IB 

Union Calendar No. 216 

114TH CONGRESS 

1ST SESSION H. R. 3510 

[Report No. 114–284] 

To amend the Homeland Security Act of 2002 to require the Secretary 

of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 15, 2015 

Mr. RICHMOND introduced the following bill; which was referred to the 

Committee on Homeland Security 

OCTOBER 6, 2015 

Additional sponsors: Mr. RATCLIFFE, Mr. MCCAUL, and Mr. THOMPSON of 

Mississippi 

OCTOBER 6, 2015 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on September 15, 2015] 


emcdonald on DSK67QTVN1PROD with BILLS
2 

•HR 3510 RH

A BILL 

To amend the Homeland Security Act of 2002 to require 

the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes. 


emcdonald on DSK67QTVN1PROD with BILLS
3 

•HR 3510 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Home5 land Security Cybersecurity Strategy Act of 2015’’. 

6 SEC. 2. CYBERSECURITY STRATEGY FOR THE DEPARTMENT 

7 OF HOMELAND SECURITY. 

8 (a) IN GENERAL.—Subtitle C of title II of the Home9 land Security Act of 2002 (6 U.S.C. 141 et seq.) is amended 

10 by adding at the end the following new section: 

11 ‘‘SEC. 230. CYBERSECURITY STRATEGY. 

12 ‘‘(a) IN GENERAL.—Not later than 60 days after the 

13 date of the enactment of this section, the Secretary shall 

14 develop a departmental strategy to carry out cybersecurity 

15 responsibilities as set forth in law. 

16 ‘‘(b) CONTENTS.—The strategy required under sub17 section (a) shall include the following: 

18 ‘‘(1) Strategic and operational goals and prior19 ities to successfully execute the full range of the Sec20 retary’s cybersecurity responsibilities. 

21 ‘‘(2) Information on the programs, policies, and 

22 activities that are required to successfully execute the 

23 full range of the Secretary’s cybersecurity responsibil24 ities, including programs, policies, and activities in 

25 furtherance of the following: 


emcdonald on DSK67QTVN1PROD with BILLS
4 

•HR 3510 RH

1 ‘‘(A) Cybersecurity functions set forth in the 

2 second section 226 (relating to the national cy3 bersecurity and communications integration cen4 ter). 

5 ‘‘(B) Cybersecurity investigations capabili6 ties. 

7 ‘‘(C) Cybersecurity research and develop8 ment. 

9 ‘‘(D) Engagement with international cyber10 security partners. 

11 ‘‘(c) CONSIDERATIONS.—In developing the strategy re12 quired under subsection (a), the Secretary shall— 

13 ‘‘(1) consider— 

14 ‘‘(A) the cybersecurity strategy for the 

15 Homeland Security Enterprise published by the 

16 Secretary in November 2011; 

17 ‘‘(B) the Department of Homeland Security 

18 Fiscal Years 2014–2018 Strategic Plan; and 

19 ‘‘(C) the most recent Quadrennial Home20 land Security Review issued pursuant to section 

21 707; and 

22 ‘‘(2) include information on the roles and re23 sponsibilities of components and offices of the Depart24 ment, to the extent practicable, to carry out such 

25 strategy. 


emcdonald on DSK67QTVN1PROD with BILLS
5 

•HR 3510 RH

1 ‘‘(d) IMPLEMENTATION PLAN.—Not later than 90 days 

2 after the development of the strategy required under sub3 section (a), the Secretary shall issue an implementation 

4 plan for the strategy that includes the following: 

5 ‘‘(1) Strategic objectives and corresponding tasks. 

6 ‘‘(2) Projected timelines and costs for such tasks. 

7 ‘‘(3) Metrics to evaluate performance of such 

8 tasks. 

9 ‘‘(e) CONGRESSIONAL OVERSIGHT.—The Secretary 

10 shall submit to the Committee on Homeland Security of the 

11 House of Representatives and the Committee on Homeland 

12 Security and Governmental Affairs of the Senate for assess13 ment the following: 

14 ‘‘(1) A copy of the strategy required under sub15 section (a) upon issuance. 

16 ‘‘(2) A copy of the implementation plan required 

17 under subsection (d) upon issuance, together with de18 tailed information on any associated legislative or 

19 budgetary proposals. 

20 ‘‘(f) PROHIBITION ON REORGANIZATION.—In the event 

21 that the strategy required under subsection (a) or imple22 mentation plan required under subsection (d) includes ac23 tions to reorganize departmental components or offices, such 

24 actions may not be executed without prior congressional au25 thorization. 


emcdonald on DSK67QTVN1PROD with BILLS
6 

•HR 3510 RH

1 ‘‘(g) CLASSIFIED INFORMATION.—The strategy re2 quired under subsection (a) shall be in an unclassified form 

3 but may contain a classified annex. 

4 ‘‘(h) RULE OF CONSTRUCTION.—Nothing in this sec5 tion may be construed as permitting the Department to en6 gage in monitoring, surveillance, exfiltration, or other col7 lection activities for the purpose of tracking an individual’s 

8 personally identifiable information. 

9 ‘‘(i) DEFINITIONS.—In this section: 

10 ‘‘(1) CYBERSECURITY RISK.—The term ‘cyberse11 curity risk’ has the meaning given such term in the 

12 second section 226, relating to the national cybersecu13 rity and communications integration center. 

14 ‘‘(2) HOMELAND SECURITY ENTERPRISE.—The 

15 term ‘Homeland Security Enterprise’ means relevant 

16 governmental and nongovernmental entities involved 

17 in homeland security, including Federal, State, local, 

18 and tribal government officials, private sector rep19 resentatives, academics, and other policy experts. 

20 ‘‘(3) INCIDENT.—The term ‘incident’ has the 

21 meaning given such term in the second section 226, 

22 relating to the national cybersecurity and commu23 nications integration center.’’. 

24 (b) CLERICAL AMENDMENT.—The table of contents in 

25 section 1(b) of the Homeland Security Act of 2002 is 


emcdonald on DSK67QTVN1PROD with BILLS
7 

•HR 3510 RH

1 amended by adding at the end of the list of items for subtitle 

2 C of title II the following new item: 

‘‘Sec. 230. Cybersecurity strategy.’’. 

3 (c) AMENDMENT TO DEFINITION.—Paragraph (2) of 

4 subsection (a) of the second section 226 of the Homeland 

5 Security Act of 2002 (6 U.S.C. 148; relating to the national 

6 cybersecurity and communications integration center) is 

7 amended to read as follows: 

8 ‘‘(2) the term ‘incident’ means an occurrence 

9 that actually or imminently jeopardizes, without law10 ful authority, the integrity, confidentiality, or avail11 ability of information on an information system, or 

12 actually or imminently jeopardizes, without lawful 

13 authority, an information system;’’. 


emcdonald on DSK67QTVN1PROD with BILLS
Union Calendar No. 216 

114TH CONGRESS 

1ST SESSION H. R. 3510 

[Report No. 114–284] 

A BILL 

To amend the Homeland Security Act of 2002 to 

poses. ment of Homeland Security, and for other purdevelop a cybersecurity strategy for the Departrequire the Secretary of Homeland Security to 

OCTOBER 6, 2015 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


emcdonald on DSK67QTVN1PROD with BILLS