In the Senate of the United States, 
October 3 (legislative day, September 28), 2018. 
Resolved, That the bill from the House of Representa-
tives (H.R. 3359) entitled ‘‘An Act to amend the Homeland 
Security Act of 2002 to authorize the Cybersecurity and In-
frastructure Security Agency of the Department of Homeland 
Security, and for other purposes.’’, do pass with the following 
AMENDMENT: 
Strike out all after the enacting clause and insert: 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity and Infra-
structure Security Agency Act of 2018’’. 
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—The Homeland Security Act of 
2002 (6 U.S.C. 101 et seq.) is amended by adding at the 
end the following:
† HR 3359 EAS 
‘‘TITLE 
XXII—CYBERSECURITY 
AND INFRASTRUCTURE SECU-
RITY AGENCY 
‘‘Subtitle A—Cybersecurity and 
Infrastructure Security 
‘‘SEC. 2201. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) 
CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the meaning given the term in section 2222. 
‘‘(2) CYBERSECURITY RISK.—The term ‘cyberse-
curity risk’ has the meaning given the term in section 
2209. 
‘‘(3) CYBERSECURITY
THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given the term in 
section 102(5) of the Cybersecurity Act of 2015 (con-
tained in division N of the Consolidated Appropria-
tions Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(4) NATIONAL
CYBERSECURITY
ASSET
RE-
SPONSE ACTIVITIES.—The term ‘national cybersecu-
rity asset response activities’ means— 
‘‘(A) furnishing cybersecurity technical as-
sistance to entities affected by cybersecurity risks
† HR 3359 EAS 
to protect assets, mitigate vulnerabilities, and re-
duce impacts of cyber incidents; 
‘‘(B) identifying other entities that may be 
at risk of an incident and assessing risk to the 
same or similar vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks 
to a sector or region, including potential cas-
cading effects, and developing courses of action to 
mitigate such risks; 
‘‘(D) facilitating information sharing and 
operational coordination with threat response; 
and 
‘‘(E) providing guidance on how best to uti-
lize Federal resources and capabilities in a time-
ly, effective manner to speed recovery from cyber-
security risks. 
‘‘(5) SECTOR-SPECIFIC AGENCY.—The term ‘Sec-
tor-Specific Agency’ means a Federal department or 
agency, designated by law or presidential directive, 
with responsibility for providing institutional knowl-
edge and specialized expertise of a sector, as well as 
leading, facilitating, or supporting programs and as-
sociated activities of its designated critical infrastruc-
ture sector in the all hazards environment in coordi-
nation with the Department.
† HR 3359 EAS 
‘‘(6) SHARING.—The term ‘sharing’ has the 
meaning given the term in section 2209. 
‘‘SEC. 2202. CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AGENCY. 
‘‘(a) REDESIGNATION.— 
‘‘(1) IN GENERAL.—The National Protection and 
Programs Directorate of the Department shall, on and 
after the date of the enactment of this subtitle, be 
known as the ‘Cybersecurity and Infrastructure Secu-
rity Agency’ (in this subtitle referred to as the ‘Agen-
cy’). 
‘‘(2) REFERENCES.—Any reference to the Na-
tional Protection and Programs Directorate of the De-
partment in any law, regulation, map, document, 
record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and In-
frastructure Security Agency of the Department. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Agency shall be headed 
by a Director of Cybersecurity and Infrastructure Se-
curity (in this subtitle referred to as the ‘Director’), 
who shall report to the Secretary. 
‘‘(2) REFERENCE.—Any reference to an Under 
Secretary responsible for overseeing critical infra-
structure protection, cybersecurity, and any other re-
† HR 3359 EAS 
lated program of the Department as described in sec-
tion 103(a)(1)(H) as in effect on the day before the 
date of enactment of this subtitle in any law, regula-
tion, map, document, record, or other paper of the 
United States shall be deemed to be a reference to the 
Director of Cybersecurity and Infrastructure Security 
of the Department. 
