I 
113TH CONGRESS 
1ST SESSION H. R. 3696 
To amend the Homeland Security Act of 2002 to make certain improvements 
regarding cybersecurity and critical infrastructure protection, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 11, 2013 
Mr. MCCAUL (for himself, Mr. MEEHAN, Mr. THOMPSON of Mississippi, and 
Ms. CLARKE) introduced the following bill; which was referred to the 
Committee on Homeland Security, and in addition to the Committees on 
Science, Space, and Technology and Oversight and Government Reform, 
for a period to be subsequently determined by the Speaker, in each case 
for consideration of such provisions as fall within the jurisdiction of the 
committee concerned 
A BILL 
To amend the Homeland Security Act of 2002 to make 
certain improvements regarding cybersecurity and critical 
infrastructure protection, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘National Cybersecurity 
and Critical Infrastructure Protection Act of 2013’’. 
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
Sec. 1. Short title. 
Sec. 2. Table of contents. 
TITLE I—SECURING THE NATION AGAINST CYBER ATTACK 
Sec. 101. Homeland Security Act of 2002 definitions. 
Sec. 102. Enhancement of cybersecurity. 
Sec. 103. Protection of critical infrastructure and information sharing. 
Sec. 104. National Cybersecurity and Communications Integration Center. 
Sec. 105. Cyber incident response and technical assistance. 
Sec. 106. Assessment of cybersecurity workforce. 
Sec. 107. Personnel authorities. 
Sec. 108. Streamlining of Department cybersecurity organization. 
TITLE II—PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY 
Sec. 201. Public-private collaboration on cybersecurity. 
Sec. 202. SAFETY Act and qualifying cyber incidents. 
Sec. 203. Prohibition on new regulatory authority. 
Sec. 204. Prohibition on additional authorization of appropriations. 
TITLE I—SECURING THE NATION 
AGAINST CYBER ATTACK 
SEC. 101. HOMELAND SECURITY ACT OF 2002 DEFINITIONS. 
Section 2 of the Homeland Security Act of 2002 (6 
U.S.C. 101) is amended by adding at the end the following 
new paragraphs: 
‘‘(19) The term ‘critical infrastructure’ has the 
meaning given that term in section 1016(e) of the 
USA Patriot Act (42 U.S.C. 5195c(e)). 
‘‘(20) The term ‘critical infrastructure owner’ 
means a person that owns critical infrastructure. 
‘‘(21) The term ‘critical infrastructure operator’ 
means a critical infrastructure owner or other per-
son that manages, runs, or operates, in whole or in 
part, the day-to-day operations of critical infrastruc-
ture. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(22) The term ‘cyber incident’ means an inci-
dent resulting in, or an attempt to cause an incident 
that, if successful, would— 
‘‘(A) jeopardize or imminently jeopardize, 
without lawful authority, the security, integrity, 
confidentiality, or availability of an information 
system or network of information systems or 
any information stored on, processed on, or 
transiting such a system; 
‘‘(B) constitute a violation or imminent 
threat of violation of law, security policies, secu-
rity procedures, or acceptable use policies re-
lated to an information system or network of 
information systems, or an act of terrorism 
against an information system or network of in-
formation systems; or 
‘‘(C) result in the denial of access to or 
degradation, disruption, or destruction of an in-
formation system or network of information 
systems, or the defeat of an operations control 
or technical control essential to the security or 
operation of an information system or network 
of information systems. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(23) The term ‘cybersecurity provider’ means 
a non-Federal entity that provides goods or services 
intended to be used for cybersecurity purposes. 
‘‘(24) The term ‘cybersecurity purpose’ means 
the purpose of ensuring the security, integrity, con-
fidentiality, or availability of, or safeguarding, an in-
formation system or network of information systems, 
including protecting an information system or net-
work of information systems, or data residing on an 
information system or network of information sys-
tems, including protection of an information system 
or network of information systems, from— 
‘‘(A) a vulnerability of an information sys-
tem or network of information systems; 
‘‘(B) a threat to the security, integrity, 
confidentiality, or availability of an information 
system or network of information systems, or 
any information stored on, processed on, or 
transiting such a system or network; 
‘‘(C) efforts to deny access to or degrade, 
disrupt, or destroy an information system or 
network of information systems; or 
‘‘(D) efforts to gain unauthorized access to 
an information system or network of informa-
tion systems, including to gain such unauthor-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
ized access for the purpose of exfiltrating infor-
mation stored on, processed on, or transiting 
such a system or network. 
‘‘(25) The term ‘cybersecurity system’ means a 
system designed or employed to ensure the security, 
integrity, confidentiality, or availability of, or safe-
guard, an information system or network of informa-
tion systems, including protecting such a system or 
network from— 
‘‘(A) a vulnerability of an information sys-
tem or network of information systems; 
‘‘(B) a threat to the security, integrity, 
confidentiality, or availability of an information 
system or network of information systems or 
any information stored on, processed on, or 
transiting such a system or network; 
‘‘(C) efforts to deny access to or degrade, 
disrupt, or destroy an information system or 
network of information systems of a private en-
tity; or 
‘‘(D) efforts to gain unauthorized access to 
an information system or network of informa-
tion systems, including to gain such unauthor-
ized access for the purpose of exfiltrating infor-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
mation stored on, processed on, or transiting 
such a system or network. 
‘‘(26) The term ‘cyber threat’ means any action 
that 
may 
result 
in 
unauthorized 
access 
to, 
exfiltration of, manipulation of, harm of, or impair-
ment to the security, integrity, confidentiality, or 
availability of an information system or network of 
information systems, or information that is stored 
on, processed by, or transiting an information sys-
tem or network of information systems. 
‘‘(27) The term ‘cyber threat information’ 
means information directly pertaining to— 
‘‘(A) a vulnerability of an information sys-
tem or network of information systems of a 
government or private entity; 
‘‘(B) a threat to the security, integrity, 
confidentiality, or availability of an information 
system or network of information systems of a 
government or private entity or any information 
stored on, processed on, or transiting such a 
system or network; 
‘‘(C) efforts to deny access to or degrade, 
disrupt, or destroy an information system or 
network of information systems of a govern-
ment or private entity; 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(D) efforts to gain unauthorized access to 
an information system or network of informa-
tion systems of a government or private entity, 
including to gain such unauthorized access for 
the purpose of exfiltrating information stored 
on, processed on, or transiting such a system or 
network; or 
‘‘(E) an act of terrorism against an infor-
mation system or network of information sys-
tems. 
