```

[House Hearing, 114 Congress]
[From the U.S. Government Publishing Office]

               OVERSIGHT OF THE CYBERSECURITY ACT OF 2015

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                     CYBERSECURITY, INFRASTRUCTURE
                        PROTECTION, AND SECURITY
                              TECHNOLOGIES

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED FOURTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             JUNE 15, 2016

                               __________

                           Serial No. 114-76

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     

      Available via the World Wide Web: http://www.gpo.gov/fdsys/

                               __________

                         U.S. GOVERNMENT PUBLISHING OFFICE 

24-379 PDF                     WASHINGTON : 2017 
-----------------------------------------------------------------------
  For sale by the Superintendent of Documents, U.S. Government Publishing 
  Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; 
         DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, 
                          Washington, DC 20402-0001

                     COMMITTEE ON HOMELAND SECURITY

                   Michael T. McCaul, Texas, Chairman
Lamar Smith, Texas                   Bennie G. Thompson, Mississippi
Peter T. King, New York              Loretta Sanchez, California
Mike Rogers, Alabama                 Sheila Jackson Lee, Texas
Candice S. Miller, Michigan, Vice    James R. Langevin, Rhode Island
    Chair                            Brian Higgins, New York
Jeff Duncan, South Carolina          Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             William R. Keating, Massachusetts
Lou Barletta, Pennsylvania           Donald M. Payne, Jr., New Jersey
Scott Perry, Pennsylvania            Filemon Vela, Texas
Curt Clawson, Florida                Bonnie Watson Coleman, New Jersey
John Katko, New York                 Kathleen M. Rice, New York
Will Hurd, Texas                     Norma J. Torres, California
Earl L. ``Buddy'' Carter, Georgia
Mark Walker, North Carolina
Barry Loudermilk, Georgia
Martha McSally, Arizona
John Ratcliffe, Texas
Daniel M. Donovan, Jr., New York
                   Brendan P. Shields, Staff Director
                    Joan V. O'Hara,  General Counsel
                    Michael S. Twinchek, Chief Clerk
                I. Lanier Avant, Minority Staff Director
                                 ------                                

SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND SECURITY 
                              TECHNOLOGIES

                    John Ratcliffe, Texas, Chairman
Peter T. King, New York              Cedric L. Richmond, Louisiana
Tom Marino, Pennsylvania             Loretta Sanchez, California
Scott Perry, Pennsylvania            Sheila Jackson Lee, Texas
Curt Clawson, Florida                James R. Langevin, Rhode Island
Daniel M. Donovan, Jr., New York     Bennie G. Thompson, Mississippi 
Michael T. McCaul, Texas (ex             (ex officio)
    officio)
               Brett DeWitt, Subcommittee Staff Director
                    Katie Rashid, Subcommittee Clerk
       Christopher Schepis, Minority Subcommittee Staff Director
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
       
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable John Ratcliffe, a Representative in Congress From 
  the State of Texas, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Security 
  Technologies:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Michael T. McCaul, a Representative in Congress 
  From the State of Texas, and Chairman, Committee on Homeland 
  Security:
  Oral Statement.................................................     4
  Prepared Statement.............................................     6
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Ranking Member, Committee on 
  Homeland Security:
  Prepared Statement.............................................     7
The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas:
  Prepared Statement.............................................     7

                               Witnesses

Mr. Matthew J. Eggers, Executive Director, Cybersecurity Policy, 
  National Security and Emergency Preparedness, U.S. Chamber of 
  Commerce:
  Oral Statement.................................................     9
  Prepared Statement.............................................    11
Mr. Robert H. Mayer, Vice President, Industry and State Affairs, 
  United States Telecom Association:
  Oral Statement.................................................    16
  Prepared Statement.............................................    18
Mr. Mark G. Clancy, Chief Executive Officer, Soltra:
  Oral Statement.................................................    20
  Prepared Statement.............................................    22
Mr. Mordecai Rosen, General Manager, Security Business Unit, CA 
  Technologies:
  Oral Statement.................................................    28
  Prepared Statement.............................................    30
Ms. Ola Sage, Founder and Chief Executive Officer, E-Management:
  Oral Statement.................................................    36
  Prepared Statement.............................................    38

                             For the Record

The Honorable Sheila Jackson Lee, a Representative in Congress 
  From the State of Texas
  Letter.........................................................    52

                                Appendix

Questions From Chairman John L. Ratcliffe for Matthew J. Eggers..    57
Questions From Ranking Member Cedric L. Richmond for Matthew J. 
  Eggers.........................................................    58
Questions From Ranking Member Cedric L. Richmond for Robert Mayer    61
Questions From Ranking Member Cedric L. Richmond for Mark G. 
  Clancy.........................................................    63
Questions From Chairman John L. Ratcliffe for Mordecai Rosen.....    65
Questions From Ranking Member Cedric L. Richmond for Mordecai 
  Rosen..........................................................    66
Questions From Ranking Member Cedric L. Richmond for Ola Sage....    68

 
               OVERSIGHT OF THE CYBERSECURITY ACT OF 2015

                              ----------                              

                        Wednesday, June 15, 2016

             U.S. House of Representatives,
                    Committee on Homeland Security,
 Subcommittee on Cybersecurity, Infrastructure Protection, 
                                 and Security Technologies,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 10:12 a.m., in 
Room 311, Cannon House Office Building, Hon. John Ratcliffe 
(Chairman of the subcommittee) presiding.
    Present: Representatives Ratcliffe, McCaul, Perry, Clawson, 
Donovan, Richmond, Thompson, Sanchez, Jackson Lee, and 
Langevin.
    Mr. Ratcliffe. Pursuant to committee rule 5(a), I now 
convene the Subcommittee on Cybersecurity, Infrastructure 
Protection, and Security Technologies with the concurrence of 
the Ranking Member.
    Before we begin this morning, I would be remiss if I didn't 
again mention the Orlando terrorist attack that killed 49 
innocent victims, the largest attack in the United States since 
9/11. I would ask that we would open with a moment of silence 
in remembrance of the victims and their families. Thank you.
    The subcommittee meets today to fulfill its obligation and 
oversight responsibility of examining the implementation of the 
Cybersecurity Act of 2015 since its passage last year, and to 
look at the necessary steps going forward to strengthen our 
Nation's cyber defenses.
    Congress' job doesn't end when a piece of legislation is 
signed into law, and that is especially true when it comes to 
cybersecurity legislation. Continued oversight is essential to 
making sure that the bill is implemented in a manner that 
actually improves our cyber defenses. If agency guidance isn't 
clear, if tweaks need to be made, we want to hear that feedback 
and we want to address those concerns.
    For that reason, we are pleased to be joined today by a 
distinguished panel of industry experts to discuss this very 
important issue.
    Pushing the Cybersecurity Act of 2015 across the finish 
line last year was a significant accomplishment that was years 
in the making. During that time, these witnesses that are here 
today and others representing critical sectors devoted 
substantial energy to collaborate with policy makers like me on 
the best path forward. Hundreds of hours of stakeholder 
outreach were conducted across literally every relevant 
industry group: Energy, health care, financial services, 
technology, telecom, retail, you name it. In the end, this bill 
recognized many of the practices that were already being 
deployed by these industry groups and codified them into law, 
while providing important rules for the road, as well.
    My objective is to maintain that same posture as we assess 
the implementation of the Cybersecurity Act of 2015. This law 
recognizes the role of DHS's National Cybersecurity and 
Communications Integration Center, the NCCIC, as the civilian 
portal for the sharing of cyber threat indicators. The key aim 
was to see that our cyber threat indicators containing critical 
information about the nature, methodology, source, and scope of 
cyber attacks would be shared with other parties, so they, in 
turn, could fortify their own networks against future 
intrusions.
    In response to the devastating attack on the Office of 
Personnel Management, this law also bolsters DHS's ability to 
deploy intrusion detection and prevention capabilities across 
the Federal Government. I think we can all agree that the need 
for stronger cybersecurity posture is clear. Every day, our 
country is facing digital intrusions from criminals and 
hacktivists, terrorists, nation-states. Cybersecurity is 
National security. The impacts of those intrusions are being 
felt everywhere, from kitchen tables to boardroom tables across 
American companies.
    We can't tolerate acts of cyber threat and cyber warfare, 
especially when they result in the theft of intellectual 
property and innovation, and put our Nation's critical 
infrastructure at risk. We can't sit idly by while escalating 
ransomware attacks on our hospitals and our health care 
providers threaten our citizens by locking out access to their 
medical records.
    Cybersecurity breaches and data manipulation can undermine 
consumer confidence and they can damage a company's hard-earned 
reputation in just a matter of seconds. While we have yet to 
see a major corporation completely collapse due to a cyber 
attack, the possibility is no longer science fiction. One can 
only imagine the turmoil that would be caused if Americans 
suddenly found out that their checking accounts had all been 
drained. The loss of trust in our financial system would cause 
an economic meltdown.
    Nearly a third of CEOs surveyed recently identified 
cybersecurity as the largest issue impacting their companies 
today, and only half of those say they are fully prepared for a 
cyber event.
    We have learned that there are only two types of companies: 
Those who have been hacked and those who don't know yet that 
they have been hacked. Information sharing between companies, 
the Government, and critical sectors improves our ability to 
defend against all of these attacks.
    Beyond the impact on the private sector, safeguarding cyber 
space is also one of the great National security challenges of 
our time. The American people recognize this. In fact, in a 
recent Pew Research poll, Americans named cybersecurity as 
their second-biggest perceived threat only to ISIS. Imagine a 
catastrophic cyber attack on our gas pipelines or the power 
grid. Such an assault on our critical infrastructure could 
cripple our economy and weaken our ability to defend the United 
States.
    Our adversaries are right now hard at work developing and 
refining cyber attack capabilities and they are using them to 
intimidate our Government and to threaten our people. But the 
threat extends beyond the industrial engines that drive our 
economy, right into the homes of the American people 
themselves. Criminals and countries alike can now use cyber 
attacks to raid American savings accounts or steal their 
personal health records. The recent breach at Anthem last year 
demonstrated the very real capability and intent of bad actors 
to prey upon Americans' most sensitive information.
    We can't leave the American people, the American economy, 
and our critical infrastructure to fend for itself. This is why 
Congress passed the Cybersecurity Act of 2015. Information is 
the currency of today's age, and we have to constantly work 
together across all sectors if we expect to stay one step ahead 
of our adversaries on this new battlefield.
    Congress must utilize rigorous oversight to ensure that DHS 
is fulfilling its mission to better protect our networks, and 
that's why we are all here today.
    I want to thank all the witnesses for testifying before our 
subcommittee, and I look forward to your testimony.
    [The statement of Chairman Ratcliffe follows:]
                  Statement of Chairman John Ratcliffe
    The subcommittee meets today to fulfill its oversight 
responsibility of examining implementation of the Cybersecurity Act of 
2015 since its passage last year, and to look at necessary steps going 
forward to strengthen our Nation's cyber defenses.
    Congress' job doesn't end when a piece of legislation is signed 
into law, and that is especially true when it comes to cybersecurity 
legislation. Continued oversight is essential to making sure the bill 
is implemented in a manner that actually improves our cyber defenses. 
If agency guidance isn't clear, if tweaks need to be made, we want to 
hear that feedback and address those concerns.
    For that reason, we are pleased to be joined by a distinguished 
panel of industry experts to discuss this very important issue.
    Pushing the Cybersecurity Act of 2015 across the finish line last 
year was a significant accomplishment that was years in the making. 
During that time, these witnesses and others representing critical 
sectors devoted substantial energy to collaborate with policy makers on 
the best path forward.
    Hundreds of hours of stakeholder outreach were conducted across 
every relevant industry group--energy, health care, financial services, 
technology, telecom, defense, retail, you name it.
    In the end, the bill recognized many of the practices already 
deployed by these groups and codified them into law, while providing 
important rules of the road.
    My objective is to maintain that posture as we assess the 
implementation of the Cybersecurity Act of 2015.
    The bill recognized the role of DHS's National Cybersecurity & 
Communications Integration Center, or NCCIC, as the civilian portal for 
the sharing of cyber threat indicators. The key aim was to see cyber 
threat indicators--which contain critical information about the nature, 
methodology, source, and scope of cyber attacks--shared with other 
parties so they can, in turn, fortify their own networks against future 
intrusion.
    In response to the devastating attack on OPM, the law also 
bolstered DHS's ability to deploy intrusion detection and prevention 
capabilities across the Federal Government.
    The need for a stronger cybersecurity posture is clear. Every day 
our country faces digital intrusions from criminals, hacktivists, 
terrorists, and nation-States like Russia, China, and Iran. 
Cybersecurity is National security, and the impacts of those intrusions 
are felt everywhere--from kitchen tables to American businesses.
    We cannot tolerate acts of cyber theft and cyber warfare, 
especially when they result in the theft of intellectual property and 
innovation, and put our Nation's critical infrastructure at risk.
    We cannot sit idly by while escalating ransomware attacks on 
hospitals and health care providers threaten our citizens by locking 
out access to medical records.
    Cybersecurity breaches and data manipulation can undermine consumer 
confidence and damage a company's hard-earned reputation in a matter of 
seconds. And while we have yet to see a major corporation completely 
collapse due to a cyber attack, the possibility is no longer science 
fiction. One can only imagine the turmoil that would be caused should 
suddenly Americans' checking accounts be drained. Loss of trust in our 
financial system would cause an economic meltdown.
    Nearly a third of CEOs surveyed identify cybersecurity as the 
largest issue impacting their companies today, and only half say they 
are fully prepared for a cyber event. There are two types of companies: 
Those who have been hacked and those who don't know they have been 
hacked. This is why Congress passed the Cybersecurity Act last year. 
Information sharing between companies, the Government, and critical 
sectors improves our ability to defend against these attacks.
    Beyond the impact on the private sector, safeguarding cyber space 
is also one of the great National security challenges of our time--and 
the American people recognize this. In fact, in a recent Pew Research 
Poll, Americans named cybersecurity as their second biggest perceived 
threat only to ISIS.
    Imagine a catastrophic cyber attack on our gas pipelines or the 
power grid. Such assaults on our critical infrastructure could cripple 
our economy and weaken our ability to defend the United States. Our 
adversaries are hard at work developing and refining cyber attack 
capabilities, and they are using them to intimidate our Government and 
threaten our people.
    But the threat extends beyond the industrial engines that drive our 
economy, to the homes of Americans themselves. Criminals and countries 
alike can use cyber attacks to raid Americans' savings accounts or 
steal their personal health records. The recent breach of Anthem 
demonstrated the very real capability and intent of bad actors to prey 
upon Americans' most sensitive information.
    We cannot leave the American people, the American economy, and our 
critical infrastructure to fend for itself.
    That's why Congress passed the Cybersecurity Act of 2015. This new 
law strengthens DHS's ability to more effectively secure Government 
networks and incentivizes the sharing of cyber threat indicators among 
critical sectors and with the Government to bolster protections from 
future attacks.
    Information is the currency of today's age, and we must constantly 
work together across all sectors if we expect to stay one step ahead of 
the adversaries on this new battlefield.
    Congress must utilize rigorous oversight to ensure that DHS is 
fulfilling its mission to better protect our networks, and that's why 
we're here today.
    I want to thank the witnesses for testifying before this 
subcommittee and I look forward to your testimony.

    Mr. Ratcliffe. The Chair now recognizes the Chairman of the 
full committee, the gentleman from Texas, Mr. McCaul, for his 
opening statement.
    Chairman McCaul. I thank the Chairman for holding this 
important hearing today.
    Before I start, I would like to say a few words about the 
tragic events Sunday in Orlando. Our thoughts and prayers go 
out to the victims and their families. Our deepest gratitude 
goes out to the first responders who helped save so many lives.
    It was the deadliest attack on the United States homeland 
since 9/11. But our response has shown that Americans are 
resilient and will not be intimidated by extremists.
    Yesterday, I moderated a Classified briefing on the 
investigation with the Secretary of Homeland Security, the 
director of the FBI, and the National Counter Terrorism Center. 
In the coming months, we will continue to seek answers and have 
an oversight hearing on this very important issue. We will also 
take action to protect our country and prevent such an attack 
from ever happening again.
    The events in Orlando are a reminder that our Nation is 
being targeted by those who want to undermine our freedom and 
diminish our prosperity.
    But the threat is not just from kinetic terrorists. Today 
we will discuss how our Nation is also being targeted and 
attacked in real time by faceless intruders across the web. As 
we speak, a war is being waged against us in cyber space. 
Criminals, hacktivists, violent extremists and nation-states 
are infiltrating our networks and infecting our systems.
    Their motives are to deceive, steal, and destroy, and the 
impacts of their attacks are felt everywhere, from our kitchen 
tables to our corporate boardrooms. This committee has made our 
Nation's cybersecurity a top priority. In recent years we 
passed a number of landmark cybersecurity bills.
    First, we established a Federal civilian interface at the 
National Cybersecurity and Communications Immigration Center, 
or NCCIC, to facilitate cyber threat information sharing. This 
allows the Government to communicate more effectively across 
the 16 critical infrastructure sectors and with the private 
sector, with liability protection.
    Second, we laid down the rules of the road regarding how 
information is shared, making sure these data exchanges are 
efficient, timely, and secure.
    Third, we put in place measures to keep Americans' rights 
and personal information protected.
    Fourth, we made sure that DHS was able to hire and retain 
top cybersecurity talent, because we cannot protect our 
networks without a cyber work force that is smart and 
aggressive.
    And fifth, we enhanced the Department's ability to prevent, 
respond to, and recover from cyber incidents on Federal 
networks.
    Those measures went a long way in helping us secure our 
systems. But even with the fundamentals in place, we still have 
major vulnerabilities, especially lack of information sharing. 
After 9/11, we learned that if our agencies did not connect the 
dots, we could not stop attacks.
    The same principle applies to cyber threats. If no one 
shares data, everyone is less secure and intrusions go 
undetected.
    We realized that companies were very hesitant to share this 
sensitive data, so last year we drafted and passed the 
Cybersecurity Act to get the information flowing. The law now 
provides liability protection so that companies and other 
organizations can more freely exchange threat indicators.
    This includes Government-to-private information sharing, 
but also, importantly, private-to-private sharing. The 
legislation was a major win for security and privacy, allowing 
companies to secure their networks and keep hackers away from 
our bank accounts, health records, and other sensitive 
information.
    But we cannot be satisfied with this progress. We have got 
to be aggressive, as our adversaries are. We should aim to stay 
a step ahead of them at every turn.
    So I hope our witnesses, and I want to thank our witnesses 
for being here today, but I hope you will help us understand 
how we can do exactly that, how can we effectively implement 
this law to enhance America's digital defenses. I am very 
interested as well to see how this program is working at the 
Department and what this committee can do to enhance and 
strengthen their efforts.
    So with that, Mr. Chairman, I yield back.
    [The statement of Chairman McCaul follows:]
                Statement of Chairman Michael T. McCaul
    Before I start today, I would like to say a few words about the 
tragic events in Orlando. Our thoughts and prayers go out to the 
victims and their families, and our deepest gratitude goes out to the 
first responders who helped save lives.
    It was the deadliest terrorist attack on the U.S. homeland since 9/
11, but our response has shown that Americans are resilient and will 
not be intimidated by extremists.
    Yesterday I moderated a Classified briefing on the investigation 
with the heads of DHS, the FBI, and the National Counterterrorism 
Center, and in the coming months we will continue to seek answers. We 
will also take action to protect our country and prevent such an attack 
from happening again.
    The events in Orlando are a reminder that our Nation is being 
targeted by those who want to undermine our freedom and diminish our 
prosperity.
    But the threat is not just from terrorists. Today we will discuss 
how our Nation is also being targeted and attacked--in real time--by 
faceless intruders across the web.
    As we speak, a war is being waged against us in cyber space. 
Criminals, hacktivists, violent extremists, and nation-states are 
infiltrating our networks and infecting our systems. Their motives are 
to deceive, steal, and destroy, and the impacts of their attacks are 
felt everywhere--from our kitchen tables to corporate board rooms.
    This committee has made our Nation's cybersecurity a top priority, 
and in recent years we have passed a number of landmark cybersecurity 
bills.
    First, we established a Federal civilian interface at the National 
Cybersecurity and Communications Integration Center, or NCCIC, to 
facilitate cyber-threat information sharing.
    This allows the Government to communicate more effectively across 
16 critical infrastructure sectors and with the private sector.
    Second, we laid down the rules of the road regarding how 
information is shared--making sure data exchanges are efficient, 
timely, and secure.
    Third, we put in place measures to keep Americans' rights and 
personal information protected.
    Fourth, we made sure DHS was able to hire and retain top 
cybersecurity talent, because we cannot protect our networks without a 
cyber workforce that is smart and aggressive.
    And fifth, we enhanced the Department's ability to prevent, respond 
to, and recover from cyber incidents on Federal networks.
    Those measures went a long way in helping us secure our systems. 
But even with the fundamentals in place, we still saw major 
vulnerabilities, especially the lack of information sharing.
    After 9/11, we learned that if our agencies did not connect the 
dots, we could not stop attacks.
    The same principle applies to cyber threats. If no one shares data, 
everyone is less secure and intrusions go undetected.
    We realized that companies were very hesitant to share their 
sensitive data, so last year we drafted and passed the Cybersecurity 
Act of 2015 to get the information flowing.
    The law now provides liability protections so that companies and 
other organizations can more freely exchange threat indicators. This 
includes ``Government-to-private'' information sharing and ``private-
to-private'' sharing.
    The legislation was a major win for security and privacy, allowing 
companies to secure their networks and keep hackers away from our bank 
accounts, health records, and other sensitive information.
    But we cannot be satisfied with this progress. We've got to be as 
aggressive as our adversaries--and we should aim to stay a step ahead 
of them.
    I hope today our witnesses will help us understand how we can do 
exactly that--and how we can effectively implement this law to enhance 
America's digital defenses.
    Thank you.

    Mr. Ratcliffe. Thank you, Mr. Chairman, and thank you for 
your leadership on this issue.
    Other Members of the committee are reminded that opening 
statements may be submitted for the record.
    [The statements of Ranking Member Thompson and Hon. Jackson 
Lee follow:]
             Statement of Ranking Member Bennie G. Thompson
                             June 15, 2016
    Today, the subcommittee turns its attention to another pressing 
issue: Securing our cyber networks. Cyber threats are constantly 
evolving. While a few years ago, critical infrastructure operators were 
primarily concerned about spear-phishing and DDOS attacks, today, the 
threat of ransomware attacks are front-of-mind. Over the past year, the 
proliferation of ransomware attacks, where networks of a hospital 
system, Government agency, or utility are held hostage for electronic 
payments, has reached epidemic proportions.
    In March, DHS reported that over the past year, there have been 321 
incidents of ``ransomware-related activity'' affecting 29 Federal 
networks. The FBI Internet Crime Complaint Center, for its part, has 
acknowledged that over the last decade, of the $58 million in financial 
damage attributable to such attacks, attacks in just the last year 
account for $24 million in damage.
    With more Americans coming to embrace the Internet of Things, the 
disruptive and damaging effects of ransomware and other innovative 
modes of attack deployed by hackers have the potential to inflict 
significant damage to our Nation.
    To counter this threat, we must redouble our efforts to promote 
cyber hygiene practices, encryption, and information sharing. The 
enactment of the ``Cybersecurity Act'' in December provides for the 
sharing of information on cybersecurity threats and defensive measures 
between the Government and the private sector and within the private 
sector.
    Privacy, liability, and anti-trust provisions that are universally 
understood as essential to the timely sharing of cyber threat 
information are part of this law. Under the Act, the epicenter for such 
activity is, of course, the National Cybersecurity and Communications 
Integration Center.
    I am interested in exploring two key mandates in the Act. First, I 
want to hear from industry stakeholders how they see the launch of the 
``Automated Indicator Sharing'' capability, as required under the Act, 
impacting information sharing.
    Second, I would like to hear the witnesses' perspective on how well 
DHS is carrying out the requirement to periodically share, through 
publication and targeted outreach, cybersecurity best practices in a 
manner that gives ``attention to accessibility and implementation 
challenges faced by small businesses.''
    Before I close, I would like to note that, this past week, I was 
heartened to see how the United States stacks up to other nations when 
it comes to vulnerability to hacking.
    The United States was ranked fourteenth on the ``National Exposure 
Index,'' a worldwide comparative analysis of vulnerability to cyber 
attacks and cyber crime that is based on the scanning of millions of 
internet channels for vulnerabilities such as unencrypted and plain 
text services.
    While it is good to see that the United States is less vulnerable 
than Brussels, Australia, France, and China--countries on the list 
found to have weak authentication and encryption practices--now is not 
the time to rest on our laurels.
                                 ______
                                 
               Statement of Honorable Sheila Jackson Lee
    Chairman Ratcliffe and Ranking Member Richmond, thank you for 
holding this morning's hearing entitled ``Oversight of the 
Cybersecurity Act of 2015.''
    This hearing is an opportunity to receive testimony regarding 
implementation of the Cybersecurity Act of 2015, enacted on December 
18, 2015, which was intended to resolve long-standing issues that 
prevented private-sector participants from sharing information on cyber 
threats with the Federal Government or with each other.
    I look forward to hearing from today's witnesses: Mr. Matthew J. 
Eggers--senior director, National Security and Emergency Preparedness, 
U.S. Chamber of Commerce; Mr. Robert H. Mayer--vice president, Industry 
and State Affairs, U.S. Telecom Association; Mr. Mark Clancy--chief 
executive officer, Soltra; Mr. Mordecai Rosen--general manager, 
Security Business Unit, CA Technologies; and Ms. Ola Sage--founder and 
chief executive officer, eManagement.
    As Ranking Member of the Judiciary Subcommittee on Crime, 
Terrorism, Homeland Security and Investigations and a senior member of 
the Committee on Homeland Security, I am a strong believer in the 
legislative process as the best path for addressing the most complex 
issues of the digital communication age.
    The Cybersecurity Act of 2015 did not follow regular order to 
become law--it was included in the Omnibus Appropriations bill passed 
at the end of last year.
    The bill encourages private companies to voluntarily share 
information about cyber threats with each other as well as the 
Government and includes the authorization of information sharing and 
its impacts on privacy and civil liberties; risks of misuse by the 
Federal Government or the private sector; and effects of proposed 
liability protections for companies and entities who participate in 
cybersecurity information sharing.
    The law requires the U.S. Attorney General and Secretary of 
Homeland Security to publish guidelines, and jointly submit to Congress 
interim CISA policies and procedures by February 16, 2016, and publish 
final policies and procedures by June 15, 2016, to assist businesses in 
identifying information that would qualify as a cyber threat indicator 
and eliminating personal information from shared cyber threat 
information.
    These guidelines will seek to: (1) Identify cyber threat indicators 
that contain personal information and are unlikely to directly relate 
to a cybersecurity threat, and, (2) identify types of information that 
is protected under privacy laws and are unlikely to directly relate to 
a cybersecurity threat.
         the cybersecurity and information-sharing legislation
    The law broadly authorizes the Federal Government to share 
Unclassified ``cyber threat indicators'' and ``defensive measures'' 
technical data that indicates how networks have been attacked, and how 
such attacks have been successfully detected, prevented, or mitigated.
    The law authorizes the sharing of Unclassified information among 
Federal agencies, as well as with businesses and the public.
    Classified cyber threat information, in contrast, may be shared 
outside the Government only with entities that have appropriate 
security clearances.
    Vulnerabilities in computing products are the chief method used by 
data thieves and terrorists to breach computing systems.
    Since 2005 to the present, the Privacy Rights Clearinghouse, 
reports that 895,886,345 records have been breached.
    Entities and their customers that have fallen victim to data 
breaches range in size from small businesses to major corporations and 
Federal Government agencies, including:
   The IRS--101,000 the agency block payments to data thieves 
        who used stolen identity information from elsewhere to generate 
        pins using stolen Social Security Numbers (date reported 2/10/
        2016).
   Scottrade--lost over 4 million records (October 1, 2015).
   Excellus Blue Cross Blue Shield--lost over 10 million 
        patient records (September 10, 2015).
   Office of Personnel Management (OPM)--lost over 21.5 million 
        Government employee or former employee records (June 4, 2015).
    Most data breach reports include no details on the number of 
records breached or stolen.
    There is no law that requires companies to report breaches, but 
there are laws that require reports to consumers when their personal 
information may have been lost or stolen.
    Identifying and closing vulnerabilities in software and firmware IS 
one important means of securing systems from threats.
    The link between commercially available computing devices and our 
Nation's critical infrastructure lies in the role of products in 
ensuring the proper maintenance and operation of critical 
infrastructure.
                    ransomware and hacking activity
    The latest threat from cyber hackers is ransomware.
    Bad actors find vulnerabilities in a computer or computing network 
and use it to introduce an encryption application that locks the data 
so the owner or user of a computer system cannot access it until a 
ransom is paid to the hackers who then unlock the data.
    Government agencies, businesses, and consumers are struggling to 
protect themselves from cyber threats large and small.
    Innovation in the form of stronger encryption has to move at 
unprecedented speed to try to catch up to the attacks currently being 
used.
    In this fast-paced environment, businesses are offering some of the 
most important cybersecurity protections for digital communications.
    The lessons that can be learned and the protections that could be 
developed is dependent on how well the private and public sectors 
cooperate.
    I look forward to hearing from our witnesses on the issue of 
overstays.
    Thank you.

    Mr. Ratcliffe. As I mentioned earlier, we are pleased to 
have with us a distinguished panel of witnesses today on this 
very important topic.
    Mr. Matthew Eggers is the executive director of national 
security and preparedness at the U.S. Chamber of Commerce.
    Good to have you back before our subcommittee, Matt.
    Mr. Robert Mayer is the vice president of industry and 
State affairs at the U.S. Telecom Association.
    We are glad to have you as well, Mr. Mayer.
    Mr. Mark Clancy is the chief executive officer at Soltra.
    Welcome, Mr. Clancy.
    Mr. Mordecai Rosen is the general manager of the Security 
Business Unit at CA Technologies.
    Thank you for being here today.
    Finally, Ms. Ola Sage is the president and chief executive 
officer of e-Management.
    Welcome, and again, welcome to you all. I would now like to 
ask the witnesses to stand and raise your right hand, so I can 
swear you in to testify.
    [Witnesses sworn.]
    Mr. Ratcliffe. Let the record reflect that the witnesses 
answered in the affirmative. You all may be seated.
    The witnesses' full statements will appear in the record. 
The Chair now recognizes Mr. Eggers, for 5 minutes, for his 
opening statement.

      STATEMENT OF MATTHEW J. EGGERS, EXECUTIVE DIRECTOR, 
     CYBERSECURITY POLICY, NATIONAL SECURITY AND EMERGENCY 
             PREPAREDNESS, U.S. CHAMBER OF COMMERCE

    Mr. Eggers. Thank you, sir. Good morning, Chairman McCaul, 
Chairman Ratcliffe, Ranking Member Richmond, and other 
distinguished Members of the House Subcommittee on 
Cybersecurity, Infrastructure Protection, and Security 
Technologies.
    My name is Matthew Eggers, and I am the executive director 
of cybersecurity policy with the U.S. Chamber. The chamber and 
I welcome the opportunity to testify.
    I will confine my statements to CISA, or the Cybersecurity 
Information Sharing Act of 2015, which is Title I of the act 
that we are discussing today.
    Last year, information-sharing legislation was the 
chamber's top cyber priority. We led the Protecting America's 
Cyber Networks Coalition, a partnership of more than 50 leading 
business associations representing nearly every sector of the 
U.S. economy.
    CISA, a voluntary program, gives businesses legal certainty 
that they have safe harbor against frivolous lawsuits when 
freely sharing and receiving cyber threat data in real time.
    CISA also offers protections related to public disclosure, 
regulatory and antitrust matters. The law safeguards 
individual's privacy and civil liberties. The chamber is 
championing CISA as part of our National cybersecurity 
campaign.
    Businesses' use of CISA falls into roughly 4 categories. I 
am generalizing. One, earlier information-sharing leaders. 
Companies in this category are eager to see a sea change in the 
real-time sharing of threat indicators.
    According to a chamber member who addressed the 
administration's cyber commission in May, our adversaries 
should only use an attack or technique once. If our business 
spots an attack today, all businesses should be protected 
against it by day's end.
    This company and ones just like it is an active member of 
the sharing community. It wants public-private sharing capacity 
expanded right away. The chamber agrees.
    No. 2, ISAO and ISAC members. Rank-and-file organizations 
in this group typically share cyber threat data with other 
businesses and with the Government through information-sharing 
bodies known as ISAOs and ISACs. This category is expected to 
swell as confidence in the CISA program grows and new 
information-sharing organizations are stood up. The 
administration's promotion of ISAOs is expected to have a 
positive influence, too.
    No. 3, be intrigued, but cautious. I attended DHS's C3 
program on June 1 in Indianapolis, and one individual's remark 
comes to mind. He said, ``I have heard about CISA, but we are 
not ready as a company to participate. It will take a cultural 
shift.'' This person's apprehension tells us how central it is 
that trust in CISA's protection be earned and maintained.
    No. 4, small businesses and under-resourced organizations. 
A goal of information-sharing legislation is to foster 
economies of scale in real-time sharing. The chamber believes 
that the market will eventually provide inexpensive and easy-
to-use technologies that conform to CISA's rules and generate 
and swap indicators at internet speeds. Such an outcome is 
important for small and under-resourced organizations.
    The chamber is a strong supporter of CISA, but it's not a 
silver-bullet solution. CISA is part of a mix of policies that 
need to advance together.
    Some select examples. First, the joint-industry NIST cyber 
framework is a sound baseline for businesses' cybersecurity 
practices. The chamber urges policymakers to help agencies 
streamline existing regulations with the framework. We oppose 
the creation of new mandates.
    Second, the chamber is engaging issues that are linked to 
information sharing. The chamber supports a piloting, a CIDAR, 
which is shorthand for a Cyber Incident Data and Analysis 
Repository. Also, we appreciate Congress' efforts to press the 
administration to renegotiate the Wassenaar Agreement control 
language governing so-called intrusion software. Industry is 
urging Wassenaar officials to eliminate the controls on 
technology software and hardware. Discussions are underway, but 
we still have much work to do.
    The CISA program is off to a good start. CISA procedures 
and guidance were finalized yesterday, and chamber members will 
review them.
    While oversight by Congress is crucial, it is too soon to 
make changes to the legislation. CISA does not need to be 
reauthorized for several years. The chamber's public message is 
two-fold. No. 1, to policymakers we say thank you for getting 
CISA done, and we urge lawmakers and the administration to be 
industry's ally as they use the program. No. 2, to businesses 
we say that you should use the framework, join an ISAO or an 
ISAC and take advantage of the CISA AIS system as appropriate.
    The chamber believes that CISA will enable private 
organizations to be more secure and resilient against America's 
cyber adversaries.
    Thank you for giving me the opportunity to convey the 
chamber's views. I am happy to answer any questions.
    [The prepared statement of Mr. Eggers follows:]
                Prepared Statement of Matthew J. Eggers
                             June 15, 2016
    Good morning, Chairman McCaul, Ranking Member Thompson, and other 
distinguished Members of the House Homeland Security Committee 
(committee). My name is Matthew Eggers, and I am the executive director 
of cybersecurity policy with the U.S. Chamber's National Security and 
Emergency Preparedness Department. On behalf of the chamber, I welcome 
the opportunity to testify before the committee regarding industry's 
perspectives on the Cybersecurity Act of 2015.
    The chamber's National Security and Emergency Preparedness 
Department was established in 2003 to develop and implement the 
chamber's homeland and National security policies. The Department's 
Cybersecurity Working Group, which I lead, identifies current and 
emerging issues, crafts policies and positions, and provides analysis 
and direct advocacy to Government and business leaders.
    The chamber applauds the committee and its staff members for their 
dedication to getting cybersecurity information-sharing legislation 
enacted. Recent cyber incidents in the public and private sectors 
underscore the need for legislation to help businesses improve their 
awareness of cyber threats and to enhance their protection and response 
capabilities in collaboration with Government entities. Cyber attacks 
aimed at businesses and Government bodies are increasingly being 
launched from sophisticated hackers, organized crime, and state-
sponsored groups. These attacks are advancing in scope and complexity. 
Industry and Government have a mutual interest in bolstering the 
economic security of the U.S. business community.
    cybersecurity information sharing act of 2015 (cisa): the basics
    I will largely confine my written statement to the Cybersecurity 
Information Sharing Act of 2015 (CISA), which is title I of the 
Cybersecurity Act of 2015.\1\ President Obama signed this legislation 
into law in December 2015. The House passed two cybersecurity 
information-sharing bills in April 2015 with robust majorities from 
both parties and with broad industry backing. Indeed, the House's 
action prodded the full Senate to take up cybersecurity information-
sharing legislation in the fall.
---------------------------------------------------------------------------
    \1\ The cyber legislation was included in the Consolidated 
Appropriations Act, 2016 (Pub. L. No. 114-113). www.congress.gov/bill/
114th-congress/house-bill/2029.
---------------------------------------------------------------------------
    Passing cybersecurity information-sharing legislation was the top 
cyber policy priority of the chamber. We led the Protecting America's 
Cyber Networks Coalition (the coalition), a partnership of more than 50 
leading business associations representing nearly every sector of the 
U.S. economy. It took a dedicated team working with Capitol Hill and 
the administration to get CISA done.
    CISA establishes a voluntary information-sharing program, intended 
to strengthen businesses' protection and resilience against cyber 
attacks. The law gives businesses legal certainty that they have safe 
harbor against frivolous lawsuits when freely sharing and receiving 
cyber-threat indicators (CTIs) and defensive measures (DMs) in real 
time and taking actions to mitigate cyber attacks. CISA also offers 
protections related to public disclosure, regulatory, and antitrust 
matters in order to increase the timely exchange of information among 
public and private entities.
    The law safeguards individuals' privacy and civil liberties and 
establishes appropriate roles for Government agencies and departments. 
CISA reflects sound compromises among many parties on these issues.\2\
---------------------------------------------------------------------------
    \2\ See Automated Indicator Sharing (AIS) resources, including the 
Cybersecurity Information Sharing Act of 2015 (CISA) implementation 
procedures and guidance, available at www.us-cert.gov/ais. Also see 
pro-CISA advocacy papers: ``It's About Protecting America's Cyber 
Networks, Not Surveilling You'' (August 10, 2015) [http://
www.uschamber.com/sites/default/files/
cisa_myth_v_fact_cyber_protection_not_surveillance_final_0.pdf]; 
``Sharing Cyber Threat Indicators (CTIs)--Separating Fact From 
Fiction'' (August 19, 2015) [http://www.uschamber.com/sites/default/
files/cisa_ctis_separating_fact_from_fiction_aug_19- _final.pdf]; `` 
`Voluntary' Means Voluntary--Separating Fact From Fiction'' (August 26, 
2015); and ``Going on the `Defensive'--Separating Fact From Fiction'' 
(October 5, 2015) [http://www.uschamber.com/sites/default/files/
cisa_going_on_the_defensive_separating_fact_- 
from_fiction_oct_5_final.pdf]. http://insidecybersecurity.com/daily-
news/info-sharing-debate-shifts-implementation-privacy-advocates-now-
back-cyber-law.
---------------------------------------------------------------------------
    CISA called for the Department of Homeland Security (DHS) to 
establish a ``capability and process'' (aka a portal) in the Department 
to receive CTIs and DMs shared by businesses with the Federal 
Government in an electronic format--i.e., through email or media, an 
interactive form on an internet website, or a real-time, automated 
process. In March 2016, DHS launched an Automated Indicator Sharing 
(AIS) platform that enables the Government and the private sector to 
exchange cybersecurity threat information with one another.\3\ The AIS 
initiative reportedly has more than 100 participants--spanning the 
banking, energy, and technology sectors, as well as both small and 
large companies--up from 6 participants this past spring.
---------------------------------------------------------------------------
    \3\ www.us-cert.gov/ais.
---------------------------------------------------------------------------
    Groups have begun testing their ability to share and receive 
indicators, but there is not yet sharing on a massive scale. The 
platform uses technical specifications, including the Trusted Automated 
eXchange of Indicator Information (TAXII), which defines a set of 
services and message exchanges that, when implemented, enable sharing 
of actionable cyber threat information. It also uses Structured Threat 
Information eXpression (STIX), a collaborative effort to develop a 
structured language to represent threat information.\4\
---------------------------------------------------------------------------
    \4\ http://blogs.wsj.com/cio/2016/03/21/homeland-security-
department-launches-cyber-threat-sharing-platform.
---------------------------------------------------------------------------
    An industry participant at last week's (June 9) CISA implementation 
workshop captured the thinking of many when he said, ``Our adversaries 
are employing automated techniques against us. Machine-to-machine 
sharing is a key element needed to help solve our cybersecurity 
problems.'' He added that the United States cannot succeed if we pit 
cyber professionals--which are a significantly limited workforce 
asset--against machines.
     chamber promoting cisa as part of our national cyber campaign
    The chamber is championing CISA as part of our National 
cybersecurity campaign. The chamber will develop a document in concert 
with industry groups and other parties, including DHS and the 
Department of Justice (DOJ), that summarizes the CISA/AIS program, 
describes participants' protections and obligations, and urges the 
private sector to get involved in the AIS network. Appropriate, real-
time automated sharing will strengthen the security and resilience of 
industry and Government, thus heightening the costs of executing 
malicious attacks by U.S. adversaries. Many experts contend that the 
timely sharing of cyber indicators among various information-sharing 
and analysis organizations (ISAOs), information-sharing and analysis 
centers (ISACs), and private- and public-sector entities can reduce 
both the probability and the severity of cybersecurity incidents. 
(ISACs are considered to be ISAOs.)
    The chamber launched our cybersecurity roundtable series in 2014. 
This National initiative recommends that businesses of all sizes and 
sectors adopt fundamental internet security practices, including using 
the framework and similar risk management tools, engaging cybersecurity 
providers, and partnering with law enforcement before cyber incidents 
occur. Nine regional roundtables and two summits in Washington, DC, 
have been held since 2014. More events are planned this year, including 
in San Antonio, Texas, on June 28 and in Chicago (Schaumburg, Illinois) 
on July 12. The chamber's Fifth Annual Cybersecurity Summit will be 
held on September 27.
    Each regional event includes approximately 200 attendees and 
typically features cybersecurity principals from the White House, DHS, 
the National Institute of Standards and Technology (NIST), and local 
FBI and Secret Service officials.
       cisa implementation guidance and proceduers: a good start
    The enactment of CISA triggered an array of Government guidelines 
and procedures. The chamber has tracked implementation dates and 
monitored agencies' progress toward meeting the deadlines--and DHS and 
the DOJ delivered.
    In particular, DHS and DOJ released interim guidance in February 
2016 to assist ``non-Federal entities''--including organizations in the 
private sector and State and local governments--to share CTIs with the 
Federal Government. The departments also released interim procedures 
relating to the receipt and use of CTIs by the Federal Government, 
interim guidelines relating to privacy and civil liberties in 
connection with the exchange of these indicators, and guidance to 
Federal agencies on sharing information in the Government's possession.
    At the time of this writing, the chamber expects that DHS and DOJ 
officials will release by June 15 final procedures and guidance, which 
we generally agree with. We anticipate that the departments will 
accommodate the chamber's request to clarifying the protections 
afforded to a non-Federal entity when it shares cyber threat 
information with another non-Federal entity. The chamber and public 
authorities have a mutual interest in ensuring that the important 
protections authorized under CISA are clearly stated and utilized.
      looking ahead: promoting cisa, building and maintaing trust
    Looking forward to the next several months, the chamber believes 
that businesses' use of the CISA program arguably falls into roughly 4 
categories. I want to emphasize that these groups are generalizations--
shorthand for where private entities are in the information-sharing 
ecosystem.
   Early Information-Sharing Leaders: Increasing the Quality 
        and Volume of Sharing Under CISA.--Private organizations in 
        this category are actively engaged in sharing threat data. They 
        were in the vanguard of businesses establishing and funding 
        ISAOs and ISACs several years ago. Companies in this grouping 
        have long-established information-sharing relationships among 
        multiple industry peers and Government partners, and several of 
        them are already directly connected to sharing programs like 
        AIS.\5\
---------------------------------------------------------------------------
    \5\ www.dhs.gov/topic/cybersecurity-information-sharing.
---------------------------------------------------------------------------
    CISA should give the lawyers and risk management professionals in 
        these top organizations added certainty to receive CTIs and DMs 
        and to share them with business and the Government. A core 
        purpose of the new law is to extend liability protections to 
        companies to encourage them to share cyber threat 
        information.\6\
---------------------------------------------------------------------------
    \6\ http://insidecybersecurity.com/daily-news/mccaul-evaluate-
effectiveness-cyber-info-sharing-law-including-liability-protections.
---------------------------------------------------------------------------
    Companies in this category are eager to see a sea change in the 
        real-time sharing of threat indicators within and across 
        sectors, as well as between Government and businesses. 
        According to a chamber member who addressed on May 16 the 
        Commission on Enhancing National Cybersecurity, ``Our 
        adversaries should only use an attack or technique once. If our 
        business spots an attack today, all businesses should be 
        protected against it by day's end.'' Clearly, this company is 
        an active member of the sharing community and wants public-
        private capacity to expand their capability to exchange threat 
        data immediately. The chamber agrees.
   ISAOs/ISACs Members: Leveraging the Expanding Network of 
        Sharing Conduits.--Many members in this dispersed network of 
        ISAOs/ISACs do not share cybersecurity threat data directly 
        with the Government. Instead, rank-and-file members in this 
        category typically share CTIs and DMs with other businesses and 
        with the Government through the channels that information 
        bodies (e.g., the Financial Services-ISAC, the Oil and Natural 
        Gas-ISAC) provide. This category is expected to swell as 
        confidence in the CISA program grows and new information-
        sharing organizations are stood up over the coming months and 
        years.
    The comparatively new ISAO standards organization is a key 
        component of the Obama administration's cybersecurity strategy, 
        launched in early 2015.\7\ The administration's promotion of 
        ISAOs is designed to encourage the protected sharing of 
        information based on emerging and evolving threats that 
        transcend industry sectors and geographic regions.\8\ CISA is 
        expected to have a positive influence on the expansion of the 
        community of ISAOs and ISACs.
---------------------------------------------------------------------------
    \7\ In February 2015, President Obama signed an Executive Order 
(EO) to promote cybersecurity information sharing among multiple 
business and Government entities. The EO urges the private sector to 
develop information sharing and analysis organizations (ISAOs) to serve 
as focal points for cybersecurity information sharing and collaboration 
within the private sector and between the private sector and 
Government. www.whitehouse.gov/the-press-office/2015/02/13/executive-
order-promoting-private-sector-cybersecurity-information-shari.
    \8\ http://insidecybersecurity.com/daily-news/isao-standards-body-
issue-next-round-draft-plans-info-sharing-july.
---------------------------------------------------------------------------
   The Intrigued But Cautious: Sharing Should Pick Up as Both 
        Education and Confidence Increase.--Businesses in this category 
        have probably heard something about CISA through social media, 
        cybersecurity events, and colleagues. Business leaders are 
        interested in protected sharing arrangements, yet they are not 
        ready to commit to routine sharing and receiving. Perhaps they 
        do not know how to begin. The former view is due to misgivings 
        about CISA's protections. The latter situation can be addressed 
        through outreach and education.
    Many cautious businesses have pictures in their heads of 
        bureaucrats lying in wait with regulations and privacy groups 
        readying law suits. The chamber does not agree completely with 
        these perspectives, but we hear them expressed frequently. I 
        attended a DHS-led C3 Voluntary Program in early June in 
        Indianapolis and one individual's remark comes to mind. He 
        said, ``I have heard about CISA. But we are not ready as a 
        company to participate--it will take a cultural shift.'' This 
        person's apprehension tells us how central it is that trust in 
        CISA's protections be earned and maintained. The chamber and 
        most Government leaders appreciate that business attitudes 
        change over time and participation in CISA/AIS will be gradual.
    One change that may accelerate the use of CISA is business 
        contracting arrangements. The chamber foresees situations where 
        large firms require their supply chain partners to belong to an 
        ISAO/ISAC and to utilize AIS or some other automated means of 
        timely indicator sharing.
   Small Businesses and Underresourced Organizations: Indirect 
        Beneficiaries of Innovations in Sharing.--Many small and 
        midsize businesses, especially underresourced enterprises, will 
        be able to benefit from an innovative, automated sharing 
        ecosystem. A key long-term goal of information-sharing 
        legislation is to foster economies of scale in real-time 
        sharing. The chamber anticipates that the marketplace will 
        eventually provide inexpensive and easy-to-deploy technologies 
        that conform to CISA's rules (e.g., scrubbing privacy 
        information from CTIs) and generate and swap threat signatures 
        at internet speeds. Systems like AIS will be able to block 
        attacks sooner and more regularly, compared with the relatively 
        human-intensive sharing schemes in use today.
   cisa fits within a collection of policy issues that need attention
    The chamber is a strong supporter of CISA and its potential to 
clear away real or perceived hurdles to information sharing. CISA is 
not a silver-bullet solution to our Nation's cybersecurity challenges. 
However, chamber members say that increasing the speed and quality of 
bilateral information flows of CTIs and DMs is essential for developing 
a holistic approach to cyber defense. CISA is part of a mix of 
cybersecurity policies that need to advance together.
    Here are some select issues that are worth highlighting for the 
committee:
    First, the joint industry-NIST Framework for Improving Critical 
Infrastructure Cybersecurity (the framework) is a sound baseline for 
businesses' cybersecurity practices. The CISA program and the framework 
are highly complementary. Businesses implement a cybersecurity risk 
management program before investing in information-sharing programs. In 
February 2016, the chamber sent a letter to NIST, commenting on the 
framework.
    Key points that the chamber made in the letter include the 
following:
   The chamber has been actively promoting the framework.
   Chamber members are using the framework and urging business 
        partners to manage cybersecurity risks to their information 
        networks and systems.
   The chamber urges policymakers to help agencies and 
        departments with streamlining existing regulations with the 
        framework and maintaining the framework's voluntary nature.
   Industry opposes the creation of new or quasi-cybersecurity 
        regulations, particularly when Government authorities have not 
        taken affected entities' perspectives into account.\9\
---------------------------------------------------------------------------
    \9\ http://csrc.nist.gov/cyberframework/rfi_comments_02_2016/
20160209_US_Chamber_- of_Commerce.pdf.
---------------------------------------------------------------------------
    The bottom line: The chamber values the Obama administration's 
leadership on the non-regulatory framework and urges the next 
administration to actively support it. NIST did an admirable job 
working with industry to development the tool. As framework 
stakeholders begin the year-long transition from the Obama 
administration to its successor, the chamber wants to sustain the view 
held by most businesses and policymakers that the framework is a policy 
and political cornerstone for managing enterprise cybersecurity risks 
and threats.
    To sustain the momentum behind the framework, the chamber believes 
that both industry and government have jobs to do. On the one hand, the 
chamber has been actively promoting the framework since it was released 
in 2014. Our national cybersecurity campaign is funded through members' 
sponsorships and through the contributions of State and local chambers 
of commerce, other business organizations, and academic institutions. 
Further, chamber members are using the framework and urging business 
partners to manage cybersecurity risks to their data and devices. 
Industry is working with government entities, including DHS, to 
strengthen their information networks and systems against malicious 
actors.
    On the other hand, the chamber urges policymakers to help agencies 
and departments with harmonizing existing regulations with the 
framework and maintaining the framework's voluntary nature. Our 
organization opposes the creation of new or quasi-cybersecurity 
regulations, especially when government authorities have not taken 
affected entities' perspectives into account.
    Second, the chamber is engaging policy issues that ultimately 
relate to cybersecurity information sharing.
   The chamber supports piloting a CIDAR, shorthand for a cyber 
        incident data and analysis repository. In May 2016, we sent a 
        letter to DHS saying that (1) data submitted to a CIDAR need to 
        be made anonymous, (2) additional sharing protections may be 
        needed, and (3) an experimental CIDAR could offer tangible 
        upsides to public- and private-sector cybersecurity. 
        Comprehensive information about cyber events could assist 
        insurers in expanding cyber coverage and in identifying 
        cybersecurity best practices for their customers.
   The chamber appreciates the efforts of the Congressional 
        Cybersecurity Caucus, particularly co-chairs McCaul and 
        Langevin, to press the administration to renegotiate the 
        Wassenaar Agreement (WA) control language governing so-called 
        intrusion software and surveillance items aspects of a 
        controversial international agreement to prevent the export of 
        sophisticated hacking tools to repressive governments and 
        criminal organizations.
    Industry and democratic governments have a mutual interest in 
        keeping malicious software out of the hands of bad actors. But 
        the 2013 WA control language governing so-called intrusion 
        software and surveillance items takes a seriously wrong 
        approach to cybersecurity.\10\
---------------------------------------------------------------------------
    \10\ https://www.uschamber.com/sites/default/files/documents/files/
final_group_letter_- bis_proposed_rule_intrusion_software-
surveillance_items_july_20_2015.pdf.
---------------------------------------------------------------------------
    WA officials are gathering from June 20 to 24 in Vienna, Austria, 
        at the working-group level. Industry is urging officials to 
        completely eliminate the controls on technology, software, and 
        hardware. If deleting the controls is not possible, the chamber 
        and many others recommend that WA officials substantially 
        narrow the scope of the control language and dramatically 
        simplify the language in order to bring clarity and enable 
        compliance.\11\ If the WA control language is not eliminated or 
        at least adequately amended, it could have a powerfully 
        (unintended) negative effect on the CISA program. Creating 
        cybersecurity policies and laws in the WA environment lacks 
        sufficient transparency and does not advance public-private 
        partnerships at home and abroad.
---------------------------------------------------------------------------
    \11\ http://insidecybersecurity.com/daily-news/obama-
administration-agrees-renegotiate-cyber-export-controls.
---------------------------------------------------------------------------
   On June 8, the chamber's board of directors approved a 
        policy statement on cybersecurity norms and deterrence. The 
        paper argues that despite the existence of written blueprints, 
        such as ones related to global prosperity and defense, the U.S. 
        cybersecurity strategy is seemingly uncertain--both to many in 
        the private sector and our adversaries alike. The chamber 
        believes that policymakers need to refocus National and global 
        efforts to heighten the costs on sophisticated attackers that 
        would willfully hack America's private sector for illicit 
        purposes.
    Public-private policymaking needs to spotlight increasing adherence 
        to international norms and deterrence to reduce the benefits of 
        conducting harmful cyber activity against the U.S. business 
        community and the Nation. The statement makes several policy 
        endorsements. For instance, the chamber contends that the 
        United States and its allies should enhance businesses' 
        situational awareness through protected information sharing.
               recommendations on congressional oversight
    The chamber believes that the CISA program is off to a good start. 
The CISA/AIS implementation guidance documents will likely be finalized 
today. We look forward to reviewing them with our members. The chamber 
appreciates the open and constructive discussions that we have had with 
DHS and DOJ officials. While oversight by Congress is crucial, it is 
too soon to make changes to the legislation. CISA does not need to be 
reauthorized for several years (i.e., September 2025).
    The chamber's public message is two-fold:
   To policymakers we say thank you for getting the 
        cybersecurity information-sharing legislation across the finish 
        line. And we urge lawmakers and the administration to be 
        industry's ally as they use the program. Companies need to feel 
        that policymakers have their backs. It is important that 
        businesses see that the protections granted by the law-
        including matters tied to limited liability, regulation, 
        antitrust, and public disclosure-become real.
   To businesses we say that you should use the framework, join 
        an ISAO/ISAC, and take advantage of the CISA/AIS system as 
        appropriate. The chamber urges the senior leaders of industry 
        groups to promote these initiatives among their peers and 
        constituencies.
    The chamber and many stakeholders worked diligently over several 
years to craft policy that would serve multiple interests--namely 
individuals' security and privacy. We believe that CISA will enable 
private organizations of all sizes and sectors to be more secure and 
resilient against America's cyber adversaries.

    Mr. Ratcliffe. Thank you, Mr. Eggers.
    The Chair now recognizes Mr. Mayer, for 5 minutes, for his 
opening statement.

  STATEMENT OF ROBERT H. MAYER, VICE PRESIDENT, INDUSTRY AND 
        STATE AFFAIRS, UNITED STATES TELECOM ASSOCIATION

    Mr. Mayer. Thank you. Good morning, Chairman McCaul, 
Chairman Ratcliffe, Ranking Member Richmond, and distinguished 
Members of the committee.
    My name is Robert Mayer, and I serve as vice president of 
industry and State affairs at the United States Telecom 
Association. Thank you for giving the communications sector and 
me personally the opportunity to appear before you today for 
this important oversight hearing.
    Today, our Nation faces unrelenting assaults from a variety 
of bad actors, including, among others, nation-states, criminal 
enterprises, terror organizations and individual and group 
hackers. As new interconnected platforms, technologies, and 
applications grow exponentially, so does the attack surface 
expand, placing every U.S. citizen and organization in harm's 
way.
