I 
111TH CONGRESS 
2D SESSION 
H. R. 5548 
To amend the Homeland Security Act of 2002 and other laws to enhance 
the security and resiliency of the cyber and communications infrastruc-
ture of the United States. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 16, 2010 
Ms. HARMAN (for herself and Mr. KING of New York) introduced the fol-
lowing bill; which was referred to the Committee on Oversight and Gov-
ernment Reform, and in addition to the Committees on Homeland Secu-
rity, Select Intelligence (Permanent Select), Armed Services, the Judici-
ary, and Education and Labor, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To amend the Homeland Security Act of 2002 and other 
laws to enhance the security and resiliency of the cyber 
and communications infrastructure of the United States. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Protecting Cyberspace 
as a National Asset Act of 2010’’. 
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
Sec. 1. Short title. 
Sec. 2. Table of contents. 
Sec. 3. Definitions. 
TITLE I—OFFICE OF CYBERSPACE POLICY 
Sec. 101. Establishment of the Office of Cyberspace Policy. 
Sec. 102. Appointment and responsibilities of the Director. 
Sec. 103. Prohibition on political campaigning. 
Sec. 104. Review of Federal agency budget requests relating to the National 
Strategy. 
Sec. 105. Access to intelligence. 
Sec. 106. Consultation. 
Sec. 107. Reports to Congress. 
TITLE II—NATIONAL CENTER FOR CYBERSECURITY AND 
COMMUNICATIONS 
Sec. 201. Cybersecurity. 
TITLE III—FEDERAL INFORMATION SECURITY MANAGEMENT 
Sec. 301. Coordination of Federal information policy. 
TITLE IV—RECRUITMENT AND PROFESSIONAL DEVELOPMENT 
Sec. 401. Definitions. 
Sec. 402. Assessment of cybersecurity workforce. 
Sec. 403. Strategic cybersecurity workforce planning. 
Sec. 404. Cybersecurity occupation classifications. 
Sec. 405. Measures of cybersecurity hiring effectiveness. 
Sec. 406. Training and education. 
Sec. 407. Cybersecurity incentives. 
Sec. 408. Recruitment and retention program for the National Center for Cy-
bersecurity and Communications. 
TITLE V—OTHER PROVISIONS 
Sec. 501. Consultation on cybersecurity matters. 
Sec. 502. Cybersecurity research and development. 
Sec. 503. Prioritized critical information infrastructure. 
Sec. 504. National Center for Cybersecurity and Communications acquisition 
authorities. 
Sec. 505. Technical and conforming amendments. 
SEC. 3. DEFINITIONS. 
In this Act: 
(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
(B) the Committee on Homeland Security 
of the House of Representatives; 
(C) the Committee on Oversight and Gov-
ernment Reform of the House of Representa-
tives; and 
(D) any other congressional committee 
with jurisdiction over the particular matter. 
(2) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given that 
term in section 1016(e) of the USA PATRIOT Act 
(42 U.S.C. 5195c(e)). 
(3) CYBERSPACE.—The term ‘‘cyberspace’’ 
means the interdependent network of information in-
frastructure, 
and 
includes 
the 
Internet, 
tele-
communications networks, computer systems, and 
embedded processors and controllers in critical in-
dustries. 
(4) DIRECTOR.—The term ‘‘Director’’ means 
the Director of Cyberspace Policy established under 
section 101. 
(5) FEDERAL
AGENCY.—The term ‘‘Federal 
agency’’— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
Defense, a military department, or another 
element of the intelligence community. 
(7) INCIDENT.—The term ‘‘incident’’ means an 
occurrence that— 
(A) actually or potentially jeopardizes— 
(i) the information security of infor-
mation infrastructure; or 
(ii) the information that information 
infrastructure processes, stores, receives, 
or transmits; or 
(B) constitutes a violation or threat of vio-
lation of security policies, security procedures, 
or acceptable use policies applicable to informa-
tion infrastructure. 
(8) 
INFORMATION
INFRASTRUCTURE.—The 
term ‘‘information infrastructure’’ means the under-
lying framework that information systems and assets 
rely on to process, transmit, receive, or store infor-
mation electronically, including programmable elec-
tronic devices and communications networks and any 
associated hardware, software, or data. 
(9) INFORMATION SECURITY.—The term ‘‘infor-
mation security’’ means protecting information and 
information systems from disruption or unauthorized 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
access, use, disclosure, modification, or destruction 
in order to provide— 
(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; and 
(C) availability, by ensuring timely and re-
liable access to and use of information. 
(10) INFORMATION
TECHNOLOGY.—The term 
‘‘information technology’’ has the meaning given 
that term in section 11101 of title 40, United States 
Code. 
(11) INTELLIGENCE
COMMUNITY.—The term 
‘‘intelligence community’’ has the meaning given 
that term under section 3(4) of the National Secu-
rity Act of 1947 (50 U.S.C. 401a(4)). 
(12) KEY
RESOURCES.—The term ‘‘key re-
sources’’ has the meaning given that term in section 
2 of the Homeland Security Act of 2002 (6 U.S.C. 
101). 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(13) NATIONAL CENTER FOR CYBERSECURITY 
AND COMMUNICATIONS.—The term ‘‘National Cen-
ter for Cybersecurity and Communications’’ means 
the National Center for Cybersecurity and Commu-
nications established under section 242(a) of the 
Homeland Security Act of 2002, as added by this 
Act. 
(14) NATIONAL
INFORMATION
INFRASTRUC-
TURE.—The term ‘‘national information infrastruc-
ture’’ means information infrastructure— 
(A)(i) that is owned, operated, or con-
trolled within or from the United States; or 
(ii) if located outside the United States, 
the disruption of which could result in national 
or regional catastrophic damage in the United 
States; and 
(B) that is not owned, operated, controlled, 
or licensed for use by a Federal agency. 
(15) NATIONAL SECURITY SYSTEM.—The term 
‘‘national security system’’ has the meaning given 
that term in section 3551 of title 44, United States 
Code, as added by this Act. 
(16) NATIONAL
STRATEGY.—The term ‘‘Na-
tional Strategy’’ means the national strategy to in-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
crease the security and resiliency of cyberspace de-
veloped under section 101(a)(1). 
(17) OFFICE.—The term ‘‘Office’’ means the 
Office of Cyberspace Policy established under section 
101. 
(18) RISK.—The term ‘‘risk’’ means the poten-
tial for an unwanted outcome resulting from an inci-
dent, as determined by the likelihood of the occur-
rence of the incident and the associated con-
sequences, including potential for an adverse out-
come 
assessed 
as 
a 
function 
of 
threats, 
vulnerabilities, and consequences associated with an 
incident. 
(19) RISK-BASED SECURITY.—The term ‘‘risk- 
based security’’ has the meaning given that term in 
section 3551 of title 44, United States Code, as 
added by this Act. 
TITLE I—OFFICE OF 
CYBERSPACE POLICY 
SEC. 101. ESTABLISHMENT OF THE OFFICE OF CYBER-
SPACE POLICY. 
(a) ESTABLISHMENT OF OFFICE.—There is estab-
lished in the Executive Office of the President an Office 
of Cyberspace Policy which shall— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(1) develop, not later than 1 year after the date 
of enactment of this Act, and update as needed, but 
not less frequently than once every 2 years, a na-
tional strategy to increase the security and resiliency 
of cyberspace, that includes goals and objectives re-
lating to— 
(A) computer network operations, includ-
ing offensive activities, defensive activities, and 
other activities; 
(B) information assurance; 
(C) protection of critical infrastructure and 
key resources; 
(D) research and development priorities; 
(E) law enforcement; 
(F) diplomacy; 
(G) homeland security; and 
(H) military and intelligence activities; 
(2) oversee, coordinate, and integrate all poli-
cies and activities of the Federal Government across 
all instruments of national power relating to ensur-
ing the security and resiliency of cyberspace, includ-
ing— 
(A) diplomatic, economic, military, intel-
ligence, homeland security, and law enforcement 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
policies and activities within and among Federal 
agencies; and 
(B) offensive activities, defensive activities, 
and other policies and activities necessary to en-
sure effective capabilities to operate in cyber-
space; 
(3) ensure that all Federal agencies comply 
with appropriate guidelines, policies, and directives 
from the Department of Homeland Security, other 
Federal agencies with responsibilities relating to 
cyberspace security or resiliency, and the National 
Center for Cybersecurity and Communications; and 
(4) ensure that Federal agencies have access to, 
receive, and appropriately disseminate law enforce-
ment information, intelligence information, terrorism 
information, and any other information (including 
information relating to incidents provided under sub-
sections (a)(4) and (c) of section 246 of the Home-
land Security Act of 2002, as added by this Act) rel-
evant to— 
(A) the security of the Federal information 
infrastructure or the national information infra-
structure; and 
(B) the security of— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(i) information infrastructure that is 
owned, operated, controlled, or licensed for 
use by, or on behalf of, the Department of 
Defense, a military department, or another 
element of the intelligence community; or 
(ii) a national security system. 
(b) DIRECTOR OF CYBERSPACE POLICY.— 
(1) IN GENERAL.—There shall be a Director of 
Cyberspace Policy, who shall be the head of the Of-
fice. 
(2) EXECUTIVE SCHEDULE POSITION.—Section 
5312 of title 5, United States Code, is amended by 
adding at the end the following: 
‘‘Director of Cyberspace Policy.’’. 
SEC. 102. APPOINTMENT AND RESPONSIBILITIES OF THE 
DIRECTOR. 
(a) APPOINTMENT.— 
(1) IN GENERAL.—The Director shall be ap-
pointed by the President, by and with the advice and 
consent of the Senate. 
(2) QUALIFICATIONS.—The President shall ap-
point the Director from among individuals who have 
demonstrated ability and knowledge in information 
technology, cybersecurity, and the operations, secu-
rity, and resiliency of communications networks. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(3) PROHIBITION.—No person shall serve as 
Director while serving in any other position in the 
Federal Government. 
(b) RESPONSIBILITIES.—The Director shall— 
(1) advise the President regarding the estab-
lishment of policies, goals, objectives, and priorities 
for securing the information infrastructure of the 
Nation; 
(2) advise the President and other entities with-
in the Executive Office of the President regarding 
mechanisms to build, and improve the resiliency and 
efficiency of, the information and communication in-
dustry of the Nation, in collaboration with the pri-
vate sector, while promoting national economic inter-
ests; 
(3) work with Federal agencies to— 
(A) oversee, coordinate, and integrate the 
implementation of the National Strategy, in-
cluding coordination with— 
(i) the Department of Homeland Se-
curity; 
(ii) the Department of Defense; 
(iii) the Department of Commerce; 
(iv) the Department of State; 
(v) the Department of Justice; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(vi) the Department of Energy; 
(vii) through the Director of National 
Intelligence, the intelligence community; 
and 
(viii) and any other Federal agency 
with responsibilities relating to the Na-
tional Strategy; and 
(B) resolve any disputes that arise between 
Federal agencies relating to the National Strat-
egy or other matters within the responsibility of 
the Office; 
(4) if the policies or activities of a Federal 
agency are not in compliance with the responsibil-
ities of the Federal agency under the National Strat-
egy— 
(A) notify the Federal agency; 
(B) transmit a copy of each notification 
under subparagraph (A) to the President and 
the appropriate congressional committees; and 
(C) coordinate the efforts to bring the 
Federal agency into compliance; 
(5) ensure the adequacy of protections for pri-
vacy and civil liberties in carrying out the respon-
sibilities of the Director under this title, including 
through consultation with the Privacy and Civil Lib-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
erties Oversight Board established under section 
1061 of the National Security Intelligence Reform 
Act of 2004 (42 U.S.C. 2000ee); 
(6) upon reasonable request, appear before any 
duly constituted committees of the Senate or of the 
House of Representatives; 
(7) recommend to the Office of Management 
and Budget or the head of a Federal agency actions 
(including requests to Congress relating to the re-
programming of funds) that the Director determines 
are necessary to ensure risk-based security of— 
(A) the Federal information infrastructure; 
(B) information infrastructure that is 
owned, operated, controlled, or licensed for use 
by, or on behalf of, the Department of Defense, 
a military department, or another element of 
the intelligence community; or 
(C) a national security system; 
(8) advise the Administrator of the Office of E- 
Government and Information Technology and the 
Administrator of the Office of Information and Reg-
ulatory Affairs on the development, and oversee the 
implementation, of policies, principles, standards, 
guidelines, and budget priorities for information 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
technology functions and activities of the Federal 
Government; 
(9) coordinate and ensure, to the maximum ex-
tent practicable, that the standards and guidelines 
developed for national security systems and the 
standards and guidelines under section 20 of the 
National Institute of Standards and Technology Act 
(15 U.S.C. 278g–3) are complementary and unified; 
(10) in consultation with the Administrator of 
the Office of Information and Regulatory Affairs, 
coordinate efforts of Federal agencies relating to the 
development of regulations, rules, requirements, or 
other actions applicable to the national information 
infrastructure to ensure, to the maximum extent 
practicable, that the efforts are complementary; 
(11) coordinate the activities of the Office of 
Science and Technology Policy, the National Eco-
nomic Council, the Office of Management and Budg-
et, the National Security Council, the Homeland Se-
curity Council, and the United States Trade Rep-
resentative related to the National Strategy and 
other matters within the purview of the Office; and 
(12) as assigned by the President, other duties 
relating to the security and resiliency of cyberspace. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
SEC. 103. PROHIBITION ON POLITICAL CAMPAIGNING. 
Section 7323(b)(2)(B) of title 5, United States Code, 
is amended— 
(1) in clause (i), by striking ‘‘or’’ at the end; 
(2) in clause (ii), by striking the period at the 
end and inserting ‘‘; or’’; and 
(3) by adding at the end the following: 
‘‘(iii) notwithstanding the exception 
under subparagraph (A) (relating to an ap-
pointment made by the President, by and 
with the advice and consent of the Senate), 
the Director of Cyberspace Policy.’’. 
SEC. 104. REVIEW OF FEDERAL AGENCY BUDGET RE-
QUESTS RELATING TO THE NATIONAL STRAT-
EGY. 
(a) IN GENERAL.—For each fiscal year, the head of 
each Federal agency shall transmit to the Director a copy 
of any portion of the budget of the Federal agency in-
tended to implement the National Strategy at the same 
time as that budget request is submitted to the Office of 
Management and Budget in the preparation of the budget 
of the President submitted to Congress under section 
1105 (a) of title 31, United States Code. 
(b) TIMELY SUBMISSIONS.—The head of each Fed-
eral agency shall ensure the timely development and sub-
mission to the Director of each proposed budget under this 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
section, in such format as may be designated by the Direc-
tor with the concurrence of the Director of the Office of 
Management and Budget. 
(c) ADEQUACY
OF
THE PROPOSED BUDGET RE-
QUESTS.—With the assistance of, and in coordination 
with, the Office of E-Government and Information Tech-
nology and the National Center for Cybersecurity and 
Communications, the Director shall review each budget 
submission to assess the adequacy of the proposed request 
with regard to implementation of the National Strategy. 
(d) INADEQUATE BUDGET REQUESTS.—If the Direc-
tor concludes that a budget request submitted under sub-
section (a) is inadequate, in whole or in part, to implement 
the objectives of the National Strategy, the Director shall 
submit to the Director of the Office of Management and 
Budget and the head of the Federal agency submitting 
the budget request a written description of funding levels 
and specific initiatives that would, in the determination 
of the Director, make the request adequate. 
SEC. 105. ACCESS TO INTELLIGENCE. 
The Director shall have access to law enforcement in-
formation, intelligence information, terrorism information, 
and any other information (including information relating 
to incidents provided under subsections (a)(4) and (c) of 
section 246 of the Homeland Security Act of 2002, as 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
added by this Act) that is obtained by, or in the possession 
of, any Federal agency that the Director determines rel-
evant to the security of— 
(1) the Federal information infrastructure; 
(2) information infrastructure that is owned, 
operated, controlled, or licensed for use by, or on be-
half of, the Department of Defense, a military de-
partment, or another element of the intelligence 
community; 
(3) a national security system; or 
(4) national information infrastructure. 
SEC. 106. CONSULTATION. 
(a) IN GENERAL.—The Director may consult and ob-
tain recommendations from, as needed, such Presidential 
and other advisory entities as the Director determines will 
assist in carrying out the mission of the Office, includ-
ing— 
(1) the National Security Telecommunications 
Advisory Committee; 
(2) the National Infrastructure Advisory Coun-
cil; 
(3) the Privacy and Civil Liberties Oversight 
Board; 
(4) the President’s Intelligence Advisory Board; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(5) the Critical Infrastructure Partnership Ad-
visory Council; and 
(6) the National Cybersecurity Advisory Council 
established under section 239 of the Homeland Se-
curity Act of 2002, as added by this Act. 
(b) NATIONAL STRATEGY.—In developing and updat-
ing the National Strategy the Director shall consult with 
the National Cybersecurity Advisory Council and, as ap-
propriate, State and local governments and private enti-
ties. 
SEC. 107. REPORTS TO CONGRESS. 
(a) IN GENERAL.—The Director shall submit an an-
nual report to the appropriate congressional committees 
describing the activities, ongoing projects, and plans of the 
Federal Government designed to meet the goals and objec-
tives of the National Strategy. 
(b) CLASSIFIED ANNEX.—A report submitted under 
this section shall be submitted in an unclassified form, but 
may include a classified annex, if necessary. 
(c) PUBLIC REPORT.—An unclassified version of 
each report submitted under this section shall be made 
available to the public. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
TITLE 
II—NATIONAL 
CENTER 
FOR 
CYBERSECURITY 
AND 
COMMUNICATIONS 
SEC. 201. CYBERSECURITY. 
Title II of the Homeland Security Act of 2002 (6 
U.S.C. 121 et seq.) is amended by adding at the end the 
following: 
‘‘Subtitle E—Cybersecurity 
‘‘SEC. 241. DEFINITIONS. 
‘‘In this subtitle— 
‘‘(1) the term ‘agency information infrastruc-
ture’ means the Federal information infrastructure 
of a particular Federal agency; 
‘‘(2) the term ‘appropriate committees of Con-
gress’ means the Committee on Homeland Security 
and Governmental Affairs of the Senate and the 
Committee on Homeland Security of the House of 
Representatives; 
‘‘(3) the term ‘Center’ means the National Cen-
ter for Cybersecurity and Communications estab-
lished under section 242(a); 
‘‘(4) the term ‘covered critical infrastructure’ 
means a system or asset— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) that is on the prioritized critical in-
frastructure list established by the Secretary 
under section 210E(a)(2); and 
‘‘(B)(i) that is a component of the national 
information infrastructure; or 
‘‘(ii) for which the national information in-
frastructure is essential to the reliable operation 
of the system or asset; 
‘‘(5) the term ‘cyber vulnerability’ means any 
security vulnerability that, if exploited, could pose a 
significant risk of disruption to the operation of in-
formation infrastructure essential to the reliable op-
eration of covered critical infrastructure; 
‘‘(6) the term ‘Director’ means the Director of 
the Center appointed under section 242(b)(1); 
‘‘(7) the term ‘Federal agency’— 
‘‘(A) means any executive department, 
military department, Government corporation, 
Government-controlled corporation, or other es-
tablishment in the executive branch of the Gov-
ernment (including the Executive Office of the 
President), or any independent regulatory agen-
cy; and 
‘‘(B) does not include the governments of 
the District of Columbia and of the territories 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
and possessions of the United States and their 
various subdivisions; 
‘‘(8) the term ‘Federal information infrastruc-
ture’— 
‘‘(A) means information infrastructure 
that is owned, operated, controlled, or licensed 
for use by, or on behalf of, any Federal agency, 
including information systems used or operated 
by another entity on behalf of a Federal agency; 
and 
‘‘(B) does not include— 
‘‘(i) a national security system; or 
‘‘(ii) information infrastructure that is 
owned, operated, controlled, or licensed for 
use by, or on behalf of, the Department of 
Defense, a military department, or another 
element of the intelligence community; 
‘‘(9) the term ‘incident’ means an occurrence 
that— 
‘‘(A) actually or potentially jeopardizes— 
‘‘(i) the information security of infor-
mation infrastructure; or 
‘‘(ii) the information that information 
infrastructure processes, stores, receives, 
or transmits; or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(B) constitutes a violation or threat of 
violation of security policies, security proce-
dures, or acceptable use policies applicable to 
information infrastructure. 
‘‘(10) the term ‘information infrastructure’ 
means the underlying framework that information 
systems and assets rely on to process, transmit, re-
ceive, or store information electronically, including— 
‘‘(A) programmable electronic devices and 
communications networks; and 
‘‘(B) any associated hardware, software, or 
data; 
‘‘(11) the term ‘information security’ means 
protecting information and information systems 
from disruption or unauthorized access, use, disclo-
sure, modification, or destruction in order to pro-
vide— 
‘‘(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
‘‘(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(17) the term ‘national cyber emergency’ 
means an actual or imminent action by any indi-
vidual or entity to exploit a cyber vulnerability in a 
manner that disrupts, attempts to disrupt, or poses 
a significant risk of disruption to the operation of 
the information infrastructure essential to the reli-
able operation of covered critical infrastructure; 
‘‘(18) the term ‘national information infrastruc-
ture’ means information infrastructure— 
‘‘(A)(i) that is owned, operated, or con-
trolled within or from the United States; or 
‘‘(ii) if located outside the United States, 
the disruption of which could result in national 
or regional catastrophic damage in the United 
States; and 
‘‘(B) that is not owned, operated, con-
trolled, or licensed for use by a Federal agency; 
‘‘(19) the term ‘national security system’ has 
the same meaning given that term in section 3551 
of title 44, United States Code; 
‘‘(20) the term ‘operational controls’ means the 
safeguards and countermeasures for an information 
system that are primarily implemented and executed 
by individuals not systems; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(21) the term ‘sector-specific agency’ means 
the relevant Federal agency responsible for infra-
structure protection activities in a designated critical 
infrastructure sector or key resources category under 
the National Infrastructure Protection Plan, or any 
other appropriate Federal agency identified by the 
President after the date of enactment of this sub-
title; 
‘‘(22) the term ‘sector coordinating councils’ 
means self-governed councils that are composed of 
representatives of key stakeholders within a specific 
sector of critical infrastructure that serve as the 
principal private sector policy coordination and plan-
ning entities with the Federal Government relating 
to the security and resiliency of the critical infra-
structure that comprise that sector; 
‘‘(23) the term ‘security controls’ means the 
management, operational, and technical controls pre-
scribed for an information system to protect the in-
formation security of the system; 
‘‘(24) the term ‘small business concern’ has the 
meaning given that term under section 3 of the 
Small Business Act (15 U.S.C. 632); 
‘‘(25) the term ‘technical controls’ means the 
safeguards or countermeasures for an information 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
system that are primarily implemented and executed 
by the information system through mechanisms con-
tained in the hardware, software, or firmware com-
ponents of the system; 
‘‘(26) the term ‘terrorism information’ has the 
meaning given that term in section 1016 of the In-
telligence Reform and Terrorism Prevention Act of 
2004 (6 U.S.C. 485); 
‘‘(27) the term ‘United States person’ has the 
meaning given that term in section 101 of the For-
eign Intelligence Surveillance Act of 1978 (50 
U.S.C. 1801); and 
‘‘(28) the term ‘US–CERT’ means the United 
States Computer Readiness Team established under 
section 244. 
