II 

117TH CONGRESS 

1ST SESSION S. 2993 

To amend the Homeland Security Act of 2002 to establish in the Cybersecurity and Infrastructure Security Agency the National Cyber Exercise 

Program, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 19, 2021 

Ms. ROSEN (for herself, Mr. SASSE, and Mr. KING) introduced the following 

bill; which was read twice and referred to the Committee on Homeland 

Security and Governmental Affairs 

A BILL 

To amend the Homeland Security Act of 2002 to establish 

in the Cybersecurity and Infrastructure Security Agency 

the National Cyber Exercise Program, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘CISA Cyber Exercise 

5 Act’’. 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 2993 IS

1 SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

4 is amended by adding at the end the following new section: 

5 ‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 

6 ‘‘(a) ESTABLISHMENT OF PROGRAM.— 

7 ‘‘(1) IN GENERAL.—There is established in the 

8 Agency the National Cyber Exercise Program (re9 ferred to in this section as the ‘Exercise Program’) 

10 to evaluate the National Cyber Incident Response 

11 Plan, and other related plans and strategies. 

12 ‘‘(2) REQUIREMENTS.— 

13 ‘‘(A) IN GENERAL.—The Exercise Program 

14 shall be— 

15 ‘‘(i) based on current risk assess16 ments, including credible threats, 

17 vulnerabilities, and consequences; 

18 ‘‘(ii) designed, to the extent prac19 ticable, to simulate the partial or complete 

20 incapacitation of a government or critical 

21 infrastructure network resulting from a 

22 cyber incident; 

23 ‘‘(iii) designed to provide for the sys24 tematic evaluation of cyber readiness and 

25 enhance operational understanding of the 


pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 2993 IS

1 cyber incident response system and rel2 evant information sharing agreements; and 

3 ‘‘(iv) designed to promptly develop 

4 after-action reports and plans that can 

5 quickly incorporate lessons learned into fu6 ture operations. 

7 ‘‘(B) MODEL EXERCISE SELECTION.—The 

8 Exercise Program shall— 

9 ‘‘(i) include a selection of model exer10 cises that government and private entities 

11 can readily adapt for use; and 

12 ‘‘(ii) aid such governments and pri13 vate entities with the design, implementa14 tion, and evaluation of exercises that— 

15 ‘‘(I) conform to the requirements 

16 described in subparagraph (A); 

17 ‘‘(II) are consistent with any ap18 plicable national, State, local, or Trib19 al strategy or plan; and 

20 ‘‘(III) provide for systematic 

21 evaluation of readiness. 

22 ‘‘(3) CONSULTATION.—In carrying out the Ex23 ercise Program, the Director may consult with ap24 propriate representatives from Sector Risk Manage25 ment Agencies, the Office of the National Cyber DiVerDate Sep 11 2014 00:04 Oct 20, 2021 Jkt 029200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2993.IS S2993

pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 2993 IS

1 rector, cybersecurity research stakeholders, and Sec2 tor Coordinating Councils. 

3 ‘‘(b) DEFINITIONS.—In this section: 

4 ‘‘(1) STATE.—The term ‘State’ means any 

5 State of the United States, the District of Columbia, 

6 the Commonwealth of Puerto Rico, the Northern 

7 Mariana Islands, the United States Virgin Islands, 

8 Guam, American Samoa, and any other territory or 

9 possession of the United States. 

10 ‘‘(2) PRIVATE ENTITY.—The term ‘private enti11 ty’ has the meaning given such term in section 102 

12 of the Cybersecurity Information Sharing Act of 

13 2015 (6 U.S.C. 1501).’’. 

14 (b) TECHNICAL AMENDMENTS.— 

15 (1) HOMELAND SECURITY ACT OF 2002.—Sub16 title A of title XXII of the Homeland Security Act 

17 of 2002 (6 U.S.C. 651 et seq.) is amended— 

18 (A) in the first section 2215 (6 U.S.C. 

19 665; relating to the duties and authorities relat20 ing to .gov internet domain), by amending the 

21 section enumerator and heading to read as fol22 lows: 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 2993 IS

1 ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 

2 INTERNET DOMAIN.’’; 

3 (B) in the second section 2215 (6 U.S.C. 

4 665b; relating to the joint cyber planning of5 fice), by amending the section enumerator and 

6 heading to read as follows: 

7 ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 

8 (C) in the third section 2215 (6 U.S.C. 

9 665c; relating to the Cybersecurity State Coor10 dinator), by amending the section enumerator 

11 and heading to read as follows: 

12 ‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 

13 (D) in the fourth section 2215 (6 U.S.C. 

14 665d; relating to Sector Risk Management 

15 Agencies), by amending the section enumerator 

16 and heading to read as follows: 

17 ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 

18 (E) in section 2216 (6 U.S.C. 665e; relat19 ing to the Cybersecurity Advisory Committee), 

20 by amending the section enumerator and head21 ing to read as follows: 

22 ‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 

23 and 

24 (F) in section 2217 (6 U.S.C. 665f; relat25 ing to Cybersecurity Education and Training 


pbinns on DSKJLVW7X2PROD with BILLS
6 

•S 2993 IS

1 Programs), by amending the section enu2 merator and heading to read as follows: 

3 ‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 

4 PROGRAMS.’’. 

5 (2) CONSOLIDATED APPROPRIATIONS ACT, 

6 2021.—Paragraph (1) of section 904(b) of division U 

7 of the Consolidated Appropriations Act, 2021 (Pub8 lic Law 116–260) is amended, in the matter pre9 ceding subparagraph (A), by inserting ‘‘of 2002’’ 

10 after ‘‘Homeland Security Act’’. 

11 (c) CLERICAL AMENDMENT.—The table of contents 

12 in section 1(b) of the Homeland Security Act of 2002 is 

13 amended by striking the items relating to sections 2214 

14 through 2217 and inserting the following new items: 

‘‘Sec. 2214. National Asset Database. 

‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 

‘‘Sec. 2216. Joint cyber planning office. 

‘‘Sec. 2217. Cybersecurity State Coordinator. 

‘‘Sec. 2218. Sector Risk Management Agencies. 

‘‘Sec. 2219. Cybersecurity Advisory Committee. 

‘‘Sec. 2220. Cybersecurity Education and Training Programs. 

‘‘Sec. 2220A. National Cyber Exercise Program.’’. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS