I 
116TH CONGRESS 
1ST SESSION H. R. 1975 
To establish in the Cybersecurity and Infrastructure Security Agency of 
the Department of Homeland Security a Chief Information Security 
Officer Advisory Committee. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 28, 2019 
Mr. KATKO (for himself, Mr. NEWHOUSE, Mr. FITZPATRICK, and Mr. LIPIN-
SKI) introduced the following bill; which was referred to the Committee 
on Homeland Security, and in addition to the Committees on Energy and 
Commerce, and Oversight and Reform, for a period to be subsequently 
determined by the Speaker, in each case for consideration of such provi-
sions as fall within the jurisdiction of the committee concerned 
A BILL 
To establish in the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security a Chief 
Information Security Officer Advisory Committee. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Advisory 
Committee Authorization Act of 2019’’. 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 is amended by adding at 
the end the following new section: 
‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 
‘‘(a) ESTABLISHMENT.—The Secretary shall estab-
lish within the Cybersecurity and Infrastructure Security 
Agency a Cybersecurity Advisory Committee. 
‘‘(b) DUTIES.— 
‘‘(1) IN
GENERAL.—The Advisory Committee 
may advise, consult with, report to, and make rec-
ommendations to the Director of Cybersecurity and 
Infrastructure Security on the development, refine-
ment, and implementation of policies, programs, 
rulemakings, planning, training, and security direc-
tives pertaining to the mission of the Cybersecurity 
and Infrastructure Security Agency. 
‘‘(2) RECOMMENDATIONS.— 
‘‘(A) IN
GENERAL.—The Advisory Com-
mittee shall develop, at the request of the Di-
rector, recommendations for improvements to 
the cybersecurity mission of the Cybersecurity 
and Infrastructure Security Agency. 
‘‘(B) RECOMMENDATIONS OF SUBCOMMIT-
TEES.—Recommendations agreed upon by the 
subcommittees established under subsection (d) 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
for any year shall be approved by the Advisory 
Committee before the Advisory Committee sub-
mits to the Director the annual report under 
paragraph (4) for that year. 
‘‘(3) PERIODIC REPORTS.—The Advisory Com-
mittee shall periodically submit to the Director— 
‘‘(A) reports on matters identified by the 
Director; and 
‘‘(B) reports on other matters identified by 
a majority of the members of the Advisory 
Committee. 
‘‘(4) ANNUAL
REPORT.—The Advisory Com-
mittee shall submit to the Director an annual report 
providing information on the activities, findings, and 
recommendations of the Advisory Committee, includ-
ing its subcommittees, for the preceding year. Not 
later than six months after the date that the Direc-
tor receives an annual report for a year, the Director 
shall publish a public version of the report describ-
ing the activities of the Advisory Committee and 
such related matters as would be informative to the 
public during that year, consistent with section 
552(b) of title 5, United States Code. 
‘‘(5) FEEDBACK.—Not later than 90 days after 
receiving any recommendation submitted by the Ad-
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
visory Committee under paragraph (2), (3), or (4), 
the Director shall respond in writing to the Advisory 
Committee with feedback on the recommendation. 
Such a response shall include— 
‘‘(A) with respect to any recommendation 
with which the Director concurs, an action plan 
to implement the recommendation; and 
‘‘(B) with respect to any recommendation 
with which the Director does not concur, a jus-
tification for why the Director does not plan to 
implement the recommendation. 
‘‘(6) 
CONGRESSIONAL
NOTIFICATION.—For 
each fiscal quarter beginning after the date of the 
enactment of this section, the Director shall provide 
to the Committee on Homeland Security and Gov-
ernmental Affairs and the Committee on Appropria-
tions of the Senate and the Committee on Homeland 
Security and the Committee on Appropriations of 
the House of Representatives a briefing on feedback 
from the Advisory Committee. 
‘‘(c) MEMBERSHIP.— 
‘‘(1) APPOINTMENT.— 
‘‘(A) IN
GENERAL.—Not later than 180 
days after the date of the enactment of this 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
Act, the Director shall appoint the members of 
the Advisory Committee. 
‘‘(B) COMPOSITION.—The membership of 
the Advisory Committee shall consist of not 
more than 35 individuals, each of whom rep-
resent a category referred to in subparagraph 
(C)(i). 
‘‘(C) REPRESENTATION.— 
‘‘(i) IN GENERAL.—The membership 
of the Advisory Committee shall include 
representatives of State and local govern-
ments and of a broad range of industries, 
including the following: 
‘‘(I) Defense. 
‘‘(II) Education. 
‘‘(III) Financial services. 
‘‘(IV) Healthcare. 
‘‘(V) Manufacturing. 
‘‘(VI) Media and entertainment. 
‘‘(VII) Chemicals. 
‘‘(VIII) Retail. 
‘‘(IX) Transportation. 
‘‘(X) Energy. 
‘‘(XI) Information Technology. 
‘‘(XII) Communications. 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
‘‘(XIII) Other relevant fields 
identified by the Director. 
‘‘(ii) PROHIBITION.—Not more than 
three members may represent any one cat-
egory under clause (i). 
