IIB 
114TH CONGRESS 
1ST SESSION H. R. 3869 
IN THE SENATE OF THE UNITED STATES 
DECEMBER 14, 2015 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to assist 
State and local coordination on cybersecurity with the 
national cybersecurity and communications integration 
center, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
22:18 Dec 14, 2015
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RFS
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
HR 3869 RFS 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber 
Protection Act of 2015’’. 
SEC. 2. STATE AND LOCAL COORDINATION ON CYBERSECU-
RITY WITH THE NATIONAL CYBERSECURITY 
AND COMMUNICATIONS INTEGRATION CEN-
TER. 
(a) IN GENERAL.—The second section 226 of the 
Homeland Security Act of 2002 (6 U.S.C. 148; relating 
to the national cybersecurity and communications integra-
tion center) is amended by adding at the end the following 
new subsection: 
‘‘(g) STATE AND LOCAL COORDINATION ON CYBER-
SECURITY.— 
‘‘(1) IN GENERAL.—The Center shall, to the ex-
tent practicable— 
‘‘(A) assist State and local governments, 
upon request, in identifying information system 
vulnerabilities; 
‘‘(B) assist State and local governments, 
upon request, in identifying information secu-
rity protections commensurate with cybersecu-
rity risks and the magnitude of the potential 
harm resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
VerDate Sep 11 2014 
22:18 Dec 14, 2015
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RFS
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
HR 3869 RFS 
‘‘(i) information collected or main-
tained by or on behalf of a State or local 
government; or 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
a State or local government or other orga-
nization on behalf of a State or local gov-
ernment; 
‘‘(C) in consultation with State and local 
governments, provide and periodically update 
via a web portal tools, products, resources, poli-
cies, guidelines, and procedures related to infor-
mation security; 
‘‘(D) work with senior State and local gov-
ernment officials, including State and local 
Chief Information Officers, through national as-
sociations to coordinate a nationwide effort to 
ensure effective implementation of tools, prod-
ucts, resources, policies, guidelines, and proce-
dures related to information security to secure 
and ensure the resiliency of State and local in-
formation systems; 
‘‘(E) provide, upon request, operational 
and technical cybersecurity training to State 
and local government and fusion center analysts 
VerDate Sep 11 2014 
22:18 Dec 14, 2015
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RFS
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
HR 3869 RFS 
and operators to address cybersecurity risks or 
incidents; 
‘‘(F) provide, in coordination with the 
Chief Privacy Officer and the Chief Civil Rights 
and Civil Liberties Officer of the Department, 
privacy and civil liberties training to State and 
local governments related to cybersecurity; 
‘‘(G) provide, upon request, operational 
and technical assistance to State and local gov-
ernments to implement tools, products, re-
sources, policies, guidelines, and procedures on 
information security by— 
‘‘(i) deploying technology to assist 
such State or local government to continu-
ously diagnose and mitigate against cyber 
threats and vulnerabilities, with or without 
reimbursement; 
‘‘(ii) compiling and analyzing data on 
State and local information security; and 
‘‘(iii) developing and conducting tar-
geted operational evaluations, including 
threat and vulnerability assessments, on 
the information systems of State and local 
governments; 
VerDate Sep 11 2014 
22:18 Dec 14, 2015
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RFS
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
HR 3869 RFS 
‘‘(H) assist State and local governments to 
develop policies and procedures for coordinating 
vulnerability disclosures, to the extent prac-
ticable, consistent with international and na-
tional standards in the information technology 
industry, including standards developed by the 
National Institute of Standards and Tech-
nology; and 
‘‘(I) ensure that State and local govern-
ments, as appropriate, are made aware of the 
tools, products, resources, policies, guidelines, 
and procedures on information security devel-
oped by the Department and other appropriate 
Federal departments and agencies for ensuring 
the security and resiliency of Federal civilian 
information systems. 
‘‘(2) TRAINING.—Privacy and civil liberties 
training provided pursuant to subparagraph (F) of 
paragraph (1) shall include processes, methods, and 
information that— 
‘‘(A) are consistent with the Department’s 
Fair Information Practice Principles developed 
pursuant to section 552a of title 5, United 
States Code (commonly referred to as the ‘Pri-
vacy Act of 1974’ or the ‘Privacy Act’); 
VerDate Sep 11 2014 
22:18 Dec 14, 2015
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RFS
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS