IB 

Union Calendar No. 411 

113TH CONGRESS 

2D SESSION H. R. 3696 

[Report No. 113–550, Part I] 

To amend the Homeland Security Act of 2002 to make certain improvements 

regarding cybersecurity and critical infrastructure protection, and for 

other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 11, 2013 

Mr. MCCAUL (for himself, Mr. MEEHAN, Mr. THOMPSON of Mississippi, and 

Ms. CLARKE) introduced the following bill; which was referred to the 

Committee on Homeland Security, and in addition to the Committees on 

Science, Space, and Technology and Oversight and Government Reform, 

for a period to be subsequently determined by the Speaker, in each case 

for consideration of such provisions as fall within the jurisdiction of the 

committee concerned 

JULY 23, 2014 

Reported from the Committee on Homeland Security with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

JULY 23, 2014 

The Committees on Science, Space, and Technology and Oversight and Government Reform discharged; committed to the Committee of the Whole 

House on the State of the Union and ordered to be printed 

[For text of introduced bill, see copy of bill as introduced on December 11, 2013] 


tkelley on DSK3SPTVN1PROD with BILLS
2 

•HR 3696 RH

A BILL 

To amend the Homeland Security Act of 2002 to make 

certain improvements regarding cybersecurity and critical 

infrastructure protection, and for other purposes. 


tkelley on DSK3SPTVN1PROD with BILLS
3 

•HR 3696 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘National Cybersecurity 

5 and Critical Infrastructure Protection Act of 2014’’. 

6 SEC. 2. TABLE OF CONTENTS. 

7 The table of contents for this Act is as follows: 

Sec. 1. Short title. 

Sec. 2. Table of contents. 

TITLE I—SECURING THE NATION AGAINST CYBER ATTACK 

Sec. 101. Homeland Security Act of 2002 definitions. 

Sec. 102. Enhancement of cybersecurity. 

Sec. 103. Protection of critical infrastructure and information sharing. 

Sec. 104. National Cybersecurity and Communications Integration Center. 

Sec. 105. Cyber incident response and technical assistance. 

Sec. 106. Streamlining of Department cybersecurity organization. 

TITLE II—PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY 

Sec. 201. Public-private collaboration on cybersecurity. 

Sec. 202. SAFETY Act and qualifying cyber incidents. 

Sec. 203. Prohibition on new regulatory authority. 

Sec. 204. Prohibition on additional authorization of appropriations. 

Sec. 205. Prohibition on collection activities to track individuals’ personally identifiable information. 

Sec. 206. Cybersecurity scholars. 

Sec. 207. National Research Council study on the resilience and reliability of the 

Nation’s power grid. 

TITLE III—HOMELAND SECURITY CYBERSECURITY WORKFORCE 

Sec. 301. Homeland security cybersecurity workforce. 

Sec. 302. Personnel authorities. 

8 TITLE I—SECURING THE NATION 

9 AGAINST CYBER ATTACK 

10 SEC. 101. HOMELAND SECURITY ACT OF 2002 DEFINITIONS. 

11 Section 2 of the Homeland Security Act of 2002 (6 

12 U.S.C. 101) is amended by adding at the end the following 

13 new paragraphs: 


tkelley on DSK3SPTVN1PROD with BILLS
4 

•HR 3696 RH

1 ‘‘(19) The term ‘critical infrastructure’ has the 

2 meaning given that term in section 1016(e) of the 

3 USA Patriot Act (42 U.S.C. 5195c(e)). 

4 ‘‘(20) The term ‘critical infrastructure owner’ 

5 means a person that owns critical infrastructure. 

6 ‘‘(21) The term ‘critical infrastructure operator’ 

7 means a critical infrastructure owner or other person 

8 that manages, runs, or operates, in whole or in part, 

9 the day-to-day operations of critical infrastructure. 

10 ‘‘(22) The term ‘cyber incident’ means an inci11 dent, or an attempt to cause an incident, that, if suc12 cessful, would— 

13 ‘‘(A) jeopardize or imminently jeopardize, 

14 without lawful authority, the security, integrity, 

15 confidentiality, or availability of an information 

16 system or network of information systems or any 

17 information stored on, processed on, or 

18 transiting such a system or network; 

19 ‘‘(B) constitute a violation or imminent 

20 threat of violation of law, security policies, secu21 rity procedures, or acceptable use policies related 

22 to such a system or network, or an act of ter23 rorism against such a system or network; or 

24 ‘‘(C) result in the denial of access to or deg25 radation, disruption, or destruction of such a 


tkelley on DSK3SPTVN1PROD with BILLS
5 

•HR 3696 RH

1 system or network, or the defeat of an operations 

2 control or technical control essential to the secu3 rity or operation of such a system or network. 

4 ‘‘(23) The term ‘cybersecurity mission’ means ac5 tivities that encompass the full range of threat reduc6 tion, vulnerability reduction, deterrence, incident re7 sponse, resiliency, and recovery activities to foster the 

8 security and stability of cyberspace. 

9 ‘‘(24) The term ‘cybersecurity purpose’ means the 

10 purpose of ensuring the security, integrity, confiden11 tiality, or availability of, or safeguarding, an infor12 mation system or network of information systems, in13 cluding protecting such a system or network, or data 

14 residing on such a system or network, including pro15 tection of such a system or network, from— 

16 ‘‘(A) a vulnerability of such a system or 

17 network; 

18 ‘‘(B) a threat to the security, integrity, con19 fidentiality, or availability of such a system or 

20 network, or any information stored on, processed 

21 on, or transiting such a system or network; 

22 ‘‘(C) efforts to deny access to or degrade, 

23 disrupt, or destroy such a system or network; or 

24 ‘‘(D) efforts to gain unauthorized access to 

25 such a system or network, including to gain such 


tkelley on DSK3SPTVN1PROD with BILLS
6 

•HR 3696 RH

1 unauthorized access for the purpose of 

2 exfiltrating information stored on, processed on, 

3 or transiting such a system or network. 

4 ‘‘(25) The term ‘cyber threat’ means any action 

5 that may result in unauthorized access to, exfiltration 

6 of, manipulation of, harm of, or impairment to the 

7 security, integrity, confidentiality, or availability of 

8 an information system or network of information sys9 tems, or information that is stored on, processed by, 

10 or transiting such a system or network. 

11 ‘‘(26) The term ‘cyber threat information’ means 

12 information directly pertaining to— 

13 ‘‘(A) a vulnerability of an information sys14 tem or network of information systems of a gov15 ernment or private entity; 

16 ‘‘(B) a threat to the security, integrity, con17 fidentiality, or availability of such a system or 

18 network of a government or private entity, or 

19 any information stored on, processed on, or 

20 transiting such a system or network; 

21 ‘‘(C) efforts to deny access to or degrade, 

22 disrupt, or destroy such a system or network of 

23 a government or private entity; 

24 ‘‘(D) efforts to gain unauthorized access to 

25 such a system or network, including to gain such 


tkelley on DSK3SPTVN1PROD with BILLS
7 

•HR 3696 RH

1 unauthorized access for the purpose of 

2 exfiltrating information stored on, processed on, 

3 or transiting such a system or network; or 

4 ‘‘(E) an act of terrorism against an infor5 mation system or network of information sys6 tems. 

7 ‘‘(27) The term ‘Federal civilian information 

8 systems’— 

9 ‘‘(A) means information, information sys10 tems, and networks of information systems that 

11 are owned, operated, controlled, or licensed for 

12 use by, or on behalf of, any Federal agency, in13 cluding such systems or networks used or oper14 ated by another entity on behalf of a Federal 

15 agency; but 

16 ‘‘(B) does not include— 

17 ‘‘(i) a national security system; or 

18 ‘‘(ii) information, information systems, 

19 and networks of information systems that 

20 are owned, operated, controlled, or licensed 

21 solely for use by, or on behalf of, the De22 partment of Defense, a military depart23 ment, or an element of the intelligence com24 munity. 


tkelley on DSK3SPTVN1PROD with BILLS
8 

•HR 3696 RH

1 ‘‘(28) The term ‘information security’ means the 

2 protection of information, information systems, and 

3 networks of information systems from unauthorized 

4 access, use, disclosure, disruption, modification, or de5 struction in order to provide— 

6 ‘‘(A) integrity, including guarding against 

7 improper information modification or destruc8 tion, including ensuring nonrepudiation and au9 thenticity; 

10 ‘‘(B) confidentiality, including preserving 

11 authorized restrictions on access and disclosure, 

12 including means for protecting personal privacy 

13 and proprietary information; and 

14 ‘‘(C) availability, including ensuring timely 

15 and reliable access to and use of information. 

16 ‘‘(29) The term ‘information system’ means the 

17 underlying framework and functions used to process, 

18 transmit, receive, or store information electronically, 

19 including programmable electronic devices, commu20 nications networks, and industrial or supervisory 

21 control systems and any associated hardware, soft22 ware, or data. 

23 ‘‘(30) The term ‘private entity’ means any indi24 vidual or any private or publically-traded company, 

25 public or private utility (including a utility that is 


tkelley on DSK3SPTVN1PROD with BILLS
9 

•HR 3696 RH

1 a unit of a State or local government, or a political 

2 subdivision of a State government), organization, or 

3 corporation, including an officer, employee, or agent 

4 thereof. 

5 ‘‘(31) The term ‘shared situational awareness’ 

6 means an environment in which cyber threat infor7 mation is shared in real time between all designated 

8 Federal cyber operations centers to provide actionable 

9 information about all known cyber threats.’’. 

10 SEC. 102. ENHANCEMENT OF CYBERSECURITY. 

11 (a) IN GENERAL.—Subtitle C of title II of the Home12 land Security Act of 2002 is amended by adding at the end 

13 the following new section: 

14 ‘‘SEC. 226. ENHANCEMENT OF CYBERSECURITY. 

15 ‘‘The Secretary, in collaboration with the heads of 

16 other appropriate Federal Government entities, shall con17 duct activities for cybersecurity purposes, including the pro18 vision of shared situational awareness to each other to en19 able real-time, integrated, and operational actions to pro20 tect from, prevent, mitigate, respond to, and recover from 

21 cyber incidents.’’. 

22 (b) CLERICAL AMENDMENTS.— 

23 (1) SUBTITLE HEADING.—The heading for sub24 title C of title II of such Act is amended to read as 

25 follows: 


tkelley on DSK3SPTVN1PROD with BILLS
10 

•HR 3696 RH

1 ‘‘Subtitle C—Cybersecurity and 

2 Information Sharing’’. 

3 (2) TABLE OF CONTENTS.—The table of contents 

4 in section 1(b) of such Act is amended— 

5 (A) by adding after the item relating to sec6 tion 225 the following new item: 

‘‘Sec. 226. Enhancement of cybersecurity.’’; 

7 and 

8 (B) by striking the item relating to subtitle 

9 C of title II and inserting the following new 

10 item: 

‘‘Subtitle C—Cybersecurity and Information Sharing’’. 

11 SEC. 103. PROTECTION OF CRITICAL INFRASTRUCTURE 

12 AND INFORMATION SHARING. 

13 (a) IN GENERAL.—Subtitle C of title II of the Home14 land Security Act of 2002, as amended by section 102, is 

15 further amended by adding at the end the following new 

16 section: 

17 ‘‘SEC. 227. PROTECTION OF CRITICAL INFRASTRUCTURE 

18 AND INFORMATION SHARING. 

19 ‘‘(a) PROTECTION OF CRITICAL INFRASTRUCTURE.— 

20 ‘‘(1) IN GENERAL.—The Secretary shall coordi21 nate, on an ongoing basis, with Federal, State, and 

22 local governments, national laboratories, critical in23 frastructure owners, critical infrastructure operators, 

24 and other cross sector coordinating entities to— 


tkelley on DSK3SPTVN1PROD with BILLS
11 

•HR 3696 RH

1 ‘‘(A) facilitate a national effort to strength2 en and maintain secure, functioning, and resil3 ient critical infrastructure from cyber threats; 

4 ‘‘(B) ensure that Department policies and 

5 procedures enable critical infrastructure owners 

6 and critical infrastructure operators to receive 

7 real-time, actionable, and relevant cyber threat 

8 information; 

9 ‘‘(C) seek industry sector-specific expertise 

10 to— 

11 ‘‘(i) assist in the development of vol12 untary security and resiliency strategies; 

13 and 

14 ‘‘(ii) ensure that the allocation of Fed15 eral resources are cost effective and reduce 

16 any burden on critical infrastructure own17 ers and critical infrastructure operators; 

18 ‘‘(D) upon request of entities, facilitate and 

19 assist risk management efforts of such entities to 

20 reduce vulnerabilities, identify and disrupt 

21 threats, and minimize consequences to their crit22 ical infrastructure; 

23 ‘‘(E) upon request of critical infrastructure 

24 owners or critical infrastructure operators, pro25 vide education and assistance to such owners 


tkelley on DSK3SPTVN1PROD with BILLS
12 

•HR 3696 RH

1 and operators on how they may use protective 

2 measures and countermeasures to strengthen the 

3 security and resilience of the Nation’s critical in4 frastructure; and 

5 ‘‘(F) coordinate a research and development 

6 strategy to facilitate and promote advancements 

7 and innovation in cybersecurity technologies to 

8 protect critical infrastructure. 

9 ‘‘(2) ADDITIONAL RESPONSIBILITIES.—The Sec10 retary shall— 

11 ‘‘(A) manage Federal efforts to secure, pro12 tect, and ensure the resiliency of Federal civilian 

13 information systems using a risk-based and per14 formance-based approach, and, upon request of 

15 critical infrastructure owners or critical infra16 structure operators, support such owners’ and 

17 operators’ efforts to secure, protect, and ensure 

18 the resiliency of critical infrastructure from 

19 cyber threats; 

20 ‘‘(B) direct an entity within the Depart21 ment to serve as a Federal civilian entity by and 

22 among Federal, State, and local governments, 

23 private entities, and critical infrastructure sec24 tors to provide multi-directional sharing of realVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
13 

•HR 3696 RH

1 time, actionable, and relevant cyber threat infor2 mation; 

3 ‘‘(C) build upon existing mechanisms to 

4 promote a national awareness effort to educate 

5 the general public on the importance of securing 

6 information systems; 

7 ‘‘(D) upon request of Federal, State, and 

8 local government entities and private entities, fa9 cilitate expeditious cyber incident response and 

10 recovery assistance, and provide analysis and 

11 warnings related to threats to and vulnerabilities 

12 of critical information systems, crisis and con13 sequence management support, and other remote 

14 or on-site technical assistance with the heads of 

15 other appropriate Federal agencies to Federal, 

16 State, and local government entities and private 

17 entities for cyber incidents affecting critical in18 frastructure; 

19 ‘‘(E) engage with international partners to 

20 strengthen the security and resilience of domestic 

21 critical infrastructure and critical infrastructure 

22 located outside of the United States upon which 

23 the United States depends; and 

24 ‘‘(F) conduct outreach to educational insti25 tutions, including historically black colleges and 


tkelley on DSK3SPTVN1PROD with BILLS
14 

•HR 3696 RH

1 universities, Hispanic serving institutions, Na2 tive American colleges, and institutions serving 

3 persons with disabilities, to encourage such insti4 tutions to promote cybersecurity awareness. 

5 ‘‘(3) RULE OF CONSTRUCTION.—Nothing in this 

6 section may be construed to require any private enti7 ty to request assistance from the Secretary, or require 

8 any private entity requesting such assistance to im9 plement any measure or recommendation suggested by 

10 the Secretary. 

11 ‘‘(b) CRITICAL INFRASTRUCTURE SECTORS.—The Sec12 retary, in collaboration with the heads of other appropriate 

13 Federal agencies, shall designate critical infrastructure sec14 tors (that may include subdivisions of sectors within a sec15 tor as the Secretary may determine appropriate). The crit16 ical infrastructure sectors designated under this subsection 

17 may include the following: 

18 ‘‘(1) Chemical. 

19 ‘‘(2) Commercial facilities. 

20 ‘‘(3) Communications. 

21 ‘‘(4) Critical manufacturing. 

22 ‘‘(5) Dams. 

23 ‘‘(6) Defense Industrial Base. 

24 ‘‘(7) Emergency services. 

25 ‘‘(8) Energy. 


tkelley on DSK3SPTVN1PROD with BILLS
15 

•HR 3696 RH

1 ‘‘(9) Financial services. 

2 ‘‘(10) Food and agriculture. 

3 ‘‘(11) Government facilities. 

4 ‘‘(12) Healthcare and public health. 

5 ‘‘(13) Information technology. 

6 ‘‘(14) Nuclear reactors, materials, and waste. 

7 ‘‘(15) Transportation systems. 

8 ‘‘(16) Water and wastewater systems. 

9 ‘‘(17) Such other sectors as the Secretary deter10 mines appropriate. 

11 ‘‘(c) SECTOR SPECIFIC AGENCIES.—The Secretary, in 

12 collaboration with the relevant critical infrastructure sector 

13 and the heads of other appropriate Federal agencies, shall 

14 recognize the Federal agency designated as of November 1, 

15 2013, as the ‘Sector Specific Agency’ for each critical infra16 structure sector designated under subsection (b). If the des17 ignated Sector Specific Agency for a particular critical in18 frastructure sector is the Department, for the purposes of 

19 this section, the Secretary shall carry out this section. The 

20 Secretary, in coordination with the heads of each such Sec21 tor Specific Agency shall— 

22 ‘‘(1) support the security and resilience activities 

23 of the relevant critical infrastructure sector in accord24 ance with this subtitle; and 


tkelley on DSK3SPTVN1PROD with BILLS
16 

•HR 3696 RH

1 ‘‘(2) provide institutional knowledge and special2 ized expertise to the relevant critical infrastructure 

3 sector. 

4 ‘‘(d) SECTOR COORDINATING COUNCILS.— 

5 ‘‘(1) RECOGNITION.—The Secretary, in collabo6 ration with each critical infrastructure sector and the 

7 relevant Sector Specific Agency, shall recognize and 

8 partner with the Sector Coordinating Council for 

9 each critical infrastructure sector designated under 

10 subsection (b) to coordinate with each such sector on 

11 security and resilience activities and emergency re12 sponse and recovery efforts. 

13 ‘‘(2) MEMBERSHIP.— 

14 ‘‘(A) IN GENERAL.—The Sector Coordi15 nating Council for a critical infrastructure sec16 tor designated under subsection (b) shall— 

17 ‘‘(i) be comprised exclusively of rel18 evant critical infrastructure owners, critical 

19 infrastructure operators, private entities, 

20 and representative trade associations for the 

21 sector; 

22 ‘‘(ii) reflect the unique composition of 

23 each sector; and 

24 ‘‘(iii) include relevant small, medium, 

25 and large critical infrastructure owners, 


tkelley on DSK3SPTVN1PROD with BILLS
17 

•HR 3696 RH

1 critical infrastructure operators, private en2 tities, and representative trade associations 

3 for the sector. 

4 ‘‘(B) PROHIBITION.—No government entity 

5 with regulating authority shall be a member of 

6 the Sector Coordinating Council. 

7 ‘‘(C) LIMITATION.—The Secretary shall 

8 have no role in the determination of the member9 ship of a Sector Coordinating Council. 

10 ‘‘(3) ROLES AND RESPONSIBILITIES.—The Sector 

11 Coordinating Council for a critical infrastructure sec12 tor shall— 

13 ‘‘(A) serve as a self-governing, self-organized 

14 primary policy, planning, and strategic commu15 nications entity for coordinating with the De16 partment, the relevant Sector-Specific Agency 

17 designated under subsection (c), and the relevant 

18 Information Sharing and Analysis Centers 

19 under subsection (e) on security and resilience 

20 activities and emergency response and recovery 

21 efforts; 

22 ‘‘(B) establish governance and operating 

23 procedures, and designate a chairperson for the 

24 sector to carry out the activities described in this 

25 subsection; 


tkelley on DSK3SPTVN1PROD with BILLS
18 

•HR 3696 RH

1 ‘‘(C) coordinate with the Department, the 

2 relevant Information Sharing and Analysis Cen3 ters under subsection (e), and other Sector Co4 ordinating Councils to update, maintain, and 

5 exercise the National Cybersecurity Incident Re6 sponse Plan in accordance with section 229(b); 

7 and 

8 ‘‘(D) provide any recommendations to the 

9 Department on infrastructure protection tech10 nology gaps to help inform research and develop11 ment efforts at the Department. 

