a designated unit to ensure rapid 
communication with the fusion centers, more often than not the centers 
do not receive information in a timely manner. This problem is 
exacerbated by the fact that other Federal agencies also have a cyber 
mission, and many have not yet built relationships with the fusion 
centers like DHS or FBI have over the last 13 years. This includes 
sector-specific agencies like Energy, Treasury, and Health and Human 
Services that play an important role in protecting key sectors of the 
Nation's critical infrastructure and economy, and who conduct outreach 
and information dissemination campaigns with private-sector entities 
under their jurisdiction. Any steps that DHS can take to streamline the 
overall Federal cyber intelligence-sharing processes with the fusion 
centers will help States and our local partners better understand the 
current threat landscape and more efficiently align our own cyber 
information sharing with the private sector. Working together will 
better enable us to protect against and respond to inevitable cyber 
attacks. The more cyber threat intelligence that fusion centers 
receive, the more we can share with agencies and businesses in our 
jurisdictions. This will close intelligence gaps and help us 
communicate threats to smaller entities that Federal information-
sharing currently does not reach.
    Second, we must also continue to evaluate how we share Classified 
cyber-threat intelligence from the Federal Government to the fusion 
centers. There is no central Federal system that stores indicators of 
compromise against which fusion center cyber analysts can run 
comparisons and lookups. The National Network of Fusion Centers does 
not have a space on the National Cybersecurity and Communications 
Integration Center (NCCIC) floor, and therefore lacks access to that 
critical data source which is available to other Federal information-
sharing partners. The network has interactions at the DHS Office of 
Intelligence and Analysis' Cyber Intelligence and Analysis Division 
(CIAD), but that interaction primarily occurs at the FOUO level and 
involves information being shared up to the Federal level, but not 
necessarily back down. Additionally, we observe that a large amount of 
cyber threat information is Classified. While the NYSIC understands why 
that might be the case, the Federal community needs to continue to 
focus on creating Unclassified tear lines of actionable intelligence. 
The fusion centers may have the capability to receive Classified 
documents, but cannot share useful contents with many of its customers 
unless the classification is downgraded. We would be pleased to work 
with authors of Classified documents to develop Unclassified actionable 
information for our non-cleared partners. I believe there has been some 
effort to share more Unclassified indicators based on recent production 
efforts by one Federal agency, and I hope that effort continues across 
the Federal community.
    Third, we need to continue our efforts to share information with 
local and county governments and private sector. We need to make sure 
there is consistency, and not confusion, regarding ``who to call'' when 
a local government or private entity experiences a cyber incident. We 
successfully worked through similar issues in the counter-terrorism 
area and I believe collective development of clear guidance would 
better serve our customers.
    Finally, the parallels between counter-terrorism and cyber extend 
beyond information sharing. Adequate cyber preparedness requires wide-
spread implementation of best practices and mitigation efforts, which 
invariably can exceed the capacity of local and county governments 
facing a growing myriad of threats. In our ever-more connected world, 
your network is only as strong as its weakest interconnection, yet 
implementing strong cybersecurity solutions is often costly. As we 
continue the hard work of policy development and adoption of best 
practices, the need for Federal Government support of State and local 
cybersecurity preparedness should not be overlooked. Much the same way 
the DHS Homeland Security Grant Program provides essential Federal 
support for counter-terrorism initiatives, similar support for 
cybersecurity would further enhance the capacity of States, fusion 
centers, and local governments to prevent and respond to cyber 
incidents that threaten our Nation's critical infrastructure and 
economy.
    Thank you for this opportunity to speak before your subcommittees. 
On behalf of New York's fusion center, and as part of the larger 
National Network of Fusion Centers, I appreciate the invitation to 
participate in this discussion and I welcome any questions you may 
have.

    Mr. Donovan. Thank you, Lieutenant Colonel.
    The Chair now recognizes General Spano for 5 minutes.

 STATEMENT OF BRIGADIER GENERAL STEVEN SPANO, (RETIRED, USAF), 
  PRESIDENT AND CHIEF OPERATING OFFICER, CENTER FOR INTERNET 
                            SECURITY

    Mr. Spano. Mr. Chairman, Ranking Members, Members of the 
committee, I am Steve Spano, the president and chief operating 
officer for the Center for Internet Security, or CIS. I 
appreciate the opportunity to share our thoughts on the state 
of National cybersecurity, and offer a number of suggestions 
and address some of the challenges that lie ahead.
    I would like to talk a little bit about our organization, 
what we do, our primary ambition, and how that feeds into our 
assessment of the current state of cybersecurity in the area 
that we know best, which is State, local, Tribal, and 
territorial governments. Then I will talk a little bit about 
how we service and are enhancing that mission, working with our 
partners, like the fusion center, and State and local 
governments, and then offer some ideas moving forward 
strategically that perhaps this committee can begin to address 
as the challenges we face continue to grow.
    About CIS, it began in 2000 out of the passion and the 
belief that everybody deserves a secure on-line experience. The 
100-plus professionals work collaboratively to enhance the 
cybersecurity mission, readiness, and response, and we do that 
in 3 core areas: Beginning from the foundation, we believe that 
it is inherently practical and important to establish a secure 
framework to build your cyber strategy on and evolving to.
    We call that security framework the critical security 
controls, or the CIS controls. They are a set of prioritized 
actions that organizations of any size can take in a priority 
order to deal with the current threats that exist in today's 
environment. That security framework serves as a foundation for 
some of the products and services that we offer, one such being 
the security benchmarks, which are automated configurations 
that lock down devices, operating systems, and software. So 
these security benchmarks help execute and implement the CIS 
controls, along with many of the services and products that our 
partners out in industry also support and provide.
    The controls, the benchmarks, the products, and services 
are put into execution in our primary mission, and that is 
running the Multistate Information Sharing and Analysis Center, 
or the MS-ISAC. The ISAC was established in a partnership with 
DHS in 2010, and we began the journey of beginning to monitor 
all 56 SLTTs, where we are approximately more than two-thirds 
of the way through bringing the States and these local 
governments and Tribal networks onto our network.
    We currently have 41 that we actively monitor that we 
provide network intrusions, that we provide intelligence 
analysis to, that we provide forensics capability and response 
as part of a computer emergency response team. That mission 
continues to grow and strengthen.
    What I would like to talk about now is how that mission 
feeds our assessment of where we believe the current state of 
National cybersecurity is within the SLTTs. We inform it 
through the day-to-day mission and the operation over the last 
several years, our experience, and global situational awareness 
and engagement. We are also responsible for producing the 
National cybersecurity in this report to DHS, which every 2 
years is provided to Congress. We are working to finalize this 
year's report.
    The NCSR is a self-assessment by the States in 13 key 
categories, and we measure those categories in a number of ways 
through the self-assessment amongst these entities. We find 
that in each of the 13 categories, while year to year, there 
has been improvements among the States, there are still 
challenges that reside in all 13 categories to meet the self-
prescribed benchmarks metrics that they want to achieve.
    Progress is being made. I characterize in my written 
testimony that the current state within the SLTTs is improving, 
but there are still a number of challenges that are facing the 
States, to include under-resource budgets, a workforce that I 
would characterize as high-demand, low-density in its assets 
and that is insufficient to address on many of the challenges, 
and a number of other areas of dealing with basic hygiene in 
terms of executing some of their strategies. But progress is 
being made, and I would characterize it as improving.
    I look forward to the dialogue and the questions and to 
diving into some of the specific details on how we can improve 
moving forward in two key areas: One is establishing a basic 
hygiene campaign, whether that is a built upon the critical 
security controls or other frameworks; and the other areas I 
mentioned that I believe is a strategic challenge for us 
Nationally is how to inspire and generate a cybersecurity 
workforce that can grow and meet the challenges. Because as I 
mentioned, they are high-demand, low-density asset across, and 
the trends we are seeing within K through 12 and interest in 
STEM, colleges and universities are offering programs but it is 
insufficient to get to scale. We are seeing that just the basic 
capabilities to keep up with the growing threats and the 
expertise and the training of existing professionals is a 
challenge for a lot of the SLTTs.
    Thank you very much for the opportunity to address you. I 
look forward to your questions.
    [The prepared statement of Mr. Spano follows:]
                   Prepared Statement of Steven Spano
                              May 24, 2016
    Chairmen Donovan and Ratcliffe, Ranking Members Payne and Richmond, 
and Members of the committee, thank you for inviting me today to this 
hearing. My name is Steve Spano, and I serve as the president and chief 
operating officer of the Center for Internet Security--or ``CIS.'' I 
appreciate the opportunity today to share our thoughts on the current 
state of National cybersecurity, focusing in the area we know best: 
State, local, Tribal, and territorial (SLTT) government entities. As 
the Nation addresses the complicated issue of cybersecurity, your 
efforts to assess the current state of National cyber preparedness and 
response capabilities and determine how best to improve our National 
cybersecurity posture is noteworthy. I look forward to offering our 
ideas on how we can collectively build on the progress being made in 
this important area of critical National security.
    Established in 2000 as a not-for-profit organization, CIS's primary 
mission is to advance cybersecurity readiness and response. CIS was 
instrumental in establishing the first guidelines for systems hardening 
at a time when there was little on-line security leadership. In 2010, 
the U.S. Department of Homeland Security (DHS), under the National 
Protection and Programs Directorate (NPPD), partnered with CIS to host 
the Multi-State Information Sharing and Analysis Center, or MS-ISAC. 
Under a cooperative agreement with DHS, the MS-ISAC was established as 
a 24x7 cybersecurity operations center that provides real-time network 
monitoring, threat analysis, and early warning notifications to SLTTs. 
MS-ISAC also consolidates and shares threat intelligence information 
with the DHS National Cybersecurity and Communications Information 
Center (NCCIC), where we have 2 employees serving as liaisons for MS-
ISAC. In 2015, we became the home of the CIS Critical Security 
Controls, previously known as the SANS Top 20. With this expanded 
operational mission, CIS has evolved as a trusted resource to help 
public and private organizations start secure and stay secure.
    Today, CIS collaborates with the global security community to lead 
Government and private-sector entities to on-line security solutions 
and resources. While I will elaborate more fully below, the 100-plus 
professionals at CIS provide cyber expertise in three main program 
areas:
    1. As I just mentioned, the MS-ISAC operates a 24x7 Secure Ops 
        Center to support SLTTs.
    2. The CIS Critical Security Controls (CIS Controls), a consensus-
        driven, prioritized set of cyber best practices created to stop 
        today's most pervasive and dangerous cyber attacks. The CIS 
        Controls are referenced in several policy and security 
        frameworks such as the NIST 800.43; and
    3. The Security Benchmarks, a program that provides well-defined 
        configuration best practices to help organizations world-wide 
        assess and improve their cybersecurity. Over 100 consensus-
        based Security Benchmarks have been developed to date, and 
        Security Benchmarks members can access tools and automated 
        content for both traditional hardware and software as well as 
        cloud-based services.
    More information about CIS is included at Attachment A and 
incorporated herein by reference.
            the current state of cybersecurity preparedness
    CIS's assessment of the current state of cybersecurity preparedness 
and response capabilities is based on our collective daily experience 
with the MS-ISAC, represented by over 1,000 SLTT members (including all 
50 States), as well as our dealings with those using the CIS Security 
Benchmarks and the CIS Controls, all of which provide us unique and 
wide-ranging insight into the cybersecurity posture of those we serve.
    Today, thanks to Congressional and DHS support and SLTT 
participation, the MS-ISAC is actively monitoring the networks of 41 
States and territories. In 2016, our goal is to have all 50 States and 
all 6 territories being monitored by the MS-ISAC. Our members represent 
local governments, public universities, critical infrastructure 
entities, and public authorities that own and operate critical 
infrastructures. In 2015, our monitoring program analyzed over 3 
trillion records, which generated over 56,000 actionable alerts to our 
SLTT partners. In 2015, our CERT team managed 161 incidents for our 
partners, largely focused on computer forensics. Their efforts actively 
identify types of threats, origins of attack, and root causes of the 
attack. Our intelligence team has produced a large number of analytical 
reports that both DHS and the FBI have cited as key resources to help 
in their investigations and high-level threat detection. Our cyber 
support for SLTTs also includes a computer emergency response 
capability, and the issuance of real-time cyber alerts, advisories, and 
intelligence products.
    Based on this work, we can state that since 2004, when the MS-ISAC 
partnership with DHS began, we have seen progress in the state of 
cybersecurity of our SLTT partners that can be characterized as 
improving, with many positive trends. There are, however, significant 
challenges that we are collectively working to improve. These 
challenges include under-resourced cybersecurity budgets, poorly 
crafted and vulnerable software provided by vendors, misconfigured 
networks, and insufficient numbers of qualified professional staff.
    Our assessment of SLTT cybersecurity preparedness and response 
capability is supported in the findings of the DHS-funded Nation-wide 
Cyber Security Review (NCSR). This annual review, tasked to the MS-ISAC 
by DHS, is produced in conjunction with the National Association of 
Counties and the National Association of State Chief Information 
Officers, and is reported to Congress by DHS every 2 years. It is a 
voluntary, self-assessment survey designed to evaluate cybersecurity 
management within, and the cybersecurity posture of, SLTT governments. 
To gauge the Nation-wide level of cybersecurity readiness, the NCSR 
measures maturity of cybersecurity programs within the SLTT community 
by assessing how SLTTs are performing in 13 key cybersecurity areas. 
The 2013 and 2014 NCSRs found SLTT respondents continuing to improve 
towards the highest level of maturity, ``risk aware'', in all 13 of 
these measured functions, but they have not yet reached that maturity 
level in any of the 13 categories. Further support for our assessment 
is found in the DHS 2015 National Preparedness Report (the 
``Preparedness Report''), which acknowledges both that SLTTs place 
significant emphasis on the importance of cybersecurity, but have been 
challenged to find sufficient financial resources and staffing to meet 
growing cybersecurity demands.
    The MS-ISAC, the NCSR and the Preparedness Report all recognize 
that steady progress is being made in many areas of SLTT cybersecurity, 
in the face of cyber threats that continue to increase in scope, 
sophistication, and number, but that challenges remain for SLTTs to 
reach full cybersecurity preparedness. This reality will not change any 
time soon. The strategy and execution of defensive responses must 
evolve at a faster pace. This will require continued investment, strong 
leadership, and collaboration at all levels of government.
    Outside of the SLTT space, our experience with our Security 
Benchmarks customers and those using the CIS Controls also show 
increased efforts to improve organizations' cybersecurity posture. In 
the last 3 years, the number of organizations purchasing Security 
Benchmarks memberships has almost tripled, and the growth in the use of 
automated machine image versions of the Benchmarks has grown tenfold 
since they were first released a year ago. This shows us that there is 
increasing emphasis on ensuring that organizational networks and 
devices are securely configured.
    In October 2015, we released Version 6 of the CIS Controls. In the 
period of time since the release, the CIS Controls have been downloaded 
over 32,000 times. This data, coupled with on-going requests for 
information and assistance in learning more about the Controls, shows 
us that companies and organizations are seeking guidance in how to 
start secure and stay secure, and are looking for the roadmap to tell 
them how to get there.
       how cis is working to increase cybersecurity preparedness
    Since its inception, CIS's mission has been focused on increasing 
cybersecurity preparedness, both for SLTT governments through the MS-
ISAC and for the private sector as well with the CIS Controls and 
Security Benchmarks programs. I appreciate the opportunity to highlight 
our work in these 3 areas, and why we believe our work is making a 
difference.
MS-ISAC
    The on-going work of the MS-ISAC has and will continue to improve 
the cybersecurity posture of SLTT governments. Our continuous 
monitoring of SLTT networks across the country provides us with the 
ability to see and analyze the scope of potential malicious activity 
and identify when there are multiple incidents of the same nature and 
source. As noted above, in 2015 alone, MS-ISAC detected and analyzed 
malicious activity events that generated over 56,000 incident reports. 
We provide response assistance if needed, including CERT team 
assistance. Equally importantly, we provide timely issue alerts to all 
our SLTT members, which include steps to take to avoid or mitigate the 
risk of the identified malicious activity event. We also share SLTT 
event information with Federal agencies and other trusted partners 
through our liaisons on the NCCIC floor, so our work also informs the 
cybersecurity posture of the Federal Government and the Nation as a 
whole.
    In addition to our monitoring and response services, we produce a 
monthly situational awareness report that shares timely cybersecurity 
information with our over 1,000 members. We distribute weekly reports 
of cyber threat indicators and support an automated indicator sharing 
platform (STIX/TAXII). We hold monthly webcasts focusing on particular 
cybersecurity issues. We also offer group purchasing opportunities for 
cybersecurity training and products, with substantially discounted 
pricing for SLTTs, educational and not-for-profit entities. Since 
starting the purchasing alliance in 2012, we have been able to save 
SLTT governments almost $30 million in their purchase of essential 
cybersecurity training and products. Our work with the NCSR is 
providing SLTTs with a tool to monitor and track their progress, both 
internally and against other SLTT entities.
    More information on MS-ISAC services is included in Attachment B 
and incorporated herein; further information is available here: https:/
/msisac.cisecurity.- org/.
CIS Critical Security Controls
    CIS is the home of the Critical Security Controls, the set of 
internationally recognized prioritized actions that form the foundation 
of basic cyber hygiene, demonstrated to prevent 80-90% of all known 
pervasive and dangerous cyber attacks. The CIS Controls were initially 
created, and are regularly updated, by a global network of cyber 
experts based on actual attack data derived from a variety of public 
and private threat sources, so they are informed by both professional 
expertise and real-world threat information.
    The CIS Controls act as a blueprint for network operators to 
improve cybersecurity by suggesting specific actions to be done in a 
priority order. In this regard, we strongly believe that the CIS 
Controls can help all organizations, especially the small- and mid-
sized entities, many of which need help in identifying exactly what to 
do and when.
    The CIS Controls are recognized by a number of cybersecurity 
frameworks and reports as an effective and practical tool for improving 
an organization's cybersecurity preparedness. The CIS Controls are 
specifically called out in the NIST Cybersecurity Framework as one of a 
handful of cybersecurity tools that help organizations implement the 
Framework. Just recently, the California Attorney General released the 
California Data Breach Report (2016), which specifically points to the 
Controls as a tool that if followed, would meet the requirement of 
``reasonable security'' under California law. (The full report can be 
accessed here: https://oag.ca.gov/breachreport2016).
    Additionally, the Controls are included in the following 
foundational frameworks, reports, and documents:
   NIST Framework
   Symantec 2016 Internet Security Threat Report, https://
        www.symantec.com/content/dam/symantec/docs/reports/istr-21-
        2016-en.pdf, pages 75-77
   Verizon DBIR 2015, page 55
   Tripwire, ``The Executive's Guide to the Top 20 Critical 
        Security Controls,'' http://www.tripwire.com/state-of-security/
        featured/20-csc-list-post/
   Zurich Insurance/Atlantic Council ``Risk Nexus: Overcome by 
        Cyber risks? Economic Benefits and Costs of Alternate Cyber 
        Futures''--page 28
   NGA ``National Governors Association Call to Action on 
        Cybersecurity'', page 4
   UK CPNI (the British infrastructure protection directorate--
        entire web page references the Controls)
   Conference of State Bank Supervisors, ``Cybersecurity 101: A 
        Resource Guide for Bank Executives, pages 8, 12, 24, https://
        www.csbs.org/CyberSecurity/Documents/
        CSBS%20Cybersecurity%20101%20Resource%20Guide%20- FINAL.pdf
    We make the CIS Controls available for download at no cost to the 
general public, as well as free companion guides that provide more 
detailed information and support for the implementation of the CIS 
Controls. Find out more information about the Controls and download 
them for free at: https://www.cisecurity.org/critical-controls.cfm. 
Additional information about the CIS Controls is also included at 
Attachment C and incorporated herein by reference.
CIS Security Benchmarks
    CIS is also the world's largest producer of authoritative, 
community-supported, and automatable security configuration benchmarks 
and guidance. The CIS Security Benchmarks (also known as 
``configuration guides'' or ``security checklists'') provide highly 
technical, detailed security recommendations for specific components of 
information technology, such as operating systems and devices, and are 
vital for any credible security program. The Security Benchmarks are 
developed though a collaborative effort of public and private-sector 
security experts. CIS has developed over 100 consensus-based Security 
Benchmarks have been developed today and are available in PDF format 
free to the general public, or in an automated format through the 
purchase of a membership. We have also created a number of Amazon 
Machine Images (AMIs) for the most utilized Security Benchmarks, which 
are available for purchase in the AWS Marketplace and in Amazon 
GovCloud, and we are discussing similar arrangements with other cloud 
providers. CIS Security Benchmarks are used world-wide by organizations 
ranging from small, nonprofit businesses to Fortune 500 companies.
    The CIS Security Benchmarks are referenced in a number of 
recognized security standards and control frameworks, including:
   Payment Card Industry (PCI) Data Security Standard v3.1 
        (PCI) (April 2016)?
   NIST Guide for Security-Focused Configuration Management of 
        Information System;
   Federal Risk and Authorization Management Program (FedRAMP) 
        System Security Plan;
   DHS Continuous Diagnostic Mitigation Program; and
   CIS Critical Security Controls, Version 6
    More information about CIS Security Benchmarks is included at 
Attachment D and incorporated herein by reference.
                         what more can be done?
    The current cyber threat is clear, unmistakable, and unlikely to 
abate anytime soon. Fortunately, much is currently being done to 
improve cybersecurity--but more needs to be done. We would like to 
focus our comments on 2 areas that we believe are of significant 
importance to both SLTT and non-SLTT organizations: (1) Improving cyber 
hygiene; and (2) creating a comprehensive approach to both increasing 
and improving the cybersecurity workforce.
Improving Cyber Hygiene
    Probably the single most important effort that we can undertake to 
dramatically make our networks more secure is to adopt basic cyber 
hygiene. Like personal hygiene, it involves basic, regular routines and 
actions that are needed to maintain basic safety and security.
    Despite a growing understanding of the threats and vulnerabilities 
in the technical community, wide-spread adoption of safe cyber behavior 
in cyber space is the exception, not the norm. It is our experience 
that the vast majority of cyber incidents result from either the 
failure to patch known vulnerabilities in software and web applications 
or failure to adopt proper security configurations on network operating 
systems or devices.
    We believe that part of the difficulty in getting more traction for 
cyber hygiene is the existence of a plethora of defensive tools, 
security frameworks, and guidelines, combined with the complexity of 
our networks, which have simply overwhelmed and confused consumers, 
private-sector companies and governments. For example, while the NIST 
Framework lays out a process for beginning a dialogue on cybersecurity 
measures, it is by design not a framework listing prioritized actions 
based on effectiveness.
    As we have discussed above, we believe that the CIS Controls 
provide the specific, actionable controls in priority order that will 
thwart the most pervasive attacks. This is supported in a study by the 
Australian government Department of Defense, which revealed that 85% of 
known cybersecurity vulnerabilities can be mitigated by deploying the 
Top 5 CIS Controls. Whether by using the CIS Controls or some other 
framework, increased efforts by the Federal Government to promote a 
roadmap for basic cyber hygiene will yield proven results in mitigating 
the most prevalent and pervasive cyber attacks.
Creating a Comprehensive Approach to Improving Our Cybersecurity 
        Workforce
    One of the major reasons that organizations have struggled in 
achieving basic cyber hygiene is the lack of available and qualified 
cybersecurity professionals to undertake the necessary cyber protection 
actions, particularly on an on-going basis. There are simply too few 
qualified cyber professionals in the workforce. This is the result of 
several factors:
   too few students in the K-12 level of education are 
        interested in pursuing further education in computer science 
        and cybersecurity;
   too few universities and colleges are offering cybersecurity 
        degree or certificate programs that offer the practical 
        training needed to meet the qualifications of cybersecurity 
        professional roles;
   there is a need for more continuing cyber education of staff 
        in the current cybersecurity workforce to keep up with the 
        ever-changing technical landscape of cyber threats; and
   for SLTTs and smaller organizations, the ability to hire 
        from the limited existing cybersecurity workforce is hampered 
        by the inability to compete with private-sector salary levels.
    We believe that there are several areas in which the Federal 
Government can assist with increasing and improving the cybersecurity 
workforce:
    1.   Help to increase awareness and promote STEM education at the 
        K-12 level;
    2.   Because of our DHS support, CIS is able to recruit students 
        from the National Science Foundation's Scholarship for Services 
        Program (SFS) for certain MS-ISAC positions. This program has 
        been a great tool in helping us recruit and maintain entry-
        level cyber professionals. We would recommend considering 
        additional funding for the SFS program to open the program up 
        to more students. This would assist in growing the number of 
        students entering cybersecurity studies at the college level. 
        We would also suggest considering broadening the organizations 
        that qualify to hire SFS students to include non-governmental 
        critical infrastructure organizations and not-for-profits, all 
        of whom share the same challenges that Federal and SLTT 
        governments face in recruiting and retaining cyber talent.
    3. Providing more opportunities for cyber exercises and simulations 
        and expand participation by SLTT entities. In addition to 
        allowing SLTTs more opportunities to assess their cyber 
        readiness and response capabilities, these exercises and 
        simulations provide on-going training for the SLTT 
        cybersecurity workforce.
    The threat to our Nation is real and extends down to every 
individual. As such, improving our cybersecurity defense of this 
country demands the combined efforts of us all. We will continue our 
efforts at CIS to help SLTTs protect citizen data at every level of 
Government. We will also continue our excellent partnership with the 
Federal Government as we work to extend monitoring services to all 56 
States and territories as the foundation of best practice in 
cybersecurity information sharing.
    I want to thank the committee for the opportunity to participate in 
this important hearing, and look forward to addressing any questions 
you might have.
    Find out more information about CIS here: https://
www.cisecurity.org/.
Attachment A.--The Center for Internet Security
Attachment B.--MS-ISAC
Attachment C.--CIS Critical Security Controls
Attachment D.--CIS Security Benchmarks

    Mr. Donovan. Thank you, General Spano.
    The Chair now recognizes Mr. Raymond for 5 minutes.

STATEMENT OF MARK RAYMOND, VICE PRESIDENT, NATIONAL ASSOCIATION 
              OF STATE CHIEF INFORMATION OFFICERS

    Mr. Raymond. Thank you, Chairman Donovan, Chairman 
Ratcliffe, and Ranking Members Payne and Richmond for inviting 
me to testify for you today.
    My name is Mark Raymond, and I serve as the chief 
information officer for the State of Connecticut and the vice 
president of the National Association of State Chief 
Information Officers. NASCIO is a nonprofit association that 
represents State CIOs and IT executives and managers from 
States, territories, and the District of Columbia.
