IIB 

114TH CONGRESS 

1ST SESSION H. R. 3361 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 3, 2015 

Received; read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

AN ACT 

To amend the Homeland Security Act of 2002 to establish 

the Insider Threat Program, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


asabaliauskas on DSK5VPTVN1PROD with BILLS
2 

HR 3361 RFS 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Department of Home3 land Security Insider Threat and Mitigation Act of 2015’’. 

4 SEC. 2. ESTABLISHMENT OF INSIDER THREAT PROGRAM. 

5 (a) IN GENERAL.—Title I of the Homeland Security 

6 Act of 2002 (6 U.S.C. 111 et seq.) is amended by adding 

7 at the end the following new section: 

8 ‘‘SEC. 104. INSIDER THREAT PROGRAM. 

9 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab10 lish an Insider Threat Program within the Department. 

11 Such Program shall— 

12 ‘‘(1) provide training and education for Depart13 ment personnel to identify, prevent, mitigate, and re14 spond to insider threat risks to the Department’s 

15 critical assets; 

16 ‘‘(2) provide investigative support regarding po17 tential insider threats that may pose a risk to the 

18 Department’s critical assets; and 

19 ‘‘(3) conduct risk mitigation activities for in20 sider threats. 

21 ‘‘(b) STEERING COMMITTEE.— 

22 ‘‘(1) IN GENERAL.—The Secretary shall estab23 lish a Steering Committee within the Department. 

24 The Under Secretary for Intelligence and Analysis 

25 shall serve as the Chair of the Steering Committee. 

26 The Chief Security Officer shall serve as the Vice 


asabaliauskas on DSK5VPTVN1PROD with BILLS
3 

HR 3361 RFS 

1 Chair. The Steering Committee shall be comprised 

2 of representatives of the Office of Intelligence and 

3 Analysis, the Office of the Chief Information Officer, 

4 the Office of the General Counsel, the Office for 

5 Civil Rights and Civil Liberties, the Privacy Office, 

6 the Office of the Chief Human Capital Officer, the 

7 Office of the Chief Financial Officer, the Federal 

8 Protective Service, the Office of the Chief Procure9 ment Officer, the Science and Technology Direc10 torate, and other components or offices of the De11 partment as appropriate. Such representatives shall 

12 meet on a regular basis to discuss cases and issues 

13 related to insider threats to the Department’s crit14 ical assets, in accordance with subsection (a). 

15 ‘‘(2) RESPONSIBILITIES.—Not later than 1 year 

16 after the date of the enactment of this section, the 

17 Under Secretary for Intelligence and Analysis and 

18 the Chief Security Officer, in coordination with the 

19 Steering Committee established pursuant to para20 graph (1), shall— 

21 ‘‘(A) develop a holistic strategy for Depart22 ment-wide efforts to identify, prevent, mitigate, 

23 and respond to insider threats to the Depart24 ment’s critical assets; 


asabaliauskas on DSK5VPTVN1PROD with BILLS
4 

HR 3361 RFS 

1 ‘‘(B) develop a plan to implement the in2 sider threat measures identified in the strategy 

3 developed under subparagraph (A) across the 

4 components and offices of the Department; 

5 ‘‘(C) document insider threat policies and 

6 controls; 

7 ‘‘(D) conduct a baseline risk assessment of 

8 insider threats posed to the Department’s crit9 ical assets; 

10 ‘‘(E) examine existing programmatic and 

11 technology best practices adopted by the Fed12 eral Government, industry, and research insti13 tutions to implement solutions that are vali14 dated and cost-effective; 

15 ‘‘(F) develop a timeline for deploying work16 place monitoring technologies, employee aware17 ness campaigns, and education and training 

18 programs related to identifying, preventing, 

19 mitigating, and responding to potential insider 

20 threats to the Department’s critical assets; 

21 ‘‘(G) require the Chair and Vice Chair of 

22 the Steering Committee to consult with the 

23 Under Secretary for Science and Technology 

24 and other appropriate stakeholders to ensure 

25 the Insider Threat Program is informed, on an 


asabaliauskas on DSK5VPTVN1PROD with BILLS
5 

HR 3361 RFS 

1 ongoing basis, by current information regarding 

2 threats, beset practices, and available tech3 nology; and 

4 ‘‘(H) develop, collect, and report metrics 

5 on the effectiveness of the Department’s insider 

6 threat mitigation efforts. 

7 ‘‘(c) REPORT.—Not later than 2 years after the date 

8 of the enactment of this section and the biennially there9 after for the next 4 years, the Secretary shall submit to 

10 the Committee on Homeland Security and the Permanent 

11 Select Committee on Intelligence of the House of Rep12 resentatives and the Committee on Homeland Security 

13 and Governmental Affairs and the Select Committee on 

14 Intelligence of the Senate a report on how the Department 

15 and its components and offices have implemented the 

16 strategy developed under subsection (b)(2)(A), the status 

17 of the Department’s risk assessment of critical assets, the 

18 types of insider threat training conducted, the number of 

19 Department employees who have received such training, 

20 and information on the effectiveness of the Insider Threat 

21 Program, based on metrics under subsection (b)(2)(H). 

22 ‘‘(d) DEFINITIONS.—In this section: 

23 ‘‘(1) CRITICAL ASSETS.—The term ‘critical as24 sets’ means the people, facilities, information, and 


asabaliauskas on DSK5VPTVN1PROD with BILLS
6 

HR 3361 RFS 

1 technology required for the Department to fulfill its 

2 mission. 

3 ‘‘(2) INSIDER.—The term ‘insider’ means— 

4 ‘‘(A) any person who has access to classi5 fied national security information and is em6 ployed by, detailed to, or assigned to the De7 partment, including members of the Armed 

8 Forces, experts or consultants to the Depart9 ment, industrial or commercial contractors, li10 censees, certificate holders, or grantees of the 

11 Department, including all subcontractors, per12 sonal services contractors, or any other category 

13 of person who acts for or on behalf of the De14 partment, as determined by the Secretary; or 

15 ‘‘(B) State, local, tribal, territorial, and 

16 private sector personnel who possess security 

17 clearances granted by the Department. 

18 ‘‘(3) INSIDER THREAT.—The term ‘insider 

19 threat’ means the threat that an insider will use his 

20 or her authorized access, wittingly or unwittingly, to 

21 do harm to the security of the United States, includ22 ing damage to the United States through espionage, 

23 terrorism, the unauthorized disclosure of classified 

24 national security information, or through the loss or 


asabaliauskas on DSK5VPTVN1PROD with BILLS
7 

HR 3361 RFS 

1 degradation of departmental resources or capabili2 ties.’’. 

3 (b) CLERICAL AMENDMENT.—The table of contents 

4 of the Homeland Security Act of 2002 is amended by in5 serting after the item relating to section 103 the following 

6 new item: 

‘‘Sec. 104. Insider Threat Program.’’. 

Passed the House of Representatives November 2, 

2015. 

Attest: KAREN L. HAAS, 

Clerk. 


asabaliauskas on DSK5VPTVN1PROD with BILLS