117TH CONGRESS 

1ST SESSION H. R. 3223 

AN ACT 

To amend the Homeland Security Act of 2002 to establish 

in the Cybersecurity and Infrastructure Security Agency 

the National Cyber Exercise Program, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

2 

•HR 3223 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘CISA Cyber Exercise 

3 Act’’. 

4 SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 

5 (a) IN GENERAL.—Subtitle A of title XXII of the 

6 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 

7 is amended by adding at the end the following new section: 

8 ‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 

9 ‘‘(a) ESTABLISHMENT OF PROGRAM.— 

10 ‘‘(1) IN GENERAL.—There is established in the 

11 Agency the National Cyber Exercise Program (re12 ferred to in this section as the ‘Exercise Program’) 

13 to evaluate the National Cyber Incident Response 

14 Plan, and other related plans and strategies. 

15 ‘‘(2) REQUIREMENTS.— 

16 ‘‘(A) IN GENERAL.—The Exercise Program 

17 shall be— 

18 ‘‘(i) based on current risk assess19 ments, including credible threats, 

20 vulnerabilities, and consequences; 

21 ‘‘(ii) designed, to the extent prac22 ticable, to simulate the partial or complete 

23 incapacitation of a government or critical 

24 infrastructure network resulting from a 

25 cyber incident; 

3 

•HR 3223 EH

1 ‘‘(iii) designed to provide for the sys2 tematic evaluation of cyber readiness and 

3 enhance operational understanding of the 

4 cyber incident response system and rel5 evant information sharing agreements; and 

6 ‘‘(iv) designed to promptly develop 

7 after-action reports and plans that can 

8 quickly incorporate lessons learned into fu9 ture operations. 

10 ‘‘(B) MODEL EXERCISE SELECTION.—The 

11 Exercise Program shall— 

12 ‘‘(i) include a selection of model exer13 cises that government and private entities 

14 can readily adapt for use; and 

15 ‘‘(ii) aid such governments and pri16 vate entities with the design, implementa17 tion, and evaluation of exercises that— 

18 ‘‘(I) conform to the requirements 

19 described in subparagraph (A); 

20 ‘‘(II) are consistent with any ap21 plicable national, State, local, or Trib22 al strategy or plan; and 

23 ‘‘(III) provide for systematic 

24 evaluation of readiness. 

4 

•HR 3223 EH

1 ‘‘(3) CONSULTATION.—In carrying out the Ex2 ercise Program, the Director may consult with ap3 propriate representatives from Sector Risk Manage4 ment Agencies, cybersecurity research stakeholders, 

5 and Sector Coordinating Councils. 

6 ‘‘(b) DEFINITIONS.—In this section: 

7 ‘‘(1) STATE.—The term ‘State’ means any 

8 State of the United States, the District of Columbia, 

9 the Commonwealth of Puerto Rico, the Northern 

10 Mariana Islands, the United States Virgin Islands, 

11 Guam, American Samoa, and any other territory or 

12 possession of the United States. 

13 ‘‘(2) PRIVATE ENTITY.—The term ‘private enti14 ty’ has the meaning given such term in section 102 

15 of the Cybersecurity Information Sharing Act of 

16 2015 (6 U.S.C. 1501).’’. 

17 (b) TECHNICAL AMENDMENTS.— 

18 (1) HOMELAND SECURITY ACT OF 2002.—Sub19 title A of title XXII of the Homeland Security Act 

20 of 2002 (6 U.S.C. 651 et seq.) is amended— 

21 (A) in the first section 2215 (6 U.S.C. 

22 665; relating to the duties and authorities relat23 ing to .gov internet domain), by amending the 

24 section enumerator and heading to read as fol25 lows: 

5 

•HR 3223 EH

1 ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 

2 INTERNET DOMAIN.’’; 

3 (B) in the second section 2215 (6 U.S.C. 

4 665b; relating to the joint cyber planning of5 fice), by amending the section enumerator and 

6 heading to read as follows: 

7 ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 

8 (C) in the third section 2215 (6 U.S.C. 

9 665c; relating to the Cybersecurity State Coor10 dinator), by amending the section enumerator 

11 and heading to read as follows: 

12 ‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 

13 (D) in the fourth section 2215 (6 U.S.C. 

14 665d; relating to Sector Risk Management 

15 Agencies), by amending the section enumerator 

16 and heading to read as follows: 

17 ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 

18 (E) in section 2216 (6 U.S.C. 665e; relat19 ing to the Cybersecurity Advisory Committee), 

20 by amending the section enumerator and head21 ing to read as follows: 

22 ‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 

23 and 

24 (F) in section 2217 (6 U.S.C. 665f; relat25 ing to Cybersecurity Education and Training 

6 

•HR 3223 EH

1 Programs), by amending the section enu2 merator and heading to read as follows: 

3 ‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 

4 PROGRAMS.’’. 

5 (2) CONSOLIDATED APPROPRIATIONS ACT, 

6 2021.—Paragraph (1) of section 904(b) of division U 

7 of the Consolidated Appropriations Act, 2021 (Pub8 lic Law 116–260) is amended, in the matter pre9 ceding subparagraph (A), by inserting ‘‘of 2002’’ 

10 after ‘‘Homeland Security Act’’. 

11 (c) CLERICAL AMENDMENT.—The table of contents 

12 in section 1(b) of the Homeland Security Act of 2002 is 

13 amended by striking the items relating to sections 2214 

14 through 2217 and inserting the following new items: 

‘‘Sec. 2214. National Asset Database. 

‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 

‘‘Sec. 2216. Joint cyber planning office. 

‘‘Sec. 2217. Cybersecurity State Coordinator. 

‘‘Sec. 2218. Sector Risk Management Agencies. 

‘‘Sec. 2219. Cybersecurity Advisory Committee. 

‘‘Sec. 2220. Cybersecurity Education and Training Programs. 

‘‘Sec. 2220A. National Cyber Exercise Program.’’. 

Passed the House of Representatives July 20, 2021. 

Attest: 

Clerk. 

117TH CONGRESS 

1ST SESSION H. R. 3223 

AN ACT 

To amend the Homeland Security Act of 2002 to 

Program, and for other purposes. Security Agency the National Cyber Exercise establish in the Cybersecurity and Infrastructure