12 ‘‘(e) SECTOR INFORMATION SHARING AND ANALYSIS

13 CENTERS.— 

14 ‘‘(1) RECOGNITION.—The Secretary, in collabo15 ration with the relevant Sector Coordinating Council 

16 and the critical infrastructure sector represented by 

17 such Council, and in coordination with the relevant 

18 Sector Specific Agency, shall recognize at least one 

19 Information Sharing and Analysis Center for each 

20 critical infrastructure sector designated under sub21 section (b) for purposes of paragraph (3). No other 

22 Information Sharing and Analysis Organizations, in23 cluding Information Sharing and Analysis Centers, 

24 may be precluded from having an information shar25 ing relationship within the National Cybersecurity 


tkelley on DSK3SPTVN1PROD with BILLS
19 

•HR 3696 RH

1 and Communications Integration Center established 

2 pursuant to section 228. Nothing in this subsection or 

3 any other provision of this subtitle may be construed 

4 to limit, restrict, or condition any private entity or 

5 activity utilized by, among, or between private enti6 ties. 

7 ‘‘(2) ROLES AND RESPONSIBILITIES.—In addi8 tion to such other activities as may be authorized by 

9 law, at least one Information Sharing and Analysis 

10 Center for a critical infrastructure sector shall— 

11 ‘‘(A) serve as an information sharing re12 source for such sector and promote ongoing 

13 multi-directional sharing of real-time, relevant, 

14 and actionable cyber threat information and 

15 analysis by and among such sector, the Depart16 ment, the relevant Sector Specific Agency, and 

17 other critical infrastructure sector Information 

18 Sharing and Analysis Centers; 

19 ‘‘(B) establish governance and operating 

20 procedures to carry out the activities conducted 

21 under this subsection; 

22 ‘‘(C) serve as an emergency response and re23 covery operations coordination point for such 

24 sector, and upon request, facilitate cyber incident 

25 response capabilities in coordination with the 


tkelley on DSK3SPTVN1PROD with BILLS
20 

•HR 3696 RH

1 Department, the relevant Sector Specific Agency 

2 and the relevant Sector Coordinating Council; 

3 ‘‘(D) facilitate cross-sector coordination and 

4 sharing of cyber threat information to prevent 

5 related or consequential impacts to other critical 

6 infrastructure sectors; 

7 ‘‘(E) coordinate with the Department, the 

8 relevant Sector Coordinating Council, the rel9 evant Sector Specific Agency, and other critical 

10 infrastructure sector Information Sharing and 

11 Analysis Centers on the development, integra12 tion, and implementation of procedures to sup13 port technology neutral, real-time information 

14 sharing capabilities and mechanisms within the 

15 National Cybersecurity and Communications In16 tegration Center established pursuant to section 

17 228, including— 

18 ‘‘(i) the establishment of a mechanism 

19 to voluntarily report identified 

20 vulnerabilities and opportunities for im21 provement; 

22 ‘‘(ii) the establishment of metrics to as23 sess the effectiveness and timeliness of the 

24 Department’s and Information Sharing and 


tkelley on DSK3SPTVN1PROD with BILLS
21 

•HR 3696 RH

1 Analysis Centers’ information sharing ca2 pabilities; and 

3 ‘‘(iii) the establishment of a mecha4 nism for anonymous suggestions and com5 ments; 

6 ‘‘(F) implement an integration and anal7 ysis function to inform sector planning, risk 

8 mitigation, and operational activities regarding 

9 the protection of each critical infrastructure sec10 tor from cyber incidents; 

11 ‘‘(G) combine consequence, vulnerability, 

12 and threat information to share actionable as13 sessments of critical infrastructure sector risks 

14 from cyber incidents; 

15 ‘‘(H) coordinate with the Department, the 

16 relevant Sector Specific Agency, and the relevant 

17 Sector Coordinating Council to update, main18 tain, and exercise the National Cybersecurity In19 cident Response Plan in accordance with section 

20 229(b); and 

21 ‘‘(I) safeguard cyber threat information 

22 from unauthorized disclosure. 

23 ‘‘(3) FUNDING.—Of the amounts authorized to be 

24 appropriated for each of fiscal years 2014, 2015, and 

25 2016 for the Cybersecurity and Communications OfVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
22 

•HR 3696 RH

1 fice of the Department, the Secretary is authorized to 

2 use not less than $25,000,000 for any such year for 

3 operations support at the National Cybersecurity and 

4 Communications Integration Center established under 

5 section 228(a) of all recognized Information Sharing 

6 and Analysis Centers under paragraph (1) of this 

7 subsection. 

8 ‘‘(f) CLEARANCES.—The Secretary— 

9 ‘‘(1) shall expedite the process of security clear10 ances under Executive Order 13549 or successor or11 ders for appropriate representatives of Sector Coordi12 nating Councils and the critical infrastructure sector 

13 Information Sharing and Analysis Centers; and 

14 ‘‘(2) may so expedite such processing to— 

15 ‘‘(A) appropriate personnel of critical infra16 structure owners and critical infrastructure op17 erators; and 

18 ‘‘(B) any other person as determined by the 

19 Secretary. 

20 ‘‘(g) PUBLIC-PRIVATE COLLABORATION.—The Sec21 retary, in collaboration with the critical infrastructure sec22 tors designated under subsection (b), such sectors’ Sector 

23 Specific Agencies recognized under subsection (c), and the 

24 Sector Coordinating Councils recognized under subsection 

25 (d), shall— 


tkelley on DSK3SPTVN1PROD with BILLS
23 

•HR 3696 RH

1 ‘‘(1) conduct an analysis and review of the exist2 ing public-private partnership model and evaluate 

3 how the model between the Department and critical 

4 infrastructure owners and critical infrastructure op5 erators can be improved to ensure the Department, 

6 critical infrastructure owners, and critical infrastruc7 ture operators are equal partners and regularly col8 laborate on all programs and activities of the Depart9 ment to protect critical infrastructure; 

10 ‘‘(2) develop and implement procedures to ensure 

11 continuous, collaborative, and effective interactions 

12 between the Department, critical infrastructure own13 ers, and critical infrastructure operators; and 

14 ‘‘(3) ensure critical infrastructure sectors have a 

15 reasonable period for review and comment of all joint16 ly produced materials with the Department. 

17 ‘‘(h) PROTECTION OF FEDERAL CIVILIAN INFORMA18 TION SYSTEMS.— 

19 ‘‘(1) IN GENERAL.—The Secretary shall admin20 ister the operational information security activities 

21 and functions to protect and ensure the resiliency of 

22 all Federal civilian information systems. 

23 ‘‘(2) ROLES AND RESPONSIBILITIES.—The Sec24 retary, in coordination with the heads of other Fed25 eral civilian agencies, shall— 


tkelley on DSK3SPTVN1PROD with BILLS
24 

•HR 3696 RH

1 ‘‘(A) develop, issue, and oversee the imple2 mentation and compliance of all operational in3 formation security policies and procedures to 

4 protect and ensure the resiliency of Federal civil5 ian information systems; 

6 ‘‘(B) administer Federal Government-wide 

7 efforts to develop and provide adequate, risk8 based, cost-effective, and technology neutral in9 formation security capabilities; 

10 ‘‘(C) establish and sustain continuous 

11 diagnostics systems for Federal civilian informa12 tion systems to aggregate data and identify and 

13 prioritize the mitigation of cyber vulnerabilities 

14 in such systems for cybersecurity purposes; 

15 ‘‘(D) develop, acquire, and operate an inte16 grated and consolidated system of intrusion de17 tection, analytics, intrusion prevention, and 

18 other information sharing and protective capa19 bilities to defend Federal civilian information 

20 systems from cyber threats; 

21 ‘‘(E) develop and conduct targeted risk as22 sessments and operational evaluations of Federal 

23 civilian information systems, in consultation 

24 with government and private entities that own 

25 and operate such information systems, including 


tkelley on DSK3SPTVN1PROD with BILLS
25 

•HR 3696 RH

1 threat, vulnerability, and impact assessments 

2 and penetration testing; 

3 ‘‘(F) develop and provide technical assist4 ance and cyber incident response capabilities to 

5 secure and ensure the resilience of Federal civil6 ian information systems; 

7 ‘‘(G) review annually the operational infor8 mation security activities and functions of each 

9 of the Federal civilian agencies; 

10 ‘‘(H) develop minimum technology neutral 

11 operational requirements for network and secu12 rity operations centers to facilitate the protection 

13 of all Federal civilian information systems; 

14 ‘‘(I) develop reporting requirements, con15 sistent with relevant law, to ensure the National 

16 Cybersecurity and Communications Integration 

17 Center established pursuant to section 228 re18 ceives all actionable cyber threat information 

19 identified on Federal civilian information sys20 tems; 

21 ‘‘(J) develop technology neutral performance 

22 requirements and metrics for the security of Fed23 eral civilian information systems; 

24 ‘‘(K) implement training requirements that 

25 include industry recognized certifications to enVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
26 

•HR 3696 RH

1 sure that Federal civilian agencies are able to 

2 fully and timely comply with policies and proce3 dures issued by the Secretary under this sub4 section; and 

5 ‘‘(L) develop training requirements regard6 ing privacy, civil rights, civil liberties, and in7 formation oversight for information security em8 ployees who operate Federal civilian information 

9 systems. 

10 ‘‘(3) USE OF CERTAIN COMMUNICATIONS.— 

11 ‘‘(A) IN GENERAL.—The Secretary may 

12 enter into contracts or other agreements, or oth13 erwise request and obtain, in accordance with 

14 applicable law, the assistance of private entities 

15 that provide electronic communication services, 

16 remote computing services, or cybersecurity serv17 ices to acquire, intercept, retain, use, and dis18 close communications and other system traffic, 

19 deploy countermeasures, or otherwise operate 

20 protective capabilities in accordance with sub21 paragraphs (C), (D), (E), and (F) of paragraph 

22 (2). No cause of action shall exist against private 

23 entities for assistance provided to the Secretary 

24 in accordance with this subsection. 


tkelley on DSK3SPTVN1PROD with BILLS
27 

•HR 3696 RH

1 ‘‘(B) RULE OF CONSTRUCTION.—Nothing in 

2 subparagraph (A) may be construed to— 

3 ‘‘(i) require or compel any private en4 tity to enter in a contract or agreement de5 scribed in such subparagraph; or 

6 ‘‘(ii) authorize the Secretary to take 

7 any action with respect to any communica8 tions or system traffic transiting or residing 

9 on any information system or network of 

10 information systems other than a Federal 

11 civilian information system. 

