I 

114TH CONGRESS 

1ST SESSION H. R. 3510 

To amend the Homeland Security Act of 2002 to require the Secretary 

of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 15, 2015 

Mr. RICHMOND introduced the following bill; which was referred to the 

Committee on Homeland Security 

A BILL 

To amend the Homeland Security Act of 2002 to require 

the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Home5 land Security Cybersecurity Strategy Act of 2015’’. 


srobinson on DSK5SPTVN1PROD with BILLS
2 

•HR 3510 IH

1 SEC. 2. CYBERSECURITY STRATEGY FOR THE DEPARTMENT 

2 OF HOMELAND SECURITY. 

3 (a) IN GENERAL.—Subtitle C of title II of the Home4 land Security Act (6 U.S.C. 141 et seq.) is amended by 

5 adding at the end the following new section: 

6 ‘‘SEC. 230. CYBERSECURITY STRATEGY. 

7 ‘‘(a) IN GENERAL.—Not later than 60 days after the 

8 date of the enactment of this section, the Secretary shall 

9 develop a departmental strategy to carry out cybersecurity 

10 responsibilities as set forth in law. 

11 ‘‘(b) CONTENTS.—The strategy required under sub12 section (a) shall include the following: 

13 ‘‘(1) Strategic and operational goals and prior14 ities to successfully execute the full range of the Sec15 retary’s cybersecurity responsibilities. 

16 ‘‘(2) Information on the programs, policies, and 

17 activities that are required to successfully execute 

18 the full range of the Secretary’s cybersecurity re19 sponsibilities, including programs, policies, and ac20 tivities in furtherance of the following: 

21 ‘‘(A) Cybersecurity functions set forth in 

22 the second section 226 (relating to the national 

23 cybersecurity and communications integration 

24 center). 

25 ‘‘(B) Cybersecurity investigations capabili26 ties. 


srobinson on DSK5SPTVN1PROD with BILLS
3 

•HR 3510 IH

1 ‘‘(C) Cybersecurity research and develop2 ment. 

3 ‘‘(D) Engagement with international cyber4 security partners. 

5 ‘‘(c) CONSIDERATIONS.—In developing the strategy 

6 required under subsection (a), the Secretary shall— 

7 ‘‘(1) consider— 

8 ‘‘(A) the cybersecurity strategy for the 

9 Homeland Security Enterprise published by the 

10 Secretary in November 2011; 

11 ‘‘(B) the Department of Homeland Secu12 rity Fiscal Years 2014–2018 Strategic Plan; 

13 and 

14 ‘‘(C) the most recent Quadrennial Home15 land Security Review issued pursuant to section 

16 707; and 

17 ‘‘(2) include information on the roles and re18 sponsibilities of components and offices of the De19 partment, to the extent practicable, to carry out 

20 such strategy. 

21 ‘‘(d) IMPLEMENTATION PLAN.—Not later than 90 

22 days after the development of the strategy required under 

23 subsection (a), the Secretary shall issue an implementa24 tion plan for the strategy that includes the following: 


srobinson on DSK5SPTVN1PROD with BILLS
4 

•HR 3510 IH

1 ‘‘(1) Strategic objectives and corresponding 

2 tasks. 

3 ‘‘(2) Projected timelines and costs for such 

4 tasks. 

5 ‘‘(3) Metrics to evaluate performance of such 

6 tasks. 

7 ‘‘(e) CONGRESSIONAL OVERSIGHT.—The Secretary 

8 shall submit to the Committee on Homeland Security of 

9 the House of Representatives and the Committee on 

10 Homeland Security and Governmental Affairs of the Sen11 ate for assessment the following: 

12 ‘‘(1) A copy of the strategy required under sub13 section (a) upon issuance. 

14 ‘‘(2) A copy of the implementation plan re15 quired under subsection (d) upon issuance, together 

16 with detailed information on any associated legisla17 tive or budgetary proposals. 

18 ‘‘(f) PROHIBITION ON REORGANIZATION.—In the 

19 event that the strategy required under subsection (a) or 

20 implementation plan required under subsection (d) in21 cludes actions to reorganize departmental components or 

22 offices, such actions may not be executed without prior 

23 congressional authorization. 


srobinson on DSK5SPTVN1PROD with BILLS
5 

•HR 3510 IH

1 ‘‘(g) CLASSIFIED INFORMATION.—The strategy re2 quired under subsection (a) shall be in an unclassified 

3 form but may contain a classified annex. 

4 ‘‘(h) DEFINITIONS.—In this section: 

5 ‘‘(1) CYBERSECURITY RISK.—The term ‘cyber6 security risk’ has the meaning given such term in 

7 the second section 226, relating to the national cy8 bersecurity and communications integration center. 

9 ‘‘(2) HOMELAND SECURITY ENTERPRISE.—The 

10 term ‘Homeland Security Enterprise’ means relevant 

11 governmental and nongovernmental entities involved 

12 in homeland security, including Federal, State, local, 

13 and tribal government officials, private sector rep14 resentatives, academics, and other policy experts. 

15 ‘‘(3) INCIDENT.—The term ‘incident’ has the 

16 meaning given such term in the second section 226, 

17 relating to the national cybersecurity and commu18 nications integration center.’’. 

19 (b) CLERICAL AMENDMENT.—The table of contents 

20 in section 1(b) of the Homeland Security Act of 2002 is 

21 amended by adding at the end of the list of items for sub22 title C of title II the following new item: 

‘‘Sec. 230. Cybersecurity strategy.’’. 

23 (c) AMENDMENT TO DEFINITION.—Paragraph (2) of 

24 subsection (a) of the second section 226 of the Homeland 

25 Security Act of 2002 (6 U.S.C. 148; relating to the naVerDate Sep 11 2014 22:22 Sep 15, 2015 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3510.IH H3510

srobinson on DSK5SPTVN1PROD with BILLS
6 

•HR 3510 IH

1 tional cybersecurity and communications integration cen2 ter) is amended to read as follows: 

3 ‘‘(2) INCIDENT.—The term ‘incident’ means an 

4 occurrence that actually or imminently jeopardizes, 

5 without lawful authority, the integrity, confiden6 tiality, or availability of information on an informa7 tion system, or actually or imminently jeopardizes, 

8 without lawful authority, an information system.’’. 

Æ 


srobinson on DSK5SPTVN1PROD with BILLS