‘‘(c) RESPONSIBILITIES.—The Director shall— 
‘‘(1) lead cybersecurity and critical infrastruc-
ture security programs, operations, and associated 
policy for the Agency, including national cybersecu-
rity asset response activities; 
‘‘(2) coordinate with Federal entities, including 
Sector-Specific Agencies, and non-Federal entities, in-
cluding international entities, to carry out the cyber-
security and critical infrastructure activities of the 
Agency, as appropriate; 
‘‘(3) carry out the responsibilities of the Sec-
retary to secure Federal information and information 
systems consistent with law, including subchapter II 
of chapter 35 of title 44, United States Code, and the 
Cybersecurity Act of 2015 (contained in division N of 
the Consolidated Appropriations Act, 2016 (Public 
Law 114–113));
† HR 3359 EAS 
‘‘(4) coordinate a national effort to secure and 
protect against critical infrastructure risks, consistent 
with subsection (e)(1)(E); 
‘‘(5) upon request, provide analyses, expertise, 
and other technical assistance to critical infrastruc-
ture owners and operators and, where appropriate, 
provide those analyses, expertise, and other technical 
assistance in coordination with Sector-Specific Agen-
cies and other Federal departments and agencies; 
‘‘(6) develop and utilize mechanisms for active 
and frequent collaboration between the Agency and 
Sector-Specific Agencies to ensure appropriate coordi-
nation, situational awareness, and communications 
with Sector-Specific Agencies; 
‘‘(7) maintain and utilize mechanisms for the 
regular and ongoing consultation and collaboration 
among the Divisions of the Agency to further oper-
ational coordination, integrated situational aware-
ness, and improved integration across the Agency in 
accordance with this Act; 
‘‘(8) develop, coordinate, and implement— 
‘‘(A) comprehensive strategic plans for the 
activities of the Agency; and 
‘‘(B) risk assessments by and for the Agen-
cy;
† HR 3359 EAS 
‘‘(9) carry out emergency communications re-
sponsibilities, in accordance with title XVIII; 
‘‘(10) carry out cybersecurity, infrastructure se-
curity, and emergency communications stakeholder 
outreach and engagement and coordinate that out-
reach and engagement with critical infrastructure 
Sector-Specific Agencies, as appropriate; and 
‘‘(11) carry out such other duties and powers 
prescribed by law or delegated by the Secretary. 
‘‘(d) DEPUTY DIRECTOR.—There shall be in the Agen-
cy a Deputy Director of Cybersecurity and Infrastructure 
Security who shall— 
‘‘(1) assist the Director in the management of the 
Agency; and 
‘‘(2) report to the Director. 
‘‘(e) CYBERSECURITY
AND INFRASTRUCTURE SECU-
RITY AUTHORITIES OF THE SECRETARY.— 
‘‘(1) IN
GENERAL.—The responsibilities of the 
Secretary relating to cybersecurity and infrastructure 
security shall include the following: 
‘‘(A) To access, receive, and analyze law en-
forcement information, intelligence information, 
and other information from Federal Government 
agencies, State, local, tribal, and territorial gov-
ernment agencies, including law enforcement
† HR 3359 EAS 
agencies, and private sector entities, and to inte-
grate that information, in support of the mission 
responsibilities of the Department, in order to— 
‘‘(i) identify and assess the nature and 
scope of terrorist threats to the homeland; 
‘‘(ii) detect and identify threats of ter-
rorism against the United States; and 
‘‘(iii) understand those threats in light 
of actual and potential vulnerabilities of the 
homeland. 
‘‘(B) To carry out comprehensive assess-
ments of the vulnerabilities of the key resources 
and critical infrastructure of the United States, 
including the performance of risk assessments to 
determine the risks posed by particular types of 
terrorist attacks within the United States, in-
cluding an assessment of the probability of suc-
cess of those attacks and the feasibility and po-
tential efficacy of various countermeasures to 
those attacks. At the discretion of the Secretary, 
such assessments may be carried out in coordina-
tion with Sector-Specific Agencies. 
‘‘(C) To integrate relevant information, 
analysis, and vulnerability assessments, regard-
less of whether the information, analysis, or as-