    In this setting, information sharing represents a 
fundamental building block in protecting the vital interests of 
all well-intended stakeholders in the cyber ecosystem. The U.S. 
Congress and this committee in particular are to be applauded 
for passing bipartisan legislation that now serves as a 
cornerstone in protecting our Nation's economic and National 
security from the perils of cyber attack.
    The Cybersecurity Act of 2015 is a complex bill that 
represents a careful balance of interests across a broad 
spectrum of stakeholders. The act was founded on the voluntary 
sharing of information and provides authority for preventing, 
detecting, analyzing, and mitigating cybersecurity threats.
    On the privacy front, great care was taken to safeguard 
individuals from having their personal information shared with 
the Government in a manner not directly related to specifically 
authorized activities. Of great importance to our industry were 
the assurances that information shared with our Government 
partners would not be directly used to regulate lawful 
activity, to monitor or operate defensive measures, or share 
cybersecurity threat indicators.
    Similarly, protections from Federal and State disclosure 
laws provide the appropriate balance between interest and 
transparency, and vital information sharing. Furthermore, by 
authorizing the EINSTEIN 3 Accelerated and Enhanced 
Cybersecurity Service programs and eliminating statutory 
obstacles to their implementation, the Act took important steps 
to make the network of Federal civilian agencies, State 
governments, critical infrastructure providers and other 
entities safer, especially from advanced, persistent threats.
    Perhaps of greatest significance on the impact of future 
information sharing were the protections from liability 
incorporated into the act. While there may remain some 
lingering questions in this area that will be the subject of 
further clarification, the lack of such protections was one of 
the most serious impediments to sharing information.
    The communication sector has been actively engaged in 
information sharing, operational and planning activities at DHS 
and elsewhere both before and subsequent to the passage of the 
act. Today at the operational level, over 50 private companies 
and 24 Federal agencies share critical communications 
information in the DHS National Coordination Center which also 
operates as our communications ISAC.
    Another noteworthy undertaking in this area involves 
activity in the Communications Sector Coordinating Council 
where a new committee was created following the passage of the 
act to evaluate current information-sharing activities and what 
the sector can do to support new and evolving initiatives.
    That committee is also planning to conduct a preliminary 
assessment of how the current, more narrowly circumscribed 
information sharing has been effectively and appropriately 
expanded as a consequence of the legislation adopted by 
Congress.
    While the act is only 6 months old, it is already evident 
that the new law is having an impact on both industry and 
Government efforts to facilitate greater information sharing.
    We want to take this opportunity to acknowledge the 
significant and largely successful efforts by DHS to meet their 
aggressive implementation and guidance deadlines. Both DHS and 
the DOJ have been extremely forthcoming with respect to 
explaining and clarifying administrative, operational, 
technical, and legal aspects associated with implementing 
information-sharing mechanisms, including those associated with 
a newly modified, automated information-sharing capability.
    While there are still some operational improvements needed 
to facilitate the efficient sharing of both automated and non-
automated processes, and Government guidelines remain to be 
finalized, there is clear evidence of a strong commitment on 
the part of industry and government to address any remaining 
barriers.
    Several major companies in our sector are already enrolled 
in the program and others are in process of completing their 
evaluations.
    One note of concern that we would like to share with this 
committee involves the implications of potential privacy rules 
that the FCC recently announced. Under the act, an entity can 
share information on a specific person if at the time of the 
sharing that entity did not knowingly reveal personal 
information unrelated to a cybersecurity threat.
    Unlike the language in the act, the FCC proposal would 
grant the protection only when the sharing is shown to be, 
``reasonably necessary.'' This language creates ambiguity and 
uncertainty and is likely to spur reticence on the part of the 
companies, who could fear enforcement action based on an after-
the-fact FCC determination of reasonableness. We will work hard 
to secure the appropriate clarity, and we continue to engage 
the FCC in this rulemaking proceeding.
    In closing, let me once again thank the committee for their 
on-going work to oversee the implementation of this landmark 
legislation. Given the magnitude of the threat and the promise 
of this legislation, periodic oversight by this committee will 
only bring us closer to making the cyber world much safer.
    Thank you, and I look forward to your questions.
    [The prepared statement of Mr. Mayer follows:]
                 Prepared Statement of Robert H. Mayer
                             June 15, 2016
    Chairman McCaul, Ranking Member Thompson, and distinguished Members 
of the committee, thank you for giving the Communications Sector and me 
personally the opportunity to appear before you today for this 
important oversight hearing.
    My name is Robert Mayer, and I serve as vice president of industry 
and state affairs at the United States Telecom Association. USTelecom 
represents companies ranging from some of the smallest rural broadband 
providers to some of the largest companies in the U.S. economy. I am a 
past chair and current cybersecurity committee chair of the 
Communications Sector Coordinating Council (CSCC) which represents the 
Broadcasting, Cable, Satellite, Wireless, and Wireline segments. The 
CSCC is one of the 16 critical infrastructure sectors under the 
Critical Infrastructure Partnership Advisory Council (CIPAC) through 
which the Department of Homeland Security (DHS) facilitates physical 
and cyber coordination and planning activities among the private sector 
and Federal, State, local, territorial, and Tribal governments.
    Today, our Nation faces unrelenting assaults from a variety of bad 
actors including, among others, nation-states, criminal enterprises, 
terror organizations and individual and group hackers. And as new 
interconnected platforms, technologies and applications grow 
exponentially, so does the attack surface expand placing every U.S. 
citizen and organization in harm's way. In this setting, information 
sharing represents a fundamental building block in protecting the vital 
interests of all well-intended stakeholders in the cyber ecosystem.
    The United States Congress and this committee in particular are to 
be applauded for passing bipartisan legislation that now serves as a 
cornerstone in protecting our Nation's economic and National security 
from the perils of a cyber attack. The Cybersecurity Act of 2015 is a 
complex bill that represents a careful balance of interests across a 
broad spectrum of stakeholders.\1\ The Act is founded on the voluntary 
sharing of information and provides authority for preventing, 
detecting, analyzing, and mitigating cybersecurity threats and includes 
fundamental protections important to our industry including those 
related to privacy; exposure to regulation; State, Tribal, or local 
disclosure laws; and general legal liabilities.
---------------------------------------------------------------------------
    \1\ Cybersecurity Act of 2015 was passed as part of the 
Consolidated Appropriations Act, 2016, Pub. L. No. 114-113, 129 Stat. 
2242 (available at https://www.congress.gov/114/plaws/publ113/PLAW-
114publ113.pdf).
---------------------------------------------------------------------------
    On the privacy front, great care was taken to safeguard individuals 
from having their personal information shared with the Government in a 
manner not directly related to specifically authorized activities 
associated with cyber threat indicators and defensive measures. Of 
great importance to our industry were the assurances that information 
shared with our Government partners would not be directly used to 
regulate--including enforcement actions--lawful activity to monitor, 
operate defensive measures or share cyber threat indicators. Similarly, 
protections from Federal and State disclosure laws provide the 
appropriate balance between interests in transparency while not 
impeding vital information sharing.
    Finally, by authorizing the EINSTEIN 3 Accelerated (E3A) and 
Enhanced Cybersecurity Service (ECS) programs, and eliminating 
statutory obstacles to their implementation, the Act took important 
steps to make the networks of Federal civilian agencies, State 
governments, critical infrastructure providers and other entities 
safer, especially from advanced persistent threats.
    Perhaps of greatest significance on the impact of future 
information sharing were the protections from liability incorporated 
into the Act. While there may remain some lingering questions in this 
area that are now the subject of further clarification, the lack of 
such protections was one of the most serious impediments to sharing 
information. The law establishes an appropriate standard by applying an 
exemption to liability protection only in such instances where there 
was a knowing sharing of personal information or information that 
identifies a specific person not directly related to a cybersecurity 
threat or where there exists evidence of gross negligence or willful 
misconduct in the course of conducting the authorized activities.
    The Communications Sector has been actively engaged in information 
sharing operational and planning activities at DHS and elsewhere, both 
before and subsequent to the passage of the Act. Today at the 
operational level, over 50 private-sector communications and 
information technology companies and 24 Federal Government agencies 
share critical communications information and advice in the DHS 
National Coordination Center (NCC) which also operates as the 
Communications Information Sharing and Analysis Center (ISAC) in 
accordance with a 2000 Presidential Directive.\2\ In this trusted NCC/
Comms ISAC environment, information on cyber vulnerabilities, threats, 
intrusion, and anomalies is routinely exchanged among Government and 
industry participants.\3\
---------------------------------------------------------------------------
    \2\ Presidential Policy Directive 63, (available at http://fas.org/
irp/offdocs/pdd/pdd-63.htm).
    \3\ See, DHS description of the NCC/Comms ISAC (available at 
www.dhs.gov/national-coordinating-center-communications).
---------------------------------------------------------------------------
    Another noteworthy undertaking is this area involves activity in a 
newly-established information sharing committee under the CSCC. This 
committee was created following the passage the Act to evaluate current 
information-sharing activities and what the sector can do to support 
new and evolving initiatives. The committee has identified a variety of 
mechanisms and venues for information sharing including those with 
trusted peers and commercial partners, Government agencies under 
contract, law enforcement, industry peers as part of the sector policy 
and planning process, DHS via the National Cybersecurity and 
Communications Integration Center (NCCIC) and other affiliated 
organizations like US-CERT, other public and private partners and 
finally by ISPs for their own internal use to protect their networks 
and customers. The committee is also planning to conduct a preliminary 
assessment of how the current, more narrowly circumscribed information 
sharing has been effectively and appropriately expanded as a 
consequence of the legislation adopted by Congress.
    While the Act is only 6 months old, it is already evident that this 
new law is having an impact on both industry and Government efforts to 
facilitate greater information sharing. We want to take this 
opportunity to acknowledge the significant and largely successful 
efforts by DHS to meet their aggressive implementation and guidance 
deadlines. Both DHS and the Department of Justice have been extremely 
forthcoming with respect to explaining and clarifying administrative, 
operational, technical, and legal aspects associated with implementing 
information sharing mechanisms including those associated with a newly 
modified, Automated Information Sharing (AIS) capability.\4\ While 
there are still some operational improvements needed to facilitate the 
efficient sharing of both automated and non-automated processes, and 
Government guidelines remain to be finalized, there is clear evidence 
of a strong commitment on the part of industry and Government to 
address any remaining barriers. Several major companies in our sector 
are already enrolled in the program and others are in the process of 
completing their initial evaluations.
---------------------------------------------------------------------------
    \4\ See DHS information on Automated Information Sharing Program 
(available at https://www.dhs.gov/ais).
---------------------------------------------------------------------------
    One note of concern that we would like to share with this committee 
involves the implications of potential privacy rules that the FCC 
announced in their recent Notice of Proposed Rulemaking.\5\ Under the 
Act, an entity can share information on a specific person if at the 
time of the sharing that entity did not knowingly reveal personal 
information unrelated to a cybersecurity threat.\6\ Unlike the language 
in the Act that would allow for liability protection in such instances, 
the FCC proposal would grant the protection only when the sharing is 
shown to be ``reasonably necessary.''\7\ This language creates 
ambiguity and uncertainty and is likely to spur reticence on the part 
of companies who could fear enforcement action based on an after-the-
fact FCC determination of reasonableness. We will work hard to secure 
the appropriate clarity as we continue to engage the FCC in this 
rulemaking proceeding.
---------------------------------------------------------------------------
    \5\ Protecting the Privacy of Customers of Broadband and Other 
Telecommunications Services, WC Docket No. 16-106, Notice of Proposed 
Rulemaking, FCC 16-39 (rel. Apr. 1, 2016) (FCC NPRM).
    \6\ See, Cybersecurity Act of 2015 Section 104(d)(2)(A).
    \7\ See, FCC NPRM at para. 117.
---------------------------------------------------------------------------
    In closing, let me once again thank this committee for their on-
going work to oversee the implementation of this landmark legislation. 
Given the magnitude of the threat and the promise of this legislation, 
periodic oversight by this committee will only bring us closer to 
making the cyber world much safer.

    Mr. Ratcliffe. Thank you, Mr. Mayer.
    The Chair now recognizes Mr. Clancy, for 5 minutes, for his 
opening statement.

  STATEMENT OF MARK G. CLANCY, CHIEF EXECUTIVE OFFICER, SOLTRA

    Mr. Clancy. Chairman McCaul, Chairman Ratcliffe and Ranking 
Member Richmond, and Members of this committee, thank you for 
scheduling today's hearing.
    My name is Mark Clancy, and I am the chief executive 
officer of Soltra.
    I want to thank you for your efforts and long-standing 
dedication to addressing cybersecurity concerns in this 
committee, including the passage of the cyber information-
sharing legislation. CISA's passage was a critical step toward 
improving the collective resiliency of our Nation's critical 
infrastructure.
    It has only been 6 months since CISA was signed into law, 
but its implementation is moving forward quickly. As an early 
participant in the DHS Automated Indicator Sharing System, I 
believe that Soltra can offer a unique window into AIS's 
progress, key lessons learned and suggested improvements as 
this implementation continues.
    Formed in 2014, as a joint venture between DTCC and the FS-
ISAC Act, Soltra and its automation software, Soltra Edge, are 
bringing cutting-edge innovation and technical capabilities to 
the cybersecurity information-sharing process. DTCC is a 
participant-owned and -governed cooperative that serves as 
critical infrastructure of the U.S. capital markets, as well as 
financial markets globally.
    In 2015, DTCC subsidiaries processed securities 
transactions valued at $1.5 quadrillion. The FS-ISAC is a not-
for-profit organization formed in 1999 to address cyber threats 
in the Nation's critical infrastructure. The FS-ISAC has grown 
rapidly in recent years, and today the FS-ISAC has nearly 7,000 
member organizations across 37 countries.
    Soltra leverages the unique expertise of both these 
entities in our solutions to shorten the time from awareness, 
to decision, to action in addressing cyber threats. Soltra 
began as a cross-industry initiative that provides a no-cost 
platform that users can access to share cyber threat 
intelligence, or CTI, within or across communities. After less 
than 18 months, Soltra Edge has been downloaded by over 2,600 
organizations in 75 countries across 25 industries.
    Our threat-sharing ecosystem relies on 3 open standards 
first developed by DHS and MITRE and now managed by OASIS. 
These are known as STIX, TAXII, and CYBEX. By using these 
standards, Soltra enables users to communicate CTI in a format 
that a human can understand and a machine can process, thereby 
cutting down hundreds of hours of effort that are currently 
needed to distill this information.
    These open standards also allow Soltra users to exchange 
CTI from community sources like ISACs and ISAOs, commercial 
sources, Government sources such as DHS, Treasury, FBI, and 
utilize that information in a variety of commercial and open-
source tools.
    As I mentioned earlier, Soltra is one of the handful of 
companies that has already enrolled in AIS. DHS has been a 
helpful partner in this process, and as is normal in the case 
of any program there are a few areas that would benefit from 
clarification.
    First and foremost, it has been our observation that 
additional guidance is needed from DHS and DOJ that the 
liability of protections under CISA cover private-to-private 
sharing. The initial guidance was silent on that point and 
created much confusion in the industry as a result.
    Just as of today, it looks like that was addressed in the 
updated guidance that DHS had published, and we look forward to 
reviewing that in the fall.
    As you know, privacy is and always will be a top priority 
for the financial services sector. As we move forward with 
CISA, additional guidance is also needed from DHS to provide 
clarity on the definition of personally identifiable 
information, or PII. Thus far, the definition of PII in the AIS 
guidance differs from the definition of PII in other DHS 
programs. It is critical that clarity be provided quickly by 
DHS to ensure top protections by all who participate in the 
program.
    While it is still early on in the AIS program, I would like 
to focus on 5 recommendations for improving the AIS system. 
First, to maximize the potential of AIS, it would be beneficial 
to streamline the process for signing up and to simplify the 
process for obtaining digital certificates from Federal Bridge 
providers.
    Second, various aspects of the law as well as the 
implementation have caused DHS to add extensions into the STIX 
standard. AIS also includes a series of required fields in STIX 
data submitted to the Department, which if not included will 
reject any attempted submission from a company. It would be 
helpful for DHS to specify those things up-front in order to 
help implementers understand what needs to be done in advance 
of connecting to the AIS system.
    Third, DHS should issue guidance on how the CISCP program 
fits under CISA to provide greater verification.
    Fourth, for greater participation and ease of use in the 
future, it would be beneficial to add a test environment where 
companies can ensure its AIS interface works effectively.
    Finally, there are 3 main data points that the private 
sector would like to see added to the AIS system to help 
increase the effectiveness of the platform. These include 
additional information about the types of threat actors 
associated with threat intelligence, recommended defensive 
measures, and a feedback loop to refine the context of CTI 
data.
    I want to thank you once again for providing me with the 
opportunity to share my insight today, and I look forward to 
working with the committee, Congress and the Executive branch 
as well as with our private-sector partners to achieve the 
collective goals of CISA. I would be happy to answer any 
questions that you may have.
    [The prepared statement of Mr. Clancy follows:]
                  Prepared Statement of Mark G. Clancy
                             June 15, 2016
    Chairman Ratcliffe, Ranking Member Richmond, and Members of the 
committee, thank you for scheduling today's hearing on industry 
perspectives on the Cybersecurity Act of 2015 (CISA). My name is Mark 
Clancy, and I am the chief executive officer of Soltra. Soltra's 
mission is to design and deliver solutions that shorten the time from 
awareness, to decision to action, in addressing cyber threats.
    First, thank you for all of your efforts and dedication to 
addressing key cybersecurity concerns and for successfully passing 
cybersecurity information-sharing legislation. As our Nation continues 
to confront serious cybersecurity threats to our critical 
infrastructure, cybersecurity information sharing is one critical way 
to address these challenges.
                   cybersecurity information sharing
    Cybersecurity information sharing has been a cornerstone of various 
aspects of my career, beginning in 2004. At that time, I was running 
Citigroup's global Security Incident Response Team. Twelve years ago, 
we worked to combat the menace of phishing attacks targeting our 
customers. We quickly learned that the criminals were using the same 
approaches to target customers of other financial institutions; and by 
bi-directional sharing of the technical observations of those attacks 
with our competitors, we all were better able to minimize the impacts 
of these incidents. That first generation model of sharing was born out 
of personal trust between individual practitioners who met face-to-face 
frequently.
    By 2008, a new sharing model was needed as the Financial Services 
Information Sharing and Analysis Center (FS-ISAC) started to grow 
significantly. This second generation trust model had widened to a 
larger number of institutions and individuals who still meet face-to-
face on occasion, but now had moved to using electronic mail lists as 
the primary method of exchanging information between face-to-face 
meetings.
    By 2010, when I was the chief information security office at The 
Depository Trust and Clearing Corporation (DTCC), we realized the scale 
of the community and the tonnage of information being shared grew to 
the point we could not utilize all the information, and that a third 
generation approach to sharing was required to use standardization and 
automation. This lead to us exploring standards that described a cyber 
threat in such a way that a human could understand it, but a machine 
could process it.
          soltra creation: dtcc and the fs-isac collaboration
    Soltra is the financial industry's answer to the third-generation 
information-sharing model. Soltra is a joint venture created by DTCC 
and the FS-ISAC that leverages the unique expertise of both entities, 
bringing together the best and brightest of the industry.
    DTCC is a participant-owned and governed cooperative that serves as 
the critical infrastructure for the U.S. capital markets as well as 
financial markets globally. At its core, it develops and harnesses 
technology to provide a variety of risk management and data services to 
the financial services industry. More than 40 years ago the firm was 
created largely out of the need to leverage technology and automation 
in order to ensure securities transactions were more efficiently 
settled, thereby reducing risk of loss in the event of a counterparty 
default. In this respect, DTCC presently is among the most 
sophisticated financial technology or ``FinTech'' companies.
    Today, DTCC continues to deploy evolving and improving technology 
in service to its mission as the primary financial market 
infrastructure for the securities industry. DTCC simplifies the 
complexities of clearing, settlement, asset servicing, data management 
and information services across multiple asset classes. In 2014, DTCC's 
subsidiaries processed securities transactions valued at approximately 
US$1.6 quadrillion.
    The FS-ISAC is a 501(c)6 nonprofit organization and is funded 
entirely by its nearly 7,000 member firms and sponsors. It was formed 
in 1999 in response to 1998 Presidential Decision Directive 63 (PDD 
63), which called for the public and private sectors to work together 
to address cyber threats to the Nation's critical infrastructures. The 
FS-ISAC expanded its role to encompass physical threats after the 
attacks on 9/11/2001, and in response to Homeland Security Presidential 
Directive (HSPD) 7 (and its 2013 successor, Presidential Policy 
Directive (PPD) 21) and the Homeland Security Act.
    The FS-ISAC has grown rapidly in recent years. In 2004, there were 
only 68 members which were mostly large financial services firms. 
Today, FS-ISAC has nearly 7,000 member organizations, including 
commercial banks and credit unions of all sizes; markets and equities 
firms; brokerage firms; insurance companies; payments processors; and 
40 trade associations representing all of the U.S. financial services 
sector. Because today's cyber-criminal activities transcend country 
borders, the FS-ISAC has expanded globally and has active members in 
over 37 countries.
                                 soltra
    Soltra advances cybersecurity capabilities and increases resilience 
of critical infrastructure organizations by collecting and distilling 
cybersecurity threat intelligence from a myriad of sources to help 
safeguard against cyber attacks and deliver automated services at 
``computer speed,'' cutting down the hundreds of human hours that are 
currently needed to distill cyber threat information.
    Soltra began as a true cross-industry initiative that included a 
live prototype involving over 125 security practitioners that included 
FS-ISAC members, private-sector representatives from other critical 
sectors, and Government entities to refine the requirements, 
architecture, and design of Soltra's automation software, which is 
known as Soltra Edge.TM Soltra Edge provides for a free 
platform that users can access, and after less than a year-and-a-half, 
Soltra Edge has been downloaded by over 2,600 organizations in 75 
countries spanning 25 industries to consume, utilize, and share cyber 
threat intelligence using open standards.
    The Soltra Edge platform sends, receives, and stores messages of 
Cyber Threat Intelligence (CTI) in a standardized way. It hides the 
complexity of the underlying technical specification so that end users 
can setup and start receiving threat information in under 15 minutes in 
most cases, changing the paradigm where it could take months or 
millions of dollars to change internal systems if companies wanted to 
do it on its own. The information that is received can be used to push 
instructions to other security tools to perform detection and 
mitigation of those threats. To support the widest possible adoption, 
we also made a highly functional version of the platform available at 
no cost to end-user organizations to defend themselves. We also offer a 
low-cost or no-cost solution to ISAC and ISAO community organizations 
to act as the community hub for machine-to-machine threat sharing if 
they lack an existing operational capability. For organizations with 
additional needs, we also offer a paid membership which includes system 
integrations for platforms that have not adopted standards, enterprise 
grade operational features, and technical support.
    soltra creates the first-ever interoperable information sharing 
    platform: provides cross-sector sharing to better combat threats
    Soltra has built a threat-sharing ecosystem using 3 open standards 
first developed by DHS and MITRE called the Structured Threat 
Information eXpression (STIX) and the Trusted Automated eXchange of 
Indicator Information (TAXII), and the Cyber Observable eXpression 
(CybOX). STIX, TAXII, and CybOX have been transitioned into an 
international standards body, OASIS. These open standards are 
foundational for the interoperability and machine processing that are 
key to addressing complexity, and acting on information quickly. The 
OASIS CTI Technical Committee, which maintain these standards, has the 
largest amount of corporate and individual members of any technical 
committee in the standards body.
    Soltra utilizes these open standards and has the unique ability to 
be the ``glue'' between different sectors and to provide connectivity 
for those who do not have the time or infrastructure to manage the 
transition to STIX/TAXII. This common standard also allows a defender 
of networks to use CTI from community sources like ISACs and ISAOs; 
Government sources such as the U.S. Departments of Homeland Security 
(DHS) and Treasury, along with the Federal Bureau of Investigation 
(FBI); and utilize that information in a variety of commercial and 
open-source security tools. It also addresses the problems companies 
currently have when using multiple vendors whose bundling of CTIs may 
only work with that same vendor's tools. Soltra fixes this problem and 
allows for the use and scalability of information from multiple sources 
to be utilized in multiple tools that detect or defend the network.
    Soltra also helps break down barriers between and amongst key 
sectors of the economy, providing the bridge from financial services to 
key sectors like health, energy, retail, as well as State, local, 
Tribal, and territorial (SLTT) governments. Historically, sectors only 
shared information within that sector. While important and effective to 
do, it also stovepipes the fact that the attackers are using the same 
Tactics, Techniques, and Procedures (TTPs) against all sectors and 
allows them to effectively use the same tool to attack all sectors. 
Soltra breaks down the barriers to sharing by ultimately providing the 
``utility platform'' and enabling interchange of, information already 
in the STIX/TAXII format. We see this today with firms that are members 
of multiple ISAC/ISAO organizations and with ISACs that have sharing 
relationships with each other. Both of these act as cross-sector 
bridges since it is simple to share information. Friction is greatly 
reduced when using Soltra to connect organizations--the same standard 
format, communications method, and access controls are used to respond 
to the data-handling instructions driven from the Traffic Light 
Protocol markings of content.
         soltra and information sharing bring greater security
    Sharing information about threats remains essential as Mandiant 
reports\1\ that for 2015 the median number of days from compromise to 
discovery was 146 days. This improved from a median of 229 days from 
the 2014 Mandiant report,\2\ but is still an extensive window. The 47% 
of firms that detected a breach themselves took 56 days to discover the 
breach, but the 53% of firms notified by an external party had a median 
of 320 days from compromise to detection.
---------------------------------------------------------------------------
    \1\ https://www2.fireeye.com/rs/848-DID-242/images/Mtrends2016.pdf.
    \2\ http://dl.mandiant.com/EE/library/WP_M-Trends2014_140409.pdf.
---------------------------------------------------------------------------
    This is directly relevant to information sharing in two ways. 
First, the delta between the time of an internal and external 
notification are likely a symptom of poor access to information about 
threats or ability to act on that information. Second, information 
shared about threats may represent intrusion sets recently identified 
that had been in situ for a long time. We need to both increase the 
percentage of internally discovered breaches and shorten the time to 
detect them. Sharing CTI data is one such way these discoveries are 
made and timely sharing leads to timely discovery. Soltra is working to 
solve this problem by widening the access to CTI data and shortening 
the time to act on it over manual methods. It is hard to know with 
certainty why the industry improved the lag in compromise to discovery, 
but it is highly likely information sharing tipping defenders on what 
to look for was a part of the improvement.
    Third, there are some important lessons learned about the benefits 
of sharing information that, quite simply, will vary based upon the 
maturity of the institution participating in the program. However, a 
few things are universal:
    First, initially when a company receives CTI data, it is purely a 
consumer of that information. It might find that it has limited 
technical or operational capabilities to utilize some or all of the 
information in an effective way. For example, it may receive indicator 
information about malware on endpoint, but not have a capability to 
scan end points for such files. At that juncture, the company will 
begin to realize that it needs to better understand what is in the data 
to actually be able to utilize it. For example, understanding how to 
use information when the temporal context is of an intrusion 300 days 
ago is important. If it then looks for that activity from the moment 
the CTI is received, it could miss the event that precipitated the 
intrusion several hundred days earlier. If it was just recently 
reported, the original victim may have just identified it and that 
data, even if it is a year old, might be the clue needed to ascertain 
if the same incident had occurred in your infrastructure. As a company 
moves up the maturity curve, it also moves from primarily utilizing the 
telemetry which is represented by the CTIs and starts to utilize 
insights and contextual information to anticipate hazards down the 
road. Even in mature sectors the bulk of the activity is around the 
telemetry CTI data.
    As a company matures into using CTI data that was shared, it starts 
to realize that some data lacks sufficient context and may appear to be 
a false positive. This comes about between the very natural tension 
between sharing quickly when information is fresh, but could still be 
incomplete. This also occurs by the very nature of the investigative 
process that produces information and observations of activity that may 
have occurred during an attack but could be unrelated to the attacker's 
actions and are an artifact of normal IT system behavior. In order to 
address this, a company will want to have a method to ask the producing 
source to confirm details, or perhaps after its own research it will 
understand the context was lost or the CTI data is, in fact, 
inaccurate. A company will need to have a mechanism to share these 
results back to the producing source so they can adjust the content and 
send out a revision to the community.
    This is important to note because as a company builds information-
sharing products it will need to support a range of needs and maturity 
levels. It will also need to have the capability to receive feedback on 
existing products in addition to the ability to consume new submissions 
from the community. Finally, a company will also need to create methods 
to address the level of trust needed between members of a community as 
that community scales and the parties become more remote to each other.
                          cisa implementation
    It has only been 6 months since CISA was signed into law, and while 
there has been a rapid fire of activity in that time, more work 
certainly remains to be done. Guidance issued on how to submit 
information under CISA by DHS/DOJ adhered to the letter of the law and 
described private-to-Government sharing, but was silent on private-to-
private sharing. This created some confusion concerning the scope of 
liability or when protections might apply. As an example, the FS-ISAC 
had to send a memo to all its members to clarify that the protection in 
the law did apply to private-to-private communications within the FS-
ISAC membership. As recently as Thursday, June 9, 2016, DHS advised 
that CISA covers private-to-private sharing and that it would be 
included in the revised guidance required by Congress on June 15, 2016.
    Soltra is one of the handful of companies that already has enrolled 
to DHS's Automated Indicator Sharing (AIS) program. As required by law, 
in March 2016 DHS opened access to its AIS platform along with the 
procedural documents of how to submit data to comply with the 
requirement in the law related to personal information. DHS has been a 
helpful partner in this process, and as is normally the case in any 
program, there are a number of areas that would benefit from 
clarification at this juncture. They include:
    1. Additional guidance is needed from DHS on the definition of 
        Personally Identifiable Information (PII).--Thus far, the 
        definition of PII in the AIS submission guidance differs from 
        the definition of PII in other DHS programs and was not defined 
        in the Act. The vast majority of information sharing about 
        cyber threats does not involve any personal information, but 
        the lack of clarity as to which definition would be used for 
        personal information across DHS programs needs to be made 
        clear. The financial sector sent a letter on May 11, 2016 to 
        DHS and the U.S. Department of Justice (DOJ) asking for 
        clarification on this matter.
    2. Current ``Lessons Learned'' Using the AIS System: Streamline the 
        process for signing up for AIS.--To enroll in the AIS program 
        participants need to execute two agreements with DHS, enroll to 
        get an authentication certificate from an approved FedBRIDGE 
        provider, submit network address information, and technical 
        details of the sharing platform to be used.
     Digital Certificates.--The AIS process requires all users 
            to obtain a digital certificate from 1 of the 3 FedBRIDGE 
            providers which has become a cumbersome process. As 
            background, these certificates are traditionally issued to 
            individuals to support strong authentication and email 
            encryption whereas the use case for AIS is to authenticate 
            a machine used for sharing within a company. At this 
            juncture, the AIS system requires a single person within 
            the company to obtain the certificate which then has to be 
            loaded into the server to communicate with the AIS system. 
            That automated process actually requires paper 
            documentation that has to be sent to DHS via the U.S. mail 
            system. While the need for the authentication is critical, 
            there is an inherent disconnect between the ultimate goal 
            of the AIS system which is machine-to-machine. Going 
            forward, it would be more helpful for a system to be 
            created that allows for an organization level credential to 
            be issued to the server used by the company to participate 
            in the program. Other submission methods such as the web 
            form and fax do not have the same authentication 
            requirements.
     AIS Changes to STIX/TAXII Fields.--Various aspects of the 
            law as well as implementation have caused DHS to modify 
            aspects of the STIX/TAXII fields. AIS also includes a 
            series of ``required'' fields in STIX data submitted to the 
            department which if not included, will reject any attempted 
            submission from a company. It would be helpful for DHS to 
            specify those up-front in order to help companies 
            understand what needs to be done in advance of connecting 
            to the AIS system.
     Clarify how CISA protections apply to CISCP.--The AIS 
            program does not support submissions of Proprietary 
            Information (PROPIN) nor Protected Critical Infrastructure 
            Information (PCII) although DHS does indicate information 
            submitted under the CISCP program can receive protections 
            for PROPIN or PCII. Many companies are used to submitting 
            both PROPIN and PCII related information and it would be 
            critical to ensure that companies can continue to do so, 
            hopefully using the AIS system for sake of ease. DHS should 
            also issue guidance on how the CISCP program fits under 
            CISA to provide for greater clarifications.
     Add a Test Environment Where Companies Can Ensure Its AIS 
            Interface Works Effectively.--As is the case with many 
            systems, it is preferable to be able to test whether or not 
            a company's systems are interoperable with the AIS 
            platform. Short deadlines in the law required the AIS 
            system to be stood up quickly, and at this point, DHS does 
            not have a system integration or test environment 
            available. As a result, a company must attempt to work out 
            the various issues in a live production environment. Moving 
            forward, a test environment would be helpful for other 
            companies and may allow for greater participation and ease 
            of use in the future.
                     new data points to add to ais
    There are 3 main data points that the private sector would like to 
see added to the AIS system to help increase the effectiveness of the 
AIS system:
    1. Types of Threat Actors.--It would be exceptionally helpful if 
        the AIS data could include an assessment of the type of threat 
        actor behind the activity when that is known. It is clear that 
        there are practical challenges of ``naming names'' in an 
        Unclassified context. However, examples exist, including in the 
        2013 Defense Science Board report, ``Resilient Military Systems 
        and the Advanced Cyber Threat,''\3\ that includes a 6-tier 
        scale that would provide sufficient context to companies 
        without naming specific actors.
---------------------------------------------------------------------------
    \3\ http://www.acq.osd.mil/dsb/reports/
ResilientMilitarySystems.CyberThreat.pdf.
---------------------------------------------------------------------------
    2. Defensive Measures.--One of CISA's objectives was to support the 
        development of ``defensive measures.'' While more work will be 
        needed to get to that point, AIS could add in recommendations 
        to how recipients might use the AIS data sets. For example if a 
        set of AIS information was to include the suggested defensive 
        measure of ``block, mitigate, or monitor'' it would inform 
        consumers the best type of ``defensive measure'' to employee 
        even if detailed recommendations are unavailable. This would be 
        an important benefit to the AIS system that could bring a 
        greater number of participants into the system.
3. Feedback Loop and Context to Data
    Context is important for all companies who participate in the AIS 
program. As the AIS system continues to be fine-tuned, there are a 
number of issues that would be helpful to review and clarify which may 
increase greater connectivity and participation overall. As we know, 
the spectrum of possible participants will bring with them different 
skills, capabilities, and maturities so for those submitting to AIS the 
downstream recipients want to understand the context and credibility of 
the information from AIS. These types of questions are foundational 
issues that have come from the variety of sectors Soltra supports, 
including those that are participating in the AIS program or those who 
have indicated they intend to participate in the near future. In the 
near future, industry participants will want to be able to select the 
type of data they want to receive from AIS which could include sector-
specific or even cross-sector information. Levels of ``trust'' 
associated with the data will be important and industry participants 
will want to understand what process DHS will use if AIS members ask 
for more specific information from the AIS system, including the 
ability for DHS to reach back out to the original submitter of the 
data. Ultimately, DHS will need to be able to communicate how its 
internal process is set up to identify and vet the data submitted, a 
challenge that many ISACs have gone through themselves. The DHS 
guidance does mention a process that will be put in place to deal with 
false positives and mechanisms to address updating data and it will be 
critical that DHS provide clarity on that quickly.
cybersecurity information sharing and collaboration program (ciscp) and 
             private-sector security clearances under ciscp
    Many of Soltra's customers and community members participate in the 
CISCP program, which is widely viewed as a beneficial program that 
facilitates cross-sector engagement with government. It brings private-
sector and government analysts together at quarterly in-person 
meetings, the Advanced Technical Threat Exchanges (ATTE). CISCP also 
allows the private sector to work on the National Cybersecurity and 
Communications Integration Center (NCCIC) floor, giving participants 
access to DHS, LE, and IC analysts. We are seeing an increase in 
production around CISCP analysts turning FS-ISAC reports into CISCP 
Indicator Bulletins.
                 changes to security clearances needed
    Challenges continue to exist in obtaining security clearances for 
companies. First, post the cybersecurity attack on the Office of 
Personnel Management (OPM), clearance times are much longer.
    Second, it would be helpful if there was more transparency into the 
process with key performance metrics being available to Critical 
Infrastructure and Key Resources (CIKR) members or their ISACs. It 
should include monthly breakdowns by sector and clearance types of the 
number of new clearances requested, the number of investigation 
completed, the aging of applications by stage, the number of 
reinvestigations initiated/completed per month, as well as median times 
for each stage.
    Third, there have been a number of changes to the security 
clearance program that has caused a number of challenges to many 
companies, including those who have historically had individuals on the 
NCCIC floor. As background, private-sector companies have 2 routes to 
have essential personnel cleared for access to Classified Information. 
The first is the Private-Sector Clearance Program (PSCP) initiated via 
the sector-specific agency and sponsored/operated by DHS, and which 
holds clearances to the Secret level. The second route is by executing 
a Cooperative Research and Development Agreement (CRADA) with DHS. With 
a CRADA in place the firm needs to have a Facilities Clearance (FCL), 
which allows it to hold staff clearances up to Top Secret and have 
access to the NCCIC floor.
    A recent change that greatly impacted a number of ISACs was the 
requirement to have the FCL in place for their company. This was not a 
previously requirement of the CRADA process for CISCP as DHS rolled it 
out and was added at later date by the Defense Security Service (DSS.) 
A number of ISACs did not have FCLs current and therefore were removed 
from the NCCIC floor leaving no representation in the coordination 
process for those sectors. These ISACs do not have Classified work 
areas in their offices and were using the NCCIC floor for any handling 
of Classified materials. The requirements for obtaining the FCL are 
determined by the DSS. One attribute of this process is a requirement 
to clear top executives or board directors for companies. This program 
requirement made a lot of sense in the Defense Sector when the main 
objective of the FCL was managing contractors working on defense system 
projects. With the cybersecurity threat, the majority of the attack 
surface is in the private sector and many of the companies are 
multinationals with non-U.S. citizens on corporate boards or executive 
management, rendering the existing scheme less tailored for successful 
application to today's environment.
    The CISCP program with DHS requires a CRADA be in place for the 
receipt of Unclassified information such as Cyber Threat Indicators. As 
a direct result of the change requiring the FCL for the CISCP CRADA a 
number of financial sector firms are in the process of ending their 
CRADA with DHS and going back to using the PSCP program to avoid the 
entanglement of having top executives or board members without 
cybersecurity responsibilities having to hold clearances which are 
orthogonal to their duties for the company. Again this is to receive 
Unclassified information from the DHS CISCP program.
    The ISAC's that have an FCL will participate in CISCP via the CRADA 
and then be able to share Unclassified information from CISCP with 
their members. As a practical matter, when Classified information is 
shared with the private sector, this is done in a U.S. Government 
Facility with the appropriate FCL in place. It is unclear how ISACs 
that do not have the FCL will participate in the CISCP program going 
forward.
    In addition to the problems with the CRADA and FCL, the problems 
and frustration with the clearance processes remain.
                               next steps
    Implementation of the Cybersecurity Information Sharing Act is 
moving forward quickly and DHS, DOJ, and the Congress are to be 
commended for how quickly the AIS system has been stood up, and the 
various guidance documents issued on time. As with every system, there 
are lessons learned and items that can be improved, and we look forward 
to working closely with DHS and others to achieve our collective goal.
    Soltra and Soltra Edge are bringing cutting-edge innovation and 
technical capabilities to the cybersecurity information-sharing 
process. Soltra Edge is providing a simple and easy solution by 
providing the core backbone and technical processes that have 
previously prohibited many companies from sharing, thinking that the 
process is too cumbersome or difficult just to get started. Soltra is 
helping companies in all sectors to increase the ability and likelihood 
that information sharing can help provide vastly improved cybersecurity 
defenses and ultimately make it harder and more expensive for 
attackers. We look forward to working with this committee, Congress, 
and the Executive branch, as well as with all of our private-sector 
partners to achieve our collective goals.

    Mr. Ratcliffe. Thank you, Mr. Clancy.
    The Chair now recognizes Mr. Rosen, for 5 minutes.

STATEMENT OF MORDECAI ROSEN, GENERAL MANAGER, SECURITY BUSINESS 
                     UNIT, CA TECHNOLOGIES

    Mr. Rosen. Good morning, Chairman McCaul, Chairman 
Ratcliffe, Ranking Member Richmond, and Members of the 
subcommittee. Thank you for the opportunity to appear before 
you today.
    My name is Mordecai Rosen and I serve as the senior vice 
president and general manager of the Cybersecurity Business 
Unit at CA Technologies. CA is one of the largest enterprise 
software companies in the world. We serve a global customer 
base in nearly every major commercial and industrial sector. CA 
software helps our customers develop, manage and secure the 
systems and services that form the basis for the new 
application economy.
    I want to thank the committee for getting the cybersecurity 
act of 2015 over the finish line last year. CA was a strong 
supporter of the legislation and is encouraged by DHS's 
implementation thus far.
    I want to focus on two topics today. First, I plan to 
highlight why identity and access management are so important 
in protecting our infrastructure and establishing trust in the 
cybersecurity ecosystem. Second, I will provide our overall 
perspective on the act and its implementation.
    Applications have become the central way businesses connect 
with their customers. Identity is the new security perimeter 
for the application economy. In virtually every large network 
breach in recent memory, compromised identities were the common 
threat.
    CA believes that robust identity solutions covering both 
human-to-machine and machine-to-machine connections will be 
vital to protecting Government and commercial networks and 
applications. Identity solutions ensure that users, devices, 
and applications are who and what they say they are.
    I want to congratulate DHS for the job they have done to 
date on implementation. The legislation had very aggressive 
time lines to get the program up and running. DHS has met those 
deadlines and has worked collaboratively with their Government 
and industry partners to provide clarity around the overall 
program, and this should be commended.
    At the same time, there are specific areas where further 
clarification will help accelerate adoption. CA, like many 
organizations, is actively exploring participation in the DHS 
Automated Indicator Sharing program. While we have strong 
interest, we and others still have outstanding questions.
    First, organizations will need even greater clarity on 
targeted liability protection for the database, shared or 
received. Our hope is that the updated guidance, which I know 
has been released this morning, that DHS releases will answer 
outstanding questions. DHS will need to remain actively engaged 
with industry to help them fully understand these protections.
    Second, ensuring trust in the system and providing robust 
privacy protections will remain central to successful 
implementation and adoption. DHS must be able to effectively 
authenticate users that share or receive information under the 
program. For example, DHS must be able to confirm that a 
participant sharing information is a real entity, not a front 
for hackers.
    We are concerned that confidence in the program will lessen 
if participants cannot be authenticated and the data being 
shared cannot be trusted. Maintaining confidence in the act's 
privacy protections remain critical. DHS's initial guidance 
made strong privacy commitments, but participants will need 
even greater clarity. Stakeholder outreach and engagement 
through implementation will ensure that privacy considerations 
remain at the forefront.
    Third, we have to make it as easy as possible for 
organizations to participate. The uptake of automated, real-
time information exchanges that protect user privacy will 
define whether the act is a success, and the data received must 
be timely and actionable for the program to have maximum 
impact.
    We look forward to reviewing DHS's updated guidance and 
hope it will give us the certainty needed to become an active 
partner in the program.
    You asked CA to also address the Federal agency cyber 
provisions contained in Title II of the act. The EINSTEIN and 
Continuous Diagnostics and Mitigation, CDM, programs, when 
fully deployed will help Government agencies be more secure. CA 
has been an active participant in Phase 2 of CDM, which 
addresses identity and access issues with a significant focus 
on privileged users.
    Managing the rights of privileged users remains one of the 
most important areas of IT risk for organizations today. 
Improper actions by privileged users can have disastrous 
effects on IT operations and security. Privileged axis 
management solutions provide the visibility, monitoring, and 
control needed for users and accounts that have the keys to the 
kingdom.
    Deployment of CDM is at a critical stage. We have growing 
concerns that this deployment will be delayed, however, because 
agencies do not have the adequate contracting personnel to 
acquire the services from DHS. We recommend the committee keep 
a watchful eye on this issue as part of your oversight.
    Thank you for your focus on cyber threat information 
sharing. CA stands ready to continue our partnership with you, 
with DHS and with our industry colleagues to enhance trust and 
make it as easy as possible for organizations to participate.
    Thank you again for the opportunity to be here. I look 
forward to answering any of your questions.
    [The prepared statement of Mr. Rosen follows:]
                  Prepared Statement of Mordecai Rosen
                             June 15, 2016
    Chairman McCaul, Ranking Member Thompson and Members of the 
committee: Thank you for the opportunity to appear before you today. My 
name is Mordecai Rosen and I serve as senior vice president and general 
manager of the Security Business Unit at CA Technologies, where I 
manage global development of CA's cybersecurity products and solutions.
    CA is one of the largest enterprise software companies in the 
world, serving global customers in nearly every major commercial and 
industrial sector. We are headquartered in New York, and have 11,000 
employees across the globe, including many in districts represented on 
this committee. CA delivers software that is mission critical to the 
development, management, and security of technologies, which optimize 
business operations and enable digital transformation in what is being 
referred to as the ``application economy.''
    I intend to focus my remarks today on two important and related 
topics. First, I want to highlight some of the emergent and serious 
cybersecurity threats we see in the application economy. Second, I'll 
plan to provide CA's specific perspective on the Cybersecurity Act of 
2015--how it can be effectively implemented, and how we ultimately feel 
it can serve as a guidepost for reducing cyber risk in both Government 
and commercial systems.
                              introduction
    CA Technologies was a strong supporter of the Cybersecurity Act of 
2015 and is encouraged by the implementation thus far. Cyber threat 
information sharing helps us improve our collective cyber defenses by 
enabling us to prioritize and deploy resources against current and 
anticipated attacks. Improving Federal agency cybersecurity helps 
defend National security and protect citizen data. We want to thank the 
committee for your driving this legislation over the finish line last 
year.
    The application economy is transforming the way organizations do 
business. From entertainment to communications to finance, applications 
are rewriting the world in which we live, and are enabling 
organizations and governments to provide services to customers and 
citizens in new ways that reduce costs, enhance efficiencies, and 
improve outcomes. Software has become the principal means through which 
organizations deliver these new services. Examples of these 
technologies include mobile banking applications, the smart grid to 
reduce energy costs, and connected vehicle communications to improve 
safety and efficiency.
    Applications have become the critical point of engagement for 
organizations of all sizes, optimizing experiences and providing a 
direct and constant connection from organizations to their end-users. 
CA software transforms businesses' ability to thrive in this new 
reality, delivering the means to deploy, monitor, and secure their 
technology investments.
    However, the increasing volume and sophistication of cyber attacks 
threatens to undermine this progress through the illegal transfer of 
intellectual property, the theft of personally identifiable information 
(PII) and other sensitive data, and the undermining or destruction of 
critical infrastructure systems.
    Cyber attacks that disable systems, such as the electric grid, 
water utilities, financial markets, or even mass transit systems, could 
have a potentially catastrophic effect, putting the health and safety 
of large populations at risk. Federal agency breaches that result in 
the loss of sensitive data can lead to massive identify theft and 
fraud, and can put National security at risk.
    The Federal Government has suffered significant and harmful 
breaches over the past few years, most notably the Office of Personnel 
Management (OPM) breach that compromised the data of more than 20 
million current and former Government employees and contractors. Yet, 
the Government doesn't stand alone as a target for attack. The critical 
infrastructure community of the United States includes public and 
private operators of critical systems and assets, and they are all 
experiencing sophisticated attacks that carry with them the possibility 
of catastrophic outcomes. The German government recently said in a 
report that hackers successfully broke into the control systems of a 
domestic steel plant and caused massive damage to the blast furnace. 
Here in the United States, the Wall Street Journal recently reported 
that 2 years ago hackers infiltrated the control system of a small dam 
less than 20 miles from New York City.
    As the Federal Government and critical infrastructure owners and 
operators look to create efficiencies through automation and 
modernization, they must build security in to their systems on the 
front end and abandon the model of bolting security on afterwards.
        the role of identity protections in robust cybersecurity
    In this new threat environment, CA believes that identity and 
access management technologies are central to protecting systems, 
networks, devices, and data and to enabling secure interactions with 
customers and citizens. The traditional network perimeter can no longer 
provide a control mechanism for this access. Identities now constitute 
the new perimeter and are the single unifying control point across all 
apps, devices, data, and users. As such, identities and application 
programming interfaces (APIs) serve as the foundations of the 
application economy because they enable easier deployment of secure 
apps and help simplify control of access to those apps. They are how 
you protect access to apps and data, whether that be by human-to-
machine or machine-to-machine. APIs provide a way to connect computer 
software components and data. Broadly speaking, APIs make it possible 
for organizations to open their backend data and functionality for 
reuse in new application services (think hotel websites using Google or 
Bing for their maps and directions).
    An API achieves this by facilitating interactions between code 
modules, applications, and backend IT systems. The API specifies the 
way in which these different software components can interact with each 
other and enables content and data to be shared between components.
    Given these new realities, identity is now the attack vector of 
choice for cyber criminals. In virtually every large network breach in 
recent memory, compromised identities were the common thread. 
Protecting identities is foundational to robust security in the 
application economy.
    CA Technologies has made a strategic commitment to addressing 
identity-centric cybersecurity challenges in today's dynamic threat 
environment by developing effective identity management solutions 
through our in-house development process. CA software manages millions 
of user identities in most major countries around the world. We provide 
identity-centric security solutions to multiple Federal agencies. Our 
API Management tools are used within the Federal Government and the 
commercial sector to protect network and application interfaces, to 
facilitate the secure exchange of information, and to ensure that any 
data shared protects personal privacy. We believe all of these 
capabilities will further enable robust cyber threat information 
sharing. I'll touch more on this below.
 dhs implementation of cyber threat information sharing provisions in 
                         the cybersecurity act
    Congress passed the Cybersecurity Act of 2015 to help businesses 
and governments better protect themselves against cyber attacks. The 
Act promotes cybersecurity information sharing between the private 
sector and the Government, and across the private sector. In addition, 
the Act includes provisions to strengthen Federal agency cybersecurity 
through a Federal intrusion and detection system, through capabilities 
to continuously diagnose and mitigate cybersecurity risks, and through 
other measures.
    CA Technologies supported the passage of the Cybersecurity Act of 
2015 because it includes key provisions for which CA has been an active 
advocate: The bill includes targeted liability protections for program 
participants; it includes measures to protect the privacy of 
individuals; and it promotes the further development of automated 
mechanisms for sharing cyber threat indicators.
    CA Technologies believes the Cybersecurity Act will enhance 
security and provide businesses with the assurances needed to securely 
share with trusted partners the security threats they are seeing on 
their own networks, and to receive threat indicators from the wider 
ecosystem, which will help them optimize defenses. We believe the 
automated capabilities provided through the DHS Automated Indicator 
Sharing (AIS) program will make it easier to accept and exchange cyber 
threat data in real time. CA Technologies welcomes the opportunity to 
provide our insight on implementation to date, and to make 
recommendations to encourage greater participation in the information 
sharing program and to improve Federal agency cybersecurity.
    At the outset, I want to congratulate DHS for the job they've done 
thus far on implementation. The Cybersecurity Act of 2015 contained 
very aggressive time lines for DHS to release initial and final 
guidance to implement the program and to designate the primary system 
that would be used to exchange threat data between participants. DHS 
has met those deadlines thus far, and has worked collaboratively with 
their Government and industry partners to provide clarity around the 
overall requirements for sharing, the privacy protections and processes 
required to participate, and the process required to take full 
advantage of the program's benefits. We know how challenging it is to 
balance competing interests and meet very aggressive deadlines. While 
the initial guidance documents that DHS issued have raised some 
questions that we will address below, by and large we feel they provide 
good clarity on the technical, legal, and practical considerations 
entities need to weigh when determining whether to participate in the 
program.
    We are encouraged by DHS's openness to the feedback they have 
received from industry, civil society, and other actors in the 
cybersecurity ecosystem, and by DHS's consultative approach. DHS has 
indicated that they intend to address the majority of these questions 
in their final guidance documents. We look forward to reviewing those 
in detail when they are released later today.
    We are committed to working with DHS to move implementation forward 
with active and constructive industry dialogue. Among other 
organizations, CA Technologies is a member of the Information 
Technology Information Sharing and Analysis Center and sits on the 
Executive Committee of the IT Sector Coordinating Council, which helps 
advise DHS and other Federal agencies on information-sharing policies 
and public-private partnerships.
    I'd now like to turn to our views on specific provisions of the 
legislation and the issues we see at play and where some further 
clarity is needed in implementation.
Liability Protection
    Organizations should have targeted liability protection for the 
data they share or receive. This protection will encourage greater 
participation in the program, leading to better cyber defense. 
Liability and regulatory concerns are powerful inhibitors of 
participation in information sharing agreements. Reducing these 
barriers through targeted protections helps organizations feel more 
secure in sharing, receiving, and acting upon cyber threat indicators.
    The Cybersecurity Act included targeted liability protections, and 
DHS today is releasing updated guidance providing greater clarification 
on these protections and the requisite responsibilities of 
participating companies.
    Cybersecurity information sharing is based on trust, and this trust 
needs to be underpinned by strong certainty for participating 
companies. While the preliminary guidance released by DHS in February 
began to provide greater clarity around processes and procedures to 
gain protections, it also left a great deal of uncertainty. Our 
understanding is that the updated guidance should provide more clarity 
and we look forward to exploring this in greater depth. Beyond the 
release of the updated guidance, we encourage DHS to actively engage 
with industry and legal groups to help them better understand the 
information-sharing program, the responsibilities of participating 
organizations, and the liability protections that will be afforded 
participants.
Preserving Privacy
    The Cybersecurity Act of 2015 requires organizations to take 
reasonable steps to remove PII of individuals not related to the threat 
from any cyber threat information they share through the program. It 
also requires the Government to further scrub this information to 
ensure that PII is removed. This is vital to protect the privacy of 
customers and citizens.
    The global IT industry is very sensitive to issues of protecting 
customer privacy and enhancing trust in the solutions we deliver. 
Therefore, we believe it will be helpful for DHS and the administration 
to reassert that the purpose of cyber threat indicator information 
sharing is to protect networks.
    Any Government exceptions to this purpose must be clearly defined 
and limited. In addition, CA and others advocated strongly that 
cybersecurity threat indicator information should be shared through a 
civilian portal under the legislation. We want to thank the committee 
for pushing the National Cybersecurity and Communications Integration 
Center (NCCIC) at DHS as the portal for information sharing, and we 
encourage the administration to continue to promote this portal as the 
principal mechanism through which to share.
    While requirements to remove PII are important to protect privacy, 
it's also important to help organizations better understand how they 
can remove PII automatically. DHS's STIX/TAXII effort can help 
organizations understand what data to share, and how to share it, but 
companies will need further help to take the guesswork out of this 
process and automate the removal of PII before sharing. Myriad tools 
and capabilities exist in the commercial sector to enable automated PII 
removal. To the extent that organizations are able to effectively 
utilize these tools, it will lessen their concerns about liability and 
will heighten user confidence in the program.
    We feel that the initial guidance released by DHS made strong 
commitments towards preserving privacy under this program, though 
participants will need greater clarity. We look forward to reviewing 
the updated DHS guidance in this space. Again, active stakeholder 
outreach and engagement throughout the policy implementation process 
can help lead to effective outcomes that address both security and 
privacy needs. DHS can work with sector-specific agencies to convene 
workshops and other engagement activities where organizations can learn 
best practices on privacy protection as part of information-sharing 
programs. Ideally, these workshops and programs can target different 
types of industries and can take place in different regions of the 
country.
    DHS can also work to encourage greater participation in the 
information-sharing standards development process, established under 
the President's Executive Order from February 2015. The Standards 
Development Organization, led by the University of Texas at San Antonio 
in partnership with LMI, is currently developing draft standards for 
Information Sharing and Analysis Organizations (ISAOs). This work 
should be as open and inclusive as possible, enabling multiple types of 
organizations, including both nonprofit and for-profit organizations to 
establish ISAOs.
Automated Indicator Sharing
    Ultimately, in order to truly move the needle on improving cyber 
defenses in a significant way, organizations will need to leverage 
automated, real-time, actionable information exchanges. Cyber attacks 
happen rapidly and without up-front notice. Once cyber threat 
indicators are discovered, this information must also be disseminated 
rapidly to allow organizations that are the subject of attacks to 
mitigate their impacts, and to help other organizations target their 
defenses against the newly-discovered threat.
    DHS has been working to promote its Automated Information Sharing 
(AIS) program, which leverages explicit protocols to identify and 
structure information on cyber threat indicators and to provide for a 
secure manner of exchanging this information. CA Technologies has been 
working with DHS and other industry partners to help enable this 
secure, automated exchange of information across a wide range of 
different organizations.
