SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘State and Local Cyber 
Protection Act of 2015’’. 
SEC. 2. STATE AND LOCAL COORDINATION ON CYBERSECU-
RITY WITH THE NATIONAL CYBERSECURITY 
AND COMMUNICATIONS INTEGRATION CEN-
TER. 
(a) IN GENERAL.—The second section 226 of the 
Homeland Security Act of 2002 (6 U.S.C. 148; relating 
to the national cybersecurity and communications integra-
tion center) is amended by adding at the end the following 
new subsection: 
‘‘(g) STATE AND LOCAL COORDINATION ON CYBER-
SECURITY.— 
‘‘(1) IN GENERAL.—The Center shall, to the ex-
tent practicable— 
‘‘(A) assist State and local governments, 
upon request, in identifying information system 
vulnerabilities; 
‘‘(B) assist State and local governments, 
upon request, in identifying information secu-
rity protections commensurate with cybersecu-
rity risks and the magnitude of the potential 
harm resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of—
‘‘(i) information collected or main-
tained by or on behalf of a State or local 
government; or 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
a State or local government or other orga-
nization on behalf of a State or local gov-
ernment; 
‘‘(C) in consultation with State and local 
governments, provide and periodically update 
via a web portal tools, products, resources, poli-
cies, guidelines, and procedures related to infor-
mation security; 
‘‘(D) work with senior State and local gov-
ernment officials, including State and local 
Chief Information Officers, through national as-
sociations to coordinate a nationwide effort to 
ensure effective implementation of tools, prod-
ucts, resources, policies, guidelines, and proce-
dures related to information security to secure 
and ensure the resiliency of State and local in-
formation systems; 
‘‘(E) provide, upon request, operational 
and technical cybersecurity training to State 
and local government and fusion center analysts
and operators to address cybersecurity risks or 
incidents; 
‘‘(F) provide, in coordination with the 
Chief Privacy Officer and the Chief Civil Rights 
and Civil Liberties Officer of the Department, 
privacy and civil liberties training to State and 
local governments related to cybersecurity; 
‘‘(G) provide, upon request, operational 
and technical assistance to State and local gov-
ernments to implement tools, products, re-
sources, policies, guidelines, and procedures on 
information security by— 
‘‘(i) deploying technology to assist 
such State or local government to continu-
ously diagnose and mitigate against cyber 
threats and vulnerabilities, with or without 
reimbursement; 
‘‘(ii) compiling and analyzing data on 
State and local information security; and 
‘‘(iii) developing and conducting tar-
geted operational evaluations, including 
threat and vulnerability assessments, on 
the information systems of State and local 
governments;
‘‘(H) assist State and local governments to 
develop policies and procedures for coordinating 
vulnerability disclosures, to the extent prac-
ticable, consistent with international and na-
tional standards in the information technology 
industry, including standards developed by the 
National Institute of Standards and Tech-
nology; and 
‘‘(I) ensure that State and local govern-
ments, as appropriate, are made aware of the 
tools, products, resources, policies, guidelines, 
and procedures on information security devel-
oped by the Department and other appropriate 
Federal departments and agencies for ensuring 
the security and resiliency of Federal civilian 
information systems. 
‘‘(2) TRAINING.—Privacy and civil liberties 
training provided pursuant to subparagraph (F) of 
paragraph (1) shall include processes, methods, and 
information that— 
‘‘(A) are consistent with the Department’s 
Fair Information Practice Principles developed 
pursuant to section 552a of title 5, United 
States Code (commonly referred to as the ‘Pri-
vacy Act of 1974’ or the ‘Privacy Act’);
‘‘(B) reasonably limit, to the greatest ex-
tent practicable, the receipt, retention, use, and 
disclosure of information related to cybersecu-
rity risks and incidents associated with specific 
persons that is not necessary, for cybersecurity 
purposes, to protect an information system or 
network of information systems from cybersecu-
rity risks or to mitigate cybersecurity risks and 
incidents in a timely manner; 
‘‘(C) minimize any impact on privacy and 
civil liberties; 
‘‘(D) provide data integrity through the 
prompt removal and destruction of obsolete or 
erroneous names and personal information that 
is unrelated to the cybersecurity risk or incident 
information shared and retained by the Center 
in accordance with this section; 
‘‘(E) include requirements to safeguard 
cyber threat indicators and defensive measures 
retained by the Center, including information 
that is proprietary or business-sensitive that 
may be used to identify specific persons from 
unauthorized access or acquisition; 
‘‘(F) protect the confidentiality of cyber 
threat indicators and defensive measures associ-
ated with specific persons to the greatest extent 
practicable; and 
‘‘(G) ensure all relevant constitutional, 
legal, and privacy protections are observed.’’. 
(b) CONGRESSIONAL OVERSIGHT.—Not later than 2 
years after the date of the enactment of this Act, the na-
tional cybersecurity and communications integration cen-
ter of the Department of Homeland Security shall provide 
to the Committee on Homeland Security of the House of 
Representatives and the Committee on Homeland Security 
and Governmental Affairs of the Senate information on 
the activities and effectiveness of such activities under 
subsection (g) of the second section 226 of the Homeland 
Security Act of 2002 (6 U.S.C. 148; relating to the na-
tional cybersecurity and communications integration cen-
ter), as added by subsection (a) of this section, on State 
and local information security. The center shall seek feed-
back from State and local governments regarding the ef-
fectiveness of such activities and include such feedback in
the information required to be provided under this sub-
section. 
Passed the House of Representatives December 10, 
2015. 
Attest: 
Clerk.