Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015

To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes. 1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 6 U.S.C. 148 (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 6 U.S.C. 148 (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 6 U.S.C. 148 (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, physical security, (2) in section 70103(c)(3)(C), by striking and (v) cybersecurity; and . December 15, 2015 Reported from the Committee on Homeland Security December 15, 2015 The Committee on Transportation and Infrastructure

Summary: Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 (Sec. 2) This bill requires the Department of Homeland Security (DHS) to implement, and evaluate at least every two years, a maritime cybersecurity risk assessment model to evaluate current and future cybersecurity risks. The model must be consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any updates pursuant to the Cybersecurity Enhancement Act of 2014. DHS must also: (1) seek to ensure participation of at least one information sharing and analysis organization representing the maritime community in the National Cybersecurity and Communications Integration Center (NCCIC); (2) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents to the NCCIC and other appropriate federal agencies; and (3) request the National Maritime Security Advisory Committee to report and make recommendations to DHS regarding the enhancement of cybersecurity information sharing between relevant federal agencies and state, local, and tribal governments, public safety and emergency response agencies, law enforcement and security organizations, the maritime industry, port owners and operators, and terminal owners and operators. (Sec. 3) The Coast Guard must: (1) direct Area Maritime Security Advisory Committees to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, including, possibly, by establishing a working group of members of such committees to address port-specific cybersecurity vulnerabilities; and (2) require area maritime security plans and facility security plans to include a mitigation plan to prevent, manage, and respond to cybersecurity risks. (Sec. 4) DHS's vulnerability assessments of facilities and vessels that may be involved in a transportation security incident must identify weaknesses in cybersecurity. Owners or operators of such vessels or facilities must include provisions regarding prevention, management, and response to cybersecurity risks in their security plans for deterring such incidents.