I 
112TH CONGRESS 
1ST SESSION H. R. 3674 
To amend the Homeland Security Act of 2002 to make certain improvements 
in the laws relating to cybersecurity, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 15, 2011 
Mr. DANIEL E. LUNGREN of California (for himself, Mr. KING of New York, 
Mr. MCCAUL, Mr. BILIRAKIS, Mrs. MILLER of Michigan, Mr. WALBERG, 
Mr. MARINO, Mr. LONG, Mr. TURNER of New York, Mr. STIVERS, and 
Mr. LANGEVIN) introduced the following bill; which was referred to the 
Committee on Homeland Security, and in addition to the Committees on 
Oversight and Government Reform, Science, Space, and Technology, the 
Judiciary, and Select Intelligence (Permanent Select), for a period to be 
subsequently determined by the Speaker, in each case for consideration 
of such provisions as fall within the jurisdiction of the committee con-
cerned 
A BILL 
To amend the Homeland Security Act of 2002 to make 
certain improvements in the laws relating to cybersecu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Promoting and En-
hancing Cybersecurity and Information Sharing Effective-
ness Act of 2011’’ or the ‘‘PRECISE Act of 2011’’. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
SEC. 2. DEPARTMENT OF HOMELAND SECURITY CYBERSE-
CURITY ACTIVITIES. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 is amended by adding at the 
end the following new sections: 
‘‘SEC. 226. NATIONAL CYBERSECURITY AUTHORITY. 
‘‘(a) IN GENERAL.—To protect Federal systems and 
critical infrastructure information systems and to prepare 
the Nation to respond to, recover from, and mitigate 
against acts of terrorism and other incidents involving 
such systems and infrastructure, the Secretary shall— 
‘‘(1) develop and conduct risk assessments for 
Federal systems and, upon request and subject to 
the availability of resources, critical infrastructure 
information systems in consultation with the heads 
of other agencies or governmental and private enti-
ties that own and operate such systems, that may 
include threat, vulnerability, and impact assessments 
and penetration testing, or other comprehensive as-
sessments techniques; 
‘‘(2) foster the development, in conjunction with 
other governmental entities and the private sector, 
of essential information security technologies and ca-
pabilities for protecting Federal systems and critical 
infrastructure information systems, including com-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
prehensive protective capabilities and other techno-
logical solutions; 
‘‘(3) acquire, integrate, and facilitate the adop-
tion of new cybersecurity technologies and practices 
in a technologically and vendor-neutral manner to 
keep pace with emerging terrorist and other cyberse-
curity threats and developments, including through 
research and development, technical service agree-
ments, and making such technologies available to 
governmental and private entities that own or oper-
ate critical infrastructure information systems, as 
necessary to accomplish the purpose of this section; 
‘‘(4) maintain the capability to serve as a focal 
point with the Federal Government for cybersecu-
rity, responsible for— 
‘‘(A) the coordination of the protection of 
Federal systems and critical infrastructure in-
formation systems; 
‘‘(B) the coordination of national cyber in-
cident response; 
‘‘(C) facilitating information sharing, inter-
actions, and collaborations among and between 
Federal agencies, State and local governments, 
the private sector, academia, and international 
partners; 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(D) working with appropriate Federal 
agencies, State and local governments, the pri-
vate sector, academia, and international part-
ners to prevent and respond to terrorist and 
other cybersecurity threats and incidents involv-
ing Federal systems and critical infrastructure 
information systems pursuant to the national 
cyber incident response plan and supporting 
plans developed in accordance with paragraph 
(8); 
‘‘(E) the dissemination of timely and ac-
tionable 
terrorist 
and 
other 
cybersecurity 
threat, vulnerability, mitigation, and warning 
information, including alerts, advisories, indica-
tors, signatures, and mitigation and response 
measures, to improve the security and protec-
tion of Federal systems and critical infrastruc-
ture information systems; 
‘‘(F) the integration of information from 
Federal Government and non-federal network 
operation centers and security operations cen-
ters; 
‘‘(G) the compilation and analysis of infor-
mation about risks and incidents regarding ter-
rorism or other causes that threaten Federal 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
systems and critical infrastructure information 
systems; 
‘‘(H) the provision of incident prediction, 
detection, analysis, mitigation, and response in-
formation and remote or on-site technical as-
sistance to heads of Federal agencies and, upon 
request, governmental and private entities that 
own or operate critical infrastructure; and 
‘‘(I) acting as the Federal Government 
representative with the organization or organi-
zations designated under section 241; 
‘‘(5) assist in national efforts to mitigate com-