‘‘SEC. 242. NATIONAL CENTER FOR CYBERSECURITY AND 
COMMUNICATIONS. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN GENERAL.—There is established within 
the Department a National Center for Cybersecurity 
and Communications. 
‘‘(2) 
OPERATIONAL
ENTITY.—The 
Center 
may— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) enter into contracts for the procure-
ment of property and services for the Center; 
and 
‘‘(B) appoint employees of the Center in 
accordance with the civil service laws of the 
United States. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Center shall be headed 
by a Director, who shall be appointed by the Presi-
dent, by and with the advice and consent of the Sen-
ate. 
‘‘(2) REPORTING TO SECRETARY.—The Direc-
tor shall report directly to the Secretary and serve 
as the principal advisor to the Secretary on cyberse-
curity and the operations, security, and resiliency of 
the communications infrastructure of the United 
States. 
‘‘(3) PRESIDENTIAL
ADVICE.—The Director 
shall regularly advise the President on the exercise 
of the authorities provided under this subtitle or any 
other provision of law relating to the security of the 
Federal information infrastructure or an agency in-
formation infrastructure. 
‘‘(4) QUALIFICATIONS.—The Director shall be 
appointed from among individuals who have— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) a demonstrated ability in and knowl-
edge of information technology, cybersecurity, 
and the operations, security and resiliency of 
communications networks; and 
‘‘(B) significant executive leadership and 
management experience in the public or private 
sector. 
‘‘(5) LIMITATION ON SERVICE.— 
‘‘(A) IN
GENERAL.—Subject to subpara-
graph (B), the individual serving as the Direc-
tor may not, while so serving, serve in any 
other capacity in the Federal Government, ex-
cept to the extent that the individual serving as 
Director is doing so in an acting capacity. 
‘‘(B) 
EXCEPTION.—The 
Director 
may 
serve on any commission, board, council, or 
similar entity with responsibilities or duties re-
lating to cybersecurity or the operations, secu-
rity, and resiliency of the communications infra-
structure of the United States at the direction 
of the President or as otherwise provided by 
law. 
‘‘(c) DEPUTY DIRECTORS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(1) IN
GENERAL.—There shall be not less 
than 2 Deputy Directors for the Center, who shall 
report to the Director. 
‘‘(2) INFRASTRUCTURE PROTECTION.— 
‘‘(A) APPOINTMENT.—There shall be a 
Deputy Director appointed by the Secretary, 
who shall have expertise in infrastructure pro-
tection. 
‘‘(B) RESPONSIBILITIES.—The Deputy Di-
rector appointed under subparagraph (A) 
shall— 
‘‘(i) assist the Director and the As-
sistant Secretary for Infrastructure Protec-
tion in coordinating, managing, and direct-
ing the information, communications, and 
physical infrastructure protection respon-
sibilities and activities of the Department, 
including activities under Homeland Secu-
rity Presidential Directive–7, or any suc-
cessor thereto, and the National Infra-
structure Protection Plan, or any successor 
thereto; 
‘‘(ii) review the budget for the Center 
and the Office of Infrastructure Protection 
before submission of the budget to the Sec-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(3) INTELLIGENCE COMMUNITY.—The Direc-
tor of National Intelligence shall identify an em-
ployee of an element of the intelligence community 
to serve as a Deputy Director of the Center. The 
employee shall be detailed to the Center on a reim-
bursable basis for such period as is agreed to by the 
Director and the Director of National Intelligence, 
and, while serving as Deputy Director, shall report 
directly to the Director of the Center. 
‘‘(d) LIAISON OFFICERS.—The Secretary of Defense, 
the Attorney General, the Secretary of Commerce, and the 
Director of National Intelligence shall detail personnel to 
the Center to act as full-time liaisons with the Department 
of Defense, the Department of Justice, the National Insti-
tute of Standards and Technology, and elements of the 
intelligence community to assist in coordination between 
and among the Center, the Department of Defense, the 
Department of Justice, the National Institute of Stand-
ards and Technology, and elements of the intelligence 
community. 
‘‘(e) PRIVACY OFFICER.— 
‘‘(1) IN GENERAL.—The Director, in consulta-
tion with the Secretary, shall designate a full-time 
privacy officer, who shall report to the Director. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(2) DUTIES.—The privacy officer designated 
under paragraph (1) shall have primary responsi-
bility for implementation by the Center of the pri-
vacy policy for the Department established by the 
Privacy Officer appointed under section 222. 
‘‘(f) DUTIES OF DIRECTOR.— 
‘‘(1) IN GENERAL.—The Director shall— 
‘‘(A) working cooperatively with the private 
sector, lead the Federal effort to secure, pro-
tect, and ensure the resiliency of the Federal in-
formation infrastructure and national informa-
tion infrastructure of the United States, includ-
ing communications networks; 
‘‘(B) assist in the identification, remedi-
ation, and mitigation of vulnerabilities to the 
Federal information infrastructure and the na-
tional information infrastructure; 
‘‘(C) provide dynamic, comprehensive, and 
continuous situational awareness of the security 
status of the Federal information infrastruc-
ture, national information infrastructure, and 
information infrastructure that is owned, oper-
ated, controlled, or licensed for use by, or on 
behalf of, the Department of Defense, a mili-
tary department, or another element of the in-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
telligence community by sharing and inte-
grating classified and unclassified information, 
including 
information 
relating 
to 
threats, 
vulnerabilities, traffic, trends, incidents, and 
other anomalous activities affecting the infra-
structure or systems, on a routine and contin-
uous basis with— 
‘‘(i) the National Threat Operations 
Center of the National Security Agency; 
‘‘(ii) the United States Cyber Com-
mand, including the Joint Task Force- 
Global Network Operations; 
‘‘(iii) the Cyber Crime Center of the 
Department of Defense; 
‘‘(iv) the National Cyber Investigative 
Joint Task Force; 
‘‘(v) the Intelligence Community Inci-
dent Response Center; 
‘‘(vi) any other Federal agency, or 
component thereof, identified by the Direc-
tor; and 
‘‘(vii) any non-Federal entity, includ-
ing, where appropriate, information shar-
ing and analysis centers, identified by the 
Director, with the concurrence of the 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
owner or operator of that entity and con-
sistent with applicable law; 
‘‘(D) work with the entities described in 
subparagraph (C) to establish policies and pro-
cedures that enable information sharing be-
tween and among the entities; 
‘‘(E) develop, in coordination with the As-
sistant Secretary for Infrastructure Protection, 
other Federal agencies, the private sector, and 
State and local governments, a national incident 
response plan that details the roles of Federal 
agencies, State and local governments, and the 
private sector, including plans to be executed in 
response to a declaration of a national cyber 
emergency by the President under section 249; 
‘‘(F) conduct risk-based assessments of the 
Federal information infrastructure with respect 
to acts of terrorism, natural disasters, and 
other large-scale disruptions and provide the re-
sults of the assessments to the Director of 
Cyberspace Policy; 
‘‘(G) develop, oversee the implementation 
of, and enforce policies, principles, and guide-
lines on information security for the Federal in-
formation infrastructure, including timely adop-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
tion of and compliance with standards devel-
oped by the National Institute of Standards 
and Technology under section 20 of the Na-
tional Institute of Standards and Technology 
Act (15 U.S.C. 278g–3); 
‘‘(H) provide assistance to the National In-
stitute of Standards and Technology in devel-
oping standards under section 20 of the Na-
tional Institute of Standards and Technology 
Act (15 U.S.C. 278g–3); 
‘‘(I) provide to Federal agencies manda-
tory security controls to mitigate and remediate 
vulnerabilities of and incidents affecting the 
Federal information infrastructure; 
‘‘(J) subject to paragraph (2), and as 
needed, assist the Director of the Office of 
Management and Budget and the Director of 
Cyberspace Policy in conducting analysis and 
prioritization of budgets, relating to the secu-
rity of the Federal information infrastructure; 
‘‘(K) in accordance with section 253, de-
velop, periodically update, and implement a 
supply chain risk management strategy to en-
hance, in a risk-based and cost-effective man-
ner, the security of the communications and in-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
formation technology products and services pur-
chased by the Federal Government; 
‘‘(L) notify the Director of Cyberspace 
Policy of any incident involving the Federal in-
formation infrastructure, information infra-
structure that is owned, operated, controlled, or 
licensed for use by, or on behalf of, the Depart-
ment of Defense, a military department, or an-
other element of the intelligence community, or 
the national information infrastructure that 
could compromise or significantly affect eco-
nomic or national security; 
‘‘(M) consult, in coordination with the Di-
rector of Cyberspace Policy, with appropriate 
international partners to enhance the security 
of the Federal information infrastructure and 
national information infrastructure; 
‘‘(N)(i) coordinate and integrate informa-
tion to analyze the composite security state of 
the Federal information infrastructure and in-
formation infrastructure that is owned, oper-
ated, controlled, or licensed for use by, or on 
behalf of, the Department of Defense, a mili-
tary department, or another element of the in-
telligence community; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(ii) ensure the information required under 
clause (i) and section 3553(c)(1)(A) of title 44, 
United States Code, including the views of the 
Director on the adequacy and effectiveness of 
information security throughout the Federal in-
formation infrastructure and information infra-
structure that is owned, operated, controlled, or 
licensed for use by, or on behalf of, the Depart-
ment of Defense, a military department, or an-
other element of the intelligence community, is 
available on an automated and continuous basis 
through the system maintained under section 
3552(a)(3)(D) of title 44, United States Code; 
‘‘(iii) in conjunction with the quadrennial 
homeland security review required under section 
707, and at such other times determined appro-
priate by the Director, analyze the composite 
security state of the national information infra-
structure and submit to the President, Con-
gress, and the Secretary a report regarding ac-
tions necessary to enhance the composite secu-
rity state of the national information infrastruc-
ture based on the analysis; and 
‘‘(iv) foster collaboration and serve as the 
primary contact between the Federal Govern-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
ment, State and local governments, and private 
entities on matters relating to the security of 
the Federal information infrastructure and the 
national information infrastructure; 
‘‘(O) oversee the development, implementa-
tion, and management of security requirements 
for Federal agencies relating to the external ac-
cess points to or from the Federal information 
infrastructure; 
‘‘(P) establish, develop, and oversee the ca-
pabilities and operations within the US–CERT 
as required by section 244; 
‘‘(Q) oversee the operations of the National 
Communications System, as described in Execu-
tive Order 12472 (49 Fed. Reg. 13471; relating 
to the assignment of national security and 
emergency 
preparedness 
telecommunications 
functions), as amended by Executive Order 
13286 (68 Fed. Reg. 10619) and Executive 
Order 13407 (71 Fed. Reg. 36975), or any suc-
cessor thereto, including planning for and pro-
viding communications for the Federal Govern-
ment under all circumstances, including crises, 
emergencies, attacks, recoveries, and reconstitu-
tions; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(R) ensure, in coordination with the pri-
vacy officer designated under subsection (e), the 
Privacy Officer appointed under section 222, 
and the Director of the Office of Civil Rights 
and Civil Liberties appointed under section 705, 
that the activities of the Center comply with all 
policies, regulations, and laws protecting the 
privacy and civil liberties of United States per-
sons; 
‘‘(S) subject to the availability of re-
sources, and at the discretion of the Director, 
provide voluntary technical assistance— 
‘‘(i) at the request of an owner or op-
erator of covered critical infrastructure, to 
assist the owner or operator in complying 
with sections 248 and 249, including im-
plementing required security or emergency 
measures and developing response plans 
for national cyber emergencies declared 
under section 249; and 
‘‘(ii) at the request of the owner or 
operator of national information infra-
structure that is not covered critical infra-
structure, and based on risk, to assist the 
owner or operator in implementing best 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
practices, and related standards and guide-
lines, recommended under section 247 and 
other measures necessary to mitigate or re-
mediate vulnerabilities of the information 
infrastructure and the consequences of ef-
forts to exploit the vulnerabilities; 
‘‘(T)(i) conduct, in consultation with the 
National Cybersecurity Advisory Council, the 
head of appropriate sector-specific agencies, and 
any private sector entity determined appro-
priate by the Director, risk-based assessments 
of national information infrastructure, on a sec-
tor-by-sector basis, with respect to acts of ter-
rorism, natural disasters, and other large-scale 
disruptions or financial harm, which shall iden-
tify and prioritize risks to the national informa-
tion infrastructure, including vulnerabilities and 
associated consequences; and 
‘‘(ii) coordinate and evaluate the mitigation 
or remediation of cyber vulnerabilities and con-
sequences identified under clause (i); 
‘‘(U) regularly evaluate and assess tech-
nologies designed to enhance the protection of 
the Federal information infrastructure and na-
tional information infrastructure, including an 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
assessment of the cost-effectiveness of the tech-
nologies; 
‘‘(V) promote the use of the best practices 
recommended under section 247 to State and 
local governments and the private sector; 
‘‘(W) develop and implement outreach and 
awareness programs on cybersecurity, includ-
ing— 
‘‘(i) a public education campaign to 
increase the awareness of cybersecurity, 
cyber safety, and cyber ethics, which shall 
include use of the Internet, social media, 
entertainment, and other media to reach 
the public; 
‘‘(ii) an education campaign to in-
crease the understanding of State and local 
governments and private sector entities of 
the costs of failing to ensure effective secu-
rity of information infrastructure and cost- 
effective methods to mitigate and reme-
diate vulnerabilities; and 
‘‘(iii) 
outcome-based 
performance 
measures to determine the success of the 
programs; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(X) develop and implement a national cy-
bersecurity exercise program that includes— 
‘‘(i) the participation of State and 
local governments, international partners 
of the United States, and the private sec-
tor; and 
‘‘(ii) an after action report analyzing 
lessons learned from exercises and identi-
fying vulnerabilities to be remediated or 
mitigated; 
‘‘(Y) coordinate with the Assistant Sec-
retary for Infrastructure Protection to ensure 
that— 
‘‘(i) cybersecurity is appropriately ad-
dressed in carrying out the infrastructure 
protection responsibilities described in sec-
tion 201(d); and 
‘‘(ii) the operations of the Center and 
the Office of Infrastructure Protection 
avoid duplication and use, to the maximum 
extent practicable, joint mechanisms for in-
formation sharing and coordination with 
the private sector; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(Z) oversee the activities of the Office of 
Emergency Communications established under 
section 1801; and 
‘‘(AA) perform such other duties as the 
Secretary may direct relating to the security 
and resiliency of the information and commu-
nications infrastructure of the United States. 
‘‘(2) BUDGET ANALYSIS.—In conducting anal-
ysis and prioritization of budgets under paragraph 
(1)(J), the Director— 
‘‘(A) in coordination with the Director of 
the Office of Management and Budget, may ac-
cess information from any Federal agency re-
garding the finances, budget, and programs of 
the Federal agency relevant to the security of 
the Federal information infrastructure; 
‘‘(B) may make recommendations to the 
Director of the Office of Management and 
Budget and the Director of Cyberspace Policy 
regarding the budget for each Federal agency 
to ensure that adequate funding is devoted to 
securing the Federal information infrastructure, 
in accordance with policies, principles, and 
guidelines established by the Director under 
this subtitle; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(C) shall provide copies of any rec-
ommendations made under subparagraph (B) 
to— 
‘‘(i) the Committee on Appropriations 
of the Senate; 
‘‘(ii) the Committee on Appropriations 
of the House of Representatives; and 
‘‘(iii) the appropriate committees of 
Congress. 
‘‘(g) USE OF MECHANISMS FOR COLLABORATION.— 
In carrying out the responsibilities and authorities of the 
Director under this subtitle, to the maximum extent prac-
ticable, the Director shall use mechanisms for collabora-
tion and information sharing (including mechanisms relat-
ing to the identification and communication of threats, 
vulnerabilities, and associated consequences) established 
by other components of the Department or other Federal 
agencies to avoid unnecessary duplication or waste. 
‘‘(h) SUFFICIENCY OF RESOURCES PLAN.— 
‘‘(1) REPORT.—Not later than 120 days after 
the date of enactment of this subtitle, the Director 
of the Office of Management and Budget shall sub-
mit to the appropriate committees of Congress and 
the Comptroller General of the United States a re-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
port on the resources and staff necessary to carry 
out fully the responsibilities under this subtitle. 
‘‘(2) COMPTROLLER GENERAL REVIEW.— 
‘‘(A) IN GENERAL.—The Comptroller Gen-
eral of the United States shall evaluate the rea-
sonableness and adequacy of the report sub-
mitted by the Director under paragraph (1). 
‘‘(B) REPORT.—Not later than 60 days 
after the date on which the report is submitted 
under paragraph (1), the Comptroller General 
shall submit to the appropriate committees of 
Congress a report containing the findings of the 
review under subparagraph (A). 
‘‘(i) FUNCTIONS TRANSFERRED.—There are trans-
ferred to the Center the National Cyber Security Division, 
the Office of Emergency Communications, and the Na-
tional Communications System, including all the func-
tions, personnel, assets, authorities, and liabilities of the 
National Cyber Security Division and the National Com-
munications System. 
‘‘SEC. 243. PHYSICAL AND CYBER INFRASTRUCTURE COL-
LABORATION. 
‘‘(a) IN GENERAL.—The Director and the Assistant 
Secretary for Infrastructure Protection shall coordinate 
the information, communications, and physical infrastruc-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
ture protection responsibilities and activities of the Center 
and the Office of Infrastructure Protection. 
‘‘(b) OVERSIGHT.—The Secretary shall ensure that 
the coordination described in subsection (a) occurs. 
‘‘SEC. 244. UNITED STATES COMPUTER EMERGENCY READI-
NESS TEAM. 
‘‘(a) ESTABLISHMENT OF OFFICE.—There is estab-
lished within the Center, the United States Computer 
Emergency Readiness Team, which shall be headed by a 
Director, who shall be selected from the Senior Executive 
Service by the Secretary. 
‘‘(b) RESPONSIBILITIES.—The US–CERT shall— 
‘‘(1) collect, coordinate, and disseminate infor-
mation on— 
‘‘(A) risks to the Federal information in-
frastructure, information infrastructure that is 
owned, operated, controlled, or licensed for use 
by, or on behalf of, the Department of Defense, 
a military department, or another element of 
the intelligence community, or the national in-
formation infrastructure; and 
‘‘(B) security controls to enhance the secu-
rity of the Federal information infrastructure 
or the national information infrastructure 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
against the risks identified in subparagraph 
(A); and 
‘‘(2) establish a mechanism for engagement 
with the private sector. 
‘‘(c) MONITORING, ANALYSIS, WARNING, AND RE-
SPONSE.— 
‘‘(1) DUTIES.—Subject to paragraph (2), the 
US–CERT shall— 
‘‘(A) provide analysis and reports to Fed-
eral agencies on the security of the Federal in-
formation infrastructure; 
‘‘(B) provide continuous, automated moni-
toring of the Federal information infrastructure 
at external Internet access points, which shall 
include detection and warning of threats, 
vulnerabilities, traffic, trends, incidents, and 
other anomalous activities affecting the infor-
mation security of the Federal information in-
frastructure; 
‘‘(C) warn Federal agencies of threats, 
vulnerabilities, incidents, and anomalous activi-
ties that could affect the Federal information 
infrastructure; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(D) develop, recommend, and deploy secu-
rity 
controls 
to 
mitigate 
or 
remediate 
vulnerabilities; 
‘‘(E) support Federal agencies in con-
ducting risk assessments of the agency informa-
tion infrastructure; 
‘‘(F) disseminate to Federal agencies risk 
analyses of incidents that could impair the risk- 
based security of the Federal information infra-
structure; 
‘‘(G) develop and acquire predictive ana-
lytic tools to evaluate threats, vulnerabilities, 
traffic, trends, incidents, and anomalous activi-
ties; 
‘‘(H) aid in the detection of, and warn 
owners or operators of national information in-
frastructure regarding, threats, vulnerabilities, 
and incidents, affecting the national informa-
tion infrastructure, including providing— 
‘‘(i) timely, targeted, and actionable 
notifications of threats, vulnerabilities, and 
incidents; and 
‘‘(ii) recommended security controls to 
mitigate or remediate vulnerabilities; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(I) respond to assistance requests from 
Federal agencies and, subject to the availability 
of resources, owners or operators of the na-
tional information infrastructure to— 
‘‘(i) isolate, mitigate, or remediate in-
cidents; 
‘‘(ii) recover from damages and miti-
gate or remediate vulnerabilities; and 
‘‘(iii) evaluate security controls and 
other actions taken to secure information 
infrastructure 
and 
incorporate 
lessons 
learned into best practices, policies, prin-
ciples, and guidelines. 
‘‘(2) REQUIREMENT.—With respect to the Fed-
eral information infrastructure, the US–CERT shall 
conduct the activities described in paragraph (1) in 
a manner consistent with the responsibilities of the 
head of a Federal agency described in section 3553 
of title 44, United States Code. 
‘‘(3) REPORT.—Not later than 1 year after the 
date of enactment of this subtitle, and every year 
thereafter, the Secretary shall— 
‘‘(A) in conjunction with the Inspector 
General of the Department, conduct an inde-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
pendent audit or review of the activities of the 
US–CERT under paragraph (1)(B); and 
‘‘(B) submit to the appropriate committees 
of Congress and the President a report regard-
ing the audit or report. 
‘‘(d) PROCEDURES FOR FEDERAL GOVERNMENT.— 
Not later than 90 days after the date of enactment of this 
subtitle, the head of each Federal agency shall establish 
procedures for the Federal agency that ensure that the 
US–CERT can perform the functions described in sub-
section (c) in relation to the Federal agency. 
‘‘(e) OPERATIONAL UPDATES.—The US–CERT shall 
provide unclassified and, as appropriate, classified updates 
regarding the composite security state of the Federal in-
formation infrastructure to the Federal Information Secu-
rity Taskforce. 
‘‘(f) FEDERAL POINTS OF CONTACT.—The Director 
of the US–CERT shall designate a principal point of con-
tact within the US–CERT for each Federal agency to— 
‘‘(1) maintain communication; 
‘‘(2) ensure cooperative engagement and infor-
mation sharing; and 
‘‘(3) respond to inquiries or requests. 
‘‘(g) REQUESTS FOR INFORMATION OR PHYSICAL AC-
CESS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(1) INFORMATION ACCESS.—Upon request of 
the Director of the US–CERT, the head of a Fed-
eral agency or an Inspector General for a Federal 
agency shall provide any law enforcement informa-
tion, intelligence information, terrorism information, 
or any other information (including information re-
lating to incidents provided under subsections (a)(4) 
and (c) of section 246) relevant to the security of 
the Federal information infrastructure or the na-
tional information infrastructure necessary to carry 
out the duties, responsibilities, and authorities under 
this subtitle. 
‘‘(2) PHYSICAL ACCESS.—Upon request of the 
Director, and in consultation with the head of a 
Federal agency, the Federal agency shall provide 
physical access to any facility of the Federal agency 
necessary to determine whether the Federal agency 
is in compliance with any policies, principles, and 
guidelines established by the Director under this 
subtitle, or otherwise necessary to carry out the du-
ties, responsibilities, and authorities of the Director 
applicable to the Federal information infrastructure. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘SEC. 245. ADDITIONAL AUTHORITIES OF THE DIRECTOR 
OF THE NATIONAL CENTER FOR CYBERSECU-
RITY AND COMMUNICATIONS. 
‘‘(a) ACCESS TO INFORMATION.—Unless otherwise 
directed by the President— 
‘‘(1) the Director shall access, receive, and ana-
lyze law enforcement information, intelligence infor-
mation, terrorism information, and any other infor-
mation (including information relating to incidents 
provided under subsections (a)(4) and (c) of section 
246) relevant to the security of the Federal informa-
tion infrastructure, information infrastructure that 
is owned, operated, controlled, or licensed for use by, 
or on behalf of, the Department of Defense, a mili-
tary department, or another element of the intel-
ligence community, or national information infra-
structure from Federal agencies and, consistent with 
applicable law, State and local governments (includ-
ing law enforcement agencies), and private entities, 
including information provided by any contractor to 
a Federal agency regarding the security of the agen-
cy information infrastructure; 
‘‘(2) any Federal agency in possession of law 
enforcement information, intelligence information, 
terrorism information, or any other information (in-
cluding information relating to incidents provided 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
under subsections (a)(4) and (c) of section 246) rel-
evant to the security of the Federal information in-
frastructure, information infrastructure that is 
owned, operated, controlled, or licensed for use by, 
or on behalf of, the Department of Defense, a mili-
tary department, or another element of the intel-
ligence community, or national information infra-
structure shall provide that information to the Di-
rector in a timely manner; and 
‘‘(3) the Director, in coordination with the At-
torney General, the Privacy and Civil Liberties Over-
sight Board established under section 1061 of the 
National Security Intelligence Reform Act of 2004 
(42 U.S.C. 2000ee), the Director of National Intel-
ligence, and the Archivist of the United States, shall 
establish guidelines to ensure that information is 
transferred, stored, and preserved in accordance 
with applicable law and in a manner that protects 
the privacy and civil liberties of United States per-
sons. 
‘‘(b) OPERATIONAL EVALUATIONS.— 
‘‘(1) IN GENERAL.—The Director— 
‘‘(A) subject to paragraph (2), shall de-
velop, maintain, and enhance capabilities to 
evaluate the security of the Federal information 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
infrastructure 
as 
described 
in 
section 
3554(a)(3) of title 44, United States Code, in-
cluding the ability to conduct risk-based pene-
tration testing and vulnerability assessments; 
‘‘(B) in carrying out subparagraph (A), 
may request technical assistance from the Di-
rector of the Federal Bureau of Investigation, 
the Director of the National Security Agency, 
the head of any other Federal agency that may 
provide support, and any nongovernmental enti-
ty contracting with the Department or another 
Federal agency; and 
‘‘(C) in consultation with the Attorney 
General and the Privacy and Civil Liberties 
Oversight Board established under section 1061 
of the National Security Intelligence Reform 
Act of 2004 (42 U.S.C. 2000ee), shall develop 
guidelines to ensure compliance with all applica-
ble laws relating to the privacy of United States 
persons in carrying out the operational evalua-
tions under subparagraph (A). 
‘‘(2) OPERATIONAL EVALUATIONS.— 
‘‘(A) IN
GENERAL.—The Director may 
conduct risk-based operational evaluations of 
the agency information infrastructure of any 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
Federal agency, at a time determined by the 
Director, in consultation with the head of the 
Federal agency, using the capabilities developed 
under paragraph (1)(A). 
‘‘(B) 
ANNUAL
EVALUATION
REQUIRE-
MENT.—If the Director conducts an operational 
evaluation under subparagraph (A) or an oper-
ational evaluation at the request of a Federal 
agency to meet the requirements of section 
3554 of title 44, United States Code, the oper-
ational evaluation shall satisfy the requirements 
of section 3554 for the Federal agency for the 
year of the evaluation, unless otherwise speci-
fied by the Director. 
‘‘(c) CORRECTIVE
MEASURES
AND
MITIGATION 
PLANS.—If the Director determines that a Federal agency 
is not in compliance with applicable policies, principles, 
standards, and guidelines applicable to the Federal infor-
mation infrastructure— 
‘‘(1) the Director, in consultation with the Di-
rector of the Office of Management and Budget, 
may direct the head of the Federal agency to— 
‘‘(A) take corrective measures to meet the 
policies, principles, standards, and guidelines; 
and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) the head of the Federal agency has 
failed to comply with the corrective measures 
prescribed under paragraph (1); and 
‘‘(B) the failure to comply presents a sig-
nificant danger to the Federal information in-
frastructure. 
‘‘SEC. 246. INFORMATION SHARING. 
‘‘(a) FEDERAL AGENCIES.— 
‘‘(1) INFORMATION SHARING PROGRAM.—Con-
sistent with the responsibilities described in section 
242 and 244, the Director, in consultation with the 
other members of the Chief Information Officers 
Council established under section 3603 of title 44, 
United States Code, and the Federal Information 
Security Taskforce, shall establish a program for 
sharing information with and between the Center 
and other Federal agencies that includes processes 
and procedures, including standard operating proce-
dures— 
‘‘(A) under which the Director regularly 
shares with each Federal agency— 
‘‘(i) analysis and reports on the com-
posite security state of the Federal infor-
mation infrastructure and information in-
frastructure that is owned, operated, con-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
trolled, or licensed for use by, or on behalf 
of, the Department of Defense, a military 
department, or another element of the in-
telligence community, which shall include 
information relating to threats, vulnerabili-
ties, incidents, or anomalous activities; 
‘‘(ii) any available analysis and re-
ports regarding the security of the agency 
information infrastructure; and 
‘‘(iii) means and methods of pre-
venting, responding to, mitigating, and re-
mediating vulnerabilities; and 
‘‘(B) under which the Director may re-
quest information from Federal agencies con-
cerning the security of the Federal information 
infrastructure, information infrastructure that 
is owned, operated, controlled, or licensed for 
use by, or on behalf of, the Department of De-
fense, a military department, or another ele-
ment of the intelligence community, or the na-
tional information infrastructure necessary to 
carry out the duties of the Director under this 
subtitle or any other provision of law. 
‘‘(2) CONTENTS.—The program established 
under this section shall include— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) timeframes for the sharing of infor-
mation under paragraph (1); 
‘‘(B) guidance on what information shall 
be shared, including information regarding inci-
dents; 
‘‘(C) a tiered structure that provides guid-
ance for the sharing of urgent information; and 
‘‘(D) processes and procedures under 
which the Director or the head of a Federal 
agency may report noncompliance with the pro-
gram to the Director of Cyberspace Policy. 
‘‘(3) US–CERT.—The Director of the US– 
CERT shall ensure that the head of each Federal 
agency has continual access to data collected by the 
US–CERT regarding the agency information infra-
structure of the Federal agency. 
‘‘(4) FEDERAL AGENCIES.— 
‘‘(A) IN GENERAL.—The head of a Federal 
agency shall comply with all processes and pro-
cedures established under this subsection re-
garding notification to the Director relating to 
incidents. 
‘‘(B) 
IMMEDIATE
NOTIFICATION
RE-
QUIRED.—Unless otherwise directed by the 
President, any Federal agency with a national 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
security system shall immediately notify the Di-
rector regarding any incident affecting the risk- 
based security of the national security system. 
‘‘(b) STATE AND LOCAL GOVERNMENTS, PRIVATE 
SECTOR, AND INTERNATIONAL PARTNERS.— 
‘‘(1) IN GENERAL.—The Director, shall estab-
lish processes and procedures, including standard 
operating procedures, to promote bidirectional infor-
mation sharing with State and local governments, 
private entities, and international partners of the 
United States on— 
‘‘(A) threats, vulnerabilities, incidents, and 
anomalous activities affecting the national in-
formation infrastructure; and 
‘‘(B) means and methods of preventing, re-
sponding to, and mitigating and remediating 
vulnerabilities. 
‘‘(2) CONTENTS.—The processes and proce-
dures established under paragraph (1) shall in-
clude— 
‘‘(A) means or methods of accessing classi-
fied or unclassified information, as appropriate, 
that will provide situational awareness of the 
security of the Federal information infrastruc-
ture and the national information infrastructure 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
relating to threats, vulnerabilities, traffic, 
trends, incidents, and other anomalous activi-
ties affecting the Federal information infra-
structure or the national information infra-
structure; 
‘‘(B) a mechanism, established in consulta-
tion with the heads of the relevant sector-spe-
cific agencies, sector coordinating councils, and 
information sharing and analysis centers, by 
which owners and operators of covered critical 
infrastructure shall report incidents in the in-
formation infrastructure for covered critical in-
frastructure, to the extent the incident might 
indicate an actual or potential cyber vulner-
ability, or exploitation of that vulnerability; and 
‘‘(C) an evaluation of the need to provide 
security clearances to employees of State and 
local governments, private entities, and inter-
national partners to carry out this subsection. 
‘‘(3) GUIDELINES.—The Director, in consulta-
tion with the Attorney General and the Director of 
National Intelligence, shall develop guidelines to pro-
tect the privacy and civil liberties of United States 
persons and intelligence sources and methods, while 
carrying out this subsection. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(c) INCIDENTS.— 
‘‘(1) NON-FEDERAL ENTITIES.— 
‘‘(A) IN GENERAL.— 
‘‘(i) MANDATORY
REPORTING.—Sub-
ject to clause (i), the owner or operator of 
covered critical infrastructure shall report 
any incident affecting the information in-
frastructure of covered critical infrastruc-
ture to the extent the incident might indi-
cate an actual or potential cyber vulner-
ability, or exploitation of a cyber vulner-
ability, in accordance with the policies and 
procedures for the mechanism established 
under subsection (b)(2)(B) and guidelines 
developed under subsection (b)(3). 
‘‘(ii) LIMITATION.—Clause (i) shall 
not authorize the Director, the Center, the 
Department, or any other Federal entity to 
compel the disclosure of information relat-
ing to an incident or conduct surveillance 
unless otherwise authorized under chapter 
119, chapter 121, or chapter 206 of title 
18, United States Code, the Foreign Intel-
ligence Surveillance Act of 1978 (50 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
U.S.C. 1801 et seq.), or any other provi-
sion of law. 
‘‘(B) REPORTING PROCEDURES.—The Di-
rector shall establish procedures that enable 
and encourage the owner or operator of na-
tional information infrastructure to report to 
the Director regarding incidents affecting such 
information infrastructure. 
‘‘(2) 
INFORMATION
PROTECTION.—Notwith-
standing any other provision of law, information re-
ported under paragraph (1) shall be protected from 
unauthorized disclosure, in accordance with section 
251. 
‘‘(d) ADDITIONAL RESPONSIBILITIES.—In accord-
ance with section 251, the Director shall— 
‘‘(1) share data collected on the Federal infor-
mation infrastructure with the National Science 
Foundation and other accredited research institu-
tions for the sole purpose of cybersecurity research 
in a manner that protects privacy and civil liberties 
of United States persons and intelligence sources 
and methods; 
‘‘(2) establish a Web site to provide an oppor-
tunity for the public to provide— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) input about the operations of the 
Center; and 
‘‘(B) recommendations for improvements 
of the Center; and 
‘‘(3) in coordination with the Secretary of De-
fense, the Director of National Intelligence, the Sec-
retary of State, and the Attorney General, develop 
information sharing pilot programs with inter-
national partners of the United States. 
‘‘SEC. 247. PRIVATE SECTOR ASSISTANCE. 
