```

[Senate Hearing 114-733]
[From the U.S. Government Publishing Office]

 
  DEPARTMENT OF HOMELAND SECURITY APPROPRIATIONS FOR FISCAL YEAR 2016

                              ----------                              

                       WEDNESDAY, APRIL 15, 2015

                                       U.S. Senate,
           Subcommittee of the Committee on Appropriations,
                                                    Washington, DC.
    The subcommittee met at 2:15 p.m., in room SD-138, Dirksen 
Senate Office Building, Hon. John Hoeven (chairman) presiding.
    Present: Senators Hoeven, Cochran, and Shaheen.

                    DEPARTMENT OF HOMELAND SECURITY

STATEMENT OF HON. ANDY OZMENT, ASSISTANT SECRETARY, 
            OFFICE OF CYBERSECURITY AND COMMUNICATION, 
            NATIONAL PROTECTION AND PROGRAMS 
            DIRECTORATE

                opening statement of senator john hoeven

    Senator Hoeven. I would like to call this meeting of the 
Department of Homeland Security Appropriations Subcommittee to 
order. I would like to welcome Ranking Member Senator Shaheen 
and also our full committee Appropriations Chairman, Senator 
Cochran. I appreciate very much you being here, as well as our 
three witnesses.
    This hearing, of course, is on cybersecurity. Cybersecurity 
is one of the most complex and challenging threats currently 
facing our Nation. Today, we will examine the role of the 
Department of Homeland Security (DHS) in our Nation's 
cybersecurity efforts, specifically its responsibilities for 
securing the dot-gov domain, protecting critical 
infrastructure, and facilitating and conducting robust 
information sharing.
    I'm pleased to welcome our witnesses Andy Ozment, the 
Assistant Secretary of the Office of Cybersecurity and 
Communications from the National Protection and Programs 
Directorate (NPPD) within DHS; Luke McCormack, the DHS Chief 
Information Officer (CIO); and Greg Garcia, Executive Director 
of the Financial Services Sector Coordinating Council.
    The focus of today's hearing, as I noted, is DHS's role in 
cybersecurity. First and foremost, DHS is responsible for 
protecting the dot-gov domain. Through NPPD, DHS secures dot-
gov by providing overarching services and capabilities and best 
practices that agencies are required to deploy to protect their 
agencies' information technology (IT) infrastructure and 
systems.
    While there is a roadmap to accomplish this mission, I 
understand DHS still has work to do to fully deploy 
capabilities to ensure each agency is protecting its data.
    At the same time, we must ensure departments and agencies 
across government are appropriately funded to operate and 
support their own IT infrastructure and systems. Each Chief 
Information Officer (CIO) bears responsibility to their 
customers and data. That includes the DHS CIO with us today.
    We will discuss in detail programs such as Einstein for 
intrusion detection and prevention, continuous diagnostics for 
monitoring activity within systems, and incident reporting 
through US-CERT's online system.
    Cybersecurity efforts are substantial and growing. In 
fiscal year 2015, Congress provided $12.4 billion for 
cybersecurity across the government. DHS is responsible for 11 
percent or $1.4 billion of that funding, largely due to its 
responsibility for securing dot-gov.
    DHS's second cybersecurity mission is supporting critical 
infrastructure protection. DHS leverages its experience in 
deploying capabilities for dot-gov in supporting protection of 
critical infrastructure. At the same time, the role is very 
different, as 85 percent of U.S. critical infrastructure is 
privately held. Robust public-private partnerships are the 
cornerstone of this responsibility.
    No discussion of cybersecurity would be complete, however, 
without mentioning the Department's third mission area, the 
dissemination of cyber threat and incident information. Yet 
again, this is not a mission that DHS can own exclusively and 
execute alone. The intelligence community and national defense 
apparatus has access to information significant to detecting 
U.S. cyber-interests broadly. They struggle with how to best 
share that information while protecting sources and methods.
    Conversely, private sector entities are often the first to 
realize something wrong is happening in cyberspace and can 
alert the government and their peers.
    For those reasons, both the government and the private 
sector need the right information sharing mechanisms and 
capabilities. Timely, actionable information needs to flow in 
all directions. There is no silver bullet. Responding to the 
threat will require visionary leadership on the part of the 
Department; the government as a whole; and State, local, and 
private sector partners. Parochial interests and bureaucratic 
process should not be allowed to stand in the way of progress.
    With strong detection, prevention, mitigation, and 
information sharing efforts, we can address evolving threats 
head on and work toward a more robust cybersecurity 
environment. And I look forward to your recommendations, to 
that end.
    This is a complicated area, but it is one of great priority 
right now.
    Let me also note that this date marks a solemn anniversary. 
Two years ago today, the city of Boston suffered a terrible 
terrorist attack. The Senate will be observing a moment of 
silence at 2:49, the time of the attack. With the indulgence of 
Senator Shaheen and our witnesses, we will do the same during 
this hearing. So we will notify you at that time, 2:49, and 
there will be a moment of silence.
    With that, I would like to turn to the ranking member of 
the committee. She and I just returned from a visit of the 
southern border, including Houston, McAllen, Laredo, and San 
Antonio. I appreciate very much your going. I think it was very 
informative.
    There is a lot going on when it comes to DHS. Whether it is 
border security or cybersecurity, this is complicated stuff. 
And we need good people doing a good job, so we want to do 
everything we can to help and support, in terms of doing the 
best possible job of funding that effort.
    With that, I will turn to Ranking Member Shaheen.

                  statement of senator jeanne shaheen

    Senator Shaheen. Thank you very much, Mr. Chairman. As you 
point out, we had a fascinating and informative trip to the 
southern border. And while border security, obviously, was a 
topic of conversation throughout the trip, cybersecurity didn't 
come up much, so we look forward to hearing from each of our 
panelists today.
    I also, like you, Mr. Chairman, say how much I appreciate 
Chairman Cochran being here for this hearing. It is always nice 
to have the full committee represented when we are having a 
subcommittee hearing.
    And I also very much appreciate your mentioning that this 
is the 2-year anniversary of the Boston Marathon bombing. We 
had a number of New Hampshire folks who were injured in that 
bombing, so it is something that we feel very personally 
throughout New England, and I know through the rest of the 
country. So I am very appreciative that we will all be pausing 
to remember and acknowledge the bombing and its victims.
    As the Chairman pointed out, the Department of Homeland 
Security's role in cybersecurity is very complex and 
multifaceted, and the agency's effort should be carefully 
coordinated with other Federal agencies, with all government 
organizations, and, of course, with the private sector.
    Cybersecurity is at the forefront of our national 
consciousness, and we hear every day about another 
cybersecurity challenge.
    On the news this morning, there was a report about the 
potential vulnerability of cockpits because of the ability to 
hack into security networks. So this is an issue that, as all 
of you know, is on the front pages every day. Anybody who has 
seen the news knows that the Federal Government, private 
companies, academic institutions, individuals, no one is free 
from the potential of a cyberattack.
    Now, through this hearing, we hope to focus on DHS's role 
in protecting the Nation from cyberattacks, and I look forward 
to discussing the National Protection and Programs Directorate 
(NPPD) activities and how partners such as Federal agencies and 
the private sector use their programs. In addition, we will 
hear from DHS's chief information officer on how his office 
partners with the NPPD to stay ahead of cyber threats.
    The Department is also helping secure our Nation by the 
work of its various law enforcement agencies tasked with 
tracking down cybercriminals, and the Science and Technology 
Directorate, which is working to develop and improve 
technologies that protect our information systems.
    And I have to say, I had a fascinating briefing earlier 
this week on our efforts internationally to work with other 
governments on securing cyber networks.
    The Office of Management and Budget (OMB) reports that the 
President's cybersecurity request for fiscal year 2016 is $13.9 
billion, an 11-percent increase. Of this total, $1.4 billion is 
requested for DHS programs, including protection, 
investigations, and science and technology. And much of the 
requested funding will be dedicated to programs that help us 
both catch up and keep up with the daily threat from 
cyberattacks.
    Now, since the Internet was developed with an open 
architecture, we are retroactively addressing security 
vulnerabilities through major programs, such as intrusion 
detection and continuing diagnostics, and these efforts are 
important. Investments that mitigate future risks are equally 
important. We should focus on future workforce needs and 
support businesses by ensuring the development of quality 
cybersecurity products and encouraging the use of best 
practices.
    It is concerning that budget pressures are forcing us to 
focus more on immediate needs rather than also making the 
necessary investments that will save us money and prevent 
attacks in the future.
    So again, thank you all for being here today. I look 
forward to hearing what you have to say and to an exchange, 
following your remarks.
    Thank you, Mr. Chairman.
    Senator Cochran. Mr. Chairman.
    Senator Hoeven. I would now like to recognize the chairman 
of the full Appropriations Committee and thank Senator Cochran 
for joining us.
    Senator Cochran.

                   statement of senator thad cochran

    Senator Cochran. Mr. Chairman, thank you. I am very pleased 
to join you and other members of this panel to discuss with the 
Department of Homeland Security experts here what we should 
know about cybersecurity, what we should appreciate the 
opportunity to learn, what Congress as a principal part of the 
decision-making process should be considering in terms of 
funding, in terms of legal authority to act on behalf of our 
Nation's interests in cybersecurity, and exactly what we should 
do about the challenges that we face.
    Senator Hoeven. Thank you, Mr. Chairman. And again, thanks 
for joining us.
    We will go with 5-minute rounds for the questions, but, 
first, of course, we will start with your prepared statements.
    So Mr. Ozment, if you would like to proceed?

                 summary statement of hon. andy ozment

    Mr. Ozment. Thank you. Chairman Cochran, Chairman Hoeven, 
Ranking Member Shaheen, thank you for your unwavering support 
for the Department of Homeland Security and the National 
Protection and Programs Directorate, or NPPD. We look forward 
to continuing this cooperation as we work to secure and enhance 
the resilience of our Nation's cyber and physical 
infrastructure.
    Speaking to our cyber mission, we view ourselves as a 
customer service organization with three customers: the Federal 
Government civilian and executive branch; State, local, tribal, 
and territorial governments; and the private sector. In helping 
these three customers manage their cybersecurity risks, we 
focus on three areas.
    The first is to implement best practices, particularly 
through the cybersecurity framework. And these best practices, 
we believe that companies and agencies should invest at least 
70 percent of their effort in the space. The second is robust 
information-sharing in near real-time whenever possible, and we 
believe that companies and agencies should be investing about 
25 percent of their effort in this space. And the final area is 
effective incident response, where companies should invest the 
final 5 percent or so of their effort.
    These are ballpark figures, but my idea here is to give you 
a sense of the magnitude and relative effort that should be 
expended. We know that best practices alone can defeat the vast 
majority of cyber threats and force our adversaries to pay 
more, frankly, for the benefits that they are hoping to obtain.
    I will focus my remarks today on two of our three 
customers, the Federal civilian executive branch and the 
private sector. And, of course, two of my customers are, in 
fact, testifying with me here today.
    Regarding our Federal agency customers, I would like to 
highlight three key initiatives. First, we measure and motivate 
agency cybersecurity. Second, we provide tools and services to 
identify network security issues. And third, we provide a 
baseline of security across the Federal civilian executive 
branch through the Einstein program. I will explain each of 
these a bit further.
    Last year, Congress gave us new authorities to help measure 
and motivate agency cybersecurity through the Federal 
Information Security Modernization Act, or the modernization of 
FISMA. We are now working closely with the Office of Management 
and Budget, the National Institute for Standards and 
Technology, and the Federal CIO Council to implement these 
authorities and to help Federal agencies better understand and 
manage their own risks.
    To the second point, our Continuous Diagnostics and 
Mitigation program, or CDM, serves Federal executive branch 
civilian agencies with tools and services to identify network 
security issues and prioritize their mitigation.
    I am delighted to announce that, just yesterday, we awarded 
a new task order to seven large agencies that cover 47 percent 
of the Federal civilian government by personnel. So in total, 
55 percent of the Federal civilian government has now received 
awards for CDM tools and services.
    This is the award. The actual deployment of these tools and 
services will take some months yet, but this is a major 
milestone to have achieved.
    We are requesting $103 million for CDM in fiscal year 2016.
    Finally, in the best practices realm for Federal 
departments and agencies, I would like to highlight our 
Einstein program, otherwise known as the National Cybersecurity 
Protection System. Einstein 1 and 2 provide intrusion detection 
services, so that is where we identify the bad guys and set off 
an alarm. Einstein 3 provides an intrusion protection service, 
where it actually blocks malicious actors from intruding upon 
or attacking the Federal Government.
    The Einstein program provides a first line of defense 
against cyber threats. Einstein 3 uses classified and 
unclassified information to block cyber espionage and attacks. 
It is also a platform upon which we can build future security 
capabilities that adapt to emerging cybersecurity risks and 
that help us take advantage of the innovation the private 
sector can provide.
    We look forward to working with Congress to further clarify 
DHS authority to deploy Einstein 3A across Federal executive 
branch civilian departments and agencies.
    Now let me switch my focus to the private sector. For the 
Federal Government, our mission includes directly protecting 
departments and agencies. For the private sector, our mission 
is to help companies better secure themselves. Through our C-
Cubed Voluntary Program, we encourage organizations to adopt 
the cybersecurity framework as part of an enterprise risk 
management approach.
    We also perform risk assessments with and for companies. 
These risk assessments give us data on the state of industry 
and help individual parts of our infrastructure understand and 
manage cyber risks. We have invested an additional $4 million 
in fiscal year 2016 to double the number of cybersecurity risk 
assessments this program can help to provide our private-sector 
partners.
    I now would like to highlight three information-sharing 
programs that we offer to help the private sector. The first, 
the cyber information-sharing and collaboration program, allows 
DHS to share cybersecurity formation in near real-time with 
critical infrastructure partners. In this program, we built a 
pilot automated information-sharing program with the FS-ISAC, 
and I expect that my partner up here, Greg Garcia, may also 
speak to that.
    We also offer Enhanced Cybersecurity Services, or ECS, 
which allows us to share classified and unclassified threat 
indicators with cybersecurity companies, who then use that 
information to protect their private-sector customers.
    We have requested nearly $17 million in additional funds 
for fiscal year 2016 to expand the ECS program.
    Finally, we are working to foster Information-Sharing and 
Analysis Organizations to address the private sector's request 
for more flexible information-sharing organizations and clear 
best practices for those organizations. And we are requesting 
$2 million in fiscal year 2016 for the program.

                           prepared statement

    I would like to close by thanking members of the 
subcommittee for your help in passing five pieces of historic 
cybersecurity legislation this past year. In the interest of 
time, I will leave additional description of our efforts and of 
the NCCIC, our National Cybersecurity and Communications 
Integration Center, for your questions.
    Thank you.
    [The statement follows:]

                 Prepared Statement of Hon. Andy Ozment
                              introduction
    Chairman Hoeven, Ranking Member Shaheen, and distinguished Members 
of the Subcommittee, let me begin by thanking you for the unwavering 
support that you provide to the Department of Homeland Security (DHS) 
and the National Protection and Programs Directorate (NPPD). We look 
forward to continuing to work with you in the coming year to ensure a 
homeland that is safe, secure, and resilient against terrorism, cyber 
attacks, natural disasters, and other risks.
    NPPD undertakes its cybersecurity activities within its overarching 
mission to secure and enhance the resilience of the Nation's cyber and 
physical infrastructure. We view ourselves as a customer service 
organization, and our customers are Federal Executive Branch civilian 
departments and agencies, private sector infrastructure owners and 
operators, and State, local, tribal, and territorial (SLTT) 
governments.
    In serving these customers, our guiding principles are: prioritize 
our customers' needs to build and retain their trust; ensure privacy 
and civil rights across the depth and breadth of our cyber and 
communications activities; and enable continuous improvement in 
emergency communications and cybersecurity to stay ahead of malicious 
actors.
    I will focus my remarks today on the Office of Cybersecurity and 
Communications (CS&C's) approach to service and capabilities. This 
includes the technical tools we use in protecting our Federal agency 
customers; CS&C's incident response capabilities that we deploy to both 
public and private entities to ensure critical infrastructure 
resilience; and how we help entities protect themselves, in particular 
our work to ensure that we help private sector and SLTT customers 
better manage their risks.
                   protecting the federal government
    Across the Federal Government, each department and agency is 
responsible for managing its own cybersecurity. However, under the 
Federal Information Security Modernization Act (FISMA) of 2014, DHS is 
provided with the authority to administer the implementation of Federal 
cybersecurity policies. In order to carry out this important 
responsibility, DHS is authorized to issue binding operational 
directives, monitor agency cybersecurity practices, and provide 
operational and technical assistance. NPPD's strategy to implement its 
FISMA authorities is to measure and motivate improved cybersecurity 
among Federal agencies through partnerships with the Office of 
Management and Budget, the National Institute of Standards and 
Technology, and the Federal CIO Council, and to build technical systems 
that provide a baseline of cybersecurity across the Government.
CDM: Helping Federal Agencies Understand and Manage Cyber Risk
    Through the Continuous Diagnostics and Mitigation (CDM) program, 
DHS provides Federal Executive Branch civilian agencies with tools and 
services to identify network security issues, including unauthorized 
and unmanaged hardware and software; known vulnerabilities; weak 
configuration settings; and potential insider attacks. Agencies can 
then prioritize mitigation of these issues based upon potential 
consequences or likelihood of exploitation. In this way, CDM helps 
agencies understand and manage their own cyber risks.
    DHS is moving aggressively to implement CDM across all Federal 
Executive Branch civilian agencies, and Memoranda of Agreement (MOA) 
with the CDM program cover over 97 percent of all Federal civilian 
personnel. Delivery Order 1, the first award under the CDM/Continuous 
Monitoring as a Service (CMaaS) blanket purchase agreement was for 
$59.5 million to purchase CDM tools for 21 agencies; this procurement 
demonstrated a 30 percent cost reduction over General Services 
Administration (GSA) pricing and resulted in $26 million in cost 
avoidance. A subsequent award was made for license maintenance of the 
tools procured in Delivery Order 1 that reflected a 50 percent cost 
reduction over GSA pricing. The first of six awards for Task Order 2 
was made in February 2015 and will provide CDM tools and services to 
DHS itself. Additional awards will be issued through fiscal year (FY) 
2015 and fiscal year 2016, and ultimately will cover over 60 additional 
Federal agencies including 23 of the 24 Chief Financial Officer Act 
agencies. Department of Defense, the 24th CFO Act agency, does not 
participate in the CDM-funded solicitation activities.
    The CDM Federal Dashboard will provide DHS with summary data to 
understand relative and system risk across the Executive Branch. Local 
agency dashboards will provide each agency with detailed information 
into its specific, prioritized risks. Both dashboards will use 
commercial off-the-shelf technology. The agency-level dashboards will 
begin deployment in fiscal year 2015, and the Federal dashboard is 
expected to fully deploy by fiscal year 2017.
    These dashboards will receive automated feeds from the CDM tools 
and will provide a new level of rigor and timeliness to our 
understanding of Federal agency cyber risk.
E \3\A: Detecting and Blocking Threats Against Federal Networks
    Another tool utilized by NPPD to fulfill its mission is EINSTEIN 3 
Accelerated (E \3\A). E \3\A is a perimeter defense tool: a first line 
of defense against cyber threats for Federal civilian Departments and 
Agencies. E \3\A can be considered a set of security gates on the 
Federal Government's traffic, located at the handful of Internet 
Service Providers (ISPs) that are used by almost every Federal civilian 
agency to access the Internet. DHS has completed building E3A 
checkpoints at two ISPs: therefore, agencies that currently use these 
two ISPs to connect to the Internet are now able to obtain E \3\A 
protection. These security gates only apply to traffic transiting to 
and from Federal civilian executive branch agencies. A Privacy Impact 
Assessment (PIA) for E \3\A was published by DHS in 2013 to publicly 
document how privacy protections have been integrated into the E \3\A 
process. This PIA is available through the Department's publicly-facing 
website.
