II 

Calendar No. 528 

116TH CONGRESS 

2D SESSION S. 4024 

[Report No. 116–265] 

To establish in the Cybersecurity and Infrastructure Security Agency of 

the Department of Homeland Security a Cybersecurity Advisory Committee. 

IN THE SENATE OF THE UNITED STATES 

JUNE 22, 2020 

Mr. PERDUE (for himself and Ms. SINEMA) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

SEPTEMBER 9, 2020 

Reported by Mr. JOHNSON, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To establish in the Cybersecurity and Infrastructure Security 

Agency of the Department of Homeland Security a Cybersecurity Advisory Committee. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Advisory 

5 Committee Authorization Act of 2020’’. 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•S 4024 RS

1 SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

4 is amended by adding at the end the following: 

5 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 

6 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab7 lish within the Agency a Cybersecurity Advisory Com8 mittee (referred to in this section as the ‘Advisory Com9 mittee’). 

10 ‘‘(b) DUTIES.— 

11 ‘‘(1) IN GENERAL.—The Advisory Committee 

12 may advise, consult with, report to, and make rec13 ommendations to the Director, as appropriate, on 

14 the development, refinement, and implementation of 

15 policies, programs, planning, and training pertaining 

16 to the cybersecurity mission of the Agency. 

17 ‘‘(2) RECOMMENDATIONS.— 

18 ‘‘(A) IN GENERAL.—The Advisory Com19 mittee shall develop, at the request of the Di20 rector, recommendations for improvements to 

21 advance the cybersecurity mission of the Agency 

22 and strengthen the cybersecurity of the United 

23 States. 

24 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT25 TEES.—Recommendations agreed upon by sub26 committees established under subsection (d) for 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•S 4024 RS

1 any year shall be approved by the Advisory 

2 Committee before the Advisory Committee sub3 mits to the Director the annual report under 

4 paragraph (4) for that year. 

5 ‘‘(3) PERIODIC REPORTS.—The Advisory Com6 mittee shall periodically submit to the Director— 

7 ‘‘(A) reports on matters identified by the 

8 Director; and 

9 ‘‘(B) reports on other matters identified by 

10 a majority of the members of the Advisory 

11 Committee. 

12 ‘‘(4) ANNUAL REPORT.— 

13 ‘‘(A) IN GENERAL.—The Advisory Com14 mittee shall submit to the Director an annual 

15 report providing information on the activities, 

16 findings, and recommendations of the Advisory 

17 Committee, including its subcommittees, for the 

18 preceding year. 

19 ‘‘(B) PUBLICATION.—Not later than 180 

20 days after the date on which the Director re21 ceives an annual report for a year under sub22 paragraph (A), the Director shall publish a 

23 public version of the report describing the ac24 tivities of the Advisory Committee and such re25 lated matters as would be informative to the 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•S 4024 RS

1 public during that year, consistent with section 

2 552(b) of title 5, United States Code. 

3 ‘‘(5) FEEDBACK.—Not later than 90 days after 

4 receiving any recommendation submitted by the Ad5 visory Committee under paragraph (2), (3), or (4), 

6 the Director shall respond in writing to the Advisory 

7 Committee with feedback on the recommendation. 

8 Such a response shall include— 

9 ‘‘(A) with respect to any recommendation 

10 with which the Director concurs, an action plan 

11 to implement the recommendation; and 

12 ‘‘(B) with respect to any recommendation 

13 with which the Director does not concur, a jus14 tification for why the Director does not plan to 

15 implement the recommendation. 

16 ‘‘(6) CONGRESSIONAL NOTIFICATION.—Not less 

17 frequently than once per year after the date of en18 actment of this section, the Director shall provide to 

19 the Committee on Homeland Security and Govern20 mental Affairs and the Committee on Appropriations 

21 of the Senate and the Committee on Homeland Se22 curity and the Committee on Appropriations of the 

23 House of Representatives a briefing on feedback 

24 from the Advisory Committee. 

25 ‘‘(c) MEMBERSHIP.— 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•S 4024 RS

1 ‘‘(1) APPOINTMENT.— 

2 ‘‘(A) IN GENERAL.—Not later than 180 

3 days after the date of enactment of the Cyber4 security Advisory Committee Authorization Act 

5 of 2020, the Director shall appoint the mem6 bers of the Advisory Committee. 