    CA provides API management software that helps authenticate, 
authorize, validate, transform, and filter near-real-time cyber-threat 
messaging. We believe that any successful information sharing program 
must depend heavily on the authentication of the individuals and 
organizations that participate, and on the validity and integrity of 
the information and the data that is shared under the program.
    CA would like to thank the committee for promoting further 
development of automated information sharing mechanisms in the final 
legislation. While DHS's activity on automated sharing programs pre-
dates the passage of the Cybersecurity Act, the inclusion of this 
program in the Act should boost confidence and encourage greater 
participation.
    We recommend that DHS continue to leverage key outreach and 
partnership programs, such as the Critical Infrastructure Cyber 
Community or C3 program, and partnerships with Sector Coordinating 
Councils to build greater awareness around automated information 
sharing, and to help organizations understand what technical and 
procedural steps they will need to take to participate. Industry can 
also play a significant role to build awareness. Sector groups can 
develop user guidance and promote this with their members.
    In addition, we recommend that DHS and the Federal Government 
continue to promote the STIX/TAXII protocols with global standards 
development organizations. Ultimately, cybersecurity is a global 
challenge that doesn't recognize National borders. Global security 
solutions providers, including CA Technologies, seek to develop 
products that can scale for the global marketplace. The STIX/TAXII 
protocols are already commonly used to enable cyber threat information 
sharing across the Federal Government and in the private sector, and we 
hope that this progress can be leveraged to improve cybersecurity 
internationally. DHS's recent decision to transition continued 
development of the STIX standard to OASIS is a positive development 
that will build international engagement and consensus around the 
protocol.
    CA Technologies is not a current participant in the AIS system. Our 
internal security team currently utilizes multiple private-sector tools 
to identify, analyze, and prioritize cyber threat indicators. However, 
CA recognizes the significant benefits that we can derive from 
participation in information-sharing partnership programs in order to 
defend against cyber attacks. Therefore, we are actively exploring 
participation. We welcomed the passage of the Cybersecurity Act of 2015 
because of its authorization of activities and its calls for 
protections for participants. However, while we have strong interest, 
we are being very deliberate in making a determination on participation 
because we have outstanding questions associated with the program.
    First, will the information we receive through this program be 
timely, accessible, and actionable? Our security analysts must review 
and act on threat information from myriad sources in real time. 
Information shared through this program must help organizations to 
prevent, detect, or mitigate attacks. Therefore, information needs to 
be shared in an expedited fashion. Information has to be understandable 
for participants in the program. And participants need to be able to 
act on the information, whether that be mitigating against specific on-
going threats, or re-deploying defenses for anticipated attacks. We 
continue to examine how we would need integrate AIS threat indicators 
into our overall threat management processes.
    Second, how will DHS authenticate users who are receiving or 
sharing information in the program? Trust is vital to the success of 
information sharing and users must have confidence that the information 
they are sharing or receiving will not fall into the hands of 
adversaries and enable further attacks. Participants will want to know 
that the information they share will not be leveraged in a way that 
harms them. They will also want to know that the cyber threat indicator 
data they are acting on is valid. And, citizens and customers will want 
to know that participating businesses and the Government are doing 
everything they can to protect their privacy under this program. 
Therefore, identity and access management will play a crucial role in 
protecting the underlying information-sharing systems.
    And third, will there be greater clarification and guidance around 
liability and privacy protections in the program? This includes 
clarification around liability protections for the sharing of 
information with other private-sector organizations and for acting or 
not acting upon the receipt of indicators. It also includes greater 
clarification on privacy protection requirements.
    To reiterate, CA Technologies believes that DHS has done an 
admirable job of early-stage implementation of the information-sharing 
provisions of the Cybersecurity Act. CA looks forward to reviewing the 
updated guidance released by DHS today, which we hope will give us the 
certainty needed to become an active partner in AIS. We also encourage 
DHS to continue to conduct industry outreach, to help raise industry 
awareness of the programs, and to further provide clarification on 
associated liability and privacy protections.
    We look forward to working with DHS and the committee on continued 
successful implementation of these programs.
                 protecting federal information systems
    A significant number of recent Federal breaches resulted from 
compromised identities, including those of privileged users. Title II 
of the Cybersecurity Act recognized this issue and authorized solutions 
to more fully address the vulnerabilities in Government systems.
    The EINSTEIN and Continuous Diagnostics and Mitigation (CDM) 
programs, when fully deployed will help Government agencies acquire 
vital security capabilities and tools to better secure Government 
networks and systems.
    The EINSTEIN program is designed to detect and block cyber attacks 
from compromising Federal agencies, and to use threat information 
detected in one agency to help other Government agencies and the 
private sector to protect themselves.
    The CDM program provides Federal departments and agencies with 
capabilities and tools that identify cybersecurity risks on an on-going 
basis, prioritize these risks based upon potential impacts, and enable 
cybersecurity personnel to mitigate the most significant problems 
first. CA has been an active participant in the CDM implementation.
    While CDM Phase 1 focused on asset discovery and management, Phase 
2 is titled ``Least Privilege and Infrastructure Integrity'' and has 
prioritized both identity management and privileged access management. 
One of the most important areas of IT risk relates to privileged users. 
Whether inadvertent or malicious, improper actions by privileged users 
can have disastrous effects on IT operations and on the overall 
security and privacy of organizational assets and information. 
Therefore, it is essential that administrators be allowed to perform 
only those actions that are essential for their role-enabling ``least 
privileged access'' for reduced risk. Privileged Access Management 
solutions provide the visibility, monitoring, and control needed for 
those users and accounts that have the ``keys to the kingdom.'' This 
visibility provides insight on activity and works to prevent or flag 
anything unusual that indicates security risk.
    Both identity management and privileged access management 
positively affect operations, putting security activity in the 
background to make sure security is not seen as a barrier, but instead 
as an enabler to more secure business operations.
    CA would like to thank the committee for authorizing these programs 
under the Cybersecurity Act. In particular, we believe that legislative 
language calling on the head of each agency to assess access controls 
to sensitive and mission critical data will help protect against the 
threat of improper use of privileged credentials.
    Finally, on behalf of our IT industry partners, we would like to 
thank the committee for its help in conference negotiations to ensure 
that the EINSTEIN program would be designed to promote the security of 
Federal networks without jeopardizing multi-tenant cloud environments. 
In addition, we welcome continued committee oversight of DHS 
implementation to improve effectiveness and accountability.
    Overall, our primary recommendations in this space are the need for 
procurement flexibility and improvements in the workforce development 
process. Currently, Federal agencies recognize the value in deploying 
CDM solutions. However, they recognize that these deployments could be 
paid for by DHS in the following appropriations cycle. Agility and 
speed are very important in this context. Ultimately, a plan and a 
strategy are worthless without deployment. There is a distinct risk of 
a moral hazard where agencies will not prioritize cyber funding in the 
short term, leaving them susceptible to risk of a significant breach in 
the interim.
    Further, DHS partners with GSA on the development of contract 
vehicles for these programs, and there is a need for more trained 
contracting personnel to accelerate deployment of these new contract 
vehicles. We think this should be a key focus for implementation of 
Title III of the Cybersecurity Act.
    In the wake of the OPM breach, we saw Government officials working 
around the clock to improve systems. These are committed individuals, 
and the sense of urgency following the breach resulted in quick and 
decisive action to resolve significant challenges that became 
immediately apparent. However, the long-term success in implementing 
those decisions may be hamstrung by backlogs in the procurement 
process.
    Reacting to specific events to shore up defenses is different than 
proactive planning. As we look forward, we believe there is opportunity 
for DHS and its partner agencies to leverage the lessons learned in the 
cyber sprint and apply them proactively to enhance overall cyber 
posture across the Federal Government.
    I would mention two things in particular that we think warrant 
further consideration by this committee. First, we believe it is 
critical for the Federal Government to align its own cybersecurity 
practices with the NIST Cybersecurity Framework that is quickly 
becoming the standard for private-sector information security 
management efforts. Ensuring that the same approach is being used 
across the public and private sectors will standardize terminology and 
ensure that the Government is walking the walk when it comes to the 
approach evangelized in the Cybersecurity framework. We want to commend 
the committee for favorably reporting the ``Improving Small Business 
Cybersecurity Act of 2016'' last week. As this legislation moves 
forward in the House and ultimately, we hope, to enactment, we would 
recommend that an explicit requirement be included directing DHS and 
the Small Business Development Centers to also leverage the NIST 
Framework in maturing their cybersecurity programs.
    Second, we recommend the committee maintain focus on the unique 
cyber threats emanating from the compromise of digital identities. As 
we note above, the attack vector of choice in today's threat 
environment remains identity. CA believes that any conversations about 
cybersecurity threats and solutions must keep a strong focus on shoring 
up identity protections and enabling organizations to protect 
themselves from sophisticated identity-based attacks.
                               conclusion
    Cybersecurity represents a significant challenge for industry 
officials, and for State, National, and global policy makers. At the 
same time, the application economy is unlocking a multitude of 
opportunities to provide new services and value to customers and 
citizens. State, National, and global governments must work with 
private sector, academic, and public stakeholders to develop and 
implement cybersecurity policies that improve security, enable 
innovation, and build public trust.
    The Cybersecurity Act of 2015 recognizes the crucial role of 
public-private partnerships in enhancing cybersecurity by authorizing 
and promoting active cyber threat indicator information sharing across 
the private and public sectors. It also recognizes the National 
imperative to protect Federal information networks and systems.
    Ultimately, the success of this legislation will depend on 
stakeholder engagement, agility and inter-agency cooperation and buy-
in. CA believes that DHS has made great strides in partnering 
effectively with the private sector on the implementation of 
information-sharing provisions and we encourage DHS to continue to 
improve in this regard. The Title II provisions of this Act, in 
combination with last year's updates to the Federal Information 
Security Management Act, further enhance DHS's position to play the 
lead operational role in protecting Federal information civilian 
systems.
    CA Technologies applauds the efforts the committee has taken in 
tackling these key issues. We stand ready to continue partnering with 
the committee, DHS, and our industry colleagues in the effective 
implementation of the Cybersecurity Act of 2015.
    Thank you very much for the opportunity to testify today, and I 
look forward to answering any questions you may have.

    Mr. Ratcliffe. Thank you, Mr. Rosen.
    The Chair now recognizes Ms. Sage, for 5 minutes for her 
opening Statement.

 STATEMENT OF OLA SAGE, FOUNDER AND CHIEF EXECUTIVE OFFICER, E-
                           MANAGEMENT

    Ms. Sage. Good morning, Chairman Ratcliffe, Ranking Member 
Richmond, and distinguished Members of the committee. Thank you 
for the opportunity to testify this morning as a small-business 
owner of a 17-year-old tech firm on the Cybersecurity 
Information Sharing Act, CISA, and other information-sharing 
initiatives.
    Today I will discuss my company's experience, some 
perspectives on CISA and some final thoughts.
    In 2013, through our own research, we became aware of the 
DHS Enhanced Cybersecurity Services initiative, known as ECS, 
which is a voluntary information-sharing program that augments 
capabilities of critical infrastructure owners and operators by 
providing Classified cyber threat indicators to improve 
protection of their systems and customers.
    Following the execution of a memorandum of agreement with 
DHS, we experienced a significant hurdle. We knew ECS was a 
Classified program, and while we had a facility clearance, it 
was not at the level required to gain access to information 
needed to determine if we could participate in ECS. We spent 
weeks trying to locate a SCIF, or a Sensitive Compartmented 
Information Facility, that we could use just for a few hours to 
review the requirements to be an ECS partner. We eventually 
found a solution, but to our disappointment the financial 
barrier to entry was so high we determined that it would be 
cost-prohibitive.
    A year later, we entered into a Cooperative Research and 
Development Agreement, a CRADA, with DHS for an Unclassified 
program that allowed us to receive actionable Government-
developed cybersecurity threat information and maintain access 
to or have an on-site presence within the National 
Cybersecurity and Communications Integration Center.
    Our experience to date has been mixed. We do receive 
regular updates on threat information through the portal, which 
is very accessible. However, much of the Unclassified 
information is already widely available on the internet or is 
dated. We have ended up building our own TAXII server which 
provides communication specifications for exchanging cyber 
threat information through open sources.
    In 2015, DHS informed us of another new program called the 
Automated Indicator Sharing dissemination capability. While we 
are interested in participating, establishing the necessary 
operational capabilities has been constrained by our own 
limited resources.
    I would like to share 4 observations and a few thoughts on 
CISA and other information-sharing initiatives as it relates to 
small businesses like ours.
    No. 1, small businesses are unaware of CISA. We recognize 
the law is new, and though it applies to any size organization, 
today it is largely an interest of larger companies with 
greater infrastructure and resources.
    There is an opportunity for the Government to increase the 
visibility of the law through its existing outreach and 
awareness programs to the SMB community through, for example, 
SBA programs or by working with chambers of commerce, small-
business associations and trade groups.
    Second, small businesses need to understand how CISA helps 
them. In the law itself, there are only two references to small 
business, which highlights that this law is not directly 
focused on small businesses. How does CISA apply to SMBs in 
general? How does an SMB use CISA to help them better protect 
their business? What protocols would help facilitate and 
promote the sharing of cyber threat indicators within the SMB 
community?
    Answers to these and other questions would help clarify the 
law's applicability SMBs.
    Third, small businesses are confused by the myriad of 
information-sharing initiatives. The number and variety of 
information-sharing initiatives is overwhelming to many small 
businesses, if they are even aware they exist.
    For example, Enhanced Cybersecurity Services, the 
Cooperative Research and Development Agreement, the National 
Cybersecurity Communications Integration Center, Automated 
Indicator Sharing, the Information Sharing and Analysis Centers 
and the Information Sharing and Analysis Organizations are just 
a few that we can participate in. It would be very helpful if 
these initiatives could be streamlined and tailored to our 
community.
    Last, cybersecurity is costly for small businesses. Some 
industry estimates suggest costs of up to $60,000 a year for a 
50-employee company, and it is not clear to many what the 
concrete benefits are of investing those kind of dollars in 
cybersecurity. As information-sharing is voluntary under CISA, 
the key driver for a small-business CEO like myself to consider 
participation is the cost to implement.
    A significant percentage of small-business owners still do 
not believe that they have anything that criminals want. It 
would be helpful if there could be an estimate of what it would 
cost a small business to participate in various information-
sharing forums, similar to the time estimates that are provided 
for completing Government forms.
    In closing, CISA is in its early stages and we recognize 
that over time the implementation of the law will mature, 
providing more clarity for its application, in particular for 
small businesses. I remain committed to working with Government 
and industry partners to identify and promote affordable 
solutions that enable small businesses like ours to strengthen 
their cybersecurity readiness and posture.
    Thank you again for the opportunity to testify and I am 
ready to answer any questions you may have.
    [The prepared statement of Ms. Sage follows:]
                     Prepared Statement of Ola Sage
                             June 15, 2016
                            opening remarks
    Good morning Chairman Ratcliffe, Ranking Member Richmond, and 
distinguished Members of the committee. It is an honor for me to be 
here today.
    My name is Ola Sage and I am the founder and CEO of two technology 
small businesses, e-Management and CyberRx, located in Silver Spring, 
Maryland. e-Management was founded in 1999 and employs nearly 70 
information technology (IT) and cybersecurity professionals who deliver 
services in our core areas of IT Planning, Engineering, Application 
Development, and Cybersecurity. In 2013 e-Management was honored to 
receive the Department of Energy's Cybersecurity Innovative Technical 
Achievement Award, highlighting the capabilities of our cybersecurity 
experts in designing and implementing advanced cybersecurity detection 
and risk management capabilities. Earlier this year the U.S. Chamber of 
Commerce selected e-Management as one of the top 100 small businesses 
in America in 2016.
    CyberRx, my second company, was launched in 2015 and offers a 
software platform that private-sector companies, and small businesses 
in particular, use to help them measure, manage, and improve their 
cybersecurity readiness. Our software allows companies to quickly 
assess their cyber readiness and resilience using a unique application 
of the Cybersecurity Framework (CSF), which was developed 
collaboratively with the National Institute of Standards and Technology 
(NIST), academia, and industry. CyberRx is both vendor-agnostic and 
affordable, as we believe cybersecurity should be manageable and 
accessible to all organizations, particularly the most vulnerable 
small- and medium-sized businesses (SMBs).
    In April of this year, I was elected to serve as the chair of the 
IT Sector Coordinating Council (IT SCC). The IT SCC comprises the 
Nation's top IT companies, professional services firms, and trade 
associations, and works in partnership with the Department of Homeland 
Security (DHS) to address strategies for mitigating cybersecurity 
threats and risks to our Nation's critical infrastructure, especially 
for organizations and businesses that are particularly vulnerable, such 
as SMBs. One of the joint priorities this year with the IT SCC and DHS 
is to provide the SMB community with best practices and products for 
implementing the CSF to better protect businesses and manage risk.
    I am also a 9-year member of Vistage, an international organization 
of more than 20,000 CEOs who control businesses that have annual sales 
ranging from $1 million to more than $1 billion. I regularly meet with 
and speak to small business CEOs in Vistage and other small business 
forums about why cybersecurity should matter to them and how it can 
affect their ability to keep business, stay in business, or get new 
business. Over the last 12 months alone, I have spoken to more than 200 
SMB CEOs in a diverse mix of industries. I am a champion and advocate 
for SMB cybersecurity readiness.
    Thank you for the opportunity to testify today as a small business 
owner.
    In my testimony today, I will discuss:
   My company's experience with various Government information-
        sharing initiatives
   Perspectives on the Cybersecurity Information Sharing Act 
        (CISA), and opportunities for the SMB community
   Concluding thoughts.
       experience with government information-sharing initiatives
    As an IT and cybersecurity small business provider, maintaining our 
competitiveness requires us to constantly add value to our clients by 
offering them the best combination of new products and services. In 
2013, through our own research we became aware of the Enhanced 
Cybersecurity Services (ECS) program at DHS. ECS is a voluntary 
information-sharing program that augments capabilities of critical 
infrastructure owners and operators by providing Classified cyber 
threat ``indicators'' to improve protection of their systems and their 
customers. We reached out to learn more and were invited to establish a 
Memorandum of Agreement (MOA) to govern the Government's provision and 
e-Management's receipt and use of information and ECS-related 
activities.
    Following the execution of the MOA, we experienced our first 
hurdle. We knew ECS was a Classified program and while we had a 
facility clearance, it was not at the level required to gain access to 
information needed to determine if we could participate in ECS. We 
spent weeks trying to locate a Sensitive Compartmented Information 
Facility (SCIF) that we could use just for a few hours to review the 
requirements to be an ECS partner. We reached out to various Government 
contractors whom we knew either had a SCIF or access to one, but were 
turned down time after time. We eventually found a solution that 
enabled us to review the requirements, but to our disappointment, the 
financial barrier to entry was so high, we determined that it would be 
cost-prohibitive for us to participate.
    A year later, in 2014, we entered into a Cooperative Research and 
Development Agreement (CRADA) with DHS for an Unclassified program that 
allowed DHS and e-Management to engage in data flow and analytical 
collaboration activities, including receiving relevant, Unclassified, 
and actionable Government-developed cybersecurity threat information. 
Through the CRADA, e-Management was also permitted to maintain access 
to or have an on-site presence within the National Cybersecurity and 
Communications Integration Center (NCCIC).
    Our experience with the CRADA has been mixed. We do receive regular 
updates on threat information through the portal, which is very 
accessible; However, much of the Unclassified information received is 
already widely available on the internet or is dated, and therefore has 
limited use for our cybersecurity analysts or our clients. We ended up 
building our own Trusted Automated eXchange of Indicator Information 
(TAXII) server, pulling from open sources to collect threat information 
that we could use to better protect our company.
    In 2015, we were informed of a new initiative called the Automated 
Indicator Sharing Initiative Dissemination Capability, which could 
enable us to participate in the dissemination of cyber threat 
indicators under the DHS Automated Indicator Sharing (AIS) Initiative 
TAXII server, in addition to the existing portal means provided through 
our CRADA. While we have an in interest in participating, establishing 
the necessary operational capabilities is constrained by limited 
resources.
an smb ceo's perspective on opportunities for the cisa and information-
                sharing initiatives for small businesses
    The Cybersecurity Act of 2015 provides a way for the Government and 
the private sector to collaborate on cybersecurity while providing the 
necessary protections to alleviate the concerns of many companies, 
large or small, that they may be exposed to civil or criminal 
liability, reputational damage, or competitive threats. Some 
observations about the law, other information sharing initiatives, and 
some recommendations for how CISA can be more relevant to the SMB 
community, are as follows.
    1. Small businesses are unaware of CISA.--CISA is new and though it 
        applies to any size organization, today it is largely an 
        interest of larger companies that have the infrastructure and 
        resources to act. There is an opportunity for the Government to 
        increase the visibility of the law through its existing 
        outreach and awareness programs to the SMB community through, 
        for example, Small Business Administration (SBA) programs, or 
        by working with Chambers of Commerce, small business 
        associations, and trade groups.
    2. Small businesses need to understand how CISA helps them.--In the 
        law itself, there are only 2 references to small business, 
        which highlights that this law is not directly focused on small 
        businesses. How does CISA apply to SMBs in general? How does an 
        SMB use CISA to help them better protect their business? Is 
        CISA more applicable to certain types of small businesses? What 
        protocols would help facilitate and promote the sharing of 
        cyber threat indicators with the SBM community? Answers to 
        these and other questions would help clarify the law's 
        applicability to SMBs.
    3. Small businesses are confused by the myriad of information-
        sharing initiatives.--The number and variety of information-
        sharing initiatives is overwhelming to many small businesses, 
        if they are even aware they exist. For example, Enhanced 
        Cybersecurity Services, the Cooperative Research and 
        Development Agreement, the National Cybersecurity and 
        Communications Integration Center, Automated Indicator Sharing, 
        the Information Sharing and Analysis Centers, and/or the 
        Information Sharing and Analysis Organizations, are just a few 
        of the information-sharing initiatives companies can 
        participate in. It would be helpful to the SMB community if 
        these initiatives could be streamlined and tailored for the SMB 
        community.
    4. Cybersecurity is costly for small businesses.--Implementing 
        cybersecurity best practices and solutions is costly for many 
        small businesses. Some industry estimates suggest costs of up 
        to $60,000 a year for a 50-employee company, and it is not 
        clear to many what the concrete benefits are of investing those 
        kinds of dollars in cybersecurity. As information sharing is 
        voluntary under the law, the key driver for a small business 
        CEO to consider participation will be the cost to implement. 
        There is still a significant percentage of small businesses 
        owners who do not believe that they have anything that 
        criminals would want. It would be helpful if there could be an 
        estimate, on average, of what it would cost a small business to 
        participate in the information-sharing forum (e.g., similar to 
        the time estimates that are provided for completing Government 
        forms).
                               conclusion
    CISA is in its early stages and we recognize that over time the 
implementation of the law will mature providing more clarity for its 
application, particularly for SMBs. We at e-Management and CyberRx are 
committed to working with Government and industry to identify and 
promote affordable solutions that enable small businesses to strengthen 
their cybersecurity readiness and posture.
    Thank you again for the opportunity to testify. I am ready to 
answer any questions you may have.

    Mr. Ratcliffe. Thank you, Ms. Sage.
    Thanks to all the witness for your testimony.
    I now recognize myself, for 5 minutes, for questions.
    I will start by saying that after receiving today's hearing 
testimony, I want to try and make one thing clear, and that is 
that this subcommittee will try to do everything that we can to 
ensure that the final DHS and DOJ information-sharing guidance 
explicitly states and clarifies that the Cybersecurity Act's 
liability protections are in fact extended for sharing between 
non-Federal entities.
    I would in fact like it noted for the record that it was 
Congress' full intent to grant private-to-private liability 
protections when such sharing was conducted in accordance with 
the law.
    Having said that, I know that the Department of Homeland 
Security and Department of Justice this morning issued final 
guidance. I don't know if our witnesses have had an opportunity 
to review that, so I am not going to put any of you on the 
spot. But I would like to give you the opportunity to address 
this issue and how a lack of clarity in liability protection 
might cause general counsels in some private companies to 
prohibit their cyber operators from sharing information.
    I will start with you, Mr. Eggers.
    Mr. Eggers. Thank you, Mr. Chairman.
    I think, at least in terms of the interim guidance and 
procedures documents that we have been reviewing since 
February, our members view them as very good. I haven't had a 
chance to look through the latest documents that were just 
released, I think, over the evening. We'll do that. My 
impression, but we'll wait to see what the language states, is 
DHS and DOJ have tried to clarify, per the law, that the 
protections attach when non-Federal entities or private 
organizations or even State and local governments share between 
themselves and among themselves.
    I think just kind of taking a step back, organizations are 
able to enter into the CISA and the AIS program when they are 
sharing threat data for a cybersecurity purpose, right, and 
they are doing other things, such as monitoring, sharing, 
receiving indicators and defensive measures.
    Irrespective of the size of an organization, those 
protections and I should say the authorizations and the 
protections should attach.
    Mr. Ratcliffe. Thank you, Mr. Eggers.
    Mr. Mayer, I want to give you an opportunity.
    Mr. Mayer. Sure. Sure. Thank you.
    Real quickly, I also haven't had an opportunity to read the 
guidance. I think this has its roots in perhaps some comments 
that came out of DHS at one point suggesting that there was 
some uncertainty or ambiguity around this issue. We had always 
felt that reading the statute that private-to-private sharing 
was permitted.
    So I would say that, since some uncertainty was introduced, 
resolving that explicitly, as you did just now and as I am sure 
the guidance states, will only be helpful in terms of us being 
able to take advantage of the program. Thank you.
    Mr. Ratcliffe. Great. Thank you, Mr. Mayer.
    Mr. Clancy, anything you would like to comment on?
    Mr. Clancy. Just to add, I think to, you know, build on the 
comments of the earlier panelists, I would just say that the 
place where the confusion was the greatest was in the ISAC 
community when sharing between a member to the ISAC to a 
member.
    The ISACs themselves went and did their own legal reviews, 
got legal opinions and started to clarify that issue on their 
own. I think just reinforcing it by your statements and the 
additional clarified guidance from DHS and DOJ can help us move 
past this issue.
    Mr. Ratcliffe. Thank you, Mr. Clancy.
    Mr. Rosen.
    Mr. Rosen. Yes, I think we primarily agree with what has 
been said down the line. We understand the existing liability 
we have today with sharing threat information, sharing breach 
information. We just want to make sure, and we will hopefully 
find it in the additional guidance, that we are not increasing 
our liability for either good-faith acts or lack of action 
based on some cybersecurity indicator.
    So I think that kind-of is the most important clarity for 
us.
    Mr. Ratcliffe. Terrific. Thank you.
    Ms. Sage, anything you would like to add?
    Ms. Sage. I haven't read it. Sorry, Mr. Chairman.
    Mr. Ratcliffe. No, that's fine.
    Ms. Sage. Happy to get back to you.
    Mr. Ratcliffe. On March 17, I was at the NCCIC to witness 
the certification to Congress that the Automated Information 
Sharing program, or AIS, was operational.
    Mr. Clancy, you are the CEO of Soltra, which I understand 
is currently going through the process of connecting with DHS's 
AIS system, could you talk a little bit about how that process 
is going so far? What are the next big milestones for the AIS 
program going forward, as you see it?
    Mr. Clancy. Thanks for the question.
    So yes, we have been enrolled in the program. We have been 
doing I will call it the technical integration side of the 
story. As with any new technical capability, there are those 
normal, you know, bumps in the road as you get going. We have 
been working through them and the Department's been pretty 
responsive in addressing them.
    As I mentioned in my testimony, there are some challenges 
in the on-boarding, the process by which you get credentialed. 
To go to Mr. Rosen's comment, I think the challenge is 
establishing identity of the participants and the process that 
was used, vis-a-vis how it interacts with machine-to-machine 
sharing.
    We believe that the other challenge was the customizations 
that were made and quite necessary for submitters of 
information to mark how they wanted their identity to be 
handled. So did they want comments attributed to them, to 
everyone in the program, to only U.S. Government or to no one 
outside of the NCCIC? That just takes time for the platforms 
and the implementers to absorb. So I think that's moving 
forward, I think it is in the right direction, but it had a 
little bit of latency for everyone getting started.
    Mr. Ratcliffe. Thank you, Mr. Clancy.
    The Chair now recognizes the Ranking Minority Member of the 
subcommittee, the gentleman from Louisiana, Mr. Richmond, for 
any statement that he may offer or any questions he may have.