munications and information technology supply 
chain vulnerabilities to enhance the security and the 
resiliency of Federal systems and critical infrastruc-
ture information systems; 
‘‘(6) develop and lead a nationwide awareness 
and outreach effort to educate the public about— 
‘‘(A) the importance of cybersecurity and 
cyber ethics; 
‘‘(B) ways to promote cybersecurity best 
practices at home and in the workplace; and 
‘‘(C) training opportunities to support the 
development of an effective national cybersecu-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
rity workforce and educational paths to cyberse-
curity professions; 
‘‘(7) establish, in coordination with the Director 
of the National Institute of Standards and Tech-
nology and the heads of other appropriate agencies, 
benchmarks and guidelines for making critical infra-
structure information systems more secure at a fun-
damental level, including through automation, inter-
operability, and privacy-enhancing authentication; 
‘‘(8) develop a national cybersecurity incident 
response plan and supporting cyber incident re-
sponse and restoration plans, in consultation with 
the heads of other relevant Federal agencies, owners 
and operators of critical infrastructure, sector co-
ordinating councils, State and local governments, 
and relevant non-governmental organizations and 
based on applicable law that describe the specific 
roles and responsibilities of governmental and pri-
vate entities during cyber incidents to ensure essen-
tial government operations continue; 
‘‘(9) develop and conduct exercises, simulations, 
and other activities designed to support the national 
response to terrorism and other cybersecurity 
threats and incidents and evaluate the national 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
cyber incident response plan and supporting plans 
developed in accordance with paragraph (8); 
‘‘(10) ensure that the technology and tools used 
to accomplish the requirements of this section are 
scientifically and operationally validated; and 
‘‘(11) take such other lawful action as may be 
necessary and appropriate to accomplish the require-
ments of this section. 
‘‘(b) COORDINATION.— 
‘‘(1) COORDINATION WITH OTHER ENTITIES.— 
In carrying out the cybersecurity activities under 
this section, the Secretary shall coordinate, as ap-
propriate, with— 
‘‘(A) the head of any relevant agency or 
entity; 
‘‘(B) representatives of State and local 
governments; 
‘‘(C) the private sector, including owners 
and operators of critical infrastructure; 
‘‘(D) suppliers of technology for critical in-
frastructure; 
‘‘(E) academia; and 
‘‘(F) international organizations and for-
eign partners. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) COORDINATION OF AGENCY ACTIVITIES.— 
The Secretary shall coordinate the activities under-
taken by agencies to protect Federal systems and 
critical infrastructure information systems and pre-
pare the Nation to predict, anticipate, recognize, re-
spond to, recover from, and mitigate against risk of 
acts of terrorism and other incidents involving such 
systems and infrastructure. 
‘‘(3) LEAD
CYBERSECURITY
OFFICIAL.—The 
Secretary shall designate a lead cybersecurity official 
to provide leadership to the cybersecurity activities 
of the Department and to ensure that the Depart-
ment’s cybersecurity activities under this subtitle are 
coordinated with all other infrastructure protection 
and cyber-related programs and activities of the De-
partment, including those of any intelligence or law 
enforcement components or entities within the De-
partment. 
‘‘(4) REPORTS TO CONGRESS.—The lead cyber-
security official shall make regular reports to the ap-
propriate committees of Congress on the coordina-
tion of cyber-related programs across the Depart-
ment. 
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS
‘‘(c) STRATEGY.—In carrying out the cybersecurity 
functions of the Department, the Secretary shall develop 
and maintain a strategy that— 
‘‘(1) articulates the actions necessary to assure 
the readiness, reliability, continuity, integrity, and 
resilience of Federal systems and critical infrastruc-
ture information systems; 
‘‘(2) is informed by the need to maintain eco-
nomic prosperity and facilitate market leadership for 
the United States information and communications 
industry; and 
‘‘(3) protects privacy rights and preserves civil 
liberties of United States persons. 
‘‘(d) ACCESS TO INFORMATION.—The Secretary shall 
ensure that the organization or organizations designated 
under section 241 have full and timely access to properly 
anonymized cyber incident information originating within 
the Federal civilian networks to populate the common op-
erating picture described in section 242. 
‘‘(e) NO RIGHT OR BENEFIT.—The provision of as-
sistance or information to governmental or private entities 
that own or operate critical infrastructure information sys-
tems under this section shall be at the discretion of the 
Secretary and subject to the availability of resources. The 
provision of certain assistance or information to one gov-
VerDate Mar 15 2010 
02:08 Dec 21, 2011
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3674.IH
H3674
jbell on DSK7SPTVN1PROD with BILLS