    E \3\A uses classified and unclassified information to block cyber 
espionage and attacks, including by our most sophisticated adversaries. 
E \3\A currently provides two protection capabilities (Domain Name 
Server (DNS) Sinkholing and Email Filtering) that have been found to be 
highly effective in detecting and blocking known threats, thereby 
protecting against those adversaries about whom the Government has 
identified telltale attributes. The Domain Name Server (DNS) Sinkholing 
capability allows DHS to prevent malware installed on .gov networks 
from communicating with known or suspected malicious Internet domains 
(sinkhole information) by redirecting the network connection away from 
the malicious domain to ``safe servers'' or ``sinkhole servers,'' thus 
preventing further malicious activity by the installed malware. The 
Email Filtering capability allows DHS to scan email destined for .gov 
networks for malicious attachments, Uniform Resource Locators (URL), 
and other forms of malware, before being delivered to .gov end-users.
    Currently, approximately 26 percent of Federal civilian personnel 
are protected by at least one of E \3\A's capabilities. Recently, a 
second ISP completed its build-out of E \3\A, so now the capacity 
exists to protect almost 50 percent of Federal civilian personnel. To 
take advantage of that new capacity, the newly covered agencies must 
sign an MOA and restructure their networks to ensure they can receive 
the full suite of E \3\A capabilities. Agencies will be onboarded in 
stages, and each onboarding is expected to take several weeks. As of 
April 3, 2015, 51 agencies have signed MOAs to participate in E \3\A 
services, and those agencies include approximately 96 percent of all 
Federal civilian personnel. We are continuing to work with the other 
major ISPs used by the Federal Government to build E \3\A capabilities 
at those ISPs as well.
    E \3\A also provides a platform on which DHS can build future 
protection capabilities that adapt to emerging security risks, allowing 
future innovation from both government and industry. It is a unique 
system that utilizes classified information to protect unclassified 
network traffic for Federal Civilian Executive Branch networks and 
allows DHS to better detect, respond to, and appropriately counter 
known or suspected cyber threats identified within the Federal network 
traffic it monitors.
    Moreover, E \3\A is allowing DHS to create situational awareness of 
cyber threats by screening Federal agency Internet traffic for cyber 
threats across multiple agencies, enabling strong correlation of events 
and the ability to provide early warning and greater context about 
emerging risks. As the Department detects and stops adversaries' 
attacks with E \3\A, we will take the knowledge we gain and share it 
with the private sector and SLTT governments, meeting their information 
needs in a manner that is consistent with the protection of privacy and 
civil liberties. They will be able to use this information to better 
protect themselves.
    Obtaining the MOAs necessary to deploy E \3\A services has been 
time consuming, and not all agencies are ready to sign them. Some 
agencies, in some cases, have questioned how deployment of EINSTEIN 
under DHS authority interplays with their existing statutory 
restrictions on the use and disclosure of agency data. As a result of 
this uncertainty, DHS has not been able to achieve 100 percent 
commitment from agencies to enter into authorizing the deployment of 
EINSTEIN capabilities to protect their systems. DHS and the 
Administration have sought statutory changes to clarify this 
uncertainty and to enable agencies to disclose their network traffic to 
DHS for narrowly tailored purposes to protect agency networks, while 
making clear that privacy protections for the data would remain in 
place. Moreover, as E \3\A's capabilities evolve, the MOAs will need to 
be updated. We look forward to working with Congress to further clarify 
DHS's authority to deploy this protective technology to Federal 
Executive Branch civilian systems.
    Looking toward the future, NPPD is advancing its protective 
capabilities to detect not only known cyber threats, but also recognize 
potential threats that have not been previously observed. Just as the 
human body achieves resilience by fighting new viruses with biological 
mechanisms that recognize when the body is under attack, DHS seeks to 
build similar mechanisms for networks using mathematical trend analysis 
of cyber events. We will collect the data needed for this from the 
government agencies that we protect, following the privacy protections 
detailed in our publicly available PIAs. The concept comprises the 
ability to view the current state of cybersecurity, just as a 
traditional weather map provides a view of current weather. Our long-
term goal is for networks and connected devices to know when to reject 
incoming traffic or even refuse to execute specific computer 
instructions because they are recognized as harmful due to their 
current behavior, even if the exact computer ``disease'' has not been 
seen before. This will help to create the resilience to deter many 
cyber threat actors by increasing the costs of individual cyber 
attacks.
  enhancing information sharing to reduce the frequency and impact of 
                            cyber incidents
    The National Cybersecurity & Communications Integration Center 
(NCCIC) serves as a 24x7 centralized location for cybersecurity 
information sharing, incident response, and incident coordination. 
NCCIC partners include all Federal departments and agencies, including 
law enforcement, the Department of Defense, the Intelligence Community; 
SLTT governments; the private sector; and international entities. The 
NCCIC provides its partners with enhanced situational awareness of 
cybersecurity and communications incidents and risks, and it provides 
timely information to manage vulnerabilities, threats, and incidents. 
In 2014, the NCCIC received over 97,000 incident reports, and issued 
nearly 12,000 actionable cyber-alerts or warnings. NCCIC teams also 
detected over 64,000 vulnerabilities on Federal and non-Federal systems 
and directly responded to 115 significant cyber incidents.
    An example of the NCCIC's support to and collaboration with the 
private sector was the effort to mitigate Distributed Denial of Service 
(DDoS) incidents impacting U.S. banking institutions in 2012 and 2013. 
During the DDoS attacks, the NCCIC disseminated technical data and 
assistance--including 600,000 DDoS-related Internet Protocol (IP) 
addresses and supporting contextual information--to Federal agencies, 
critical infrastructure partners, international partners, and US-based 
ISPs. This information helped financial institutions and cybersecurity 
service providers improve their defensive capabilities and detect or 
block threats before financial services were impacted. In addition to 
sharing with relevant private sector entities, the NCCIC shared 
information with over 120 international partners, many of whom 
contributed to our mitigation efforts. The NCCIC, along with the U.S. 
Secret Service, FBI and other interagency partners, also deployed to 
affected entities to offer on-site technical assistance.
    For fiscal year 2016, NPPD requested an additional $10.412 million 
and 35 FTP/19 FTE to develop situational awareness and infrastructure 
analysis. This increased funding will support 24/7 operations for an 
Integrated Analysis Cell, increased software and tool support for 
forensic analysis, increased resources for incident response, and 
improved architecture to drive cybersecurity solutions.
      helping the private sector and sltt governments manage risk
    NPPD helps the Nation's infrastructure owners and operators protect 
themselves by offering our customers risk assessments and assistance 
via the Critical Infrastructure Cyber Community (C3) Voluntary Program. 
NPPD assists all 16 critical infrastructure sectors with risk 
management activities, including supporting the use of the NIST 
Cybersecurity Framework for Critical Infrastructure (the Framework). 
NPPD is requesting additional resources in support of the Framework to 
allow the C3 Voluntary Program to double the number of cybersecurity 
risk assessments provided to critical infrastructure owners and 
operators. These assessments provide critical infrastructure owners and 
operators with invaluable information about their cybersecurity posture 
in relation to the Framework, and they offer concrete areas for 
improvement. This budget request will extend the reach of the C3 
Voluntary Program, promote adoption of the Framework, and build the 
security and resilience of the nation's critical infrastructure.
    Separately, NPPD is requesting $16.901 million for the Enhanced 
Cybersecurity Services (ECS) program. ECS has similar capabilities to E 
\3\A. However, unlike E \3\A, it is available to validated critical 
infrastructure companies and SLTT customers. ECS shares sensitive 
unclassified and classified cyber threat indicators with qualified 
Commercial Service Providers (CSPs) that then use that data to protect 
their ECS customers. All payment and contractual relationships occur 
between an ECS customer and their service provider devoid of any DHS 
involvement. The Federal Government deals directly with the CSPs and 
not their end customers. The Federal Government's role is limited to 
ensuring CSPs meet the program security requirements for receiving 
sensitive unclassified and classified Government Furnished Information, 
providing timely and vetted cyber threat information to the qualified 
service providers, and receiving anonymous, aggregated data back from 
the service providers about the number of malicious activities detected 
by their ECS systems. Through their respective CSPs, ECS customers can 
decide whether any data is shared back to the Department. The privacy 
and civil liberties considerations for the program are detailed in the 
ECS PIA available on DHS's publicly-facing website and in a Privacy and 
Civil Liberties assessment mandated by Executive Order 13636 and made 
publicly available on the DHS Privacy Office website. This budget 
request will fund additional cybersecurity analysts to provide new 
threat and network analysis, and it will expand the ECS program to an 
increased number of CSPs.
                         congressional support
    I would like to take this opportunity to thank the members of this 
Committee, and Congress as a whole, for the passage of five pieces of 
legislation this past year that have significant implications for 
cybersecurity. The passage of these bills represents a historic and 
momentous accomplishment for our Directorate. These bills contribute to 
the safety, security, and resilience of our Nation's digital networks 
and critical infrastructure. Simply put, they will make our nation 
safer. They include:
  --The National Cybersecurity Protection Act of 2014, which provides 
        explicit authority for DHS to provide assistance to the private 
        sector in identifying vulnerabilities and restoring their 
        networks following an attack, and establishes in law the NCCIC 
        as a Federal civilian interface with the private sector.
  --The Federal Information Security Modernization Act of 2014, which 
        statutorily establishes DHS authority to administer the 
        implementation of Federal information security policies, 
        develop and oversee implementation of binding cybersecurity 
        directives, provide technical assistance to other agencies 
        through US-CERT, and deploy cybersecurity technology to other 
        agencies upon their request.
  --Two bills that help DHS continue to recruit, hire, and retain the 
        best and brightest cybersecurity workforce. In fiscal year 
        2016, NPPD is requesting $16.238 million to support 
        cybersecurity pay reform as part of DHS' efforts to improve its 
        cybersecurity workforce.
  --Separately, apart from our cybersecurity authorities, a four-year 
        authorization for the Chemical Facility Anti-Terrorism 
        Standards (CFATS) program, which significantly improves our 
        ability to work with the private sector on security at high-
        risk chemical facilities.
    Thank you for the opportunity to appear before you today. I look 
forward to answering any questions you may have about my testimony or 
NPPD's cyber activities. Additionally, before I conclude, I'd like to 
encourage those members who have not yet been able to visit the NCCIC 
or who have not been by recently to contact us to arrange a tour. A 
visit to the facility is a great way to better understand how NPPD 
works to secure our customers and respond to incidents across the 
Nation.

    Senator Hoeven. Thank you.
    Mr. McCormack.
STATEMENT OF LUKE McCORMACK, CHIEF INFORMATION OFFICER
    Mr. McCormack. Thank you, Chairman Cochran, Chairman 
Hoeven, Ranking Member Shaheen, and members of the 
subcommittee. Thank you for this opportunity to speak to you 
about cybersecurity at the Department of Homeland Security.
    In the following remarks, I will focus on the role and 
responsibility of the DHS chief information officer to defend 
the Department's information systems from cyberattacks and how 
the Nation's cybersecurity is strengthened through ongoing 
collaboration with our components, with NPPD, and across the 
Federal Government.
    The Office of the Chief Information Officer implements 
information security programs at the Department level. It 
provides oversight to more than 90 major IT (information 
technology) programs across the Department's seven operational 
components and headquarters offices. Because of our size and 
mission diversity, we have some unique challenges and 
opportunities for success.
    The Department's leadership is strengthening a 
collaborative environment and culture within DHS, especially 
across planning, budgeting, and acquisition oversight processes 
through the Secretary's signature Unity of Effort initiative.
    With this as our foundation, the CFO (Chief Financial 
Officer) and CIO councils work together to clearly define 
budgetary needs for cybersecurity efforts in 2016 and into the 
near future. Just as NPPD coordinates the Federal response to 
cyber incidents, we collaborate with them on many Federal 
cybersecurity programs, oftentimes while they are still in 
development. Through early adoption, we provide feedback to 
NPPD on products and programs before they are more widely 
implemented across the Federal Government.
    Our organization also collaborates prominently across the 
Federal IT community to address challenges and share our cyber 
experience.
    I would like to share a few of the highlights of some of 
our critical cyber programs and initiatives.
    DHS is a major partner in the Federal Risk and 
Authorization Management Program, commonly referred to as 
FedRAMP. FedRAMP provides a standardized approach for accessing 
and monitoring the security capability of cloud service 
providers. It then certifies those capabilities. Using this 
``do once, use many times'' framework, departments and agencies 
can then leverage the certification, reducing their cost and 
reducing their time-to-market for service delivery.
    Along with the Department of Defense (DOD) and the General 
Services Administration (GSA), DHS serves as one of the tri-
chairs of the FedRAMP Joint Authorization Board, the primary 
governance and decisionmaking body for this program. We have 
requested a program increase of $2.6 million in fiscal year 
2016 to support FedRAMP as cloud computing expands and our 
engagement intensifies.
    Again, as an early adopter partnering with NPPD, the 
Department was the first agency to contract for Continuous 
Diagnostic and Mitigation. CDM uses real-time data to provide 
stakeholders with tools to detect and counteract day-to-day 
cyber threats. This real-time information will be available on 
an agency-level dashboard that will alert us to critical cyber 
risks, providing situational awareness across the Department.
    Our CDM capabilities are complemented by ongoing 
authorization. Ongoing authorization allows us to focus our 
attention on the most critical system security controls, so we 
can make data-driven and timely risk management decisions. With 
CDM and ongoing authorization, DHS is leveraging technology and 
risk-based decisionmaking to strengthen our security posture 
and target our resource capabilities.
    Another important initiative to strengthen our security is 
the Intrusion Defense Chain, or IDC. Cyberattacks are more than 
isolated activities. They often occur in phases that are 
repeated and reused. The DHS IDC methodology uses lessons from 
past attacks to anticipate the direction of future attacks.

                           PREPARED STATEMENT

    We continue to enhance our remediation of known 
vulnerabilities across the Department. It is because of these 
efforts that the President's fiscal year 2016 budget includes 
$31.7 million for mission-essential cybersecurity remediation. 
We also requested $16.2 million to implement an enterprise 
single sign-on ability. This will strengthen our ability to 
prevent unwarranted access to mission-critical systems.
    Cyber-defense is not purely technical. Attracting, 
training, and retaining quality IT professionals is critical to 
the long-term success of our mission. DHS has developed and 
implemented a number of initiatives, beginning with the hiring 
process and extending throughout an employee's career.
    I appreciate your time and attention, and I look forward to 
addressing your questions and concerns.
    [The statement follows:]
                  Prepared Statement of Luke McCormack
                              introduction
    Chairman Hoeven, Ranking Member Shaheen, and Members of the 
Subcommittee: Thank you for this opportunity to speak to you about 
cybersecurity at the Department of Homeland Security. As you are aware, 
it is vital for our Department and the Federal Government to defend our 
systems against cyber-attacks. The Office of the Chief Information 
Officer (CIO), in close coordination with the National Protection and 
Programs Directorate (NPPD) ensures that our Nation is secure and able 
to stay ahead of cyber threats.
    In the following remarks, I will focus on the roles and 
responsibilities of the Office of the Chief Information Officer to 
ensure the Department's information is safe from cyber-attacks, and how 
the nation's cybersecurity is strengthened through ongoing 
collaboration with our components, with NPPD, and across-government. I 
will also highlight some of the Department's ongoing and future 
cybersecurity initiatives.
                         the role of cio at dhs
    As the DHS Chief Information Officer, my role is to implement 
information security programs at the Department level. My office's 
mission is to develop and maintain a single, Department-wide 
information technology (IT) infrastructure that is reliable, scalable, 
flexible, maintainable, accessible, and secure. I provide oversight to 
over 90 major IT programs across the Department's seven operational 
components and Headquarters offices. Because of our size and mission 
diversity, we have some unique challenges and opportunities for 
success.
                        dhs ocio and components
    The Department's leadership recognizes the importance of 
strengthening a collaborative environment and culture within DHS, 
especially across programming, budgeting, and acquisition oversight 
processes. On April 22, 2014, the Secretary signed a memo entitled 
Strengthening Departmental Unity of Effort. Through this Unity of 
Effort initiative, we are:
  --Actively supporting the Joint Requirements Council (JRC)--a body 
        that develops recommendations for investment, as well as 
        changes to training, organization, legislation, and operational 
        processes and procedures;
  --Enhance the Department's programming and budgeting process; and
  --Actively collaborating with our component counterparts to drive 
        efficiencies and improve effectiveness.
    Using Unity of Effort as our foundation, the Councils of the CFO 
and CIO--bodies comprised of the chief financial and chief information 
officers from across DHS-worked collaboratively to clearly define 
budgetary needs for cybersecurity efforts in 2016 and into the near 
future. It is because of these efforts that the President's budget 
includes $31.7 million for essential cybersecurity remediation 
initiatives in fiscal year 2016.
    The Unity of Effort also resulted in updating the DHS IT Strategic 
Plan. It is a focused, mission-driven, achievable plan that positions 
our technology environment to address the critical areas of people and 
culture, innovative technologies, cybersecurity, and governance and 
accountability. As part of that IT Strategic Plan, the CIO Council 
developed a specific cybersecurity goal: to ``Empower DHS and its 
partners to operate secure IT systems and networks, keeping ahead of 
evolving cyber threats.'' Additionally the CIO Council is supported on 
all matters of cybersecurity by another cross-Department council 
comprised of the Chief Information Security Officers from Headquarters 
and our components.
                          partnering with nppd
    NPPD's role is to enhance the security, resilience, and reliability 
of the nation's cyber and communications infrastructure. NPPD 
coordinates the Federal response to cyber incidents, and leads efforts 
to protect the Federal ``.gov'' domain, and collaborates with the 
``.com'' domain to increase the security of critical networks. Due to 
our partnership with NPPD we are able to internally implement and 
collaborate on many Federal cybersecurity programs, sometimes while 
they are still in development. By taking on the role of an early 
adopting agency, we provide valuable feedback to NPPD on products and 
programs before they are more widely implemented across government. For 
example, we are currently working with NPPD to test the Continuous 
Diagnostics and Mitigation (CDM) dashboard. Through collaboration of 
this nature, DHS strengthens its cybersecurity posture across 
government to serves as an initiator and leader in Federal 
cybersecurity efforts.
              cross-government expertise and collaboration
    In addition, my office contributes cybersecurity expertise to the 
Federal IT community. Two of the areas where we are working with 
colleagues across government are to enhance security of mobile 
applications and standardizing the approach for assessing and 
monitoring the security of cloud products and services.
Secure Mobility
    Directly related to the Presidential memorandum issued on May 23, 
2012, entitled, Building a 21st Century Digital Government, the Federal 
CIO Council has been charged with identifying solutions to challenges 
that prevent progress in IT delivery. One such challenge is ensuring 
the rapid adoption of mobile technologies while maintaining a security 
posture appropriate to the agency's mission. To address this, the 
Federal CIO Council established a Mobile Technology Tiger Team. DHS co-
chairs the tiger team, which recently unveiled a set of criteria to be 
used in validating security for mobile applications. This effort 
provides consistency across the Federal Government and allows industry 
to better meet the needs of Federal customers. As additional Federal 
agencies adopt the criteria, mobile application development will be 
more secure and predictable.
The Federal Risk and Authorization Management Program (FedRAMP)
    DHS is a major partner in the Federal Risk and Authorization 
Management Program (FedRAMP). FedRAMP provides a standardized approach 
for assessing and monitoring the security of cloud products and 
services and will significantly reduce the time-to-market for 
Departments and Agencies as they implement cloud computing. Testing and 
authorizing a cloud provider is performed once and is shared multiple 
times across the government. This reduces both time and cost by reusing 
the authorization of a cloud provider, and introduces competition in 
the cloud market.
    DHS was engaged in FedRAMP from its inception, contributing to the 
development of its security standards. Along with the Department of 
Defense and the General Services Administration, DHS serves as one of 
the tri-chairs of the FedRAMP Joint Authorization Board, the primary 
governance and decisionmaking body for the program. DHS provides 
technical reviews of cloud service provider proposals for the board. As 
more of government moves to cloud services and our engagement 
intensifies, we see an expected program increase of $2.6 million in 
fiscal year 2016 to support FedRAMP.
                     dhs cybersecurity initiatives
    As you know, Congress passed two key pieces of legislation that 
greatly enhances our ability to shape and resource cybersecurity 
initiatives. Both the 2014 Federal Information Security Modernization 
Act (FISMA) and the Federal Information Technology Acquisition Reform 
Act (FITARA) will strengthen our ability, as a Department, to respond 
and establish stronger guidance and controls.
  --The 2014 Federal Information Security Modernization Act allows for 
        more nimble and risk-based security assessments and compliance. 
        It defines roles and responsibilities for cybersecurity within 
        the Federal Government. FISMA frames information security in a 
        more modern and efficient fashion.
  --FITARA strengthens the role of Departmental CIOs. It ensures that 
        all IT investments are be reviewed by the CIO prior to 
        acquisition. This is vital to reduce duplication of IT systems, 
        provide high-value services, and ensure the continued ability 
        to proactively combat cyber-attacks.
Continuous Diagnostics and Mitigation Program
    The Department was the first agency to contract Continuous 
Diagnostics and Mitigation. As an early adopter, the Department expects 
to see positive impacts to how we detect and counteract cyber threats. 
CDM uses real-time data to provide stakeholders with the tools needed 
to protect their networks and enhance their ability to detect and 
counteract day-to-day cyber threats. The CDM capabilities feed into 
agency-level dashboards that alert us to critical cyber risks in near 
real time.
    DHS is currently testing the CDM dashboard in two operational 
instances. This enables the system stakeholders to readily identify 
which network security issues to address first, enhancing the overall 
security posture of agency networks in hours instead of days. The CDM 
dashboard will provide extensive visibility across the DHS enterprise.
Ongoing Authorization
    Originally, a system's Authority to Operate was granted every 3 
years after a large paper-based security controls review. This 
triennial paper-based process will evolve to the Ongoing Authorization 
(OA) program. OA uses real-time event-driven data from CDM sensors to 
alert on dynamic, risk-based events. OA delivers effective, timely, 
event-driven security services to Federal IT systems.
    DHS is a role model for the implementation of OA across the Federal 
government. Our OA program continues to expand. Seventy systems were 
enrolled in the program before the end of fiscal year 2014, exceeding 
the goal of 50. Currently, 82 systems are enrolled.
Security Operations Center
    Like other Departments, DHS uses a federated architecture that 
relies on mission-focused components leveraging their intimate 
knowledge of their missions to police their networks. The DHS Security 
Operations Center (SOC) aggregates these data feeds to create a 
holistic view of the DHS enterprise. The Department's SOC monitors the 
enterprise network and reports all cyber incidents to the United States 
Computer Emergency Readiness Team (US-CERT) under NPPD. Additionally, 
the DHS Chief Information Security Officer provides advanced threat 
investigation services.
    As our adversaries continue to evolve and become more 
sophisticated, we must evolve as well. To do this, we anticipate 
additional investment in cyber counterintelligence services like 
Focused Operations.
Intrusion Defense Chain
    Cyber attacks are more than isolated activities. They often occur 
in phases, in a chain of offensive events that are repeated, reused, 
and predictable. In 2013, we began implementing and refining the 
Intrusion Defense Chain (IDC) into our security operations. The DHS IDC 
methodology uses the attackers' tactics against them. It hardens the 
Department's defenses based on what we learn from evaluating all the 
links of their previous attacks.
    The IDC allows us to use what we learn from past attacks to bolster 
our defenses and identify areas that might need future investment. 
Defending the Department is a full-time effort and the IDC helps to 
provide us with an advantage tactically and financially.
Strengthening the IT Workforce
    Workforce planning at DHS is an inclusive process involving top 
management support with input from human resources, program management, 
budget, acquisition, and legal partners. It is the responsibility of 
every DHS component to support and ensure that effective workforce 
plans are prepared, implemented with action plans, monitored, and 
evaluated.
    Attracting, training, and retaining quality IT professionals is 
critical to the long-term success of our mission. To attract IT 
professionals with cutting-edge skills in emerging technologies 
necessary to address cybersecurity future needs, DHS has developed and 
implemented a number of initiatives:
  --The CyberSkills Management Support Initiative develops and executes 
        Department-wide human capital strategies, policies, and 
        programs that will create, enhance, and support a top-notch DHS 
        cyber workforce.
  --The DHS IT Human Capital Strategy outlines IT career paths and 
        enables DHS to more formally address how new workers can 
        progress along a technical or managerial career track. As part 
        of this strategy, DHS is leveraging developmental, mentoring, 
        and rotational programs.
  --The DHS IT Immersion Program provides newly-hired employees with a 
        formal path to learning about IT across DHS components, and to 
        engage with senior leadership and colleagues about career 
        management, component activities, and working in DHS IT. This 
        supports a true IT culture, including mentoring and educational 
        opportunities.
    The Department continues to explore possibilities to collaborate on 
ways to create a community of high-performing IT professionals.
                               conclusion
    I appreciate your time and attention, and I look forward to 
addressing your questions and concerns.

    Senator Hoeven. Mr. Garcia.
STATEMENT OF GREG GARCIA, EXECUTIVE DIRECTOR, FINANCIAL 
            SERVICES SECTOR COORDINATING COUNCIL
    Mr. Garcia. Thank you, Chairman Hoeven, Chairman Cochran, 
Ranking Member Shaheen. Thanks for inviting me to testify. 
Today, I will discuss the DHS role in cybersecurity and its 
partnership with the private sector. But first, I will just 
take a few minutes to describe how the financial sector deals 
with threats and vulnerabilities to our critical financial 
infrastructure.
    The Financial Services Sector Coordinating Council, or 
FSSCC, was established in 2002 and includes 65 of the largest 
financial firms and associations. It was formed under the 
critical infrastructure protection framework first developed by 
Presidential Directive 63 in 1998. That directive was since 
amended in 2003 and again in 2013.
    The FSSCC mission is to coordinate the sector-wide efforts 
to strengthen the resiliency of our critical financial 
infrastructure against threats and vulnerabilities. In 
practice, this means that we work with government and other 
partners on information-sharing content and procedures, 
incident response, cyber and operational risk management best 
practices, and policy options to support the above objectives.
    To achieve these objectives, the FSSCC focuses on the 
longer term policy and strategy options. And the tactical and 
operational engagement is performed by the Financial Services 
Information-Sharing and Analysis Center, or the FS-ISAC. This 
is one of our member organizations under the FSSCC umbrella.
    The FS-ISAC manages a formal structure for collecting, 
analyzing, and sharing actionable intelligence and best 
practices. This sharing is done within the sector and with our 
industry, government, and law enforcement partners.
    Indeed, we have learned over the years that strong risk 
management includes participating in communities of trust that 
share information on cyber and physical threats, on 
vulnerabilities and incidents. And this is based on the simple 
concept of strength in numbers. Call it a neighborhood watch or 
common situational awareness.
    So now on DHS programs, our financial institutions, whether 
they are companies or industry associations, participate in a 
variety of strategic and information-sharing programs operated 
by DHS. For example, we have a physical presence in the 
National Cybersecurity and Communications Integration Center, 
or NCCIC, which Andy Ozment described in his statement. 
Supplementing our NCCIC presence is the DHS Cyber Information-
Sharing and Collaboration Program, or CISCP. Our sector 
participants consider the CISCP program valuable for fusing and 
accelerating threat analysis and our time to respond. This is a 
good tool.
    Also useful is the Critical Infrastructure Cyber Community, 
C-Cubed Voluntary Program, again, which Dr. Ozment described. 
This supplements the NIST cybersecurity framework and assists 
our industry stakeholders with risk assessments.
    The Office of Cyber and Infrastructure Analysis helps 
critical sectors evaluate those cross-sector interdependencies, 
and they are currently doing an assessment between financial 
services and the telecommunications infrastructure in the 
Chicago area.
    The FSSCC also has developed a research and development 
agenda that is highlighting the priority R&D initiatives that 
we believe will enhance the protection of our critical 
financial infrastructure. I am happy to submit the agenda for 
the record.
    Referencing this agenda, we have consulted with the DHS 
Science and Technology Directorate over time to help inform 
their funding priorities.
    In the area of physical resiliency, the sector works 
closely with the National Infrastructure Coordinating Center, 
the NICC.
    Most recently, the financial sector has been planning and 
executing a series of sector-wide cyber-exercises that test our 
ability to share information and respond to critical incidents 
with our government partners. The DHS NCCIC management and 
operations team has been an important partner in this process. 
They have helped develop scenarios, supported the actual 
exercise, and contributed to the after-action reports.
    DHS also funded development of an open specification for 
automated threat information sharing that Dr. Ozment referred 
to. It is called STIX and TAXII.
    The financial sector leveraged that tool to develop a 
capability known as Soltra Edge. It automates threat sharing 
and analysis, and it speeds our time to decision and mitigation 
from days to hours and minutes.
    This tool is extremely powerful and getting more so, and it 
is available to anyone in the financial sector and in other 
sectors. There has already been a substantial amount of uptake 
since its formal launch in December of last year.
    Now I will wrap-up with some concluding observations.
    First, if Congress were to pass legislation facilitating 
information sharing, DHS could receive a new influx of cyber-
threat information from the private sector. A lot of these 
liabilities go away in incentives for more information sharing. 
But this in turn would intensify the already pressing need for 
DHS to be able to process and act on that intelligence. That is 
going to require more personnel who are well-trained in 
cybersecurity and in the critical infrastructure sectors that 
they serve. And it requires robust, well-managed programs to 
develop analytical and best practices guidance for the 
community, particularly at the unclassified level. I believe 
these requirements apply not only to senior DHS management, but 
to thoughtful congressional oversight as well.
    Overall, our assessment is that the financial sector's 
relationship with DHS is productive and directionally positive. 
We are showing tangible successes that are improving the 
protection and resilience of our critical financial 
infrastructure. Where there are programmatic gaps or 
implementation deficiencies in the partnership, they are 
mutually acknowledged and addressed.
    On a personal note, I will just say as the first person to 
hold the position of Assistant Secretary at the Department of 
Homeland Security that Andy Ozment now occupies, I just want to 
congratulate Assistant Secretary Ozment for continuing the 
momentum that we had begun in a previous administration. They 
have improved on the initiatives that we started and have 
embarked on new initiatives and new innovations in customer 
service, as Andy put it.
    And I also thank Congress for recognizing the critical 
importance of this issue and funding it accordingly. If only I 
had the money in 2008 that Andy has in 2015.
    Ultimately, we recognize that, as our joint effort matures 
over time, we are never done, we are only better. And we are 
getting better.
    Mr. Chairman, that concludes my oral remarks, and I will be 
happy to answer questions.
    [The statement follows:]
                Prepared Statement of Gregory T. Garcia
    Chairman Hoeven, Ranking Member Shaheen, and Members of the 
Subcommittee, thank you for this opportunity to address the 
Subcommittee about funding the DHS role in cybersecurity and its 
partnership with the private sector.
    My name is Gregory T. Garcia. I am the Executive Director of the 
Financial Services Sector Coordinating Council (FSSCC), which was 
established in 2002 and involves 65 of the largest financial services 
providers and industry associations representing clearinghouses, 
commercial banks, credit card networks and credit rating agencies, 
exchanges/electronic communication networks, financial advisory 
services, insurance companies, financial utilities, government-
sponsored enterprises, investment banks, merchants, retail banks, and 
electronic payment firms.
    The FSSCC was established in accordance with the critical 
infrastructure protection framework promulgated first in Presidential 
Decision Directive 63 in 1998, which was superseded in 2003 by Homeland 
Security Presidential Directive 7 and in 2013 by Presidential Policy 
Directive 21.
    FSSCC membership includes critical financial enterprises and their 
industry associations whose responsibility and commitment to the 
protection of our sector is commensurate with their substantial 
importance to the resilience of the national and global economy.
    As with many industry associations, its governing structure 
includes a rotating chairmanship and an executive committee, with 
numerous outcome-oriented working groups focused on specific 
deliverables to achieve the organization's objectives.
    The current chairman, serving the first year of his 2 year term, is 
Russell Fitzgibbons, theChief Risk Officer and Executive Vice President 
of The Clearing House.
    What I will cover today is an overview of the financial sector's 
tactical and strategic components, and how we manage cyber risk with 
the Department of Homeland Security, the Treasury Department, and other 
key government and industry partners.
                             fsscc mission
    The mission of the FSSCC is to strengthen the resiliency of the 
financial services sector against attacks and other threats to the 
nation's critical infrastructure by proactively identifying threats and 
promoting protection, driving preparedness, collaborating with the 
Federal government, and coordinating crisis response for the benefit of 
the financial services sector, consumers and the nation. During the 
past decade, this strategic partnership has continued to grow, in terms 
of the size and commitment of its membership and the breadth of issues 
it addresses.
    In simplest terms, members of the FSSCC assess security and 
resiliency trends and policy developments affecting our critical 
financial infrastructure, and coordinate among ourselves
    and with our partners in government and other sectors to develop a 
consolidated point of view and coherent strategy for dealing with those 
issues.
    Accordingly, our sector's primary objectives are to:
    1. Implement and maintain structured routines for sharing timely 
and actionable information related to cyber and physical threats and 
vulnerabilities among firms, across sectors of industry, and between 
the private sector and government.
    2. Improve risk management capabilities and the security posture of 
firms across the financial sector and the service providers they rely 
on by encouraging the development and use of common approaches and best 
practices.
    3. Collaborate with homeland security, law enforcement and 
intelligence communities, financial regulatory authorities, other 
industry sectors, and international partners to respond to and recover 
from significant incidents.
    4. Discuss policy and regulatory initiatives that advance 
infrastructure resiliency and security priorities through robust 
coordination between government and industry.
    We have learned over the years that a strong risk management 
strategy for cyber and physical protection involves participating in 
communities of trust that share information related to threats, 
vulnerabilities, and incidents affecting those communities. That 
foundation is based on the simple concepts of strength in numbers, the 
neighborhood watch, and shared situational awareness.
    Accordingly, we partner with the Department of Treasury as our 
sector specific agency, the Department of Homeland Security, law 
enforcement, the intelligence community, other critical sectors, and 
financial regulatory agencies forming our Government Coordinating 
Council counterpart--called the Financial and Banking Information 
Infrastructure Committee (FBIIC).
    Together we are undertaking numerous initiatives to:
  --Improve Information sharing content and procedures between 
        government and the sector;
  --Conduct joint exercises to test our resiliency and information 
        sharing procedures under differing scenarios;
  --Prioritize critical infrastructure protection research and 
        development funding needs
  --Engage with other critical sectors and international partners to 
        better understand and leverage our interdependencies;
  --Advocate broad adoption of the NIST Cybersecurity Framework, 
        including among small and mid-sized financial institutions 
        across the country; and
  --Develop best practices guidance for operational risk issues 
        involving third party risk, supply chain, and cyber insurance 
        strategies.
 financial sector partnership with the department of homeland security
    Of particular relevance to the topic of this hearing, financial 
sector stakeholders participate in a variety of strategic and 
information sharing programs operated by the Department of Homeland 
Security. For example:
  --The financial sector and Treasury Department maintain a physical 
        presence within the DHS National Cybersecurity and 
        Communications Integration Center (NCCIC), which serves as a 
        hub for sharing information related to cybersecurity and 
        communications incidents across sectors, among other roles and 
        responsibilities.
  --Supplementing our information sharing engagement within NCCIC is 
        the DHS Cyber Information Sharing and Collaboration Program 
        (CISCP) which enables collaborative threat analysis between 
        industry and government in an operational environment that 
        speeds time to response.
  --Also useful to the financial sector, particularly smaller community 
        institutions, is the Critical Infrastructure Cyber Community 
        (C3, or ``C-Cubed'') Voluntary Program, which supplements the 
        NIST Cyber Security Framework, and provides guidance on how 
        institutions can improve their cyber risk management programs, 
        regardless of size and sophistication.
  --The Office of Cyber & Infrastructure Analysis helps critical 
        sectors evaluate cross sector interdependencies with risk and 
        threat assessments, and is currently undertaking an 
        interdependency assessment between financial services and 
        telecommunications infrastructure in the Chicago area.
  --The financial sector has developed a research and development (R&D) 
        agenda highlighting the priority R&D initiatives we believe 
        will enhance protection of our critical financial 
        infrastructure, and we have consulted with the DHS Science and 
        Technology Directorate to help inform their funding priorities.
  --The sector also works closely with the National Infrastructure 
        Coordinating Center (NICC), the dedicated 24/7 coordination and 
        information sharing operations center that maintains 
        situational awareness of the nation's critical infrastructure 
        for the Federal government.
  --Most recently, the financial sector has begun planning and 
        executing a series of sector-wide cyber exercises that test our 
        ability to share information and respond to critical incidents 
        collaboratively with our government partners. The DHS NCCIC 
        management and operations team has been an important partner in 
        this process, as have the Treasury Department and other key 
        government stakeholders, lending their expertise and resources 
        toward developing the scenarios and supporting the execution 
        and after-action reports of the exercises.
  --Through the promulgation of DHS-funded open specifications for 
        automated threat information sharing, the Financial Services 
        Information Sharing and Analysis Center (FS-ISAC) has developed 
        a capability that is widely used by the financial sector and 
        other sectors. Known as Soltra Edge, this tool automates threat 
        sharing and analysis and speeds time to decision and mitigation 
        from days to hours and minutes. I will discuss FS-ISAC 
        activities in more detail below.
    In sum, the financial sector has been able to benefit substantially 
from its close information sharing relationship with DHS.
          fs-isac information sharing programs and operations
    For the financial sector, the primary community of trust for 
critical financial infrastructure protection is the Financial Services 
Information Sharing and Analysis Center, or FS-ISAC, which is the 
tactical and operational organization that informs the FSSCC's 
strategic policy mission.
    The FS-ISAC was formed in 1999 in response to the 1998 Presidential 
Decision Directive 63 (PDD 63), which called for the public and private 
sectors to work together to address physical and cyber threats to the 
nation's critical infrastructures. This role was reinforced after 9/11, 
and in response to Homeland Security Presidential Directive 7 (and its 
2013 successor, Presidential Policy Directive 21) and the Homeland 
Security Act.
    The FS-ISAC is a 501(c)6 nonprofit organization and is funded 
entirely by its member firms and sponsors. In 2004, there were 68 
members, mostly larger financial services firms. Since that time, the 
membership has expanded to more than 5000 organizations including 
commercial banks and credit unions of all sizes, brokerage firms, 
insurance companies, data security payments processors, and 24 trade 
associations representing virtually all of the U.S. financial services 
sector.
    Since its founding, the FS-ISAC's operations and culture of trusted 
collaboration have evolved into what we believe is a successful model 
for how other industry sectors can organize themselves around this 
security imperative. The overall objective of the FS-ISAC is to protect 
the financial services sector against cyber and physical threats and 
risk. It acts as a trusted third party that provides anonymity to allow 
members to share threat, vulnerability and incident information in a 
non-attributable and trusted manner. The FS-ISAC provides a formal 
structure for valuable and actionable information to be shared among 
members, the sector, and its industry and government partners, which 
ultimately benefits the nation. FS-ISAC information sharing activities 
include:
  --Delivery of timely, relevant and actionable cyber and physical 
        email alerts from various sources distributed through the FS-
        ISAC Security Operations Center (SOC);
  --An anonymous online submission capability to facilitate member 
        sharing of threat, vulnerability, incident information and best 
        practices in a non-attributable and trusted manner;
  --Support for attributable information exchange by various special 
        interest groups including the FSSCC, the FS-ISAC Threat 
        Intelligence Committee, threat intelligence sharing open to the 
        membership, the Payment Processors Information Sharing Council 
        (PPISC), the Clearing House and Exchange Forum (CHEF), the 
        Business Resilience Committee, and the Payments Risk Council;
  --Bi-weekly threat information sharing calls for members and invited 
        security/risk experts to discuss the latest threats, 
        vulnerabilities and incidents affecting the sector;
  --Emergency threat or incident notifications to all members using the 
        Critical Infrastructure Notification System (CINS); and
  --Participation in various cyber exercises such as those conducted by 
        DHS (Cyber Storm I, II, and III) and support for FSSCC 
        exercises such as the Hamilton series, CyberFIRE and Quantum 
        Dawn.
                          fs-isac partnerships
    The FS-ISAC works closely with various government agencies 
including the Department of Treasury, DHS, Federal Reserve, Federal 
Financial Institutions Examination Council (FFIEC) regulatory agencies, 
United States Secret Service, Federal Bureau of Investigation (FBI), 
the intelligence community, and state and local governments.
    In partnership with DHS, FS-ISAC 2 years ago became the third ISAC 
to have representation on e the NCCIC watch floor. FS-ISAC 
representatives, cleared at the Top Secret/Sensitive Compartmented 
Information (TS/SCI) level, attend the daily briefs and other NCCIC 
meetings to share information on threats, vulnerabilities, incidents, 
and potential or known impacts to the financial services sector. Our 
presence on the NCCIC floor has enhanced situational awareness and 
information sharing between the financial services sector and the 
government, as well as other critical sectors, and there are numerous 
examples of success to illustrate this.
    As part of this partnership, the FS-ISAC set up an email listserv 
with U.S. CERT where actionable incident, threat and vulnerability 
information is shared in near real-time. This listserv allows FS-ISAC 
members to share directly with U.S. CERT and further facilitates the 
information sharing that is already occurring between FS-ISAC members 
and with the NCCIC watch floor or with other government organizations.
    In addition, FS-ISAC representatives sit on the Cyber Unified 
Coordination Group (Cyber UCG) and the group has been actively engaged 
in incident response. The Cyber UCG's handling and communications with 
various sectors following the distributed denial of service (DDOS) 
attacks on the financial sector in late 2012 and early 2013 is one 
example of how this group is effective in facilitating relevant and 
actionable information sharing.
    Finally, the FS-ISAC and FSSCC have worked closely with its 
government partners to obtain security clearances for key financial 
services sector personnel. These clearances have been used to brief the 
sector on new information security threats and have provided useful 
information for the sector to implement effective risk controls to 
combat these threats.
                  automated threat information sharing
    The sector continues to make significant progress toward increasing 
the speed and reliability of its information sharing efforts through 
expanded use of DHS-funded open specifications, including Structured 
Threat Information eXchange (STIXTM) and Trusted Automated 
eXchange of Indicator Information (TAXIITM).
    Late last year, the financial sector announced a new automated 
threat capability it created called ``Soltra Edge'', which is the 
result of a joint venture of the FS-ISAC and the Depository Trust and 
Clearing Corporation (DTCC). This capability addresses a fundamental 
challenge in our information sharing environment: typically the time 
associated with chasing down any specific threat indicator is 
substantial. The challenge has been to help our industry increase the 
speed, scale and accuracy of information sharing and accelerate time to 
resolution.
    The Soltra Edge capability developed by the sector removes a huge 
burden of work for both large and small financial organizations, 
including those that rely on third parties for monitoring and incident 
response. It is designed for use by many parts of the critical 
infrastructure ecosystem, including the financial services sector, the 
healthcare sector, the energy sectors, transportation sectors, other 
ISACs, national and regional CERTs (Computer Emergency Response Teams) 
and vendors and services providers that serve these sectors.
    Key goals of Soltra-Edge are to:
  --Deliver an industry-created utility to automate threat intelligence 
        sharing
  --Reduce response time from days/weeks/months to seconds/minutes
  --Deliver 10 times reduction in effort and cost to respond
  --Operate on the tenets of at-cost model and open standards (STIX, 
        TAXII)
  --Leverage DTCC scalability; FS-ISAC community & best practices
  --Provide a platform that can be extended to all sizes of financial 
        services firms, otherISACs and industries
  --Enable integration with vendor solutions (firewalls, intrusion 
        detection, anti-virus, threat intelligence, etc.)
    With these advancements, one organization's incident becomes 
everyone's defense at machine speed. We expect this automated solution 
to be a 'go to' resource to speed incident response across thousands of 
organizations in many countries within the next few years.
importance of dhs funding and strong oversight for improved partnership
    DHS is currently responsible for enhancing the security, 
resilience, and reliability of the Nation's cyber and communications 
infrastructure--a critical and expansive mission. In the realm of 
information sharing, DHS's role could expand further with increased 
information sharing following the implementation of the President's 
February 13, 2015 Executive Order to promote private sector information 
sharing. Should Congress enact legislation establishing a streamlined 
voluntary information sharing legal framework, DHS will likely receive 
additional information from private sector partners on cyber threats. 
This will increase the already existing need for a robust analytic 
capability at DHS to develop products, particularly at the unclassified 
level, that will be useful and actionable to its domestic and 
international stakeholder community, both inside and outside the 
government.
    It is critical that DHS have the necessary personnel and technical 
tools to enable them to complete their mission. Last year, Congress 
passed additional personnel authorities for DHS to hire trained, 
qualified personnel to work in cybersecurity positions, which will 
hopefully make the recruitment and retention of qualified personnel 
more successful.
    In this era of fiscal restraint, we also appreciate the need to 
ensure that appropriated funds are being spent in the most effective 
and efficient manner. We believe this is a role not only for senior DHS 
management, but Congress as well, as the ultimate appropriators of 
funding. This can strengthen DHS's cyber programs and provide sector 
stakeholders better information with which to defend their own networks 
and ultimately strengthen the security of our nation's infrastructure.
    Overall, our assessment is that the financial sector's relationship 
with DHS is productive and directionally positive, with tangible 
successes that we believe are improving the protection and resilience 
of our critical financial infrastructure. Where there are programmatic 
gaps or implementation inefficiencies in the partnership, they are 
mutually acknowledged and addressed. Ultimately, we recognize that as 
our joint effort matures over time, we are never done, only better.
    Mr. Chairman and Members of the Committee, this concludes my 
testimony.

           EINSTEIN AND CONTINUOUS DIAGNOSTICS AND MITIGATION

    Senator Hoeven. Thanks to all three of the witnesses, and 
we will start the rounds of questions. We will be pausing at 
2:49. So I will start, but we may have to pause, in terms of 
your response.
    I want to start with Mr. Ozment. My first question goes to 
the rollout of both Einstein and CDM. Where are you in terms of 
the rollout? There has been obviously some concern about the 
pace at which these are being deployed across all government 
agencies, and also the state of the technology.
    So in terms of the dot-gov domain, talk about the rollout 
about CDM and Einstein. Do we have it across all agencies? If 
not, why not? And when will it happen? And is the technology 
ahead of the attacks that are coming our way? And you have 2 
minutes, so you can just get started. I may interrupt you, but 
if you want to start?
    Mr. Ozment. Thank you, Mr. Chairman. I am happy to do it, 
and I, certainly, understand and am very happy to be 
interrupted when the time comes.
    If you don't mind, I would like to start by giving an 
overview of what the Einstein and CDM programs do and how they 
tie together and where they are, to your question.
    They are complementary elements of our strategy to secure 
the Federal civilian executive branch. Einstein 1 provides 
boundary or perimeter-based protection services--I'm sorry, 
Einstein 1, 2, and 3 do.
    So a useful analogy is that of a military base. If you are 
defending a military base, first you limit the number of roads 
coming in and out of it. Then you put security where those 
roads enter the base.
    Einstein 1 is like providing a license plate reader at the 
roads into and out of the military base. So think about that 
base as a single department or agency. Einstein 1 is tracking 
who is entering and leaving the base.
    Einstein 2 adds, if you, will, a watchlist function. This 
car is not allowed to enter the base. It doesn't stop the car, 
but it sets off an alert, a bad guy came into the base. And, of 
course, it is more complicated than just looking for specific 
license plates, but it gives you a sense of the program.
    Einstein 3 is a different approach. Einstein 1 and 2, those 
intrusion detection systems, are built on unclassified 
information. Einstein 3 also takes advantage of classified 
information. And so to make that work effectively, rather than 
build this classified capability at every agency, at every 
military base, if you will, we pulled it back to the highway.
    Senator Hoeven. Mr. Ozment, I am sorry. I am going to have 
to stop you now. It is 2:49.
    At this time, I would like to observe a moment of silence. 
Let this time serve as an opportunity to reflect on the 
survivors, those who were loved and lost, and our resilience as 
a peaceful Nation.
    So please, a moment of silence.
    Senator Hoeven. Thank you.
    Again, to all the victims and their families in Boston and 
those from around the country who were affected, and even 
beyond our shores, our hearts and prayers go out to them once 
again. And we are reminded that we do face real threats in this 
country.
    And, of course, that is a very important part of our 
mission, to help protect against those threats. We are also 
reminded of the strength and resiliency of our country and the 
resolve of our people.
    Senator Shaheen, any thoughts you might have before we 
proceed?
    Senator Shaheen. I think you said it very well, Mr. 
Chairman.
    Senator Hoeven. Chairman Cochran.
    Senator Cochran. I have nothing further now.
    Senator Hoeven. Thank you, Mr. Ozment. Proceed. You were 
just using your military base analogy, which I thought was 
excellent, so please continue.
    Mr. Ozment. Thank you, chairman.
    So with our analogy here, we have Einstein 1 and 2 set up 
at the boundaries of the military base, essentially reading the 
license plates of the cars entering the base, setting off an 
alert if a bad guy drives in. Einstein 3 is pulled back to the 
highways, the highways that serve multiple bases--in this case, 
the Internet service providers (ISPs).
    Now, Einstein 3 will be built at a handful of Internet 
service providers that serve the vast majority of Federal 
Government traffic. It only applies to the traffic to and from 
the Federal Government at those Internet service providers.
    Einstein 3, think about it as a guardhouse. At that 
highway, as we have cars heading toward the bases, the 
guardhouse can actually stop. It checks the license plates. It 
looks for anomalous behavior of the cars and can actually stop 
cars that it believes to be malicious.
    It is also a platform, if you will. So you have built a 
guardhouse. You can put up a gate. You can put up security 
cameras. You can have guards there. You can, in fact, do 
different things at this guardhouse to adapt to an adopting 
threat. That is exactly the case with Einstein 3.
    With Einstein 3, we have started with two security 
capabilities at this guardhouse, but it is also a critical 
platform that we can use to work with the private sector and 
incorporate new and innovative security technologies at the 
guardhouse itself.
    Now, that is great. That is security at the perimeter for 
these bases that are our departments and agencies. But, of 
course, anytime you are working in security, whether physical 
or cyber, you want a layered defense. You don't want to defend 
just at the perimeter. You also want to worry about security 
inside the base.
    CDM, Continuous Diagnostics and Mitigation, is part of our 
interior defense for the departments and agencies. In our 
analogy of a base, this program, CDM, is essentially the tools 
of the guards that go around the inside of the base for 
security purposes. CDM also has multiple phases.
    The first phase is the equivalent of going around and 
making sure that the doors on buildings are closed and locked, 
windows are locked, the basic security of the infrastructure is 
there. Phase two will focus on identity management and will 
essentially be going inside each building and saying, are the 
people inside this building, which is inside this base, are 
they people who are authorized to be here? With additional 
capabilities, we will add different security technologies to 
this interior guard, if you will.
    So where are we on these two programs right now? Einstein 1 
and 2 have broad perimeter coverage across Federal civilian 
departments and agencies.
    I say that specifically to exclude the Department of 
Defense and the intelligence agencies. Those are excluded from 
this program.
    But for civilian departments and agencies, Einstein 1 and 2 
reach between 80 percent and 90 percent coverage. Now the 
reason for not having full coverage there is every department 
and agency has more Internet connections. Most departments and 
agencies have more Internet connections than they want. So they 
are trying to consolidate down to a small number of connections 
where the security is. So as departments and agencies further 
narrow their extra Internet connections, our coverage will go 
up.
    For Einstein 3, we are in the middle of building out that 
capability. We have built it with two Internet service 
providers, Verizon and CenturyLink. Those two service providers 
give us coverage for about half of the Federal civilian 
departments and agencies by personnel.
    Now, there are two parts to Einstein 3, which is we build 
the capability and then we work with departments and agencies 
to route their traffic through the capability. So we can build 
the guardhouse, but if they are not sending their traffic to 
the guardhouse, it doesn't work.
    So with Einstein 3, about a quarter of the government is 
routing some or all of their traffic to our guardhouses. So a 
quarter of the government is receiving at least one protection.
    We have just put the second ISP online, so we have really 
just expanded the capacity from a quarter of the government to 
half. Now we are working with departments and agencies to take 
advantage of that new capacity that we just rolled out. Then we 
are continuing to work with ISPs to build out this capability 
at other ISPs.
    Switching to CDM, that inside-the-perimeter program, as I 
mentioned in my opening statement, just yesterday we announced 
the second of a set of awards for this program. We now have 
awarded to departments and agencies that constitute more than 
half of the departments and agencies.
    Now this is announcing the award. Now that we have the 
tools and services, we need to deploy them. That will take some 
months yet, but that is a particularly important milestone that 
I am very proud that we have achieved.
    So with that, hopefully, I have answered the question, 
chairman. If it there is anything else I can add, I am happy to 
do so.
    Senator Hoeven. That was really well done, in terms of 
actually explaining how this stuff works to someone who doesn't 
work in your field. Certainly, far from an expert. I didn't 
even want to use the term ``expert.'' But this is complicated 
stuff. That was a good job of explaining how it works, and I 
appreciate that.
    I am going to follow up on that question, because I think 
you went a long way down the trail, but you did it in an 
understandable way, and I appreciate that.
    At this point, I will turn to Senator Shaheen.

                            INCIDENT REPORT

    Senator Shaheen. Thank you.
    One of the challenges, and I think we talked a little bit 
about this when I visited the NCCIC, where the NPPD operates 
and where you all are working, is how to quantify what the 
challenge is and how to track what is happening in a way so 
that we can prioritize resources and help explain what the 
threat is to the Nation.
    So I was interested to see that DHS received over 97,000 
incident reports, and I am going to ask you to explain what 
those are, and issued 12,000 actionable alerts, and detected 
64,000 vulnerabilities, responding to 115 incidents in 2014.
    So those are numbers that I think show, to some degree, the 
extent of the challenge, but it is hard to understand exactly 
what that means out of context. So can you try to put those 
numbers into some context and explain what that means and what 
we should be looking at to prioritize our response to those?
    Mr. Ozment. Absolutely. Thank you, Ranking Member Shaheen.
    Regardless of where you get your data on cybersecurity, 
whether it is the statistics that we report on our activity, 
whether it is from a private-sector security company and their 
reports, or the academic reports in this field, almost every 
report you look at will indicate that the problem is 
extraordinarily large in scale and growing. Now, no single 
entity has a lens on the entire problem, so there is nowhere 
you can go to see everything at once. Although, certainly, we 
view that as part of the problem that we have to tackle, to 
improve that lens.
    You mentioned some of the statistics. Let me, I think, 
provide some of the context within which to frame them.
    Senator Shaheen. Great.
    Mr. Ozment. One of them is, I started in cybersecurity 
around 1998 and originally worked as a network operator. When I 
worked as a network operator, when we had an incident, it was a 
big deal. We pulled out all the stops. It was momentous in my 
life. I got no sleep.
    Unfortunately, the world is such today that if you are a 
Fortune 1,000 company, this is no longer a noted or notable 
incident, just because somebody has intruded upon your company. 
In fact, quite the contrary. Every CIO or CISO (Chief 
Information Security Officer) I know operates under the 
assumption that somebody has already broken into their network 
and is, in fact, living and working on their network from 
abroad.
    So we have moved from this understanding that mostly we are 
secure and sometimes people break in, to a world where we, by 
and large, now believe that mostly we are insecure and there is 
always somebody who has broken it. The challenge for us is how 
rapidly we can detect them and remove them.

       CYBERSECURITY: GOVERNMENT AND PRIVATE-SECTOR UNDERSTANDING

    Senator Shaheen. Can I just ask, how much of the rest of 
government do you think understands that reality?
    Mr. Ozment. I think, in the CIO community, and I will defer 
to my colleague Mr. McCormack on this, but I think it is very 
widely understood. I think even in the past 6 or 8 years, I 
have seen a dramatic increase in understanding and senior 
leadership. Now for the first time since I entered government, 
I would say that it is widely understood across senior 
leadership.
    Senator Shaheen. Mr. Garcia, how widely do you think that 
is understood in the private sector?
    Mr. Garcia. The private sector, writ large, is not where it 
should be. For the financial sector, I think we have a fairly 
sophisticated understanding of, number one, the problem, and, 
number two, the business proposition for addressing ourselves, 
for investing in cybersecurity.
    Just to give you one example, after DHS, I was an executive 
at a major bank. One of the things we tried to do was actually 
measure the value of our cybersecurity investment. So we just 
take one example where, are we getting our money's worth from 
all this information-sharing that we are doing and the 
resources that we are deploying toward it and the people as 
well? Let's take an example of having gotten one piece of data, 
one threat intelligence that we didn't know about.
    We understood that that particular malware attack has the 
capacity to disable computers or to wipe the data clean or 
corrupt the data in some way. And if we did not have that 
information, we could not have stopped it from happening. If it 
had just infected one division within the bank, maybe that is 
1,000 computers, you are going to have to go back and wipe all 
of those thousand computers clean and reimage them. $500, $750 
per computer and multiply that by 1,000 computers, 10,000 
computers, and suddenly you have a real number associated with 
catching just one threat.
    So when you build that out over time and you think of all 
the other ways that we can be investing in security, it isn't 
easy. It is sometimes an art. It is hard to prove the negative, 
that because we didn't see anything, nothing happened. But 
those methods for measuring progress are improving and at 
increasingly higher levels within corporate America. So we are 
making progress.
    Senator Shaheen. I will get back to you.
    Can I get Mr. Ozment to finish answering that question, 
putting numbers into some context?
    Mr. Ozment. So I think a key thing to emphasize from us is, 
as we sit within my organization, we do not believe that we 
have scaled to the level commensurate with the risk we are 
facing.

                               RESOURCES

    Senator Shaheen. And is that a function of resources?
    Mr. Ozment. We are receiving the resources right now that 
we need, assuming that we receive, of course, the President's 
budget request. We think we are in good shape. Part of it is, 
you can only scale and grow so fast. It is a new field in the 
sort of national perspective.
    Senator Shaheen. We can only grow so fast because we don't 
have the personnel, the technology?