‘‘(a) IN GENERAL.—The Director, in consultation 
with the Director of the National Institute of Standards 
and Technology, the Director of the National Security 
Agency, the head of any relevant sector-specific agency, 
the National Cybersecurity Advisory Council, State and 
local governments, and any private entities the Director 
determines appropriate, shall establish a program to pro-
mote, and provide technical assistance authorized under 
section 242(f)(1)(S) relating to the implementation of, 
best practices and related standards and guidelines for se-
curing the national information infrastructure, including 
the costs and benefits associated with the implementation 
of the best practices and related standards and guidelines. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(b) ANALYSIS AND IMPROVEMENT OF STANDARDS 
AND GUIDELINES.—For purposes of the program estab-
lished under subsection (a), the Director shall— 
‘‘(1) regularly assess and evaluate cybersecurity 
standards and guidelines issued by private sector or-
ganizations, recognized international and domestic 
standards setting organizations, and Federal agen-
cies; and 
‘‘(2) in coordination with the National Institute 
of Standards and Technology, encourage the devel-
opment of, and recommend changes to, the stand-
ards and guidelines described in paragraph (1) for 
securing the national information infrastructure. 
‘‘(c) GUIDANCE AND TECHNICAL ASSISTANCE.— 
‘‘(1) IN GENERAL.—The Director shall promote 
best practices and related standards and guidelines 
to assist owners and operators of national informa-
tion infrastructure in increasing the security of the 
national information infrastructure and protecting 
against and mitigating or remediating known vulner-
abilities. 
‘‘(2) REQUIREMENT.—Technical assistance pro-
vided under section 242(f)(1)(S) and best practices 
promoted under this section shall be prioritized 
based on risk. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(d) CRITERIA.—In promoting best practices or rec-
ommending changes to standards and guidelines under 
this section, the Director shall ensure that best practices, 
and related standards and guidelines— 
‘‘(1) address cybersecurity in a comprehensive, 
risk-based manner; 
‘‘(2) include consideration of the cost of imple-
menting such best practices or of implementing rec-
ommended changes to standards and guidelines; 
‘‘(3) increase the ability of the owners or opera-
tors of national information infrastructure to protect 
against and mitigate or remediate known vulnerabili-
ties; 
‘‘(4) are suitable, as appropriate, for implemen-
tation by small business concerns; 
‘‘(5) as necessary and appropriate, are sector 
specific; 
‘‘(6) to the maximum extent possible, incor-
porate standards and guidelines established by pri-
vate sector organizations, recognized international 
and domestic standards setting organizations, and 
Federal agencies; and 
‘‘(7) provide sufficient flexibility to permit a 
range of security solutions. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘SEC. 248. CYBER VULNERABILITIES TO COVERED CRIT-
ICAL INFRASTRUCTURE. 
‘‘(a) 
IDENTIFICATION
OF
CYBER 
VULNERABILITIES.— 
‘‘(1) IN
GENERAL.—Based on the risk-based 
assessments 
conducted 
under 
section 
242(f)(1)(T)(i), the Director, in coordination with 
the head of the sector-specific agency with responsi-
bility for covered critical infrastructure and the head 
of any Federal agency that is not a sector-specific 
agency with responsibilities for regulating the cov-
ered critical infrastructure, and in consultation with 
the National Cybersecurity Advisory Council and 
any private sector entity determined appropriate by 
the Director, shall, on a continuous and sector-by- 
sector basis, identify and evaluate the cyber 
vulnerabilities to covered critical infrastructure. 
‘‘(2) FACTORS TO BE CONSIDERED.—In identi-
fying and evaluating cyber vulnerabilities under 
paragraph (1), the Director shall consider— 
‘‘(A) the perceived threat, including a con-
sideration of adversary capabilities and intent, 
preparedness, target attractiveness, and deter-
rence capabilities; 
‘‘(B) the potential extent and likelihood of 
death, injury, or serious adverse effects to 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
human health and safety caused by a disruption 
of the reliable operation of covered critical in-
frastructure; 
‘‘(C) the threat to or potential impact on 
national security caused by a disruption of the 
reliable operation of covered critical infrastruc-
ture; 
‘‘(D) the extent to which the disruption of 
the reliable operation of covered critical infra-
structure will disrupt the reliable operation of 
other covered critical infrastructure; 
‘‘(E) the potential for harm to the econ-
omy that would result from a disruption of the 
reliable operation of covered critical infrastruc-
ture; and 
‘‘(F) other risk-based security factors that 
the Director, in consultation with the head of 
the sector-specific agency with responsibility for 
the covered critical infrastructure and the head 
of any Federal agency that is not a sector-spe-
cific agency with responsibilities for regulating 
the covered critical infrastructure, determine to 
be appropriate and necessary to protect public 
health and safety, critical infrastructure, or na-
tional and economic security. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(3) REPORT.— 
‘‘(A) IN
GENERAL.—Not later than 180 
days after the date of enactment of this sub-
title, and annually thereafter, the Director, in 
coordination with the head of the sector-specific 
agency with responsibility for the covered crit-
ical infrastructure and the head of any Federal 
agency that is not a sector-specific agency with 
responsibilities for regulating the covered crit-
ical infrastructure, shall submit to the appro-
priate committees of Congress a report on the 
findings of the identification and evaluation of 
cyber vulnerabilities under this subsection. 
Each report submitted under this paragraph 
shall be submitted in an unclassified form, but 
may include a classified annex. 
‘‘(B) INPUT.—For purposes of the reports 
required under subparagraph (A), the Director 
shall create a process under which owners and 
operators of covered critical infrastructure may 
provide input on the findings of the reports. 
‘‘(b) RISK-BASED PERFORMANCE REQUIREMENTS.— 
‘‘(1) IN GENERAL.—Not later than 270 days 
after the date of the enactment of this subtitle, in 
coordination with the heads of the sector-specific 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
agencies with responsibility for covered critical infra-
structure and the head of any Federal agency that 
is not a sector-specific agency with responsibilities 
for regulating the covered critical infrastructure, and 
in consultation with the National Cybersecurity Ad-
visory Council and any private sector entity deter-
mined appropriate by the Director, the Director 
shall issue interim final regulations establishing risk- 
based security performance requirements to secure 
covered critical infrastructure against cyber vulnera-
bilities through the adoption of security measures 
that satisfy the security performance requirements 
identified by the Director. 
‘‘(2) PROCEDURES.—The regulations issued 
under this subsection shall— 
‘‘(A) include a process under which owners 
and operators of covered critical infrastructure 
are informed of identified cyber vulnerabilities 
and security performance requirements de-
signed to remediate or mitigate the cyber 
vulnerabilities, in combination with best prac-
tices recommended under section 247; 
‘‘(B) establish a process for owners and 
operators of covered critical infrastructure to 
select security measures, including any best 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
practices recommended under section 247, that, 
in combination, satisfy the security performance 
requirements established by the Director under 
this subsection; 
‘‘(C) establish a process for owners and op-
erators of covered critical infrastructure to de-
velop response plans for a national cyber emer-
gency declared under section 249; and 
‘‘(D) establish a process by which the Di-
rector— 
‘‘(i) is notified of the security meas-
ures selected by the owner or operator of 
covered critical infrastructure under sub-
paragraph (B); and 
‘‘(ii) may determine whether the pro-
posed security measures satisfy the secu-
rity performance requirements established 
by the Director under this subsection. 
‘‘(3) INTERNATIONAL COOPERATION ON SECUR-
ING COVERED CRITICAL INFRASTRUCTURE.— 
‘‘(A) IN GENERAL.—The Director, in co-
ordination with the head of the sector-specific 
agency with responsibility for covered critical 
infrastructure and the head of any Federal 
agency that is not a sector-specific agency with 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
responsibilities for regulating the covered crit-
ical infrastructure, shall— 
‘‘(i) consistent with the protection of 
intelligence sources and methods and other 
sensitive matters, inform the owner or op-
erator of covered critical infrastructure 
that is located outside the United States 
and the government of the country in 
which the covered critical infrastructure is 
located of any cyber vulnerabilities to the 
covered critical infrastructure; and 
‘‘(ii) coordinate with the government 
of the country in which the covered critical 
infrastructure is located and, as appro-
priate, the owner or operator of the cov-
ered critical infrastructure, regarding the 
implementation of security measures or 
other measures to the covered critical in-
frastructure to mitigate or remediate cyber 
vulnerabilities. 
‘‘(B) INTERNATIONAL AGREEMENTS.—The 
Director shall carry out the this paragraph in 
a manner consistent with applicable inter-
national agreements. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(4) RISK-BASED SECURITY PERFORMANCE RE-
QUIREMENTS.— 
‘‘(A) IN GENERAL.—The security perform-
ance requirements established by the Director 
under this subsection shall be— 
‘‘(i) based on the factors listed in sub-
section (a)(2); and 
‘‘(ii) designed to remediate or mitigate 
identified cyber vulnerabilities and any as-
sociated consequences of an exploitation 
based on such vulnerabilities. 
‘‘(B) CONSULTATION.—In establishing se-
curity performance requirements under this 
subsection, the Director shall, to the maximum 
extent practicable, consult with— 
‘‘(i) the Director of the National Se-
curity Agency; 
‘‘(ii) the Director of the National In-
stitute of Standards and Technology; 
‘‘(iii) the National Cybersecurity Advi-
sory Council; 
‘‘(iv) the heads of sector-specific agen-
cies; and 
‘‘(v) the heads of Federal agencies 
that are not a sector-specific agency with 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
responsibilities for regulating the covered 
critical infrastructure. 
‘‘(C) ALTERNATIVE MEASURES.— 
‘‘(i) IN GENERAL.—The owners and 
operators of covered critical infrastructure 
shall have flexibility to implement any se-
curity measure, or combination thereof, to 
satisfy the security performance require-
ments described in subparagraph (A) and 
the Director may not disapprove under this 
section any proposed security measures, or 
combination thereof, based on the presence 
or absence of any particular security meas-
ure if the proposed security measures, or 
combination thereof, satisfy the security 
performance requirements established by 
the Director under this section. 
‘‘(ii) RECOMMENDED SECURITY MEAS-
URES.—The Director may recommend to 
an owner and operator of covered critical 
infrastructure a specific security measure, 
or combination thereof, that will satisfy the 
security performance requirements estab-
lished by the Director. The absence of the 
recommended security measures, or com-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
bination thereof, may not serve as the 
basis for a disapproval of the security 
measure, or combination thereof, proposed 
by the owner or operator of covered critical 
infrastructure if the proposed security 
measure, or combination thereof, otherwise 
satisfies the security performance require-
ments established by the Director under 
this section. 
‘‘SEC. 249. NATIONAL CYBER EMERGENCIES. 
‘‘(a) DECLARATION.— 
‘‘(1) IN GENERAL.—The President may issue a 
declaration of a national cyber emergency to covered 
critical infrastructure. Any declaration under this 
section shall specify the covered critical infrastruc-
ture subject to the national cyber emergency. 
‘‘(2) NOTIFICATION.—Upon issuing a declara-
tion under paragraph (1), the President shall, con-
sistent with the protection of intelligence sources 
and methods, notify the owners and operators of the 
specified covered critical infrastructure of the nature 
of the national cyber emergency. 
‘‘(3) AUTHORITIES.—If the President issues a 
declaration under paragraph (1), the Director 
shall— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(F) initiate a process under section 248 
to address the cyber vulnerability that may be 
exploited by the national cyber emergency; and 
‘‘(G) provide voluntary technical assist-
ance, if requested, under section 242(f)(1)(S). 
‘‘(4) REIMBURSEMENT.—A Federal agency 
shall be reimbursed for expenditures under this sec-
tion from funds appropriated for the purposes of 
this section. Any funds received by a Federal agency 
as reimbursement for services or supplies furnished 
under the authority of this section shall be deposited 
to the credit of the appropriation or appropriations 
available on the date of the deposit for the services 
or supplies. 
‘‘(5) CONSULTATION.—In carrying out this sec-
tion, the Director shall consult with the Secretary, 
the Secretary of Defense, the Director of the Na-
tional Security Agency, the Director of the National 
Institute of Standards and Technology, and any 
other official, as directed by the President. 
‘‘(6) PRIVACY.—In carrying out this section, 
the Director shall ensure that the privacy and civil 
liberties of United States persons are protected. 
