I 

116TH CONGRESS 

1ST SESSION H. R. 1975 

To establish in the Cybersecurity and Infrastructure Security Agency of 

the Department of Homeland Security a Chief Information Security 

Officer Advisory Committee. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 28, 2019 

Mr. KATKO (for himself, Mr. NEWHOUSE, Mr. FITZPATRICK, and Mr. LIPINSKI) introduced the following bill; which was referred to the Committee 

on Homeland Security, and in addition to the Committees on Energy and 

Commerce, and Oversight and Reform, for a period to be subsequently 

determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To establish in the Cybersecurity and Infrastructure Security 

Agency of the Department of Homeland Security a Chief 

Information Security Officer Advisory Committee. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Advisory 

5 Committee Authorization Act of 2019’’. 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 1975 IH

1 SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 

2 (a) IN GENERAL.—Subtitle A of title XXII of the 

3 Homeland Security Act of 2002 is amended by adding at 

4 the end the following new section: 

5 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 

6 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab7 lish within the Cybersecurity and Infrastructure Security 

8 Agency a Cybersecurity Advisory Committee. 

9 ‘‘(b) DUTIES.— 

10 ‘‘(1) IN GENERAL.—The Advisory Committee 

11 may advise, consult with, report to, and make rec12 ommendations to the Director of Cybersecurity and 

13 Infrastructure Security on the development, refine14 ment, and implementation of policies, programs, 

15 rulemakings, planning, training, and security direc16 tives pertaining to the mission of the Cybersecurity 

17 and Infrastructure Security Agency. 

18 ‘‘(2) RECOMMENDATIONS.— 

19 ‘‘(A) IN GENERAL.—The Advisory Com20 mittee shall develop, at the request of the Di21 rector, recommendations for improvements to 

22 the cybersecurity mission of the Cybersecurity 

23 and Infrastructure Security Agency. 

24 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT25 TEES.—Recommendations agreed upon by the 

26 subcommittees established under subsection (d) 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 1975 IH

1 for any year shall be approved by the Advisory 

2 Committee before the Advisory Committee sub3 mits to the Director the annual report under 

4 paragraph (4) for that year. 

5 ‘‘(3) PERIODIC REPORTS.—The Advisory Com6 mittee shall periodically submit to the Director— 

7 ‘‘(A) reports on matters identified by the 

8 Director; and 

9 ‘‘(B) reports on other matters identified by 

10 a majority of the members of the Advisory 

11 Committee. 

12 ‘‘(4) ANNUAL REPORT.—The Advisory Com13 mittee shall submit to the Director an annual report 

14 providing information on the activities, findings, and 

15 recommendations of the Advisory Committee, includ16 ing its subcommittees, for the preceding year. Not 

17 later than six months after the date that the Direc18 tor receives an annual report for a year, the Director 

19 shall publish a public version of the report describ20 ing the activities of the Advisory Committee and 

21 such related matters as would be informative to the 

22 public during that year, consistent with section 

23 552(b) of title 5, United States Code. 

24 ‘‘(5) FEEDBACK.—Not later than 90 days after 

25 receiving any recommendation submitted by the AdVerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975

kjohnson on DSK79L0C42 with BILLS
4 

•HR 1975 IH

1 visory Committee under paragraph (2), (3), or (4), 

2 the Director shall respond in writing to the Advisory 

3 Committee with feedback on the recommendation. 

4 Such a response shall include— 

5 ‘‘(A) with respect to any recommendation 

6 with which the Director concurs, an action plan 

7 to implement the recommendation; and 

8 ‘‘(B) with respect to any recommendation 

9 with which the Director does not concur, a jus10 tification for why the Director does not plan to 

11 implement the recommendation. 

12 ‘‘(6) CONGRESSIONAL NOTIFICATION.—For 

13 each fiscal quarter beginning after the date of the 

14 enactment of this section, the Director shall provide 

15 to the Committee on Homeland Security and Gov16 ernmental Affairs and the Committee on Appropria17 tions of the Senate and the Committee on Homeland 

18 Security and the Committee on Appropriations of 

19 the House of Representatives a briefing on feedback 

20 from the Advisory Committee. 

21 ‘‘(c) MEMBERSHIP.— 

22 ‘‘(1) APPOINTMENT.— 

23 ‘‘(A) IN GENERAL.—Not later than 180 

24 days after the date of the enactment of this 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 1975 IH

1 Act, the Director shall appoint the members of 

2 the Advisory Committee. 

3 ‘‘(B) COMPOSITION.—The membership of 

4 the Advisory Committee shall consist of not 

5 more than 35 individuals, each of whom rep6 resent a category referred to in subparagraph 

7 (C)(i). 

8 ‘‘(C) REPRESENTATION.— 

9 ‘‘(i) IN GENERAL.—The membership 

10 of the Advisory Committee shall include 

11 representatives of State and local govern12 ments and of a broad range of industries, 

13 including the following: 

14 ‘‘(I) Defense. 

15 ‘‘(II) Education. 

16 ‘‘(III) Financial services. 

17 ‘‘(IV) Healthcare. 

18 ‘‘(V) Manufacturing. 

19 ‘‘(VI) Media and entertainment. 

20 ‘‘(VII) Chemicals. 

21 ‘‘(VIII) Retail. 

22 ‘‘(IX) Transportation. 

23 ‘‘(X) Energy. 

24 ‘‘(XI) Information Technology. 

25 ‘‘(XII) Communications. 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 1975 IH

1 ‘‘(XIII) Other relevant fields 

2 identified by the Director. 

3 ‘‘(ii) PROHIBITION.—Not more than 

4 three members may represent any one cat5 egory under clause (i). 

6 ‘‘(2) TERM OF OFFICE.— 

7 ‘‘(A) TERMS.—The term of each member 

8 of the Advisory Committee shall be two years, 

9 but a member may continue to serve until a 

10 successor is appointed. 

11 ‘‘(B) REMOVAL.—The Director may review 

12 the participation of a member of the Advisory 

13 Committee and remove such member for cause 

14 at any time. 

15 ‘‘(C) REAPPOINTMENT.—A member of the 

16 Advisory Committee may be reappointed for an 

17 unlimited number of terms. 

18 ‘‘(3) DELEGATION OF RESPONSIBILITIES.—A 

19 member of the Advisory Committee may delegate 

20 that member’s responsibilities under this section to 

21 another individual, with the exception of access to 

22 protected information and classified information 

23 under paragraph (6). 

24 ‘‘(4) PROHIBITION ON COMPENSATION.—The 

25 members of the Advisory Committee may not receive 


kjohnson on DSK79L0C42 with BILLS
7 

•HR 1975 IH

1 pay or benefits from the United States Government 

2 by reason of their service on the Advisory Com3 mittee. 

4 ‘‘(5) MEETINGS.— 

5 ‘‘(A) IN GENERAL.—The Director shall re6 quire the Advisory Committee to meet at least 

7 quarterly, and may convene additional meetings 

8 as necessary. 

9 ‘‘(B) PUBLIC MEETINGS.—At least one of 

10 the meetings referred to in subparagraph (A) 

11 shall be open to the public. 

12 ‘‘(C) ATTENDANCE.—The Advisory Com13 mittee shall maintain a record of the persons 

14 present at each meeting. 

15 ‘‘(6) MEMBER ACCESS TO CLASSIFIED AND

16 PROTECTED INFORMATION.— 

17 ‘‘(A) IN GENERAL.—Not later than 60 

18 days after the date on which a member is first 

19 appointed to the Advisory Committee and be20 fore the member is granted access to any classi21 fied information or protected information, the 

22 Director shall determine if there is cause for 

23 such member to be restricted from reviewing, 

24 discussing, or possessing such information. 

