Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity and In-
frastructure Security Agency Act of 2017’’. 
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—The Homeland Security Act of 
2002 is amended by adding at the end the following new 
title: 
‘‘TITLE 
XXII—CYBERSECURITY 
AND INFRASTRUCTURE SECU-
RITY AGENCY 
‘‘Subtitle A—Cybersecurity and 
Infrastructure Security 
‘‘SEC. 2201. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the meaning given such term in section 2215. 
‘‘(2) CRITICAL
INFRASTRUCTURE
RISK.—The 
term ‘critical infrastructure risk’ means threats to 
and vulnerabilities of critical infrastructure and any 
related consequences, including consequences caused 
by or resulting from an act of terrorism. 
VerDate Sep 11 2014 
00:07 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RH
H3359
lotter on DSKBCFDHB2PROD with BILLS
‘‘(3) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
section 2209. 
‘‘(4) CYBERSECURITY THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given such term 
in paragraph (5) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(5) FEDERAL ENTITY.—The term ‘Federal en-
tity’ has the meaning given such term in paragraph 
(8) of section 102 of the Cybersecurity Act of 2015 
(contained in division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(6) NON-FEDERAL ENTITY.—The term ‘non- 
Federal entity’ has the meaning given such term in 
paragraph (14) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(7) SHARING.—The term ‘sharing’ has the 
meaning given such term in section 2209. 
VerDate Sep 11 2014 
00:07 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RH
H3359
lotter on DSKBCFDHB2PROD with BILLS
‘‘(8) NATIONAL
CYBERSECURITY
ASSET
RE-
SPONSE ACTIVITIES.—The term ‘national cybersecu-
rity asset response activities’ means— 
‘‘(A) furnishing technical assistance to en-
tities affected by cybersecurity risks to protect 
assets, mitigate vulnerabilities, and reduce im-
pacts of cyber incidents; 
‘‘(B) identifying other entities that may be 
at risk of an incident and assessing risk to the 
same or similar vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks 
to a sector or region, including potential cas-
cading effects, and developing courses of action 
to mitigate such risks; 
‘‘(D) facilitating information sharing and 
operational coordination with threat response; 
and 
‘‘(E) providing guidance on how best to 
utilize Federal resources and capabilities in a 
timely, effective manner to speed recovery from 
cybersecurity risks. 
‘‘SEC. 2202. CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AGENCY. 
‘‘(a) REDESIGNATION.— 
VerDate Sep 11 2014 
00:07 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RH
H3359
lotter on DSKBCFDHB2PROD with BILLS
‘‘(1) IN
GENERAL.—The National Protection 
and Programs Directorate of the Department shall, 
on and after the date of the enactment of this sub-
title, be known as the ‘Cybersecurity and Infrastruc-
ture Security Agency’ (in this subtitle referred to as 
the ‘Agency’). 
‘‘(2) REFERENCES.—Any reference to the Na-
tional Protection and Programs Directorate of the 
Department in any law, regulation, map, document, 
record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and 
Infrastructure Security Agency of the Department. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Agency shall be head-
ed by a Director of Cybersecurity and Infrastructure 
Security (in this subtitle referred to as the ‘Direc-
tor’), who shall report to the Secretary. 
‘‘(2) REFERENCE.—Any reference to an Under 
Secretary responsible for overseeing critical infra-
structure protection, cybersecurity, and any other re-
lated program of the Department as described in 
section 103(a)(1)(H) as in effect on the day before 
the date of the enactment of this subtitle in any law, 
regulation, map, document, record, or other paper of 
the United States shall be deemed to be a reference 
VerDate Sep 11 2014 
00:07 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RH
H3359
lotter on DSKBCFDHB2PROD with BILLS
to the Director of Cybersecurity and Infrastructure 
Security of the Department. 
‘‘(c) RESPONSIBILITIES.—The Director shall— 
‘‘(1) lead cybersecurity and critical infrastruc-
ture security programs, operations, and associated 
policy for the Agency, including national cybersecu-
rity asset response activities; 
‘‘(2) coordinate with Federal entities and non- 
Federal entities, including international entities, to 
carry out the cybersecurity and critical infrastruc-
ture activities of the Agency, as appropriate; 
‘‘(3) carry out the Secretary’s responsibilities to 
secure Federal information and information systems 
consistent with law, including subchapter II of chap-
ter 35 of title 44, United States Code, and the Cy-
bersecurity Act of 2015 (contained in division N of 
the Consolidated Appropriations Act, 2016 (Public 
Law 114–113)); 
‘‘(4) coordinate a national effort to secure and 
protect against critical infrastructure risks; 
‘‘(5) upon request provide analyses, expertise, 
and other technical assistance to critical infrastruc-
ture owners and operators and, where appropriate, 
provide such analyses, expertise, and other technical 
assistance in coordination with critical infrastructure 
VerDate Sep 11 2014 
00:07 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RH
H3359
lotter on DSKBCFDHB2PROD with BILLS