7 ‘‘(B) COMPOSITION.—The membership of 

8 the Advisory Committee shall consist of not 

9 more than 35 individuals. 

10 ‘‘(C) REPRESENTATION.— 

11 ‘‘(i) IN GENERAL.—The membership 

12 of the Advisory Committee shall be geo13 graphically balanced and shall include rep14 resentatives of State and local governments 

15 and of a broad range of industries, which 

16 may include the following: 

17 ‘‘(I) Defense. 

18 ‘‘(II) Education. 

19 ‘‘(III) Financial services and in20 surance. 

21 ‘‘(IV) Healthcare. 

22 ‘‘(V) Manufacturing. 

23 ‘‘(VI) Media and entertainment. 

24 ‘‘(VII) Chemicals. 

25 ‘‘(VIII) Retail. 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•S 4024 RS

1 ‘‘(IX) Transportation. 

2 ‘‘(X) Energy. 

3 ‘‘(XI) Information Technology. 

4 ‘‘(XII) Communications. 

5 ‘‘(XIII) Other relevant fields 

6 identified by the Director. 

7 ‘‘(ii) PROHIBITION.—Not more than 3 

8 members may represent any 1 category 

9 under clause (i). 

10 ‘‘(2) TERM OF OFFICE.— 

11 ‘‘(A) TERMS.—The term of each member 

12 of the Advisory Committee shall be 2 years, ex13 cept that a member may continue to serve until 

14 a successor is appointed. 

15 ‘‘(B) REMOVAL.—The Director may review 

16 the participation of a member of the Advisory 

17 Committee and remove such member any time 

18 at the discretion of the Director. 

19 ‘‘(C) REAPPOINTMENT.—A member of the 

20 Advisory Committee may be reappointed for an 

21 unlimited number of terms. 

22 ‘‘(3) PROHIBITION ON COMPENSATION.—The 

23 members of the Advisory Committee may not receive 

24 pay or benefits from the United States Government 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•S 4024 RS

1 by reason of their service on the Advisory Com2 mittee. 

3 ‘‘(4) MEETINGS.— 

4 ‘‘(A) IN GENERAL.—The Director shall re5 quire the Advisory Committee to meet not less 

6 frequently than semiannually, and may convene 

7 additional meetings as necessary. 

8 ‘‘(B) PUBLIC MEETINGS.—At least one of 

9 the meetings referred to in subparagraph (A) 

10 shall be open to the public. 

11 ‘‘(C) ATTENDANCE.—The Advisory Com12 mittee shall maintain a record of the persons 

13 present at each meeting. 

14 ‘‘(5) MEMBER ACCESS TO CLASSIFIED INFOR15 MATION.— 

16 ‘‘(A) IN GENERAL.—Not later than 60 

17 days after the date on which a member is first 

18 appointed to the Advisory Committee and be19 fore the member is granted access to any classi20 fied information, the Director shall determine if 

21 the member should be restricted from review22 ing, discussing, or possessing classified informa23 tion. 

24 ‘‘(B) ACCESS.—Access to classified mate25 rials shall be managed in accordance with ExecVerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024

pamtmann on DSKBC07HB2PROD with BILLS
8 

•S 4024 RS

1 utive Order No. 13526 of December 29, 2009 

2 (75 Fed. Reg 707), or any subsequent cor3 responding Executive Order. 

4 ‘‘(C) PROTECTIONS.—A member of the 

5 Advisory Committee shall protect all classified 

6 information in accordance with the applicable 

7 requirements for the particular level of classi8 fication of such information. 

9 ‘‘(6) CHAIRPERSON.—The Advisory Committee 

10 shall select, from among the members of the Advi11 sory Committee— 

12 ‘‘(A) a member to serve as chairperson of 

13 the Advisory Committee; and 

14 ‘‘(B) a member to serve as chairperson of 

15 each subcommittee of the Advisory Committee 

16 established under subsection (d). 

17 ‘‘(d) SUBCOMMITTEES.— 

18 ‘‘(1) IN GENERAL.—The Director shall establish 

19 subcommittees within the Advisory Committee to ad20 dress cybersecurity issues, which may include the 

21 following: 

22 ‘‘(A) Information exchange. 

23 ‘‘(B) Critical infrastructure. 

24 ‘‘(C) Risk management. 

25 ‘‘(D) Public and private partnerships. 


pamtmann on DSKBC07HB2PROD with BILLS
9 

•S 4024 RS

1 ‘‘(2) MEETINGS AND REPORTING.—Each sub2 committee shall meet not less frequently than semi3 annually, and submit to the Advisory Committee for 

4 inclusion in the annual report required under sub5 section (b)(4) information, including activities, find6 ings, and recommendations, regarding subject mat7 ter considered by the subcommittee. 

8 ‘‘(3) SUBJECT MATTER EXPERTS.—The chair of 

9 the Advisory Committee shall appoint members to 

10 subcommittees and shall ensure that each member 

11 appointed to a subcommittee has subject matter ex12 pertise relevant to the subject matter of the sub13 committee. 

14 ‘‘(e) NONAPPLICABILITY OF FACA.—The Federal 

15 Advisory Committee Act (5 U.S.C. App.) shall not apply 

16 to the Advisory Committee and its subcommittees.’’. 

17 (b) CLERICAL AMENDMENT.—The table of contents 

18 in section 1(b) of the Homeland Security Act of 2002 

19 (Public Law 107–296; 116 Stat. 2135) is amended by in20 serting after the item relating to section 2214 the fol21 lowing: 

‘‘2215. Cybersecurity Advisory Committee.’’. 

22 SECTION 1. SHORT TITLE. 

23 This Act may be cited as the ‘‘Cybersecurity Advisory 

24 Committee Authorization Act of 2020’’. 


pamtmann on DSKBC07HB2PROD with BILLS
10 

•S 4024 RS

1 SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 

4 amended by adding at the end the following: 

5 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 

6 ‘‘(a) ESTABLISHMENT.—The Secretary shall establish 

7 within the Agency a Cybersecurity Advisory Committee (re8 ferred to in this section as the ‘Advisory Committee’). 

9 ‘‘(b) DUTIES.— 

10 ‘‘(1) IN GENERAL.—The Advisory Committee 

11 shall advise, consult with, report to, and make rec12 ommendations to the Director, as appropriate, on the 

13 development, refinement, and implementation of poli14 cies, programs, planning, and training pertaining to 

15 the cybersecurity mission of the Agency. 

16 ‘‘(2) RECOMMENDATIONS.— 

17 ‘‘(A) IN GENERAL.—The Advisory Com18 mittee shall develop, at the request of the Direc19 tor, recommendations for improvements to ad20 vance the cybersecurity mission of the Agency 

21 and strengthen the cybersecurity of the United 

22 States. 

23 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT24 TEES.—Recommendations agreed upon by sub25 committees established under subsection (d) for 

26 any year shall be approved by the Advisory 


pamtmann on DSKBC07HB2PROD with BILLS
11 

•S 4024 RS

1 Committee before the Advisory Committee sub2 mits to the Director the annual report under 

3 paragraph (4) for that year. 

4 ‘‘(3) PERIODIC REPORTS.—The Advisory Com5 mittee shall periodically submit to the Director— 

6 ‘‘(A) reports on matters identified by the 

7 Director; and 

8 ‘‘(B) reports on other matters identified by 

9 a majority of the members of the Advisory Com10 mittee. 

11 ‘‘(4) ANNUAL REPORT.— 

12 ‘‘(A) IN GENERAL.—The Advisory Com13 mittee shall submit to the Director an annual re14 port providing information on the activities, 

15 findings, and recommendations of the Advisory 

16 Committee, including its subcommittees, for the 

17 preceding year. 

18 ‘‘(B) PUBLICATION.—Not later than 180 

19 days after the date on which the Director receives 

20 an annual report for a year under subparagraph 

21 (A), the Director shall publish a public version 

22 of the report describing the activities of the Advi23 sory Committee and such related matters as 

24 would be informative to the public during that 


pamtmann on DSKBC07HB2PROD with BILLS
12 

•S 4024 RS

1 year, consistent with section 552(b) of title 5, 

2 United States Code. 

3 ‘‘(5) FEEDBACK.—Not later than 90 days after 

4 receiving any recommendation submitted by the Advi5 sory Committee under paragraph (2), (3), or (4), the 

6 Director shall respond in writing to the Advisory 

7 Committee with feedback on the recommendation. 

8 Such a response shall include— 

9 ‘‘(A) with respect to any recommendation 

10 with which the Director concurs, an action plan 

11 to implement the recommendation; and 

12 ‘‘(B) with respect to any recommendation 

13 with which the Director does not concur, a jus14 tification for why the Director does not plan to 

15 implement the recommendation. 

