114TH CONGRESS 
1ST SESSION H. R. 3510 
AN ACT 
To amend the Homeland Security Act of 2002 to require 
the Secretary of Homeland Security to develop a cyberse-
curity strategy for the Department of Homeland Secu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Department of Home-
land Security Cybersecurity Strategy Act of 2015’’. 
SEC. 2. CYBERSECURITY STRATEGY FOR THE DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new section: 
‘‘SEC. 230. CYBERSECURITY STRATEGY. 
‘‘(a) IN GENERAL.—Not later than 60 days after the 
date of the enactment of this section, the Secretary shall 
develop a departmental strategy to carry out cybersecurity 
responsibilities as set forth in law. 
‘‘(b) CONTENTS.—The strategy required under sub-
section (a) shall include the following: 
‘‘(1) Strategic and operational goals and prior-
ities to successfully execute the full range of the Sec-
retary’s cybersecurity responsibilities. 
‘‘(2) Information on the programs, policies, and 
activities that are required to successfully execute 
the full range of the Secretary’s cybersecurity re-
sponsibilities, including programs, policies, and ac-
tivities in furtherance of the following: 
‘‘(A) Cybersecurity functions set forth in 
the second section 226 (relating to the national
cybersecurity and communications integration 
center). 
‘‘(B) Cybersecurity investigations capabili-
ties. 
‘‘(C) Cybersecurity research and develop-
ment. 
‘‘(D) Engagement with international cyber-
security partners. 
‘‘(c) CONSIDERATIONS.—In developing the strategy 
required under subsection (a), the Secretary shall— 
‘‘(1) consider— 
‘‘(A) the cybersecurity strategy for the 
Homeland Security Enterprise published by the 
Secretary in November 2011; 
‘‘(B) the Department of Homeland Secu-
rity Fiscal Years 2014–2018 Strategic Plan; 
and 
‘‘(C) the most recent Quadrennial Home-
land Security Review issued pursuant to section 
707; and 
‘‘(2) include information on the roles and re-
sponsibilities of components and offices of the De-
partment, to the extent practicable, to carry out 
such strategy.
‘‘(d) IMPLEMENTATION PLAN.—Not later than 90 
days after the development of the strategy required under 
subsection (a), the Secretary shall issue an implementa-
tion plan for the strategy that includes the following: 
‘‘(1) Strategic objectives and corresponding 
tasks. 
‘‘(2) Projected timelines and costs for such 
tasks. 
‘‘(3) Metrics to evaluate performance of such 
tasks. 
‘‘(e) CONGRESSIONAL OVERSIGHT.—The Secretary 
shall submit to the Committee on Homeland Security of 
the House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate for assessment the following: 
‘‘(1) A copy of the strategy required under sub-
section (a) upon issuance. 
‘‘(2) A copy of the implementation plan re-
quired under subsection (d) upon issuance, together 
with detailed information on any associated legisla-
tive or budgetary proposals. 
‘‘(f) CLASSIFIED INFORMATION.—The strategy re-
quired under subsection (a) shall be in an unclassified 
form but may contain a classified annex.
‘‘(g) RULE OF CONSTRUCTION.—Nothing in this sec-
tion may be construed as permitting the Department to 
engage in monitoring, surveillance, exfiltration, or other 
collection activities for the purpose of tracking an individ-
ual’s personally identifiable information. 
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
the second section 226, relating to the national cy-
bersecurity and communications integration center. 
‘‘(2) HOMELAND SECURITY ENTERPRISE.—The 
term ‘Homeland Security Enterprise’ means relevant 
governmental and nongovernmental entities involved 
in homeland security, including Federal, State, local, 
and tribal government officials, private sector rep-
resentatives, academics, and other policy experts. 
‘‘(3) INCIDENT.—The term ‘incident’ has the 
meaning given such term in the second section 226, 
relating to the national cybersecurity and commu-
nications integration center.’’. 
(b) PROHIBITION ON REORGANIZATION.—The Sec-
retary of Homeland Security may not change the location 
or reporting structure of the National Protection and Pro-
grams Directorate of the Department of Homeland Secu-
rity, or the location or reporting structure of any office
or component of the Directorate, unless the Secretary re-
ceives prior authorization from Congress permitting such 
change. 
(c) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by adding at the end of the list of items for sub-
title C of title II the following new item: 
‘‘Sec. 230. Cybersecurity strategy.’’. 
(d) AMENDMENT TO DEFINITION.—Paragraph (2) of 
subsection (a) of the second section 226 of the Homeland 
Security Act of 2002 (6 U.S.C. 148; relating to the na-
tional cybersecurity and communications integration cen-
ter) is amended to read as follows: 
‘‘(2) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
actually or imminently jeopardizes, without lawful 
authority, an information system;’’. 
Passed the House of Representatives October 6, 
2015. 
Attest: 
Clerk.