    Mr. Ozment. Personnel is probably the biggest single 
holdup, and then just by the nature of organizations. If you 
grow organizations too rapidly, it is difficult.
    The only other thing I would add is when you look across 
these, one of the things that can be confusing about the scale 
of numbers, and particularly people often report on attempted 
intrusions, that number has become, by and large, meaningless 
because attempting to break in is free. An adversary can try 1 
million times per day against one victim and largely there is 
no punitive action that would deter them from doing it.
    So adversaries automate their attempted break-ins and just 
go across broad swaths of the Internet. So we have stopped 
paying attention to a number that used to be an important 
signifier to us in this community, because, essentially, it is 
infinite now.
    That being said, sometimes people hear these broad numbers 
and largely give up. They say that this problem is intractable. 
The flip side of this is we look at intrusions that we know 
about. And again, whether it is our data or a private-sector 
company's data, the vast majority, 80 percent to 90 percent of 
the incidents that you learn about, could have been prevented 
by basic best practices.
    That is one of the reasons we focus so much of our efforts 
on best practices. It is not the most exciting topic in the 
world, and it often receives less attention than incident 
response or even information-sharing, which can be more 
dynamic. But it is the basic thing that we need organizations, 
whether government agencies or companies, to take those actions 
and sort of raise the bar for our attackers.
    Senator Shaheen. Thank you.
    Thank you, Mr. Chairman.

 EINSTEIN AND CONTINUOUS DIAGNOSTICS AND MITIGATION: LEVEL OF SECURITY

    Senator Hoeven. Mr. Ozment, go back to the analogy you were 
talking about before, or basically the rollout of CDM and 
Einstein in terms of deploying them across all agencies, before 
we get into the private sector aspect.
    Will these technologies put us ahead of the technologies 
that attackers use to try to infiltrate our systems? Are you 
ahead now? Are you staying ahead? Because obviously hackers are 
constantly improving their ability to undertake these attacks.
    Mr. Ozment. Certainly. One of the things you will observe 
from me is that I am a former computer scientist and 
programmer, so I think in lists. So I have three answers for 
you on this question.
    The first is, for Einstein itself, the technology of 
intrusion detection and intrusion prevention is not a new 
technology. In no way would I call it innovative or cutting-
edge. Neither is a fence. But it is still a core component of a 
layered protection for protecting a physical installation.
    That being said, these technologies depend upon the 
information that is fed them. So first, it is a necessary but 
not sufficient technology. Second, what is innovative about 
what we are doing is the information we are putting into these 
systems, particularly for Einstein 3, the classified 
information that we derive from our partners in law enforcement 
and the intelligence community. That information helps us stay 
ahead of our adversaries and keep them out of our networks, 
even if we haven't seen them before.
    The final aspect of it is that it's necessary to have a 
fence, and it is great that our fence uses classified 
information that makes it a cutting-edge fence. It is still not 
sufficient. So the final aspect of Einstein 3 is that it is a 
platform that we have made this guardhouse at the highway that 
serves multiple bases, and we can install new technologies on 
the guardhouse as we go.
    We are even now exploring what are the next technologies to 
put into the system to continue to build out its capabilities. 
That is for the Einstein program.
    For the CDM program, it is a similar evolution. First, 
build the basics that every organization should have, but, 
unfortunately, not every organization does have, and then add 
the more sophisticated technologies on top of it. That first 
component of CDM, which is that guard inside the base checking 
doors to make sure they're locked, a big part of that is 
ascertaining whether or not computers are vulnerable, meaning 
whether they have been patched.
    Again, there are numerous private-sector reports on this: 
that 80 percent to 90 percent of intrusions takes advantage of 
a vulnerability that we have known about for at least a year, 
and that there is a patch, a fix for it, widely available.
    So this is the basic blocking and tackling of security. And 
if we haven't rolled out the tools that let us do it 
systematically, measurably at scale, then we can't build 
anything more sophisticated on top of that.
    So that is what the first phase of CDM tackles. The second 
phase, as we start looking at who is in the building and should 
they be there, starts to be more cutting-edge.
    Senator Hoeven. Again, going back, agencies have their own 
security, and then you come along and provide CDM and Einstein 
across all agencies. But to the extent that some of these 
agencies aren't yet fully using both of those programs, as you 
mentioned in your testimony, they still have taken some steps 
for security. Maybe some aspects of their software, their 
number of access points and so forth which don't fully comply 
with some of the best practices that you talked about and some 
of your security protocols, but some steps. So, how secure are 
they?
    In other words, first, how secure are the ones where you 
have Einstein and CDM deployed? What is your opinion in terms 
of how good their security is? Are they secure, and are you 
comfortable? And then what is the state of security for those 
agencies that haven't deployed them yet?
    Mr. Ozment. Unfortunately, it is not quite as simple as 
saying that agencies that have CDM and Einstein are secure and 
those that lack them are insecure. It varies widely, depending 
on an agency's capability and investment in cybersecurity.
    One of the purposes of Einstein and CDM, though, is to 
provide a basic level of security, so that we can be 
comfortable that we have that baseline of security across the 
Federal Government, regardless of the agency's skill or 
resources at a given moment.
    With respect to the Einstein program, another key advantage 
really that both programs provide us is agencies can and should 
be effective at seeing what is happening to them on their 
network, but we believe that we will be able to identify 
attacks that are not visible within one agency because it is a 
small anomaly within one agency, but when you see it across 
seven agencies, you recognize that it is something bigger. It 
is putting together the pieces of the mosaic and understanding 
the broader picture of what you see.
    And then the only thing additionally I would add, just to 
reassure you, on the Einstein program, we are providing 
something around departments and agencies that couldn't have 
existed before. They may have their own intrusion detection 
systems, but, again, the systems would be local and don't use 
classified information. With CDM, some agencies have built out 
parts of this capability before and we are not duplicating what 
they have already built out. The CDM program has, frankly, a 
fairly wide variety of vendors and the reason we have that is 
because our goal is to fill in the gaps of what agencies may 
already have rather than replace what they bought.

EINSTEIN AND CONTINUOUS DIAGNOSTICS AND MITIGATION: DEPLOYMENT SCHEDULE

    Senator Hoeven. When will all agencies have both? What is 
your goal?
    Mr. Ozment. With CDM, we have broken the agencies 
essentially into five buckets and we are going through each 
bucket awarding and deploying to those agencies.
    So you just heard that we awarded the second bucket. We 
intend to award the fifth bucket by the second quarter of 
fiscal year 2016 and then essentially have built out that final 
bucket over the next two quarters. So we will have all of these 
buckets both purchased and built out by the fourth quarter of 
fiscal year 2016.
    Now, something I do want to flag, however, is we have 
grouped agencies in part by size. So as we get to that final 
bucket, it is a large number of agencies; it is an extremely 
small percentage of the Federal Government by personnel.
    So as you heard, with just two buckets, we are already over 
50 percent. As we go through these buckets, the remaining 
buckets get smaller.
    Senator Hoeven. Is that for both programs?
    Mr. Ozment. I'm sorry?
    Senator Hoeven. Is that for both programs?
    Mr. Ozment. So that is for CDM. Einstein is a different 
approach.
    Einstein is based on the ISP. If we were to build 
classified capabilities at every agency, it would be 
prohibitively expensive. So by pulling back to the highway and 
building at just a handful of ISPs, we can keep our costs down 
and still cover most of the Federal Government that way.
    Right now, as you know, we have two of those ISPs providing 
service. We are now talking to the third ISP to get it under 
contract. We hope to have all of our capabilities built out 
with these ISPs by the end of fiscal year 2017.
    Again, as you get toward the end, you get declining 
additional coverage of the government. We get the biggest 
chunks early.
    One thing I want to highlight for Einstein though is we 
build it; they still have to come. So that is why, for example, 
right now, we have 50 percent capacity for the government, but 
only 26 percent taking advantage of a countermeasure.
    Now that does not mean that agencies are being resistant. 
We built the capability. Now they have to modify their 
networks. It takes some time.
    But I will tell you that we do have challenges with 
agencies who are concerned about whether the legal authorities 
in this space are clear. They want the protection. They very 
much would like to be part of the program. But they have 
statutes that were not intended to address this issue, that 
were developed for entirely different purposes, but that 
restrict who can see the information that that agency receives.
    So there is all sorts of protected information throughout 
the government. It may be protected because it was intended 
that it never be accessible to law enforcement or to 
regulators, you name it. Some of those statutes are broad 
enough that agencies are concerned whether or not they violate 
the statute for this program to be operational.
    So that is why we have come to Congress to ask for a 
positive authorization of this program.
    Senator Hoeven. Thank you.

EINSTEIN AND CONTINUOUS DIAGNOSTICS AND MITIGATION: DHS-WIDE PROTECTION

    Senator Shaheen. So, Mr. McCormack, are all the agencies 
within DHS protected?
    Mr. McCormack. Absolutely. I just wanted to bridge onto 
several things that were discussed with Mr. Ozment.
    One is, just in my assessment of the maturity of the CIOs 
and their awareness of cyber, being a component CIO and 
Department CIO at the Department of Justice (DOJ) and here at 
DHS, absolutely, there is sensitivity to that. I think what OMB 
has done recently with their cyber assessments where they are 
having discussions with Department leadership, I mean, 
organically, we do that now because of the nature of what we do 
at DHS, so we are always having those conversations. But those 
are very intimate conversations going across all departments 
and agencies, at this point. So I think that has been very 
successful.
    One other thing on the Einstein, I think another thing that 
makes that very powerful is not only do the guardhouses have 
that level of sophistication, using Andy's metaphor, but the 
fact that these guardhouses are now going to be able to talk to 
each other at machine-speed and inform each other is very 
powerful as well. That is a big improvement as to the 
configuration that we have today.
    Last, I would say, on the CDM, as we discussed earlier, as 
I said in my opening statement, we are early adopters of both 
of those programs. For instance, for us, in Einstein, they just 
implemented the Einstein capability in the ISP that we happen 
to use.
    Now we have to reconfigure our network, as Andy was talking 
about. We will have that done approximately at the end of May, 
so we will be routing our traffic through that and taking 
advantage of those capabilities.
    That is not to say that we don't have some of those 
capabilities now. We don't have the classified capability that 
we are very interested in getting because that is a higher 
order of protection. But most departments and agencies have 
built some type of capability using commercial services, et 
cetera, to do the protection that you asked about.
    On CDM, we're an early adopter of that. We were in phase 
one. They just awarded phase two. So we are in the process of 
implementing that. That will take several months to implement.
    We do have continuous monitoring throughout the Department. 
It is not as homogenized as we would like to have it, and this 
is going to allow us to fill in those gaps and give us some 
capability that we hadn't had before and give us that sort of 
broad dashboard so that we can quickly look at where our gaps 
are and focus our attention on that. So that is the priority 
issue that you had spoken about, so we can narrow our focus and 
know where we have some gaps and quickly address those 
concerns.
    Senator Shaheen. Mr. Ozment, is the Senate covered?
    Mr. Ozment. So the Senate is not covered in this program. 
We are very happy to talk about the Senate, but our 
understanding is, for concern of separation of branches, that 
the legislative branch is not interested in the programs. But 
if there is a change in that opinion, we are extraordinarily 
happy to work with you.

                    INCIDENT DETECTION AND RESPONSE

    Senator Shaheen. Okay. So back when the Foreign Relations 
Committee took action on Syria in 2013, one of the advisories 
that we got was that there was information suggesting that the 
email accounts of those of us on the committee might be hacked 
into. Where did that originate? Was that DHS that would have 
gotten that alert and then sent that to the Senate to act on?
    Mr. Ozment. So I can't speak to that particular incident, 
but that type of information can originate in a number of ways. 
It can originate in a law enforcement investigation. It can 
originate through intelligence.
    When we, DHS, my organization, when the NCCIC deploys an 
incident response team to a victim, they may, as they help that 
victim, discover information that the adversary has been on 
another victim. So there is any number of ways that we can find 
out about new victims of intrusions.
    One of the things that we have all worked on for the past 
few years in the executive branch is making sure that we do a 
coordinated, immediate outreach to those victims to let them 
know. I am happy to tell you that whereas 2 years ago we did 
not have a process for that, we have a process for it now and 
do a good job, not just of making sure the victim gets a knock 
on the door, but making sure the victim only gets one knock and 
not three knocks from three different agencies.
    Senator Shaheen. So when I read off all those statistics 
earlier, and I talked about the 115 incidents that you 
responded to in 2014, is that the response to victims who have 
had a cyberattack? And what do you do when that happens? Call 
the agency and then do what?
    Mr. Ozment. So those are responses to a victim of either 
cyberattack or intrusion. We do tend to differentiate an 
intrusion from an attack that breaks things.
    So we may have found out about those through any of the 
means I just mentioned.
    What happens when we find out? We call a victim or 
sometimes a victim calls us. It can happen either way. So we 
let the victim know or they let us know. We offer our 
assistance.
    That assistance can be as lightweight as our just telling 
them we have seen this before. Here's what we know about it.
    Senator Shaheen. What do you do in a worst-case scenario?
    Mr. Ozment. Worst case scenario, we send a team onsite to 
help them figure out where in the network it is and essentially 
to kick the bad guy off the network and get them up and running 
again. Ideally, we do that with law enforcement.
    Senator Shaheen. That is what I was going to ask. Can you 
identify the bad guy and then do you report that to law 
enforcement in some way?
    Mr. Ozment. So we do not focus on identifying the bad guy, 
although we can find information that gives us hints and we can 
pass that on. We are sometimes called by companies who are 
unwilling to have law enforcement onsite, but our strong 
preference and really our belief is that the right thing to do 
is to be onsite with law enforcement--law enforcement focused 
on the investigation, the attribution, how to catch the bad 
guy; us focused on figuring out where in the network the bad 
guy is, getting them off of it, getting the company or the 
agency up and running again.
    Whether that is the Secret Service or the FBI or Homeland 
Security investigators, if we are out with a victim, we will be 
encouraging them every day to bring in law enforcement.
    Senator Shaheen. Thank you.

                          INFORMATION SHARING

    Senator Hoeven. I would like to shift to the state of 
information-sharing. So I would like to get Mr. Ozment's sense 
of where we are in terms of timely, actionable information-
sharing, public sector, private sector.
    Mr. Garcia, the same question to you.
    In any order, whoever wants to go first, fire away.
    Mr. Ozment. Okay, I will go first, I guess.
    I actually want to break information down into three 
buckets again.
    One is the in-person collaboration and exchange of 
information, and we cannot minimize the importance of that, 
because so much of knowledge in complicated spaces is tacit 
knowledge that is best shared when you engage with people 
directly. But it doesn't scale. So while we have to do that, 
that is far from sufficient.
    Next is what I view as sort of the analytic reporting, 
which is contextual information that helps the recipient 
understand broadly what is going on. An example of this would 
be a report talking about attacks that are targeting these 
three sectors. They are broadly taking these approaches. We 
think they are after this type of information, or this is the 
goal they are trying to achieve. It may or may not be 
actionable in a tactical sense, but it gives that strategic 
context that helps the recipient understand what is going on.
    Third and final is tactical information-sharing, what we 
often call cyber threat indicators that are the actionable 
things that a recipient can use to protect themselves.
    We have programs in all three areas, and I think all three 
are necessary. A lot of the focus right now is on that third 
area of tactical information-sharing, so I will focus on that. 
But I do know that we also put a lot of effort into those first 
two areas.
    So for that tactical information-sharing, that is the type 
of information-sharing that we can make happen at machine-speed 
and what we have been very focused on doing. So starting over 3 
years ago at DHS, we realized the need that we would have to 
share these indicators, we would have to share them in an 
automated way and do it at machine-speed, and that there was no 
standard by which to characterize them and to share them. So we 
started that work over 3 years ago.
    That led to the STIX (Structured Threat Informaton 
eXpression) standard and the TAXII (Trusted Automated eXchange 
of Indicator Information) standard. STIX is how you describe 
the information to be shared. ``I am sending you this piece of 
information. This is what it means. This is how you use it. 
This is how you have to protect it. And this is how you share 
it, if you like.'' So it gets quite complicated, but it is the 
standardized language for describing all those things.
    TAXII is how computers tell each other that at machine-
speed.
    So we started, 3 years ago, developing those standards. In 
2013, we started releasing all of our products in this STIX 
format, this machine-readable language. We were not yet sharing 
it at machine-speed, but when you got it, you didn't have to 
type it in. You could feed it to a program that could 
understand it and then read it as a computer would read it.
    Then a year ago, in February 2014, we started a pilot with 
the Financial Services ISAC (Information Sharing and Analysis 
Center), part of the FSSCC (Financial Services Sector 
Coordinating Council). And with the Financial Services ISAC, we 
started this pilot where we would send information that was 
STIX-formatted with TAXII, so machine-speed, machine-readable 
information, back and forth.
    We ran that pilot. It was very much successful. As a 
consequence of that, we have been building. We had a pilot 
scale system now. Now we want to serve a large swath of the 
private sector and the government. So we have to build a 
robust, scalable system. So we have been doing that. We hope to 
report good news on that in the coming weeks.
    Senator Hoeven. Mr. Garcia.
    Mr. Garcia. Yes, sir, Mr. Chairman. I agree with everything 
that the Assistant Secretary said. I would add two pieces to 
that. One is process, and the other is relevance.
    Our information-sharing engagement with the government from 
the financial sector is good and getting better. As I said in 
my opening statement, where there are gaps or inefficiencies, 
they are acknowledged and we are addressing them. We have a 
working group that involves our sector-specific agency, the 
Treasury Department, as well as DHS and other Federal agencies, 
and the financial sector working on these process issues. That 
is very simple questions like: Who is on the phone tree, and in 
what order? And how does information generated within DHS 
actually get over to the Treasury Department? And how does 
Treasury actually get certain information from the NSA? And who 
has authority to share it outward? What about the tear line? 
The tear line is you have a classified section and unclassified 
section. How do you split those two so you can actually get the 
actionable information to the owner and operator of the bank or 
insurance company to actually deal with it?
    So the process is not easy. The government is not 
monolithic; the financial sector industry is not monolithic. 
And getting through all that vast wiring diagram to get 
information out in time to the right people is a challenge. It 
always will be. It is a systemic issue that is just the nature 
of the beast.
    The second is relevance. As the threats evolve, as 
technology evolves, and vulnerabilities, the way we deal with 
those is different. Where we have taken care of one problem, a 
new one emerges. I have been on the receiving end when I was at 
DHS, and I thought we had some pretty juicy information about 
some classified threat, and I shared it with a cleared industry 
official, and he said, ``Are you kidding? I have known about 
that for 6 months.'' So that wasn't relevant.
    So it is a constant process of engaging with the partners 
to know, does this piece of information work for you? Is this 
relevant? Can you do something with this?
    So three times a year, we have very large meetings between 
industry and government where we have classified sessions. 
Every month, the Treasury Department is holding classified 
sessions with cleared industry people. That exchange is 
constantly going, recalibrating and recalibrating what matters.
    Senator Hoeven. So you feel that with the ISAC and the 
industry--in this case, the financial services industry--it is 
working? You feel that you have generally good security and you 
are working to make it better with information-sharing and 
response and coordination and technology deployment, both 
individually and some of these technologies that cross 
businesses or agencies?
    I mean, it is going the right way? You feel like it is 
working?
    Mr. Garcia. It is going the right way. As I said at the 
start, we are never done, we are only better. I think the STIX 
and TAXII open specification that Andy referred to is very 
important for us because it is laying out an open standard for 
all industry to apply to their information-sharing. It is 
simply how you describe the information and how you transport 
it in a machine-to-machine way.
