I 
115TH CONGRESS 
1ST SESSION H. R. 3359 
To amend the Homeland Security Act of 2002 to authorize the Cybersecurity 
and Infrastructure Security Agency of the Department of Homeland 
Security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 24, 2017 
Mr. MCCAUL (for himself, Mr. THOMPSON of Mississippi, Mr. RATCLIFFE, Mr. 
RICHMOND, Mr. KATKO, Mr. HURD, Mr. DONOVAN, Mr. GALLAGHER, 
Mr. HIGGINS of Louisiana, Mr. GARRETT, and Mr. FITZPATRICK) intro-
duced the following bill; which was referred to the Committee on Home-
land Security, and in addition to the Committees on Energy and Com-
merce, Oversight and Government Reform, and Transportation and Infra-
structure, for a period to be subsequently determined by the Speaker, in 
each case for consideration of such provisions as fall within the jurisdic-
tion of the committee concerned 
A BILL 
To amend the Homeland Security Act of 2002 to authorize 
the Cybersecurity and Infrastructure Security Agency of 
the Department of Homeland Security, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity and In-
frastructure Security Agency Act of 2017’’. 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—The Homeland Security Act of 
2002 is amended by adding at the end the following new 
title: 
‘‘TITLE 
XXII—CYBERSECURITY 
AND INFRASTRUCTURE SECU-
RITY AGENCY 
‘‘Subtitle A—Cybersecurity and 
Infrastructure Security 
‘‘SEC. 2201. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the meaning given such term in section 2215. 
‘‘(2) CRITICAL
INFRASTRUCTURE
RISK.—The 
term ‘critical infrastructure risk’ means threats to 
and vulnerabilities of critical infrastructure and any 
related consequences, including consequences caused 
by or resulting from an act of terrorism. 
‘‘(3) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
section 2209. 
‘‘(4) CYBERSECURITY THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given such term 
in paragraph (5) of section 102 of the Cybersecurity 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(5) FEDERAL ENTITY.—The term ‘Federal en-
tity’ has the meaning given such term in paragraph 
(8) of section 102 of the Cybersecurity Act of 2015 
(contained in division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(6) NON-FEDERAL ENTITY.—The term ‘non- 
Federal entity’ has the meaning given such term in 
paragraph (14) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(7) SHARING.—The term ‘sharing’ has the 
meaning given such term in section 2209. 
‘‘(8) NATIONAL
CYBERSECURITY
ASSET
RE-
SPONSE ACTIVITIES.—The term ‘national cybersecu-
rity asset response activities’ means— 
‘‘(A) furnishing technical assistance to en-
tities affected by cybersecurity risks to protect 
assets, mitigate vulnerabilities, and reduce im-
pacts of cyber incidents; 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(B) identifying other entities that may be 
at risk of an incident and assessing risk to the 
same or similar vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks 
to a sector or region, including potential cas-
cading effects, and developing courses of action 
to mitigate such risks; 
‘‘(D) facilitating information sharing and 
operational coordination with threat response; 
and 
‘‘(E) providing guidance on how best to 
utilize Federal resources and capabilities in a 
timely, effective manner to speed recovery from 
cybersecurity risks. 
‘‘SEC. 2202. CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AGENCY. 
‘‘(a) REDESIGNATION.— 
‘‘(1) IN
GENERAL.—The National Protection 
and Programs Directorate of the Department shall, 
on and after the date of the enactment of this sub-
title, be known as the ‘Cybersecurity and Infrastruc-
ture Security Agency’ (in this subtitle referred to as 
the ‘Agency’). 
‘‘(2) REFERENCES.—Any reference to the Na-
tional Protection and Programs Directorate of the 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
Department in any law, regulation, map, document, 
record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and 
Infrastructure Security Agency of the Department. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Agency shall be head-
ed by a Director of Cybersecurity and Infrastructure 
Security (in this subtitle referred to as the ‘Direc-
tor’), who shall report to the Secretary. 
‘‘(2) REFERENCE.—Any reference to an Under 
Secretary responsible for overseeing critical infra-
structure protection, cybersecurity, and any other re-
lated program of the Department as described in 
section 103(a)(1)(H) as in effect on the day before 
the date of the enactment of this subtitle in any law, 
regulation, map, document, record, or other paper of 
the United States shall be deemed to be a reference 
to the Director of Cybersecurity and Infrastructure 
Security of the Department. 
‘‘(c) RESPONSIBILITIES.—The Director shall— 
‘‘(1) lead cybersecurity and critical infrastruc-
ture security programs, operations, and associated 
policy for the Agency, including national cybersecu-
rity asset response activities; 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(2) coordinate with Federal entities and non- 
Federal entities, including international entities, to 
carry out the cybersecurity and critical infrastruc-
ture activities of the Agency, as appropriate; 
‘‘(3) carry out the Secretary’s responsibilities to 
secure Federal information and information systems 
consistent with law, including subchapter II of chap-
ter 35 of title 44, United States Code, and the Cy-
bersecurity Act of 2015 (contained in division N of 
the Consolidated Appropriations Act, 2016 (Public 
Law 114–113)); 
‘‘(4) coordinate a national effort to secure and 
protect against critical infrastructure risks; 
‘‘(5) upon request provide analyses, expertise, 
and other technical assistance to critical infrastruc-
ture owners and operators and, where appropriate, 
provide such analyses, expertise, and other technical 
assistance in coordination with critical infrastructure 
sector specific agencies and other Federal depart-
ments and agencies; 
‘‘(6) to the extent required by law, exercise du-
ties in coordination with sector-specific agencies; 
‘‘(7) maintain and utilize mechanisms for the 
regular and ongoing consultation and collaboration 
among the Agency’s Divisions to further operational 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
coordination, integrated situational awareness, and 
improved integration across the Agency in accord-
ance with this Act; 
‘‘(8) develop, coordinate, and implement— 
‘‘(A) comprehensive strategic plans for the 
activities of the Agency; and 
‘‘(B) risk assessments; 
‘‘(9) carry out emergency communications re-
sponsibilities, in accordance with title XVIII; 
‘‘(10) carry out cybersecurity, infrastructure se-
curity, and emergency communications stakeholder 
outreach and engagement; and 
‘‘(11) carry out such other duties and powers 
prescribed by law or delegated by the Secretary. 
‘‘(d) DEPUTY DIRECTOR.—There shall be in the 
Agency a Deputy Director of Cybersecurity and Infra-
structure Security who shall— 
‘‘(1) assist the Director in the management of 
the Agency; and 
‘‘(2) report to the Director. 
‘‘(e) CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AUTHORITIES OF THE SECRETARY.— 
‘‘(1) IN GENERAL.—The responsibilities of the 
Secretary relating to cybersecurity and infrastruc-
ture security shall include the following: 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(A) To access, receive, and analyze law 
enforcement information, intelligence informa-
tion, and other information from Federal Gov-
ernment agencies, State, local, tribal, and terri-
torial government agencies (including law en-
forcement agencies), and private sector entities, 
and to integrate such information, in support of 
the mission responsibilities of the Department, 
in order to— 
‘‘(i) identify and assess the nature 
and scope of terrorist threats to the home-
land; 
‘‘(ii) detect and identify threats of ter-
rorism against the United States; and 
‘‘(iii) understand such threats in light 
of actual and potential vulnerabilities of 
the homeland. 
‘‘(B) To carry out comprehensive assess-
ments of the vulnerabilities of the key resources 
and critical infrastructure of the United States, 
including the performance of risk assessments 
to determine the risks posed by particular types 
of terrorist attacks within the United States 
(including an assessment of the probability of 
success of such attacks and the feasibility and 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
potential efficacy of various countermeasures to 
such attacks). 
‘‘(C) To integrate relevant information, 
analysis, and vulnerability assessments (regard-
less of whether such information, analysis, or 
assessments are provided or produced by the 
Department) in order to identify priorities for 
protective and support measures by the Depart-
ment, other Federal Government agencies, 
State, local, tribal, and territorial government 
agencies and authorities, the private sector, and 
other entities regarding terrorist and other 
threats to homeland security. 
‘‘(D) To ensure, pursuant to section 202, 
the timely and efficient access by the Depart-
ment to all information necessary to discharge 
the responsibilities under this title, including 
obtaining such information from other Federal 
Government agencies. 
‘‘(E) To develop a comprehensive national 
plan for securing the key resources and critical 
infrastructure of the United States, including 
power production, generation, and distribution 
systems, information technology and tele-
communications systems (including satellites), 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
Department, or are consumers of information 
provided by the Department, in order to facili-
tate the identification and sharing of informa-
tion revealed in their ordinary duties and the 
optimal utilization of information received from 
the Department. 
‘‘(O) To coordinate with Federal, State, 
local, tribal, and territorial law enforcement 
agencies, and the private sector, as appropriate. 
‘‘(P) To exercise the authorities and over-
sight of the functions, personnel, assets, and li-
abilities of those components transferred to the 
Department pursuant to section 201(g). 
‘‘(Q) To carry out the functions of the na-
tional cybersecurity and communications inte-
gration center under section 2209. 
