I 
114TH CONGRESS 
1ST SESSION H. R. 3869 
To amend the Homeland Security Act of 2002 to require State and local 
coordination on cybersecurity with the national cybersecurity and commu-
nications integration center, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 2, 2015 
Mr. HURD of Texas (for himself and Mr. RATCLIFFE) introduced the following 
bill; which was referred to the Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to require 
State and local coordination on cybersecurity with the 
national cybersecurity and communications integration 
center, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber 
Protection Act of 2015’’. 
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 2. STATE AND LOCAL COORDINATION ON CYBERSECU-
RITY WITH THE NATIONAL CYBERSECURITY 
AND COMMUNICATIONS INTEGRATION CEN-
TER. 
(a) IN GENERAL.—The second section 226 of the 
Homeland Security Act of 2002 (6 U.S.C. 148; relating 
to the national cybersecurity and communications integra-
tion center) is amended by adding at the end the following 
new subsection: 
‘‘(g) STATE AND LOCAL COORDINATION ON CYBER-
SECURITY.— 
‘‘(1) IN GENERAL.—The Center shall, to the ex-
tent practicable— 
‘‘(A) assist State and local governments, 
upon request, in identifying information system 
vulnerabilities; 
‘‘(B) assist State and local governments, 
upon request, in identifying information secu-
rity protections commensurate with cybersecu-
rity risks and the magnitude of the potential 
harm resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
‘‘(i) information collected or main-
tained by or on behalf of a State or local 
government; or 
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
a State or local government or other orga-
nization on behalf of a State or local gov-
ernment; 
‘‘(C) in consultation with State and local 
governments, provide and periodically update 
via a web portal tools, products, resources, poli-
cies, guidelines, and procedures related to infor-
mation security; 
‘‘(D) work with senior State and local gov-
ernment officials, including State and local 
Chief Information Officers, through national as-
sociations to coordinate a nationwide effort to 
ensure effective implementation of tools, prod-
ucts, resources, policies, guidelines, and proce-
dures related to information security to secure 
and ensure the resiliency of State and local in-
formation systems; 
‘‘(E) provide, upon request, operational 
and technical cybersecurity training to State 
and local government and fusion center analysts 
and operators to address cybersecurity risks or 
incidents; 
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(F) provide, in coordination with the 
Chief Privacy Officer and the Chief Civil Rights 
and Civil Liberties Officer of the Department, 
privacy and civil liberties training to State and 
local governments related to cybersecurity; 
‘‘(G) provide, upon request, operational 
and technical assistance to State and local gov-
ernments to implement tools, products, re-
sources, policies, guidelines, and procedures on 
information security by— 
‘‘(i) deploying technology to assist 
such State or local government to continu-
ously diagnose and mitigate against cyber 
threats and vulnerabilities, with or without 
reimbursement; 
‘‘(ii) compiling and analyzing data on 
State and local information security; and 
‘‘(iii) developing and conducting tar-
geted operational evaluations, including 
threat and vulnerability assessments, on 
the information systems of State and local 
governments; 
‘‘(H) assist State and local governments to 
develop policies and procedures for coordinating 
vulnerability disclosures, to the extent prac-
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS
ticable, consistent with international and na-
tional standards in the information technology 
industry, including standards developed by the 
National Institute of Standards and Tech-
nology; and 
‘‘(I) ensure that State and local govern-
ments, as appropriate, are made aware of the 
tools, products, resources, policies, guidelines, 
and procedures on information security devel-
oped by the Department and other appropriate 
Federal departments and agencies for ensuring 
the security and resiliency of Federal civilian 
information systems. 
‘‘(2) TRAINING.—Privacy and civil liberties 
training provided pursuant to subparagraph (F) of 
paragraph (1) shall include processes, methods, and 
information that— 
‘‘(A) are consistent with the Department’s 
Fair Information Practice Principles developed 
pursuant to section 552a of title 5, United 
States Code (commonly referred to as the ‘Pri-
vacy Act of 1974’ or the ‘Privacy Act’); 
‘‘(B) reasonably limit, to the greatest ex-
tent practicable, the receipt, retention, use, and 
disclosure of information related to cybersecu-
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS
rity risks and incidents associated with specific 
persons that is not necessary, for cybersecurity 
purposes, to protect an information system or 
network of information systems from cybersecu-
rity risks or to mitigate cybersecurity risks and 
incidents in a timely manner; 
‘‘(C) minimize any impact on privacy and 
civil liberties; 
‘‘(D) provide data integrity through the 
prompt removal and destruction of obsolete or 
erroneous names and personal information that 
is unrelated to the cybersecurity risk or incident 
information shared and retained by the Center 
in accordance with this section; 
‘‘(E) include requirements to safeguard 
cyber threat indicators and defensive measures 
retained by the Center, including information 
that is proprietary or business-sensitive that 
may be used to identify specific persons from 
unauthorized access or acquisition; 
‘‘(F) protect the confidentiality of cyber 
threat indicators and defensive measures associ-
ated with specific persons to the greatest extent 
practicable; and 
VerDate Sep 11 2014 
02:06 Nov 03, 2015
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.IH
H3869
SSpencer on DSK4SPTVN1PROD with BILLS