HR 3138 RFS
‘‘(B) RECOMMENDATIONS
AND
REQUIRE-
MENTS.—The strategy required under subpara-
graph (A) shall— 
‘‘(i) provide recommendations relating 
to the ways in which the Federal Govern-
ment should support and promote the abil-
ity of State, local, Tribal, and territorial 
governments to identify, mitigate against, 
protect against, detect, respond to, and re-
cover from cybersecurity risks (as such 
term is defined in section 2209), cyberse-
curity threats, and incidents (as such term 
is defined in section 2209); and 
‘‘(ii) establish baseline requirements 
for cybersecurity plans under this section 
and principles with which such plans shall 
align. 
‘‘(2) CONTENTS.—The strategy required under 
paragraph (1) shall— 
‘‘(A) identify capability gaps in the ability 
of State, local, Tribal, and territorial govern-
ments to identify, protect against, detect, re-
spond to, and recover from cybersecurity risks, 
cybersecurity 
threats, 
incidents, 
and 
ransomware incidents; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(B) identify Federal resources and capa-
bilities that are available or could be made 
available to State, local, Tribal, and territorial 
governments to help those governments identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
incidents, and ransomware incidents; 
‘‘(C) identify and assess the limitations of 
Federal resources and capabilities available to 
State, local, Tribal, and territorial governments 
to help those governments identify, protect 
against, detect, respond to, and recover from 
cybersecurity risks, cybersecurity threats, inci-
dents, and ransomware incidents and make rec-
ommendations to address such limitations; 
‘‘(D) identify opportunities to improve the 
coordination of the Agency with Federal and 
non-Federal entities, such as the Multi-State 
Information Sharing and Analysis Center, to 
improve— 
‘‘(i) incident exercises, information 
sharing and incident notification proce-
dures; 
‘‘(ii) the ability for State, local, Trib-
al, and territorial governments to volun-
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
tarily adapt and implement guidance in 
Federal binding operational directives; and 
‘‘(iii) opportunities to leverage Federal 
schedules for cybersecurity investments 
under section 502 of title 40, United 
States Code; 
‘‘(E) recommend new initiatives the Fed-
eral Government should undertake to improve 
the ability of State, local, Tribal, and territorial 
governments to identify, protect against, detect, 
respond to, and recover from cybersecurity 
risks, cybersecurity threats, incidents, and 
ransomware incidents; 
‘‘(F) set short-term and long-term goals 
that will improve the ability of State, local, 
Tribal, and territorial governments to identify, 
protect against, detect, respond to, and recover 
from cybersecurity risks, cybersecurity threats, 
incidents, and ransomware incidents; and 
‘‘(G) set dates, including interim bench-
marks, as appropriate for State, local, Tribal, 
and territorial governments to establish baseline 
capabilities to identify, protect against, detect, 
respond to, and recover from cybersecurity 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
risks, cybersecurity threats, incidents, and 
ransomware incidents. 
‘‘(3) 
CONSIDERATIONS.—In 
developing 
the 
strategy required under paragraph (1), the Director, 
in coordination with the heads of appropriate Fed-
eral agencies, State, local, Tribal, and territorial 
governments, the State and Local Cybersecurity Re-
silience Committee established under section 2220A, 
and other stakeholders, as appropriate, shall con-
sider— 
‘‘(A) lessons learned from incidents that 
have affected State, local, Tribal, and territorial 
governments, and exercises with Federal and 
non-Federal entities; 
‘‘(B) the impact of incidents that have af-
fected State, local, Tribal, and territorial gov-
ernments, including the resulting costs to such 
governments; 
‘‘(C) the information related to the interest 
and ability of state and non-state threat actors 
to compromise information systems (as such 
term is defined in section 102 of the Cybersecu-
rity Act of 2015 (6 U.S.C. 1501)) owned or op-
erated by State, local, Tribal, and territorial 
governments; 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘(D) emerging cybersecurity risks and cy-
bersecurity threats to State, local, Tribal, and 
territorial governments resulting from the de-
ployment of new technologies; and 
‘‘(E) recommendations made by the State 
and Local Cybersecurity Resilience Committee 
established under section 2220A. 
‘‘(4) EXEMPTION.—Chapter 35 of title 44, 
United States Code (commonly known as the ‘Paper-
work Reduction Act’), shall not apply to any action 
to implement this subsection.’’. 
(b) RESPONSIBILITIES OF THE DIRECTOR OF THE 
CYBERSECURITY AND INFRASTRUCTURE SECURITY AGEN-
CY.—Section 2202 of the Homeland Security Act of 2002 
(6 U.S.C. 652) is amended— 
(1) by redesignating subsections (d) through (i) 
as subsections (e) through (j), respectively; and 
(2) by inserting after subsection (c) the fol-
lowing new subsection: 
‘‘(d) ADDITIONAL RESPONSIBILITIES.—In addition 
to the responsibilities under subsection (c), the Director 
shall— 
‘‘(1) develop program guidance, in consultation 
with the State and Local Government Cybersecurity 
Resilience Committee established under section 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
2220A, for the State and Local Cybersecurity Grant 
Program under such section or any other homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(2) review, in consultation with the State and 
Local Cybersecurity Resilience Committee, all cyber-
security plans of State, local, Tribal, and territorial 
governments developed pursuant to any homeland 
security assistance administered by the Department 
to improve cybersecurity; 
‘‘(3) provide expertise and technical assistance 
to State, local, Tribal, and territorial government of-
ficials with respect to cybersecurity; and 
‘‘(4) provide education, training, and capacity 
development to enhance the security and resilience 
of cybersecurity and infrastructure security.’’. 
(c) FEASIBILITY STUDY.—Not later than 270 days 
after the date of the enactment of this Act, the Director 
of the Cybersecurity and Infrastructure Security of the 
Department of Homeland Security shall conduct a study 
to assess the feasibility of implementing a short-term rota-
tional program for the detail to the Agency of approved 
State, local, Tribal, and territorial government employees 
in cyber workforce positions. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
SEC. 4. TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS. 
(a) TECHNICAL AMENDMENTS.— 
(1) HOMELAND SECURITY ACT OF 2002.—Sub-
title A of title XXII of the Homeland Security Act 
of 2002 (6 U.S.C. 651 et seq.) is amended— 
(A) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities relat-
ing to .gov internet domain), by amending the 
section enumerator and heading to read as fol-
lows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(B) in the second section 2215 (6 U.S.C. 
665b; relating to the joint cyber planning of-
fice), by amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(C) in the third section 2215 (6 U.S.C. 
665c; relating to the Cybersecurity State Coor-
dinator), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(D) in the fourth section 2215 (6 U.S.C. 
665d; relating to Sector Risk Management 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
Agencies), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(E) in section 2216 (6 U.S.C. 665e; relat-
ing to the Cybersecurity Advisory Committee), 
by amending the section enumerator and head-
ing to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(F) in section 2217 (6 U.S.C. 665f; relat-
ing to Cybersecurity Education and Training 
Programs), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(2) 
CONSOLIDATED
APPROPRIATIONS
ACT, 
2021.—Paragraph (1) of section 904(b) of division U 
of the Consolidated Appropriations Act, 2021 (Pub-
lic Law 116–260) is amended, in the matter pre-
ceding subparagraph (A), by inserting ‘‘of 2002’’ 
after ‘‘Homeland Security Act’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by striking the items relating to sections 2214 
through 2217 and inserting the following new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6211
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS
HR 3138 RFS
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs.’’. 
Passed the House of Representatives July 20, 2021. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
02:19 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H3138.RFS
H3138
kjohnson on DSK79L0C42PROD with BILLS