‘‘(28) The term ‘Federal civilian information 
systems’— 
‘‘(A) means information, information sys-
tems, and networks of information systems that 
are owned, operated, controlled, or licensed for 
use by, or on behalf of, any Federal agency, in-
cluding information systems or networks of in-
formation systems used or operated by another 
entity on behalf of a Federal agency; but 
‘‘(B) does not include— 
‘‘(i) a national security system; or 
‘‘(ii) information, information sys-
tems, and networks of information systems 
that are owned, operated, controlled, or li-
censed solely for use by, or on behalf of, 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
the Department of Defense, a military de-
partment, or an element of the intelligence 
community. 
‘‘(29) The term ‘information security’ means 
the protection of information, information systems, 
and networks of information systems from unauthor-
ized access, use, disclosure, disruption, modification, 
or destruction in order to provide— 
‘‘(A) integrity, including guarding against 
improper information modification or destruc-
tion, including ensuring nonrepudiation and au-
thenticity; 
‘‘(B) confidentiality, including preserving 
authorized restrictions on access and disclosure, 
including means for protecting personal privacy 
and proprietary information; and 
‘‘(C) availability, including ensuring timely 
and reliable access to and use of information. 
‘‘(30) The term ‘information system’ means the 
underlying framework and functions used to process, 
transmit, receive, or store information electronically, 
including programmable electronic devices, commu-
nications networks, and industrial or supervisory 
control systems and any associated hardware, soft-
ware, or data. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(31) The term ‘private entity’ means any indi-
vidual or any private or publically-traded company, 
public or private utility, organization, or corporation, 
including an officer, employee, or agent thereof. 
‘‘(32) The term ‘protected private entity’ means 
an entity, other than an individual, that enters into 
a contract with a cybersecurity provider for goods 
and services to be used for cybersecurity purposes. 
‘‘(33) The term ‘shared situational awareness’ 
means an environment in which cyber threat infor-
mation is shared in real time between all designated 
Federal cyber operations centers to provide action-
able information about all known cyber threats.’’. 
SEC. 102. ENHANCEMENT OF CYBERSECURITY. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 is amended by adding at the 
end the following new section: 
‘‘SEC. 226. ENHANCEMENT OF CYBERSECURITY. 
‘‘The Secretary, in collaboration with the heads of 
other appropriate Federal Government entities, shall con-
duct activities for cybersecurity purposes, including the 
provision of shared situational awareness to each other to 
enable real-time, integrated, and operational actions to 
protect from, prevent, mitigate, respond to, and recover 
from cyber incidents.’’. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
(b) CLERICAL AMENDMENTS.— 
(1) SUBTITLE HEADING.—The heading for sub-
title C of title II of such Act is amended to read as 
follows: 
‘‘Subtitle C—Cybersecurity and 
Information Sharing’’. 
(2) TABLE OF CONTENTS.—The table of con-
tents in section 1(b) of such Act is amended— 
(A) by adding after the item relating to 
section 225 the following new item: 
‘‘Sec. 226. Enhancement of cybersecurity.’’; 
and 
(B) by striking the item relating to subtitle 
C of title II and inserting the following new 
item: 
‘‘Subtitle C—Cybersecurity and Information Sharing’’. 
SEC. 103. PROTECTION OF CRITICAL INFRASTRUCTURE 
AND INFORMATION SHARING. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by section 102, 
is further amended by adding at the end the following new 
section: 
‘‘SEC. 227. PROTECTION OF CRITICAL INFRASTRUCTURE 
AND INFORMATION SHARING. 
‘‘(a) PROTECTION OF CRITICAL INFRASTRUCTURE.— 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(1) IN GENERAL.—The Secretary shall coordi-
nate, on an ongoing basis, with Federal, State, and 
local governments, critical infrastructure owners, 
critical infrastructure operators, and other cross sec-
tor coordinating entities to— 
‘‘(A) 
facilitate 
a 
national 
effort 
to 
strengthen and maintain secure, functioning, 
and resilient critical infrastructure from cyber 
threats; 
‘‘(B) ensure that Department policies and 
procedures enable critical infrastructure owners 
and critical infrastructure operators to receive 
real-time, actionable, and relevant cyber threat 
information; 
‘‘(C) seek industry sector-specific expertise 
to— 
‘‘(i) assist in the development of vol-
untary security and resiliency strategies; 
and 
‘‘(ii) ensure that the allocation of Fed-
eral resources are cost effective and reduce 
any burden on critical infrastructure own-
ers and critical infrastructure operators; 
‘‘(D) upon request, facilitate and assist 
risk management efforts of entities to reduce 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
vulnerabilities, identify and disrupt threats, and 
minimize consequences to their critical infra-
structure; 
‘‘(E) upon request, provide education and 
assistance to critical infrastructure owners and 
critical infrastructure operators on how they 
may use protective measures and counter-
measures to strengthen the security and resil-
ience of the Nation’s critical infrastructure; and 
‘‘(F) coordinate a research and develop-
ment strategy to facilitate and promote ad-
vancements and innovation in cybersecurity 
technologies to protect critical infrastructure. 
‘‘(2) 
ADDITIONAL
RESPONSIBILITIES.—The 
Secretary shall— 
‘‘(A) manage Federal efforts to secure, 
protect, and ensure the resiliency of Federal ci-
vilian information systems, and, upon request, 
support critical infrastructure owners’ and crit-
ical infrastructure operators’ efforts to secure, 
protect, and ensure the resiliency of critical in-
frastructure from cyber threats; 
‘‘(B) direct an entity within the Depart-
ment to serve as a Federal civilian entity by 
and among Federal, State, and local govern-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
ments, private entities, and critical infrastruc-
ture sectors to provide multi-directional sharing 
of real-time, actionable, and relevant cyber 
threat information; 
‘‘(C) promote a national awareness effort 
to educate the general public on the importance 
of securing information systems; 
‘‘(D) upon request, facilitate expeditious 
cyber incident response and recovery assistance, 
and provide analysis and warnings related to 
threats to and vulnerabilities of critical infor-
mation systems, crisis and consequence man-
agement support, and other remote or on-site 
technical assistance with the heads of other ap-
propriate Federal agencies to Federal, State, 
and local government entities and private enti-
ties for cyber incidents affecting critical infra-
structure; and 
‘‘(E) engage with international partners to 
strengthen the security and resilience of domes-
tic critical infrastructure and critical infrastruc-
ture located outside of the United States upon 
which the United States depends. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
this section may be construed to require any private 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
entity to request assistance from the Secretary, or 
require any private entity requesting such assistance 
to implement any measure or recommendation sug-
gested by the Secretary. 
‘‘(b) CRITICAL INFRASTRUCTURE SECTORS.—The 
Secretary, in collaboration with the heads of other appro-
priate Federal agencies, shall designate critical infrastruc-
ture sectors (that may include subdivisions of sectors with-
in a sector as the Secretary may determine appropriate). 
The critical infrastructure sectors designated under this 
subsection may include the following: 
‘‘(1) Chemical. 
‘‘(2) Commercial facilities. 
‘‘(3) Communications. 
‘‘(4) Critical manufacturing. 
‘‘(5) Dams. 
‘‘(6) Defense Industrial Base. 
‘‘(7) Emergency services. 
‘‘(8) Energy. 
‘‘(9) Financial services. 
‘‘(10) Food and agriculture. 
‘‘(11) Government facilities. 
‘‘(12) Healthcare and public health. 
‘‘(13) Information technology. 
‘‘(14) Nuclear reactors, materials, and waste. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(3) ROLES AND RESPONSIBILITIES.—The Sec-
tor Coordinating Council for a critical infrastructure 
sector shall— 
‘‘(A) serve as a self-governing, self-orga-
nized primary policy, planning, and strategic 
communications entity for coordinating with the 
Department, the relevant Sector-Specific Agen-
cy designated under subsection (c), and the rel-
evant Information Sharing and Analysis Cen-
ters under subsection (e) on security and resil-
ience activities and emergency response and re-
covery efforts; 
‘‘(B) establish governance and operating 
procedures, and designate a chairperson for the 
sector to carry out the activities described in 
this subsection; 
‘‘(C) coordinate with the Department, the 
relevant Information Sharing and Analysis Cen-
ters under subsection (e), and other Sector Co-
ordinating Councils to update, maintain, and 
exercise the National Cybersecurity Incident 
Response Plan in accordance with section 
229(b); and 
‘‘(D) provide any recommendations to the 
Department on infrastructure protection tech-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
nology gaps to help inform research and devel-
opment efforts at the Department. 
‘‘(e) SECTOR INFORMATION SHARING AND ANALYSIS 
CENTERS.— 
‘‘(1) RECOGNITION.—The Secretary, in collabo-
ration with the relevant Sector Coordinating Council 
and the critical infrastructure sector represented by 
such Council, and in coordination with the relevant 
Sector Specific Agency, shall recognize at least one 
Information Sharing and Analysis Center for each 
critical infrastructure sector designated under sub-
section (b) for purposes of paragraph (3). No other 
Information Sharing and Analysis Organizations, in-
cluding Information Sharing and Analysis Centers, 
may be precluded from having an information shar-
ing relationship within the National Cybersecurity 
and Communications Integration Center established 
pursuant to section 228. Nothing in this subsection 
or any other provision of this subtitle may be con-
strued to limit, restrict, or condition any private en-
tity or activity utilized by, among, or between pri-
vate entities. 
‘‘(2) ROLES AND RESPONSIBILITIES.—In addi-
tion to such other activities as may be authorized by 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
law, at least one Information Sharing and Analysis 
Center for a critical infrastructure sector shall— 
‘‘(A) serve as an information sharing re-
source for such sector and promote ongoing 
multi-directional sharing of real-time, relevant, 
and actionable cyber threat information and 
analysis by and among such sector, the Depart-
ment, the relevant Sector Specific Agency, and 
other critical infrastructure sector Information 
Sharing and Analysis Centers; 
‘‘(B) establish governance and operating 
procedures to carry out the activities conducted 
under this subsection; 
‘‘(C) serve as an emergency response and 
recovery operations coordination point for such 
sector, and upon request, facilitate cyber inci-
dent response capabilities in coordination with 
the Department, the relevant Sector Specific 
Agency and the relevant Sector Coordinating 
Council; 
‘‘(D) facilitate cross-sector coordination 
and sharing of cyber threat information to pre-
vent related or consequential impacts to other 
critical infrastructure sectors; 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(E) coordinate with the Department, the 
relevant Sector Coordinating Council, the rel-
evant Sector Specific Agency, and other critical 
infrastructure sector Information Sharing and 
Analysis Centers on the development, integra-
tion, and implementation of procedures to sup-
port technology neutral, real-time information 
sharing capabilities and mechanisms within the 
National Cybersecurity and Communications 
Integration Center established pursuant to sec-
tion 228, including— 
‘‘(i) the establishment of a mechanism 
to voluntarily report identified vulnerabili-
ties and opportunities for improvement; 
‘‘(ii) the establishment of metrics to 
assess the effectiveness and timeliness of 
the Department’s and Information Sharing 
and Analysis Centers’ information sharing 
capabilities; and 
‘‘(iii) the establishment of a mecha-
nism for anonymous suggestions and com-
ments; 
‘‘(F) implement an integration and anal-
ysis function to inform sector planning, risk 
mitigation, and operational activities regarding 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
the protection of each critical infrastructure 
sector from cyber incidents; 
‘‘(G) combine consequence, vulnerability, 
and threat information to share actionable as-
sessments of critical infrastructure sector risks 
from cyber incidents; 
‘‘(H) coordinate with the Department, the 
relevant Sector Specific Agency, and the rel-
evant Sector Coordinating Council to update, 
maintain, and exercise the National Cybersecu-
rity Incident Response Plan in accordance with 
section 229(b); and 
‘‘(I) safeguard cyber threat information 
from unauthorized disclosure. 
‘‘(3) FUNDING.—Of the amounts authorized to 
be appropriated for each of fiscal years 2014, 2015, 
and 2016 for the Cybersecurity and Communications 
Office of the Department, the Secretary is author-
ized to use not less than $25,000,000 for any such 
year for operations support at the National Cyberse-
curity and Communications Integration Center es-
tablished under section 228(a) of all recognized In-
formation Sharing and Analysis Centers under para-
graph (1) of this subsection. 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(f) CLEARANCES.—The Secretary shall expedite the 
processing of security clearances under Executive Order 
13549 or successor orders to appropriate members of the 
Sector Coordinating Councils and the critical infrastruc-
ture sector Information Sharing and Analysis Centers. 
‘‘(g) PUBLIC-PRIVATE COLLABORATION.—The Sec-
retary, in collaboration with the critical infrastructure sec-
tors designated under subsection (b), such sectors’ Sector 
Specific Agencies recognized under subsection (c), and the 
Sector Coordinating Councils recognized under subsection 
(d), shall— 
‘‘(1) conduct an analysis and review of the ex-
isting public-private partnership model and evaluate 
how the model between the Department and critical 
infrastructure owners and critical infrastructure op-
erators can be improved to ensure the Department, 
critical infrastructure owners, and critical infrastruc-
ture operators are equal partners and regularly col-
laborate on all programs and activities of the De-
partment to protect critical infrastructure; 
‘‘(2) develop procedures to ensure continuous, 
collaborative, and effective interactions between the 
Department, critical infrastructure owners, and crit-
ical infrastructure operators; and 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(3) ensure critical infrastructure sectors have 
a reasonable period for review and comment of all 
jointly produced materials with the Department. 
