IIB 

114TH CONGRESS 

1ST SESSION H. R. 3510 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 7, 2015 

Received; read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

AN ACT 

To amend the Homeland Security Act of 2002 to require 

the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


emcdonald on DSK67QTVN1PROD with BILLS
2 

HR 3510 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Department of Home3 land Security Cybersecurity Strategy Act of 2015’’. 

4 SEC. 2. CYBERSECURITY STRATEGY FOR THE DEPARTMENT 

5 OF HOMELAND SECURITY. 

6 (a) IN GENERAL.—Subtitle C of title II of the Home7 land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend8 ed by adding at the end the following new section: 

9 ‘‘SEC. 230. CYBERSECURITY STRATEGY. 

10 ‘‘(a) IN GENERAL.—Not later than 60 days after the 

11 date of the enactment of this section, the Secretary shall 

12 develop a departmental strategy to carry out cybersecurity 

13 responsibilities as set forth in law. 

14 ‘‘(b) CONTENTS.—The strategy required under sub15 section (a) shall include the following: 

16 ‘‘(1) Strategic and operational goals and prior17 ities to successfully execute the full range of the Sec18 retary’s cybersecurity responsibilities. 

19 ‘‘(2) Information on the programs, policies, and 

20 activities that are required to successfully execute 

21 the full range of the Secretary’s cybersecurity re22 sponsibilities, including programs, policies, and ac23 tivities in furtherance of the following: 

24 ‘‘(A) Cybersecurity functions set forth in 

25 the second section 226 (relating to the national 


emcdonald on DSK67QTVN1PROD with BILLS
3 

HR 3510 RFS

1 cybersecurity and communications integration 

2 center). 

3 ‘‘(B) Cybersecurity investigations capabili4 ties. 

5 ‘‘(C) Cybersecurity research and develop6 ment. 

7 ‘‘(D) Engagement with international cyber8 security partners. 

9 ‘‘(c) CONSIDERATIONS.—In developing the strategy 

10 required under subsection (a), the Secretary shall— 

11 ‘‘(1) consider— 

12 ‘‘(A) the cybersecurity strategy for the 

13 Homeland Security Enterprise published by the 

14 Secretary in November 2011; 

15 ‘‘(B) the Department of Homeland Secu16 rity Fiscal Years 2014–2018 Strategic Plan; 

17 and 

18 ‘‘(C) the most recent Quadrennial Home19 land Security Review issued pursuant to section 

20 707; and 

21 ‘‘(2) include information on the roles and re22 sponsibilities of components and offices of the De23 partment, to the extent practicable, to carry out 

24 such strategy. 


emcdonald on DSK67QTVN1PROD with BILLS
4 

HR 3510 RFS

1 ‘‘(d) IMPLEMENTATION PLAN.—Not later than 90 

2 days after the development of the strategy required under 

3 subsection (a), the Secretary shall issue an implementa4 tion plan for the strategy that includes the following: 

5 ‘‘(1) Strategic objectives and corresponding 

6 tasks. 

7 ‘‘(2) Projected timelines and costs for such 

8 tasks. 

9 ‘‘(3) Metrics to evaluate performance of such 

10 tasks. 

11 ‘‘(e) CONGRESSIONAL OVERSIGHT.—The Secretary 

12 shall submit to the Committee on Homeland Security of 

13 the House of Representatives and the Committee on 

14 Homeland Security and Governmental Affairs of the Sen15 ate for assessment the following: 

16 ‘‘(1) A copy of the strategy required under sub17 section (a) upon issuance. 

18 ‘‘(2) A copy of the implementation plan re19 quired under subsection (d) upon issuance, together 

20 with detailed information on any associated legisla21 tive or budgetary proposals. 

22 ‘‘(f) CLASSIFIED INFORMATION.—The strategy re23 quired under subsection (a) shall be in an unclassified 

24 form but may contain a classified annex. 


emcdonald on DSK67QTVN1PROD with BILLS
5 

HR 3510 RFS

1 ‘‘(g) RULE OF CONSTRUCTION.—Nothing in this sec2 tion may be construed as permitting the Department to 

3 engage in monitoring, surveillance, exfiltration, or other 

4 collection activities for the purpose of tracking an individ5 ual’s personally identifiable information. 

6 ‘‘(h) DEFINITIONS.—In this section: 

7 ‘‘(1) CYBERSECURITY RISK.—The term ‘cyber8 security risk’ has the meaning given such term in 

9 the second section 226, relating to the national cy10 bersecurity and communications integration center. 

11 ‘‘(2) HOMELAND SECURITY ENTERPRISE.—The 

12 term ‘Homeland Security Enterprise’ means relevant 

13 governmental and nongovernmental entities involved 

14 in homeland security, including Federal, State, local, 

15 and tribal government officials, private sector rep16 resentatives, academics, and other policy experts. 

17 ‘‘(3) INCIDENT.—The term ‘incident’ has the 

18 meaning given such term in the second section 226, 

19 relating to the national cybersecurity and commu20 nications integration center.’’. 

21 (b) PROHIBITION ON REORGANIZATION.—The Sec22 retary of Homeland Security may not change the location 

23 or reporting structure of the National Protection and Pro24 grams Directorate of the Department of Homeland Secu25 rity, or the location or reporting structure of any office 


emcdonald on DSK67QTVN1PROD with BILLS
6 

HR 3510 RFS

1 or component of the Directorate, unless the Secretary re2 ceives prior authorization from Congress permitting such 

3 change. 

4 (c) CLERICAL AMENDMENT.—The table of contents 

5 in section 1(b) of the Homeland Security Act of 2002 is 

6 amended by adding at the end of the list of items for sub7 title C of title II the following new item: 

‘‘Sec. 230. Cybersecurity strategy.’’. 

8 (d) AMENDMENT TO DEFINITION.—Paragraph (2) of 

9 subsection (a) of the second section 226 of the Homeland 

10 Security Act of 2002 (6 U.S.C. 148; relating to the na11 tional cybersecurity and communications integration cen12 ter) is amended to read as follows: 

13 ‘‘(2) the term ‘incident’ means an occurrence 

14 that actually or imminently jeopardizes, without law15 ful authority, the integrity, confidentiality, or avail16 ability of information on an information system, or 

17 actually or imminently jeopardizes, without lawful 

18 authority, an information system;’’. 

Passed the House of Representatives October 6, 

2015. 

Attest: KAREN L. HAAS, 

Clerk. 


emcdonald on DSK67QTVN1PROD with BILLS