12 ‘‘(i) RECOMMENDATIONS REGARDING NEW AGREE13 MENTS.—Not later than 180 days after the date of the en14 actment of this section, the Secretary shall submit to the 

15 appropriate congressional committees recommendations on 

16 how to expedite the implementation of information sharing 

17 agreements for cybersecurity purposes between the Secretary 

18 and critical information owners and critical infrastructure 

19 operators and other private entities. Such recommendations 

20 shall address the development and utilization of a scalable 

21 form that retains all privacy and other protections in such 

22 agreements in existence as of such date, including Coopera23 tive and Research Development Agreements. Such rec24 ommendations should also include any additional authoriVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
28 

•HR 3696 RH

1 ties or resources that may be needed to carry out the imple2 mentation of any such new agreements. 

3 ‘‘(j) RULE OF CONSTRUCTION.—No provision of this 

4 title may be construed as modifying, limiting, or otherwise 

5 affecting the authority of any other Federal agency under 

6 any other provision of law.’’. 

7 (b) CLERICAL AMENDMENT.—The table of contents in 

8 section 1(b) of such Act is amended by adding after the item 

9 relating to section 226 (as added by section 102) the fol10 lowing new item: 

‘‘Sec. 227. Protection of critical infrastructure and information sharing.’’. 

11 SEC. 104. NATIONAL CYBERSECURITY AND COMMUNICA12 TIONS INTEGRATION CENTER. 

13 (a) IN GENERAL.—Subtitle C of title II of the Home14 land Security Act of 2002, as amended by sections 102 and 

15 103, is further amended by adding at the end the following 

16 new section: 

17 ‘‘SEC. 228. NATIONAL CYBERSECURITY AND COMMUNICA18 TIONS INTEGRATION CENTER. 

19 ‘‘(a) ESTABLISHMENT.—There is established in the De20 partment the National Cybersecurity and Communications 

21 Integration Center (referred to in this section as the ‘Cen22 ter’), which shall be a Federal civilian information sharing 

23 interface that provides shared situational awareness to en24 able real-time, integrated, and operational actions across 

25 the Federal Government, and share cyber threat informaVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00028 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
29 

•HR 3696 RH

1 tion by and among Federal, State, and local government 

2 entities, Information Sharing and Analysis Centers, private 

3 entities, and critical infrastructure owners and critical in4 frastructure operators that have an information sharing re5 lationship with the Center. 

6 ‘‘(b) COMPOSITION.—The Center shall include each of 

7 the following entities: 

8 ‘‘(1) At least one Information Sharing and Anal9 ysis Center established under section 227(e) for each 

10 critical infrastructure sector. 

11 ‘‘(2) The Multi-State Information Sharing and 

12 Analysis Center to collaborate with State and local 

13 governments. 

14 ‘‘(3) The United States Computer Emergency 

15 Readiness Team to coordinate cyber threat informa16 tion sharing, proactively manage cyber risks to the 

17 United States, collaboratively respond to cyber inci18 dents, provide technical assistance to information sys19 tem owners and operators, and disseminate timely 

20 notifications regarding current and potential cyber 

21 threats and vulnerabilities. 

22 ‘‘(4) The Industrial Control System Cyber Emer23 gency Response Team to coordinate with industrial 

24 control systems owners and operators and share inVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00029 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
30 

•HR 3696 RH

1 dustrial control systems-related security incidents and 

2 mitigation measures. 

3 ‘‘(5) The National Coordinating Center for Tele4 communications to coordinate the protection, re5 sponse, and recovery of national security emergency 

6 communications. 

7 ‘‘(6) Such other Federal, State, and local govern8 ment entities, private entities, organizations, or indi9 viduals as the Secretary may consider appropriate 

10 that agree to be included. 

11 ‘‘(c) CYBER INCIDENT.—In the event of a cyber inci12 dent, the Secretary may grant the entities referred to in 

13 subsection (a) immediate temporary access to the Center as 

14 a situation may warrant. 

15 ‘‘(d) ROLES AND RESPONSIBILITIES.—The Center 

16 shall— 

17 ‘‘(1) promote ongoing multi-directional sharing 

18 by and among the entities referred to in subsection 

19 (a) of timely and actionable cyber threat information 

20 and analysis on a real-time basis that includes 

21 emerging trends, evolving threats, incident reports, 

22 intelligence information, risk assessments, and best 

23 practices; 


tkelley on DSK3SPTVN1PROD with BILLS
31 

•HR 3696 RH

1 ‘‘(2) coordinate with other Federal agencies to 

2 streamline and reduce redundant reporting of cyber 

3 threat information; 

4 ‘‘(3) provide, upon request, timely technical as5 sistance and crisis management support to Federal, 

6 State, and local government entities and private enti7 ties that own or operate information systems or net8 works of information systems to protect from, prevent, 

9 mitigate, respond to, and recover from cyber inci10 dents; 

11 ‘‘(4) facilitate cross-sector coordination and shar12 ing of cyber threat information to prevent related or 

13 consequential impacts to other critical infrastructure 

14 sectors; 

15 ‘‘(5) collaborate and facilitate discussions with 

16 Sector Coordinating Councils, Information Sharing 

17 and Analysis Centers, Sector Specific Agencies, and 

18 relevant critical infrastructure sectors on the develop19 ment of prioritized Federal response efforts, if nec20 essary, to support the defense and recovery of critical 

21 infrastructure from cyber incidents; 

22 ‘‘(6) collaborate with the Sector Coordinating 

23 Councils, Information Sharing and Analysis Centers, 

24 Sector Specific Agencies, and the relevant critical in25 frastructure sectors on the development and impleVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00031 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
32 

•HR 3696 RH

1 mentation of procedures to support technology neutral 

2 real-time information sharing capabilities and mech3 anisms; 

4 ‘‘(7) collaborate with the Sector Coordinating 

5 Councils, Information Sharing and Analysis Centers, 

6 Sector Specific Agencies, and the relevant critical in7 frastructure sectors to identify requirements for data 

8 and information formats and accessibility, system 

9 interoperability, and redundant systems and alter10 native capabilities in the event of a disruption in the 

11 primary information sharing capabilities and mecha12 nisms at the Center; 

13 ‘‘(8) within the scope of relevant treaties, cooper14 ate with international partners to share information 

15 and respond to cyber incidents; 

16 ‘‘(9) safeguard sensitive cyber threat information 

17 from unauthorized disclosure; 

18 ‘‘(10) require other Federal civilian agencies 

19 to— 

20 ‘‘(A) send reports and information to the 

21 Center about cyber incidents, threats, and 

22 vulnerabilities affecting Federal civilian infor23 mation systems and critical infrastructure sys24 tems and, in the event a private vendor product 

25 or service of such an agency is so implicated, the 


tkelley on DSK3SPTVN1PROD with BILLS
33 

•HR 3696 RH

1 Center shall first notify such private vendor of 

2 the vulnerability before further disclosing such 

3 information; 

4 ‘‘(B) provide to the Center cyber incident 

5 detection, analysis, mitigation, and response in6 formation; and 

7 ‘‘(C) immediately send and disclose to the 

8 Center cyber threat information received by such 

9 agencies; 

10 ‘‘(11) perform such other duties as the Secretary 

11 may require to facilitate a national effort to strength12 en and maintain secure, functioning, and resilient 

13 critical infrastructure from cyber threats; 

14 ‘‘(12) implement policies and procedures to— 

15 ‘‘(A) provide technical assistance to Federal 

16 civilian agencies to prevent and respond to data 

17 breaches involving unauthorized acquisition or 

18 access of personally identifiable information that 

19 occur on Federal civilian information systems; 

20 ‘‘(B) require Federal civilian agencies to 

21 notify the Center about data breaches involving 

22 unauthorized acquisition or access of personally 

23 identifiable information that occur on Federal 

24 civilian information systems not later than two 


tkelley on DSK3SPTVN1PROD with BILLS
34 

•HR 3696 RH

1 business days after the discovery of such a 

2 breach; and 

3 ‘‘(C) require Federal civilian agencies to no4 tify all potential victims of a data breach involv5 ing unauthorized acquisition or access of person6 ally identifiable information that occur on Fed7 eral civilian information systems without unrea8 sonable delay consistent with the needs of law en9 forcement; and 

10 ‘‘(13) participate in exercises run by the Depart11 ment’s National Exercise Program, where appro12 priate. 

13 ‘‘(e) INTEGRATION AND ANALYSIS.—The Center, in co14 ordination with the Office of Intelligence and Analysis of 

15 the Department, shall maintain an integration and anal16 ysis function, which shall — 

17 ‘‘(1) integrate and analyze all cyber threat infor18 mation received from other Federal agencies, State 

19 and local governments, Information Sharing and 

20 Analysis Centers, private entities, critical infrastruc21 ture owners, and critical infrastructure operators, 

22 and share relevant information in near real-time; 

23 ‘‘(2) on an ongoing basis, assess and evaluate 

24 consequence, vulnerability, and threat information to 

25 share with the entities referred to in subsection (a) acVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00034 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
35 

•HR 3696 RH

1 tionable assessments of critical infrastructure sector 

2 risks from cyber incidents and to assist critical infra3 structure owners and critical infrastructure operators 

4 by making recommendations to facilitate continuous 

5 improvements to the security and resiliency of the 

6 critical infrastructure of the United States; 

7 ‘‘(3) facilitate cross-sector integration, identifica8 tion, and analysis of key interdependencies to prevent 

9 related or consequential impacts to other critical in10 frastructure sectors; 

11 ‘‘(4) collaborate with the Information Sharing 

12 and Analysis Centers to tailor the analysis of infor13 mation to the specific characteristics and risk to a 

14 relevant critical infrastructure sector; and 

15 ‘‘(5) assess and evaluate consequence, vulner16 ability, and threat information regarding cyber inci17 dents in coordination with the Office of Emergency 

18 Communications of the Department to help facilitate 

19 continuous improvements to the security and resil20 iency of public safety communications networks. 

21 ‘‘(f) REPORT OF CYBER ATTACKS AGAINST FEDERAL

22 GOVERNMENT NETWORKS.—The Secretary shall submit to 

23 the Committee on Homeland Security of the House of Rep24 resentatives, the Committee on Homeland Security and 

25 Governmental Affairs of the Senate, and the Comptroller 


tkelley on DSK3SPTVN1PROD with BILLS
36 

•HR 3696 RH

1 General of the United States an annual report that summa2 rizes major cyber incidents involving Federal civilian agen3 cy information systems and provides aggregate statistics on 

4 the number of breaches, the extent of any personally identi5 fiable information that was involved, the volume of data 

6 exfiltrated, the consequential impact, and the estimated cost 

7 of remedying such breaches. 