‘‘(h) PROTECTION OF FEDERAL CIVILIAN INFORMA-
TION SYSTEMS.— 
‘‘(1) IN GENERAL.—The Secretary shall admin-
ister the operational information security activities 
and functions to protect and ensure the resiliency of 
all Federal civilian information systems. 
‘‘(2) ROLES AND RESPONSIBILITIES.—The Sec-
retary, in coordination with the heads of other Fed-
eral civilian agencies, shall— 
‘‘(A) develop, issue, and oversee the imple-
mentation and compliance of all operational in-
formation security policies and procedures to 
protect and ensure the resiliency of Federal ci-
vilian information systems; 
‘‘(B) administer Federal Government-wide 
efforts to develop and provide adequate, risk- 
based, cost-effective, and technology neutral in-
formation security capabilities; 
‘‘(C) establish and sustain continuous 
diagnostics systems for Federal civilian infor-
mation systems to aggregate data and identify 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
and prioritize the mitigation of cyber vulnerabil-
ities in such systems for cybersecurity purposes; 
‘‘(D) develop, acquire, and operate an inte-
grated and consolidated system of intrusion de-
tection, analytics, intrusion prevention, and 
other information sharing and protective capa-
bilities to defend Federal civilian information 
systems from cyber threats; 
‘‘(E) develop and conduct targeted risk as-
sessments and operational evaluations of Fed-
eral civilian information systems, in consulta-
tion with government and private entities that 
own and operate such information systems, in-
cluding threat, vulnerability, and impact assess-
ments and penetration testing; 
‘‘(F) develop and provide technical assist-
ance and cyber incident response capabilities to 
secure and ensure the resilience of Federal civil-
ian information systems; 
‘‘(G) review annually the operational infor-
mation security activities and functions of each 
of the Federal civilian agencies; 
‘‘(H) develop minimum technology neutral 
operational requirements for network and secu-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
rity operations centers to facilitate the protec-
tion of all Federal civilian information systems; 
‘‘(I) develop reporting requirements, con-
sistent with relevant law, to ensure the National 
Cybersecurity and Communications Integration 
Center established pursuant to section 228 re-
ceives all actionable cyber threat information 
identified on Federal civilian information sys-
tems; 
‘‘(J) develop technology neutral perform-
ance requirements and metrics for the security 
of Federal civilian information systems; 
‘‘(K) implement training requirements that 
include industry recognized certifications to en-
sure that Federal civilian agencies are able to 
fully and timely comply with policies and proce-
dures issued by the Secretary under this sub-
section; and 
‘‘(L) develop training requirements regard-
ing privacy, civil rights, civil liberties, and infor-
mation oversight for information security em-
ployees who operate Federal civilian informa-
tion systems. 
‘‘(3) USE OF CERTAIN COMMUNICATIONS.— 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(A) IN
GENERAL.—The Secretary may 
enter into contracts or other agreements, or 
otherwise request and obtain, in accordance 
with applicable law, the assistance of private 
entities that provide electronic communication 
services, remote computing services, or cyberse-
curity services to acquire, intercept, retain, use, 
and disclose communications and other system 
traffic, deploy countermeasures, or otherwise 
operate protective capabilities in accordance 
with subparagraphs (C), (D), (E), and (F) of 
paragraph (2). No cause of action shall exist 
against private entities for assistance provided 
to the Secretary in accordance with this sub-
section. 
‘‘(B) RULE OF CONSTRUCTION.—Nothing 
in subparagraph (A) may be construed to— 
‘‘(i) require or compel any private en-
tity to enter in a contract or agreement de-
scribed in such subparagraph; or 
‘‘(ii) authorize the Secretary to take 
any action with respect to any communica-
tions or system traffic transiting or resid-
ing on any information system or network 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
of information systems other than a Fed-
eral civilian information system. 
‘‘(i) RULE OF CONSTRUCTION.—No provision of this 
title may be construed as modifying, limiting, or otherwise 
affecting the authority of any other Federal agency under 
any other provision of law.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by adding at the 
end of the items relating to such subtitle the following new 
item: 
‘‘Sec. 227. Protection of critical infrastructure and information sharing.’’. 
SEC. 104. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 102 
and 103, is further amended by adding at the end the 
following new section: 
‘‘SEC. 228. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
‘‘(a) ESTABLISHMENT.—There is established in the 
Department the National Cybersecurity and Communica-
tions Integration Center (referred to in this section as the 
‘Center’), which shall be a Federal civilian information 
sharing interface that provides shared situational aware-
ness to enable real-time, integrated, and operational ac-
tions across the Federal Government, and share cyber 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
threat information by and among Federal, State, and local 
government entities, Information Sharing and Analysis 
Centers, private entities, and critical infrastructure owners 
and critical infrastructure operators that have an informa-
tion sharing relationship with the Center. 
‘‘(b) COMPOSITION.—The Center shall include each 
of the following entities: 
‘‘(1) At least one Information Sharing and 
Analysis Center established under section 227(e) for 
each critical infrastructure sector. 
‘‘(2) The Multi-State Information Sharing and 
Analysis Center to collaborate with State and local 
governments. 
‘‘(3) The United States Computer Emergency 
Readiness Team to coordinate cyber threat informa-
tion sharing, proactively manage cyber risks to the 
United States, collaboratively respond to cyber inci-
dents, provide technical assistance to information 
system owners and operators, and disseminate time-
ly notifications regarding current and potential cyber 
threats and vulnerabilities. 
‘‘(4) The Industrial Control System Cyber 
Emergency Response Team to coordinate with in-
dustrial control systems owners and operators and 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
share industrial control systems-related security inci-
dents and mitigation measures. 
‘‘(5) The National Coordinating Center for 
Telecommunications to coordinate the protection, re-
sponse, and recovery of national security emergency 
communications. 
‘‘(6) Such other Federal, State, and local gov-
ernment entities, private entities, organizations, or 
individuals as the Secretary may consider appro-
priate that agree to be included. 
‘‘(c) CYBER INCIDENT.—In the event of a cyber inci-
dent, the Secretary may grant the entities referred to in 
subsection (a) immediate temporary access to the Center 
as a situation may warrant. 
‘‘(d) ROLES AND RESPONSIBILITIES.—The Center 
shall— 
‘‘(1) promote ongoing multi-directional sharing 
by and among the entities referred to in subsection 
(a) of timely and actionable cyber threat information 
and analysis on a real-time basis that includes 
emerging trends, evolving threats, incident reports, 
intelligence information, risk assessments, and best 
practices; 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(2) coordinate with other Federal agencies to 
streamline and reduce redundant reporting of cyber 
threat information; 
‘‘(3) provide, upon request, timely technical as-
sistance and crisis management support to Federal, 
State, and local government entities and private en-
tities that own or operate information systems or 
networks of information systems to protect from, 
prevent, mitigate, respond to, and recover from 
cyber incidents; 
‘‘(4) facilitate cross-sector coordination and 
sharing of cyber threat information to prevent re-
lated or consequential impacts to other critical infra-
structure sectors; 
‘‘(5) collaborate with the Sector Coordinating 
Councils, Information Sharing and Analysis Centers, 
Sector Specific Agencies, and the relevant critical in-
frastructure sectors on the development and imple-
mentation of procedures to support technology neu-
tral real-time information sharing capabilities and 
mechanisms; 
‘‘(6) collaborate with the Sector Coordinating 
Councils, Information Sharing and Analysis Centers, 
Sector Specific Agencies, and the relevant critical in-
frastructure sectors to identify requirements for data 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
and information formats and accessibility, system 
interoperability, and redundant systems and alter-
native capabilities in the event of a disruption in the 
primary information sharing capabilities and mecha-
nisms at the Center; 
‘‘(7) within the scope of relevant treaties, co-
operate with international partners to share infor-
mation and respond to cyber incidents; 
‘‘(8) safeguard sensitive cyber threat informa-
tion from unauthorized disclosure; 
‘‘(9) require other Federal civilian agencies to— 
‘‘(A) send reports and information to the 
Center about cyber incidents, threats, and 
vulnerabilities affecting Federal civilian infor-
mation systems and critical infrastructure sys-
tems and, in the event a private vendor product 
or service of such an agency is so implicated, 
the Center shall first notify such private vendor 
of the vulnerability before further disclosing 
such information; 
‘‘(B) provide to the Center cyber incident 
detection, analysis, mitigation, and response in-
formation; and 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(C) immediately send and disclose to the 
Center cyber threat information received by 
such agencies; and 
‘‘(10) perform such other duties as the Sec-
retary may require to facilitate a national effort to 
strengthen and maintain secure, functioning, and re-
silient critical infrastructure from cyber threats. 
‘‘(e) INTEGRATION
AND
ANALYSIS.—The Center 
shall maintain an integration and analysis function, which 
shall — 
‘‘(1) integrate and analyze all cyber threat in-
formation received from other Federal agencies, 
State and local governments, Information Sharing 
and Analysis Centers, private entities, critical infra-
structure owners, and critical infrastructure opera-
tors, and share relevant information in near real- 
time; 
‘‘(2) on an ongoing basis, assess and evaluate 
consequence, vulnerability, and threat information to 
share with the entities referred to in subsection (a) 
actionable assessments of critical infrastructure sec-
tor risks from cyber incidents and to assist critical 
infrastructure owners and critical infrastructure op-
erators by making recommendations to facilitate 
continuous improvements to the security and resil-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
iency of the critical infrastructure of the United 
States; 
‘‘(3) facilitate cross-sector integration, identi-
fication, and analysis of key interdependencies to 
prevent related or consequential impacts to other 
critical infrastructure sectors; and 
‘‘(4) collaborate with the Information Sharing 
and Analysis Centers to tailor the analysis of infor-
mation to the specific characteristics and risk to a 
relevant critical infrastructure sector. 
‘‘(f) REPORT OF CYBER ATTACKS AGAINST FEDERAL 
GOVERNMENT NETWORKS.—The Secretary shall submit 
to the Committee on Homeland Security of the House of 
Representatives, the Committee on Homeland Security 
and Governmental Affairs of the Senate, and the Comp-
troller General of the United States an annual report that 
summarizes major cyber incidents involving Federal civil-
ian agency information systems and provides aggregate 
statistics on the number of breaches, the volume of data 
exfiltrated, the consequential impact, and the estimated 
cost of remedying such breaches. 
‘‘(g) REPORT ON THE OPERATIONS OF THE CEN-
TER.—The Secretary, in consultation with the Sector Co-
ordinating Councils and appropriate Federal Government 
entities, shall submit to the Committee on Homeland Se-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
curity of the House of Representatives, the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate, and the Comptroller General of the United States an 
annual report on— 
‘‘(1) the capability and capacity of the Center 
to carry out its cybersecurity mission in accordance 
with this section, and sections 226, 227, 229, 230, 
230A, and 230B; 
‘‘(2) the extent to which the Department is en-
gaged in information sharing with each critical in-
frastructure sector designated under section 227(b), 
including— 
‘‘(A) the extent to which each such sector 
has representatives at the Center; and 
‘‘(B) the extent to which critical infra-
structure owners and critical infrastructure op-
erators of each critical infrastructure sector 
participate in information sharing at the Cen-
ter; 
‘‘(3) the volume and range of activities with re-
spect to which the Secretary collaborated with the 
Sector Coordinating Councils and the Sector-Specific 
Agencies to promote greater engagement with the 
Center; and 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(4) the volume and range of voluntary tech-
nical assistance sought and provided by the Depart-
ment to each critical infrastructure owner and crit-
ical infrastructure operator.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act, as amended by section 103, 
is further amended by adding at the end the following new 
item: 
‘‘228. National Cybersecurity and Communications Integration Center.’’. 
(c) GAO REPORT.—Not later than one year after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall submit to the Committee on 
Homeland Security of the House of Representatives and 
the Committee on Homeland Security and Governmental 
Affairs of the Senate a report on the effectiveness of the 
National Cybersecurity and Communications Integration 
Center established under section 228 of the Homeland Se-
curity Act of 2002, as added by subsection (a) of this sec-
tion, in carrying out its cybersecurity mission in accord-
ance with this Act and such section 228 and sections 226, 
227, 229, 230, 230A, and 230B of the Homeland Security 
Act of 2002, as added by this Act. 
SEC. 105. CYBER INCIDENT RESPONSE AND TECHNICAL AS-
SISTANCE. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 102, 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
103, and 104, is further amended by adding at the end 
the following new section: 
‘‘SEC. 229. CYBER INCIDENT RESPONSE AND TECHNICAL 
ASSISTANCE. 
‘‘(a) IN GENERAL.—The Secretary shall establish 
Cyber Incident Response Teams to— 
‘‘(1) upon request, provide timely technical as-
sistance and crisis management support to Federal, 
State, and local government entities, private entities, 
and critical infrastructure owners and critical infra-
structure operators involving cyber incidents affect-
ing critical infrastructure; and 
‘‘(2) upon request, provide actionable rec-
ommendations on security and resilience measures 
and countermeasures to Federal, State, and local 
government entities, private entities, and critical in-
frastructure owners and critical infrastructure oper-
ators prior to, during, and after cyber incidents. 