‘‘(R) To carry out requirements of the 
Chemical Facilities Anti-Terrorism Standards 
Program established under title XXI and the 
secure handling of ammonium nitrate estab-
lished under subtitle J of title VIII. 
‘‘(2) MODIFICATION.—The Secretary may mod-
ify the functions specified in sections 2203(b) and 
2204(b) upon certifying to the Committee on Home-
land Security of the House of Representatives and 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
the Committee on Homeland Security and Govern-
mental Affairs of the Senate 60 days prior to any 
such modification that such modification is nec-
essary for carrying out the activities of the Agency. 
‘‘(3) STAFF.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
provide the Agency with a staff of analysts hav-
ing appropriate expertise and experience to as-
sist the Agency in discharging its responsibil-
ities under this section. 
‘‘(B) PRIVATE
SECTOR
ANALYSTS.—Ana-
lysts under this subsection may include analysts 
from the private sector. 
‘‘(C) SECURITY
CLEARANCES.—Analysts 
under this subsection shall possess security 
clearances appropriate for their work under this 
section. 
‘‘(4) DETAIL OF PERSONNEL.— 
‘‘(A) IN GENERAL.—In order to assist the 
Agency in discharging its responsibilities under 
this section, personnel of the Federal agencies 
referred to in subparagraph (B) may be de-
tailed to the Agency for the performance of 
analytic functions and related duties. 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(B) AGENCIES SPECIFIED.—The Federal 
agencies referred to in subparagraph (A) are 
the following: 
‘‘(i) The Department of State. 
‘‘(ii) The Central Intelligence Agency. 
‘‘(iii) The Federal Bureau of Inves-
tigation. 
‘‘(iv) The National Security Agency. 
‘‘(v) The National Geospatial-Intel-
ligence Agency. 
‘‘(vi) The Defense Intelligence Agen-
cy. 
‘‘(vii) Any other agency of the Federal 
Government that the President considers 
appropriate. 
‘‘(C) INTERAGENCY
AGREEMENTS.—The 
Secretary and the head of an agency specified 
in subparagraph (B) may enter into agreements 
for the purpose of detailing personnel under 
this paragraph. 
‘‘(D) BASIS.—The detail of personnel 
under this paragraph may be on a reimbursable 
or non-reimbursable basis. 
‘‘(f) COMPOSITION.—The Agency shall be composed 
of the following divisions: 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(1) The Cybersecurity Division, headed by an 
Assistant Director. 
‘‘(2) The Infrastructure Security Division, 
headed by an Assistant Director. 
‘‘(3) The Emergency Communications Division 
under title XVIII, headed by an Assistant Director. 
‘‘(g) CO-LOCATION.—To the maximum extent prac-
ticable, the Director shall examine the establishment of 
central locations in geographical regions with a significant 
Agency presence. When establishing such locations, the 
Director shall coordinate with component heads and the 
Under Secretary for Management to co-locate or partner 
on any new real property leases, renewing any existing 
leases, or agreeing to extend or newly occupy any Federal 
space or new construction. 
‘‘(h) PRIVACY.— 
‘‘(1) IN GENERAL.—There shall be a Privacy 
Officer of the Agency with primary responsibility for 
privacy policy and compliance for the Agency. 
‘‘(2) RESPONSIBILITIES.—The responsibilities 
of the Privacy Officer of the Agency shall include— 
‘‘(A) assuring that the use of technologies 
by the Agency sustain, and do not erode, pri-
vacy protections relating to the use, collection, 
and disclosure of personal information; 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS
‘‘(B) assuring that personal information 
contained in Privacy Act systems of records of 
the Agency is handled in full compliance with 
fair information practices as specified in the 
Privacy Act of 1974; 
‘‘(C) evaluating legislative and regulatory 
proposals involving collection, use, and disclo-
sure of personal information by the Agency; 
and 
‘‘(D) conducting a privacy impact assess-
ment of proposed rules of the Agency on the 
privacy of personal information, including the 
type of personal information collected and the 
number of people affected. 
‘‘(i) SAVINGS.—Nothing in this title may be con-
strued as affecting in any manner the authority, existing 
on the day before the date of the enactment of this title, 
of any other component of the Department or any other 
Federal department or agency. 
‘‘SEC. 2203. CYBERSECURITY DIVISION. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN GENERAL.—There is established in the 
Agency a Cybersecurity Division. 
‘‘(2) ASSISTANT DIRECTOR.—The Cybersecurity 
Division shall be headed by an Assistant Director for 
VerDate Sep 11 2014 
03:22 Aug 02, 2017
Jkt 069200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.IH
H3359
dlhill on DSKBC4BHB2PROD with BILLS