8 ‘‘(g) REPORT ON THE OPERATIONS OF THE CENTER.— 

9 The Secretary, in consultation with the Sector Coordinating 

10 Councils and appropriate Federal Government entities, 

11 shall submit to the Committee on Homeland Security of the 

12 House of Representatives, the Committee on Homeland Se13 curity and Governmental Affairs of the Senate, and the 

14 Comptroller General of the United States an annual report 

15 on— 

16 ‘‘(1) the capability and capacity of the Center to 

17 carry out its cybersecurity mission in accordance 

18 with this section, and sections 226, 227, 229, 230, 

19 230A, and 230B; 

20 ‘‘(2) the extent to which the Department is en21 gaged in information sharing with each critical in22 frastructure sector designated under section 227(b), 

23 including— 

24 ‘‘(A) the extent to which each such sector 

25 has representatives at the Center; and 


tkelley on DSK3SPTVN1PROD with BILLS
37 

•HR 3696 RH

1 ‘‘(B) the extent to which critical infrastruc2 ture owners and critical infrastructure operators 

3 of each critical infrastructure sector participate 

4 in information sharing at the Center; 

5 ‘‘(3) the volume and range of activities with re6 spect to which the Secretary collaborated with the 

7 Sector Coordinating Councils and the Sector-Specific 

8 Agencies to promote greater engagement with the Cen9 ter; and 

10 ‘‘(4) the volume and range of voluntary technical 

11 assistance sought and provided by the Department to 

12 each critical infrastructure owner and critical infra13 structure operator.’’. 

14 (b) CLERICAL AMENDMENT.—The table of contents in 

15 section 1(b) of such Act is amended by adding after the item 

16 relating to section 227 (as added by section 103) the fol17 lowing new item: 

‘‘Sec. 228. National Cybersecurity and Communications Integration Center.’’. 

18 (c) GAO REPORT.—Not later than one year after the 

19 date of the enactment of this Act, the Comptroller General 

20 of the United States shall submit to the Committee on 

21 Homeland Security of the House of Representatives and the 

22 Committee on Homeland Security and Governmental Af23 fairs of the Senate a report on the effectiveness of the Na24 tional Cybersecurity and Communications Integration Cen25 ter established under section 228 of the Homeland Security 


tkelley on DSK3SPTVN1PROD with BILLS
38 

•HR 3696 RH

1 Act of 2002, as added by subsection (a) of this section, in 

2 carrying out its cybersecurity mission (as such term is de3 fined in section 2 of the Homeland Security Act of 2002, 

4 as amended by section 101) in accordance with this Act 

5 and such section 228 and sections 226, 227, 229, 230, 230A, 

6 and 230B of the Homeland Security Act of 2002, as added 

7 by this Act. 

8 SEC. 105. CYBER INCIDENT RESPONSE AND TECHNICAL AS9 SISTANCE. 

10 (a) IN GENERAL.—Subtitle C of title II of the Home11 land Security Act of 2002, as amended by sections 102, 103, 

12 and 104, is further amended by adding at the end the fol13 lowing new section: 

14 ‘‘SEC. 229. CYBER INCIDENT RESPONSE AND TECHNICAL AS15 SISTANCE. 

16 ‘‘(a) IN GENERAL.—The Secretary shall establish 

17 Cyber Incident Response Teams to— 

18 ‘‘(1) upon request, provide timely technical as19 sistance and crisis management support to Federal, 

20 State, and local government entities, private entities, 

21 and critical infrastructure owners and critical infra22 structure operators involving cyber incidents affecting 

23 critical infrastructure; and 

24 ‘‘(2) upon request, provide actionable rec25 ommendations on security and resilience measures 


tkelley on DSK3SPTVN1PROD with BILLS
39 

•HR 3696 RH

1 and countermeasures to Federal, State, and local gov2 ernment entities, private entities, and critical infra3 structure owners and critical infrastructure operators 

4 prior to, during, and after cyber incidents. 

5 ‘‘(b) COORDINATION.—In carrying out subsection (a), 

6 the Secretary shall coordinate with the relevant Sector Spe7 cific Agencies, if applicable. 

8 ‘‘(c) CYBER INCIDENT RESPONSE PLAN.—The Sec9 retary, in coordination with the Sector Coordinating Coun10 cils, Information Sharing and Analysis Centers, and Fed11 eral, State, and local governments, shall develop, regularly 

12 update, maintain, and exercise a National Cybersecurity 

13 Incident Response Plan which shall— 

14 ‘‘(1) include effective emergency response plans 

15 associated with cyber threats to critical infrastruc16 ture, information systems, or networks of information 

17 systems; 

18 ‘‘(2) ensure that such National Cybersecurity In19 cident Response Plan can adapt to and reflect a 

20 changing cyber threat environment, and incorporate 

21 best practices and lessons learned from regular exer22 cises, training, and after-action reports; and 

23 ‘‘(3) facilitate discussions on the best methods for 

24 developing innovative and useful cybersecurity exer25 cises for coordinating between the Department and 


tkelley on DSK3SPTVN1PROD with BILLS
40 

•HR 3696 RH

1 each of the critical infrastructure sectors designated 

2 under section 227(b). 

3 ‘‘(d) UPDATE TO CYBER INCIDENT ANNEX TO THE NA4 TIONAL RESPONSE FRAMEWORK.—The Secretary, in co5 ordination with the heads of other Federal agencies and in 

6 accordance with the National Cybersecurity Incident Re7 sponse Plan under subsection (c), shall regularly update, 

8 maintain, and exercise the Cyber Incident Annex to the Na9 tional Response Framework of the Department.’’. 

10 (b) CLERICAL AMENDMENT.—The table of contents in 

11 section 1(b) of such Act is amended by adding after the item 

12 relating to section 228 (as added by section 104) the fol13 lowing new item: 

‘‘Sec. 229. Cyber incident response and technical assistance.’’. 

14 SEC. 106. STREAMLINING OF DEPARTMENT CYBERSECU15 RITY ORGANIZATION. 

16 (a) CYBERSECURITY AND INFRASTRUCTURE PROTEC17 TION DIRECTORATE.—The National Protection and Pro18 grams Directorate of the Department of Homeland Security 

19 shall, after the date of the enactment of this Act, be known 

20 and designated as the ‘‘Cybersecurity and Infrastructure 

21 Protection Directorate’’. Any reference to the National Pro22 tection and Programs Directorate of the Department in any 

23 law, regulation, map, document, record, or other paper of 

24 the United States shall be deemed to be a reference to the 


tkelley on DSK3SPTVN1PROD with BILLS
41 

•HR 3696 RH

1 Cybersecurity and Infrastructure Protection Directorate of 

2 the Department. 

3 (b) SENIOR LEADERSHIP OF THE CYBERSECURITY

4 AND INFRASTRUCTURE PROTECTION DIRECTORATE.— 

5 (1) IN GENERAL.—Paragraph (1) of section 

6 103(a) of the Homeland Security Act of 2002 (6 

7 U.S.C. 113(a)) is amended by adding at the end the 

8 following new subparagraphs: 

9 ‘‘(K) Under Secretary for Cybersecurity and 

10 Infrastructure Protection. 

11 ‘‘(L) Deputy Under Secretary for Cyberse12 curity. 

13 ‘‘(M) Deputy Under Secretary for Infra14 structure Protection.’’. 

15 (2) CONTINUATION IN OFFICE.—The individuals 

16 who hold the positions referred to in subparagraphs 

17 (K), (L), and (M) of subsection (a) of section 103 of 

18 the Homeland Security Act of 2002 (as added by 

19 paragraph (1) of this subsection) as of the date of the 

20 enactment of this Act may continue to hold such posi21 tions. 

22 (c) REPORT ON IMPROVING THE CAPABILITY AND EF23 FECTIVENESS OF THE CYBERSECURITY AND COMMUNICA24 TIONS OFFICE.—To improve the operational capability and 

25 effectiveness in carrying out the cybersecurity mission (as 


tkelley on DSK3SPTVN1PROD with BILLS
42 

•HR 3696 RH

1 such term is defined in section 2 of the Homeland Security 

2 Act of 2002, as amended by section 101) of the Department 

3 of Homeland Security, the Secretary of Homeland Security 

4 shall submit to the Committee on Homeland Security of the 

5 House of Representatives and the Committee on Homeland 

6 Security and Governmental Affairs of the Senate a report 

7 on— 

8 (1) the feasibility of making the Cybersecurity 

9 and Communications Office of the Department an 

10 operational component of the Department; 

11 (2) recommendations for restructuring the 

12 SAFETY Act Office within the Department to protect 

13 and maintain operations in accordance with the Of14 fice’s mission to provide incentives for the develop15 ment and deployment of anti-terrorism technologies 

16 while elevating the profile and mission of the Office, 

17 including the feasibility of utilizing third-party reg18 istrars for improving the throughput and effectiveness 

19 of the certification process. 

20 (d) REPORT ON CYBERSECURITY ACQUISITION CAPA21 BILITIES.—The Secretary of Homeland Security shall as22 sess the effectiveness of the Department of Homeland Secu23 rity’s acquisition processes and the use of existing authori24 ties for acquiring cybersecurity technologies to ensure that 

25 such processes and authorities are capable of meeting the 


tkelley on DSK3SPTVN1PROD with BILLS
43 

•HR 3696 RH

1 needs and demands of the Department’s cybersecurity mis2 sion (as such term is defined in section 2 of the Homeland 

3 Security Act of 2002, as amended by section 101). Not later 

4 than 180 days after the date of the enactment of this Act, 

5 the Secretary shall submit to the Committee on Homeland 

6 Security of the House of Representatives and the Committee 

7 on Homeland Security and Governmental Affairs of the 

8 Senate a report on the effectiveness of the Department’s ac9 quisition processes for cybersecurity technologies. 

10 (e) RESOURCE INFORMATION.—The Secretary of 

11 Homeland Security shall make available Department of 

12 Homeland Security contact information to serve as a re13 source for Sector Coordinating Councils and critical infra14 structure owners and critical infrastructure operators to 

15 better coordinate cybersecurity efforts with the Department 

16 relating to emergency response and recovery efforts for cyber 

17 incidents. 