‘‘(b) DISCONTINUANCE
OF
EMERGENCY
MEAS-
URES.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(1) IN GENERAL.—Any emergency measure or 
action developed under this section shall cease to 
have effect not later than 30 days after the date on 
which the President issued the declaration of a na-
tional cyber emergency, unless— 
‘‘(A) the Director affirms in writing that 
the emergency measure or action remains nec-
essary to address the identified national cyber 
emergency; and 
‘‘(B) the President issues a written order 
or directive reaffirming the national cyber 
emergency, the continuing nature of the na-
tional cyber emergency, or the need to continue 
the adoption of the emergency measure or ac-
tion. 
‘‘(2) EXTENSIONS.—An emergency measure or 
action extended in accordance with paragraph (1) 
may— 
‘‘(A) remain in effect for not more than 30 
days after the date on which the emergency 
measure or action was to cease to have effect; 
and 
‘‘(B) be extended for additional 30-day pe-
riods, if the requirements of paragraph (1) and 
subsection (d) are met. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(c) COMPLIANCE WITH EMERGENCY MEASURES.— 
‘‘(1) IN GENERAL.—Subject to paragraph (2), 
the owner or operator of covered critical infrastruc-
ture shall immediately comply with any emergency 
measure or action developed by the Director under 
this section during the pendency of any declaration 
by the President under subsection (a)(1) or an ex-
tension under subsection (b)(2). 
‘‘(2) ALTERNATIVE MEASURES.—If the Director 
determines that a proposed security measure, or any 
combination thereof, submitted by the owner or op-
erator of covered critical infrastructure in accord-
ance with the process established under section 
248(b)(2) addresses the cyber vulnerability associ-
ated with the national cyber emergency that is the 
subject of the declaration under this section, the 
owner or operator may comply with paragraph (1) of 
this subsection by implementing the proposed secu-
rity measure, or combination thereof, approved by 
the Director under the process established under 
section 248. Before submission of a proposed secu-
rity measure, or combination thereof, and during the 
pendency of any review by the Director under the 
process established under section 248, the owner or 
operator of covered critical infrastructure shall re-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
main in compliance with any emergency measure or 
action developed by the Director under this section 
during the pendency of any declaration by the Presi-
dent under subsection (a)(1) or an extension under 
subsection (b)(2), until such time as the Director 
has approved an alternative proposed security meas-
ure, or combination thereof, under this paragraph. 
‘‘(3) INTERNATIONAL
COOPERATION
ON
NA-
TIONAL CYBER EMERGENCIES.— 
‘‘(A) IN GENERAL.—The Director, in co-
ordination with the head of the sector-specific 
agency with responsibility for covered critical 
infrastructure and the head of any Federal 
agency that is not a sector-specific agency with 
responsibilities for regulating the covered crit-
ical infrastructure, shall— 
‘‘(i) consistent with the protection of 
intelligence sources and methods and other 
sensitive matters, inform the owner or op-
erator of covered critical infrastructure 
that is located outside of the United States 
and the government of the country in 
which the covered critical infrastructure is 
located of any national cyber emergency 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
affecting the covered critical infrastruc-
ture; and 
‘‘(ii) coordinate with the government 
of the country in which the covered critical 
infrastructure is located and, as appro-
priate, the owner or operator of the cov-
ered critical infrastructure, regarding the 
implementation of emergency measures or 
actions necessary to preserve the reliable 
operation, and mitigate or remediate the 
consequences of the potential disruption, of 
the covered critical infrastructure. 
‘‘(B) INTERNATIONAL AGREEMENTS.—The 
Director shall carry out this paragraph in a 
manner consistent with applicable international 
agreements. 
‘‘(4) LIMITATION
ON
COMPLIANCE
AUTHOR-
ITY.—The authority to direct compliance with an 
emergency measure or action under this section shall 
not authorize the Director, the Center, the Depart-
ment, or any other Federal entity to compel the dis-
closure of information or conduct surveillance unless 
otherwise authorized under chapter 119, chapter 
121, or chapter 206 of title 18, United States Code, 
the Foreign Intelligence Surveillance Act of 1978 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
(50 U.S.C. 1801 et seq.), or any other provision of 
law. 
‘‘(d) REPORTING.— 
‘‘(1) IN GENERAL.—Except as provided in para-
graph (2), the President shall ensure that any dec-
laration under subsection (a)(1) or any extension 
under subsection (b)(2) is reported to the appro-
priate committees of Congress before the Director 
mandates any emergency measure or actions under 
subsection (a)(3). 
‘‘(2) EXCEPTION.—If notice cannot be given 
under paragraph (1) before mandating any emer-
gency measure or actions under subsection (a)(3), 
the President shall provide the report required under 
paragraph (1) as soon as possible, along with a 
statement of the reasons for not providing notice in 
accordance with paragraph (1). 
‘‘(3) CONTENTS.—Each report under this sub-
section shall describe— 
‘‘(A) the nature of the national cyber 
emergency; 
‘‘(B) the reasons that risk-based security 
requirements under section 248 are not suffi-
cient to address the national cyber emergency; 
and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(C) the actions necessary to preserve the 
reliable 
operation 
and 
mitigate 
the 
con-
sequences of the potential disruption of covered 
critical infrastructure. 
‘‘(e) STATUTORY DEFENSES AND CIVIL LIABILITY 
LIMITATIONS
FOR
COMPLIANCE
WITH
EMERGENCY 
MEASURES.— 
‘‘(1) DEFINITIONS.—In this subsection— 
‘‘(A) the term ‘covered civil action’— 
‘‘(i) means a civil action filed in a 
Federal or State court against a covered 
entity; and 
‘‘(ii) does not include an action 
brought under section 2520 or 2707 of 
title 18, United States Code, or section 
110 or 308 of the Foreign Intelligence 
Surveillance Act of 1978 (50 U.S.C. 1810 
and 1828); 
‘‘(B) the term ‘covered entity’ means any 
entity that owns or operates covered critical in-
frastructure, including any owner, operator, of-
ficer, employee, agent, landlord, custodian, or 
other person acting for or on behalf of that en-
tity with respect to the covered critical infra-
structure; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(C) the term ‘noneconomic damages’ 
means damages for losses for physical and emo-
tional pain, suffering, inconvenience, physical 
impairment, mental anguish, disfigurement, loss 
of enjoyment of life, loss of society and compan-
ionship, loss of consortium, hedonic damages, 
injury to reputation, and any other nonpecu-
niary losses. 
‘‘(2) APPLICATION OF LIMITATIONS ON CIVIL 
LIABILITY.—The limitations on civil liability under 
paragraph (3) apply if— 
‘‘(A) the President has issued a declaration 
of national cyber emergency under subsection 
(a)(1); 
‘‘(B) the Director has— 
‘‘(i) issued emergency measures or ac-
tions for which compliance is required 
under subsection (c)(1); or 
‘‘(ii) 
approved 
security 
measures 
under subsection (c)(2); 
‘‘(C) the covered entity is in compliance 
with— 
‘‘(i) the emergency measures or ac-
tions required under subsection (c)(1); or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(ii) security measures which the Di-
rector has approved under subsection 
(c)(2); and 
‘‘(D)(i) the Director certifies to the court 
in which the covered civil action is pending that 
the actions taken by the covered entity during 
the period covered by the declaration under 
subsection (a)(1) were consistent with— 
‘‘(I) emergency measures or actions 
for which compliance is required under 
subsection (c)(1); or 
‘‘(II) security measures which the Di-
rector has approved under subsection 
(c)(2); or 
‘‘(ii) notwithstanding the lack of a certifi-
cation, the covered entity demonstrates by a 
preponderance of the evidence that the actions 
taken during the period covered by the declara-
tion under subsection (a)(1) are consistent with 
the implementation of— 
‘‘(I) emergency measures or actions 
for which compliance is required under 
subsection (c)(1); or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(II) security measures which the Di-
rector has approved under subsection 
(c)(2). 
‘‘(3) LIMITATIONS ON CIVIL LIABILITY.—In any 
covered civil action that is related to any incident as-
sociated with a cyber vulnerability covered by a dec-
laration of a national cyber emergency and for which 
Director has issued emergency measures or actions 
for which compliance is required under subsection 
(c)(1) or for which the Director has approved secu-
rity measures under subsection (c)(2), or that is the 
direct consequence of actions taken in good faith for 
the purpose of implementing security measures or 
actions which the Director has approved under sub-
section (c)(2)— 
‘‘(A) the covered entity shall not be liable 
for any punitive damages intended to punish or 
deter, exemplary damages, or other damages 
not intended to compensate a plaintiff for ac-
tual losses; and 
‘‘(B) noneconomic damages may be award-
ed against a defendant only in an amount di-
rectly proportional to the percentage of respon-
sibility of such defendant for the harm to the 
plaintiff, and no plaintiff may recover non-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
economic damages unless the plaintiff suffered 
physical harm. 
‘‘(4) CIVIL ACTIONS ARISING OUT OF IMPLE-
MENTATION
OF
EMERGENCY
MEASURES
OR
AC-
TIONS.—A covered civil action may not be main-
tained against a covered entity that is the direct 
consequence of actions taken in good faith for the 
purpose of implementing specific emergency meas-
ures or actions for which compliance is required 
under subsection (c)(1), if— 
‘‘(A) the President has issued a declaration 
of national cyber emergency under subsection 
(a)(1) and the action was taken during the pe-
riod covered by that declaration; 
‘‘(B) the Director has issued emergency 
measures or actions for which compliance is re-
quired under subsection (c)(1); 
‘‘(C) the covered entity is in compliance 
with the emergency measures required under 
subsection (c)(1); and 
‘‘(D)(i) the Director certifies to the court 
in which the covered civil action is pending that 
the actions taken by the entity during the pe-
riod covered by the declaration under subsection 
(a)(1) were consistent with the implementation 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
of emergency measures or actions for which 
compliance is required under subsection (c)(1); 
or 
‘‘(ii) notwithstanding the lack of a certifi-
cation, the entity demonstrates by a preponder-
ance of the evidence that the actions taken dur-
ing the period covered by the declaration under 
subsection (a)(1) are consistent with the imple-
mentation of emergency measures or actions for 
which compliance is required under subsection 
(c)(1). 
‘‘(5) CERTAIN ACTIONS NOT SUBJECT TO LIMI-
TATIONS ON LIABILITY.— 
‘‘(A) 
ADDITIONAL
OR
INTERVENING 
ACTS.—Paragraphs (2) through (4) shall not 
apply to a civil action relating to any additional 
or intervening acts or omissions by any covered 
entity. 
‘‘(B) SERIOUS
OR
SUBSTANTIAL
DAM-
AGE.—Paragraph (4) shall not apply to any 
civil action brought by an individual— 
‘‘(i) whose recovery is otherwise pre-
cluded by application of paragraph (4); 
and 
‘‘(ii) who has suffered— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(I) serious physical injury or 
death; or 
‘‘(II) substantial damage or de-
struction to his primary residence. 
‘‘(C) RULE OF CONSTRUCTION.—Recovery 
available under subparagraph (B) shall be lim-
ited to those damages available under subpara-
graphs (A) and (B) of paragraph (3), except 
that neither reasonable and necessary medical 
benefits nor lifetime total benefits for lost em-
ployment income due to permanent and total 
disability shall be limited herein. 
‘‘(D) INDEMNIFICATION.—In any civil ac-
tion brought under subparagraph (B), the 
United States shall defend and indemnify any 
covered entity. Any covered entity defended and 
indemnified under this subparagraph shall fully 
cooperate with the United States in the defense 
by the United States in any proceeding and 
shall be reimbursed the reasonable costs associ-
ated with such cooperation. 
‘‘(f) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to— 
‘‘(1) alter or supersede the authority of the Sec-
retary of Defense, the Attorney General, or the Di-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
rector of National Intelligence in responding to a na-
tional cyber emergency; or 
‘‘(2) limit the authority of the Director under 
section 248, after a declaration issued under this 
section expires. 