    Today, I would like to provide the committee with an 
overview of cybersecurity preparedness in the States, what 
States are doing to improve our resilience, and opportunities 
to enhance the security profile of our Nation.
    State CIOs are Executive branch officials who serve as 
business leaders, advisers of IT policy, and implementation at 
the State level. The most critical role for the CIO today 
includes the security of State networks, protection of State 
data, and helping formulate the response for cyber incident or 
disruption. These responsibilities are shared with the chief 
information security officer, or CISO, a position that exists 
among all 50 States and for whom are becoming increasingly 
standardized in their roles.
    State CIOs and CISOs operate in an increasingly challenging 
environment. In the 2014 Deloitte-NASCIO Cybersecurity Study, 
we found that the top barriers for States addressing 
cybersecurity were insufficient budgets, increased 
sophistication of threats, and the inadequate availability of 
security professionals.
    Regarding insufficient funding, the majority of the States 
spend in the range of 1 to 2 percent of their overall IT budget 
on cybersecurity. The Federal Government spends around 14 to 16 
percent. Combined with recent events, this disparity shows that 
there is no one correct amount or percentage. States must 
assess their cybersecurity risk and spend commensurate with 
that risk.
    The lack of qualified IT security professionals are also a 
challenge for States. People with IT security skills are the 
most difficult to recruit and retain for States, and the State 
government salary rates and pay structures are the biggest 
challenge in bringing on IT talent.
    Another obstacle for CIO and CISOs is the increasing 
sophistication of threats. The top 3 are malicious code, 
hacktivism, and zero-day attacks. State CIOs are playing 
defense, but we have been able to better prepare for known 
threats through information sharing.
    Despite these challenges, States are progressing towards a 
more secure cyber environment. NASCIO has long called for 
States to adopt a cybersecurity framework, and quickly endorsed 
the NIST framework upon its release. From 2015 data, we know 
that 80 percent of the States have adopted a cybersecurity 
framework based on National standards and guidelines.
    States are utilizing public and private resources to 
enhance their cybersecurity posture in both times of relative 
rest and in times of emergency. To better identify and detect 
cyber threats, States are increasingly sharing threat 
information through fusion centers and MS-ISAC. Eighty percent 
of States have established trusted partnerships for information 
sharing and response. Eighty percent of the States have also 
acquired and implemented continuous vulnerability monitoring 
capabilities to better identify and detect malicious cyber 
activity.
    Many States also participate in ALBERT, a joint program 
between MS-ISAC and DHS, which brings an EINSTEIN-based, cyber-
traffic monitoring system to the States. Knowing that the 
ability to identify and detect is our first line of defense, 
Connecticut is the first State to take advantage of DHS's 
threat intelligence offering provided by iSight partners.
    In the realm of response and recoveries, States are also 
showing maturity. In a disaster, State officials expect the 
State CIO to maintain reliable and secure infrastructure, 
coordinate with other State officials, and restore 
communications services. I am responsible for these duties in 
my State as outlined in our disaster response framework.
    Recognizing that States could face a catastrophic disaster 
that coincides with or is caused by a cyber event, NASCIO has 
called on States to develop a cyber disruption plan that 
contemplates massive disruptions to the business of State 
government. States like Michigan have taken the whole-community 
approach and have developed disruption plans that outline roles 
and responsibilities during a disaster.
    A key partner to the States has been DHS. States are heavy 
utilizers of DHS State and local cyber programs like ICS-CERT 
and FedVTE. Also Federal programs like CyberCorps helps shore 
the IT security workforce gap that all States are facing.
    Another way the Federal Government could aid in enhancing 
State's ability to identify, protect, detect, respond, and 
recover is by harmonizing Federal security requirements. CIOs 
must comply with IRS publication 1075, FBI-CJIS, HIPAA, FERPA, 
CMS's MARS-E, amongst others. Regulation harmonization could 
lessen the burden on States, enabling us to focus on providing 
security services rather than checking off boxes.
    Thank you for holding this important hearing and for the 
opportunity to testify today on this truly critical issue.
    [The prepared statement of Mr. Raymond follows:]
                   Prepared Statement of Mark Raymond
                              May 24, 2016
    Thank you Chairmen Ratcliffe and Donovan and Ranking Members Payne 
and Richmond for inviting me to testify before you today.
    My name is Mark Raymond and I serve as the chief information 
officer (CIO) for the State of Connecticut and also as the vice 
president of the National Association of State Chief Information 
Officers (NASCIO). At NASCIO, I also co-chair the cybersecurity 
committee. NASCIO is a nonprofit, 501(c)(3) association representing 
State chief information officers and information technology executives 
and managers from the States, territories, and the District of 
Columbia.
    Today, I would like to provide the committee an overview of the 
status of cybersecurity preparedness in the States, what States are 
doing to improve and enhance resilience to cyber attacks, and 
opportunities to enhance the security profile of our Nation.
    State chief information officers are State executive branch 
officials who serve as business leaders and advisors of information 
technology policy and implementation at the State level.--All States 
have a CIO and all CIOs serve within the executive branch of State 
government. The office of the State CIO takes many forms, some are 
cabinet officials and others are executive directors; regardless of the 
title, all State CIOs share a common function of setting and 
implementing a State's IT policy.
    State CIOs are also responsible for providing IT services to State 
executive branch agencies. This not only includes the more typical 
business of provisioning enterprise data or phone services but also 
securing the digital business of State government. The most critical 
role today for the CIO includes the security of State networks, 
protection of State data, and helping formulate the response for a 
cyber incident or disruption. These responsibilities are shared with 
the chief information security officer (CISO), a position that exists 
among all 50 States and duties for whom are becoming increasingly 
standardized.
    State CIOs and CISOs operate in an increasingly challenging 
environment.--In the 2014 Deloitte-NASCIO Cybersecurity Study, State 
governments at risk: Time to move forward, (2014 Deloitte-NASCIO Study) 
[http://www.nascio.org/Portals/0/Publications/Documents/Deloitte-
NASCIOCybersecurityStudy_2014.pdf], we studied the current 
cybersecurity environment in the States, common challenges, and 
barriers to a strong State cybersecurity posture. The 2014 Deloitte-
NASCIO Study showed that the top barriers to States addressing 
cybersecurity were insufficient budgets, increased sophistication of 
threats, and the inadequate availability of security professionals. 
These challenges remained the same in 2015.
    Insufficient budgets for cybersecurity have been cited as a top 
barrier since the inception of the Deloitte-NASCIO Cybersecurity Study 
in 2010. The majority of States spend in the range of 1-2 percent of 
their overall IT budget on cybersecurity. The Federal Government spends 
around 14-16 percent of their IT budget on cybersecurity. Combined with 
recent events, this disparity shows that there is no one correct amount 
or percentage; States must assess their cybersecurity risk and spend 
commensurate with that risk.
    Funding challenges also affect the ability of States to hire and 
retain skilled IT security personnel. NASCIO's State IT Workforce: 
Facing Reality with Innovation [http://www.nascio.org/Portals/0/
Publications/Documents/NASCIO_StateIT- WorkforceSurvey2015_WEB.pdf] 
survey shows that a shortage in the State IT workforce has been 
predicted for some time and States are finding that those with IT 
security skills are the most difficult to recruit and retain (67.3%) 
followed by application development, programming, and support (57.1%); 
and architecture (55.1%). Ninetey-two percent of respondents reported 
that salary rates and pay structures are a challenge in bringing on top 
IT talent. States are responding to the dearth of qualified IT security 
personnel by getting innovative.
    In Maine, State CIO Jim Smith confronted the reality that 24 
percent of his 480 State IT workers would be eligible to retire in the 
next 2 years thus highlighting the need to recruit and retain new IT 
talent. He has addressed 1 aspect of the workforce issue by updating 
the application process, moving it on-line, and making it mobile 
friendly. He has also created an IT intern program and over 70 percent 
of those interns have become full-time employees. High school students 
are also welcome to visit Maine's Office of Information Technology for 
its annual ``Technight,'' [http://www.maine.gov/oit/technight/
index.shtml] where students participate in a variety of tech-related 
activities, which introduces them to exciting IT careers.
    While insufficient budgets and workforce shortages continue to be 
obstacles for State CISOs, 3 out of 5 also reported that the increasing 
sophistication of threats was also a major barrier to addressing 
cybersecurity. In the 2014 Deloitte-NASCIO Study, CISOs reported their 
top 3 cyber concerns: Malicious code (74.5%), hacktivism (53.2 %), and 
zero-day attacks (42.6%). Malicious cyber activity happens daily in 
State government, but State CIOs have been able to better prepare for 
known threats through information sharing, a concept with which 
emergency managers are acutely aware.
    Despite these challenges, States are progressing toward a more 
secure cyber environment. NASCIO has long called for States to adopt a 
cybersecurity framework and quickly endorsed [http://nascio.org/
Newsroom/ArtMID/484/ArticleID/34/NASCIO-Supports-Adoption-of-the-NIST-
Cybersecurity-Framework] the National Institute of Science and 
Technology's (NIST) Framework for Improving Critical Infrastructure 
Cybersecurity (NIST Cybersecurity Framework) upon its release in 
February, 2014. In the 2014 Deloitte-NASCIO Study, we found that 88 
percent of States were reviewing or planning to leverage the NIST 
Cybersecurity Framework within the year. In the NASCIO, Grant Thornton, 
CompTIA 2015 State CIO Survey, The Value Equation: Agility in Sourcing, 
Software and Services, [http://www.nascio.org/Portals/0/Publications/
Documents/2015/NASCIO_- 2015_State_CIO_Survey.pdf] we found that 80 
percent of States had adopted a cybersecurity framework based on 
National standards and guidelines.
    States are adapting to shared cybersecurity challenges and 
utilizing public and private resources to enhance their cybersecurity 
posture both in times of relative rest and in times of emergency. The 
NIST Cybersecurity Framework identifies 5 basic functions: Identify, 
protect, detect, respond, and recover. States are making progress in 
each of these areas.
    To better identify and detect cyber threats to protect a wealth of 
State digital assets, States are increasingly sharing threat 
information through established forums like fusion centers and the 
Multi-State Information Sharing and Analysis Center (MS-ISAC). From the 
2015 State CIO Survey, we know that 80 percent of States have 
established trusted partnerships for information sharing and response. 
Additionally, 80 percent of States have also acquired and implemented 
continuous vulnerability monitoring capabilities in order to better 
identify and detect malicious cyber activity. Knowing that the ability 
to identify and detect are our first line of defense, NASCIO has called 
on States to invest in advanced cyber analytics as a part of the 
practice of business intelligence and recently published, Advanced 
Cyber Analytics: Risk Intelligence for State Government. [http://
www.nascio.org/Portals/0/Publications/Documents/2016/
NASCIO_AdvancedCyberAnalytics_FINAL_- 4.18.16.pdf] To that end, 
Connecticut is the first State to take advantage of DHS's threat 
intelligence offering provided via iSight Partners. Many States also 
participate in ALBERT, a joint program between MS-ISAC and DHS which 
brings an EINSTEIN-based, cyber-traffic monitoring system to the 
States.
    In my State, in addition to participating in the information 
sharing through MS-ISAC and utilizing ALBERT, Emergency Management 
Deputy Commissioner and State Homeland Security Advisor, William Shea, 
and I co-chair a cybersecurity task force whose membership includes a 
diverse mix of stakeholders including higher education, law 
enforcement, public utilities, private businesses, and others. We meet 
regularly to discuss the latest threat and vulnerability information 
because we know that information sharing is key to cultivating a 
culture of information security and is a best practice to which States 
should conform.
    In the realm of response and recovery, States are also showing 
maturity.--State CIOs are expected to play a role in helping State 
governments respond to and recover from natural and man-made disasters. 
According to the 2015 State CIO Survey, the top 3 functions for which 
State CIOs were responsible are maintaining a robust, reliable, and 
secure infrastructure; coordinating with other State officials; and 
restoring communications services.
    When riots broke out in and Baltimore, Maryland, Governor Larry 
Hogan declared a state of emergency. Maryland's CIO organization, led 
by Secretary of Information Technology David Garcia, assisted with the 
swift deployment of ``Maryland First Responders Interoperable Radio 
System Team (FIRST),'' the State-wide radio communications equipment 
for first responders and stood up a website, ``Maryland Unites'' to 
which State and local leaders could direct members of the affected 
community. They also worked with public and private partners to reverse 
engineer Anonymous' attack on State networks. Information sharing was 
also helpful; officials in Missouri shared their experience with 
Maryland as they had faced a similar crisis. In ways like these, State 
CIOs are showing maturity in response in both the cybersecurity and 
emergency management fronts and especially when those two worlds 
collide.
    Recognizing that States could face a catastrophic emergency event 
that coincides with or is caused by a cybersecurity event, NASCIO has 
called on States to develop a cyber disruption plan and recently 
released the ``Cyber Disruption Response Planning Guide.'' [http://
www.nascio.org/Portals/0/Publications/Documents/2016/
NASCIO_CyberDisruption_040616.pdf] A cybersecurity disruption is 
defined as: ``an event or effects from events that are likely to cause, 
or are causing, harm to critical functions and series across the public 
and private sectors by impairing the confidentiality, integrity, or 
availability, of electronic information, information systems, services, 
or networks that provide direct information technology services or 
enabling and support capabilities for other services; and/or threaten 
public safety, undermine public confidence, have a negative effect on 
the state economy, or diminish the security posture of the state.'' A 
cybersecurity disruption differs from a cybersecurity incident which is 
limited in scope and impact.