16 ‘‘(6) CONGRESSIONAL NOTIFICATION.—Not less 

17 frequently than once per year after the date of enact18 ment of this section, the Director shall provide to the 

19 Committee on Homeland Security and Governmental 

20 Affairs and the Committee on Appropriations of the 

21 Senate and the Committee on Homeland Security and 

22 the Committee on Appropriations of the House of 

23 Representatives a briefing on feedback from the Advi24 sory Committee. 


pamtmann on DSKBC07HB2PROD with BILLS
13 

•S 4024 RS

1 ‘‘(7) GOVERNANCE RULES.—The Director shall 

2 establish rules for the structure and governance of the 

3 Advisory Committee and all subcommittees estab4 lished under subsection (d). 

5 ‘‘(c) MEMBERSHIP.— 

6 ‘‘(1) APPOINTMENT.— 

7 ‘‘(A) IN GENERAL.—Not later than 180 

8 days after the date of enactment of the Cyberse9 curity Advisory Committee Authorization Act of 

10 2020, the Director shall appoint the members of 

11 the Advisory Committee. 

12 ‘‘(B) COMPOSITION.—The membership of 

13 the Advisory Committee shall consist of not more 

14 than 35 individuals. 

15 ‘‘(C) REPRESENTATION.— 

16 ‘‘(i) IN GENERAL.—The membership of 

17 the Advisory Committee shall— 

18 ‘‘(I) consist of subject matter ex19 perts; 

20 ‘‘(II) be geographically balanced; 

21 and 

22 ‘‘(III) include representatives of 

23 State, local, and Tribal governments 

24 and of a broad range of industries, 

25 which may include the following: 


pamtmann on DSKBC07HB2PROD with BILLS
14 

•S 4024 RS

1 ‘‘(aa) Defense. 

2 ‘‘(bb) Education. 

3 ‘‘(cc) Financial services and 

4 insurance. 

5 ‘‘(dd) Healthcare. 

6 ‘‘(ee) Manufacturing. 

7 ‘‘(ff) Media and entertain8 ment. 

9 ‘‘(gg) Chemicals. 

10 ‘‘(hh) Retail. 

11 ‘‘(ii) Transportation. 

12 ‘‘(jj) Energy. 

13 ‘‘(kk) Information Tech14 nology. 

15 ‘‘(ll) Communications. 

16 ‘‘(mm) Other relevant fields 

17 identified by the Director. 

18 ‘‘(ii) PROHIBITION.—Not less than 1 

19 member nor more than 3 members may rep20 resent any 1 category under clause (i)(III). 

21 ‘‘(iii) PUBLICATION OF MEMBERSHIP

22 LIST.—The Advisory Committee shall pub23 lish its membership list on a publicly avail24 able website not less than once per fiscal 


pamtmann on DSKBC07HB2PROD with BILLS
15 

•S 4024 RS

1 year and shall update the membership list 

2 as changes occur. 

3 ‘‘(2) TERM OF OFFICE.— 

4 ‘‘(A) TERMS.—The term of each member of 

5 the Advisory Committee shall be 2 years, except 

6 that a member may continue to serve until a 

7 successor is appointed. 

8 ‘‘(B) REMOVAL.—The Director may review 

9 the participation of a member of the Advisory 

10 Committee and remove such member any time at 

11 the discretion of the Director. 

12 ‘‘(C) REAPPOINTMENT.—A member of the 

13 Advisory Committee may be reappointed for an 

14 unlimited number of terms. 

15 ‘‘(3) PROHIBITION ON COMPENSATION.—The 

16 members of the Advisory Committee may not receive 

17 pay or benefits from the United States Government by 

18 reason of their service on the Advisory Committee. 

19 ‘‘(4) MEETINGS.— 

20 ‘‘(A) IN GENERAL.—The Director shall re21 quire the Advisory Committee to meet not less 

22 frequently than semiannually, and may convene 

23 additional meetings as necessary. 


pamtmann on DSKBC07HB2PROD with BILLS
16 

•S 4024 RS

1 ‘‘(B) PUBLIC MEETINGS.—At least one of 

2 the meetings referred to in subparagraph (A) 

3 shall be open to the public. 

4 ‘‘(C) ATTENDANCE.—The Advisory Com5 mittee shall maintain a record of the persons 

6 present at each meeting. 

7 ‘‘(5) MEMBER ACCESS TO CLASSIFIED INFORMA8 TION.— 

9 ‘‘(A) IN GENERAL.—Not later than 60 days 

10 after the date on which a member is first ap11 pointed to the Advisory Committee and before 

12 the member is granted access to any classified 

13 information, the Director shall determine, for the 

14 purposes of the Advisory Committee, if the mem15 ber should be restricted from reviewing, dis16 cussing, or possessing classified information. 

17 ‘‘(B) ACCESS.—Access to classified mate18 rials shall be managed in accordance with Exec19 utive Order No. 13526 of December 29, 2009 (75 

20 Fed. Reg. 707), or any subsequent corresponding 

21 Executive Order. 

22 ‘‘(C) PROTECTIONS.—A member of the Ad23 visory Committee shall protect all classified in24 formation in accordance with the applicable reVerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6203 E:\BILLS\S4024.RS S4024

pamtmann on DSKBC07HB2PROD with BILLS
17 

•S 4024 RS

1 quirements for the particular level of classifica2 tion of such information. 

3 ‘‘(D) RULE OF CONSTRUCTION.—Nothing in 

4 this paragraph shall be construed to affect the se5 curity clearance of a member of the Advisory 

6 Committee or the authority of a Federal agency 

7 to provide a member of the Advisory Committee 

8 access to classified information. 

9 ‘‘(6) CHAIRPERSON.—The Advisory Committee 

10 shall select, from among the members of the Advisory 

11 Committee— 

12 ‘‘(A) a member to serve as chairperson of 

13 the Advisory Committee; and 

14 ‘‘(B) a member to serve as chairperson of 

15 each subcommittee of the Advisory Committee es16 tablished under subsection (d). 

17 ‘‘(d) SUBCOMMITTEES.— 

18 ‘‘(1) IN GENERAL.—The Director shall establish 

19 subcommittees within the Advisory Committee to ad20 dress cybersecurity issues, which may include the fol21 lowing: 

22 ‘‘(A) Information exchange. 

23 ‘‘(B) Critical infrastructure. 

24 ‘‘(C) Risk management. 

25 ‘‘(D) Public and private partnerships. 


pamtmann on DSKBC07HB2PROD with BILLS
18 

•S 4024 RS

1 ‘‘(2) MEETINGS AND REPORTING.—Each sub2 committee shall meet not less frequently than semi3 annually, and submit to the Advisory Committee for 

4 inclusion in the annual report required under sub5 section (b)(4) information, including activities, find6 ings, and recommendations, regarding subject matter 

7 considered by the subcommittee. 

8 ‘‘(3) SUBJECT MATTER EXPERTS.—The chair9 person of the Advisory Committee shall appoint mem10 bers to subcommittees and shall ensure that each 

11 member appointed to a subcommittee has subject mat12 ter expertise relevant to the subject matter of the sub13 committee.’’. 

14 (b) CLERICAL AMENDMENT.—The table of contents in 

15 section 1(b) of the Homeland Security Act of 2002 (Public 

16 Law 107–296; 116 Stat. 2135) is amended by inserting 

17 after the item relating to section 2214 the following: 

‘‘Sec. 2215. Cybersecurity Advisory Committee.’’. 


pamtmann on DSKBC07HB2PROD with BILLS

pamtmann on DSKBC07HB2PROD with BILLS
Calendar No. 528 

116TH CONGRESS 

2D SESSION S. 4024 

[Report No. 116–265] 

A BILL 

To establish in the Cybersecurity and InfrastrucCommittee. Homeland Security a Cybersecurity Advisory ture Security Agency of the Department of 

SEPTEMBER 9, 2020 

Reported with an amendment 


pamtmann on DSKBC07HB2PROD with BILLS