18 TITLE II—PUBLIC-PRIVATE COL19 LABORATION ON CYBERSECU20 RITY 

21 SEC. 201. PUBLIC-PRIVATE COLLABORATION ON CYBERSE22 CURITY. 

23 (a) NATIONAL INSTITUTE OF STANDARDS AND TECH24 NOLOGY.— 


tkelley on DSK3SPTVN1PROD with BILLS
44 

•HR 3696 RH

1 (1) IN GENERAL.—The Director of the National 

2 Institute of Standards and Technology, in coordina3 tion with the Secretary of Homeland Security, shall, 

4 on an ongoing basis, facilitate and support the devel5 opment of a voluntary, industry-led set of standards, 

6 guidelines, best practices, methodologies, procedures, 

7 and processes to reduce cyber risks to critical infra8 structure. The Director, in coordination with the Sec9 retary— 

10 (A) shall— 

11 (i) coordinate closely and continuously 

12 with relevant private entities, critical infra13 structure owners and critical infrastructure 

14 operators, Sector Coordinating Councils, In15 formation Sharing and Analysis Centers, 

16 and other relevant industry organizations, 

17 and incorporate industry expertise to the 

18 fullest extent possible; 

19 (ii) consult with the Sector Specific 

20 Agencies, Federal, State and local govern21 ments, the governments of other countries, 

22 and international organizations; 

23 (iii) utilize a prioritized, flexible, re24 peatable, performance-based, and cost-effec25 tive approach, including information secuVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00044 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
45 

•HR 3696 RH

1 rity measures and controls, that may be vol2 untarily adopted by critical infrastructure 

3 owners and critical infrastructure operators 

4 to help them identify, assess, and manage 

5 cyber risks; 

6 (iv) include methodologies to— 

7 (I) identify and mitigate impacts 

8 of the cybersecurity measures or con9 trols on business confidentiality; and 

10 (II) protect individual privacy 

11 and civil liberties; 

12 (v) incorporate voluntary consensus 

13 standards and industry best practices, and 

14 align with voluntary international stand15 ards to the fullest extent possible; 

16 (vi) prevent duplication of existing 

17 regulatory processes and prevent conflict 

18 with or superseding of existing regulatory 

19 requirements and processes; and 

20 (vii) include such other similar and 

21 consistent elements as determined necessary; 

22 and 

23 (B) shall not prescribe or otherwise re24 quire— 

25 (i) the use of specific solutions; 


tkelley on DSK3SPTVN1PROD with BILLS
46 

•HR 3696 RH

1 (ii) the use of specific information 

2 technology products or services; or 

3 (iii) that information technology prod4 ucts or services be designed, developed, or 

5 manufactured in a particular manner. 

6 (2) LIMITATION.—Information shared with or 

7 provided to the Director of the National Institute of 

8 Standards and Technology or the Secretary of Home9 land Security for the purpose of the activities under 

10 paragraph (1) may not be used by any Federal, 

11 State, or local government department or agency to 

12 regulate the activity of any private entity. 

13 (b) AMENDMENT.— 

14 (1) IN GENERAL.—Subtitle C of title II of the 

15 Homeland Security Act of 2002, as amended by sec16 tions 102, 103, 104, and 105, is further amended by 

17 adding at the end the following new section: 

18 ‘‘SEC. 230. PUBLIC-PRIVATE COLLABORATION ON CYBERSE19 CURITY. 

20 ‘‘(a) MEETINGS.—The Secretary shall meet with the 

21 Sector Coordinating Council for each critical infrastructure 

22 sector designated under section 227(b) on a biannual basis 

23 to discuss the cybersecurity threat to critical infrastructure, 

24 voluntary activities to address cybersecurity, and ideas to 


tkelley on DSK3SPTVN1PROD with BILLS
47 

•HR 3696 RH

1 improve the public-private partnership to enhance cyberse2 curity, in which the Secretary shall— 

3 ‘‘(1) provide each Sector Coordinating Council 

4 an assessment of the cybersecurity threat to each crit5 ical infrastructure sector designated under section 

6 227(b), including information relating to— 

7 ‘‘(A) any actual or assessed cyber threat, in8 cluding a consideration of adversary capability 

9 and intent, preparedness, target attractiveness, 

10 and deterrence capabilities; 

11 ‘‘(B) the extent and likelihood of death, in12 jury, or serious adverse effects to human health 

13 and safety caused by an act of terrorism or other 

14 disruption, destruction, or unauthorized use of 

15 critical infrastructure; 

16 ‘‘(C) the threat to national security caused 

17 by an act of terrorism or other disruption, de18 struction, or unauthorized use of critical infra19 structure; and 

20 ‘‘(D) the harm to the economy that would 

21 result from an act of terrorism or other disrup22 tion, destruction, or unauthorized use of critical 

23 infrastructure; and 


tkelley on DSK3SPTVN1PROD with BILLS
48 

•HR 3696 RH

1 ‘‘(2) provide recommendations, which may be 

2 voluntarily adopted, on ways to improve cybersecu3 rity of critical infrastructure. 

4 ‘‘(b) REPORT.— 

5 ‘‘(1) IN GENERAL.—Starting 30 days after the 

6 end of the fiscal year in which the National Cyberse7 curity and Critical Infrastructure Protection Act of 

8 2013 is enacted and annually thereafter, the Sec9 retary shall submit to the appropriate congressional 

10 committees a report on the state of cybersecurity for 

11 each critical infrastructure sector designated under 

12 section 227(b) based on discussions between the De13 partment and the Sector Coordinating Council in ac14 cordance with subsection (a) of this section. The Sec15 retary shall maintain a public copy of each report, 

16 and each report may include a non-public annex for 

17 proprietary, business-sensitive information, or other 

18 sensitive information. Each report shall include, at a 

19 minimum information relating to— 

20 ‘‘(A) the risk to each critical infrastructure 

21 sector, including known cyber threats, 

22 vulnerabilities, and potential consequences; 

23 ‘‘(B) the extent and nature of any cyberse24 curity incidents during the previous year, in25 cluding the extent to which cyber incidents jeopVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00048 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
49 

•HR 3696 RH

1 ardized or imminently jeopardized information 

2 systems; 

3 ‘‘(C) the current status of the voluntary, in4 dustry-led set of standards, guidelines, best prac5 tices, methodologies, procedures, and processes to 

6 reduce cyber risks within each critical infra7 structure sector; and 

8 ‘‘(D) the volume and range of voluntary 

9 technical assistance sought and provided by the 

10 Department to each critical infrastructure sector. 

11 ‘‘(2) SECTOR COORDINATING COUNCIL RE12 SPONSE.—Before making public and submitting each 

13 report required under paragraph (1), the Secretary 

14 shall provide a draft of each report to the Sector Co15 ordinating Council for the critical infrastructure sec16 tor covered by each such report. The Sector Coordi17 nating Council at issue may provide to the Secretary 

18 a written response to such report within 45 days of 

19 receiving the draft. If such Sector Coordinating Coun20 cil provides a written response, the Secretary shall in21 clude such written response in the final version of 

22 each report required under paragraph (1). 

23 ‘‘(c) LIMITATION.—Information shared with or pro24 vided to a Sector Coordinating Council, a critical infra25 structure sector, or the Secretary for the purpose of the acVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00049 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
50 

•HR 3696 RH

1 tivities under subsections (a) and (b) may not be used by 

2 any Federal, State, or local government department or 

3 agency to regulate the activity of any private entity.’’. 

4 (2) CLERICAL AMENDMENT.—The table of con5 tents in section 1(b) of such Act is amended by add6 ing after the item relating to section 229 (as added 

7 by section 105) the following new item: 

‘‘Sec. 230. Public-private collaboration on cybersecurity.’’. 

8 SEC. 202. SAFETY ACT AND QUALIFYING CYBER INCIDENTS. 

9 (a) IN GENERAL.—The Support Anti-Terrorism By 

10 Fostering Effective Technologies Act of 2002 (6 U.S.C. 441 

11 et seq.) is amended— 

12 (1) in section 862(b) (6 U.S.C. 441(b))— 

13 (A) in the heading, by striking ‘‘DESIGNA14 TION OF QUALIFIED ANTI-TERRORISM TECH15 NOLOGIES’’ and inserting ‘‘DESIGNATION OF

16 ANTI-TERRORISM AND CYBERSECURITY TECH17 NOLOGIES’’; 

18 (B) in the matter preceding paragraph (1), 

19 by inserting ‘‘and cybersecurity’’ after ‘‘anti-ter20 rorism’’; 

21 (C) in paragraphs (3), (4), and (5), by in22 serting ‘‘or cybersecurity’’ after ‘‘anti-terrorism’’ 

23 each place it appears; and 

24 (D) in paragraph (7)— 


tkelley on DSK3SPTVN1PROD with BILLS
51 

•HR 3696 RH

1 (i) by inserting ‘‘or cybersecurity tech2 nology’’ after ‘‘Anti-terrorism technology’’; 

3 and 

4 (ii) by inserting ‘‘or qualifying cyber 

5 incidents’’ after ‘‘acts of terrorism’’; 

6 (2) in section 863 (6 U.S.C. 442)— 

7 (A) by inserting ‘‘or cybersecurity’’ after 

8 ‘‘anti-terrorism’’ each place it appears; 

9 (B) by inserting ‘‘or qualifying cyber inci10 dent’’ after ‘‘act of terrorism’’ each place it ap11 pears; and 

12 (C) by inserting ‘‘or qualifying cyber inci13 dents’’ after ‘‘acts of terrorism’’ each place it ap14 pears; 

15 (3) in section 864 (6 U.S.C. 443)— 

16 (A) by inserting ‘‘or cybersecurity’’ after 

17 ‘‘anti-terrorism’’ each place it appears; and 

18 (B) by inserting ‘‘or qualifying cyber inci19 dent’’ after ‘‘act of terrorism’’ each place it ap20 pears; and 

21 (4) in section 865 (6 U.S.C. 444)— 

22 (A) in paragraph (1)— 

23 (i) in the heading, by inserting ‘‘OR

24 CYBERSECURITY’’ after ‘‘ANTI-TERRORISM’’; 


tkelley on DSK3SPTVN1PROD with BILLS
52 

•HR 3696 RH

1 (ii) by inserting ‘‘or cybersecurity’’ 

2 after ‘‘anti-terrorism’’; 

3 (iii) by inserting ‘‘or qualifying cyber 

4 incidents’’ after ‘‘acts of terrorism’’; and 

5 (iv) by inserting ‘‘or incidents’’ after 

6 ‘‘such acts’’; and 

7 (B) by adding at the end the following new 

8 paragraph: 

9 ‘‘(7) QUALIFYING CYBER INCIDENT.— 

10 ‘‘(A) IN GENERAL.—The term ‘qualifying 

11 cyber incident’ means any act that the Secretary 

12 determines meets the requirements under sub13 paragraph (B), as such requirements are further 

14 defined and specified by the Secretary. 