    That is a good thing. That is taxpayer dollars well spent.
    Senator Shaheen. You talked about the fact, Mr. Garcia, 
that the financial services sector is ahead of much of the rest 
of the private sector, in terms of dealing with cyber threats.
    Why do you think that is? And how do we get folks in the 
utility sector and some of those other areas where they haven't 
responded as quickly to be aware of the challenge and to work 
with them to get them up to speed to where they ought to be?
    Mr. Garcia. I certainly don't want to claim that the 
financial sector is far ahead of everyone else. But first of 
all, the financial sector is heavily regulated so there are 
very explicit requirements that we have for ensuring the safety 
and soundness of the financial system.
    Senator Shaheen. So are utilities, though.
    Mr. Garcia. Indeed. The second point is that it is the 
Willie Sutton factor. That is where the money is.
    The financial services sector is a symbol. It is a very 
large and potent symbol of America, and it, therefore, becomes 
a target naturally on the global stage.
    But I think because we recognize that we as a sector are 
targeted every day, that it is not a competitive issue among 
us. We don't say, ``We are more secure than the other bank. 
Come bank with us.'' We recognize that it is the three 
musketeers. We have to be one for all and all for one so that 
we can form a collective intelligence, a collaborative posture, 
to take on the bad guys.
    So because of that, we have formed a very strong trust 
community. As I said at the start, strength in numbers. If you 
don't have strength in numbers, you are not going to be able to 
defeat the adversary, period.
    I think that that notion of trust community might not be as 
mature in other sectors. They certainly are accelerating that. 
There is greater recognition.
    And then finally, I think we are doing a lot of work sector 
to sector. The financial sector is heavily dependent on the 
electric sector. The electric sector is dependent on financial 
services. We are all dependent on telecommunications, 
information technology. So there are critical interdependencies 
that really illuminate those vulnerabilities, those shared 
vulnerabilities.
    From a business-to-business standpoint, government is 
important in helping us deal with this, but this is a business-
to-business issue. How do I know when the lights are going to 
come back on? And my electric company better have an answer for 
that.
    So we are dealing with those issues both in terms of 
business and in terms of policy and critical infrastructure 
protection.
    Senator Shaheen. Senator Hoeven was asking about 
information-sharing. I was here--I think you were here, too, 
Senator Hoeven--several years ago when there was an effort to 
get a cyber bill through the Senate. I think it broke down 
along, basically, the concern about sharing information as well 
as who was going to be in charge of holding that information 
and responding to it.
    There is new legislation that has been drafted. Do you have 
a view on whether that is preferable and how the private sector 
might respond to that new legislation, and whether it is 
needed? I will ask you all that as well.
    Mr. Garcia. Yes. I couldn't comment on the details of 
legislation, but as a general matter, we are supportive of any 
information-sharing legislation that facilitates that.
    While we believe we have very robust information-sharing 
within the financial sector, there remain concerns about 
liabilities.
    Let's say I will share information with government. How do 
I know that it is not going to be used for regulatory purposes 
against me? Or I do take action on it and, it results in a 
class-action lawsuit because I didn't act within 10 days or 
some other potentially arbitrary standard.
    So to the extent that Congress can provide levels of 
assurance to the private sector, that good-faith information-
sharing that is intended to protect critical infrastructure 
will not go punished in some ancillary way, I think that is 
going to facilitate more information-sharing.
    Information-sharing is not the silver bullet, but it 
certainly is the currency of our collective protection.

                    INFORMATION-SHARING LEGISLATION

    Senator Shaheen. Mr. Ozment.
    Mr. Ozment. Let me start by actually emphasizing the point 
Mr. Garcia just made, which is information-sharing is 
critically important, but it is not a silver bullet. In fact, 
if you haven't implemented best practices, I can share 
information with you all day long and you have no way of 
implementing that information.
    Senator Shaheen. Should legislation include best practices? 
Should it include a standard by which sectors should operate?
    Mr. Ozment. I don't think that we need that in statute. I 
think the government and private sector worked together to 
develop the cybersecurity framework over the last 2 years and 
that we are advocating for the voluntary adoption of that 
framework and see a lot of enthusiasm for it. So I think----
    Senator Shaheen. Has anyone adopted it yet? The financial 
sector?
    Mr. Garcia. Yes. The framework that Andy was referring to 
was developed jointly between industry and the National 
Institute of Standards and Technology (NIST), so there is 
general support for it.
    It is very broad in nature, which is the elegance of it, in 
the sense that it is very scalable. Very small community 
institutions, banks like Chairman Hoeven used to be the CEO of, 
can adopt the NIST cyber framework, as can major banks.
    A lot of us have done the mapping. Many of the financial 
institutions have very sophisticated, robust cybersecurity 
practices and controls. And we see that we map very closely to 
the NIST framework.
    So I think we are there. I think the challenge now is to 
push that NIST framework out to the broader business community, 
particularly small and midsized institutions, because they are 
part of this ecosystem as well.
    Senator Shaheen. Are there other ways in which we are 
encouraging other industries and the private sector to adopt 
those standards?
    Mr. Ozment. We absolutely are. So a good portion of the 
programs that I have are focused, in fact, on encouraging the 
adoption of standards. We have requested increases in our 
budget this year for some of those programs.
    One of them is the C-Cubed Voluntary Program. This is our 
cybersecurity advisers, so individuals who are across the 
United States help companies understand cyber best practices 
and adopt them. And also risk assessments.
    So as I mentioned in my opening remarks, we will work with 
companies and do a risk assessment with them. Now, we can do 
that in person, and we also have downloadable tools that they 
can use to do their own. One of the reasons we do it in person 
is to give us a better sense of the pulse of industry and where 
industry is.
    So we seek to do more with us. They are a great educational 
tool, both for the infrastructure or the company that receives 
it, and, frankly, they help us very much understand industry's 
needs.
    So we have multiple programs where we are out there. We are 
also working with the sectors and the sector coordinating 
councils to do sector-wide risk assessments but also to work 
with them and customize a cyber framework to their sectors' 
individual needs.
    There is a lot of great work going on in the space. And, 
frankly, we are seeing a level of adoption and energy around 
the framework that I would not have even hoped for 2 years ago.
    Senator Shaheen. That is encouraging. Thank you.

                   STAFFING: RECRUITING AND RETAINING

    Senator Hoeven. Okay, we will try to wrap this up now, 
either in one or possibly two more rounds, but maybe we'll just 
set this round up to go a little bit longer and see if we can't 
bring things to conclusion.
    A couple different questions that I have. I am going to go 
to Mr. McCormack and just ask, in terms of staffing, how are 
you doing in terms of recruiting and retaining staffing for DHS 
agencies?
    Mr. McCormack. Thank you. Staffing is always an ongoing 
activity for us, and we certainly do appreciate the flexibility 
that we now have in our pay scale and the like. We are working 
very closely with our CHCO (Chief Human Capital Officer) 
organization to go through the necessary processes, to do the 
skills assessment, etc., to implement that across the 
Department.
    We also have direct hire authority, which really helps us 
in allowing us to pursue the variety of talent that we are 
interested in.
    Retaining is always an opportunity and a challenge. As Andy 
and I were talking right before the hearing started, I just 
shared a small story. When I was over at DOJ, we had a young 
lady over there, very sharp, midcareer, who was actively 
pursued through LinkedIn. Out of the blue, she ends up getting 
an offer that is more than double her salary, moves her out of 
state, puts her up, lets her build her dream house, and changed 
her life.
    We were honored that--it is a big world--and of all the 
places across the world that they could come, they come right 
to the Federal Government. That is the flattering part of it. 
The challenge is that we lost a good employee there. So that is 
always a real dynamic that we have to work with.
    So how do we address that? Well, we continue to recruit. We 
continue to grow. We have a lot of techniques to do that. We 
are working very closely on that. But that is a real 
opportunity for us, to continue to build our workforce from the 
lowest level up to the senior level and continue to bolster 
that workforce to deal with the adversaries. It is a real 
opportunity for us.
    Senator Hoeven. Do you feel you are in a position to do 
that?
    Mr. McCormack. Yes. I think we have all the tools in place. 
You all have helped us with that. So we really do appreciate 
that. That is an ongoing pursuit. That is a constant, continual 
activity.
    As we grow our organization and grow the level of skill set 
that we need, that is just an ongoing maturity curve that we 
are going to continually face.
    Senator Hoeven. Mr. Ozment, the same question.
    Mr. Ozment. I too would really focus on the workforce issue 
and really emphasize the importance of you and the Congress 
acting in December of this year and passing, in fact, two bills 
related to the DHS security workforce. So I truly thank you for 
that.
    As we implement those bills, that will be incredibly 
helpful for us in sustaining our cybersecurity workforce. There 
are two sort of additional considerations that I would put on 
the table for that.
    First of all, ultimately, those bills and that effort will 
help us enormously in recruiting and retaining great talent. 
But I will also tell you, from my organization's perspective, 
when I look at my cybersecurity talent that I recruit, I do not 
look at them and think, this person will be with me for a full 
government career. I think this person will work with me. They 
will contribute a great deal. They will learn a great deal. At 
some point, they will likely circulate to the private sector. 
And then, hopefully, I will catch them again at a different 
point in their career.
    That is a different model of government service. It is not 
a bad model. It is just one that we have to adjust to and build 
our workforce processes to accept.
    The second thing I would say is, in addition to the 
tactical problem of how we hire for ourselves, we also have to 
worry about, of course, building a national workforce so that 
Mr. McCormack and I don't have to just poach from each other or 
from other companies, but, in fact, there is a broader talent 
pool available that we can all hire and draw from. That is 
where our cybersecurity education and awareness efforts come 
in.
    Senator Hoeven. Do you feel you have the ability to get 
what you need? Yes or no?
    Mr. Ozment. Yes. Yes, sir. Thank you.

                   INFORMATION-SHARING ORGANIZATIONS

    Senator Hoeven. What is the difference between an ISAC and 
ISAO (Information Sharing and Analysis Organization)?
    Mr. Ozment. We heard two things from the private sector 
about information-sharing organizations. One, a lot of 
companies that were in ISACs, most companies in ISACs, feel 
really positive about them. But there were a lot of companies 
that said, I don't fit in an ISAC.
    The ISACs were constructed since 1998 along sector-focused 
lines. So it would be the financial services ISAC, electric 
subsector ISAC, you name it.
    There are companies that said, I just don't fit. I don't 
see myself in one of these sectors, or I see myself in all of 
these sectors, or I have trust relationships with people in my 
city and I want to share with them and have them be my hub. I 
don't want to be part of the sector construct.
    Essentially, in the government, we said, why are we 
imposing a government hierarchical structure on you? We should 
let you, the private sector, organize yourselves as you see 
fit, and we'll work with you.
    So ISACs continue to exist and are incredibly valuable. 
ISAOs are new organizations for people or companies that are 
not interested in the traditional ISAC approach and want to 
form a different type of group.
    Senator Shaheen. That is a really bad acronym.
    Mr. Ozment. That is very true. I apologize.
    Senator Hoeven. Are there any good acronyms in 
cybersecurity?
    Senator Shaheen. Maybe not.
    Mr. Garcia. If I could put a fine point on it, all ISACs 
are an ISAO, but not all ISAOs are ISACs.
    Senator Hoeven. ISACs are industry specific. ISAO is 
something else.
    Mr. Ozment. Any shape and size.
    Mr. Garcia. And it could be for-profit. ISACs are not-for-
profit.

                              CYBER CAMPUS

    Senator Hoeven. I am concerned about the civilian cyber 
campus concept, the cost and idea of putting everything in one 
place. I would like each of you to comment on that.
    Mr. Ozment, why don't you start? But I want all three of 
you to comment on that. I have concern about the cost. I have 
concern about trying to put everything in one place.
    So please comment on that.
    Mr. Ozment. So all departments and agencies that are 
involved in the cybersecurity mission have agreed in concept 
with the vision and goals and objectives of the cyber campus.
    It is planned to be a federally owned and operated facility 
that will house as original anchors DHS and DOJ cybersecurity 
elements. Our hope is that the campus will lessen and 
streamline the costs of operating what are currently dispersed 
and largely leased facilities while simultaneously enhancing 
unity of effort. Sometimes there is no substitute for being 
able to walk down the hall and talk to a person face-to-face.
    So we support the President's fiscal year 2016 request for 
$227 million in the GSA budget to began construction of the 
campus.
    Senator Hoeven. Do you have some kind of cost analysis that 
shows the relative cost of one consolidated campus versus 
multiple sites? Have you done a cost-benefit analysis where we 
can actually compare the costs?
    Mr. Ozment. I would have to defer to GSA for that broader 
analysis.
    Senator Hoeven. Okay. That would be something I would want 
to see.
    Mr. McCormack.
    Mr. McCormack. We also support the concept. As an agency, 
we wouldn't house our folks in there. We would continue to 
house our folks in our configuration as we have today, but we 
are obviously very interested in the information that we would 
share with the cyber campus and the information that would come 
out, very similar to what we do with NCCIC. We actually have 
someone installed in NCCIC, but our whole workforce isn't in 
the NCCIC.
    So certainly, we support the concept, but we as an agency, 
and I am sort of speaking on behalf of any agency, that the 
internal traditional cybersecurity organization that is 
protecting that agency doesn't plan on being in the cyber 
campus.
    Senator Hoeven. Mr. Garcia.
    Mr. Garcia. Mr. Chairman, I am afraid I am not well enough 
informed on the program to opine.
    Senator Hoeven. It was primarily for the other two, but I 
just wanted to see if you had any thoughts on it.
    Mr. Garcia. Thank you.
    Senator Hoeven. Okay, thank you.

                             STAFFING: PAY

    Senator Shaheen. Doesn't it, though, seem sort of 
counterintuitive that, when we are talking about issues around 
cybersecurity and around communicating virtually on the 
Internet, the only way we think we can do that is to build a 
brick-and-mortar campus? I mean, that seems to me like that 
sort of misses the point of what we are trying to accomplish 
here, that it would be better to put all that money into 
improving our IT systems rather than building a new building to 
put people together. You don't have to respond to that.
    But I do want to zero in on the issue of more flexibility 
in the pay scale. I don't know which one of you said that, 
whether it was you, Mr. McCormack, or you, Mr. Ozment. But one 
of the questions that I had is, as we are looking at providing 
additional flexibility so we can recruit and retain people, how 
do we include performance as part of what we factor in, in 
looking at how we're dealing with that flexibility in the pay 
scale?
    Mr. McCormack. I think that was me that mentioned that. I 
think I also mentioned that the first thing they'll do is a 
workforce assessment. And then through that analysis, and the 
pay analysis, they will take things into consideration, such as 
performance, also job categories and the level of training and 
those things.
    All of those things will get mixed together to make those 
determinations. I know that CHCO is working very closely with 
the DOD and the NSA, who has already done this, and using some 
of their policies and best practices. So I would expect all 
that to come together and then assess on the basis of, again, 
job performance. The type of job, the level of training, would 
then determine what type of pay or bonus or retention bonus, 
those sorts of things, that would be equated to that job 
position.
    Senator Shaheen. Okay. I think, clearly, this is an issue 
as we try to retain talent and recruit top talent. I think a 
bigger issue is the one you talked about, Mr. Ozment, and that 
is that we are not educating enough STEM graduates in this 
country.
    In New Hampshire alone, by 2018, we need 43,000 STEM 
graduates. So this is a huge issue and it is one we really need 
to think about, not just at the DHS level, but as we are 
looking at education and other ways that we can incentivize 
encouraging young people to go into those fields.
    I am going to leave you out of this Mr. Garcia, because 
this is a public question.
    To what extent and how do you all coordinate with DOD and 
with other agencies that have their own cyber centers?

                    COORDINATING WITH OTHER AGENCIES

    Mr. Ozment. So from the national and cross-governmental 
perspective, I can tell you we coordinate and collaborate 
deeply daily.
    Senator Shaheen. So give me an example.
    Mr. Ozment. So every morning at 8:30, the cyber centers, 
the six cyber centers, have a phone call where they all walk 
through all the issues.
    Senator Shaheen. Who are the six cyber centers?
    Mr. Ozment. NCI JTF, the National Cyber Investigative Joint 
Task Force, which is housed by the FBI; the NCCIC, which is 
part of DHS and NPPD; DCCC, the Defense Cyber Crime Center, and 
I will confess I don't know where it is geographically located, 
but the Department of Defense; the intelligence community----
    Senator Shaheen. I have a diagram for this. Go ahead.
    Mr. Ozment. Okay.
    Senator Shaheen. Now I see what you are talking about. Go 
ahead.
    Mr. Ozment. Indeed. The intelligence community. And I 
forget their acronym, forgive me, but their, essentially, 
cybersecurity team.
    Senator Hoeven. ICRC.
    Senator Shaheen. You are good. You have seen this before.
    Mr. Ozment. ICRC (Intelligence Contingency Readiness 
Center). Thank you.
    The U.S. Cyber Command Joint Operations Center and the NSA 
NTOC, the National Threat Operation Center.
    Senator Shaheen. So you all talk first thing in the 
morning?
    Mr. Ozment. We all talk daily. Now, you know, depending on 
the mission, some of us have more recurring close ties than 
others. But we also have liaison exchange.
    So on the NCCIC floor, for example, we have FBI liaisons, 
NSA, Northern Command, Cyber Command, Coast Guard, Homeland 
Security investigators, Secret Service. Those are the people 
there every day. Appearing about once per week or so, we have 
Treasury, Energy, and I am sure I am missing agencies. But we 
do a lot of liaisons and essentially swapping people.
    And we have our people out at almost all of the centers as 
well.
    Senator Shaheen. One of the things that you talked about 
when I visited the NCCIC was the fact that part of what you 
were looking for in this year's appropriation was to be able to 
anticipate and get ahead of cyber threats, to develop systems, 
whatever technology to be able to stay one step ahead of the 
hackers.
    How do you share that kind of effort among all of those 
agencies? So if you develop some great way to keep the system 
secure, do you share that with DOD, and vice versa?
    Mr. Ozment. Absolutely. The problem is too big for us to be 
worried about hoarding solutions. I will tell you I literally 
spent an entire day yesterday, and my schedule is nowhere near 
as busy as yours, but I rarely spend a full day in one place. I 
spent a full day with our Science and Technology Directorate at 
the National Security Agency literally having this 
conversation: Here's what we are finding works on the 
technology front. What are you finding? Is there anything we 
know about that you don't and vice versa? We have to stay 
together, and we have to stay abreast of this threat.
    And that is about the technology. On the actual information 
itself, Ranking Member, I failed to answer your question about 
information-sharing legislation, would you like me to give a 
few thoughts on that?

                    INFORMATION-SHARING LEGISLATION

    Senator Shaheen. Yes, that would be great.
    Mr. Ozment. It is critically important that we in the 
government share among ourselves whatever information we have 
about cyber threats. We are doing, frankly, a pretty darn good 
job of it, far better than at any time during my time in 
government.
    With respect to the cybersecurity information-sharing 
legislation, the administration believes that there should be 
one place where information from the private sector comes into 
government, and that is for two reasons.
    One is just efficiency. We need to give the private sector 
one coherent, consistent answer so they don't have to decide 
between multiple choices.
    The other is for privacy and civil liberties protections. 
The administration's proposal has a number of privacy and civil 
liberty protections in place, but one of them is to narrow what 
we are talking about. That is to narrow it to cyber threat 
indicators. These are the things used by network defenders to 
protect themselves against cyber threats and incidents. A cyber 
threat indicator doesn't mean you've had an attack or you've 
been broken into. A good defender learns about cyber threat 
indicators just by defending themselves.
    I got a phishing email. We were smart. We didn't click on 
the link. We identified it as phishing, but maybe nobody has 
ever seen it before. So I share the ``from'' address on this 
phishing email, and other people can protect themselves.
    There is no incident. But now we are all better off 
protected.
    So we believe that DHS should be the one portal by which 
this information comes into government. We believe that 
provides us with a better place to put in place privacy and 
civil liberties protection, because it is centralized and we 
can do our oversight there. The NCCIC is not law enforcement 
and it is not intelligence, so that gives comfort to those who 
are concerned about these issues.
    At the same time, we are very up front that we are getting 
this information and we are going to share it with our 
government partners, because we all need to see it in 
government. So while we will put in place the privacy 
protections to ensure that what we are passing on is 
appropriate, it is also incumbent upon us at DHS to make sure 
we get it to our partners at all the other cyber centers and 
relevant agencies in near real-time, once those privacy 
protections have been put in place.
    Senator Shaheen. So you think you can do that without 
legislation?
    Mr. Ozment. We absolutely need legislation to provide 
liability protection to the private sector, to give them the 
comfort to share information with us.
    Senator Shaheen. Thank you.
    Thank you, Mr. Chairman.
    Senator Hoeven. Thank you, Senator Shaheen.
    And we're finishing up at about the right time because we 
have votes that will start at about 4 o'clock.
    So I would like to thank all three of our witnesses. I 
think you did a really excellent job of laying out what you are 
doing. I think it was very helpful.
    Again, it's a tremendously complex area. It's really 
important that we are focused on it as a Nation and doing the 
very things that you are doing both in the public sector and in 
the private sector.
    As we take up this cyber legislation, it is going to be a 
real challenge. As Senator Shaheen said a minute ago, we tried 
once before to bring a bill forward, and there just is such a 
diversity of opinions out there in terms of how to do this. But 
it is a real challenge to get people with your level of 
expertise to work with policymakers to foster an understanding 
so that we can try to get this right.
    It is very important that we do. So I think you are going 
to continue to be right in the middle of some very, very 
important work.
    And I think, Mr. Garcia, as you said, or maybe it was Mr. 
Ozment, but I know all three of you recognize and appreciate 
that this is a process. It is not like we are going to do this 
and, gee, it's fixed, and we solved that problem, and we'll go 
do something else.
    This is a process, and we are going to continue to be 
working at it, for a long, long period of time, forever.
    So again, thanks. Appreciate it very much.
    Senator Shaheen, any closing comments?
    Okay, so this will conclude our hearing today. I want to 
thank all of the witnesses for your testimony and for the work 
that you do.

                     ADDITIONAL COMMITTEE QUESTIONS

    The hearing record will remain open for 2 weeks from today. 
Senators may submit written questions for the record. And we 
would ask that the witnesses respond to them within a 
reasonable length of time.
    [The following questions were not asked at the hearing, but 
were submitted to the Department subsequent to the hearing:]

                Questions Submitted to Hon. Andy Ozment
               Questions Submitted by Senator John Hoeven
        the multi-state information sharing and analysis center
    Question. The Multi-State Information Sharing and Analysis Center 
(MS-ISAC) is also the only ISAC receiving direct Federal assistance. 
Last year they received $9.7 million from DHS, and this year the 
President's budget recommends a reduction to $9 million. Even though 
all 50 States receive bulletins from the MS-ISAC, only 24 States and 
one territory receive Managed Security Services.
    What are some of the factors preventing all States from 
participating in the MS-ISAC?
    Answer. Please note the fiscal year 2015 MS-ISAC budget is $12.956 
million, rather than the $9.7 million the question references. All 50 
States are members of the MS-ISAC, along with 679 local governments, 
three territories and eight tribal governments. Over the past few 
years, DHS has worked with the MS-ISAC to expand its Albert monitoring 
system, an automated cybersecurity information analysis tool, to all 50 
States and six territories in fiscal year 2015, beyond the 33 States 
currently covered by the program. However, State participation in 
Albert requires a lengthy State approval and onboarding process. Many 
States have a process that includes approval from political appointees, 
Generals Counsel, and technology managers. Our primary stakeholders, 
CISOs, have an understanding of what Albert does but it can take time 
to get that information up the decision chain. Participation is 
completely voluntary and some States are determining whether the 
approval timeframe addresses their requirements.
    Question. Will the reduction in funding reduce the capability for 
the MS-ISAC to provide its current level of service?
    Answer. DHS will be working to right size the MS-ISAC budget based 
off growing DHS requirements and mission and in response to the level 
of State and territory participation in the cost-share initiative for 
fiscal year 2017 and beyond. DHS stands by the funding request and 
fully supports the President's budget. We worked through a process to 
request enough funding this year so that, along with the carryover, we 
would maintain our current level of support.
    The MS-ISAC reduction in fiscal year 2016 exceeds the estimated 
cost share amount due to late fiscal year obligations. MS-ISAC 
obligations are done at the end of the fourth quarter of each fiscal 
year, thereby causing MS-ISAC to draw down against those prior year 
funds during the following fiscal year.
                                 ______
                                 
              Questions Submitted by Senator Thad Cochran
    Question. Could you explain to the subcommittee the function and 
value of developing and utilizing test ranges in the cyber domain?
    Answer. Cyber test ranges fulfill two principal functions. First, 
test ranges can be used to test and evaluate cyber technologies, 
products, and systems. A test range provides a suite of tools, 
processes and expertise to evaluate products under conditions that 
simulate operational use in order to capture key indicators of product 
performance. Test ranges can deploy networks of simulated government 
and commercial organizations with real world applications, services and 
content. For example, the National Cyber Range (NCR) deployed a 
simulated public Internet environment for USCYBERCOM's Cyber Flag 
exercises that provided realistic content from hundreds of foreign and 
domestic Web sites and instantiations of cafe, school, hospital, 
commercial, and home networks. Ranges such as the NCR can employ live 
malware, red teams, and classified tactics, techniques, and procedures 
tied to specific threat actors to evaluate whether and how a particular 
product mitigates basic and advanced threats. Within DHS, the Office of 
Science and Technology has partnered with the National Science 
Foundation to develop the Defense Technology Experimental Research 
(DETER) test-bed, which is used to test and evaluate cybersecurity 
technologies, including DHS-funded researchers, the larger 
cybersecurity research community, government, industry, academia and 
educational users.
    Second, a cyber test range can be used for educational purposes. It 
can provide a virtual training environment where cybersecurity 
professionals can practice or demonstrate competency in a skill or 
ability. Training activities using a cyber test range also provide 
opportunities for operational teams to demonstrate their collective 
ability to analyze unique threats, work together to develop effective 
countermeasures, and to develop and test contingencies in an effective 
and timely manner.
    Question. Does the administration's fiscal year 2016 budget request 
provide adequate resources to address evolving Department requirements 
and cybersecurity test capabilities?
    Answer. The administration's fiscal year 2016 budget request 
provides adequate resources to address evolving departmental 
requirements and cybersecurity test capabilities. Furthermore, the 
request includes resources for several high-priority areas including: 
Incident response, analysis, automated information sharing and capacity 
building for non-Federal stakeholders. As part of our ongoing work to 
support the nation's cybersecurity, we work with industry and 
government partners to identify and evaluate open source tools and to 
develop technology to improve interoperability among tools to reduce 
the time for detection and mitigation of cyber events.
    Question. Does the National Guard's unique flexibility to move 
between the commands of Governors and the President position it to be a 
particularly useful organization for defending against cyber-attacks?
    Answer. The National Guard's diverse capabilities as well as their 
unique authorities under State Active Duty and title 32 make them a 
useful organization for defending against cyber attacks. Many National 
Guard members have cybersecurity experience from industry, making them 
highly qualified to understand the cyber threat to civilian 
infrastructure and serve as an effective partner with DHS. DHS 
regularly conducts exercises with the National Guard, including last 
year's Cyber Guard. In this 2-week exercise, DHS, the National Guard, 
and other interagency partners tested operational and interagency 
coordination as well as tactical-level operations to protect, prevent, 
mitigate and recover from a domestic cyber incident. On the other hand, 
the National Guard cannot be the only answer to our needs. For example, 
members of the Guard may be needed at their private sector companies 
during a cyber emergency, to mitigate the impacts at those companies. 
To the extent that the National Guard participates in cybersecurity 
activities, we would welcome their integration into existing response 
capabilities and established Federal and National Security response 
relationships while assisting in defending State cyber critical 
infrastructure.
    Question. Your Department has been recognized for its excellent 
efforts in consolidating its information technology infrastructure and 
the savings these efforts will generate. Generally speaking, is it your 
judgment that it is easier to protect these assets when they are 
consolidated and accounted for or when they are scattered around the 
Government?
    Answer. Consolidation improves the Federal Government's security 
posture and incident response capability. Consolidation of assets 
provides the opportunity for enhanced monitoring and situational 
awareness across the Federal enterprise. Economies of scale can be 
achieved by grouping assets to key strategic locations. But of 
paramount importance is the ability to identify and account for assets. 
Without that capability, security professionals are unable to monitor, 
patch, configure or otherwise secure them.
    Question. While it is widely accepted that a foreign or terrorist 
cyber-attack on our electric grid, water systems, or financial systems 
could cause widespread damage and have detrimental effects on our 
economy and consumer confidence, there has been much discussion about 
how involved the Federal Government should be in defending 
infrastructure owned by non-Federal entities. How would you define the 
threshold for what types of non-Federal infrastructure might qualify as 
``critical'' for these purposes?
    Answer. The Department of Homeland Security's National 
Infrastructure Protection Plan, or NIPP, defines critical 
infrastructure as the ``assets, systems, and networks, whether physical 
or virtual, so vital to the United States that their incapacitation or 
destruction would have a debilitating effect on security, national 
economic security, national public health or safety, or any combination 
thereof.'' The destruction or unavailability of any critical entity can 
have a cascading effect, either within a supply chain or across 
sectors. It is also true that while an individual disruption may not 
appear to meet a threshold meriting Federal interference, in fact, an 
immediate and coordinated Government response is essential to the 
continuity of critical services and to overall national security. The 
distinction between publicly and privately held infrastructure does not 
dictate whether it merits a Federal response to ensure continuity of 
services and mitigation of effects, including cascading effects.
    Further, Executive Order 13636 section 9 directed DHS to identify 
critical infrastructure that could be impacted by a cybersecurity 
incident reasonably resulting in catastrophic regional or national 
effects on public health or safety, economic security, or national 
security. DHS therefore conducts proactive outreach to those entities 
on the section 9 list to ensure that they participate in available 
cybersecurity programs and are aware of assistance available from DHS 
and its partner agencies.
    Question. I have heard about the importance of cooperation and 
clearly defined lanes of responsibility across the Federal Government 
for our cybersecurity efforts. What are your respective roles in 
receiving and sharing threat information with the private sector?
    Answer. The Office of Cybersecurity and Communications (CS&C), 
within the National Protection and Programs Directorate, is responsible 
for enhancing the security, resilience, and reliability of the Nation's 
cyber and communications infrastructure. CS&C is working to create a 
cyber environment where a given threat, such as a malicious email, can 
only be used once before it is blocked by all other potential victims. 
This will reduce the frequency of successful cybersecurity 
exploitations and deter adversaries by increasing the investment 
required for a single successful attack. To this end, DHS helps 
companies develop information sharing capabilities, fosters the 
development of information sharing and analysis organizations, and 
serves as a portal to share cybersecurity information with a wide range 
of organizations.
    Within CS&C, the National Cybersecurity and Communications 
Integration Center (NCCIC) provides 24x7 cyber situational awareness, 
incident response, and incident coordination capabilities. The NCCIC 
serves as a nexus between the private sector, Federal Government, 
intelligence community, and law enforcement. The NCCIC works closely 
with other Federal departments and agencies with additional 
cybersecurity responsibilities, including the FBI, the Department of 
Defense, and Sector Specific Agencies such as the Departments of 
Treasury and Energy. Further, a number of private sector companies and 
Information Sharing and Analysis Centers (ISACs) maintain seats on the 
NCCIC floor, allowing ongoing collaboration around cybersecurity 
threats, vulnerabilities, and incidents. Departments/Agencies and ISACs 
that have a person on the NCCIC floor at least 1 day a week: Department 
of Defense Cyber Crime Center; Department of State; Department of 
Energy; Department of Health & Human Services; Department of Treasury; 
FBI; U.S. Secret Service; NSA; NORAD/USNORTHCOM; US Coast Guard; 
USCYBERCOM; Financial Services-ISAC; Multi-State-ISAC; Aviation-ISAC; 
DHS National Operations Center; DHS ICE/HSI. There are also 114 private 
companies that have signed a CRADA and collaborate with the NCCIC via 
the Critical Infrastructure and Key Resources Cyber Information Sharing 
and Collaboration Program (CISCP).
    The National Cybersecurity Protection Act of 2014 recognized the 
NCCIC to be responsible for coordinating information sharing related to 
cybersecurity risks and to be the Federal civilian interface for multi-
directional and cross-sector sharing of cybersecurity risks and 
warnings. The NCCIC has representatives from the private sector and 
from other Federal entities involved in cyber information sharing work 
at a range of levels, from those with whom we have a formal Cooperative 
Research and Development Agreement (CRADA, a negotiated agreement that 
defines the parameters of the information sharing relationship) and 
share consistently, to those that passively receive information from 
the Center.
    CS&C shares information in three principal ways; first, by sharing 
machine-readable threat indicators that can be immediately used for 
network defense; second, by sharing alerts, bulletins, and warnings 
that provide detailed technical context to allow cybersecurity 
practitioners to understand particular risks and implement necessary 
mitigations; and finally, by convening communities of interest to 
engage in in-depth collaboration. In all of these activities, the NCCIC 
works with its Government partners to ensure that shared information 
reflects the collective knowledge of the inter-agency and is both 
timely and actionable to help protect private sector networks.
                                 ______
                                 
              Questions Submitted by Senator Patty Murray
    Question. Dr. Ozment, as I understand, the Enhanced Cybersecurity 
Services (ECS) program is currently limited to the two commercial 
service providers (CSPs) currently qualified by the Department. How 
does the Department measure the efficacy of these programs? What are 
the current barriers to qualifying CSPs or attracting additional CSPs 
to ECS? Last, has the Department explored partnering with other 
commercial providers in different critical infrastructure sectors?
    Answer. As of May 2015, the ECS program has three (3) fully 
operational CSPs--AT&T, CenturyLink, and Verizon--and expects a fourth 
CSP to begin providing service this summer. The fourth CSP is not a 
traditional Internet Service Provider. The Department measures the 
success of this program by the increasing number of accredited CSPs, 
interest by individual companies in receiving services from a CSP, and 
monthly/weekly program performance reports. The performance reports 
highlight the number of ECS indicators that triggered as hits and show 
trends by sector and threat actor. The barriers for CSPs participating 
in the program result from the nature of working with companies on a 
classified program, particularly those that do not already have a top 
secret facility clearance, cleared individuals, or a Sensitive 
Compartmented Information Facility (SCIF). There are also resources 
required of potential CSPs to design, build, and gain accreditation of 
ECS systems. There is a cost to DHS to accredit CSPs, and we have 
requested enough funding in the fiscal year 2016 budget to pay for four 
new CSPs and to maintain the anticipated four CSPs from 2015. There is 
also a cost for the secure communications link, and we have budgeted 
for that as well.
    The Department proactively partners with any company interested in 
becoming a CSP and continues to encourage representation across 
critical infrastructure sectors.
              national protection and programs directorate
    Question. Dr. Ozment, notwithstanding the current reach of ECS, how 
does the Department account for differing cyber analysis and response 
capabilities among State, local, tribal, and territorial (SLTT) 
government users? How is the Department supporting efforts like those 
ongoing in my home State of Washington to burnish these cyber 
capabilities among small and potentially vulnerable elements across 
critical infrastructure sectors?
    Answer. In an effort to better support SLTT governments and provide 
technical expertise and outreach, DHS provides four primary 
initiatives: funding the MS-ISAC, offering voluntary risk assessments, 
holding cybersecurity exercises, and offering incident response 
assistance. The MS-ISAC is the DHS-designated Information Sharing and 
Analysis Center (ISAC) for all SLTT governments. The MS-ISAC supports 
SLTT governments by providing education and awareness, a 24x7 security 
operations center, and technical expertise in malware analysis, 
forensic analysis and incident response/mitigation. The MS-ISAC acts as 
a force-multiplier for DHS in reaching out to the tens of thousands of 
SLTT governments across the country.
    Further, DHS partners with SLTT governments to help them understand 
and manage their cybersecurity risk. DHS offers risk assessments such 
as the Cyber Resilience Review and the annual Nationwide Cyber Security 
Review that help SLTT governments understand their capabilities in 
performing, planning, managing, and measuring cybersecurity practices 
and behaviors. DHS also offers more technical in-depth assessments, 
such as Cyber Hygiene and Risk and Vulnerability Assessments, which 
take a closer look at SLTT government networks and offer specific 
recommendations to improve security and resilience. These assessments, 
and other resources, are available via the Critical Infrastructure 
Cyber Community (C3) Voluntary Program, developed to support 
implementation of the Cybersecurity Framework. The C3 Voluntary Program 
offers a Web site that provides programs and resources to all DHS 
customers, including SLTT governments.
    Additionally, DHS develops and manages large and small-scale cyber 
exercises with SLTT governments to test incident response plans and 
continuity. These exercises, conducted on location at DHS and in the 
field, offer SLTT governments the opportunity to evaluate their 
collaboration with intra-State partners, other SLTT governments, and 
Federal agencies, under simulated conditions of a cybersecurity 
incident.
    Finally, DHS' US-CERT provides incident response assistance at the 
request of the affected entity. SLTT governments impacted by a 
cybersecurity incident can request either on-site or remote assistance 
to identify the extent of a potential compromise, remove the adversary 
from the affected network, and restore critical services to a more 
secure State.
    Question. Dr. Ozment, as you are aware, significant pieces of 
critical infrastructure in Washington is owned and operated by public 
sector entities, such as local governments and public utility 
districts. With that in mind, how does the Department plan to provide 
adequate instrumentation and analytic capacity to support real-time 
information sharing about cybersecurity threats to these types of 
public sector entities? What steps has the Department taken to 
integrate its current framework--including the National Cybersecurity 
and Communications Integration Center, computer emergency response 
teams, and information sharing and analysis centers--with these 
entities?
    Answer. DHS provides a range of resources to enhance the 
cybersecurity of public sector entities including public utilities. The 
National Cybersecurity and Communications Integration Center (NCCIC) is 
the Federal civilian interface for multi-directional and cross-sector 
sharing of information about cybersecurity risks and warnings. The 
NCCIC has representatives from private sector and from other public 
entities involved in cyber information sharing work at a range of 
levels, providing support and expertise to critical infrastructure 
owners and operators. The NCCIC works through the Multi State 
Information Sharing and Analysis Center (MS-ISAC) to provide 
cybersecurity expertise and information to State and local governments. 
Further, the MS-ISAC has two representatives with seats on the NCCIC 
floor.
    DHS' Cyber and Information Sharing Collaboration Program (CISCP) 
provides a platform for organizations to receive, share, and 
collaborate around unclassified threat and vulnerability information. 
Currently, this information sharing is primarily manual via email and a 
secure portal. Therefore, DHS is moving quickly to deploy automated 
indicator sharing, which will allow organizations to share and receive 
cyber threat indicators in near-real-time, formatted to be used 
immediately for network defense (in a format known as STIX/TAXII). With 
Automated Indicator Sharing, cyber threat information can be shared and 
applied to network defenses before the adversary can launch an attack. 