    Examples of a cybersecurity disruption include: A cyber attack on 
the power grid which leads to a loss of power for a significant 
population; a cyber attack on water treatment and delivery leading to a 
loss of water supply to a significant population; a cyber attack on 
network capabilities leading to loss of communications which then 
hampers, interrupts, or prevents the operation of government and 
requires implementation of a continuity of operations plan; or a 
hurricane, flood, or other natural disaster that impairs or destroys 
key infrastructure assets that then precipitates the loss of 
connectivity over the internet or internal network.
    With these scenarios in mind, States like Michigan, taking the 
``whole community'' approach, convened State and local government 
representatives and private-sector critical infrastructure owners and 
operators to develop the Michigan Cyber Disruption Response Strategy, 
initially completed in 2013. Michigan's Cyber Disruption Response 
Strategy [https://www.michigan.gov/documents/cybersecurity/
Michigan_Cyber_Disruption_Response_Strategy_1.0_438703_7.pdf] provides 
a common framework to encourage a State-wide effort among public and 
private partners to defend Michigan's critical networks. Specifically 
the plan prompts critical infrastructure owners and operators to 
address: Data backup, disaster recovery/business continuity, halt key 
processes, equipment shutdown, log file, communications, and how to 
activate the cyber disruption response plan.
    States like the Commonwealth of Massachusetts, New Hampshire, and 
Rhode Island have taken a regional approach to cyber disruption 
planning, an effort supported by FEMA's Regional Catastrophic 
Preparedness Grant Program and Urban Areas Security Initiative (UASI) 
funding. In 2012, as part of the New England Regional Catastrophic 
Preparedness Imitative (NERCPI), these 3 States along with the city of 
Boston and Providence completed regional cyber disruption planning and 
created a Cyber Disruption Response Annex which outlines how cyber 
responders will support industrial control system (ICS) structure in 
each jurisdiction, how critical cyber incident information will be 
shared, and how IT organizations can support public safety and each 
other. NERCPI also created cyber disruption teams in each State and the 
city of Boston; these teams are comprised of experts from IT, emergency 
management and public safety and are responsible for coordinating 
resources and information during catastrophic events.
    As these previous examples exhibit, protection from cybersecurity 
attacks requires a ``team'' or ``whole community'' approach and a key 
partner to the States has been the U.S. Department of Homeland Security 
(DHS). States are heavy utilizers of DHS's cybersecurity-focused State 
and local programs including: ICS-CERT, FedVTE (virtual training 
environment), and cybersecurity advisors (CSA). Also, Federal programs 
like ``CyberCorps: Scholarship for Service'' allow qualifying students 
to serve in an IT assurance role with a Federal, State, or local 
government after graduation; this helps shore the IT security workforce 
gap that all States are facing.
    The Federal Government, principally through DHS, has and hopefully 
will continue to provide support for successful cybersecurity programs. 
There is, however, another way the Federal Government could aid in 
enhancing States' ability to identify, protect, detect, respond, and 
recover--by harmonizing Federal security requirements.
    When States receive Federal funds, they are required to certify 
that certain security measures are in place; this is mandated by the 
Federal Information Security Management Act (FISMA). CIOs and CISOs 
must also comply with a variety of Federal regulations, typically 
promulgated in a silo-ed fashion. Some of the Federal regulations with 
which our community must comply include: IRS Publication 1075, FBI-
Criminal Justice Information Services (FBI-CJIS), the Health Insurance 
Portability and Accountability Act (HIPAA), social security 
administration security standards, Family Educational Rights and 
Privacy Act (FERPA), Office of Child Support Enforcement (OCSE) 
security requirements, the Center for Medicare and Medicaid Services' 
Minimum Acceptable Risk Standards for Exchanges (MARS-E), among others.
    The overarching goal of these regulations is data/information 
security. Knowing that the vast majority of States are utilizing 
National standards like those issued by NIST, the Federal Government 
could lessen the regulatory burden on States by harmonizing Federal 
requirements especially since most if not all of these regulations 
share a common security goal.
    Cybersecurity is an issue that will only become more complex as we 
enter an age where the Internet of Things will become more prominent 
and technology like unmanned aerial systems (UAS), body-worn cameras, 
and cloud adoption are a norm. New technologies will require State 
governments to constantly assess security vulnerabilities as citizens 
demand consumer-level technology services to be deployed on a whole-of-
Government or enterprise basis. Given this background, the Congress and 
Federal agencies should continue to partner with State CIOs and CISOs 
when reviewing or promulgating new data security laws or regulations to 
ensure that the goal of security is achieved without undue burden or 
redundancy.
    Thank you for opportunity to testify today on this critical issue.

    Mr. Donovan. Thank you, Mr. Raymond.
    The Chair now recognizes Mr. Galvin for 5 minutes.

  STATEMENT OF ROBERT GALVIN, CHIEF TECHNOLOGY OFFICER, PORT 
              AUTHORITY OF NEW YORK AND NEW JERSEY

    Mr. Galvin. Good morning, Chairman Ratcliffe, Chairman 
Donovan, Ranking Member Payne, and Members of the 
subcommittees. Thank you for this opportunity to discuss 
strategies for strengthening our Nation's cybersecurity.
    Since December 2013, it has been my privilege to serve the 
Port Authority of New York and New Jersey as its chief 
technology officer. The Port Authority builds, operates, and 
maintains infrastructure critical to New York and New Jersey 
transportation and regional trade. These facilities include 
America's busiest airport system, including JFK, LaGuardia, and 
Newark Liberty International Airports, the World Trade Center, 
the PATH rail transit system, 6 tunnels and bridges between New 
York and New Jersey, the Port Authority Bus Terminal, Hudson 
River ferries, and marine terminals.
    For more than 90 years, the Port Authority has worked to 
improve the quality of life for more than 18 million people who 
live, work, and visit New York and New Jersey metropolitan 
region.
    Safety is the No. 1 priority across all of the authority's 
locations. Technology touches virtually all of our operations 
so the secure and reliable functioning of our computing assets 
is vital to public safety.
    In our limited time, I would like to briefly discuss 3 
areas in which I believe the Federal Government can assist 
technology professionals in addressing cyber threats. These 
areas are communication, readiness, and public education. In 
the realm of communication, events like today's public hearing 
play a valuable role. Government and technology leaders need to 
work together to create safe forums to discuss prevention 
strategies and deconstruct cybersecurity incidents. Through the 
avenues of improved communication, best practices can be shared 
across many organizations to the benefit of the whole.
    Turning now to readiness. When I joined the Port Authority, 
the organization was in the planning stages of designing a 
comprehensive cybersecurity program. We adopted a framework, 
the NIST 800-53, which was developed by a joint task force of 
people from the National Institute of Standards and Technology, 
DOD, Department of Homeland Security, intelligence community, 
and Committee on National Security Systems. This was an 
invaluable tool saving us time and money as we put our 
cybersecurity program in place.
    I believe the Federal Government has a similar opportunity 
to assist organizations by coordinating regular drills, 
simulating large-scale cybersecurity events. Facilitating these 
exercises would allow those involved to understand whether they 
have the right procedures in place to respond effectively and 
to identify any deficiencies. At the Port Authority, our Office 
of Emergency Management conducts regular readiness drills 
simulating such things as active-shooter scenarios and aircraft 
emergencies. From these exercises, teams learn how to improve 
their response. Cybersecurity professionals can benefit from 
the same rigorous testing of our readiness.
    Like many organizations, the Port Authority invests 
resources to detect, prioritize, and examine suspicious 
activity on our computer networks. We also use strong, complex 
passwords across all mission-critical systems, restrict 
administrator access to only essential personnel, and staff a 
247 operations center to respond to alarms generated by our 
cybersecurity tools and alerts received from other agencies.
    But probably the single most important thing we do to 
improve our cybersecurity posture is to require all staff who 
access Port Authority computers to participate in mandatory 
cybersecurity training programs. Themes such as ``Think Before 
You Click on Email Links'' and ``Be Aware Before You Share on 
Social Media'' encourage people to contact our help desks and 
the operations center before they open questionable links and 
attachments.
    Education is essential. I believe the Federal Government 
can play a significant role in strengthening America's 
cybersecurity by sponsoring a National public education 
campaign to promote safe computing practices. In my experience, 
people are more likely to exercise good cyber hygiene if they 
understand the important role their individual actions play in 
keeping our computer network secure.
    In the physical world, we rely on the American public to 
see something and say something. We need to develop Nation-wide 
awareness and training programs to empower people to do the 
same in the realm of cybersecurity. I thank the committee and 
look forward to your questions.
    [The prepared statement of Mr. Galvin follows:]
                  Prepared Statement of Robert Galvin
                              May 24, 2016
                              about the pa
    The Port Authority of New York & New Jersey conceives, builds, 
operates, and maintains infrastructure critical to the New York/New 
Jersey region's trade and transportation network. These facilities 
include America's busiest airport system, including: John F. Kennedy 
International, LaGuardia, and Newark Liberty International airports, 
marine terminals and ports, the PATH rail transit system, 6 tunnels and 
bridges between New York and New Jersey, the Port Authority Bus 
Terminal in Manhattan, and the World Trade Center. For more than 90 
years, the Port Authority has worked to improve the quality of life for 
the more than 18 million people who live and work in New York and New 
Jersey metropolitan region.
I. It is important to keep the Authority up and running
    The Authority operates a diverse groups of facilities that can have 
both logistic and economic impacts that can reach across the globe if 
the facilities were to be shut down by a cyber attack. These facilities 
have implemented many different internet-based technologies to add 
efficiencies to how they operate. However, it is these technologies 
that make these facilities more vulnerable to cyber attacks.
II. The Authority relies of its supply chain to operate
    The Authority relies on its supply chain in 2 States (New York and 
New Jersey) in order to operate its facilities. Required resources are 
provided by multiple suppliers. If fuel cannot be provided, or if 
electricity is impacted in either State, the Authority cannot operate 
at full capacity. It is critical that these supply chains are resilient 
to cyber attacks and have resilient business continuity plans.
III. The Port Authority takes cybersecurity seriously and has an 
        evolving program
    The Port Authority takes cybersecurity very seriously. In 2012, the 
Authority conducted an audit of its cybersecurity posture, and as a 
result, immediately started to build a cybersecurity program. Working 
with a consultant to identify the requirements of our cybersecurity 
program, the authority decided to use the NIST SP 800-53 guidelines as 
a standard for organizing teams, and developing and implementing the 
program. Leveraging this existing standard created by a joint task 
force of NIST (National Institute of Standards and Technology), the 
Department of Defense, Department of Homeland Security, the 
intelligence community and the Committee on National Security systems 
saved The Port Authority time and effort we otherwise would have had to 
develop a framework implementing cybersecurity.
    The first step the Authority took to advance the cybersecurity 
program was to implement services from MS-ISAC (Multi-State Information 
Sharing and Analysis Center). MS-ISAC analyzes all the logs generated 
by our perimeter security tools and provides the authority visibility 
into potential indicators of compromise.
    The Authority built and staffs a 24x7 Cybersecurity Operations 
Center (CSOC) that responds to all of the alarms generated by our 
cybersecurity tools, and to alerts received from the agency partners 
and cybersecurity services.
    We created and manage a mandatory cybersecurity awareness and 
training program for all staff who access the authority's computing 
resources.
    Through this process, Port Authority developed and maintains strong 
partnerships with DHS, FBI, NYPD, NJSP, MS-ISAC (multi-State 
information sharing and analysis centers), US-CERT, and ICS-CERT. We 
continue to engage these agencies to perform vulnerability assessments 
and to assist with incident response. We also strengthened internal 
partnerships within the Port Authority between the Chief Security 
Office, Office of Emergency Management, Office of Inspector General and 
the Technology departments. Early on we recognized that no one team or 
group would have the total solution.
    From these efforts, the Port Authority has seen positive results, 
but much work remains to protect critical assets. The technology we put 
in place provides visibility into emerging threats and have shown 
results, such as the ability to detect and automatically block 90% of 
critical incidents. We continue to make improvements in our 
cybersecurity operations. Last year, we reduced our critical incident 
response time by one-third over the previous year.
    However, just as the technology sector continuously innovates, 
criminal organizations, nation-states, and hacktivists are also 
innovating their methods for exploiting vulnerabilities presented by 
new technologies, ``apps'', and new attack surfaces like the Internet 
of Things.
IV. The Port Authority's Biggest Cybersecurity Concerns
   Like many organizations, The Port Authority uses a large 
        number of ICS (Industrial Control Systems) to operate its 
        facilities, for example: tunnel ventilation systems, PATH Train 
        Control Systems and Airport Airfield Lighting Systems. Some of 
        these systems, if compromised, could cause loss of life. This 
        year, the Authority initiated a program to better understand 
        our vulnerabilities and properly patch and mitigate these 
        systems. But, it is an enormous task.
   In order to properly respond to a massive cyber attack or 
        the breach of a partner organization, the PA must be in 
        communication with partner organizations in real time and have 
        specific remediation actions or practices to follow. Today's 
        ISACs while useful, do not provide such real-time breach 
        notification. According to Verizon's 2015 Data Breach 
        Investigations Report, 75% of attacks spread from the first 
        victim to the second victim within 24 hours, and 40% spread 
        from the first victim to the second in 1 hour.
   In order to operate all these diverse facilities and 
        business functions, the Agency hires thousands of contractors. 
        These individuals have access to some of our most critical 
        systems. The Authority has recognized that insider threat is 
        potential attack vector.
   The Authority invests in resources and money to implement 
        cybersecurity tools. We have learned from telecommunications 
        carriers and cybersecurity service providers that it is 
        possible for aggressive nation-states to obtain these tools 
        through third parties and to reverse engineer them to determine 
        how these detection and prevention tools may be circumvented.
V. How can the Federal Government help?
   Education.--I think there is a clear role for the Federal 
        Government to play by launching a massive public education 
        campaign to practice ``Safe Computing''. The weakest link in 
        our cybersecurity chain is the end-user. Phishing scams, e-
        mails with links to malevolent sites are often the first step 
        toward a breach. Two-thirds of cybersecurity incidents that fit 
        a pattern of cyber-espionage feature phishing scams. (DBIR, 
        2015). Raising our internal education & awareness level was a 
        crucial step in improving the security posture at the Port 
        Authority. I think PSAs (public service announcements) to 
        inform the public about how technology works, responsible 
        measures such as good passwords, ``Think before your click'' 
        and other safe computing practices should be taught to the 
        American public, beginning in school.
   Communication.--Events such as today's, not built around an 
        incident or a breach, but a conversation between technology and 
        policy makers to reach understanding go a long way to help both 
        technologists and our Government make better decisions. 
        Government and technology leaders need to work together to 
        create safe forums to discuss prevention strategies and de-
        construct cybersecurity incidents. The Federal Government can 
        conduct in-depth reviews following an organizational breach, 
        similar to the investigations conducted following plane crashes 
        or what hospitals do after a medical mistake. These non-
        punitive approaches have been very successful improving airline 
        safety and in reducing medical mistakes in the hospitals and 
        emergency rooms--I would think it could have a significant 
        impact improving cybersecurity. The name of the breached 
        organization could be withheld, and the Federal Government can 
        inform agencies of findings and recommendations after 
        completing the review. Case studies provide more than technical 
        remediation requirements; they inform industry how to prevent 
        problems over the long term.
   Simulations.--The Federal Government can assist the PA and 
        related agencies by coordinating an exercise or drill 
        simulating a large-scale cybersecurity event. This drill would 
        allow the agencies to understand where our deficiencies lie, 
        and whether we have the right procedures and external 
        relationships in place to respond correctly. For example, the 
        operations of the Port Authority rely on several Federal 
        Agencies: The CBP (Customs & Border Protection), TSA, FAA. If 
        their systems were compromised, the impact on the Port 
        Authority would be substantial. if the TSA cannot perform pre-
        screening, we cannot board passengers, if the CBP cannot review 
        manifests, we cannot transport cargo, if the FAA air traffic 
        controllers are impacted, our regional airports can be shut 
        down. The operational stability of these Federal entities has a 
        direct impact on the Port Authority's ability to provide 
        services to the region. Post-drill, the Fed can assist the 
        agencies to ensure that their comprehensive cybersecurity 
        programs and resilient business continuity plans are complete 
        and coordinate with related agencies.
   Consider oversight of cybersecurity tool developers to 
        ensure their intellectual property is not compromised. The 
        Authority, like many public and private-sector organizations, 
        invests resources and money into their cybersecurity tools. If 
        aggressive nation-states obtained these same tools through 
        third parties and reverse-engineered them to determine how they 
        can be circumvented, the protection we seek from cybersecurity 
        tools would be lost. The tech industry and Federal Government 
        must work together to protect the intellectual capital that 
        represents the vanguard of our security apparatus for it to 
        operate effectively. The Federal Government may be able to 
        provide oversight of the developers of cybersecurity tools to 
        ensure that they are not sold to malicious third parties.
   Consider stopping the Federal Government's participation in 
        ``bug bounty'' programs which encourage grey hat hackers to 
        sell zero-day vulnerabilities to the highest bidder. The amount 
        governments are willing to pay for some vulnerabilities 
        inflates their value and creates a potentially lucrative 
        secondary market for trading vulnerabilities and may even 
        encourage programmers to `build in' vulnerabilities they can 
        later sell.
VI. Challenges related to planning for, and responding to, 
        cybersecurity
    The first challenge of planning for cybersecurity is the wide 
variety of threat scenarios an organization must plan for: Viruses, 
ransomware, hacktivists, nation-states, simple human error, Point-of-
Sale intrusion, payment card skimmers, web app attacks, denial-of-
service attacks, and cyber espionage.
    The second challenge is the size, configuration, and expanding 
nature of the attack surface: Internet presence (websites), internal 
network, desktops and servers, cloud-based software systems & file 
storage, public WiFi infrastructure, portable storage devices, VOIP 
systems, and the looming Internet of Things. This list includes the 
traditional boundary of the organization. However, we are seeing a 
common entry point into an organization being the subcontractors and 
consultants who bring equipment onsite or connect their organization's 
networks to provide services. The computing networks and infrastructure 
of suppliers who provide critical support services to an organization 
should be considered part of any organization's `attack surface' that 
could be exploited by a malevolent entity.
    Another challenge is the speed with which threats evolve and time 
required to detect a breach before damage can be done. This is often 
referred to the ``volume, velocity, and variation'' of malware. At a 
high level, there are approximately 5 malware events globally every 
second (170 million in 2015). Most of this is filtered out by an 
organization's firewalls and other cybersecurity technology, but half 
of all organizations discover malware during 35 or fewer days per year. 
This seems to align with `releases' of malware during specific periods, 
rather than all year long. As for variation, 70-90% of malware samples 
in 2015 were unique to the organizations in which they were found. This 
combination shows that adversaries are getting more sophisticated to 
overcome defenses and more targeted in their approaches.

    Mr. Donovan. Thank you, Mr. Galvin.
    I now recognize myself for 5 minutes for questions. Since 
each of us only has 5 minutes, I would like to give each of you 
an opportunity to answer. I think I would like to just ask the 
entire panel just one question and ask each of you to spend a 
minute on a response.
    States have constantly ranked their cyber capabilities the 
lowest among their core capabilities, and it makes sense that 
States would look towards the Federal Government for 
assistance. Each of you, in 1 minute, can you tell me--and some 
of you hit on it--declassification of information, training as 
we do it, active-shooter demonstrations we should do with cyber 
attacks. Could each of you just tell me what you think the No. 
1 priority of the Federal Government should be for each of the 
States to help them in securing their cyber terrorist 
capabilities?
    Mr. Ghilarducci. Mark Ghilarducci. Really, 2 areas: No. 1, 
information sharing is really critical here so that we are all 
on the same page with regards to the threat streams; and 
dedicated funding to implement that collective footprint or 
blueprint as we move forward working together to minimize the 
threat. There is no dedicated funding for cybersecurity. It 
needs to be raised on the priority scale.
    Mr. Donovan. Lieutenant Colonel.
    Mr. Cooney. In the post-9/11 environment, there was a 
tremendous amount of effort and time put together to create a 
structure and a network for counterterrorism, and that is, you 
know, the National network of fusion centers. I compare the 
cyber environment now to that environment then where, you know, 
we should leverage this structure that took so long to build, 
you know, to share this threat, this cyber threat information. 
I think, as I mentioned in my testimony, I think that is 
something that is there, we just need to take it a little 
further, and I think--if I had to name one thing, that would be 
my one topic.
    Mr. Donovan. Thank you, sir.
    General.
    Mr. Spano. Yeah, I would probably say the workforce is 
probably the biggest challenge and where the Federal Government 
can help. In that area, the States are really struggling, both 
to compete with industry, and so when they do hire cyber 
professionals, because, again, they are in such demand, it is 
hard to compete with industry who also is requiring and 
demanding and hiring of those cyber professionals.
    So looking at the catalyst of how to start in K through 12 
to get more interest in STEM, to look at the scholarship for 
service and how perhaps we can broaden that into other areas of 
not-for-profits and other businesses that surround critical 
security controls and critical infrastructures would be a clear 
role for the Federal Government to sort-of serve as a catalyst.
    I would say very closely to that would be tighten in the 
command and control in the apparatuses that link the State 
governments through the fusion centers, through the ISAC, to 
continue to strengthen the situational awareness that we 
present from the ISAC to DHS, which informs many National and 
international threats and actions and fusing that together and 
presenting it for National action. So they would be my 2 areas.
    Mr. Donovan. General, I suspect that one of your 
frustrations is that all of you train people who then 
eventually go onto industry.
    Mr. Spano. Yeah.
    Mr. Donovan. Yes. Mr. Raymond.
    Mr. Raymond. Thank you. Two areas: No. 1 is, I think, 
continuing to raise the recognition of cyber risks as equally 
as critical as physical infrastructure risk to our critical 
infrastructure. I think the second is to leverage--broader 
leveraging of funding that is available to the States for a 
variety of different directed programs; that if we could 
leverage that more broadly to address the cyber risk across the 
State, that would be tremendously beneficial to the States.
    Mr. Donovan. Thank you, sir.
    Mr. Galvin.
    Mr. Galvin. Chairman, thank you. So I outlined 3 in my 
opening remarks. If I had to narrow it down to--I could narrow 
it down to 2, which I think is in the area of readiness. I 
talked a little bit about coordinating cybersecurity simulation 
incidents. My intent there is really not so much to exercise 
the cybersecurity plans of each organization or agency, but to 
look at the coordination between agencies and organizations. 
For example, the Port Authority relies heavily on Customs and 
Border Protection and the FAA. But there is no one organization 
that is responsible for overseeing a coordinated response to a 
coordinated attack, which is a very high concern for me.
    The other I talked about is public education. So as a 
technology practitioner professional who has been working in 
the technical areas for 30 years, frankly, I don't know how 
most normal individuals who have training in other areas deal 
with the onslaught of technology that comes at them every day. 
We have all been trained as technology professionals in 
information access and security and control mechanisms and so 
on and so forth.
    Today, people buy WiFi devices, they come home, and they 
set them up. They buy televisions that interconnect with their 
WiFi networks and their cable systems. There are protections 
that you can use and leverage, but without some kind of a 
training plan, I don't know how people deal with it. I assume 
that what happens is most of them, if they don't have someone 
in their life that works in the technology sphere to come and 
help them set up, I think they take it out of the box, they 
plug it in, and if it works, they declare victory and they 
leave it until it breaks and they buy another one.
    So I think public education has a huge role in protecting 
individuals' information as well as the information at risk in 
organizations, because what we are seeing is social media being 
leveraged by people who are posing a threat in order to gain 
access to corporate and agency systems.
    Mr. Donovan. Thank you, sir. I thank you, all, for your 
testimony and sharing your expertise with us.
    The Chair now recognizes the gentleman from New Jersey, Mr. 
Payne, for questions.
    Mr. Payne. Thank you, Mr. Chairman.
    Just on Mr. Galvin's last question, I resemble some of 
those remarks. I was the relative back in the 1980s that hooked 
everyone's VCR up. So I went around to all my aunts and uncles 
and that was my job for a while, so I understand what you are 
saying in terms of that.
    I will stay with you, Mr. Galvin. You know, like 
California, we in New Jersey have established a State 
cybersecurity and communications integration cell with the goal 
of bringing together diverse stakeholders, promote State-wide 
awareness and local cyber threats and wide-spread adoption of 
cybersecurity best practices.
    In your opinion, is New Jersey cybersecurity cell carrying 
out its mission effectively? What is it doing well and what 
should it be doing better?
    Mr. Galvin. Great. Thank you.
    One thing I want to make clear is that, you know, the work 
of securing our information assets and ensuring the reliable 
function of our systems is performed by a, in my organization, 
a hardworking staff of technology and security professionals, 
and also in our partners' agencies. I am truly fortunate to 
work with such a talented and dedicated set of public servants. 
I assume that other members of the panel have a similar 
experience.
    This is a team effort. You know, we recognized early on 
putting our cybersecurity program together that there was no 
one group or individual that was going to have the total 
solution. So we have developed strong partnerships with New 
Jersey CISC, New York CIG, New Jersey State Police, NYPD, FBI, 
DHS, the MS-ISAC, US-CERT, and ICS-CERT, and we continue to 
engage with those agencies to perform vulnerability assessments 
and to assist with incident response.
    Likewise, we also, in this process of putting our 
cybersecurity program together, strengthen internal 
partnerships between the chief security office, which the Port 
Authority is responsible for the PAPD, the Office of Emergency 
Management, the Office of Inspector General, and the technology 
departments. So it's definitely a coordinated team approach 
that--I think you said it very well, Mr. Ghilarducci, that it 
is a team solution.
    Mr. Payne. So you feel that you are breaking through the 
silos of these different entities and working together to 
better assess these threats?
    Mr. Galvin. We do. We spent time--I assume this will 
probably be a question--breaking down the NIST 853 framework, 
and we did a RACI diagram--responsible, accountable, consulted, 
and informed--to identify who was in the lead for each of the 
different tasks. It was a very lengthy exercise, but it was 
extremely valuable to us in helping put our plan together.
    Mr. Payne. Thank you.
    Mr. Ghilarducci, every year the National Preparedness 
Report reveals that of the 32 core capabilities, States are 
least confident in cybersecurity. At the same time, States 
invest very little of their homeland security grant funds into 
improving that cybersecurity capability. Why do you think that 
is?
    Mr. Ghilarducci. Well, I think that part of it is because 
really the emphasis from DHS to States, to the State 
administrative agents or to the HSAs that are doing the 
investment justifications, are not necessarily clear.
    The whole concern about cyber, as has been stated here, 
really isn't fully yet understood. This is an evolving threat. 
It is getting more complex. It is getting worse as the days go 
on. I think that we, as DHS and the States, really we need to 
catch up with the fact that this threat is not going away.
    So once the DHS--and of course Congress--allocate funding 
specifically targeted towards the cyber threat, I think that 
then you will start to see States start to implement more of 
that capability.
    Now, I would say that just this year, I, as the SSA, went 
into our investment justification and broadened the investment 
justification to include cybersecurity and countering violent 
extremism to be able to push down to local grant recipients at 
other State agencies and local governments so that they could 
utilize what funds they do have and repurpose those funds. But, 
as you know, funds are pretty limited as they are, and it is 
hard to sort-of move one thing to start working on the other. 
So it is a constant prioritization and reprioritization issue.
    Mr. Payne. Thank you.
    Mr. Chair, I will yield back.
    Mr. Donovan. The gentleman yields.
    The Chair now recognizes the gentleman from Texas, Mr. 
Ratcliffe, for questions.
    Mr. Ratcliffe. Thank you, Mr. Chairman.
    Earlier, I guess the end of last year, we passed an 
information-sharing bill in this Congress aimed at improving 
our ability to timely share cyber threat indicators.
    I want to start with you, General Spano. How would you 
characterize the quality of the information flow that the MS-
ISAC has with the NCCIC?
    Mr. Spano. I would say that the quality, I believe, as 
representative and testified by FBI and other DHS of 
information that we provided from monitoring State networks, is 
very high quality, and it is fused. We have representatives 
from the MS-ISAC that sit on the NCCIC floor as liaison, so 
they are very integrated into that mission.
    Mr. Ratcliffe. So is that how you give feedback in terms of 
what information you are getting that is valuable?
    Mr. Spano. The feedback of what we provide comes from our 
analysis within the MS-ISAC from our monitoring mission. So, 
for instance, 2015, we analyzed 3 trillion records and provided 
56,000 alerts, sifting through all of those that were 
actionable for the States, but we also fed into the NCCIC for 
further analysis and fusing with other sources of intelligence.
    We have supported FBI investigations with some of our 
analysis of what we have seen at the State level. So the 
conduit and the function and the command and control has been 
working extremely well based upon the maturity of the ISAC 
mission and its capabilities year over year.
    Mr. Ratcliffe. Okay. So I am pleased to hear that the 
sharing is going extremely well.
    Can you offer, would you offer anything to improve the 
efficiency or effectiveness?
    Mr. Spano. Again, what we provide is, I think, moving up in 
its intelligence. The processes are lean and getting better as 
we continue to strengthen that relationship. The challenges, I 
think, are more downward into the State levels, as I talked 
about with respect to some of the resources.
    Mr. Ratcliffe. Yes. You talked about the workforce being a 
challenge.
    Mr. Spano. Right.
    Mr. Ratcliffe. I think you characterized it as high-demand, 
low-density.
    So what can DHS do to create a workforce that is well-
trained and fully-equipped to respond to cyber threats?
    Mr. Spano. I don't know that it is any one responsibility 
or one responsibility of any single agency. I believe it is a 
collaborative effort at all levels--public, private, 
facilitated, encouraged by DHS. They have a number of programs 
that the ISAC implements to try to encourage younger students. 
We do a poster contest, and the CIS offers some summer camps to 
try to encourage it. There is a scholarship for service under 
the National Science Foundation, which is really important. We 
believe that looking at that and examining whether we can 
continue to do that.
    It is not any silver bullet that is going to solve this 
problem. It is a generational problem where if the pipeline at 
the K through 12 is not satisfying the growing demand, you are 
sort-of always chasing. Looking at it from a comprehensive 
perspective of how to ignite that STEM capability at all levels 
and then balancing the differences between the public and 
private partnerships, I think will help create a stop-gap with 
programs that are specific to workforce exercises, joint 
exercises, to raise awareness.
    Mr. Ratcliffe. All right. Thank you.
    Let me turn to you, Mr. Raymond. Last month I held a field 
hearing in my district where I got perspectives from fire 
chiefs and local law enforcement officials on how they are 
responding to cyber incidents. I want your perspective from the 
State, the NASCIO perspective.
    What is the greatest limitation out there right now for 
States in terms of defending their cyber networks? I guess part 
2 of that is, are there shared best practices that NASCIO is 
using to coordinate between State CIOs and local first 
responders and law enforcement?
    Mr. Raymond. Thank you for that question.
    I would say that the biggest challenge is the velocity of 
the threat and the changing threat. So continued improvement on 
providing information and actionable information as efficiently 
as it can be provided almost to machine-to-machine level to 
allow us to react will continue to allow the States to be able 
to defend as best we can. It does help with the workforce issue 
in many ways where we can have our machines responding on our 
behalf.
    In terms of working out with the field, NASCIO has put out 
over 31 different publications that are responsible or 
intending to work with both the education aspects, so making 
sure that our leaders understand how important cyber, is all 
the way to practitioners. We have over a 100-page cyber guide 
and a set of information for State information security 
officers on best practices that we have assembled across the 
States to help them as they are new to these rules. We do have 
turnover, that they can pick it up quickly and understand the 
very diverse environment that we have across all States.
    Mr. Ratcliffe. Terrific. Thanks very much.
    I appreciate you all being here and your testimony.
    My time has expired, so I will yield back.
    Mr. Donovan. The gentleman yields back.
    The Chair now recognizes the gentleman from Rhode Island, 
Mr. Langevin.
    Mr. Langevin. Thank you, Mr. Chairman.
    I want to thank our panel here today. Your testimony was 
excellent, and I appreciate your work that you are doing in 
this field.
    Let me start, if I could, with Mr. Raymond and Mr. Galvin. 
Let's say that the State of Connecticut or the Port Authority 
has experienced what you, Mr. Raymond, in your testimony term a 
cyber disruption event. Whom do you call first?
    Mr. Raymond. For Connecticut, we actually have a cyber 
working group. So the homeland security adviser, Deputy 
Commissioner Bill Shea, and I work closely with this. Our first 
call is to the fusion center and then to MS-ISAC in terms of 
coordinating our events. We pull together a cyber response team 
that includes both homeland security and my office in terms of 
dealing with the response.
    Mr. Langevin. Okay.
    Mr. Galvin. For our organization, we have a cybersecurity 
operations center that would likely be the initial point of 
contact or the discovery point for a potential incident. We 
would assess as much as possible the depth of the breach before 
reaching out. But we would certainly contact MS-ISAC. Usually 
they find out the same time we do. If we identify that the 
breach involves personally identifiable information or 
something of that sort, we would initiate a call to the FBI.
    Mr. Langevin. Okay. Thank you.
    As a follow-up, Colonel Cooney and Mr. Ghilarducci, as 
individuals with emergency management roles, whom do you 
recommend New Yorkers or Californians call in the event of a 
disruption event?
    Mr. Cooney. For us it depends on the nature, but, of 
course, I would say the NCCIC, the fusion center being 
collocated with the MS-ISAC, and then we would take it from 
there depending on the nature of it.
    Mr. Ghilarducci. As well, it depends on the nature. With 
this new integration center we built, this will be the central 
point where all information and reporting will flow into. If 
there is a criminal predicate associated with the intrusion, 
our State police that has a cyber crime investigation unit will 
sort-of take the lead and be supported by the rest of the 
entities that have come together in a collaborative way.
    But that is the process. Because the center also includes 
connections with DHS and FBI, they are right there with us, and 
then we can move on as rapidly as possible.
    Mr. Langevin. Do you all feel comfortable with knowing who 
in particular who to call at the Federal level and who would 
respond to you in the event of a cyber disruption event? I have 
found that that is something that is unclear to many, whether 
it is big businesses or even Government agencies. Are you all 
clear on that, and who would you call?
    Mr. Ghilarducci. Well, this is a question, I mean, we 
typically would turn to the FBI, DHS as information sharing. 
But the FBI would be working with us on the actual analysis of 
the intrusion. But the Secret Service also plays a role in it. 
So there is a little bit of a conflict there. But, typically, 
our next step is to go to the FBI.
    Mr. Langevin. Okay.
    Mr. Galvin. I think your point is well taken, though, that 
in the private sector I think there is less awareness of who to 
call. You have got a panel of people who work in Government and 
who spend time putting together cybersecurity program, so we 
more than anybody are going to know the right individuals to 
call.
    But I think you are correct that depending on the nature of 
the entity, particularly a privately-held organization, I am 
not sure they would know who to reach out to.
    Mr. Langevin. I think that is why we have to work at the 
Federal level here to help get the word out more. One of the 
first places to go, in addition to FBI, would also be the NCCIC 
or US-CERT to request Federal assistance.
    But, Mr. Raymond, if I could, in your testimony you mention 
that NASCIO recommends that the States have a cyber disruption 
response plan. I know you highlighted New Hampshire, 
Massachusetts, and my home State of Rhode Island. I know what 
we have been doing in Rhode Island, that our cyber disruption 
team that we have created has visited all the stakeholders at 
the table, emergency management people, State police. We have 
our colleges and universities, as well as the private sector at 
the table. It has really proven to be very effective at 
bringing the stakeholders to the table to plan for a response 
to a cyber disruption event.
    Is there a way for the Federal Government that we can 
encourage this type of approach?
    Mr. Raymond. I believe as it related to education and 
continuing to hold exercises, continuing to participate through 
homeland security and having the States describe their 
disruption plans, I think all of those encouragement points are 
very helpful in organizing States' response to incidents like 
that.
    Participation. NGA is holding a cyber policy academy for 
several States. Connecticut is one of those participating. That 
helps brings best practices across the States. I know that DHS 
is a good partner in that exercise as well.
    Mr. Langevin. Thank you all.
    I yield back.
    Mr. Donovan. The gentleman yields back.
    The Chair now recognize the Vice Chairman of the 
Subcommittee on Emergency Preparedness, Response, and 
Communications, the gentleman from North Carolina, Mr. Walker.
    Mr. Walker. Thank you, Mr. Chairman.
    Thank you, panel, for being here and the professional 
testimony. Very detailed, very important to us.
    Mr. Raymond, I have a question here. Two-part question, so 
I may break it up. How can the roles of information-sharing 
organizations such as MS-ISAC and ISAC be more strongly defined 
and effectively implemented?
    Mr. Raymond. I know that we actively work with MS-ISAC, and 
we find that it is fairly defined. I am not sure I understand 
how more strongly----
    Mr. Walker. Let me add a little more description. Should 
their responsibilities be strengthened to increase information-
sharing efficiency? Is that fair?
    Mr. Raymond. Yes. I believe the velocity of information 
sharing specifically across all players can be improved.
    Mr. Walker. Okay.
    General Spano, what efforts does the MS-ISAC take to gauge 
customer satisfaction with the States that they are engaging 
with?
    Mr. Spano. Sure. So we have an executive committee that is 
comprised of several of the representatives from the CISO's 
office and the security professionals. We have monthly calls 
with all the members. We have over a thousand members, although 
the 56 are the ones that we actively are pursuing monitoring 
with. We have an annual conference that they attend. We provide 
newsletters, efforts, the NCSR we manage on behalf of DHS to 
get their self-assessments to work. So it is a very strong and 
growing collaborative environment.
    Mr. Walker. In your testimony, I believe you described the 
value add of a State being a member of the MS-ISAC?
    Mr. Spano. Correct.
    Mr. Walker. What additional services or capabilities do you 
see the MS-ISAC being able to provide taking up the next 5 to 
10 years?
    Mr. Spano. The next 5 to 10 years, I believe that as we 
help solidify the basic hygiene of the security framework, such 
as the controls, as the foundations at the State level, and 
begin to help them evolve from the basics of just trying to 
keep their systems patched and configured correctly, I think 
the whole state or posture of cybersecurity will eventually 
begin to increase at a much more rapid pace. That is one 
specific area.
    As technology evolves to the Internet of Things and into 
the cloud environment, there may be a different dimension to 
cybersecurity that has not yet fully matured or evolved or is 
understood.
    Mr. Walker. Sure.
    Mr. Spano. So we have started to move out by offering those 
hardened images within Amazon Web Services, and we are talking 
to the other cloud providers like Microsoft to be able to 
provide the same type of hardened machine images in their cloud 
so that as the States begin to move toward cloud they can do it 
much more securely than they are now, because there are 
tremendous advantages and cost savings that could help fuel 
resources to help in the cybersecurity area.
    Mr. Walker. My next question was, what kind of steps do you 
see there to effectively get us there? But I think you just 
touched on some of that.
    Let me take, if I could, please, going back to Mr. Raymond, 
what do you currently see as the greatest limitation of the 
States' ability to defend just against the general cyber 
attacks? Can you speak to that for a second, talk about the 
problems there?
    Mr. Raymond. Different States are organized very 
differently. We a critical infrastructure provider from State 
data centers to State networks. I think if we look at sort-of 
the complexity of the business that we serve, from schools, 
libraries, in some instances hospitals, so the diversity of the 
population that we serve and that sort of discreet nature of 
how funding comes in, doesn't allow us to leverage things as 
broadly as we would like. So I would say that that is one of 
the primary challenges.
    Mr. Walker. Can I open that up to anybody else on the 
panel? I have got 57 seconds left. Anybody else want to touch 
on the States, sort-of the obstacles there?
    Mr. Spano. I think one of the bigger challenges that they 
have that makes implementing cybersecurity tougher is a more 
strategic problem in how software and applications are 
developed. So many of the software products are coming out of 
the box with inherent vulnerabilities, and I think they are 
poorly crafted and require a lot of lift to continue to sustain 
it.
    That is not going to be solved in any sweeping legislation, 
but it has to be addressed, because the competitive nature of 
providing software and services and applications to get the 
speed and agility that you need to compete means you are 
getting beta versions and you are a little bit sloppier in the 
production. The applications that you are building, even 
internally, to do specific things are oftentimes poorly crafted 
and have security vulnerabilities that tax your cyber 
professionals.
    Mr. Walker. My time has expired.
    Mr. Ghilarducci, you looked like you were in agreement 
there. Did you need to add anything to that?
    Mr. Ghilarducci. I would just say that cyber, what I call 
low-hanging fruit, just cyber hygiene training across the board 
can go a long way in making sure that State employees and State 
networks are as robust against attacks. That is one of the 
things that there is really not a lot of consistent and 
standardized training that is really made available, and I 
think that more of that would help a great deal.
    Mr. Walker. Thank you, Mr. Chairman.
    Mr. Donovan. The gentleman's time has expired.
    The Chair now recognizes the gentlewoman from New Jersey, 
Mrs. Watson Coleman.
    Mrs. Watson Coleman. Thank you, Mr. Chairman.
    Good morning, gentlemen. Thank you for your testimony.
    Mr. Galvin, frequently the first person to decide what to 
do in response to a cyber incident is not the CEO or even 
senior leadership, it is the operational personnel level and 
often physical security professionals who are vastly more 
comfortable protecting against physical threats than threats to 
a network.
    My question is: What are the most important relationships 
emergency responders should maintain with private-sector 
employees at all organizational levels?
    Mr. Galvin. It is a very good question, Congresswoman. 
Thank you for it.
    I think your observation is entirely accurate, that the 
person who is sitting at the facility overseeing operations is 
the person who is going to see the symptoms or the effects of a 
cyber attack first and foremost. I think there are several 
important relationships. One, within any organization, there 
has to be training to make sure that the person who is 
operating the facility is aware of what they should do in order 
to pick up the phone and contact, in our case our help desk or 
our CSOC, cyber security operations center.
    Then from there it goes from a technical professional who 
is going to field the call and take a look at the nature of the 
threat and make a determination as to whether this is an 
opportunistic thing that is just a latent incident that has 
been there active for a while versus something that is 
emergent. Then that person escalates it internally in our 
organization, and I would suspect that a lot of organizations 
are similar. There is a kind of a tiered operation that goes 
on. It goes to a second- or a third-level person in order to 
investigate and follow up further on.
    So I think the relationships are first and foremost between 
the operations personnel and the technical personnel, and then 
second is the escalation in the partnerships that happen within 
an organization as well as awareness as to where to escalate it 
further if the threat cannot be contained.
    Mrs. Watson Coleman. Thank you. This is a question I would 
like to start with you, Mr. Galvin, and then kind-of move on 
down as quickly as we possibly can. This has to do with sort-of 
just imagine a cyber Katrina.
    So our question is, I mean, if we fail to develop, 
implement, and train on doctrine to respond to a cyber event 
with physical or collateral consequences because it is 
something we have not seen before, then we will be inventing 
the wheel as we try to drive the car when we have these 
attacks. So my question is: From your perspective, what is the 
most important action the Federal Government can take to ensure 
that the communities can effectively respond to a cyber event 
of this nature?
    Mr. Galvin. Again, I think it relates to the readiness and 
the preparedness. We haven't really talked about this yet, but 
one of the things that keeps me awake at night, and I am sure 
it keeps a lot of CIOs awake, is industrial control systems or 
operational technology.
    So we have talked a little bit about IT systems and the 
fact that there is patching required. We are used to that as 
technology professionals--oh, there is a fix that came out. You 
know, Microsoft has patch Tuesday, and it has turned into cyber 
threat Wednesday, right? Because they release the 
vulnerability, people know about it, and they try to leverage 
it.
    But there is no analog to the operational technology world, 
the things that control lighting systems or fire alarm systems 
or ventilation systems or things of that nature, and those pose 
a real threat for us.
    I am sorry. I am getting lost in your question. But----
    Mrs. Watson Coleman. What do you see the Federal 
Government----
    Mr. Galvin. Yeah. So, again, I think it has to do with the 
preparedness, making sure that the plans are in place to 
respond and that there is coordination between organizations, 
not just within a single organization.
    Mrs. Watson Coleman. Thank you.
    Is there anyone else who would like to respond to this 
question?
    Mr. Raymond.
    Mr. Raymond. Thank you.
    I think continuing to sponsor and participate in exercises 
that allow the States to demonstrate their preparedness as 
Internet of Things continues to grow, unmanned vehicle systems, 
all of that will continue to get more complex. So being an 
important sponsor to allow us to play and work through these 
exercises in advance and think through them helps us really 
prepare for real events when they do occur.
    Mrs. Watson Coleman. Thank you. Thank you.
    One quick question, since we can't go down there. On a 
scale of 1 to 10 being the very best, how well are we doing in 
incorporating risk into emergency response plans and developing 
contingency operations?
    I should just probably give that to you, Mr. Ghilarducci. 
Did I slay that name?
    Mr. Ghilarducci. You did great. Thanks.
    Well, I appreciate the question, Congresswoman. We don't 
need to reinvent the wheel with regards to all-hazard planning. 
I mean, we have a national construct, a National Incident 
Management System, and having those capabilities in place to 
respond to the consequences, the cascading consequences of a 
cyber attack, should be reinforced and exercised and built 
upon.
    The delta or the challenge is that the traditional systems 
that we depend upon for communications and situational 
awareness may be actually impacted by a cyber attack. So we 
need to make sure we have continuity of operations redundancies 
put in place. This was an area where the Federal Government can 
support States. You want to leverage that public-private 
capability so that you are utilizing the most information you 
can get to be able to make the right decisions.
    So in your training and in your focus you need to also plan 
for--you know, don't just always plan for the technology is 
going to be operational. Start to do exercises and plans where 
you lose all that. How are you going to continue to 
communicate? How are you going to continue to get resources and 
get situational awareness in a timely way to make sure you 
protect lives and property?
    So those are some of the things. But it has to start with 
the construct of that all-hazards environment and our NIMS 
construct.
    Mrs. Watson Coleman. Thank you. Thank you very much.
    I yield back my time, even though I am over it.
    Mr. Donovan. The gentlewoman yields back the time that she 
doesn't have.
    We have a few more moments, and our panel travelled so far, 
I would just like to offer a second round of quick questions 
for my colleagues.
    I just would like to start. We spoke about your challenges, 
and each of you told us about the challenge of lack of 
resources, competing, the competition for talent with industry, 
the inability to share information because of its 
classifications.
    Would each of you just share with us what you think your 
biggest achievement is or your biggest success, without 
divulging trade secrets to our enemies, that maybe some of your 
colleagues would be able to piggyback on and use in their 
various environments?
    Mr. Ghilarducci. I will start. I guess two areas. Again, it 
continues to evolve for us, and we are working hard at it. But 
that is the establishment of a public-private nongovernmental 
academic cybersecurity task force to be able to share 
information and best practices and recommendations and ideas to 
help us as a State drive those ideas forward, and the 
establishment of this integrated cybersecurity fusion center, 
if you would, that collocates with our primary fusion center 
and our critical infrastructure protection team, they can come 
together and all be looking at similar threat streams together 
with an effort to be able to mitigate prior to the event 
actually having the greatest impact.
    So I think those are two areas. Then spinoffs from those is 
working with K through 12 and community colleges. We have 
actually implemented a cyber warrior program in California that 
has just taken off--I hate to use the word like wildfire, 
because we have a lot of those--but has really taken off in 
California. The cyber warrior program for high school students 
and community college students has really been well-received, 
and really we are trying to make that cyber warrior work for 
us.
    Mr. Donovan. Thank you, sir.
    Lieutenant Colonel.
    Mr. Cooney. I think it would be the establishment of our 
cyber analysis unit at our fusion center. I think we were 
fortunate to find the right people and the right mix between 
technical capability and the ability to do intelligence 
analysis. It has worked well for us in an area that, as I 
mentioned in my testimony, that when it comes to cyber 
intrusion and the intel up front in the prevention realm, this 
is still relatively new for us. We got into it in about 2014 
and so far we have made some good progress. So I would say if 
other States could emulate that, then they may find that 
beneficial.
    Mr. Donovan. Thank you, sir.
    General.
    Mr. Spano. Yeah, I would say that the success of the ISAC 
in terms of showing how public and private can come together to 
address an issue of such National importance. Within the ISAC, 
I probably would highlight our CERT function, which is probably 
one of the best, certainly, in the Nation. I would like to say 
that it is probably world-recognized in terms of its ability to 
conduct forensics and analysis for a plethora of customers, 
predominantly, of course, focused at the SLTT.
    Mr. Donovan. Thank you. Mr. Chairman.
    Mr. Raymond.
    Mr. Raymond. Thank you. One of the things that I think we 
are really proud of in Connecticut is that we have been sort-of 
baking telecommunications and networking into our incident 
response teams. So we have had several weather events over the 
past few years and through that it has become really critical 
that citizens rely on communication technology much more so 
than they ever had before.
    So we do have a response team associated with restoring 
commercial networks and communication structures. Having those 
relationships at the ready has allowed us to respond very 
quickly when Superstorm Sandy came and to be able to restore 
communications as much as possible.
    Mr. Donovan. Thank you, sir.
    Mr. Galvin.
    Mr. Galvin. Thank you. At the Port Authority, the 
technology, the policies, the procedures, and the personnel 
that we have put in place, we have been able to detect and 
automatically block 90 percent of the critical incidences that 
we can see on our network, and we have been able to reduce our 
critical incident response time by two-thirds in the past year.
    So we are proud of these things, but there is a lot of work 
that remains to protect our critical technology assets. As many 
people on the panel have already talked about and I won't 
repeat, the threat continues to evolve and the attack surface 
continues to expand with mobile devices and the emerging 
Internet of Things. So we are confident, but we are continuing 
to work diligently.
    Mr. Donovan. Thank you, sir.
    The Chair now recognizes the gentleman from New Jersey, Mr. 
Payne.
    Mr. Payne. Thank you, Mr. Chairman.
    Mr. Galvin, in your testimony you note that the Port 
Authority has undertaken an effort to better understand cyber 
vulnerabilities and address them. What is the biggest challenge 
in carrying out this task? What has the Port Authority learned 
in the process that might help other ports or critical 
infrastructure owners conduct a similar assessment?
    Mr. Galvin. Thank you very much.
    So I think the size of the task is enormous. We have 
approximately 690 applications to assess. I think the lesson 
that I would give to other organizations is to start now. It 
doesn't decrease in effort or size as time goes on, because 
there are new techniques, new technologies that every day get 
introduced into the organization whether or not you are aware 
of them. They do require an assessment.
    So it is a huge effort, and the limiting factor, I think, 
is the size of the staff and the ability of our organization to 
absorb what we learn.
    Mr. Payne. Thank you.
    Mr. Ghilarducci, you have observed that risk assessments 
used by some States do not adequately address the top cyber 
threats or systematic interdependencies. How can we help States 
better assess their cyber vulnerabilities? Should FEMA be 
improving the bureau guidance, or should the Federal Government 
be providing separate guidance on how to conduct cyber 
assessments more thoroughly?
    Mr. Ghilarducci. Well, the guidance, I mean, really, the 
standards for assessments that we are using really are the NIST 
standards. I think that we would all agree that a little bit 
more meat could be put on the bones around doing assessments 
that speak a little bit more to the various aspects of the 
emergency management or public safety spectrum.
    I know we are looking at networks, but when you look at the 
networks' vulnerabilities, we also need to think about in the 
long term what would be the consequences should we lose certain 
networks and sort-of play that out in a little longer bit way. 
So FEMA would be a good entity to be able to provide some 
additional guidance there.
    The other thing is DHS, through their protective service 
analysts that work with our critical infrastructure protection 
folks, they do provide some additional support, and we 
appreciate that. But we probably need to get some area 
associated with the cyber networks, particularly when looking 
at private sector, given that most of the infrastructure is 
owned by the private sector.
    We need to continue to work to link those together with 
regards to the assessment process, because sometimes 
information sharing is a little bit challenging, because of 
proprietary and competitive kind of issues, but we need to find 
a place that we continue to share information to strengthen our 
capability as much as possible.
    Mr. Payne. You also talked about States playing catch-up in 
developing a whole-of-the-government approach to cybersecurity 
and noted that even in California only 13 organizations have 
participated in the cyber hygiene partnership.
    Why do you think more agencies within the States are not 
participating? What can the Federal Government do to encourage 
improved buy-in for cybersecurity efforts among State and local 
agencies or even in the private sector?
    Mr. Ghilarducci. Well, I think maybe Mr. Raymond and others 
may be a little bit more to talk about the challenges in State 
government. I know for us it has been, I think, one, framing 
and understanding of the threat. It means different things to 
different people. We need to be more outgoing, external, like 
we do with a lot of other preparedness programs.
    This is where the Federal Government, through cyber hygiene 
initiatives and other kind of training opportunities to build 
that knowledge base as to what it means to sit at a device or 
get onto the internet and what kind of challenges you could be 
faced with with regards to threats. So training and education 
is one thing.
    The second piece is, I think because there is a lack of 
knowledge, particularly at the Executive level in making 
decisions on funding allocations for doing assessments, quite a 
few times it is, you know, because you don't understand it, it 
is not made as a priority as it should be.