15 ‘‘(B) REQUIREMENTS.—A qualifying cyber 

16 incident meets the requirements of this subpara17 graph if— 

18 ‘‘(i) the incident is unlawful or other19 wise exceeds authorized access authority; 

20 ‘‘(ii) the incident disrupts or immi21 nently jeopardizes the integrity, operation, 

22 confidentiality, or availability of program23 mable electronic devices, communication 

24 networks, including hardware, software and 

25 data that are essential to their reliable operVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00052 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
53 

•HR 3696 RH

1 ation, electronic storage devices, or any 

2 other information system, or the informa3 tion that system controls, processes, stores, 

4 or transmits; 

5 ‘‘(iii) the perpetrator of the incident 

6 gains access to an information system or a 

7 network of information systems resulting 

8 in— 

9 ‘‘(I) misappropriation or theft of 

10 data, assets, information, or intellec11 tual property; 

12 ‘‘(II) corruption of data, assets, 

13 information, or intellectual property; 

14 ‘‘(III) operational disruption; or 

15 ‘‘(IV) an adverse effect on such 

16 system or network, or the data, assets, 

17 information, or intellectual property 

18 contained therein; and 

19 ‘‘(iv) the incident causes harm inside 

20 or outside the United States that results in 

21 material levels of damage, disruption, or 

22 casualties severely affecting the United 

23 States population, infrastructure, economy, 

24 or national morale, or Federal, State, local, 

25 or tribal government functions. 


tkelley on DSK3SPTVN1PROD with BILLS
54 

•HR 3696 RH

1 ‘‘(C) RULE OF CONSTRUCTION.—For pur2 poses of clause (iv) of subparagraph (B), the 

3 term ‘severely’ includes any qualifying cyber in4 cident, whether at a local, regional, state, na5 tional, international, or tribal level, that af6 fects— 

7 ‘‘(i) the United States population, in8 frastructure, economy, or national morale, 

9 or 

10 ‘‘(ii) Federal, State, local, or tribal 

11 government functions.’’. 

12 (b) FUNDING.—Of the amounts authorized to be appro13 priated for each of fiscal years 2014, 2015, and 2016 for 

14 the Department of Homeland Security, the Secretary of 

15 Homeland Security is authorized to use not less than 

16 $20,000,000 for any such year for the Department’s SAFE17 TY Act Office. 

18 SEC. 203. PROHIBITION ON NEW REGULATORY AUTHORITY. 

19 This Act and the amendments made by this Act (except 

20 that this section shall not apply in the case of section 202 

21 of this Act and the amendments made by such section 202) 

22 do not— 

23 (1) create or authorize the issuance of any new 

24 regulations or additional Federal Government regu25 latory authority; or 


tkelley on DSK3SPTVN1PROD with BILLS
55 

•HR 3696 RH

1 (2) permit regulatory actions that would dupli2 cate, conflict with, or supercede existing regulatory re3 quirements, mandatory standards, or related proc4 esses. 

5 SEC. 204. PROHIBITION ON ADDITIONAL AUTHORIZATION 

6 OF APPROPRIATIONS. 

7 No additional funds are authorized to be appropriated 

8 to carry out this Act and the amendments made by this 

9 Act. This Act and such amendments shall be carried out 

10 using amounts otherwise available for such purposes. 

11 SEC. 205. PROHIBITION ON COLLECTION ACTIVITIES TO 

12 TRACK INDIVIDUALS’ PERSONALLY IDENTIFI13 ABLE INFORMATION. 

14 Nothing in this Act shall permit the Department of 

15 Homeland Security to engage in the monitoring, surveil16 lance, exfiltration, or other collection activities for the pur17 pose of tracking an individual’s personally identifiable in18 formation. 

19 SEC. 206. CYBERSECURITY SCHOLARS. 

20 The Secretary of Homeland Security shall determine 

21 the feasibility and potential benefit of developing a visiting 

22 security researchers program from academia, including cy23 bersecurity scholars at the Department of Homeland Secu24 rity’s Centers of Excellence, as designated by the Secretary, 

25 to enhance knowledge with respect to the unique challenges 


tkelley on DSK3SPTVN1PROD with BILLS
56 

•HR 3696 RH

1 of addressing cyber threats to critical infrastructure. Eligi2 ble candidates shall possess necessary security clearances 

3 and have a history of working with Federal agencies in 

4 matters of national or domestic security. 

5 SEC. 207. NATIONAL RESEARCH COUNCIL STUDY ON THE 

6 RESILIENCE AND RELIABILITY OF THE NA7 TION’S POWER GRID. 

8 (a) INDEPENDENT STUDY.—Not later than 60 days 

9 after the date of the enactment of this Act, the Secretary 

10 of Homeland Security, in coordination with the heads of 

11 other departments and agencies, as necessary, shall enter 

12 into an agreement with the National Research Council to 

13 conduct research of the future resilience and reliability of 

14 the Nation’s electric power transmission and distribution 

15 system. The research under this subsection shall be known 

16 as the ‘‘Saving More American Resources Today Study’’ or 

17 the ‘‘SMART Study’’. In conducting such research, the Na18 tional Research Council shall— 

19 (1) research the options for improving the Na20 tion’s ability to expand and strengthen the capabili21 ties of the Nation’s power grid, including estimation 

22 of the cost, time scale for implementation, and identi23 fication of the scale and scope of any potential sig24 nificant health and environmental impacts; 


tkelley on DSK3SPTVN1PROD with BILLS
57 

•HR 3696 RH

1 (2) consider the forces affecting the grid, includ2 ing technical, economic, regulatory, environmental, 

3 and geopolitical factors, and how such forces are like4 ly to affect— 

5 (A) the efficiency, control, reliability and 

6 robustness of operation; 

7 (B) the ability of the grid to recover from 

8 disruptions, including natural disasters and ter9 rorist attacks; 

10 (C) the ability of the grid to incorporate 

11 greater reliance on distributed and intermittent 

12 power generation and electricity storage; 

13 (D) the ability of the grid to adapt to 

14 changing patterns of demand for electricity; and 

15 (E) the economic and regulatory factors af16 fecting the evolution of the grid; 

17 (3) review Federal, State, industry, and aca18 demic research and development programs and iden19 tify technological options that could improve the fu20 ture grid; 

21 (4) review the implications of increased reliance 

22 on digital information and control of the power grid 

23 for improving reliability, resilience, and congestion 

24 and for potentially increasing vulnerability to cyber 

25 attack; 


tkelley on DSK3SPTVN1PROD with BILLS
58 

•HR 3696 RH

1 (5) review regulatory, industry, and institu2 tional factors and programs affecting the future of the 

3 grid; 

4 (6) research the costs and benefits, as well as the 

5 strengths and weaknesses, of the options identified 

6 under paragraph (1) to address the emerging forces 

7 described in paragraph (2) that are shaping the grid; 

8 (7) identify the barriers to realizing the options 

9 identified and suggest strategies for overcoming those 

10 barriers including suggested actions, priorities, incen11 tives, and possible legislative and executive actions; 

12 and 

13 (8) research the ability of the grid to integrate 

14 existing and future infrastructure, including utilities, 

15 telecommunications lines, highways, and other crit16 ical infrastructure. 

17 (b) COOPERATION AND ACCESS TO INFORMATION AND

18 PERSONNEL.—The Secretary shall ensure that the National 

19 Research Council receives full and timely cooperation, in20 cluding full access to information and personnel, from the 

21 Department of Homeland Security, the Department of En22 ergy, including the management and operating components 

23 of the Departments, and other Federal departments and 

24 agencies, as necessary, for the purposes of conducting the 

25 study described in subsection (a). 


tkelley on DSK3SPTVN1PROD with BILLS
59 

•HR 3696 RH

1 (c) REPORT.— 

2 (1) IN GENERAL.—Not later than 18 months 

3 from the date on which the Secretary enters into the 

4 agreement with the National Research Council de5 scribed in subsection (a), the National Research 

6 Council shall submit to the Secretary and the Com7 mittee on Homeland Security of the House of Rep8 resentatives and the Committee on Homeland Secu9 rity and Governmental Affairs of the Senate a report 

10 containing the findings of the research required by 

11 that subsection. 

12 (2) FORM OF REPORT.—The report under para13 graph (1) shall be submitted in unclassified form, but 

14 may include a classified annex. 

15 (d) FUNDING.—Of the amounts authorized to be ap16 propriated for 2014 for the Department of Homeland Secu17 rity, the Secretary of Homeland Security is authorized to 

18 obligate and expend not more than $2,000,000 for the Na19 tional Research Council report. 

20 TITLE III—HOMELAND SECURITY 

21 CYBERSECURITY WORKFORCE 

22 SEC. 301. HOMELAND SECURITY CYBERSECURITY WORK23 FORCE. 

24 (a) IN GENERAL.—Subtitle C of title II of the Home25 land Security Act of 2002, as amended by sections 101, 102, 


tkelley on DSK3SPTVN1PROD with BILLS
60 

•HR 3696 RH

1 103, 104, 105, and 201, is further amended by adding at 

2 the end the following new section: 

3 ‘‘SEC. 230A. CYBERSECURITY OCCUPATION CATEGORIES, 

4 WORKFORCE ASSESSMENT, AND STRATEGY. 

5 ‘‘(a) SHORT TITLE.—This section may be cited as the 

6 ‘Homeland Security Cybersecurity Boots-on-the-Ground 

7 Act’. 

8 ‘‘(b) CYBERSECURITY OCCUPATION CATEGORIES.— 

9 ‘‘(1) IN GENERAL.—Not later than 90 days after 

10 the date of the enactment of this section, the Secretary 

11 shall develop and issue comprehensive occupation cat12 egories for individuals performing activities in fur13 therance of the cybersecurity mission of the Depart14 ment. 

15 ‘‘(2) APPLICABILITY.—The Secretary shall ensure 

16 that the comprehensive occupation categories issued 

17 under paragraph (1) are used throughout the Depart18 ment and are made available to other Federal agen19 cies. 

20 ‘‘(c) CYBERSECURITY WORKFORCE ASSESSMENT.— 

21 ‘‘(1) IN GENERAL.—Not later than 180 days 

22 after the date of the enactment of this section and an23 nually thereafter, the Secretary shall assess the readi24 ness and capacity of the workforce of the Department 

25 to meet its cybersecurity mission. 


tkelley on DSK3SPTVN1PROD with BILLS
61 

•HR 3696 RH

1 ‘‘(2) CONTENTS.—The assessment required under 

2 paragraph (1) shall, at a minimum, include the fol3 lowing: 

4 ‘‘(A) Information where cybersecurity posi5 tions are located within the Department, speci6 fied in accordance with the cybersecurity occupa7 tion categories issued under subsection (b). 

8 ‘‘(B) Information on which cybersecurity 

9 positions are— 

10 ‘‘(i) performed by— 

11 ‘‘(I) permanent full time depart12 mental employees, together with demo13 graphic information about such em14 ployees’ race, ethnicity, gender, dis15 ability status, and veterans status; 

16 ‘‘(II) individuals employed by 

17 independent contractors; and 

18 ‘‘(III) individuals employed by 

19 other Federal agencies, including the 

20 National Security Agency; and 

21 ‘‘(ii) vacant. 

22 ‘‘(C) The number of individuals hired by 

23 the Department pursuant to the authority grant24 ed to the Secretary in 2009 to permit the Sec25 retary to fill 1,000 cybersecurity positions across 


tkelley on DSK3SPTVN1PROD with BILLS
62 

•HR 3696 RH

1 the Department over a three year period, and in2 formation on what challenges, if any, were en3 countered with respect to the implementation of 

4 such authority. 

5 ‘‘(D) Information on vacancies within the 

6 Department’s cybersecurity supervisory work7 force, from first line supervisory positions 

8 through senior departmental cybersecurity posi9 tions. 

10 ‘‘(E) Information on the percentage of indi11 viduals within each cybersecurity occupation 

12 category who received essential training to per13 form their jobs, and in cases in which such 

14 training is not received, information on what 

15 challenges, if any, were encountered with respect 

16 to the provision of such training. 

17 ‘‘(F) Information on recruiting costs in18 curred with respect to efforts to fill cybersecurity 

19 positions across the Department in a manner 

20 that allows for tracking of overall recruiting and 

21 identifying areas for better coordination and 

22 leveraging of resources within the Department. 

23 ‘‘(d) WORKFORCE STRATEGY.— 

24 ‘‘(1) IN GENERAL.—Not later than 180 days 

25 after the date of the enactment of this section, the SecVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00062 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
63 

•HR 3696 RH

1 retary shall develop, maintain, and, as necessary, up2 date, a comprehensive workforce strategy that en3 hances the readiness, capacity, training, recruitment, 

4 and retention of the cybersecurity workforce of the De5 partment. 

6 ‘‘(2) CONTENTS.—The comprehensive workforce 

7 strategy developed under paragraph (1) shall in8 clude— 

9 ‘‘(A) a multiphased recruitment plan, in10 cluding relating to experienced professionals, 

11 members of disadvantaged or underserved com12 munities, the unemployed, and veterans; 

13 ‘‘(B) a 5-year implementation plan; 

14 ‘‘(C) a 10-year projection of the Depart15 ment’s cybersecurity workforce needs; and 

16 ‘‘(D) obstacles impeding the hiring and de17 velopment of a cybersecurity workforce at the De18 partment. 

19 ‘‘(e) INFORMATION SECURITY TRAINING.—Not later 

20 than 270 days after the date of the enactment of this section, 

21 the Secretary shall establish and maintain a process to 

22 verify on an ongoing basis that individuals employed by 

23 independent contractors who serve in cybersecurity posi24 tions at the Department receive initial and recurrent infor25 mation security training comprised of general security 


tkelley on DSK3SPTVN1PROD with BILLS
64 

•HR 3696 RH

1 awareness training necessary to perform their job functions, 

2 and role-based security training that is commensurate with 

3 assigned responsibilities. The Secretary shall maintain doc4 umentation to ensure that training provided to an indi5 vidual under this subsection meets or exceeds requirements 

6 for such individual’s job function. 

7 ‘‘(f) UPDATES.—The Secretary shall submit to the ap8 propriate congressional committees annual updates regard9 ing the cybersecurity workforce assessment required under 

10 subsection (c), information on the progress of carrying out 

11 the comprehensive workforce strategy developed under sub12 section (d), and information on the status of the implemen13 tation of the information security training required under 

14 subsection (e). 

15 ‘‘(g) GAO STUDY.—The Secretary shall provide the 

16 Comptroller General of the United States with information 

17 on the cybersecurity workforce assessment required under 

18 subsection (c) and progress on carrying out the comprehen19 sive workforce strategy developed under subsection (d). The 

20 Comptroller General shall submit to the Secretary and the 

21 appropriate congressional committees a study on such as22 sessment and strategy. 

23 ‘‘(h) CYBERSECURITY FELLOWSHIP PROGRAM.—Not 

24 later than 120 days after the date of the enactment of this 

25 section, the Secretary shall submit to the appropriate conVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00064 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
65 

•HR 3696 RH

1 gressional committees a report on the feasibility of estab2 lishing a Cybersecurity Fellowship Program to offer a tui3 tion payment plan for undergraduate and doctoral can4 didates who agree to work for the Department for an agreed5 upon period of time.’’. 

6 (b) CLERICAL AMENDMENT.—The table of contents in 

7 section 1(b) of such Act is amended by adding after the item 

8 relating to section 230 (as added by section 201) the fol9 lowing new item: 

‘‘Sec. 230A. Cybersecurity occupation categories, workforce assessment, and strategy.’’. 

10 SEC. 302. PERSONNEL AUTHORITIES. 

11 (a) IN GENERAL.—Subtitle C of title II of the Home12 land Security Act of 2002, as amended by sections 101, 102, 

13 103, 104, 105, 106, 201, and 301 is further amended by 

14 adding at the end the following new section: 

15 ‘‘SEC. 230B. PERSONNEL AUTHORITIES. 

16 ‘‘(a) IN GENERAL.— 

17 ‘‘(1) PERSONNEL AUTHORITIES.—The Secretary 

18 may exercise with respect to qualified employees of the 

19 Department the same authority that the Secretary of 

20 Defense has with respect to civilian intelligence per21 sonnel and the scholarship program under sections 

22 1601, 1602, 1603, and 2200a of title 10, United 

23 States Code, to establish as positions in the excepted 

24 service, appoint individuals to such positions, fix 


tkelley on DSK3SPTVN1PROD with BILLS
66 

•HR 3696 RH

1 pay, and pay a retention bonus to any employee ap2 pointed under this section if the Secretary determines 

3 that such is needed to retain essential personnel. Be4 fore announcing the payment of a bonus under this 

5 paragraph, the Secretary shall submit to the Com6 mittee on Homeland Security of the House of Rep7 resentatives and the Committee on Homeland Secu8 rity and Governmental Affairs of the Senate a writ9 ten explanation of such determination. Such author10 ity shall be exercised— 

11 ‘‘(A) to the same extent and subject to the 

12 same conditions and limitations that the Sec13 retary of Defense may exercise such authority 

14 with respect to civilian intelligence personnel of 

15 the Department of Defense; and 

16 ‘‘(B) in a manner consistent with the merit 

17 system principles set forth in section 2301 of 

18 title 5, United States Code. 

19 ‘‘(2) CIVIL SERVICE PROTECTIONS.—Sections 

20 1221 and 2302, and chapter 75 of title 5, United 

21 States Code, shall apply to the positions established 

22 pursuant to the authorities provided under paragraph 

23 (1). 

24 ‘‘(3) PLAN FOR EXECUTION OF AUTHORITIES.— 

25 Not later than 120 days after the date of the enactVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00066 Fmt 6652 Sfmt 6203 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS
67 

•HR 3696 RH

1 ment of this section, the Secretary shall submit to the 

2 Committee on Homeland Security of the House of 

3 Representatives and the Committee on Homeland Se4 curity and Governmental Affairs of the Senate a re5 port that contains a plan for the use of the authorities 

6 provided under this subsection. 

7 ‘‘(b) ANNUAL REPORT.—Not later than one year after 

8 the date of the enactment of this section and annually there9 after for four years, the Secretary shall submit to the Com10 mittee on Homeland Security of the House of Representa11 tives and the Committee on Homeland Security and Gov12 ernmental Affairs of the Senate a detailed report (including 

13 appropriate metrics on actions occurring during the report14 ing period) that discusses the processes used by the Sec15 retary in implementing this section and accepting applica16 tions, assessing candidates, ensuring adherence to veterans’ 

17 preference, and selecting applicants for vacancies to be filled 

18 by a qualified employee. 

19 ‘‘(c) DEFINITION OF QUALIFIED EMPLOYEE.—In this 

20 section, the term ‘qualified employee’ means an employee 

21 who performs functions relating to the security of Federal 

22 civilian information systems, critical infrastructure infor23 mation systems, or networks of either of such systems.’’. 

24 (b) CLERICAL AMENDMENT.—The table of contents in 

25 section 1(b) of such Act is amended by adding after the item 


tkelley on DSK3SPTVN1PROD with BILLS
68 

•HR 3696 RH

1 relating to section 230A (as added by section 301) the fol2 lowing new item: 

‘‘Sec. 230B. Personnel authorities.’’. 


tkelley on DSK3SPTVN1PROD with BILLS

tkelley on DSK3SPTVN1PROD with BILLS
Union Calendar No. 411 

113TH CONGRESS 

2D SESSION H. R. 3696 

[Report No. 113–550, Part I] 

A BILL 

To amend the Homeland Security Act of 2002 to 

other purposes. rity and critical infrastructure protection, and for make certain improvements regarding cybersecuJULY 23, 2014 

Reported from the Committee on Homeland Security 

with an amendment 

JULY 23, 2014 

The Committees on Science, Space, and Technology and 

State of the Union and ordered to be printed mitted to the Committee of the Whole House on the Oversight and Government Reform discharged; comVerDate Mar 15 2010 21:44 Jul 23, 2014 Jkt 039200 PO 00000 Frm 00070 Fmt 6651 Sfmt 6651 E:\BILLS\H3696.RH H3696

tkelley on DSK3SPTVN1PROD with BILLS