II 

Calendar No. 674 

117TH CONGRESS 

2D SESSION S. 2993 

[Report No. 117–275] 

To amend the Homeland Security Act of 2002 to establish in the Cybersecurity and Infrastructure Security Agency the National Cyber Exercise 

Program, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 19, 2021 

Ms. ROSEN (for herself, Mr. SASSE, and Mr. KING) introduced the following 

bill; which was read twice and referred to the Committee on Homeland 

Security and Governmental Affairs 

DECEMBER 19, 2022 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To amend the Homeland Security Act of 2002 to establish 

in the Cybersecurity and Infrastructure Security Agency 

the National Cyber Exercise Program, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 2993 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘CISA Cyber Exercise 

3 Act’’. 

4 SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 

5 (a) IN GENERAL.—Subtitle A of title XXII of the 

6 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

7 is amended by adding at the end the following new section: 

8 ‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 

9 ‘‘(a) ESTABLISHMENT OF PROGRAM.— 

10 ‘‘(1) IN GENERAL.—There is established in the 

11 Agency the National Cyber Exercise Program (re12 ferred to in this section as the ‘Exercise Program’) 

13 to evaluate the National Cyber Incident Response 

14 Plan, and other related plans and strategies. 

15 ‘‘(2) REQUIREMENTS.— 

16 ‘‘(A) IN GENERAL.—The Exercise Program 

17 shall be— 

18 ‘‘(i) based on current risk assess19 ments, including credible threats, 

20 vulnerabilities, and consequences; 

21 ‘‘(ii) designed, to the extent prac22 ticable, to simulate the partial or complete 

23 incapacitation of a government or critical 

24 infrastructure network resulting from a 

25 cyber incident; 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 2993 RS

1 ‘‘(iii) designed to provide for the sys2 tematic evaluation of cyber readiness and 

3 enhance operational understanding of the 

4 cyber incident response system and rel5 evant information sharing agreements; and 

6 ‘‘(iv) designed to promptly develop 

7 after-action reports and plans that can 

8 quickly incorporate lessons learned into fu9 ture operations. 

10 ‘‘(B) MODEL EXERCISE SELECTION.—The 

11 Exercise Program shall— 

12 ‘‘(i) include a selection of model exer13 cises that government and private entities 

14 can readily adapt for use; and 

15 ‘‘(ii) aid such governments and pri16 vate entities with the design, implementa17 tion, and evaluation of exercises that— 

18 ‘‘(I) conform to the requirements 

19 described in subparagraph (A); 

20 ‘‘(II) are consistent with any ap21 plicable national, State, local, or Trib22 al strategy or plan; and 

23 ‘‘(III) provide for systematic 

24 evaluation of readiness. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•S 2993 RS

1 ‘‘(3) CONSULTATION.—In carrying out the Ex2 ercise Program, the Director may consult with ap3 propriate representatives from Sector Risk Manage4 ment Agencies, the Office of the National Cyber Di5 rector, cybersecurity research stakeholders, and Sec6 tor Coordinating Councils. 

7 ‘‘(b) DEFINITIONS.—In this section: 

8 ‘‘(1) STATE.—The term ‘State’ means any 

9 State of the United States, the District of Columbia, 

10 the Commonwealth of Puerto Rico, the Northern 

11 Mariana Islands, the United States Virgin Islands, 

12 Guam, American Samoa, and any other territory or 

13 possession of the United States. 

14 ‘‘(2) PRIVATE ENTITY.—The term ‘private enti15 ty’ has the meaning given such term in section 102 

16 of the Cybersecurity Information Sharing Act of 

17 2015 (6 U.S.C. 1501).’’. 

18 (b) TECHNICAL AMENDMENTS.— 

19 (1) HOMELAND SECURITY ACT OF 2002.—Sub20 title A of title XXII of the Homeland Security Act 

21 of 2002 (6 U.S.C. 651 et seq.) is amended— 

22 (A) in the first section 2215 (6 U.S.C. 

23 665; relating to the duties and authorities relat24 ing to .gov internet domain), by amending the 


kjohnson on DSK79L0C42PROD with BILLS
5 

•S 2993 RS

1 section enumerator and heading to read as fol2 lows: 

3 ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 

4 INTERNET DOMAIN.’’; 

5 (B) in the second section 2215 (6 U.S.C. 

6 665b; relating to the joint cyber planning of7 fice), by amending the section enumerator and 

8 heading to read as follows: 

9 ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 

10 (C) in the third section 2215 (6 U.S.C. 

11 665c; relating to the Cybersecurity State Coor12 dinator), by amending the section enumerator 

13 and heading to read as follows: 

14 ‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 

15 (D) in the fourth section 2215 (6 U.S.C. 

16 665d; relating to Sector Risk Management 

17 Agencies), by amending the section enumerator 

18 and heading to read as follows: 

19 ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 

20 (E) in section 2216 (6 U.S.C. 665e; relat21 ing to the Cybersecurity Advisory Committee), 

22 by amending the section enumerator and head23 ing to read as follows: 

24 ‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 

25 and 


kjohnson on DSK79L0C42PROD with BILLS
6 

•S 2993 RS

1 (F) in section 2217 (6 U.S.C. 665f; relat2 ing to Cybersecurity Education and Training 

3 Programs), by amending the section enu4 merator and heading to read as follows: 

5 ‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 

6 PROGRAMS.’’. 

7 (2) CONSOLIDATED APPROPRIATIONS ACT, 

8 2021.—Paragraph (1) of section 904(b) of division U 

9 of the Consolidated Appropriations Act, 2021 (Pub10 lic Law 116–260) is amended, in the matter pre11 ceding subparagraph (A), by inserting ‘‘of 2002’’ 

12 after ‘‘Homeland Security Act’’. 

13 (c) CLERICAL AMENDMENT.—The table of contents 

14 in section 1(b) of the Homeland Security Act of 2002 is 

15 amended by striking the items relating to sections 2214 

16 through 2217 and inserting the following new items: 

‘‘Sec. 2214. National Asset Database. 

‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 

‘‘Sec. 2216. Joint cyber planning office. 

‘‘Sec. 2217. Cybersecurity State Coordinator. 

‘‘Sec. 2218. Sector Risk Management Agencies. 

‘‘Sec. 2219. Cybersecurity Advisory Committee. 

‘‘Sec. 2220. Cybersecurity Education and Training Programs. 

‘‘Sec. 2220A. National Cyber Exercise Program.’’. 

17 SECTION 1. SHORT TITLE. 

18 This Act may be cited as the ‘‘CISA Cyber Exercise 

19 Act’’. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•S 2993 RS

1 SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 

4 amended by adding at the end the following new section: 

5 ‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 

6 ‘‘(a) ESTABLISHMENT OF PROGRAM.— 

7 ‘‘(1) IN GENERAL.—There is established in the 

8 Agency the National Cyber Exercise Program (re9 ferred to in this section as the ‘Exercise Program’) to 

10 evaluate the National Cyber Incident Response Plan, 

11 and other related plans and strategies. 

12 ‘‘(2) REQUIREMENTS.— 

13 ‘‘(A) IN GENERAL.—The Exercise Program 

14 shall be— 

15 ‘‘(i) based on current risk assessments, 

16 including credible threats, vulnerabilities, 

17 and consequences; 

18 ‘‘(ii) designed, to the extent prac19 ticable, to simulate the partial or complete 

20 incapacitation of a government or critical 

21 infrastructure network resulting from a 

22 cyber incident; 

23 ‘‘(iii) designed to provide for the sys24 tematic evaluation of cyber readiness and 

25 enhance operational understanding of the 


kjohnson on DSK79L0C42PROD with BILLS
8 

•S 2993 RS

1 cyber incident response system and relevant 

2 information sharing agreements; and 

3 ‘‘(iv) designed to promptly develop 

4 after-action reports and plans that can 

5 quickly incorporate lessons learned into fu6 ture operations. 

7 ‘‘(B) MODEL EXERCISE SELECTION.—The 

8 Exercise Program shall— 

9 ‘‘(i) include a selection of model exer10 cises that government and private entities 

11 can readily adapt for use; and 

12 ‘‘(ii) aid such governments and private 

13 entities with the design, implementation, 

14 and evaluation of exercises that— 

15 ‘‘(I) conform to the requirements 

16 described in subparagraph (A); 

17 ‘‘(II) are consistent with any ap18 plicable national, State, local, or Trib19 al strategy or plan; and 

20 ‘‘(III) provide for systematic eval21 uation of readiness. 

22 ‘‘(3) CONSULTATION.—In carrying out the Exer23 cise Program, the Director may consult with appro24 priate representatives from Sector Risk Management 

25 Agencies, the Office of the National Cyber Director, 


kjohnson on DSK79L0C42PROD with BILLS
9 

•S 2993 RS

1 cybersecurity research stakeholders, and Sector Co2 ordinating Councils. 

3 ‘‘(b) DEFINITIONS.—In this section: 

4 ‘‘(1) STATE.—The term ‘State’ means any State 

5 of the United States, the District of Columbia, the 

6 Commonwealth of Puerto Rico, the Northern Mariana 

7 Islands, the United States Virgin Islands, Guam, 

8 American Samoa, and any other territory or posses9 sion of the United States. 

10 ‘‘(2) PRIVATE ENTITY.—The term ‘private entity’ 

11 has the meaning given such term in section 102 of the 

12 Cybersecurity Information Sharing Act of 2015 (6 

13 U.S.C. 1501). 

14 ‘‘(c) RULE OF CONSTRUCTION.—Nothing in this sec15 tion shall be construed to affect the authority or responsibil16 ities of the Administrator of the Federal Emergency Man17 agement Agency pursuant to section 648 of the Post18 Katrina Emergency Management Reform Act of 2006 (6 

19 U.S.C. 748).’’. 

20 (b) CLERICAL AMENDMENT.—The table of contents in 

21 section 1(b) of the Homeland Security Act of 2002 is 

22 amended by inserting after the item relating to section 2217 

23 the following: 

‘‘Sec. 2220A. National Cyber Exercise Program.’’. 


kjohnson on DSK79L0C42PROD with BILLS
Calendar No. 674 

117TH CONGRESS 

2D SESSION S. 2993 

[Report No. 117–275] 

A BILL 

To amend the Homeland Security Act of 2002 to 

Program, and for other purposes. Security Agency the National Cyber Exercise establish in the Cybersecurity and Infrastructure 

DECEMBER 19, 2022 

Reported with an amendment 


kjohnson on DSK79L0C42PROD with BILLS