Assessing a Cyber State of Distress Act of 2020

To require the Secretary of Homeland Security to conduct an assessment of the feasibility and advisability of establishing a fund for the response to, and recovery from, a cyber state of distress, and for other purposes. 1. Short title This Act may be cited as the Assessing a Cyber State of Distress Act of 2020 2. Definitions In this Act: (1) Appropriate congressional committees The term appropriate congressional committees (A) the Committee on Homeland Security and Governmental Affairs of the Senate (B) the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives. (2) Critical infrastructure The term critical infrastructure 42 U.S.C. 5195c(e) (3) Cyber Response and Recovery Fund The term Cyber Response and Recovery Fund (4) Cyber state of distress The term cyber state of distress (A) begins with a Federal declaration; and (B) triggers additional financial and material assistance in responding to significant cyber incidents. (5) State The term State 3. Assessment of cyber state of distress (a) In general Not later than 180 days after the enactment of this Act, the Secretary of Homeland Security, in consultation with the head of any agency or non-Federal entity determined appropriate by the Secretary, shall conduct an assessment of the feasibility and advisability of establishing an authority for the declaration of a cyber state of distress. (b) Elements The assessment required under subsection (a) shall include— (1) a review of recommendations developed by the Cyberspace Solarium Commission under section 1652(k) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 ( Public Law 115–232 (2) the development of additional recommendations relating to— (A) the determinations that the Secretary should make and any other actions that should be taken before the Secretary is authorized to declare or renew a cyber state of distress, including whether the declaration or any renewal should require congressional oversight or approval; (B) the definition of the term significant cyber incident (C) the authority for the coordination, including the extent and type of coordination, of the response of— (i) Federal, State, local, and Tribal governments, including the National Guard; and (ii) private entities; (D) the appropriate duration of a cyber state of distress and any renewal of a cyber state of distress; (E) whether there should be a limitation on the number of renewals of a cyber state of distress, with or without congressional oversight or approval; (F) the interaction, duplication, coordination, and deconfliction of— (i) authorities or functions for the preparation for, response to, or recovery from a significant cyber incident that the Secretary of Homeland Security recommends granting or assigning under this paragraph; and (ii) existing authorities or functions established by law or policy that may relate to preparing for, responding to, or recovery from a significant cyber incident, including under— (I) the Robert T. Stafford Disaster Relief and Emergency Assistance Act ( 42 U.S.C. 5121 (II) the National Emergencies Act ( 50 U.S.C. 1601 (III) continuity of government plans; (IV) other national disaster plans; and (V) any other Federal authority the Secretary of Homeland Security determines appropriate; (G) appropriate exemptions from applicable legal requirements necessary to facilitate activities during a cyber state of distress; (H) the scope of any allowable activities— (i) in preparation for a declaration of a cyber state of distress; (ii) during a cyber state of distress; or (iii) immediately following the termination of the cyber state of distress; (I) the scope of any other interaction between Federal entities and between Federal and non-Federal entities; and (J) any other aspects of a cyber state of distress that the Secretary of Homeland Security determines relevant. 4. Assessment of Cyber Response and Recovery Fund (a) In general Not later than 180 days after the date of enactment of this Act, the Secretary of Homeland Security shall conduct an assessment of the feasibility and advisability of establishing a Cyber Response and Recovery Fund. (b) Elements The assessment required under subsection (a) shall include— (1) a review of recommendations developed by the Cyberspace Solarium Commission under section 1652(k) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 ( Public Law 115–232 (2) the development of additional recommendations relating to— (A) the administration of a Cyber Response and Recovery Fund; (B) the eligibility of entities that may receive direct or indirect support under a Cyber Response and Recovery Fund, including eligibility for the receipt of direct or indirect support by— (i) Federal entities; (ii) State, local, and Tribal governments; (iii) owners and operators of critical infrastructure; and (iv) private sector entities that are not owners or operators of critical infrastructure; (C) allowable expenses for a Cyber Response and Recovery Fund; (D) whether any entity receiving funds from the Cyber Response and Recovery Fund should be required to match funds or reimburse any funds to the Cyber Response and Recovery Fund; and (E) with respect to funding available for the response to, and recovery from a significant cyber incident, the interaction, duplication, coordination, and deconfliction of that funding, or applications for that funding, provided— (i) from a Cyber Response and Recovery Fund; or (ii) under— (I) the Robert T. Stafford Disaster Relief and Emergency Assistance Act ( 42 U.S.C. 5121 (II) the National Emergencies Act ( 50 U.S.C. 1601 (III) any other Federal grant program relating to cybersecurity or natural disaster response or recovery. 5. Briefing (a) In general Not later than 180 days after the date of enactment of this Act, the Secretary of Homeland Security shall provide a briefing to each appropriate congressional committee on the assessments carried out by the Secretary of Homeland Security under sections 3 and 4 that includes— (1) the findings from the assessments; and (2) legislative proposals for the establishment of— (A) an authority for the declaration of a cyber state of distress; and (B) a Cyber Response and Recovery Fund. (b) Format Each briefing required under subsection (a)— (1) shall be completed in a manner that is unclassified; and (2) may include a classified component.

Summary: Assessing a Cyber State of Distress Act of 2020 This bill requires the Department of Homeland Security (DHS) to assess the feasibility and advisability of establishing (1) an authority for the declaration of a cyber state of distress, and (2) a Cyber Response and Recovery Fund. Both required assessments shall include a review of recommendations by the Cyberspace Solarium Commission established to develop a consensus on a strategic approach to defending the United States in cyberspace against cyberattacks of significant consequences. Further, the assessment of an authority for declaring a cyber state of distress shall include the development of additional recommendations relating to (1) any determinations that DHS should make and other actions that should be taken before DHS is authorized to declare or renew a cyber state of distress, (2) the definition of the term significant cyber incident, and (3) the appropriate duration of a cyber state of distress. The assessment of a Cyber Response and Recovery Fund shall include the development of additional recommendations relating to (1) the administration of such a fund, (2) the eligibility of entities that may receive support from such fund, and (3) allowable expenses for such fund. DHS must provide a briefing that includes findings from each assessment and legislative proposals for the establishment of an authority for the declaration of a cyber state of distress and a Cyber Response and Recovery Fund.