I 
112TH CONGRESS 
1ST SESSION 
H. R. 174 
To enhance homeland security, including domestic preparedness and collective 
response to terrorism, by amending the Homeland Security Act of 2002 
to establish the Cybersecurity Compliance Division and provide authori-
ties to the Department of Homeland Security to enhance the security 
and resiliency of the Nation’s cyber and physical infrastructure against 
terrorism and other cyber attacks, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 5, 2011 
Mr. THOMPSON of Mississippi introduced the following bill; which was referred 
to the Committee on Homeland Security, and in addition to the Com-
mittee on Oversight and Government Reform, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such 
provisions as fall within the jurisdiction of the committee concerned 
A BILL 
To enhance homeland security, including domestic prepared-
ness and collective response to terrorism, by amending 
the Homeland Security Act of 2002 to establish the 
Cybersecurity Compliance Division and provide authori-
ties to the Department of Homeland Security to enhance 
the security and resiliency of the Nation’s cyber and 
physical infrastructure against terrorism and other cyber 
attacks, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Homeland Security 
Cyber and Physical Infrastructure Protection Act of 
2011’’. 
SEC. 2. OFFICE OF CYBERSECURITY AND COMMUNICA-
TIONS AND CYBERSECURITY COMPLIANCE 
DIVISION. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by redesignating sections 221 through 225 in order as 
section 226 through 229, respectively, and by inserting be-
fore section 222 (as so redesignated) the following: 
‘‘SEC. 221. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) COMMON
CRITERIA
FOR
INFORMATION 
TECHNOLOGY
SECURITY
EVALUATION.—The term 
‘common criteria for information technology security 
evaluation’ means international standard for com-
puter security codified in the International Organi-
zation for Standardization and the International 
Electrotechnical Commission standard 15408 (ISO/ 
IEC 15408). 
‘‘(2) COVERED CRITICAL INFRASTRUCTURE.— 
The term ‘covered critical infrastructure’ means sys-
tems and assets designated by the Director under 
section 224(e). 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
retary for Cybersecurity and Communications shall 
be the head of the Office. 
‘‘(3) COMPONENTS.—The Office shall include— 
‘‘(A) the United States Computer Emer-
gency Readiness Team, as in effect on the date 
of enactment of this section; 
‘‘(B) the Cybersecurity Compliance Divi-
sion established by subsection (b); and 
‘‘(C) other components of the Department 
that have primary responsibilities for emergency 
or national communications or cybersecurity. 
‘‘(b) CYBERSECURITY COMPLIANCE DIVISION.— 
‘‘(1) IN GENERAL.—There is established in the 
Office of Cybersecurity and Communications a Cy-
bersecurity Compliance Division. 
‘‘(2) DIRECTOR.—The Cybersecurity Compli-
ance Division shall be headed by a Director, who 
shall be appointed by the Secretary or the Sec-
retary’s designee from among individuals who pos-
sess— 
‘‘(A) demonstrated knowledge and ability 
in cybersecurity, information technology, infra-
structure protection, and the operation, secu-
rity, and resilience of communications networks; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(B) significant executive leadership, regu-
latory, and management experience in the pub-
lic or private sector; and 
‘‘(C) other skills or attributes the Sec-
retary considers necessary. 
‘‘(3) DUTIES AND RESPONSIBILITIES.—The Di-
rector— 
‘‘(A) shall issue risk-based, performance- 
based regulations, after notice and comment, in 
accordance with section 224; 
‘‘(B) shall serve as the first-party regu-
latory agency to enforce regulations under sec-
tion 224 for computer networks and assets in 
critical infrastructure sectors for which the Of-
fice of Cybersecurity and Communications or 
any of its components is the designated sector- 
specific agency; 
‘‘(C) may require a first-party regulatory 
agency or sector-specific agency to coordinate 
with the Director to— 
‘‘(i) develop and publish, for covered 
critical infrastructure sectors or subsec-
tors, risk-based and performance-based 
regulations after notice and comment in 
accordance with paragraph (1), with any 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
appropriate modifications, as identified by 
the Director, necessary for application to a 
specific critical infrastructure sector or 
subsector; and 
‘‘(ii) enforce the regulations promul-
gated under paragraph (1); and 
‘‘(D) may delegate part or all of the re-
sponsibilities and authorities for securing pri-
vate sector networks under this section to an 
appropriate first-party regulatory agency or sec-
tor-specific agency, which shall report to the Di-
rector all activities it carries out pursuant to 
such delegation. 
‘‘(4) RESOURCES.—There is authorized to be 
appropriated such sums as may be necessary for the 
operations of the Cybersecurity Compliance Division 
for each of fiscal years 2012, 2013, and 2014. 
‘‘SEC. 223. DEPARTMENT RESPONSIBILITIES AND AUTHORI-
TIES FOR SECURING FEDERAL GOVERNMENT 
NETWORKS. 
‘‘(a) IN GENERAL.—The Secretary, acting through 
the Assistant Secretary for Cybersecurity and Commu-
nications or the Director of the Cybersecurity Compliance 
Division pursuant to subparagraphs (B), (C), and (D) of 
subsection (b)(2), shall establish and enforce cybersecurity 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
requirements for civilian nonmilitary and nonintelligence 
community Federal systems to prevent, deter, prepare for, 
detect, report, attribute, mitigate, respond to, and recover 
from cyber attacks and other cyber incidents. 
‘‘(b) INTERAGENCY WORKING GROUP.— 
‘‘(1) IN GENERAL.—The Assistant Secretary for 
Cybersecurity and Communications shall establish 
and chair an interagency working group that shall 
include, at a minimum, representation of all chief in-
formation officers from all Federal civilian agencies, 
the Director of the Cybersecurity Compliance divi-
sion, the Assistant Secretary for Infrastructure Pro-
tection, and the White House Cybersecurity Coordi-
nator. The Assistant Secretary shall invite the Sec-
retary of Defense, the Director of the National Secu-
rity Agency, and the Director of National Intel-
ligence to participate as nonvoting representatives 
for purposes of advising the interagency working 
group. 
‘‘(2) FUNCTIONS.—The interagency working 
group shall— 
‘‘(A) meet at the call of the Chair; 
‘‘(B) develop and adopt risk-based, per-
formance-based cybersecurity requirements for 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
civilian Federal agency computer networks and 
federally owned critical infrastructure; 
‘‘(C) develop and adopt a range of rem-
edies, including penalties, for noncompliance of 
the requirements adopted under paragraph (2), 
each agency having one vote; 
‘‘(D) develop recommended budgets for se-
curity of the civilian nonmilitary and non-intel-
ligence community Federal agency computer 
networks; and 
‘‘(E) propose updates, as necessary, for the 
Common Criteria for Information Technology 
Security Evaluation as part of a supply chain 
risk management strategy designed to ensure 
the security and resilience of the Federal infor-
mation 
infrastructure, 
including 
protection 
against unauthorized access to, alteration of in-
formation in, disruption of operations of, inter-
ruption of communications or services of, and 
insertion of malicious software, engineering 
vulnerabilities, or otherwise corrupting soft-
ware, hardware, services, or products intended 
for use in Federal information infrastructure. 
‘‘(3) ADOPTION BY VOTE.—Adoption of require-
ments and remedies under subparagraphs (B) and 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS