SEC. 6. CYBER INCIDENT RESPONSE PLANS. 
(a) IN GENERAL.—Section 227 of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 149) is amended— 
(1) in the heading, by striking ‘‘PLAN’’ and in-
serting ‘‘PLANS’’; 
(2) by striking ‘‘The Under Secretary appointed 
under section 103(a)(1)(H) shall’’ and inserting the 
following: 
‘‘(a) IN GENERAL.—The Under Secretary for Cyberse-
curity and Infrastructure Protection shall’’; and 
(3) by adding at the end the following new sub-
section: 
‘‘(b) UPDATES TO THE CYBER INCIDENT ANNEX TO 
THE NATIONAL RESPONSE FRAMEWORK.—The Secretary, 
in coordination with the heads of other appropriate Federal 
departments and agencies, and in accordance with the Na-
tional Cybersecurity Incident Response Plan required 
under subsection (a), shall regularly update, maintain, and 
exercise the Cyber Incident Annex to the National Response 
Framework of the Department.’’. 
(b) CLERICAL AMENDMENT.—The table of contents of 
the Homeland Security Act of 2002 is amended by amend-
ing the item relating to section 227 to read as follows: 
‘‘Sec. 227. Cyber incident response plans.’’. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6213
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
SEC. 7. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS; CYBERSECURITY AWARE-
NESS CAMPAIGN. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amended 
by adding at the end the following new sections: 
‘‘SEC. 230. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS. 
‘‘The National Cybersecurity and Communications In-
tegration Center, in coordination with the Office of Emer-
gency Communications of the Department, shall assess and 
evaluate consequence, vulnerability, and threat information 
regarding cyber incidents to public safety communications 
to help facilitate continuous improvements to the security 
and resiliency of such communications. 
‘‘SEC. 231. CYBERSECURITY AWARENESS CAMPAIGN. 
‘‘(a) IN GENERAL.—The Under Secretary for Cyberse-
curity and Infrastructure Protection shall develop and im-
plement an ongoing and comprehensive cybersecurity 
awareness campaign regarding cybersecurity risks and vol-
untary best practices for mitigating and responding to such 
risks. Such campaign shall, at a minimum, publish and 
disseminate, on an ongoing basis, the following: 
‘‘(1) Public service announcements targeted at 
improving awareness among State, local, and tribal 
governments, the private sector, academia, and stake-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
holders in specific audiences, including the elderly, 
students, small businesses, members of the Armed 
Forces, and veterans. 
‘‘(2) Vendor and technology-neutral voluntary 
best practices information. 
‘‘(b) CONSULTATION.—The Under Secretary for Cyber-
security and Infrastructure Protection shall consult with a 
wide range of stakeholders in government, industry, aca-
demia, and the non-profit community in carrying out this 
section.’’. 
(b) CLERICAL AMENDMENT.—The table of contents of 
the Homeland Security Act of 2002 is amended by inserting 
after the item relating to section 226 (relating to cybersecu-
rity recruitment and retention) the following new items: 
‘‘Sec. 230. Security and resiliency of public safety communications. 
‘‘Sec. 231. Cybersecurity awareness campaign.’’. 
SEC. 8. CRITICAL INFRASTRUCTURE PROTECTION RE-
SEARCH AND DEVELOPMENT. 
(a) STRATEGIC
PLAN; PUBLIC-PRIVATE
CONSOR-
TIUMS.—Title III of the Homeland Security Act of 2002 
(6 U.S.C. 181 et seq.) is amended by adding at the end 
the following new section: 
‘‘SEC. 318. RESEARCH AND DEVELOPMENT STRATEGY FOR 
CRITICAL INFRASTRUCTURE PROTECTION. 
‘‘(a) IN GENERAL.—Not later than 180 days after the 
date of enactment of this section, the Secretary, acting 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
through the Under Secretary for Science and Technology, 
shall submit to Congress a strategic plan to guide the overall 
direction of Federal physical security and cybersecurity 
technology research and development efforts for protecting 
critical infrastructure, including against all threats. Such 
plan shall be updated and submitted to Congress every two 
years. 
‘‘(b) CONTENTS OF PLAN.—The strategic plan, includ-
ing biennial updates, required under subsection (a) shall 
include the following: 
‘‘(1) An identification of critical infrastructure 
security risks and any associated security technology 
gaps, that are developed following— 
‘‘(A) consultation with stakeholders, includ-
ing critical infrastructure Sector Coordinating 
Councils; and 
‘‘(B) performance by the Department of a 
risk and gap analysis that considers information 
received in such consultations. 
‘‘(2) A set of critical infrastructure security tech-
nology needs that— 
‘‘(A) is prioritized based on the risks and 
gaps identified under paragraph (1); 
‘‘(B) emphasizes research and development 
of technologies that need to be accelerated due to 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
rapidly evolving threats or rapidly advancing 
infrastructure technology; and 
‘‘(C) includes research, development, and 
acquisition roadmaps with clearly defined objec-
tives, goals, and measures. 
‘‘(3) An identification of laboratories, facilities, 
modeling, and simulation capabilities that will be re-
quired to support the research, development, dem-
onstration, testing, evaluation, and acquisition of the 
security technologies described in paragraph (2). 
‘‘(4) An identification of current and planned 
programmatic initiatives for fostering the rapid ad-
vancement and deployment of security technologies for 
critical infrastructure protection, including a consid-
eration of opportunities for public-private partner-
ships, intragovernment collaboration, university cen-
ters of excellence, and national laboratory technology 
transfer. 
‘‘(5) A description of progress made with respect 
to each critical infrastructure security risk, associated 
security technology gap, and critical infrastructure 
technology need identified in the preceding strategic 
plan required under subsection (a). 
‘‘(c) COORDINATION.—In carrying out this section, the 
Under Secretary for Science and Technology shall coordi-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
nate with the Under Secretary for the National Protection 
and Programs Directorate. 
‘‘(d) CONSULTATION.—In carrying out this section, the 
Under Secretary for Science and Technology shall consult 
with— 
‘‘(1) critical infrastructure Sector Coordinating 
Councils; 
‘‘(2) to the extent practicable, subject matter ex-
perts on critical infrastructure protection from uni-
versities, colleges, national laboratories, and private 
industry; 
‘‘(3) the heads of other relevant Federal depart-
ments and agencies that conduct research and devel-
opment relating to critical infrastructure protection; 
and 
‘‘(4) State, local, and tribal governments, as ap-
propriate.’’. 
(b) CLERICAL AMENDMENT.—The table of contents of 
the Homeland Security Act of 2002 is amended by inserting 
after the item relating to section 317 the following new item: 
‘‘Sec. 318. Research and development strategy for critical infrastructure protec-
tion.’’. 
SEC. 9. REPORT ON REDUCING CYBERSECURITY RISKS IN 
DHS DATA CENTERS. 
Not later than one year after the date of the enactment 
of this Act, the Secretary of Homeland Security shall sub-
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
mit to the Committee on Homeland Security of the House 
of Representatives and the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate a report on 
the feasibility of the Department of Homeland Security cre-
ating an environment for the reduction in cybersecurity 
risks in Department data centers, including by increasing 
compartmentalization between systems, and providing a 
mix of security controls between such compartments. 
SEC. 10. ASSESSMENT. 
Not later than two years after the date of the enact-
ment of this Act, the Comptroller General of the United 
States shall submit to the Committee on Homeland Security 
of the House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the Senate 
a report that contains an assessment of the implementation 
by the Secretary of Homeland Security of this Act and the 
amendments made by this Act and, to the extent prac-
ticable, findings regarding increases in the sharing of cyber 
threat indicators, defensive measures, and information re-
lating to cybersecurity risks and incidents at the National 
Cybersecurity and Communications Integration Center and 
throughout the United States. 
SEC. 11. CONSULTATION. 
The Under Secretary for Cybersecurity and Infrastruc-
ture Protection shall produce a report on the feasibility of 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
creating a risk-informed prioritization plan should mul-
tiple critical infrastructures experience cyber incidents si-
multaneously. 
SEC. 12. TECHNICAL ASSISTANCE. 
The Inspector General of the Department of Homeland 
Security shall review the operations of the United States 
Computer Emergency Readiness Team (US-CERT) and the 
Industrial Control Systems Cyber Emergency Response 
Team (ICS-CERT) to assess the capacity to provide tech-
nical assistance to non-Federal entities and to adequately 
respond to potential increases in requests for technical as-
sistance. 
SEC. 13. PROHIBITION ON NEW REGULATORY AUTHORITY. 
Nothing in this Act or the amendments made by this 
Act may be construed to grant the Secretary of Homeland 
Security any authority to promulgate regulations or set 
standards relating to the cybersecurity of non-Federal enti-
ties, not including State, local, and tribal governments, that 
was not in effect on the day before the date of the enactment 
of this Act. 
SEC. 14. SUNSET. 
Any requirements for reports required by this Act or 
the amendments made by this Act shall terminate on the 
date that is seven years after the date of the enactment of 
this Act. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
SEC. 15. PROHIBITION ON NEW FUNDING. 
No funds are authorized to be appropriated to carry 
out this Act and the amendments made by this Act. This 
Act and such amendments shall be carried out using 
amounts appropriated or otherwise made available for such 
purposes. 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6203
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS
Union Calendar No. 61 
114TH CONGRESS 
1ST SESSION 
H. R. 1731 
[Report No. 114–83] 
A BILL 
To amend the Homeland Security Act of 2002 to 
enhance multi-directional sharing of information 
related to cybersecurity risks and strengthen pri-
vacy and civil liberties protections, and for other 
purposes. 
APRIL 17, 2015 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
22:31 Apr 17, 2015
Jkt 049200
PO 00000
Frm 00060
Fmt 6651
Sfmt 6651
E:\BILLS\H1731.RH
H1731
ebenthall on DSK5SPTVN1PROD with BILLS