    Mr. Richmond. Mr. Chairman. I would ask unanimous consent 
to submit for the record the DHS and Department of Justice 
document released this morning entitled Guidance to Assist Non-
Federal Entities to Share Cyber Threat Indicators and Defensive 
Measures with Federal Entities Under the Cybersecurity 
Information Sharing Act.
    Mr. Ratcliffe. Without objection.*
---------------------------------------------------------------------------
    * The document has been retained in committee files.
---------------------------------------------------------------------------
    Mr. Richmond. Thank you.
    Let me start, I think, Ms. Sage, where you kind-of touched. 
The act requires periodic circulation of cybersecurity best 
practices, paying special attention to the needs of small 
businesses. When this guidance is published, presumably 
probably early next year, what would you like to see in it? I 
would take from your testimony that you mentioned, like, cost 
estimates and others, but anything else you would like 
specifically to see in it?
    Ms. Sage. Some degree of prioritization. Where should we 
start? Where are the areas that have the most impact to a small 
business like ours would also be helpful.
    Mr. Richmond. Thank you.
    Well, to Mr. Clancy, do you see potential conflicts between 
the FCC's proposed privacy rules for ISPs and the monitoring 
and information sharing authorized under the Cybersecurity Act?
    Mr. Clancy. I think that question might be better for Mr. 
Mayer, but I can certainly see any ambiguity in what the 
definition will add uncertainty and will chill the ability for 
people to share information.
    Mr. Richmond. Mr. Mayer.
    Mr. Mayer. Thank you, sir.
    As I indicated in my opening remarks, I think that any time 
you introduce a level of uncertainty into this process, the 
lawyers are going to be inclined to want to be very prudent and 
careful.
    What the FCC has done, well, let me correct that, what the 
FCC may do, because it is a proposed rulemaking, is they may 
have a standard in there that talks about being reasonably 
necessary versus the standard that is in the Act, which is that 
there has to be knowing that the information was not consistent 
with a cybersecurity purpose.
    So what that means for us is that we understand what the 
bar is for knowing, we can understand what it is for gross 
negligence and willful misconduct. But when you are talking 
whenever it is reasonable, reasonably necessarily, we don't 
know if that means you should have known if you didn't know. We 
don't know where the determination is going to be made after 
the fact as to what our instructions are, what the rules will 
require.
    That is going to require probably another layer of legal 
scanning and review on the part of our attorneys. That really 
is very much inconsistent with what you are trying to 
accomplish with respect to real-time information sharing. So I 
am confident that we can work with the FCC and explain how that 
provision could complicate what was intended through this 
legislation.
    Mr. Richmond. Thank you.
    Well, in the lead-up to the Cybersecurity Act we passed, 
industry told us consistently over and over again that 
information sharing, the fear for participating was exposing 
oneself to legal liability.
    In fact, Mr. Eggers, you specifically testified about a 
year ago to urge legislation granting businesses a safe harbor 
from frivolous lawsuits, public disclosure, regulatory and 
antitrust actions.
    Ultimately, we passed that law. However, we talked with DHS 
this morning, and only about 30 entities are actually 
participating on a day-to-day basis. Some say a hundred have 
signed up, but only 30 have skin in the game. Would you say 
that the private sector is holding up its end of the bargain?
    Mr. Eggers. No, sir, I think that we've seen, as I noted in 
my opening testimony, we've kind of got two bookends. We've got 
companies that can't share enough and get enough cyber threat 
data. There are a lot of leading companies in this space that 
have been sharing and receiving data without protections for 
several years.
    In that middle, I think, and the final guidelines just came 
out, so I think it is too soon to make a definitive judgment, 
but we are very optimistic.
    On the other hand, we still have companies, as I noted I 
was at a DHS C3 event in Indianapolis, we still got companies 
who have, I think, pictures in their head of regulators lying 
in wait or consumer privacy groups writing lawsuits. That is 
the picture in their head. We don't think that that is 
completely accurate.
    What we think is going to happen is the new protections, 
whether they are liability, regulatory, antitrust or public 
disclosure, are going to help those leading companies, right, 
and those folks who are part of ISAOs and ISACs now, or soon 
will be, do more confidently. Then I think over time and to the 
point about small businesses, I hope that what we will see is 
that we won't necessarily have to put a large burden on the 
smaller and under-resourced organizations.
    There will be some kind of technologies, and I think they 
already exist, that can be put on networks and systems that can 
generate and swap threat indicators at real time. Those 
companies and that companies that help those organizations will 
enjoy those protections, too.
    I also understand that there are about 30 companies that 
are directly plugged into the AIS system with about a hundred 
companies signed up. I expect that that number will grow as 
folks interpret the guidance and he ISAOs are created as we go 
forward.
    Mr. Richmond. Thank you, Mr. Chairman. I yield back.
    Mr. Ratcliffe. Thank the Ranking Member.
    The Chair now recognizes the gentlemen from Pennsylvania, 
Mr. Perry.
    Mr. Perry. Thank you, Mr. Chairman.
    Ms. Sage, over here. In your opinion if you can, do you see 
the Federal Government's responsibility regarding vulnerability 
disclosure as a component of information-sharing process? Do 
you see the current level of vulnerability disclosures are 
strengthening your defensive posture, if that makes sense to 
you, if I have stated that correctly?
    Ms. Sage. If I understand the question, do I believe that 
the level of vulnerability information that we are receiving 
from the Federal Government is helping our companies?
    Mr. Perry. Essentially, correct.
    Ms. Sage. I would say probably, but there are just so many 
places to get it and it's overwhelming. We are not sure if we 
are getting the right information.
    I welcome, you know, Matt Eggers' comment over there. If at 
some point this kind of information could be built into tools 
that we already use so that we are not having to go to all 
these different places to get it, that would be a very welcome 
development.
    Mr. Perry. OK. So somewhat of a consolidation and indexing 
if it so you know what is current and that you have the 
complete panoply of everything available at one place, you are 
not wondering if you are missing something.
    Ms. Sage. Correct.
    Mr. Perry. All right.
    Ms. Sage. To the comment of the AIS program, I mean, we 
were as I mentioned in my testimony, interested in 
participating, but in order to participate you have to have 
your own TAXII server.
    Mr. Perry. Right.
    Ms. Sage. So for a small business to invest in that, you 
know, it just adds to the cost.
    Mr. Perry. Right. Yes, I am not sure as to how you get 
there quite honestly.
    Ms. Sage. Right.
    Mr. Perry. But I appreciate the comment. Yes, I think it 
highlights an interesting aspect that maybe was not considered 
fully for sure.
    Mr. Eggers. Congressman Perry, if I may just offer up a 
thought?
    Mr. Perry. Sure.
    Mr. Eggers. I think what we are going to here is, I think 
we are going to have a situation where kind-of the vanguard of 
companies in ISACs and ISAOs are going to start moving out a 
lot more confidently and swiftly.
    We've had really good discussions with policy makers and 
DHS, other Government bodies. I think we are really working 
together better than ever, at least in this space. But I do 
think that it is really tough for a small business who doesn't 
have paid professionals necessarily to do these kinds of things 
to expect them to have either the capital or the----
    Mr. Perry. Technical.
    Mr. Eggers [continuing]. The technical talent. So what we 
want to end up doing is we are going to innovate our way to 
where technology will help those small businesses keep doing 
what they are doing, whether they are inventing new drugs or 
what have you. That technology will let them generate and 
receive threat data, and perhaps even kind-of heal, if you 
will, their networks and systems at real-time speeds. We are 
not there, but I think we will get there at some point.
    Mr. Perry. Yes, I appreciate that. As a former small-
business owner myself, when I listen to this, I don't see how 
you get from point A to point B at the current position that we 
are. I think it is just exceptionally difficult.
    Mr. Rosen. Can I add one comment to the discussion?
    Mr. Perry. Sure.
    Mr. Rosen. So, we are a large business, $4 billion a year, 
11,000 employees. Part of our analysis of AIS is the 
operational side.
    So our organization is analyzing how it fits into our 
threat intelligence analytics engine, whether it is duplicate, 
whether it adds value, whether we can handle the feed, whether 
it adds . . . So that's us at $4 billion a year, 11,000 people, 
so I think that will give you some nature of what----
    Mr. Perry. Yes, so it is not just small business. I was 
going to ask you a question, Mr. Rosen, regarding the requisite 
tech refresh needed to ensure Federal networks. Do you think 
that they have the hardware or the software in network defense? 
I mean, do you get that sense now or do you think that they are 
lacking there?
    Mr. Rosen. I think they have made great progress since the 
cyber sprint last year, but it wasn't starting from a fantastic 
place to begin with.
    Mr. Perry. There is a new term right there, cyber sprint, I 
like that as well, at least new to me.
    Mr. Rosen. But the one thing I can suggest, is that in this 
Act and what DHS is doing, you have described the strategy and 
you have come up with the plan and you have come up with the 
metrics to measure it, but there is no security without 
deployment. That is where I think the focus has to wind up 
being.
    We saw under emergency situations post-OPM breach, and CA 
was involved in the DHS cyber sprint where we were aggressively 
implementing PIV authentication and privilege access management 
throughout all the components, we operate very well when 
friction is reduced, and then you wind up having deployment and 
you have made genuine progress to securing the Nation. It's 
that gap, it's operationalizing the plan that I think has to 
wind up being the focus of whatever stumbling blocks there are 
in the way. You know, if they are acquisition-related, if they 
are technology-related.
    I think the one thing you did a very good job of in the Act 
is not dictating technology. I think that was a really good 
thing. But I think that any focus that can help reduce the 
friction to deployment, how do we take that unbelievably 
effective sprint, and everybody pays attention to a sprint, the 
100-yard dash, and how do we apply that to the marathon, which 
is our job, and divide it up in a way so people pay attention, 
friction is reduced and we can actually deploy? That's my 
recommendation.
    Mr. Perry. Thank you, Mr. Chairman. I yield.
    Mr. Ratcliffe. Thank the gentleman.
    The Chair now recognizes the gentlelady from California, 
Ms. Sanchez.
    Ms. Sanchez. Thank you, Mr. Chairman.
    Well, as usual, we are at a spot where it's just all so 
overwhelming. I know so many of us on this committee have been 
working on this for such a long time.
    I am worried about every aspect of business, large 
businesses, medium-sized businesses, technology companies, you 
know, we have only to look at the whole issue of Estonia a few 
years ago to understand that every business that uses IT can be 
hit. Whether it is just a threat of just taking your business 
off-line for a week while you are trying to figure it all out, 
or whether it's an imminent threat of taking all moneys out of 
everything, we are all concerned.
    So I want to go back to the small-business issue because I 
think there is a lot of help with the larger companies. We deal 
with them all the time. We look at the banking industry, we 
have robustness et cetera.
    Ms. Sage, I was very discouraged, quite frankly, after your 
frank and to-the-point testimony that you put forward. For a 
small business that is actually plugged in and aware in trying 
to work with the Department of Homeland Security programs, but 
can't leverage so many of those offerings unless you go through 
an established ISAC or a Sector Coordinating Council or any of 
the other layers that you mentioned in your testimony.
    So a small-business owner who also happens to be the 
sitting chair of the IT-ISAC and to not meaningfully get access 
to how we are trying to help from the Department, I can't 
imagine what other smaller business are facing. I mean, they 
are throwing their hands up and saying I can't do this.
    So is a small business best served by going through an 
ISAC? Is there a value proposition being offered from DHS to 
help small businesses? Can you from your interaction tell me 
what are the benefits of what we put in place under the cyber 
act and what are the biggest hurdles from your perspective for 
a small business?
    Ms. Sage. Thank you, Congresswoman. I didn't intend to make 
you depressed, so my apologies for that.
    Ms. Sanchez. You know, I used to own a small business. So 
the biggest thing people need to understand about small-
business owners is that they get some letter from the 
Government or something through the mail and fear strikes you, 
right? You didn't put somebody's tax moneys in the right way, 
you messed up on some IRA for your employees and there are 
penalties and the nasty letters. So, you know, in an effort to 
try to help people to actually secure their businesses and 
their information, it's really disappointing to have seen your 
testimony.
    I love that you are frank, but what can we do?
    Ms. Sage. Well, you know, in our world it is all about 
simplification. Keep it simple.
    So while it's great to have all of these choices, you know, 
cybersecurity, and I am speaking as a small business, you know, 
I have run my company for 17 years, we're about customers and 
growing our businesses, but we have so many different 
challenges that cybersecurity right now is just the latest one. 
Right? So whether, you know, we are worrying about payroll, we 
are worrying about employees as you know, and so we have now 
this huge thing, cybersecurity, that we are being told is going 
to wipe us out.
    You know, Chairman Ratcliffe mentioned in his opening 
statements, there are two kinds of companies, the ones that 
have been hacked, the ones that don't know that they have. So 
there are lot of small businesses that I interact with who 
basically say if that is the case, why do I need to spend any 
more money? Because if we are already hacked and we just don't 
know it, why do I need to spend?
    So I just think that, you know, I applaud what, you know, 
DHS and NIST, for example, did with the cybersecurity 
framework, the C3 program which I participated in some of their 
session and found the information very valuable. But I think, 
you know, and as you mentioned, I am one who is actually trying 
to get ahead of this. A lot of it is time. We just don't have 
the time to attend all of these different----
    Ms. Sanchez. The resources, you don't have the personnel to 
put----
    Ms. Sage. Exactly. So I just go back to my point at the 
top, if there is a way to streamline, simplify, and prioritize 
these initiatives, I think that would be helpful.
    Ms. Sanchez. Mr. Chairman, I didn't get to my second 
question, but maybe the panel can submit to this. Small 
businesses don't have the latest up-to-date software and the 
latest up-to-date hardware, and so is Department of Homeland 
Security working with programs of small businesses who have 
more dated equipment and technology? Or are we just moving to 
the forefront of what is the latest cutting edge? That would be 
my second question.
    Mr. Eggers. Congresswoman, if I may?
    Let me maybe set a little bit, frame things. I think you 
are asking some very practical, good questions. Let me see if I 
can maybe frame things a little bit more----
    Ms. Sanchez. Optimistic?
    Mr. Eggers [continuing]. Optimistically. So I think you are 
right. I think on a lot of levels you have got to cut small 
businesses some slack. I think that is the underlying kind of 
notion behind your concern. I think that is right.
    On the other hand, I think small business obviously produce 
some of the most innovative products and services out there. So 
small doesn't necessarily mean not capable, but clearly our 
experience is, is that they are obviously the bulk of our 
membership.
    We've got a campaign that we have been waiting for several 
years to get out to State and local chambers. We've hit 9 big 
cities in the last several years to promote the framework and 
really the solutions for all companies. Right? Then we also do, 
I mean, for example, we are going to be in San Antonio at the 
end of this month, we do smaller meetings with places like 
Beaumont, Texas, Longview, Texas. I will be in Green Bay in 
August. What we try to do is get out to our State and local 
chambers, just talk about some of the basic things that they 
need to do because they need help. Right? Some of the small 
businesses are actually ready to go and provide solutions.
    I think one of the things that we can think about is trying 
to continue the education effort. Resources are an issue. I 
will note that there are a couple, if not more, businesses 
focused on small businesses in cyber, both here in the House 
and in the Senate, that will try to leverage entities like 
small business development centers. That looks like that could 
be pretty good.
    The other thing I would note is in terms of, what do we 
tell businesses? I think we want to orient small business and 
companies and organizations of all sizes around the 
cybersecurity framework. If anything, I kind-of think of it as 
a written tool, maybe something companies can use to ask 
questions up and down from the CEO to the first hire. It is 
something that is really, I think, in a lot of ways, a mindset 
and it is also something that we want to focus on promoting 
here at home and globally.
    Ms. Sanchez. Thank you, Mr. Chairman.
    If the rest of the panel will submit that issue of, you 
know, what are your ideas for small business? I would really 
appreciate it.
    Thank you for the indulgence.
    Mr. Ratcliffe. I thank the gentlelady.
    For the record and for the benefit of some in the audience 
and for a point of optimism on this question and issue, last 
week this committee did mark up and pass legislation to support 
small businesses. H.R. 5064 is the Improving Small Business 
Cybersecurity Act, and the bill, if it became law, would 
require DHS to work with the Small Business Administration to 
jointly develop a strategy to aid small businesses. So 
hopefully that will, to address some of the issues that have 
been raised here, move forward for consideration by the full 
House.
    With that, I will recognize the gentleman from Rhode 
Island, Mr. Langevin.
    Mr. Langevin. Thank you, Mr. Chairman.
    I want to thank our panel for our testimony today and Mr. 
Chairman, especially I want to thank you and the Ranking Member 
for holding this hearing.
    As you know many of us, Chairman McCaul and I and many 
others, have been trying for years to get information-sharing 
legislation passed. Thankfully, the leadership of this Congress 
and last year, we finally passed that legislation. Now comes 
the implementation and holding hearings like this and making 
sure that we are implementing it the right ways is vitally 
important.
    Before I begin my questions, I just wanted to mention, Mr. 
Eggers, I want to thank you for mentioning the work that 
Chairman McCaul and I have been doing on the Wassenaar 
Arrangement. I think we are moving in a good direction on that.
    I also want to say, you know, how much I appreciate the 
chamber being so proactive on Wassenaar. It has been very 
helpful in getting it to a good place.
    But to my questions, if I could, following up on Mr. 
Richmond's question, I think you all touched on this issue in 
your written testimony, but as directly as possible, again why 
is the uptake of AIS so low given Mr. Clancy's testimony that 
one can be up and running with a Soltra install in as few as 15 
minutes? So, you know, I find it hard to understand why more 
mature companies wouldn't at least be experimenting with the 
threat stream.
    Again, I understand the guidance for sharing with DHS is 
just being finalized, but why wouldn't they at least be 
receiving data from the Government when there is known threat 
indicators and applying those to their cyber defenses?
    Mr. Eggers. Is that for me, sir?
    Mr. Langevin. For the panel.
    Mr. Eggers. I will jump in. Thanks for your comments about 
Wassenaar.
    I would say discussions are progressing on that front. We 
have been encouraging our colleagues in Europe to engage 
European and Wassenaar officials that handle cyber and export-
control issues. I think we have made progress thanks to you all 
here, but we are not out of the woods yet.
    A nod to the administration for saying that the cyber 
controls in that space need considerable work, if not, our 
preference, elimination.
    Now, in terms of sign-up, you know, I might say, gosh, the 
AIS system was turned on, if you will, formally in March. The 
final guidance just came out. We are pretty optimistic that 
things will keep moving.
    In my mind, what I think we're trying to do is to make sure 
that we're moving and grooving with our largest and most 
sophisticated organizations that can tap in, if they are not 
already tapped in, tomorrow and then make sure that we are 
boosting the confidence of companies that are on the sidelines 
waiting to see how policymakers handle this issue. I think the 
key word is trust.
    I think, as I noted in my opening remarks, we've got a, 
let's say, a representative company that says, hey, we have 
heard about CISA, but it is not exactly clear yet if this 
program will work for us or against us. I think they have got 
still, I would say, somewhat legitimate fears about liability, 
but I think the program is such that that should minimize those 
fears.
    The other thing is, is we want to make sure that regulators 
are kept at bay in terms of the data that they receive. But I 
think on balance, we would say jump in, get involved as 
appropriate.
    Mr. Langevin. Yes, and just on that, I understand that on 
the business side of building the trust on sharing the 
information with the Government. That I get, even though it is 
voluntary, but I am talking about actually receiving from the 
information, from the Government, not what private sector would 
share with Government, yet. I understand that trust will be 
come in time and hopefully soon. But at least accepting 
information from the Government where there are known threat 
indicators, why not at least accept it?
    Mr. Eggers. Yes, I think most companies are probably more 
than happy to receive, rather than share. Right? Because when 
you share, then you are putting yourself out there and your 
data out there. But I will finish there and see if others here 
on the panel have thoughts.
    Mr. Clancy. So a few thoughts for you. I think there is a 
technical dimension and operational dimension. On the technical 
dimension, platforms like mine need to complete our 
certification that we can fully support bidirectional 
communication with AIS. Because of those adjustments that were 
made, we had to make some code changes and we are going through 
that process.
    I think one of the barriers and I mentioned it in my 
testimony is there is no actual test system to use with DHS. So 
in their rush to produce the platform and make it live, they 
didn't have, you know, an extra system, if you would, where you 
can go test things out, and so you want to be very sure before 
you turn things on in production. I think that's one piece.
    On the operational side, I think there are just some 
mechanical issues that need to get worked through with signing 
up. I mentioned earlier the credentialing process. That process 
that is being leveraged was really set up to get individuals 
encryption certificates so they can send secure email or 
authenticate as individual humans to websites. That 
provisioning process wasn't designed for machine-to-machine 
sharing. A simple example is, all of the issuance processes 
assumes you are using Windows desktop. Our service platform is 
a Linux workstation, it is a completely different technical 
environment. So we have to add wizards and helpers to help 
people import those credentials to get them to work. So there 
are those kind of pieces.
    Then there is a tiny bit of thing on the agreement side 
where you sign one agreement, you get some paperwork back, you 
have to sign a second agreement and put it through. If I can 
take that to my general counsel once, it will take weeks out of 
the process because I need to get back in their queue to review 
agreement No. 2. So it is little things like that I think will 
help.
    We are early. I mean, the law is 6 months old. The program 
is only 3 months old. So I think it is just, you know, if we 
have this problem again in 12 months then we are in a very 
different place.
    Mr. Mayer. I would like to offer some comments on that. 
Building on what's been said previously, I think the fact that 
we have 30 companies that are operational right now, frankly, 
given the scope of engagement that is required at the financial 
level, at the operational level, at the technical level, at the 
legal review level, is not a bad situation. In fact, Mr. Clancy 
talks about not having the test bed environment. The live 
environment has, in a sense, become part of the test bed 
process right now. So for example, I can speak to a company in 
our sector where they did try to work through the AIS 
engagement. I think Mr. Clancy can substantiate this, and DHS 
has acknowledged this, that there is legacy data in the systems 
that has triggered some reaction that was not anticipated. It's 
delaying the process of AIS. That is something that can be 
overcome. They are talking about 6.2.0. We have guidance that 
is still coming out as recently as this morning.
    So I think that the prudent thing for a lot of companies 
right now is to see these issues get resolved, to understand 
what the value proposition is for them, to work with DHS and 
other sectors to see what we can do to expedite and facilitate 
a more streamlined process. I think that will happen, but 
expecting that all to be resolved in 6 months is probably a 
little bit, I don't know what the word is, overly optimistic or 
whatever. But progress is being made.
    Mr. Langevin. Thank you. I know my time is expired, so I 
don't know if--OK.
    Mr. Eggers. Mr. Ratcliffe----
    Mr. Rosen. I thought I would just give a brief response 
from our perspective. So I think other than the issues that we 
have discussed on clarification of liability and even what do 
we mean by PII data and privacy, and especially for a global 
company where, you know, we have, you know, general data 
protection regulation coming out of the European Union, so we 
have to look at it from a lot of aspects. But other than that, 
we are looking at it very similar to what just got described 
from an operational point of view and a priority point of view.
    So we have a broad threat intelligence feed and analytics 
engine inside of our company to protect it, to protect our 
company. We are in the process of exploring what this looks 
like, how do we add that to the feed, does it generate 
additional work for our operations, how do we tune it? So that 
will be our next step in exploring it once the clarifications 
on the privacy and liability issues get put by the wayside. 
Again, bringing it to general counsel once is better than 
bringing it multiple times.
    I do think this idea of having a test bed for folks like us 
to try it, get the data feed, do the analytics, see what the 
impact is, it is really an operational and priority issue for 
us. But we believe, if the data feeds aren't what we are 
getting today, meaning if it is not duplicative data, you know, 
the more intel feeds for us, the better.
    Mr. Langevin. Sure. Very good. Thank you. I will mention, 
too, that one of the things that I am not clear on yet, too, is 
that the ISACs have not signed up for this yet either, so it is 
not just a problem with businesses not yet signing up, it is 
also the ISACs, which are designed for information sharing, 
have not yet signed up. I find that troubling and hopefully we 
will move it to a better place in the very near future. So, 
thank you, Mr. Chairman. I yield back.
    Mr. Ratcliffe. Thank the gentleman.
    The Chair now recognizes my colleague from the great State 
of Texas, Ms. Jackson Lee.
    Ms. Jackson Lee. I thank the Chairman very much.
    Chairman Ratcliffe, let me thank you and Ranking Member 
Richmond for being so diligent on these issues.
    I am going to stay narrowly focused and say somewhat of the 
obvious. I am glad that we passed the Oversight of the 
Cybersecurity Act of 2015 and included privacy elements in that 
bill as well, and now that we are having an oversight of the 
Oversight bill to find ways to improve our service to the 
American people.
    But I want to be the one that poses or at least puts in the 
record that we are dealing with fire here. We are dealing with 
something that probably is not evidenced in the calmness of our 
conversation. But I hope you will view this committee as being 
very serious about this issue.
    So I am going to ask to put into the record, Mr. Chairman, 
the ``Crime Pays: Ransomware Bosses Make $90K Annually.'' It 
speaks to the Russian ransomware boss making $90,000 a year, or 
13 times the average income for citizens in the country who 
stick to the straight and narrow. Of course, their job is to 
maintain, update it so that the antivirus systems won't 
recognize the software that they are maintaining as malware. So 
I ask unanimous consent to place that into the record.
    Mr. Ratcliffe. Without objection.
    [The information follows:]
    Article Submitted For the Record by Honorable Sheila Jackson Lee
    SPOTLIGHT ON SECURITY.--Crime Pays: Ransomware Bosses Make $90K 
                                Annually
By John P. Mello Jr., June 14, 2016, 5 o'clock AM PT
            http://www.technewsworld.com/story/83603.html
    If crime doesn't pay, Russian ransomware bosses wouldn't know it.
    The average Russian ransomware boss makes US$90,000 a year--or 13 
times the average income for citizens in the country who stick to the 
``straight and narrow,'' according to a recent Flashpoint study.
    What does a ransomware honcho do for those rubles? Basically, the 
job calls for supporting and maintaining the malware.
    ``The software has to be constantly updated so that antivirus 
systems won't recognize it as malware,'' explained Vitali Kremez, a 
cybercrime intelligence analyst with Flashpoint.
    ``It's not a situation where you provide the malware and sit back 
on a couch waiting for your payments. You have to work on it on a daily 
basis,'' he told TechNewsWorld. ``The boss controls the source code for 
the malware.''
                        ransomware as a service
    The malware model is evolving, according to the Flashpoint study, 
which focuses on the Russian ransomware scene.
    ``A new form of ransomware has been developed that is in effect 
`Ransomware as a Service' (RaaS),'' notes the report. It ``enables 
`affiliates' to obtain a piece of ransomware from a crime boss and 
distribute it to victims as these affiliates wish.''
    That's a departure from the past, when ransomware was available 
only to criminals willing to make a hefty upfront payment for the 
malware--$2,000 to rent or $5,000 to buy. That began to change last 
November, Kremez noted.
    ``We started to see developers considering giving their malware 
free of charge to criminals and keeping 40 to 50 percent of each 
ransomware payment made,'' he said.
    The new business model has lowered the barriers to getting into the 
business. It is not particularly hard for newcomers to start spreading 
ransomware quickly. They can attack corporations and individuals 
through botnet installs, email and social media phishing campaigns, 
compromised dedicated servers and file-sharing websites.
    ``It used to be a one-on-one business,'' Kremez said. ``At this 
stage, it's all automated. We see marketplaces. We see services on the 
dark web where you deposit your money and buy what you have to buy 
without any direct communication with the seller.''
                    malicious infrastructure growing
    More evidence of the popularity of ransomware is evident in 
Infoblox's latest quarterly report on malicious infrastructure building 
globally.
    To measure that kind of activity worldwide, Infoblox has created a 
threat index. Upon its launch in the first quarter of 2013, the threat 
index was 76. During this year's first quarter, the index reached it's 
highest point ever: 137.
    Activity related to ransomware has fueled the index's rise.
    ``While exploit kits remain a major threat, this latest jump was 
driven in large part by a 35X increase in creation of domains for 
ransomware over the previous quarter, which in turn drove an increase 
of 290 percent in the overall malware category,'' the report States.
    The activity of malware kit developers is another indicator of 
ransomware's attractiveness to criminals. Kits are used to infect 
devices with a variety of malware programs.
    ``A number of exploit kits and threat actor gangs behind them have 
started adding ransomware to their repertoire over the last few 
months,'' said Sean Tierney, director of cyber intelligence at 
Infoblox.
    ``These are gangs that were using their kits to deliver other kinds 
of malware,'' he told TechNewsWorld, that ``have either started 
including or switched entirely to ransomware.''
    It's likely that the ransomware market will level off as security 
software makers get better at detecting it and consumers get smarter 
about avoiding it, suggested Tierney.
    ``Then the market will become saturated,'' he said, ``and the 
return won't be able to support the amount of activity going on.''
                             expanding 2fa
    Two-factor authentication, which requires both something you have 
and something you know in order to access an account, has proven to be 
a good way to thwart data thieves. One problem with the technology, 
though, is that it isn't easy for many rank-and-file developers to 
deploy. One authentication company aims to change that with a recently 
launched program.
    Centrify actually goes beyond 2FA to include single sign-in--which 
allows the use of a single set of credentials to log into multiple 
accounts--along with password reset and access control of a device. 
Under the program, developers can plug into those features through 
Centrify system APIs.
    ``Developers who are building an application from a great idea 
aren't necessarily expert in security,'' said Chris Webber. security 
strategist at Centrify.
    ``We can give that to them,'' he told TechNewsWorld.
    ``They can take advantage of all the user management and 
multifactor authentication that Centrify's built, so they don't have to 
learn about that world and can concentrate on their great idea,'' 
Webber pointed out. ``It's more and more critical that we need to 
figure out how to put two-factor auth everywhere, because passwords 
alone are just not a great way to do authentication anymore.''
                              breach diary
   May 30. Troy Hunt, who maintains the data breach awareness 
        portal Have I Been Pwned, advises his subscribers that 
        information on 65 million Tumblr accounts is being offered for 
        sale on the dark web.
   May 30. Twitter account of Katy Perry breached and her 89 
        million followers sent tweets filled with profanity and slurs, 
        TechCrunch reports.
   May 31. MySpace announces it has reset the passwords of all 
        accounts created prior to June 11, 2014, due to a data breach.
   May 31. A Federal district court in Pheonix, Arizona, rules 
        that insurance provider Chubb does not have to reimburse P.F. 
        Chang under a cybersecurity policy for payments to credit card 
        processors connected to a 2014 data breach.
   June 1. U.S. Federal Reserve detected more than 50 breaches 
        between 2011 and 2015, including several incidents described in 
        internal documents as espionage, Reuters reports.
   June 1. Medical information of thousands of NFL players is 
        at risk after backback containing the data was stolen from an 
        athletic trainer's car, Deadspin reports.
   June 1. FBI alerts public that extortion attempts are being 
        made against victims whose personal information has been 
        compromised in recent large data breaches. Extortionists are 
        threatening to make victim's personal informtion public if not 
        paid two to five bitcoins.
   June 1. TeamViewer reports it experienced a service outage 
        due to a DDoS attack, but its systems were not breached by 
        hackers.
   June 2. Medical records of some 40,491 customers of the 
        Stamford Podiatry Group in Connecticut impacted due to a system 
        intrusion, HealthIT Security reports.
   June 2. 2015 payroll tax data of employees of Verify Health 
        Systems in California at risk after an employee was duped by a 
        phishing scam, SC Magazine reports.

    Ms. Jackson Lee. Speak the obvious of the hacking of the 
Democratic National Committee, which brings it really home. For 
those of us young enough to remember Watergate, we are managing 
now 21st Century. But again, the individuals allegedly attached 
to that were Russian. I don't speak particularly to Russia, but 
it does say that this is an international threat that goes to 
our private sector.
    Some years back I chaired the Transportation Security 
Subcommittee, and this component was under that committee. I 
remember noting the 80 percent-plus cyber issues would be in 
the private sector. So I am glad of your presence here today.
    Then I want to ask unanimous consent to put into the record 
``Lights Out: A Cyberattack, A Nation Unprepared, Surviving the 
Aftermath.'' That is, of course, a bestseller investigation by 
Ted Koppel.
    Mr. Ratcliffe. Without objection.*
---------------------------------------------------------------------------
    * The information has been retained in committee files.
---------------------------------------------------------------------------
    Ms. Jackson Lee. So I want to go first to Ms. Sage and 
indicate, if I could, very briefly for your answer. Pointedly, 
you indicated that the information was dated. And that you, I 
guess, on your receiving end needed a secure entity. Help me 
understand what we can do to help. Obviously, I want the data 
to be current. I don't want it to be where you have just turned 
on National news and said, well, I just saw this on the 
National news. Then, is the idea of a secure channel yours or 
ours? Or how can we help you do that?
    Ms. Sage. Sure. Thank you, Congresswoman, for your 
question. The Enhanced Cybersecurity Services initiative is the 
one that is a Classified program. That was the one where we had 
difficulty getting access to a facility where we could even 
just review the requirements, not even whether or not we were 
going to participate. So there, if there is a way for DHS or 
the Government or some Government entity to be able to provide 
those kinds of facilities so that companies--and we had a 
clearance, it just wasn't at the level, you know, needed to be 
able to review these requirements--to make that easier, that 
would be very helpful. Because we actually had to start looking 
at, did we need to build a SCIF, and those costs are just cost-
prohibitive.
    Then, you know, without even getting into the merits of the 
program itself, once we were able to review, it just was not 
something that a small business would be--and there are two 
pieces to that program. You can be a provider or you can 
partner with the larger firms. So that's now kind-of what we 
are exploring, because, you know, trying to invest, is just not 
possible.
    On the question of data, and this also speaks, I think, to 
the AIS initiative, I think at the end of the day, I agree with 
what, you know, my colleagues have talked about in terms of 
financial, technical, and operational considerations. But I 
think it all, at the end of the day, comes down to the quality 
and the value of the data that is received.
    So it was our experience with the CRADA, when we 
participated in the Unclassified program, that a lot of the 
data that we were receiving through the portal was already 
widely available. So it was just another stream of data that 
was not particularly adding, you know, value above and beyond.
    So I can't speak, you know, and I believe the AIS program 
is a good initiative, and I would just urge on the DHS side and 
the Government side that as that data is being provided, that 
it is reviewed for the quality and the currency to the 
recipients.
    Ms. Jackson Lee. I think, Mr. Chairman, this is something 
that we really pointedly can look at together with DHS on the 
accuracy or the currency of the data.
    Mr. Chairman, I have just one or two points and I will be 
finished. I thank you.
    One is going to be deviating, because I made a commitment 
that I would make mention of this, whatever Homeland Security 
meeting I was in, and that is, of course, to acknowledge my 
sympathy for those who lost their lives this past Sunday, the 
most heinous and largest mass murder, massacre, and slaughter 
of American people here in the United States in our history.
    I believe that there is a great deal of morality in this 
Congress, and so I am hoping and looking for action this week 
on a ban on the assault weapons.
    No. 2, no-fly, no-buy. If you are on a terrorist watch 
list, you should not be able to buy assault weapons. Something 
to say to the American people that we get it, that our pain is 
as deeply embedded as theirs, that families who mourn 
tragically do not mourn in vain. I am hoping that this Homeland 
Security Committee can be a bipartisan leader on these issues.
    I hope the American people and those who are listening in 
this audience in their own way will rise up and be actively 
engaged in ensuring that we are responsive to the deeply 
embedded pain. I asked the question whether or not we are in 
fact good Samaritans and whether or not it is your neighbor, 
and if it is your neighbor, what would you do? If it is 
yourself, what would you do?
    So I am looking forward to us working on that issue.
    But let me conclude my remarks on the cybersecurity and 
raise this question out of Ted Koppel's article. Maybe some of 
you have read his book.
    So, Mr. Eggers, I am going to go to you because you 
represent a vast number of private sector. So I won't read it 
all, but Mr. Koppel suggests that a massive cyber attack, we 
would have no running water, no refrigeration or light, food 
and medical supplies dwindling, we would be going in the dark, 
banks no longer function, looting is widespread, law and order 
are being tested as never before.
    What is your response to the private sector's preparation 
for what might be? Because we have to answer those questions.
    Mr. Eggers. Congresswoman, good to see you.
    Ms. Jackson Lee. Thank you.
    Mr. Eggers. You know, I think in a lot of ways, and hearing 
Mr. Koppel speak, I get the sense more he uses kind-of the 
electric sector as kind-of a gateway for his concerns. I think 
it's less about that, it's more about some kind of dystopian 
future, right? But I think what he leaves out, if you talk to 
folks in the administration and the private sector, they are 
going to say, you know what, the book paints the private sector 
and Government as if we are sitting still, when in fact there 
is so much going on, not only in the electric sector and other 
sectors that frankly even individuals like myself, I can't keep 
up.
    So leaving aside the regulatory platform that the electric 
sector works under, I am pleased to hear situations where, 
let's see, I think Secretary Spalding recently said, hey, look 
at what has happened in Ukraine with an incident with their 
electric sector. We know how to handle that here.
    Now, I am the last person that is going to say an incident 
won't impact us, but when I think about the Sector Coordinating 
Councils, the ISACs and ISAOs, our organization of critical 
infrastructure at greatest risk, we know who those folks are. I 
would say, if anything, we are pretty busy. One of the things 
that I think we need to focus on is making sure that they have 
got everything they need for a bad day.
    The other thing is we often point the fingers at ourselves, 
right? I like this program, CISA and AIS, because we are 
working together pretty well. The chamber just approved a norms 
and deterrence statement last week, our board of directors, 
saying at least a couple of things. We impose a lot of costs on 
ourselves, but we can do better in an active, restrained, legal 
way to impose costs on bad guys. We are doing that.
    But let me give you an example. So the Cyber Forum of 
Independent and Executive Branch Regulators, there is something 
like a dozen or so agencies in that body. If I look at 
organizations like the Secret Service or DHS that are 
positioned to push back, that's two. I am not saying we act 
recklessly, but I am saying that we need to be mindful about 
how we impose costs on bad actors, many of whom or which are 
State actors or their proxies or super criminal groups.
    So when I think about small business or even larger 
companies, I think that they are going to be ultimately 
resource-constrained against a nation-state or their 
surrogates. I hope that helps.
    Ms. Jackson Lee. It does.
    I will just end, Mr. Chairman and say, as I heard some good 
news from Mr. Eggers, I want to emphasize that I think we need 
a SOS or Red Cross team dealing with cybersecurity in light of 
these possibilities. I yield back. Thank you.
    Mr. Ratcliffe. Thank the gentlelady.
    I wish we could do another round of questions, but prior 
commitments of the Chair prevent that. So I will thank the 
witnesses for your valuable and important testimony today, and 
I thank all the Members for their questions.
    Members of this committee, I think, will have some 
additional questions for the witnesses. That being the case, we 
will ask you to respond to those in writing.
    Pursuant to committee rule 7(e), the hearing record will be 
held open for a period of 10 days.
    Without objection, the subcommittee stands adjourned.
    [Whereupon, at 11:41 a.m., the subcommittee was adjourned.]

                            A P P E N D I X

                              ----------                              

    Questions From Chairman John L. Ratcliffe for Matthew J. Eggers
    Question 1. Does the U.S. Chamber of Commerce believe that the 
Cybersecurity Act of 2015, specifically Automated Indicator Sharing, is 
applicable to all businesses, including small businesses, and private 
organizations?
    Answer. The chamber believes that the Cybersecurity Act of 2015--
particularly title I, the Cybersecurity Information Sharing Act of 2015 
(CISA)--and Automated Indicator Sharing (AIS) are applicable to 
businesses and private organizations of all sizes and sectors.
    Question 2. What avenues do Government and industry have to 
increase businesses' awareness of the Cybersecurity Act of 2015, 
specifically Automated Indicator Sharing?
    Do you expect that all businesses, especially small ones, will use 
the Cybersecurity Act of 2015, specifically the Automated Indicator 
Sharing program, directly?
    Answer. There are many ways to publicly promote CISA. The chamber 
led the Protecting America's Cyber Networks Coalition, a partnership of 
more than 50 leading business associations representing nearly every 
sector of the U.S. economy to pass CISA. Each association has on 
average thousands of members.
    The chamber is championing CISA as part of our cybersecurity 
campaign, which was launched in 2014. This National initiative 
recommends that businesses of all sizes and sectors adopt fundamental 
internet security practices, including the joint industry-National 
Institute of Standards and Technology (NIST) Framework for Improving 
Critical Infrastructure Cybersecurity (the framework) and the new 
information-sharing law.
    The chamber spearheaded 11 major regional roundtables and 2 summits 
in Washington, DC. More events are planned for 2017. The chamber's 
Fifth Annual Cybersecurity Summit was held on September 27. Each 
regional event had approximately 200 attendees and typically features 
cybersecurity principals from the White House, Department of Homeland 
Security (DHS), NIST, and local FBI and Secret Service officials.
    The chamber also partners with State and local chambers and 
universities to produce cyber educational events in locations such as 
Appleton, Wisconsin; Augusta, Georgia; Oak Brook, Illinois; 
Indianapolis, Indiana; Irving, Texas; and Longview, Texas. We endorse 
CISA and AIS at each gathering. In addition, chamber professionals 
regularly speak on and/or moderate industry panels tied to 
cybersecurity, where we can actively pitch CISA/AIS to multiple 
businesses.
    DHS Deputy Secretary Ali Mayorkas addressed the chamber's Small 
Business Summit on June 14, and he advocated that businesses take 
basic, prudent steps to protect their devices and sensitive data, 
including leveraging cybersecurity information-sharing services.
    Big picture: The chamber is urging businesses to use the framework, 
join an information-sharing body, and take advantage of the CISA/AIS 
system as appropriate. We are pressing senior leaders of industry 
groups to popularize these initiatives among their peers and 
constituencies, including through jointly written chamber-DHS op-ed 
articles.\1\
---------------------------------------------------------------------------
    \1\ http://thehill.com/blogs/congress-blog/technology/304163-
cybersecurity-building-resiliency-together, www.csoonline.com/article/
3124626/security/advancing-cybersecurity-through-automated-indicator-
sharing.html.
---------------------------------------------------------------------------
    The chamber commends DHS and the Department of Justice (DOJ) for 
jointly holding their Cybersecurity Conference for Lawyers on September 
28, which included a discussion on traditional challenges to sharing 
threat data and CISA's attempt to address these challenges and a 
demonstration of the AIS program.
    Question 3. The issue of how many entities are signed up for the 
Automated Indicator Sharing program was discussed at the hearing. 
Should Information Sharing and Analysis Organizations (ISAO)--and 
Information Sharing and Analysis Centers (ISAC)--participating entities 
be included in the accounting of the number of participating entities 
under the program if they are sharing cyber threat data through an ISAO 
or ISAC that is plugged into DHS's NCCIC?
    Answer. First, it is important to stress the chamber believes that 
the success of CISA and AIS should not be linked to the number of 
organizations that sign up for AIS. Some subcommittee Members suggested 
at the hearing that the number of AIS signers and the achievements of 
CISA/AIS are bound together. Most industry organizations are unlikely 
to share cyber threat indicators (CTIs) directly with Government 
partners. Instead, the chamber believes that the vast majority of 
businesses will share and receive cyber threat data with industry peers 
and ISACs and ISAOs. It is our understanding that most businesses will 
use information-sharing bodies as conduits between themselves and DHS, 
among other Federal entities. These businesses will not be signed up 
with AIS, but significant amounts of information sharing will 
nonetheless take place.
    Second, ISAOs and ISACs and their respective members should be part 
of the calculation of private organizations that are possibly using 
CISA/AIS. The chamber defers to DHS's data concerning AIS involvement. 
Yet at the time of this writing, we understand that approximately 150 
private organizations have signed DHS's Terms of Use that govern the 
use of CTIs and DMs and participation in the AIS initiative.\2\ Fifty-
eight of these organizations are attached to the AIS server and consume 
Government-furnished CTIs. In addition, 12 of these organizations are 
either ISACs or ISAOs. For instance, the Financial Services-ISAC (FS-
ISAC) has upward of 7,000 member financial institutions and partner 
organizations. Presumably, many of these entities are engaged in 
protected information sharing under CISA but may not be part of AIS 
accounting.\3\
---------------------------------------------------------------------------
    \2\ www.us-cert.gov/sites/default/files/ais_files/
AIS_Terms_of_Use.pdf.
    \3\ http://media.wix.com/ugd/
416668_2c6d85d4964743f8b4d3470b860f6e3b.pdf.
---------------------------------------------------------------------------
    Similarly, the Health Information Trust Alliance (HITRUST) Cyber 
Threat XChange, the health industry's ISAO, is now connected to AIS and 
supports the bidirectional sharing of cyber threat data with DHS. The 
real-time sharing of CTIs between HITRUST's more than 1,000 members and 
DHS helps private-sector organizations reduce their cyber risks.\4\
---------------------------------------------------------------------------
    \4\ https://hitrustalliance.net/hitrust-advances-State-cyber-
threat-information-sharing-nations-healthcare-sector.
---------------------------------------------------------------------------
    The chamber understands that several entities are testing the 
sharing process before they initiate automated, bidirectional sharing 
on routine basis.
 Questions From Ranking Member Cedric L. Richmond for Matthew J. Eggers
    Question 1a. In accordance with 1A103 and  105(a)(4) of the 
Cybersecurity Act of 2015 (Pub. L. No. 114-113), on June 15, 2016, the 
Director of National Intelligence, the Secretary of Homeland Security, 
the Secretary of Defense, and the Attorney General issued updated, 
final guidance on the sharing of cyber threat indicators and defensive 
measures among multiple Federal and non-Federal entities.
    What was your impression of the guidance? Are there aspects that 
you find insufficient or impractical?
    Answer. The chamber was impressed at the wide-spread support CISA/
AIS stakeholders showed for the final CISA procedures and guidance 
documents that were released on June 15. The chamber especially 
commends DOJ's Leonard Bailey, senior counsel, and DHS's Gabe Taran, 
acting assistant general counsel for infrastructure programs, for their 
positive roles in negotiating with multiple parties and writing the 
documents under a tight deadline.
    The chamber believes that the procedures and guidance are 
sufficient and practical.
    Question 1b. In addition to resolving the question of liability 
protections for private-to-private sharing, are there other aspects of 
the DHS guidance that you believe would benefit from additional 
clarity?
    Answer. The issue related to clarifying liability protections for 
private-to-private sharing seems to have been dealt with adequately. 
The procedures and guidance do not need additional clarification at 
this time. In the main, the chamber is urging industry to take 
advantage of CISA/AIS as appropriate.
    Question 1c. Are there aspects of the law that should be clarified?
    Answer. No. The CISA/AIS program is off to a good start. While 
oversight by Congress is crucial, it is too soon to make changes to the 
legislation. CISA does not need to be reauthorized until September 
2025.
    The chamber urges lawmakers and the next administration to be 
industry's ally as it uses CISA/AIS, which is currently more important 
to businesses than clarifications. Companies need to trust that policy 
makers have their backs. It is important that businesses see that the 
protections granted by CISA--including matters tied to limited 
liability, regulation, antitrust, and public disclosure--become real. 
For some businesses, the protections are still an open question.
    The chamber agrees with a witness who spoke on June 21 before the 
Commission on Enhancing National Cybersecurity at the University of 
California-Berkeley. He noted that the Government could make it easier 
for companies to create a ``regulatory safe space,'' where they can 
more effectively share information about threats and attacks.\5\
---------------------------------------------------------------------------
    \5\ https://cltc.berkeley.edu/2016/06/27/cltc-hosted-white-house-
commission-considers-challenges-opportunities-for-the-next-president.
---------------------------------------------------------------------------
    The chamber hears such sentiments frequently and believes that 
Government entities like DHS want to use company data prudently. 
However, many more agencies and departments will have to adopt 
attitudes and actions that do not discourage businesses from reporting 
threat and vulnerability data.
    Question 2. As a general rule, small- and medium-size businesses do 
not have the resources to devote to the most advanced, state-of-the-art 
information technology systems. As such, smaller enterprises may use 
older systems that have known cybersecurity vulnerabilities. Can these 
companies rely on older systems to share or receive threat information 
or do their platforms require a more advanced system?
    Answer. The chamber's experience suggests that sophisticated 
cybersecurity programs can be very expensive to develop, deploy, and 
maintain for companies of all sizes, particularly small and mid-size 
businesses (SMBs).
    DHS does not charge a fee for companies to participate in AIS. 
However, any AIS participant will need to adhere to defined technical 
connectivity activities, which DHS helps organizations manage.\6\ 
Larger firms may have more resources to submit indicators directly 
through AIS. Most SMBs may not need to.
---------------------------------------------------------------------------
    \6\ www.us-cert.gov/sites/default/files/ais_files/
AIS_fact_sheet.pdf, www.us-cert.gov/sites/default/files/ais_files/
AIS_FAQ.pdf.
---------------------------------------------------------------------------
    Indeed, the chamber anticipates that many SMBs will benefit from an 
innovative, automated-sharing ecosystem. A key long-term goal of 
information-sharing policy is to foster economies of scale in real-
time, machine-to-machine sharing. The chamber anticipates that the 
marketplace will eventually provide inexpensive and easy-to-deploy 
technologies that conform to CISA's rules (e.g., scrubbing privacy 
information from CTIs) and generate and swap threat signatures at 
internet speeds. Systems like AIS will be able to block attacks sooner 
and more regularly, compared with the relatively human-intensive 
sharing schemes in use today.
    The chamber understands that cyber threat intelligence companies 
have the means to enable companies to opt-in to AIS and gain from the 
process of receiving pertinent security event information such as IP 
addresses, domain names, hashes, and actor tactics, techniques, and 
procedures.
    From a resource standpoint, it is probably too much to ask most 
SMBs to engage in the cybersecurity threat-sharing ecosystem directly. 
Many SMBs will likely struggle to create and maintain sound 
cybersecurity programs.\7\ Technology may be challenging to use, and 
professional cyber talent is both scarce and pricey. Public policy does 
not do a sufficient job of recognizing the potentially extraordinary 
costs that industry faces in creating robust information-security 
programs.
---------------------------------------------------------------------------
    \7\ https://inthenation.nationwide.com/news/small-business-cyber-
security-survey.
---------------------------------------------------------------------------
    Secretary of Commerce Penny Pritzker spoke at the chamber on 
September 27 concerning cybersecurity policy. She said that cyber space 
is the ``only domain where we ask private companies to defend 
themselves'' against foreign powers and other significant threats. She 
wondered aloud, ``Does that sound as crazy to you as it does to 
me?''\8\ Government does not stand between private entities and 
malicious hackers, she suggested.
---------------------------------------------------------------------------
    \8\ www.commerce.gov/news/secretary-speeches/2016/09/us-secretary-
commerce-penny-pritzker-delivers-keynote-address-us.
---------------------------------------------------------------------------
    It is instructive, according to a Council of Insurance Agents and 
Brokers market survey, that 26.1 percent of SMBs purchase ``cyber'' 
insurance for risk mitigation assistance (4.5 percent) and post-breach 
resources (21.6 percent). In contrast, 20.4 percent of large entities 
purchase ``cyber'' insurance for risk mitigation assistance (10.2 
percent) and post-breach resources (10.2 percent).\9\ In the chamber's 
view, companies typically have healthy and maturing cyber risk 
management programs in place before engaging in active information-
sharing initiatives.
---------------------------------------------------------------------------
    \9\ www.ciab.com/news.aspx?id=6176.
---------------------------------------------------------------------------
    Question 3. In developing the aforementioned guidance,  103(a)(5) 
specified that the procedures established must facilitate periodic 
circulation of cybersecurity ``best practices'' designed with special 
attention to the accessibility and implementation challenges faced by 
small businesses. Do the policies and procedures described in the 
guidance actually facilitate the development and circulation of best 
practices that are mindful of small business needs?
    Answer. In keeping with section 103(a)(5) of CISA, the Federal 
Government-sharing guidance calls for the periodic sharing of 
cybersecurity best practices ``with attention to accessibility and 
implementation challenges faced by small business concerns.'' The 
guidance outlines several programs, activities, and Federal agencies 
and departments that support the recurrent sharing of sound 
cybersecurity techniques, which are expected to be rooted in the on-
going analyses of cyber threat data.
    Here are some examples of cybersecurity best practices featured in 
the Federal Government-sharing guidance and that the chamber includes 
in our National cyber education campaign:
   NIST Computer Security Division.--NIST special publications 
        and interagency reports, covering a broad range of topics, 
        provide management, operations, and technical security 
        guidelines for Federal agency information systems. Beyond these 
        documents, which are peer reviewed throughout industry, 
        Government, and academia, NIST conducts workshops, awareness 
        briefings, and outreach to help ensure greater understanding of 
        standards and guidelines resources.\10\
---------------------------------------------------------------------------
    \10\ www.nist.gov/itl/computer-security-division.
---------------------------------------------------------------------------
   DHS Critical Infrastructure Cyber Community (C\3\) Voluntary 
        Program.--The C\3\ (pronounced ``c cubed'') Voluntary Program 
        helps enhance critical infrastructure cybersecurity and 
        encourage the adoption of the framework. The C\3\ Voluntary 
        Program aids sectors and private organizations that want to use 
        the framework by connecting them with cyber risk management 
        tools offered by DHS, other Federal entities, and the private 
        sector.\11\
---------------------------------------------------------------------------
    \11\ www.dhs.gov/ccubedvp.
---------------------------------------------------------------------------
   DHS National Cybersecurity and Communications Integration 
        Center (NCCIC).--The NCCIC disseminates publications that 
        recommend practices and standards for technical and 
        nontechnical users. Information is available for Government 
        users, as well as owners, operators, and vendors of industrial 
        control systems.\12\ In addition, the NCCIC includes 
        information specifically focused on securing small business and 
        home networks.\13\
---------------------------------------------------------------------------
    \12\ https://ics-cert.us-cert.gov.
    \13\ www.us-cert.gov/home-and-business.
---------------------------------------------------------------------------
    Through the US-CERT, a component of NCCIC, DHS offers the Cyber 
        Resilience Review (CRR), a no-cost, voluntary, nontechnical 
        assessment to help an organization evaluate its resilience and 
        cybersecurity practices. The CRR may be conducted as a self-
        assessment or as an on-site assessment facilitated by DHS 
        cybersecurity professionals.
   Small Business Administration (SBA) Cybersecurity Website.--
        The SBA provides information about cybersecurity best practices 
        through its website, which features top tips, among other 
        resources, that SMBs can use.\14\
---------------------------------------------------------------------------
    \14\ www.sba.gov/cybersecurity.
---------------------------------------------------------------------------
    Question 4. There is a natural tension between sharing threat 
indicators quickly to facilitate rapid response, and sharing only the 
most valuable information once it has been processed and analyzed. I 
understand that DHS uses the former, emphasizing volume and timeliness. 
Do you prefer this ``time is of the essence'' approach? In other words, 
how useful and actionable is the information you [a business or private 
organization] receive from DHS?
    Answer. The chamber supports the ``time is of the essence'' mind-
set. During the legislative debate concerning CISA, we opposed 
amendments that would attempt to address the ``second scrub'' issue by 
requiring DHS to perform another scrub of cyber threat data for 
personal information before disseminating indicators to appropriate 
Federal entities. So the speed of sharing is key.
    Granting authority to DHS to conduct a second scrub is not 
inherently bad if viewed only through the vague lens of ``privacy.'' 
But privacy is just one of several considerations in CISA. For example, 
when one understands that CTIs rarely if ever contain personal 
information, the second scrub would bog down the sharing of CTIs from 
businesses to the Federal entities that need them in a timely 
manner.\15\
---------------------------------------------------------------------------
    \15\ www.uschamber.com/sites/default/files/
cisa_ctis_separating_fact_from_fiction_ - aug_19_final.pdf.
---------------------------------------------------------------------------
    A DHS privacy official said at the Cybersecurity Conference for 
Lawyers in September that if a CTI field ``fails or is not completed 
fully'' by a submitter, the whole indicator is not held back, which is 
constructive from a timeliness standpoint.\16\
---------------------------------------------------------------------------
    \16\ www.us-cert.gov/sites/default/files/ais_files/
AIS_Submission_Guidance_Appendix_- A.pdf.
---------------------------------------------------------------------------
    Question 5. The Cybersecurity Act of 2015 contains numerous 
provisions designed to safeguard privacy and civil liberties by 
requiring, for instance, the scrubbing of personal information. Are 
private-sector organizations using their own systems to fulfill these 
obligations or relying on DHS mechanisms?
    Answer. Section 104(d)(2) of CISA requires businesses to remove any 
information from a CTI or DM that it knows at the time of sharing to be 
personal information of a specific individual or information that 
identifies a specific individual who is not directly related to a 
cybersecurity threat before sharing that data with a Federal 
entity.\17\
---------------------------------------------------------------------------
    \17\ www.us-cert.gov/sites/default/files/ais_files/Non-
Federal_Entity_Sharing_Guidance_- %28Sec%20105%28a%29%29.pdf.