25 ‘‘(B) ACCESS.— 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 1975 IH

1 ‘‘(i) PROTECTED INFORMATION.—If 

2 the Director does not restrict a member 

3 from reviewing, discussing, or possessing 

4 sensitive information under subparagraph 

5 (A) and the member voluntarily signs a 

6 nondisclosure agreement with respect to 

7 protected information, the member may be 

8 granted access to protected information 

9 that the Director determines is relevant to 

10 such member’s service on the Advisory 

11 Committee. 

12 ‘‘(ii) CLASSIFIED INFORMATION.—Ac13 cess to classified materials shall be man14 aged in accordance with Executive Order 

15 No. 13526 of December 29, 2009 (75 Fed. 

16 Reg 707), or any subsequent corresponding 

17 Executive Order. 

18 ‘‘(C) PROTECTIONS.—A member of the 

19 Advisory Committee shall agree, as a condition 

20 of such membership, to protect all classified in21 formation in accordance with the applicable re22 quirements for the particular level of classifica23 tion of such information and to protect all pro24 tected information appropriately. 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 1975 IH

1 ‘‘(D) PROTECTED INFORMATION DE2 FINED.—In this section, the term ‘protected in3 formation’ means— 

4 ‘‘(i) information specifically exempted 

5 from disclosure by statute or regulation; 

6 ‘‘(ii) trade secrets and commercial or 

7 financial information obtained from a per8 son and privileged or confidential; 

9 ‘‘(iii) deliberative process privileged 

10 information; 

11 ‘‘(iv) personally identifiable informa12 tion, the disclosure of which would con13 stitute an invasion of personal privacy; 

14 ‘‘(v) records containing law enforce15 ment sensitive information; and 

16 ‘‘(vi) other categories of information, 

17 as determined by the Director. 

18 ‘‘(7) CHAIRPERSON.—The Advisory Committee 

19 shall select, from among the members of the Advi20 sory Committee— 

21 ‘‘(A) a member to serve as chairperson of 

22 the Advisory Committee; and 

23 ‘‘(B) a member to serve as chairperson of 

24 each subcommittee of the Advisory Committee 

25 established under subsection (d). 


kjohnson on DSK79L0C42 with BILLS
10 

•HR 1975 IH

1 ‘‘(d) SUBCOMMITTEES.— 

2 ‘‘(1) IN GENERAL.—The Director and the Advi3 sory Committee shall establish subcommittees within 

4 the Advisory Committee to address cybersecurity 

5 issues, including relating to the following: 

6 ‘‘(A) Information exchange. 

7 ‘‘(B) Critical infrastructure. 

8 ‘‘(C) Risk management. 

9 ‘‘(D) Public and private partnerships. 

10 ‘‘(2) ADDITIONAL SUBCOMMITTEES.—In addi11 tion to the subcommittees established pursuant to 

12 paragraph (1), the Advisory Committee chairperson, 

13 in coordination with the Director, may establish 

14 within the Advisory Committee additional sub15 committees that the Director and Advisory Com16 mittee determine to be necessary. 

17 ‘‘(3) MEETINGS AND REPORTING.—Each sub18 committee shall meet at least bimonthly, and submit 

19 to the Advisory Committee for inclusion in the an20 nual report required under subsection (b)(4) infor21 mation, including activities, findings, and rec22 ommendations, regarding subject matter considered 

23 by the subcommittee. 

24 ‘‘(4) SUBJECT MATTER EXPERTS.—The chair of 

25 the Advisory Committee shall appoint members to 


kjohnson on DSK79L0C42 with BILLS
11 

•HR 1975 IH

1 subcommittees and shall ensure that each member 

2 appointed to a subcommittee has subject matter ex3 pertise relevant to the subject matter of the sub4 committee. 

5 ‘‘(e) NONAPPLICABILITY OF FACA.—The Federal 

6 Advisory Committee Act (5 U.S.C. App.) shall not apply 

7 to the Advisory Committee and its subcommittees.’’. 

8 (b) CLERICAL AMENDMENT.—The table of contents 

9 in section 1(b) of such Act is amended by inserting after 

10 the item relating to section 2214 the following new item: 

‘‘2215. Cybersecurity Advisory Committee.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS