National Cybersecurity Protection Act of 2014

To codify an existing operations center for cybersecurity. 1. Short title This Act may be cited as the National Cybersecurity and Communications Integration Center Act of 2014 2. National Cybersecurity and Communications Integration Center (a) In general Subtitle A of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 121 et seq. 210G. Operations center (a) Functions There is in the Department an operations center, which may carry out the responsibilities of the Under Secretary appointed under section 103(a)(1)(H) with respect to security and resilience, including by— (1) serving as a Federal civilian information sharing interface for cybersecurity; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government; (3) sharing cybersecurity threat, vulnerability, impact, and incident information and analysis by and among Federal, State, and local government entities and private sector entities; (4) coordinating cybersecurity information sharing throughout the Federal Government; (5) conducting analysis of cybersecurity risks and incidents; (6) upon request, providing timely technical assistance to Federal and non-Federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and remediation; and (7) providing recommendations on security and resilience measures to Federal and non-Federal entities. (b) Composition The operations center shall be composed of— (1) personnel or other representatives of Federal agencies, including civilian and law enforcement agencies and elements of the intelligence community, as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)); and (2) representatives from State and local governments and other non-Federal entities, including— (A) representatives from information sharing and analysis organizations; and (B) private sector owners and operators of critical information systems. (c) Annual report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 (1) an analysis of the performance of the operations center in carrying out the functions under subsection (a); (2) information on the composition of the center, including— (A) the number of representatives from non-Federal entities that are participating in the operations center, including the number of representatives from States, nonprofit organizations, and private sector entities, respectively; and (B) the number of requests from non-Federal entities to participate in the operations center and the response to such requests, including— (i) the average length of time to fulfill such identified requests by the Federal agency responsible for fulfilling such requests; and (ii) a description of any obstacles or challenges to fulfilling such requests; and (3) the policies and procedures established by the operations center to safeguard privacy and civil liberties. (d) GAO report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 (e) No right or benefit The provision of assistance or information to, and inclusion in the operations center of, governmental or private entities under this section shall be at the discretion of the Under Secretary appointed under section 103(a)(1)(H). The provision of certain assistance or information to, or inclusion in the operations center of, one governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity. . (b) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 Sec. 210G. Operations center. . 3. Rule of construction (a) Definition In this section, the term critical infrastructure (b) Rule of construction Nothing in this Act shall be construed to grant the Secretary of Homeland Security any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this Act. July 31, 2014 Reported with an amendment

Summary: National Cybersecurity Protection Act of 2014 - (Sec. 3) Amends the Homeland Security Act of 2002 to establish a national cybersecurity and communications integration center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs. Requires the center to be the federal civilian interface for sharing cybersecurity risks, incidents, analysis, and warnings for federal and non-federal entities. Directs the center to: (1) enable real-time, integrated, and operational actions across federal and non-federal entities; (2) facilitate cross-sector coordination to address risks and incidents that may be related or could have consequential impacts across multiple sectors; (3) conduct and share analysis; and (4) provide technical assistance, risk management, and security measure recommendations. Directs the center to ensure: (1) continuous, collaborative, and inclusive coordination across sectors and with sector coordinating councils, information sharing and analysis organizations, and other appropriate non-federal partners; (2) development and use of technology-neutral, real-time mechanisms for sharing information about risks and incidents; and (3) safeguards against unauthorized access. Provides the Under Secretary with unreviewable discretion as to whether governmental or private entities are included in the center or are provided assistance or information. (Sec. 4) Requires the DHS Secretary to submit to Congress recommendations regarding how to expedite implementation of information-sharing agreements for cybersecurity purposes between the center and non-federal entities. (Sec. 5) Directs the Secretary to report annually to Congress concerning: (1) the number of non-federal participants, the length of time taken to resolve requests to participate in the center, and the reasons for any denials of such requests; (2) DHS's information sharing with each critical infrastructure sector; and (3) privacy and civil liberties safeguards. (Sec. 6) Requires a Comptroller General (GAO) report on the effectiveness of the center. (Sec. 7) Directs the Under Secretary to develop, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks to critical infrastructure. Requires the Secretary to make the application process for security clearances relating to a classified national security information program available to sector coordinating councils, sector information sharing and analysis organizations, and owners and operators of critical infrastructure. Directs the Office of Management and Budget (OMB) to ensure that data breach notification policies require affected agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General (DOJ), heads of elements of the intelligence community, or the Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions. Requires OMB to assess agency implementation of data breach notification policies. (Sec. 8) Prohibits this Act from being construed to: (1) grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the enactment of this Act, or (2) require any private entity to request the Secretary's assistance or to implement any recommendation suggested by the Secretary in response to such a request.