IB 
Union Calendar No. 276 
114TH CONGRESS 
1ST SESSION H. R. 3869 
[Report No. 114–363] 
To amend the Homeland Security Act of 2002 to require State and local 
coordination on cybersecurity with the national cybersecurity and commu-
nications integration center, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 2, 2015 
Mr. HURD of Texas (for himself and Mr. RATCLIFFE) introduced the following 
bill; which was referred to the Committee on Homeland Security 
DECEMBER 3, 2015 
Additional sponsors: Mr. MESSER, Mr. SESSIONS, Mr. THORNBERRY, and Mr. 
SWALWELL of California 
DECEMBER 3, 2015 
Committed to the Committee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to require 
State and local coordination on cybersecurity with the 
national cybersecurity and communications integration 
center, and for other purposes. 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber 
Protection Act of 2015’’. 
SEC. 2. STATE AND LOCAL COORDINATION ON CYBERSECU-
RITY WITH THE NATIONAL CYBERSECURITY 
AND COMMUNICATIONS INTEGRATION CEN-
TER. 
(a) IN GENERAL.—The second section 226 of the 
Homeland Security Act of 2002 (6 U.S.C. 148; relating 
to the national cybersecurity and communications integra-
tion center) is amended by adding at the end the following 
new subsection: 
‘‘(g) STATE AND LOCAL COORDINATION ON CYBER-
SECURITY.— 
‘‘(1) IN GENERAL.—The Center shall, to the ex-
tent practicable— 
‘‘(A) assist State and local governments, 
upon request, in identifying information system 
vulnerabilities; 
‘‘(B) assist State and local governments, 
upon request, in identifying information secu-
rity protections commensurate with cybersecu-
rity risks and the magnitude of the potential 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
harm resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
‘‘(i) information collected or main-
tained by or on behalf of a State or local 
government; or 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
a State or local government or other orga-
nization on behalf of a State or local gov-
ernment; 
‘‘(C) in consultation with State and local 
governments, provide and periodically update 
via a web portal tools, products, resources, poli-
cies, guidelines, and procedures related to infor-
mation security; 
‘‘(D) work with senior State and local gov-
ernment officials, including State and local 
Chief Information Officers, through national as-
sociations to coordinate a nationwide effort to 
ensure effective implementation of tools, prod-
ucts, resources, policies, guidelines, and proce-
dures related to information security to secure 
and ensure the resiliency of State and local in-
formation systems; 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
the information systems of State and local 
governments; 
‘‘(H) assist State and local governments to 
develop policies and procedures for coordinating 
vulnerability disclosures, to the extent prac-
ticable, consistent with international and na-
tional standards in the information technology 
industry, including standards developed by the 
National Institute of Standards and Tech-
nology; and 
‘‘(I) ensure that State and local govern-
ments, as appropriate, are made aware of the 
tools, products, resources, policies, guidelines, 
and procedures on information security devel-
oped by the Department and other appropriate 
Federal departments and agencies for ensuring 
the security and resiliency of Federal civilian 
information systems. 
‘‘(2) TRAINING.—Privacy and civil liberties 
training provided pursuant to subparagraph (F) of 
paragraph (1) shall include processes, methods, and 
information that— 
‘‘(A) are consistent with the Department’s 
Fair Information Practice Principles developed 
pursuant to section 552a of title 5, United 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
States Code (commonly referred to as the ‘Pri-
vacy Act of 1974’ or the ‘Privacy Act’); 
‘‘(B) reasonably limit, to the greatest ex-
tent practicable, the receipt, retention, use, and 
disclosure of information related to cybersecu-
rity risks and incidents associated with specific 
persons that is not necessary, for cybersecurity 
purposes, to protect an information system or 
network of information systems from cybersecu-
rity risks or to mitigate cybersecurity risks and 
incidents in a timely manner; 
‘‘(C) minimize any impact on privacy and 
civil liberties; 
‘‘(D) provide data integrity through the 
prompt removal and destruction of obsolete or 
erroneous names and personal information that 
is unrelated to the cybersecurity risk or incident 
information shared and retained by the Center 
in accordance with this section; 
‘‘(E) include requirements to safeguard 
cyber threat indicators and defensive measures 
retained by the Center, including information 
that is proprietary or business-sensitive that 
may be used to identify specific persons from 
unauthorized access or acquisition; 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
‘‘(F) protect the confidentiality of cyber 
threat indicators and defensive measures associ-
ated with specific persons to the greatest extent 
practicable; and 
‘‘(G) ensure all relevant constitutional, 
legal, and privacy protections are observed.’’. 
(b) CONGRESSIONAL OVERSIGHT.—Not later than 
two years after the date of the enactment of this Act, the 
national cybersecurity and communications integration 
center of the Department of Homeland Security shall pro-
vide to the Committee on Homeland Security of the House 
of Representatives and the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate information 
on the activities and effectiveness of such activities under 
subsection (g) of the second section 226 of the Homeland 
Security Act of 2002 (6 U.S.C. 148; relating to the na-
tional cybersecurity and communications integration cen-
ter), as added by subsection (a) of this section, on State 
and local information security. The center shall seek feed-
back from State and local governments regarding the ef-
fectiveness of such activities and include such feedback in 
the information required to be provided under this sub-
section. 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS
Union Calendar No. 276 
114TH CONGRESS 
1ST SESSION 
H. R. 3869 
[Report No. 114–363] 
A BILL 
To amend the Homeland Security Act of 2002 to 
require State and local coordination on cyberse-
curity with the national cybersecurity and com-
munications integration center, and for other 
purposes. 
DECEMBER 3, 2015 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
22:21 Dec 03, 2015
Jkt 059200
PO 00000
Frm 00010
Fmt 6651
Sfmt 6651
E:\BILLS\H3869.RH
H3869
asabaliauskas on DSK5VPTVN1PROD with BILLS