As a starting point, organizations, including public sector entities, 
can join DHS' Cyber Information Sharing and Collaboration Program 
(CISCP). CISCP currently provides a number of benefits, including 
analyst-to-analyst collaboration, detailed technical bulletins, and in-
depth information exchanges, and will allow participants to benefit 
from Automated Indicator Sharing.
    Public sector entities are also eligible to pay a commercial 
service provider for Enhanced Cybersecurity Services (ECS), which uses 
classified cyber threat indicators to detect and block potential cyber 
attacks. Additionally, the US Computer Emergency Readiness Team (US-
CERT) and the Industrial Control Systems Cyber Emergency Response Team 
(ICS-CERT) provide a range of technical information and resources to 
support the cybersecurity of critical infrastructure, including public 
utilities. Among the services offered by US-CERT and ICS-CERT are on-
site assessment and response assistance, particularly upon the request 
of an organization affected by a cybersecurity incident.
                                 ______
                                 
                 Questions Submitted to Luke McCormack
              Questions Submitted by Senator Thad Cochran
    Question. Your Department has been recognized for its excellent 
efforts in consolidating its information technology infrastructure and 
the savings these efforts will generate. Generally speaking, is it your 
judgment that it is easier to protect these assets when they are 
consolidated and accounted for or when they are scattered around the 
Government?
    Answer. Consolidation of IT applications, services, and 
infrastructure results in stronger security and accountability, which 
enhances our Nation's preparedness, mitigation, and recovery 
capabilities.
    Question. While it is widely accepted that a foreign or terrorist 
cyber-attack on our electric grid, water systems, or financial systems 
could cause widespread damage and have detrimental effects on our 
economy and consumer confidence, there has been much discussion about 
how involved the Federal Government should be in defending 
infrastructure owned by non-Federal entities. How would you define the 
threshold for what types of non-Federal infrastructure might qualify as 
critical for these purposes?
    Answer. NPPD covers policies and outreach to non-Federal 
infrastructure however if there was an area that could utilize 
assistance and knowledge from the Federal Government it is the private 
Information Technology sector more specifically private Internet and 
Network Service providers. These entities can utilize Government best 
practices and shared operational data to combat the advanced persistent 
threat and mitigate known and unknown threats before they impact the 
respective networks.
    Question. I have heard about the importance of cooperation and 
clearly defined lanes of responsibility across the Federal Government 
for our cybersecurity efforts. What are your respective roles in 
receiving and sharing threat information with the private sector?
    Answer. OCIO does not have a direct role in sharing information 
with private sector entities. However, when indicators of compromise or 
any other advanced threat information has been discovered on the DHS 
network the information is shared with NPPD for external dissemination 
of relevant threat information to our industry partners. A number of 
indicators and threat based alerts that have been disseminated by NPPD 
are authored by DHS internal Security Operations Centers and released 
for situational awareness to all interested parties.
                                 ______
                                 
              Questions Submitted by Senator Bill Cassidy
 safeguarding and protecting sensitive and classified documents at dhs
    Question. In response to the recent leaks of sensitive and 
classified information (OPM SF-86, Wikileaks, Snowden) and in an effort 
to adhere to The White House Executive Order 13587--Structural Reforms 
to Improve the Security of Classified Networks and the Responsible 
Sharing and Safeguarding of Classified Information, the subcommittee is 
following up to get a status check on how the Department of Homeland 
Security is specifically securing classified and sensitive information 
and documents inside and outside its departmental content management 
systems.
    Answer. The Office of Intelligence and Analysis (I&A) and the Chief 
Information Officer's (CIO's) response is limited to the securing 
classified and sensitive information and documents inside Departmental 
Content Management Systems.
    I&A Document Content Management Systems employ a variety access 
control mechanisms. The mechanisms restrict access to specifically 
authorized users and are implemented at the network, system and 
application layers. User access controls are transitioning to Identity 
and Access Management (IdAM) which is the combination of technical 
systems, policies and processes that create, define, and govern the 
utilization and safeguarding of identity information, as well as 
managing the relationship between an entity and the resources to which 
access is needed. Currently, IdAM is not completed implementation on 
all Document Content Management Systems.
    In addition to enhancing the access to the Document Content 
Management Systems, I&A has integrated the enterprise audit program and 
the Information Security Continuous Monitoring program to safeguard the 
Document Content Management Systems. These measures combined with other 
Computer Network Defense and the Insider Threat programs have greatly 
enhanced the security posture of Document Content Management Systems.
                           document security
    Question. The issue of document security was specifically mentioned 
in the fiscal year 2015 House Homeland Security Appropriations Report 
(H.R. 113-481, page 22 and was not revised or negated in the 
explanatory statement of H.R. 240 as finally passed):
    ``The Committee remains concerned over the need to protect 
classified information, especially as to methods used to secure paper 
forms, which can be scanned, faxed, copied, or otherwise stolen or 
compromised. Existing, off-the-shelf commercial technologies can be 
used to monitor document access and alert security personnel when 
sensitive documents are at-risk. The Committee directs the Department 
to report to the relevant committees of jurisdiction, within 90 days 
after the date of enactment of this Act, on the measures currently 
being used to ensure hard copy document security.''

    Does the Department of Homeland Security (DHS) have any information 
security programs in place that encrypts, analyzes and monitors 
sensitive digital content, documents and information, (MS Office, PDFs, 
CADE files, videos, etc.) inside and outside the firewall of 
departmental databases?
    Answer. There are no immediate plans to fund and deploy enterprise-
wide DRM technologies however; OCIO is researching possible solutions 
to meet this area of concern. DHS data at rest on computing devices, in 
its data centers and as it traverses its networks is routinely 
encrypted for protection.
    In general, insider threat monitoring is fully in place on C-LAN 
and a pilot effort is in progress for HSDN. OCSO is in charge of this 
effort, with cooperation from OCIO and other Components. The Insider 
Threat program includes the monitoring and analysis of user activity on 
the network, but does not include any encryption of content.
    Question. Understanding the Department has a significant volume of 
sensitive and personally identifiable information (PII), does the 
Department's CIO or CISO have plans to fund and deploy enterprise-wide 
secure content management or digital rights management (DRM) 
technologies across the Department to protect against future leaks of 
information?
    Answer. At this time, capabilities such as the deployment of 
digital rights management capabilities are localized and not provided 
at an enterprise level under OCIO. The current fiscal year 2016 budget 
request does not yet include development of these capabilities for 
unclassified systems. I&A would be responsible for implementing DRM on 
TS/SCI systems (C-LAN), while OCIO would create a request for the HSDN 
network.
    However, DHS will be prepared to make marked progress due to the 
fiscal year 2014 and fiscal year 2015 initiatives the Department has 
made in ensuring that over 85 percent of its employees use a PIV card 
for access to the network. The OCIO has been working to expand 
capabilities which are foundational to providing enterprise 
safeguarding services as part of its security-in-depth to further 
protect data within DHS firewalls, and in the future as data leaves its 
firewalls. In the fiscal year 2016 President's budget request, DHS has 
plans to implement a trusted identity exchange that is critical to 
implementing additional data level security on sensitive but 
unclassified and classified networks such as the fine grained access 
controls critical to the success of the DHS Data Framework program 
(unclassified and classified), and the protection of data and 
information as it would leave the Homeland Security Information Network 
(unclassified).
                       digital rights management
    Question. Digital rights management (DRM) is a technology already 
widely used by the commercial sector and intelligence community to 
protect and continuously monitor sensitive documents and information. 
DRM works by encrypting information (Microsoft Office, PDFs, CAD files, 
and other digital formats) with NSA standard encryption, allowing 
Government officials to determine whether sensitive or classified 
documents may be accessed internally or externally from the 
Government's trusted environments. The encryption is embedded within 
the document itself, rather than wrapping the document with a security 
envelope, which can be discarded by trusted Government employees and 
forwarded unprotected. This embedding of encryption is a key 
differentiator that ensures the encryption stays with the document even 
if it is duplicated or emailed. Because of this feature, the DRM 
solution completely prevents unwanted access to sensitive or classified 
documents and allows the Government to control saving, copying, screen-
capturing, and printing.
    Digital rights management, once applied to a digital piece of 
evidence/intelligence, will track and potentially restrict every 
interaction with that digital content, protecting against unauthorized 
insider access and dissemination. This solution also provides chain of 
custody tracking for evidence processing both inside and outside of 
firewalls. In addition, DRM telemetry data can be used to measure the 
effectiveness of the DI's communication and information dissemination 
campaign. This is accomplished by tracking what was opened, how long 
was it was open (read), was it printed or edited, how often someone 
returns to read that content and geographically where the incident 
occurred. This is achieved through three primary functions, 
authentication, authorization and auditing (telemetry data).
Authentication
    Question. Who is opening (successful or not) DRM'd content, with 
watermark attribution and geographical location identification.
    Answer. At this time, capabilities such as the deployment of 
digital rights management capabilities are localized and not provided 
at an enterprise level under OCIO. The current fiscal year 2016 budget 
request does not yet include development of these capabilities for 
unclassified systems. I&A would be responsible for implementing DRM on 
TS/SCI systems (C-LAN), while OCIO would create a request for the HSDN 
network.
Authorization
    Question. What actions are they permitted to take? Has the content 
expired or been revoked.
    Answer. At this time, capabilities such as the deployment of 
digital rights management capabilities are localized and not provided 
at an enterprise level under OCIO. The current fiscal year 2016 budget 
request does not yet include development of these capabilities for 
unclassified systems. I&A would be responsible for implementing DRM on 
TS/SCI systems (C-LAN), while OCIO would create a request for the HSDN 
network.
Audit
    Question. The ability to know who is accessing DRM'd content, what 
actions are they taking, when this event took place and geographically 
where this event happened. Additional metrics can easily be added if a 
counterintelligence officer wants to drill into a specific user to 
detect anomalistic behavior to see what documents they are accessing, 
when they accessed those documents and whether this a deviation from 
their normal behavior.
    Answer. At this time, capabilities such as the deployment of 
digital rights management capabilities are localized and not provided 
at an enterprise level under OCIO. The current fiscal year 2016 budget 
request does not yet include development of these capabilities for 
unclassified systems. I&A would be responsible for implementing DRM on 
TS/SCI systems (C-LAN), while OCIO would create a request for the HSDN 
network.
    The use of DRM like solutions has been mandated by the Office of 
the Director of National Intelligence (ODNI) and the White House 
through multiple directives.
                                 ______
                                 
 Questions Submitted to the Office of the Chief Human Capital Officer, 
                    Department of Homeland Security
               Questions Submitted by Senator John Hoeven
              meeting cybersecurity workforce requirements
    Question. The Government has had many challenges in recruiting and 
training capable IT personnel. Cybersecurity needs have compounded that 
challenge. As a result, DHS has a significant number of vacancies in 
its cyber workforce. We've certainly heard stories of people being 
recruited away from the Federal Government, but haven't seen metrics or 
data behind this outflow.
    Late last year, Congress passed cybersecurity pay reform 
legislation giving the Secretary flexibility in classifying and 
upgrading key positions. It was an attempt to make the Government more 
competitive with the private sector. Further, the fiscal year 2016 
budget includes a request for $31.3 million (1,400 personnel) including 
$16.3 million for NPPD for the CyberSkills Management Initiative 
(CSMI). In regard to this request, please provide the following:
    A. Attrition statistics justifying the need for the $31.3 million 
request.
    Answer. DHS averages a vacancy rate of approximately 5 percent in 
the population of approximately 1,400 Federal civilian positions 
present in the Department's Cybersecurity Workforce Inventory database. 
This population of positions is spread across 12 different DHS 
components and headquarters organizations and over 15 occupational 
series.
    In response to Public Law 113-277 and Public Law 113-246, the 
CyberSkills Management Support Initiative is leading a Department-wide 
effort to enhance its cybersecurity workforce planning and analysis 
activities to meet new statutory reporting requirements and to prepare 
for the implementation of new human capital authority, which will 
eventually affect the hiring and compensation of cybersecurity 
positions.
    Question. We have a financial breakdown by component of the CSMI 
but lack detail on the number of personnel and how precisely the funds 
would be distributed across the Department. Please provide a breakdown 
by component of all positions including transfers, new hires, and those 
receiving incentive packages.
    Answer. Current proposals distribute the $31.3 million across 
components based on data derived from the Cybersecurity Workforce 
Inventory database and modified based on component budget input. The 
Department's intention is for the Office of the Chief Financial Officer 
and the Office of the Chief Human Capital Officer to use the results of 
data calls being conducted now as part of the effort to refine this 
distribution prior to the start of fiscal year 2016; the new dataset of 
mission critical cybersecurity positions that will help to inform 
funding is expected to be available in September 2015. A portion of the 
$31.3 million will be used to increase headquarters and component human 
capital infrastructure to ensure effective implementation and eventual 
operationalization of new authority granted by Public Law 113-277; 
remaining funds will be proportionally distributed to components based 
on the size of their validated, mission critical cybersecurity 
workforce. This data will be complete by the end of fiscal year 2015. 
Components will use these funds to support targeted recruitment and 
retention strategies. The administration of such flexibilities must be 
done at the component/organization level, and each case in question, 
including the circumstances of the specific employee/new hire and 
position, must meet regulatory and policy requirements to ultimately 
justify the decision to make a payment.
    Question. For those positions requiring hiring (versus retention 
incentives), how many existing vacancies within each component will be 
filled through the CyberSkills Management Support Initiative, and how 
many can be filled by the end of fiscal year 2016?
    Answer. The CyberSkills Management Support Initiative plans to 
institute new workforce planning processes throughout fiscal year 2016 
to closely monitor component vacancies using data gathered via the 
comprehensive cybersecurity workforce analysis process. In addition to 
providing leadership with more insight than ever into staffing gaps and 
similar issues, the data will be used to inform targeted interventions 
with component cyber program managers and human capital staff. This 
data will be complete by the end of fiscal year 2015. This coordinated 
approach will help to ensure that DHS effectively uses its hiring and 
retention flexibilities, and to address the most critical vacancies as 
quickly as possible.
    Question. A breakdown by job category and grade-level for each of 
the positions.
    Answer. At the start of fiscal year 2016, the Department expects to 
have a new database capturing the mission critical cybersecurity 
workforce validated through the comprehensive cybersecurity workforce 
analysis effort. Currently available data collected by the 
cybersecurity workforce inventory process in place since 2012 indicates 
the following for the population of approximately 1,400 civilian and 
active duty Coast Guard positions which the Department has been 
monitoring:

                                   WORKFORCE BY OCCUPATIONAL SERIES AND GRADE
----------------------------------------------------------------------------------------------------------------
                                                Management                 Information
                                 Intelligence  and program     Criminal     technology
                                     (0132)      analysis   investigation   management     Other        Total
                                                  (0343)        (1811)        (2210)
----------------------------------------------------------------------------------------------------------------
GS-07..........................             1  ...........  .............  ...........  ...........            1
GS-09..........................             1  ...........  .............            5            2            8
GS-11..........................             4  ...........             2            19  ...........           25
GS-12..........................             2            1            21            52            2           78
GS-13..........................            14            2           583           102           11          712
GS-14..........................            12            6            61           214           18          311
GS-15..........................             5            2             8            49            4           68
G Band.........................  ............            1  .............  ...........  ...........            1
H Band.........................  ............  ...........  .............            4  ...........            4
I Band.........................  ............            3  .............           20            6           29
J Band.........................             2            2  .............           49            2           55
K Band.........................  ............  ...........  .............            9            1           10
L Band.........................  ............  ...........  .............            1  ...........            1
Executive (SES, SL, ST, etc.)..  ............  ...........  .............            1            8            9
Commissioned Officer (O-1                   4  ...........  .............           11  ...........           15
 through O-10).................
Chief Warrant Officer (W-2       ............  ...........             7            26  ...........           33
 through W-4)..................
Non-Commissioned Officer (E-4               1  ...........             3            27  ...........           31
 through E-9)..................
Other..........................  ............  ...........  .............  ...........            3            3
                                --------------------------------------------------------------------------------
      Total....................            46           17           685           589           57        1,394
----------------------------------------------------------------------------------------------------------------

    Question. The Office of the Chief Human Capital Officer intends to 
work with components to track the population of mission critical 
cybersecurity positions and al flexibilities used to recruit or retain 
employees associated with those positions throughout fiscal year 2016.
    What conditions are being attached to the incentives? In other 
words, will recipients be required to stay with the Government for a 
period of time after receiving the additional pay?
    Answer. As indicated in our response to the second question, the 
act of granting an incentive to a new hire or employee requires that 
each case in question, including the circumstances of the specific 
employee/new hire and position, meet regulatory and policy requirements 
to ultimately justify the decision to make a payment. Once an incentive 
is approved, an employee must also sign a written agreement to complete 
a specified period of employment with the agency. For example, a 
recruitment incentive service agreement must specify the length, 
commencement, and termination dates of the service period; the amount, 
method and timing of incentive payments; the conditions under which an 
agreement will be terminated by the agency; any agency or employee 
obligations if a service agreement is terminated (including the 
conditions under which the employee must repay an incentive); and any 
other terms and conditions for receiving and retaining a recruitment 
incentive.
                                 ______
                                 
    Questions Submitted to the Office of the Chief Security Office, 
                    Department of Homeland Security
              Questions Submitted by Senator Bill Cassidy
 safeguarding and protecting sensitive and classified documents at dhs
    Question. In response to the recent leaks of sensitive and 
classified information (OPM SF-86, Wikileaks, Snowden) and in an effort 
to adhere to The White House Executive Order 13587--Structural Reforms 
to Improve the Security of Classified Networks and the Responsible 
Sharing and Safeguarding of Classified Information, the subcommittee is 
following up to get a status check on how the Department of Homeland 
Security is specifically securing classified and sensitive information 
and documents inside and outside its departmental content management 
systems.
    Answer. The totality of these mandates and initiatives are managed 
in the Department of Homeland Security by the Information Sharing and 
Safeguarding Governance Board (ISSGB). The elements involved include 
information systems enterprise audit programs, information assurance 
programs, insider threat user activity monitoring, physical security of 
facilities and system hubs, rigorous access control programs for 
physical and virtual environments, personnel security background checks 
and periodic reviews, developing programs involving the continuous 
evaluation of personnel holding security clearances, and active 
training and awareness programs for all cleared personnel. Recommend 
assigning this question to OCIO and I&A.
                           document security
    Question. The issue of document security was specifically mentioned 
in the fiscal year 2015 House Homeland Security Appropriations Report 
(H.R. 113-481, page 22 and was not revised or negated in the 
explanatory statement of H.R. 240 as finally passed):

``The Committee remains concerned over the need to protect classified 
information, especially as to methods used to secure paper forms, which 
can be scanned, faxed, copied, or otherwise stolen or compromised. 
Existing, off-the-shelf commercial technologies can be used to monitor 
document access and alert security personnel when sensitive documents 
are at-risk. The Committee directs the Department to report to the 
relevant committees of jurisdiction, within 90 days after the date of 
enactment of this Act, on the measures currently being used to ensure 
hard copy document security.''

    What is the Department doing to respond to the fiscal year 2015 
House Homeland Security Appropriations Report ``Document Security'' 
language? Specifically, will the Department respond with some program 
details as to how to address document security issues? And, is this 
report on track to be submitted within the 90-day period directed by 
Congress?
    Answer. The response to the required report was submitted on time 
to Congress June 1, 2015.

                          SUBCOMMITTEE RECESS

    Senator Hoeven. And with that, this subcommittee stands in 
recess. Again, my thanks.
    [Whereupon, at 3:58 p.m., Wednesday, April 15, the 
subcommittee was recessed, to reconvene at a time subject to 
the call of the Chair.]

                                   -
```