---------------------------------------------------------------------------
    Private organizations use their own technical capabilities to scrub 
indicators of personal information. It is worth noting that a DHS 
privacy official said at the Cybersecurity Conference for Lawyers that 
there is no ``hard and fast list of privacy information that must be 
removed'' from CTIs. CISA/AIS stakeholders need to consult the non-
Federal entity guidance for scrubbing protocols. Scrubbing is 
``ultimately up to the company that is sharing the indicators,'' she 
added. The chamber instructs businesses to remove personal information 
from cyber threat data and not to rely on DHS mechanisms, which, among 
other things, may impede timely sharing efforts.
   Questions From Ranking Member Cedric L. Richmond for Robert Mayer
    Question 1a. In accordance with  103 and  105(a)(4) of the 
Cybersecurity Act of 2015 (Pub. L. No. 114-113), on June 15, 2016, the 
Director of National Intelligence, the Secretary of Homeland Security, 
the Secretary of Defense, and the Attorney General issued updated final 
guidance on the sharing of cyber threat indicators and defensive 
measures between and among Federal and non-Federal entities.
    What was your impression of the guidance and are there aspects that 
you find insufficient or impractical?
    Question 1b. In addition to resolving the question of liability 
protections for private-to-private sharing, are there other aspects of 
the DHS guidance that you believe would benefit from additional 
clarity?
    Question 1c. Are there aspects of the law that should be clarified?
    Answer. As indicated in our testimony, we applaud DHS for its 
efforts to meet CISA's aggressive deadlines and for producing both 
interim and final guidance that provides additional evidence of the 
liability protections afforded under the Act. We now continue to focus 
our attention on evaluating the requirements and benefits associated 
with implementing CISA, and we expect that more companies will enter 
into arrangements for sharing cyber threat indicators and defensive 
measures through the new DHS portal.
    Our member companies believe that no additional statutory 
clarification is required at this time and that it would be premature 
to open up CISA for amendment so soon after final passage. The process 
to reach consensus on the language in CISA, including the liability and 
privacy protection provisions, was a lengthy one. The law establishes 
an information-sharing structure, provides for liability and privacy 
protections, and more granular details about how sharing is conducted 
are better placed in implementation guidance, policies, and procedures.
    We also recognize that over time issues may arise that would 
benefit from more clarification in the Federal guidance. Should that 
occur, we are confident that DHS will continue to work with the private 
sector through the current highly-collaborative process with 
appropriate dialogue on any potential future modifications to the 
guidance.
    Question 2. As a general rule, small- and medium-sized businesses 
do not have the resources to devote to the most advanced, state-of-the-
art information technology systems. As such, they are more likely to 
use older systems even if they exhibit known cybersecurity 
vulnerabilities. In developing its information-sharing program, has DHS 
provided a means for entities that rely on these older systems to share 
and receive threat information, or does their platform require more 
advanced system?
    Answer. It is clearly the case that small communications carriers 
do not possess the same level of technical and financial resources that 
can be devoted exclusively to cybersecurity operations and technologies 
as do the large service providers. Still, they rely on the same vendors 
for hardware and software as their larger peers given that small 
service providers do not have the scope and scale to incent vendors to 
manufacture products specifically for their needs. DHS through the 
National Coordinating Center (NCC) and US-CERT work with the vendor 
community to publicize software updates and vulnerabilities--and this 
information is used by large and small operators alike.
    Implementing Automated Information Sharing (AIS) capabilities for 
small business in the short term is impeded by the fact that most small 
businesses lack the ability to devote limited technical and capital 
resources to fully participate in the program at this juncture. 
However, over time, smaller entities will be likely to pool their 
resources and work through the existing Information Sharing and 
Analysis Centers (ISAC) and the Information Sharing and Analysis 
Organizations (ISAOs) that are currently under development. DHS seems 
to be approaching the implementation of AIS in a correct fashion by 
enrolling entities that have the deep technical know-how and capacity 
to engage operationally and to provide input for enhancing current 
capabilities that ensure that timely and actionable information is made 
available to program participants. We can also report that the 
communications sector, through a pilot effort under the auspices of 
CTIA, is working with a diverse set of industry participants (including 
small providers) to test the capabilities of AIS and the associated 
protocols and make modifications necessary to support 
telecommunications-specific requirements to support automated 
information sharing.
    Question 3. In developing the aforementioned guidance,  103(a)(5) 
specified that the procedures established must facilitate periodic 
circulation of cybersecurity ``best practices'' designed with special 
attention to the accessibility and implementation challenges faced by 
small businesses. Do the policies and procedures described in the 
guidance actually facilitate the development and circulation of best 
practices that are mindful of small business needs?
    Answer. It is commonly understood that the small- and medium-sized 
businesses face substantial burdens when contemplating whether to share 
cyber threat indicators and defensive measures. The human resources and 
financial costs of participation can be daunting. However, we also 
recognize how important the small- and medium-sized businesses are in 
making the information-sharing environment effective. As DHS and 
industry gain a better understanding of the AIS process and its 
associated costs and benefits, small and medium businesses will be 
better-positioned to leverage experiences and lessons learned that are 
likely to be communicated and provided through their ISACs and any ISAO 
in which they participate.
    It is also worth noting that for smaller companies, the current 
guidance does allow for sharing via means outside of the portal 
including via an email or phone call. This is especially important for 
this class of providers who may not be using technologies such as STIX 
and TAXI at this point in time. There needs to be continued flexibility 
inherent in the overall information-sharing process to accommodate the 
needs and capabilities of small- and medium-sized providers.
    DHS might also want to consider convening a workshop with 
representatives of small entities to discuss current capabilities of 
AIS, the requirements to implement for smaller companies, the costs 
associated with implementation, the constraints that small companies 
face, and possible technical, operational, and administrative processes 
that may be streamlined to make participation for small entities more 
feasible.
    Question 4. There is a natural tension between sharing threat 
indicators quickly to facilitate rapid response, and sharing only the 
most valuable information once it has been processed and analyzed. I 
understand that DHS uses the former, emphasizing volume and timeliness. 
Do you prefer this ``time is of the essence'' approach? In other words, 
how useful and actionable is the information you receive from DHS?
    Answer. This may not be an either-or proposition though it is an 
important question. We often talk about information needing to be both 
``timely'' and ``actionable'' which means that information can become 
quickly perishable and while it may be quality information, it may no 
longer be actionable. So it must be recognized that what is most 
important is that the information is accurate and provides the 
necessary context to facilitate specific action. We cannot lose these 
qualities for the sake of expediency.
    The balance between what is timely and what is useful will continue 
to evolve based on the nature of the threat, and the nature of the type 
of information being shared. One of the primary purposes of sharing is 
to involve more parties to evaluate cyber threat indicators and 
defensive measures. As part of the collaborative nature of the 
information-sharing regime, we must all be mindful of the need for 
parties to strike the right balance between ``timely'' and 
``effective'' information-sharing practices.
    Having said that, we do value the DHS view that ``time is of the 
essence'' and over time, we have seen substantial improvements in the 
timeliness and utility of information shared with us by the Government. 
Information received from the Government is one of many resources that 
many of our member companies use as part of their own cybersecurity 
efforts. Generally speaking, we have no significant issues with the way 
that DHS is implementing the information sharing provisions of the Act. 
If issues arise, we expect that DHS and the private sector will address 
them in a collaborative way.
    Question 5. The Cybersecurity Act of 2015 contains numerous 
provisions designed to safeguard privacy and civil liberties by 
requiring, for instance, the scrubbing of personal information. Are 
private-sector organizations using their own systems to fulfill these 
obligations or relying on DHS mechanisms?
    Answer. The structure contemplated by CISA contains multiple layers 
of privacy protections for information sharing with the Federal 
Government and confers responsibilities on both the private sector and 
the Federal Government. The first layer places responsibility on a 
private sector entity sharing information to ensure it reviews the 
information for known personal information of a specific person, and if 
such information is present, that it is connected to a cybersecurity 
threat. Conversely, if it is not, the information must be removed.
    The next layer of responsibility in the private-to-Federal venue is 
on the Federal Government at the point of receipt, and prior to sharing 
with other Federal entities. Our members take the responsibility placed 
upon them very seriously and understand that it is not sufficient or 
legally prudent to merely rely on the Federal Government to conduct its 
privacy review upon receipt of the information.
    Moreover, some of our member companies have established, mature 
information-sharing mechanisms that long pre-date CISA and that also 
include strong privacy protective systems and practices. Those members 
will likely continue to rely on established methods to meet the 
baseline requirements concerning privacy protections under CISA, and to 
also go beyond those baseline requirements. Indeed, some members 
consider one step further than what is required under CISA. Namely once 
it has been established that it is legal under CISA to share cyber 
threat information that contains personal information, they will 
consider whether they should share it or could the cyber threat 
indicator be shared in a meaningful way without personal information? 
Our member companies will also rely on their privacy protective 
policies and practices in the private-to-private information sharing 
context, which does not contemplate DHS involvement or review.
    Finally, the Automated Information Sharing (AIS) system DHS 
established to effectuate its role as the primary automated intake 
portal under CISA by design substantially minimizes the likelihood that 
personal information could, as a technical matter, be conveyed if it is 
not directly related to a cybersecurity threat. The technology, by 
design, adds another layer of privacy protection for companies sharing 
through the portal with DHS.
    I hope that you find this information to be fully responsive to 
your questions.
  Questions From Ranking Member Cedric L. Richmond for Mark G. Clancy
    Question 1a. In accordance with  103 and  105(a)(4) of the 
Cybersecurity Act of 2015 (Pub. L. No. 114-113), on June 15, 2016, the 
Director of National Intelligence, the Secretary of Homeland Security, 
the Secretary of Defense, and the Attorney General issued updated final 
guidance on the sharing of cyber threat indicators and defensive 
measures between and among Federal and non-Federal entities.
    What was your impression of the guidance and are there aspects that 
you find insufficient or impractical?
    Question 1b. In addition to resolving the question of liability 
protections for private-to-private sharing, are there other aspects of 
the DHS guidance that you believe would benefit from additional 
clarity?
    Question 1c. Are there aspects of the law that should be clarified?
    Answer. As you mentioned, the updated guidance issued on June 15, 
2016 on sharing for non-Federal entities \1\ makes the important 
clarification needed about how protections still apply when sharing 
occurs between private-sector entities in Annex 1 ``Sharing of Cyber 
Threat Indicator and Defensive Measure Sharing between Non-Governmental 
Entities under CISA''. The guidance was extremely helpful to provide 
clarification for concerns previously raised with the interim guidance.
---------------------------------------------------------------------------
    \1\ Guidance to Assist Non-Federal Entities to Share Cyber Threat 
Indicators and Defensive Measures with Federal Entities under the 
Cybersecurity Information Sharing Act of 2015, June 2016.
---------------------------------------------------------------------------
    As we have mentioned, we believe the U.S. Department of Homeland 
Security (DHS) has been very helpful in providing updates and 
clarifications. As we consider these questions, there are two areas 
that would also be helpful for DHS to provide some assistance. There 
are other programs within DHS that have been very helpful over time, 
the Cybersecurity Information Sharing and Collaboration Program (CISCP) 
and the Protected Critical Infrastructure Information Program (PCII).
    While CISCP, PCII, and the Cybersecurity Information Sharing Act 
(CISA) have different statutory authorities, and over time were created 
for different reasons, as we consider broader cybersecurity information 
sharing there are overlaps and some growing questions about how the 
private sector should share information and which programs should be 
used.
    First, it would be helpful for DHS to address how the CISCP program 
fits within the scope of the Automation Indicator Sharing (AIS) system 
and with CISA. The CISCP data is available as a separate `feed' on the 
AIS system, however access to this feed requires a Cooperative Research 
and Development Agreement (CRADA) to be in place. Since CISCP is part 
of AIS, that would mean that sharing under CISCP would have the same 
protections under CISA as AIS and it would be important for DHS to 
confirm that point. If that is not accurate, then it would be helpful 
for DHS to provide that clarification in order to ensure that is the 
case.
    Second, as we consider other aspects of the law and cybersecurity 
information sharing with DHS, it would be helpful for DHS to provide 
clarification on how the PCII program currently does, and in the future 
will, work with CISA. While PCII was created many years ago for 
physical events, it has morphed over time to include physical and 
cybersecurity events and is a useful program. Many companies, whether 
large or small, will need to understand and ultimately choose what 
program to share information through and clarification now would be 
important.
    Question 2. As a general rule, small- and medium-sized businesses 
do not have the resources to devote to the most advanced, state-of-the-
art information technology systems. As such, they are more likely to 
use older systems even if they exhibit known cybersecurity 
vulnerabilities. In developing its information-sharing program, has DHS 
provided a means for entities that rely on these older systems to share 
and receive threat information, or does their platform require more 
advanced system?
    Answer. We work closely with a number of small- and medium-sized 
businesses and are providing answers to your questions based on our 
experience working with them. As you may expect, for those companies 
who are small- and medium-sized businesses, they may have different 
perspectives than we do. However, we have a few thoughts and 
suggestions on this question.
    DHS has provided two additional methods for firms unable to use the 
automation to share information with the Department whether firms are 
small-, medium-sized, or larger ones not able to use automation. That 
includes a web submission form and an email box to send submissions. 
Both methods are accessible for small or medium business whether they 
are using older information technology systems or simply choose not to 
use automation. DHS could consider ways to share with organizations how 
that manual information will be shared back. It may also be helpful for 
DHS to provide guidance or best practices on how to craft a good 
submission. In fact, this may be useful for those sharing via an 
automated or manual submission.
    Question 3. In developing the aforementioned guidance,  103(a)(5) 
specified that the procedures established must facilitate periodic 
circulation of cybersecurity ``best practices'' designed with special 
attention to the accessibility and implementation challenges faced by 
small businesses. Do the policies and procedures described in the 
guidance actually facilitate the development and circulation of best 
practices that are mindful of small business needs?
    Answer. One area that may be more challenging for small- and 
medium-sized businesses could be in understanding how to understand and 
manage ``defensive measures.'' The guidance discussed how these will be 
created and what they contain. Small- and medium-sized businesses will 
have different abilities to understand how to manage them when they are 
received and may need additional support to create internal structures 
to implement them. Whether large or small, it would be helpful to have 
a method for providing feedback or surveying recipients (of such 
defensive measures) as to the level of detail that a company finds 
useful or lacking. In other instances in the past, suggestions may come 
from an agency that over-simplifies what defensive measure should be 
taken including ``patch your systems,'' ``update anti-virus,'' or ``use 
a firewall.'' Suggestions for defensive measures from the U.S. 
Government going forward will need to be tailored to the size and 
abilities of the companies.
    It is important to note that many small business use service 
providers to perform some or all of their IT services. These service 
providers are a community to which the Department must engage to 
effectively assist small businesses benefit from the information shared 
via CISA.
    Question 4. There is a natural tension between sharing threat 
indicators quickly to facilitate rapid response, and sharing only the 
most valuable information once it has been processed and analyzed. I 
understand that DHS uses the former, emphasizing volume and timeliness. 
Do you prefer this ``time is of the essence'' approach? In other words, 
how useful and actionable is the information you receive from DHS?
    Answer. There is an inherent tension between sharing quickly and 
sharing the most valuable information that no single approach will 
solve. However, sharing quickly with the ability to revise information 
shared when refined or after feedback from other parties is received is 
the optimal approach. Discussions have been had with DHS about adding 
ways to share confidence ratings within the cyber threat intelligence 
(CTI) AIS system that could be utilized to make the determination of 
how best to act on the information. As a result, CTI could be shared 
but if needed be matched with a lower confidence information versus 
those that may receive a higher high confidence based on information 
that has additional vetting imbedded in it.
    Question 5. The Cybersecurity Act of 2015 contains numerous 
provisions designed to safeguard privacy and civil liberties by 
requiring, for instance, the scrubbing of personal information. Are 
private-sector organizations using their own systems to fulfill these 
obligations or relying on DHS mechanisms?
    Answer. In our experience, the private sector firms Soltra works 
with take privacy very seriously and are taking the necessary steps to 
ensure that scrubbing of information is occurring before information is 
shared under CISA. The final DHS-DOJ guidance also does a good job 
providing examples of the demarcation under CISA on what data points 
may be related to the actual threat and how best to manage that 
process.
    We appreciate all that you do on these issues. If you or your staff 
would like to discuss any of these matters in more detail, please let 
us know.
      Questions From Chairman John L. Ratcliffe for Mordecai Rosen
    Question 1. In your opinion, do DHS's programs to secure Federal 
Information Systems--Einstein and the Continuous Diagnostics and 
Mitigation (CDM) program--together offer a comprehensive solution and a 
defense-in-depth strategy to secure Federal networks?
    Answer. Federal Information Systems are much safer today as a 
result of early implementation of the Einstein and CDM programs. The 
Federal Government has successfully integrated logical access through 
the use of the PIV card for all privileged users and performed an audit 
and reductions of privileged accounts. In particular, OPM has utilized 
the CDM roadmap whereby you start with identifying assets and users, 
then move toward managing behavior.
    Early implementation of the Einstein program has helped Federal 
agencies to detect malicious cyber attacks, and to communicate these 
threats across the Federal Government.
    However, there remain opportunities for improving security through 
automated response and modernization of antiquated legacy systems.
    We think the Cyber Sprint helped improve Government security 
overall as well. Some say we need a marathon and we agree, there is 
much work to do. But, we believe that a long series of tightly measured 
sprints invokes management focus and unmatched operational cadence.
    The Einstein and CDM programs constitute an effective strategy to 
improve Federal agency cybersecurity, with opportunities for continuous 
improvement as technology evolves. However, a plan and strategy are 
inconsequential without deployment. Deployment urgency will remain a 
critical component to maximizing protection of Federal networks.
    Question 2. In your opinion, are DHS's cybersecurity programs for 
both Federal and non-Federal entities flexible and dynamic enough for 
it to leverage emerging cutting-edge technologies and to keep pace with 
the rapidly-evolving cyber threat landscape?
    Answer. CA Technologies believes that DHS has become much stronger 
at engaging with stakeholders and incorporating private-sector input 
into both Federal and non-Federal cybersecurity programs. These include 
the Einstein and CDM programs for Federal agencies and the Automated 
Indicator Sharing (AIS) program for private entities.
    This stakeholder engagement is vital to maintaining flexibility and 
incorporating cutting-edge technologies.
    We believe the major challenge in maintaining pace with the 
evolving cyber threat landscape lies in the procurement, acquisition, 
and deployment process. In particular, we see a need for more and 
better-trained contracting personnel who have a strong understanding of 
modern technologies and are empowered to accelerate deployment of 
technologies under DHS programs.
    Further we, and our technology industry partners, continue to 
advocate for stronger Federal Government alignment with the NIST-
developed Framework for Improving Critical Infrastructure 
Cybersecurity, which envisions dynamic, flexible approaches to 
improving cybersecurity, and calls for continuous improvement based on 
evolving threat dynamics.
    Question 3. A long-term goal of Einstein includes the filtering of 
email, HTTP traffic, and DNS sinkholing. What would your estimation be 
of the other security risks to Federal networks outside filtering 
email, HTTP traffic, and DNS sinkholing?
    Answer. CA Technologies believes that the compromise of digital 
identities will continue to remain a primary security risk. Compromised 
identities have been a common thread in virtually every large network 
breach in recent years, including Federal agency breaches.
    CA believes that identity and access management technologies are 
central to protecting systems, networks, devices, and data. As Federal 
agencies increase their utilization of digital technologies, the 
authentication of persons and the authentication of devices and data 
will remain crucial to protecting Federal networks.
    In addition, authentication of both individuals and data will 
become increasingly important to maintaining the integrity of cyber 
threat information-sharing programs, as they are opened up to multiple 
actors and organizations.
    Further, as the application economy continues to evolve, more 
organizations and governments will be opening up their data sets to 
third parties. Therefore, it will be critical to both effectively 
manage and secure the application programming interfaces that allow for 
these transactions.
  Questions From Ranking Member Cedric L. Richmond for Mordecai Rosen
    Question 1a. In accordance with Sec. 103 and Sec. 105(a)(4) of the 
Cybersecurity Act of 2015 (Pub. L. No. 114-113), on June 15, 2016, the 
Director of National Intelligence, the Secretary of Homeland Security, 
the Secretary of Defense, and the Attorney General issued updated final 
guidance on the sharing of cyber threat indicators and defensive 
measures between and among Federal and non-Federal entities.
    What was your impression of the guidance and are there aspects that 
you find insufficient or impractical?
    Question 1b. In addition to resolving the question of liability 
protections for private-to-private sharing, are there other aspects of 
the DHS guidance that you believe will benefit from additional clarity?
    Question 1c. Are there aspects of the law that should be clarified?
    Answer. CA Technologies would like to congratulate DHS, ODNI, DOD, 
and DOJ on the job they have done in issuing updated final guidance on 
the sharing of cyber threat indicators and defensive measures between 
and among Federal and non-Federal entities.
    The guidance clearly explains the mechanisms for sharing cyber 
threat information with the Federal Government, the requirements for 
removing personally identifiable information, and the liability 
protections that will be afforded to organizations that comply with the 
requirements of the legislation.
    At this point, CA believes that stakeholders would benefit from 
further DOJ and DHS clarification of liability protections for actions 
taken in good faith participation in the information-sharing program. 
The Automated Indicator Sharing (AIS) program envisions a wide volume 
and velocity of shared cyber threat indicator data streams, which will 
require significant analysis in order to make them actionable. It is 
possible that some organizations will act on certain data streams that 
may ultimately prove not to be related to cyber threats, and other 
organizations may miss relevant indicators in the data streams, all 
while participating in good faith. Greater clarification of liability 
protections under these scenarios would benefit participants.
    CA believes this clarification can be provided through DHS and DOJ 
outreach with stakeholders and potentially through further guidance. We 
don't believe the law needs to be clarified at this point.
    Question 2. As a general rule, small- and medium-sized businesses 
do not have the resources to devote to the most advanced, state-of-the-
art information technology systems. As such, they are more likely to 
use older systems even if they exhibit known cybersecurity 
vulnerabilities. In developing its information-sharing program, has DHS 
provided a means for entities that rely on these older systems to share 
and receive threat information, or does their platform require a more 
advanced system?
    Answer. Our sense is that DHS has developed its information-sharing 
program in a way that allows for maximum participation with respect to 
manual sharing of cyber threat indicators. In addition to allowing 
organizations to share indicators through the AIS program, it also 
allows organizations to share cyber threat indicators through a web 
form or email. In order to receive liability protection under the law, 
these organizations will need to remove any personally identifiable 
information (PII) from information they share that they know at the 
time of sharing is not related to a cyber threat. This will require the 
organization to use manual controls or to implement automated controls 
to ensure PII is removed. Automated technologies, such as Application 
Programming Interface management software are available in the 
marketplace for small- and medium-sized businesses.
    In order for small businesses to receive cyber threat indicators 
from the Federal Government in close to real time, they will need to 
sign up to the AIS program. This will require them to acquire a Trusted 
Automated eXchange of Indicator Information (TAXII) client and to 
receive a Public Key Infrastructure (PKI) certificate from an approved 
provider. This may be difficult for some small businesses. We recommend 
that DHS continue to conduct outreach and awareness raising with small 
businesses to help them properly understand how cybersecurity risks 
impact their overall business risk environment. This will help small 
businesses better prioritize cybersecurity investments, including 
potential participation in information-sharing programs.
    Question 3. In developing the aforementioned guidance, Sec. 
103(a)(5) specified that the procedures established must facilitate 
periodic circulation of cybersecurity ``best practices'' designed with 
special attention to the accessibility and implementation challenges 
faced by small businesses. Do the policies and procedures described in 
the guidance actually facilitate the development and circulation of 
best practices that are mindful of small business needs?
    Answer. The guidance titled, ``Sharing of Cyber Threat Indicators 
and Defensive Measures by the Federal Government under the 
Cybersecurity Information Sharing Act of 2015'' included a section on 
periodic sharing of cybersecurity best practices. This section includes 
a listing of many cross-governmental programs, which provide 
cybersecurity guidance. Included in this list of programs are those 
with a focus on small- and medium-sized businesses such as those 
provided by US-CERT, the National Cybersecurity and Communications 
Integration Center (NCCIC), and the Small Business Administration.
    CA believes that facilitating the development and circulation of 
best practices should remain a priority for DHS implementation of the 
Cybersecurity Act of 2015 in order to make Government cybersecurity 
programs more accessible and actionable for the full range of 
stakeholders. We would recommend that DHS continue to flesh out this 
section with additional guidance in future updates.
    Question 4. There is a natural tension between sharing threat 
indicators quickly to facilitate rapid response, and sharing only the 
most valuable information once it has been processed and analyzed. I 
understand that DHS uses the former, emphasizing volume and timeliness. 
Do you prefer this ``time is of the essence'' approach? In other words, 
how useful and actionable is the information you receive from DHS?
    Answer. CA Technologies is not currently a participant in the AIS 
program, however we are in the process of actively exploring 
engagement. At this point, we recognize the importance of emphasizing 
volume and timeliness. In the longer term, we believe it will be 
important to enable automated analysis of data in order to make it more 
actionable for organizations that don't have the resources to process 
and analyze massive data sets. Authentication of both program 
participants and the data that is shared will be a critical factor in 
the successful implementation of this program.
    Question 5. The Cybersecurity Act of 2015 contains numerous 
provisions designed to safeguard privacy and civil liberties by 
requiring, for instance, the scrubbing of personal information. Are 
private-sector organizations using their own systems to fulfill these 
obligations or relying on DHS mechanisms?
    Answer. CA Technologies' understanding of the Cybersecurity Act of 
2015, and its related guidance, is that it requires organizations to 
scrub personal information that they know, at the time of sharing, is 
not related to a cybersecurity threat in order to receive liability 
protection under the law. CA Technologies is not a current participant 
in the AIS program though we are currently actively exploring 
participation. Should we participate in the program, we would use our 
own systems to fulfill privacy obligations before sharing cyber threat 
indicators with the Government.
    As we noted in our answer to question No. 2, there are existing 
technologies available in the marketplace to help organizations filter 
personally identifiable information from data sets before sharing with 
the Government. We anticipate that most organizations will want to 
utilize these automated technologies or will implement manual controls 
to remove personal information before sharing. The DHS mechanisms will 
then provide an additional level of privacy assurance.
     Questions From Ranking Member Cedric L. Richmond for Ola Sage
    Question 1a. In accordance with  103 and  105(a)(4) of the 
Cybersecurity Act of 2015 (Pub. L. No. 114-113), on June 15, 2016, the 
Director of National Intelligence, the Secretary of Homeland Security, 
the Secretary of Defense and the Attorney General issued updated final 
guidance on the sharing of cyber threat indicators and defensive 
measures between and among Federal and non-Federal entities.
    What was your impression of the guidance and are there aspects that 
you find insufficient or impractical?
    Question 1b. In addition to resolving the question of liability 
protections for private-to-private sharing, are there other aspects of 
the DHS guidance that you believe would benefit from additional 
clarity?
    Question 1c. Are there aspects of the law that should be clarified?
    Answer. Response was not received at the time of publication.
    Question 2. As a general rule, small- and medium-sized businesses 
do not have the resources to devote to the most advanced, state-of-the-
art information technology systems. As such, they are more likely to 
use older systems even if they exhibit known cybersecurity 
vulnerabilities. In developing its information-sharing program, has DHS 
provided a means for entities that rely on these older systems to share 
and receive threat information, or does their platform require more 
advanced system?
    Answer. Response was not received at the time of publication.
    Question 3. In developing the aforementioned guidance,  103(a)(5) 
specified that the procedures established must facilitate periodic 
circulation of cybersecurity ``best practices'' designed with special 
attention to the accessibility and implementation challenges faced by 
small businesses. Do the policies and procedures described in the 
guidance actually facilitate the development and circulation of best 
practices that are mindful of small business needs?
    Answer. Response was not received at the time of publication.
    Question 4. There is a natural tension between sharing threat 
indicators quickly to facilitate rapid response, and sharing only the 
most valuable information once it has been processed and analyzed. I 
understand that DHS uses the former, emphasizing volume and timeliness. 
Do you prefer this ``time is of the essence'' approach? In other words, 
how useful and actionable is the information you receive from DHS?
    Answer. Response was not received at the time of publication.
    Question 5. The Cybersecurity Act of 2015 contains numerous 
provisions designed to safeguard privacy and civil liberties by 
requiring, for instance, the scrubbing of personal information. Are 
private-7sector organizations using their own systems to fulfill these 
obligations or relying on DHS mechanisms?
    Answer. Response was not received at the time of publication.

                                 [all]
```