‘‘(b) COORDINATION.—In carrying out subsection 
(a), the Secretary shall coordinate with the relevant Sector 
Specific Agencies, if applicable. 
‘‘(c) CYBER INCIDENT RESPONSE PLAN.—The Sec-
retary, in coordination with the Sector Coordinating Coun-
cils, Information Sharing and Analysis Centers, and Fed-
eral, State, and local governments, shall develop, regularly 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
update, maintain, and exercise a National Cybersecurity 
Incident Response Plan which shall— 
‘‘(1) include effective emergency response plans 
associated with cyber threats to critical infrastruc-
ture, information systems, or networks of informa-
tion systems; and 
‘‘(2) ensure that such National Cybersecurity 
Incident Response Plan can adapt to and reflect a 
changing cyber threat environment, and incorporate 
best practices and lessons learned from regular exer-
cises, training, and after-action reports.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act, as amended by sections 103 
and 104, is further amended by adding at the end the 
following new item: 
‘‘229. Cyber incident response and technical assistance.’’. 
SEC. 106. ASSESSMENT OF CYBERSECURITY WORKFORCE. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 101, 
103, 104, and 105, is further amended by adding at the 
end the following new section: 
‘‘SEC. 230. ASSESSMENT OF CYBERSECURITY WORKFORCE. 
‘‘(a) ASSESSMENT.—The Secretary, in consultation 
with relevant private entities, shall regularly assess the 
readiness and capacity of the workforce of the Department 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
to meet the needs of the cybersecurity mission of the De-
partment. 
‘‘(b) STRATEGY REQUIRED.—Not later than 180 
days after the date of the enactment of this section, the 
Secretary shall develop, maintain, and, as necessary, up-
date, a comprehensive workforce strategy designed to en-
hance the readiness, capacity, training, recruitment, and 
retention of the cybersecurity personnel of the Depart-
ment. Such strategy shall include a five-year plan on re-
cruitment of personnel for the workforce of the Depart-
ment, and ten-year projections of the workforce needs of 
the Department. The Secretary shall submit such strategy 
to the Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Security 
and Governmental Affairs of the Senate.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act, as amended by sections 103, 
104, and 105, is further amended by adding at the end 
the following new item: 
‘‘230. Assessment of cybersecurity workforce.’’. 
SEC. 107. PERSONNEL AUTHORITIES. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 101, 
102, 103, 104, 105, and 106, is further amended by add-
ing at the end the following new section: 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘SEC. 230A. PERSONNEL AUTHORITIES. 
‘‘(a) IN GENERAL.— 
‘‘(1) PERSONNEL
AUTHORITIES.—The Sec-
retary may exercise with respect to qualified employ-
ees of the Department the same authority that the 
Secretary of Defense has with respect to civilian in-
telligence personnel and the scholarship program 
under sections 1601, 1602, 1603, and 2200a of title 
10, United States Code, to establish as positions in 
the excepted service, appoint individuals to such po-
sitions, fix pay, and pay a retention bonus to any 
employee appointed under this section if the Sec-
retary determines that such is needed to retain es-
sential personnel. Before announcing the payment of 
a bonus under this paragraph, the Secretary shall 
submit to the Committee on Homeland Security of 
the House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the 
Senate a written explanation of such determination. 
Such authority shall be exercised— 
‘‘(A) to the same extent and subject to the 
same conditions and limitations that the Sec-
retary of Defense may exercise such authority 
with respect to civilian intelligence personnel of 
the Department of Defense; and 
VerDate Mar 15 2010 
03:18 Dec 14, 2013
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
‘‘(B) in a manner consistent with the merit 
system principles set forth in section 2301 of 
title 5, United States Code. 
‘‘(2) CIVIL
SERVICE
PROTECTIONS.—Sections 
1221 and 2302, and chapter 75 of title 5, United 
States Code, shall apply to the positions established 
pursuant to the authorities provided under para-
graph (1). 
‘‘(3) PLAN
FOR
EXECUTION
OF
AUTHORI-
TIES.—Not later than 120 days after the date of the 
enactment of this section, the Secretary shall submit 
to the Committee on Homeland Security of the 
House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the 
Senate a report that contains a plan for the use of 
the authorities provided under this subsection. 
‘‘(b) ANNUAL REPORT.—Not later than one year 
after the date of the enactment of this section and annu-
ally thereafter for four years, the Secretary shall submit 
to the Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Security 
and Governmental Affairs of the Senate a detailed report 
(including appropriate metrics on actions occurring during 
the reporting period) that discusses the processes used by 
the Secretary in implementing this section and accepting 
VerDate Mar 15 2010 
03:18 Dec 14, 2013
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
applications, assessing candidates, ensuring adherence to 
veterans’ preference, and selecting applicants for vacancies 
to be filled by a qualified employee. 
‘‘(c) DEFINITION
OF QUALIFIED EMPLOYEE.—In 
this section, the term ‘qualified employee’ means an em-
ployee who performs functions relating to the security of 
Federal civilian information systems, critical infrastruc-
ture information systems, or networks of either of such 
systems.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act, as amended by sections 103, 
104, 105, and 106, is further amended by adding at the 
end the following new item: 
‘‘230A. Personnel authorities.’’. 
SEC. 108. STREAMLINING OF DEPARTMENT CYBERSECURI-
TY ORGANIZATION. 
(a) CYBERSECURITY
AND INFRASTRUCTURE PRO-
TECTION DIRECTORATE.—The National Protection and 
Programs Directorate of the Department of Homeland Se-
curity shall, after the date of the enactment of this Act, 
be known and designated as the ‘‘Cybersecurity and Infra-
structure Protection Directorate’’. Any reference to the 
National Protection and Programs Directorate of the De-
partment in any law, regulation, map, document, record, 
or other paper of the United States shall be deemed to 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
be a reference to the Cybersecurity and Infrastructure 
Protection Directorate of the Department. 
(b) SENIOR LEADERSHIP OF THE CYBERSECURITY 
AND INFRASTRUCTURE PROTECTION DIRECTORATE.— 
(1) IN
GENERAL.—Subsection (a) of section 
103 of the Homeland Security Act of 2002 (6 
U.S.C. 113) is amended by adding at the end the 
following new subparagraphs: 
‘‘(K) Under Secretary for Cybersecurity 
and Infrastructure Protection. 
‘‘(L) Deputy Under Secretary for Cyberse-
curity. 
‘‘(M) Deputy Under Secretary for Infra-
structure Protection.’’. 
(2) CONTINUATION
IN
OFFICE.—The individ-
uals who hold the positions referred to in subpara-
graphs (K), (L), and (M) of subsection (a) of section 
103 of the Homeland Security Act of 2002 (as 
added by paragraph (1) of this subsection) as of the 
date of the enactment of this Act may continue to 
hold such positions. 
(c) REPORT ON IMPROVING THE CAPABILITY AND 
EFFECTIVENESS OF THE CYBERSECURITY AND COMMU-
NICATIONS OFFICE.—To improve the operational capa-
bility and effectiveness in carrying out the cybersecurity 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
mission of the Department of Homeland Security, the Sec-
retary of Homeland Security shall submit to the Com-
mittee on Homeland Security of the House of Representa-
tives and the Committee on Homeland Security and Gov-
ernmental Affairs of the Senate a report on— 
(1) the feasibility of making the Cybersecurity 
and Communications Office of the Department an 
operational component of the Department; 
(2) recommendations for restructuring the 
SAFETY Act Office within the Department to ele-
vate the profile and mission of the Office, including 
the feasibility of utilizing third-party registrars for 
improving the throughput and effectiveness of the 
certification process. 
(d) REPORT ON CYBERSECURITY ACQUISITION CAPA-
BILITIES.—The Secretary of Homeland Security shall as-
sess the effectiveness of the Department of Homeland Se-
curity’s acquisition processes and the use of existing au-
thorities for acquiring cybersecurity technologies to ensure 
that such processes and authorities are capable of meeting 
the needs and demands of the Department’s cybersecurity 
mission. Not later than 180 days after the date of the 
enactment of this Act, the Secretary shall submit to the 
Committee on Homeland Security of the House of Rep-
resentatives and the Committee on Homeland Security 
VerDate Mar 15 2010 
03:18 Dec 14, 2013
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
and Governmental Affairs of the Senate a report on the 
effectiveness of the Department’s acquisition processes for 
cybersecurity technologies. 
TITLE II—PUBLIC-PRIVATE COL-
LABORATION ON CYBERSECU-
RITY 
SEC. 201. PUBLIC-PRIVATE COLLABORATION ON CYBERSE-
CURITY. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 102, 
103, 104, 105, 106, and 107, is further amended by add-
ing at the end the following new section: 
‘‘SEC. 230B. PUBLIC-PRIVATE COLLABORATION ON CYBER-
SECURITY. 
‘‘(a) NATIONAL INSTITUTE
OF STANDARDS
AND 
TECHNOLOGY.—The Director of the National Institute of 
Standards and Technology, in collaboration with the Sec-
retary, shall, on an ongoing basis, facilitate and support 
the development of a voluntary, industry-led set of stand-
ards, guidelines, best practices, methodologies, procedures, 
and processes to reduce cyber risks to critical infrastruc-
ture. The Director, in collaboration with the Secretary— 
‘‘(1) shall— 
‘‘(A) coordinate closely and continuously 
with relevant private entities, critical infrastruc-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
ture owners and critical infrastructure opera-
tors, Sector Coordinating Councils, Information 
Sharing and Analysis Centers, and other rel-
evant industry organizations, and incorporate 
industry expertise to the fullest extent possible; 
‘‘(B) consult with the Sector Specific 
Agencies, Federal, State and local governments, 
the governments of other countries, and inter-
national organizations; 
‘‘(C) utilize a prioritized, flexible, repeat-
able, performance-based, and cost-effective ap-
proach, including information security measures 
and controls, that may be voluntarily adopted 
by critical infrastructure owners and critical in-
frastructure operators to help them identify, as-
sess, and manage cyber risks; 
‘‘(D) include methodologies to— 
‘‘(i) identify and mitigate impacts of 
the cybersecurity measures or controls on 
business confidentiality; and 
‘‘(ii) protect individual privacy and 
civil liberties; 
‘‘(E) 
incorporate 
voluntary 
consensus 
standards and industry best practices, and align 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
with voluntary international standards to the 
fullest extent possible; 
‘‘(F) prevent duplication of existing regu-
latory processes and prevent conflict with or su-
perseding of existing regulatory requirements 
and processes; and 
‘‘(G) include such other similar and con-
sistent elements as determined necessary; and 
‘‘(2) shall not prescribe or otherwise require— 
‘‘(A) the use of specific solutions; 
‘‘(B) the use of specific information tech-
nology products or services; or 
‘‘(C) that information technology products 
or services be designed, developed, or manufac-
tured in a particular manner. 
‘‘(b) MEETINGS.—The Secretary shall meet with the 
Sector Coordinating Council for each critical infrastruc-
ture sector designated under section 227(b) on a biannual 
basis to discuss the cybersecurity threat to critical infra-
structure, voluntary activities to address cybersecurity, 
and ideas to improve the public-private partnership to en-
hance cybersecurity, in which the Secretary shall— 
‘‘(1) provide each Sector Coordinating Council 
an assessment of the cybersecurity threat to each 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
critical infrastructure sector designated under sec-
tion 227(b), including information relating to— 
‘‘(A) any actual or assessed cyber threat, 
including a consideration of adversary capability 
and intent, preparedness, target attractiveness, 
and deterrence capabilities; 
‘‘(B) the extent and likelihood of death, in-
jury, or serious adverse effects to human health 
and safety caused by an act of terrorism or 
other disruption, destruction, or unauthorized 
use of critical infrastructure; 
‘‘(C) the threat to national security caused 
by an act of terrorism or other disruption, de-
struction, or unauthorized use of critical infra-
structure; and 
‘‘(D) the harm to the economy that would 
result from an act of terrorism or other disrup-
tion, destruction, or unauthorized use of critical 
infrastructure; and 
‘‘(2) provide recommendations, which may be 
voluntarily adopted, on ways to improve cybersecuri-
ty of critical infrastructure. 
‘‘(c) REPORT.— 
‘‘(1) IN GENERAL.—Starting 30 days after the 
end of the fiscal year in which the National Cyberse-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
curity and Critical Infrastructure Protection Act of 
2013 is enacted and annually thereafter, the Sec-
retary shall submit to the Committee on Homeland 
Security of the House of Representatives and the 
Committee on Homeland Security and Governmental 
Affairs of the Senate a report on the state of cyber-
security for each critical infrastructure sector des-
ignated under section 227(b) based on discussions 
between the Department and the Sector Coordi-
nating Council in accordance with subsection (b) of 
this section. The Secretary shall maintain a public 
copy of each report, and each report may include a 
non-public annex for proprietary or business-sen-
sitive information. Each report shall include, at a 
minimum information relating to— 
‘‘(A) the risk to each critical infrastructure 
sector, including known cyber threats, vulnera-
bilities, and potential consequences; 
‘‘(B) the extent and nature of any cyberse-
curity incidents during the previous year, in-
cluding the extent to which cyber incidents 
jeopardized or imminently jeopardized informa-
tion systems; 
‘‘(C) the current status of the voluntary, 
industry-led set of standards, guidelines, best 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
practices, methodologies, procedures, and proc-
esses to reduce cyber risks within each critical 
infrastructure sector; and 
‘‘(D) the volume and range of voluntary 
technical assistance sought and provided by the 
Department to each critical infrastructure sec-
tor. 
‘‘(2) SECTOR
COORDINATING
COUNCIL
RE-
SPONSE.—Before making public and submitting 
each report required under paragraph (1), the Sec-
retary shall provide a draft of each report to the 
Sector Coordinating Council for the critical infra-
structure sector covered by each such report. The 
Sector Coordinating Council at issue may provide to 
the Secretary a written response to such report with-
in 45 days of receiving the draft. If such Sector Co-
ordinating Council provides a written response, the 
Secretary shall include such written response in the 
final version of each report required under para-
graph (1). 
‘‘(d) LIMITATION.—Information shared with or pro-
vided to the Director of the National Institute of Stand-
ards and Technology or the Secretary for the purpose of 
the activities under subsections (a) and (b) shall not be 
used by any Federal, State, or local government depart-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
ment or agency to regulate the activity of any private enti-
ty.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act, as amended by sections 102, 
103, 104, 105, 106, and 107 is further amended by adding 
at the end the following new item: 
‘‘Sec. 230B. Public-private collaboration on cybersecurity.’’. 
SEC. 202. SAFETY ACT AND QUALIFYING CYBER INCIDENTS. 
(a) IN GENERAL.—The Support Anti-Terrorism By 
Fostering Effective Technologies Act of 2002 (6 U.S.C. 
441 et seq.) is amended— 
(1) in section 862(b) (6 U.S.C. 441(b))— 
(A) in the heading, by striking ‘‘DESIGNA-
TION OF QUALIFIED ANTI-TERRORISM TECH-
NOLOGIES’’ and inserting ‘‘DESIGNATION
OF 
ANTI-TERRORISM AND CYBERSECURITY TECH-
NOLOGIES’’; 
(B) in the matter preceding paragraph (1), 
by inserting ‘‘and cybersecurity’’ after ‘‘anti- 
terrorism’’; 
(C) in paragraphs (3), (4), and (5), by in-
serting ‘‘or cybersecurity’’ after ‘‘anti-ter-
rorism’’ each place it appears; and 
(D) in paragraph (7)— 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
(i) by inserting ‘‘or cybersecurity tech-
nology’’ after ‘‘Anti-terrorism technology’’; 
and 
(ii) by inserting ‘‘or qualifying cyber 
incidents’’ after ‘‘acts of terrorism’’; 
(2) in section 863 (6 U.S.C. 442)— 
(A) by inserting ‘‘or cybersecurity’’ after 
‘‘anti-terrorism’’ each place it appears; 
(B) by inserting ‘‘or qualifying cyber inci-
dent’’ after ‘‘act of terrorism’’ each place it ap-
pears; and 
(C) by inserting ‘‘or qualifying cyber inci-
dents’’ after ‘‘acts of terrorism’’ each place it 
appears; 
(3) in section 864 (6 U.S.C. 443)— 
(A) by inserting ‘‘or cybersecurity’’ after 
‘‘anti-terrorism’’ each place it appears; and 
(B) by inserting ‘‘or qualifying cyber inci-
dent’’ after ‘‘act of terrorism’’ each place it ap-
pears; and 
(4) in section 865 (6 U.S.C. 444)— 
(A) in paragraph (1)— 
(i) in the heading, by inserting ‘‘OR 
CYBERSECURITY’’ 
after 
‘‘ANTI-TER-
RORISM’’; 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
(ii) by inserting ‘‘or cybersecurity’’ 
after ‘‘anti-terrorism’’; and 
(iii) by inserting ‘‘or qualifying cyber 
incident’’ after ‘‘acts of terrorism’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(7) QUALIFYING CYBER INCIDENT.— 
‘‘(A) IN GENERAL.—The term ‘qualifying 
cyber incident’ means any act that the Sec-
retary determines meets the requirements under 
subparagraph (B), as such requirements are 
further defined and specified by the Secretary. 
‘‘(B) REQUIREMENTS.—A qualifying cyber 
incident meets the requirements of this sub-
paragraph if the incident— 
‘‘(i) is unlawful or otherwise exceeds 
authorized access authority; 
‘‘(ii) disrupts or imminently jeopard-
izes the integrity, operation, confiden-
tiality, or availability of programmable 
electronic 
devices, 
communication 
net-
works, including hardware, software and 
data that are essential to their reliable op-
eration, electronic storage devices, or any 
other information system, or the informa-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
tion that system controls, processes, stores, 
or transmits; 
‘‘(iii) gains access to an information 
system or a network of information sys-
tems resulting in— 
‘‘(I) misappropriation or theft of 
data, assets, information, or intellec-
tual property; 
‘‘(II) corruption of data, assets, 
information, or intellectual property; 
‘‘(III) operational disruption; or 
‘‘(IV) an adverse effect on such 
system or network, or the data, as-
sets, information, or intellectual prop-
erty contained therein; and 
‘‘(iv) causes harm inside or outside 
the United States that results in material 
levels of damage, disruption, or casualties 
severely affecting the United States popu-
lation, infrastructure, economy, national 
morale, or Federal, State, local, or tribal 
government functions.’’. 
(b) FUNDING.—Of the amounts authorized to be ap-
propriated for each of fiscal years 2014, 2015, and 2016 
for the Science and Technology Directorate of the Depart-
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS
ment of Homeland Security, the Secretary of Homeland 
Security is authorized to use not less than $20,000,000 
for any such year for the Department’s SAFETY Act Of-
fice. 
SEC. 203. PROHIBITION ON NEW REGULATORY AUTHORITY. 
This Act and the amendments made by this Act do 
not— 
(1) create or authorize the issuance of any new 
regulations or additional Federal Government regu-
latory authority; or 
(2) permit regulatory actions that would dupli-
cate, conflict with, or supercede existing regulatory 
requirements, mandatory standards, or related proc-
esses. 
SEC. 204. PROHIBITION ON ADDITIONAL AUTHORIZATION 
OF APPROPRIATIONS. 
No additional funds are authorized to be appro-
priated to carry out this Act and the amendments made 
by this Act. This Act and such amendments shall be car-
ried out using amounts otherwise available for such pur-
poses. 
Æ 
VerDate Mar 15 2010 
01:41 Dec 13, 2013
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6301
E:\BILLS\H3696.IH
H3696
pwalker on DSK7TPTVN1PROD with BILLS