    Let's face it, we as a collective country, and it is just 
across the board, are behind the power curve with regard to 
this threat. We all are working very hard collectively, but we 
do need to do more to step this up. You can't just say it is a 
priority, we need to put resources behind it to really and 
truly make it a priority. Just like we have done with other 
kinds of threats, whether it is natural or human-caused 
threats, we throw a lot of resources at that to make sure that 
we are in front of it and are effectively all knowledgeable 
about it.
    Mr. Payne. Okay.
    I yield back, Mr. Chairman.
    Mr. Donovan. The gentleman yields.
    The Chair recognizes the gentleman from Rhode Island, Mr. 
Langevin.
    Mr. Langevin. Thank you, Mr. Chairman.
    I just want to go back to something we had talked about in 
terms of knowing who to call.
    Mr. Ghilarducci, maybe I have a question for you. I just 
wanted to follow up with a point that Mr. Galvin had made about 
the private sector knowing who to call.
    So just so I understand, so if PG&E has a cyber incident, 
do you recommend that they contact you or DOE or DHS first? Are 
you concerned about losing visibility if critical 
infrastructure providers go Federal first?
    Mr. Ghilarducci. We have the California Utilities Emergency 
Association, it is an entity that is funded and supported by 
all of the major utilities in California, embedding into your 
cyber integration center. It gives them that one sort of belly 
button, so to speak, to be able to make the call and open all 
of the contacts in a one-call sort-of format.
    It is challenging, I think, for them now because they do 
have a lot of people that they need to be reporting to. 
Inadvertently, what happens is that someone, some entity that 
needs to know what is going on falls through those cracks.
    The other thing is that, historically, there hasn't been a 
lot of desire, I guess, so to speak, to let too many people 
know what is going on because of demonstrating vulnerabilities 
that an organization may have.
    So by utilizing authorities and procedures that are being 
put in place through this integrated approach, it gives the 
utilities and the privates, the health industry similar kind of 
thing, a single belly button to make the call. We are all 
looking at it at the same time, and all of the required 
notifications can be made at one point.
    Mr. Langevin. Okay. Thank you.
    Yeah, I think that the point about being reluctant to 
share, by the way, we have got to work at getting over that, 
because, obviously, if one is vulnerable, everybody is 
vulnerable, and that is what, hopefully, information sharing 
will help to mitigate.
    You know, we have been talking a lot about assessments this 
morning, but equally important is not only knowing the 
vulnerabilities that may exist in your assets, in your systems, 
but also knowing the value of the data that you are holding.
    So for Mr. Spano, Mr. Raymond, in Rhode Island, where I am 
from, our Governor, Governor Raimondo, set up a cybersecurity 
commission to examine the State cyber posture. One of the 
biggest initial findings had to do with managers not 
understanding the value of the data or systems and their 
vulnerability to attack.
    Incidentally, this is the same problem that the Federal 
Government faced with the OPM attack, knowing that their 
systems were vulnerable, but also not understanding the value 
really of the data that they were responsible for protecting.
    In your experience, how well do State agencies, particular 
those that aren't focused on IT, understand their exposure and 
also the value of their data?
    Mr. Spano. The value question is hard to quantify other 
than to say that the question of the scope and standards of 
protection has been one that has been discussed and debated 
since sort-of the evolution of the internet into the challenges 
that we are facing today: What do I protect and how much 
protection is enough?
    We have got the full classification of systems. So I think 
there is a clear understanding of Secret, Top Secret. It is 
within that Unclassified regime of understanding personal 
identifiable information, HIPAA information. I think, by and 
large, there is a rudimentary understanding at sort-of the 
basic masses of employees that deal in those environments and 
with that information.
    There are isolated and pockets of excellence where managers 
are being trained in how to deal with HIPAA and identify PII, 
but by and large it is a challenge with educating your existing 
workforces against the basic cyber threats and the basic 
protections that they can do, as well as sort-of the 
identification of what that value is of information.
    Mr. Langevin. Okay. Thank you.
    Mr. Raymond.
    Mr. Raymond. I think that the States' response--it has been 
my experience that there are sort-of 2 buckets, right? One is 
for those who have regulated data, whether it is HIPAA, 
protected medical information, FERPA data, IRS, those 
organizations are very much aware of the value of the 
information that they have.
    I think for those that have nonregulated data but that may 
be important to protect, I think that the reliability of--or 
the awareness of what they have and the importance to protect 
it may be a little bit less.
    I know in Connecticut we have a data classification policy 
that makes you look at what data you have and how valuable it 
is in terms of treating it for data sharing or at least 
protecting, and I think having that kind of approach for all 
States can really raise that visibility level that you 
describe.
    Mr. Langevin. Very good.
    Thank you, Mr. Chairman. I yield back.
    Mr. Donovan. The gentleman yields back.
    The Chair now recognize the gentlewoman from Texas, Ms. 
Jackson Lee.
    Ms. Jackson Lee. Let me thank the Chair for his courtesies. 
Let me acknowledge the Chair and Ranking Member sitting, 
wearing many hats, Mr. Payne, to the full committee Chair and 
the full committee Ranking Member. We have overlapping 
committees, and I just came out of the Judiciary Committee, so 
I thank you for your courtesies.
    This is a very important hearing, which is one of the 
reasons I did the mad dash, because I chaired this committee 
when it was the Transportation and Infrastructure Committee, 
which included all of the Nation's technological networks. I 
remember visiting water and sewer plants and seeing the 
openness and the expanse and wondering what potential terrorist 
act or manipulation of the technology dealing with it. I just 
came back from Silicon Valley, and they are pleading for 
individuals who can code or to write code.
    So I want to offer to you some thoughts. Obviously, you 
have not looked at it, but I have a bill, H.R. 53, 
Cybersecurity Education and Federal Workforce Enhancement, 
which is to target in and focus in on building up the workforce 
for the Federal Government, dealing with technology. Also H.R. 
60--one is H.R. 53 dealing with education--H.R. 60, the 
National Guard Act to develop a civilian force that can be 
activated in the event of a major cyber attack or event.
    Now, if we were domestic, we know that we have NORTHCOM 
that would rise up and be part of dealing with any attack to 
the United States in a very massive way. I pushed NORTHCOM to 
be engaged on State and local. But this is technology, this is 
a cyber attack.
    So if you can answer the question, the importance of 
building the workforce, and as well the importance of having 
well-experienced individuals for a massive attack that deals 
with infrastructure, such as water and sewer, such as our 
electrical grid, and the one that I live with every day, the 
petrochemical industry, which is highly automated at each stage 
of the process through energy extraction, transportation, 
processing, and distribution. As you well know, that is an arm 
of the movement of the economy in this Nation.
    So if you could answer those, I would appreciate it. I will 
listen to you. Thank you. Is there someone who wants to take--
thank you.
    Mr. Raymond. I think education and workforce are incredibly 
important for us being able to respond. I would just add one 
comment. Specifically around the Guard and Guard response, I 
think that as it relates to us being able to have and retain 
workforce, because many of these folks are highly trained 
individuals and they can gain higher salaries in the private 
sector, having that capability of applying that in the event it 
happens at a State level is important.
    We do work very closely. We have a monthly cyber meeting 
where members of the Guard participate in that for awareness 
capabilities. So it is one sort of creative way for the States 
to be able to utilize that capability and bring those skills to 
bear.
    Ms. Jackson Lee. Thank you.
    Mr. Galvin. I have a comment as well.
    Ms. Jackson Lee. Thank you. I appreciate it.
    Mr. Galvin. I think there are several different skills that 
are involved in doing incident response in cybersecurity. They 
not all of them require coding skills. I think the ability to 
think creatively, to think on your feet, to stay calm under 
pressure, I think those are all important skills that don't 
necessarily require coders.
    On the other side, after an incident is detected and you 
are trying to figure out how to protect yourself in the future 
from similar attacks, because the nature of cybersecurity 
events is you have something that is novel and that is unique, 
and then you have multiple copies of it replicated with slight 
variations. So if you can protect yourself against one, you can 
kind of replicate the protection going forward. That is where 
you need a coder, a skill, someone who can take apart the 
threat or at least work with someone who can take it apart, 
because these are getting increasingly more complex as time 
goes on.
    I think the other thing that you brought up was having a 
well of individuals to respond in the event of an attack on the 
grid or water systems or other such critical infrastructure is 
extremely important. Frankly, I think you have to talk to the 
operations people who would oversee the facilities to talk 
about what kind of staff those people are. If it is an attack 
on the grid, they are not IT people, because we don't function 
when there is no electricity.
    So the question is really back to your response plan, and 
back in the day when a lot of us did initial kind of major 
systems implementations, there was always the plan, like, what 
happens if we are not going to go live and we have to go back 
to the old system? That was an old product that was dusted off.
    So we have to go back and start looking at having those 
kinds of plans in place. Like, if the payroll system goes down, 
you go back to writing checks and doing things like that. So we 
need to start thinking about that in the face of these kinds of 
very major attacks on electrical infrastructure, for example.
    Ms. Jackson Lee. Let me pursue, if I could--thank you for 
that. I think it is important to emphasize calmness, 
creativity, and thinking on your feet. But this whole concept 
of code, what I gleaned from Silicon Valley, they are looking 
at it from one perspective, we don't have enough individuals 
Nation-wide. Maybe you would comment. I want to be able to see 
a far reach to be able to have those that can take apart a 
threat, which I believe that we are susceptible to.
    So anyone want to comment on building that code, coding and 
coders, body of infrastructure in the human resource?
    Mr. Spano. Yeah, we talked about that a little bit earlier 
in terms of sort-of the urgency or the burning platform of it 
is a challenge to look at this problem as we have and other 
challenges where capacity could solve it. The challenges we 
face in cyber are challenges of complexity. Capacity can't 
solve a complexity issue, so we have to think about it in a 
much different way.
    The workforce is not a simple fix of just going out and 
trying to figure out how you are going to compete with the 
availability. It is how do you produce a pipeline where there 
is zero unemployment?
    That starts back from K through 12 and STEM and getting 
much more interest in those areas at a much younger age, 
encouraging colleges and universities to develop more 
curriculum and more degrees. It is tied to loan forgiveness and 
scholarship for service beyond that to encourage them to move 
into those areas.
    So it has to be comprehensive and looked at across a 
broader spectrum of time.
    Ms. Jackson Lee. Yes, sir.
    Mr. Ghilarducci. Thanks for the question. I think it is a 
good one. I agree with everything that has been said.
    I think it is important that we sort-of understand kind-of 
talking about pre-event and post-event. Really the pre-event is 
where you need that workforce multiplier, those folks that are 
the coders, the folks that are going to interdict and mitigate 
prior to the event actually taking place.
    The consequences of power outages or a dam release or 
something where there is infrastructure impact, our systems 
that are in place currently for consequence management need to 
be leveraged, and those are the ones that are going to be 
responding to the consequences. Unless there is an on-going 
series of cyber attacks, the attack itself may be done once and 
then you have got now a resulting series of consequences that 
you have to deal with.
    The key thing, I think, is really in the pre-event phase, 
is trying to have that workforce. You mentioned the National 
Guard. I think the National Guard across the States is a model, 
a good model, that could be utilized for building real-time 
capabilities, where in the case of California there are a lot 
of people that work in Silicon Valley, actually, or in the IT 
industry, that are also guards men and women, and they bring 
them in on State Active Duty and be able work on the cyber 
topic. But they give you a workforce multiplier that you can 
continue to build upon.
    But that is not exclusive, mutually exclusive, to the need, 
as the general was saying, in building out workforce from the 
high school level moving forward.
    So I think that it is important that we think about it from 
the standpoint of, what do we have to prevent, interdict, and 
mitigate to minimize the impact? Then our consequence managers, 
the people who are going to respond, we need to train them with 
an understanding that, unlike a wildfire or earthquake, you may 
be operating in an environment with no IT, no situational 
awareness through the computer network, and you may have to go 
back to pen and paper to be able to get the job done. Those are 
the things that I think are important to understand.
    Ms. Jackson Lee. I want to thank the Chairman for his 
indulgence. If I can just, as I close, I would cite the 
petrochemical industry as one that argues for all that you 
said.
    Anybody just want to comment on that?
    Just because these industries are dealing not only with 
technology, but they are dealing with chemicals, it is just a 
combination that you need this holistic viewpoint.
    Mr. Spano. I think that is shared across finance, health 
care, electricity, and other critical infrastructures equally 
as well. Some are at varying levels of maturity in their 
thought, strategy, and execution.
    Ms. Jackson Lee. Well, let me say that I could listen to 
the experts that are here quite more extensively, but let me 
say that I am hoping to move these bills and also reviewing 
something called COIN technology--you may not have heard of 
it--or may have heard of it--that is supposed to be dealing 
with the bigger picture that you all are looking at.
    Being on this committee for so long, I will just say that 
when we started, we knew that 80 percent of the infrastructure, 
which includes all that you are speaking about, was in the 
private sector. It may have gone up now, maybe 85 percent. So 
we know what our work is, and we know what our work is going 
forward, and this is a very important hearing for collaboration 
between Government and the private sector.
    I thank you to the Chairman and Ranking Member, and I yield 
back.
    Mr. Donovan. The gentlewoman yields back.
    I thank the witnesses for their valuable testimony and the 
Members for their questions. The Members of the subcommittees 
may have some additional questions for the witnesses. We will 
ask you to respond to these in writing. Pursuant to the 
Committee Rule VII(E), the hearing record will be held open for 
10 days.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 12:03 p.m., the subcommittees were 
adjourned.]

                                 [all]
```