‘‘(2) TERM OF OFFICE.— 
‘‘(A) TERMS.—The term of each member 
of the Advisory Committee shall be two years, 
but a member may continue to serve until a 
successor is appointed. 
‘‘(B) REMOVAL.—The Director may review 
the participation of a member of the Advisory 
Committee and remove such member for cause 
at any time. 
‘‘(C) REAPPOINTMENT.—A member of the 
Advisory Committee may be reappointed for an 
unlimited number of terms. 
‘‘(3) DELEGATION
OF
RESPONSIBILITIES.—A 
member of the Advisory Committee may delegate 
that member’s responsibilities under this section to 
another individual, with the exception of access to 
protected information and classified information 
under paragraph (6). 
‘‘(4) PROHIBITION
ON
COMPENSATION.—The 
members of the Advisory Committee may not receive 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
pay or benefits from the United States Government 
by reason of their service on the Advisory Com-
mittee. 
‘‘(5) MEETINGS.— 
‘‘(A) IN GENERAL.—The Director shall re-
quire the Advisory Committee to meet at least 
quarterly, and may convene additional meetings 
as necessary. 
‘‘(B) PUBLIC MEETINGS.—At least one of 
the meetings referred to in subparagraph (A) 
shall be open to the public. 
‘‘(C) ATTENDANCE.—The Advisory Com-
mittee shall maintain a record of the persons 
present at each meeting. 
‘‘(6) MEMBER
ACCESS
TO
CLASSIFIED
AND 
PROTECTED INFORMATION.— 
‘‘(A) IN
GENERAL.—Not later than 60 
days after the date on which a member is first 
appointed to the Advisory Committee and be-
fore the member is granted access to any classi-
fied information or protected information, the 
Director shall determine if there is cause for 
such member to be restricted from reviewing, 
discussing, or possessing such information. 
‘‘(B) ACCESS.— 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
‘‘(i) PROTECTED
INFORMATION.—If 
the Director does not restrict a member 
from reviewing, discussing, or possessing 
sensitive information under subparagraph 
(A) and the member voluntarily signs a 
nondisclosure agreement with respect to 
protected information, the member may be 
granted access to protected information 
that the Director determines is relevant to 
such member’s service on the Advisory 
Committee. 
‘‘(ii) CLASSIFIED INFORMATION.—Ac-
cess to classified materials shall be man-
aged in accordance with Executive Order 
No. 13526 of December 29, 2009 (75 Fed. 
Reg 707), or any subsequent corresponding 
Executive Order. 
‘‘(C) PROTECTIONS.—A member of the 
Advisory Committee shall agree, as a condition 
of such membership, to protect all classified in-
formation in accordance with the applicable re-
quirements for the particular level of classifica-
tion of such information and to protect all pro-
tected information appropriately. 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
‘‘(D) 
PROTECTED
INFORMATION
DE-
FINED.—In this section, the term ‘protected in-
formation’ means— 
‘‘(i) information specifically exempted 
from disclosure by statute or regulation; 
‘‘(ii) trade secrets and commercial or 
financial information obtained from a per-
son and privileged or confidential; 
‘‘(iii) deliberative process privileged 
information; 
‘‘(iv) personally identifiable informa-
tion, the disclosure of which would con-
stitute an invasion of personal privacy; 
‘‘(v) records containing law enforce-
ment sensitive information; and 
‘‘(vi) other categories of information, 
as determined by the Director. 
‘‘(7) CHAIRPERSON.—The Advisory Committee 
shall select, from among the members of the Advi-
sory Committee— 
‘‘(A) a member to serve as chairperson of 
the Advisory Committee; and 
‘‘(B) a member to serve as chairperson of 
each subcommittee of the Advisory Committee 
established under subsection (d). 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS
‘‘(d) SUBCOMMITTEES.— 
‘‘(1) IN GENERAL.—The Director and the Advi-
sory Committee shall establish subcommittees within 
the Advisory Committee to address cybersecurity 
issues, including relating to the following: 
‘‘(A) Information exchange. 
‘‘(B) Critical infrastructure. 
‘‘(C) Risk management. 
‘‘(D) Public and private partnerships. 
‘‘(2) ADDITIONAL SUBCOMMITTEES.—In addi-
tion to the subcommittees established pursuant to 
paragraph (1), the Advisory Committee chairperson, 
in coordination with the Director, may establish 
within the Advisory Committee additional sub-
committees that the Director and Advisory Com-
mittee determine to be necessary. 
‘‘(3) MEETINGS AND REPORTING.—Each sub-
committee shall meet at least bimonthly, and submit 
to the Advisory Committee for inclusion in the an-
nual report required under subsection (b)(4) infor-
mation, including activities, findings, and rec-
ommendations, regarding subject matter considered 
by the subcommittee. 
‘‘(4) SUBJECT MATTER EXPERTS.—The chair of 
the Advisory Committee shall appoint members to 
VerDate Sep 11 2014 
06:34 Apr 11, 2019
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1975.IH
H1975
kjohnson on DSK79L0C42 with BILLS