‘‘SEC. 250. ENFORCEMENT. 
‘‘(a) ANNUAL CERTIFICATION OF COMPLIANCE.— 
‘‘(1) IN GENERAL.—Not later than 6 months 
after the date on which the Director promulgates 
regulations under section 248(b), and every year 
thereafter, each owner or operator of covered critical 
infrastructure shall certify in writing to the Director 
whether the owner or operator has developed and 
implemented, or is implementing, security measures 
approved by the Director under section 248 and any 
applicable emergency measures or actions required 
under section 249 for any cyber vulnerabilities and 
national cyber emergencies. 
‘‘(2) FAILURE TO COMPLY.—If an owner or op-
erator of covered critical infrastructure fails to sub-
mit a certification in accordance with paragraph (1), 
or if the certification indicates the owner or operator 
is not in compliance, the Director may issue an 
order requiring the owner or operator to submit pro-
posed security measures under section 248 or com-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
ply with specific emergency measures or actions 
under section 249. 
‘‘(b) RISK-BASED EVALUATIONS.— 
‘‘(1) IN GENERAL.—Consistent with the factors 
described in paragraph (3), the Director may per-
form an evaluation of the information infrastructure 
of any specific system or asset constituting covered 
critical infrastructure to assess the validity of a cer-
tification of compliance submitted under subsection 
(a)(1). 
‘‘(2) DOCUMENT REVIEW AND INSPECTION.— 
An evaluation performed under paragraph (1) may 
include— 
‘‘(A) a review of all documentation sub-
mitted to justify an annual certification of com-
pliance submitted under subsection (a)(1); and 
‘‘(B) a physical or electronic inspection of 
relevant information infrastructure to which the 
security measures required under section 248 or 
the emergency measures or actions required 
under section 249 apply. 
‘‘(3) EVALUATION
SELECTION
FACTORS.—In 
determining whether sufficient risk exists to justify 
an evaluation under this subsection, the Director 
shall consider— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(A) the specific cyber vulnerabilities af-
fecting or potentially affecting the information 
infrastructure of the specific system or asset 
constituting covered critical infrastructure; 
‘‘(B) any reliable intelligence or other in-
formation indicating a cyber vulnerability or 
credible national cyber emergency to the infor-
mation infrastructure of the specific system or 
asset constituting covered critical infrastruc-
ture; 
‘‘(C) actual knowledge or reasonable sus-
picion that the certification of compliance sub-
mitted by a specific owner or operator of cov-
ered critical infrastructure is false or otherwise 
inaccurate; 
‘‘(D) a request by a specific owner or oper-
ator of covered critical infrastructure for such 
an evaluation; and 
‘‘(E) such other risk-based factors as iden-
tified by the Director. 
‘‘(4) SECTOR-SPECIFIC
AGENCIES.—To carry 
out the risk-based evaluation authorized under this 
subsection, the Director may use the resources of a 
sector-specific agency with responsibility for the cov-
ered critical infrastructure or any Federal agency 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
that is not a sector-specific agency with responsibil-
ities for regulating the covered critical infrastructure 
with the concurrence of the head of the agency. 
‘‘(5) INFORMATION PROTECTION.—Information 
provided to the Director during the course of an 
evaluation under this subsection shall be protected 
from disclosure in accordance with section 251. 
‘‘(c) CIVIL PENALTIES.— 
‘‘(1) IN
GENERAL.—Any person who violates 
section 248 or 249 shall be liable for a civil penalty. 
‘‘(2) NO PRIVATE RIGHT OF ACTION.—Nothing 
in this section confers upon any person, except the 
Director, a right of action against an owner or oper-
ator of covered critical infrastructure to enforce any 
provision of this subtitle. 
‘‘(d) LIMITATION ON CIVIL LIABILITY.— 
‘‘(1) DEFINITION.—In this subsection— 
‘‘(A) the term ‘covered civil action’— 
‘‘(i) means a civil action filed in a 
Federal or State court against a covered 
entity; and 
‘‘(ii) does not include an action 
brought under section 2520 or 2707 of 
title 18, United States Code, or section 
110 or 308 of the Foreign Intelligence 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
Surveillance Act of 1978 (50 U.S.C. 1810 
and 1828); 
‘‘(B) the term ‘covered entity’ means any 
entity that owns or operates covered critical in-
frastructure, including any owner, operator, of-
ficer, employee, agent, landlord, custodian, or 
other person acting for or on behalf of that en-
tity with respect to the covered critical infra-
structure; and 
‘‘(C) the term ‘noneconomic damages’ 
means damages for losses for physical and emo-
tional pain, suffering, inconvenience, physical 
impairment, mental anguish, disfigurement, loss 
of enjoyment of life, loss of society and compan-
ionship, loss of consortium, hedonic damages, 
injury to reputation, and any other nonpecu-
niary losses. 
‘‘(2) LIMITATIONS ON CIVIL LIABILITY.—If a 
covered entity experiences an incident related to a 
cyber vulnerability identified under section 248(a), 
in any covered civil action for damages directly 
caused by the incident related to that cyber vulner-
ability— 
‘‘(A) the covered entity shall not be liable 
for any punitive damages intended to punish or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
deter, exemplary damages, or other damages 
not intended to compensate a plaintiff for ac-
tual losses; and 
‘‘(B) noneconomic damages may be award-
ed against a defendant only in an amount di-
rectly proportional to the percentage of respon-
sibility of such defendant for the harm to the 
plaintiff, and no plaintiff may recover non-
economic damages unless the plaintiff suffered 
physical harm. 
‘‘(3) 
APPLICATION.—This 
subsection 
shall 
apply to claims made by any individual or non-
governmental entity, including claims made by a 
State or local government agency on behalf of such 
individuals or nongovernmental entities, against a 
covered entity— 
‘‘(A) whose proposed security measures, or 
combination thereof, satisfy the security per-
formance requirements established under sub-
section 248(b) and have been approved by the 
Director; 
‘‘(B) that has been evaluated under sub-
section (b) and has been found by the Director 
to have implemented the proposed security 
measures approved under section 248; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(C) that is in actual compliance with the 
approved security measures at the time of the 
incident related to that cyber vulnerability. 
‘‘(4) LIMITATION.—This subsection shall only 
apply to harm directly caused by the incident related 
to the cyber vulnerability and shall not apply to 
damages caused by any additional or intervening 
acts or omissions by the covered entity. 
‘‘(5) RULE OF CONSTRUCTION.—Except as pro-
vided under paragraph (3), nothing in this sub-
section shall be construed to abrogate or limit any 
right, remedy, or authority that the Federal Govern-
ment or any State or local government, or any entity 
or agency thereof, may possess under any law, or 
that any individual is authorized by law to bring on 
behalf of the government. 
‘‘(e) REPORT
TO CONGRESS.—The Director shall 
submit an annual report to the appropriate committees of 
Congress on the implementation and enforcement of the 
risk-based performance requirements of covered critical in-
frastructure under subsection 248(b) and this section in-
cluding— 
‘‘(1) the level of compliance of covered critical 
infrastructure with the risk-based security perform-
ance requirements issued under section 248(b); 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
‘‘(2) how frequently the evaluation authority 
under subsection (b) was utilized and a summary of 
the aggregate results of the evaluations; and 
‘‘(3) any civil penalties imposed on covered crit-
ical infrastructure. 
‘‘SEC. 251. PROTECTION OF INFORMATION. 
‘‘(a) DEFINITION.—In this section, the term ‘covered 
information’— 
‘‘(1) means— 
‘‘(A) any information required to be sub-
mitted under sections 246, 248, and 249 to the 
Center by the owners and operators of covered 
critical infrastructure; and 
‘‘(B) any information submitted to the 
Center under the processes and procedures es-
tablished under section 246 by State and local 
governments, private entities, and international 
partners of the United States regarding threats, 
vulnerabilities, and incidents affecting— 
‘‘(i) the Federal information infra-
structure; 
‘‘(ii) information infrastructure that is 
owned, operated, controlled, or licensed for 
use by, or on behalf of, the Department of 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
Defense, a military department, or another 
element of the intelligence community; or 
‘‘(iii) the national information infra-
structure; and 
‘‘(2) shall not include any information described 
under paragraph (1), if that information is sub-
mitted to— 
‘‘(A) conceal violations of law, inefficiency, 
or administrative error; 
‘‘(B) prevent embarrassment to a person, 
organization, or agency; or 
‘‘(C) interfere with competition in the pri-
vate sector. 
‘‘(b) VOLUNTARILY SHARED CRITICAL INFRASTRUC-
TURE INFORMATION.—Covered information submitted in 
accordance with this section shall be treated as voluntarily 
shared critical infrastructure information under section 
214, except that the requirement of section 214 that the 
information be voluntarily submitted, including the re-
quirement for an express statement, shall not be required 
for submissions of covered information. 
‘‘(c) GUIDELINES.— 
‘‘(1) IN GENERAL.—Subject to paragraph (2), 
the Director shall develop and issue guidelines, in 
consultation with the Secretary, Attorney General, 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
100 
and the National Cybersecurity Advisory Council, as 
necessary to implement this section. 
‘‘(2) REQUIREMENTS.—The guidelines devel-
oped under this section shall— 
‘‘(A) consistent with section 214(e)(2)(D) 
and (g) and the guidelines developed under sec-
tion 246(b)(3), include provisions for informa-
tion sharing among Federal, State, and local 
and officials, private entities, or international 
partners of the United States necessary to 
carry out the authorities and responsibilities of 
the Director; 
‘‘(B) be consistent, to the maximum extent 
possible, with policy guidance and implementa-
tion standards developed by the National Ar-
chives and Records Administration for con-
trolled unclassified information, including with 
respect to marking, safeguarding, dissemination 
and dispute resolution; and 
‘‘(C) describe, with as much detail as pos-
sible, the categories and type of information en-
tities should voluntarily submit under sub-
sections (b) and (c)(1)(B) of section 246. 
‘‘(d) PROCESS
FOR REPORTING SECURITY PROB-
LEMS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
101 
‘‘(1) ESTABLISHMENT OF PROCESS.—The Di-
rector shall establish through regulation, and provide 
information to the public regarding, a process by 
which any person may submit a report to the Sec-
retary regarding cybersecurity threats, vulnerabili-
ties, and incidents affecting— 
‘‘(A) the Federal information infrastruc-
ture; 
‘‘(B) information infrastructure that is 
owned, operated, controlled, or licensed for use 
by, or on behalf of, the Department of Defense, 
a military department, or another element of 
the intelligence community; or 
‘‘(C) national information infrastructure. 
‘‘(2) ACKNOWLEDGMENT OF RECEIPT.—If a re-
port submitted under paragraph (1) identifies the 
person making the report, the Director shall respond 
promptly to such person and acknowledge receipt of 
the report. 
‘‘(3) STEPS TO ADDRESS PROBLEM.—The Di-
rector shall review and consider the information pro-
vided in any report submitted under paragraph (1) 
and, at the sole, unreviewable discretion of the Di-
rector, determine what, if any, steps are necessary 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
102 
or appropriate to address any problems or defi-
ciencies identified. 
‘‘(4) DISCLOSURE OF IDENTITY.— 
‘‘(A) IN GENERAL.—Except as provided in 
subparagraph (B), or with the written consent 
of the person, the Secretary may not disclose 
the identity of a person who has provided infor-
mation described in paragraph (1). 
‘‘(B) REFERRAL TO THE ATTORNEY GEN-
ERAL.—The Secretary shall disclose to the At-
torney General the identity of a person de-
scribed under subparagraph (A) if the matter is 
referred to the Attorney General for enforce-
ment. The Director shall provide reasonable ad-
vance notice to the affected person if disclosure 
of that person’s identity is to occur, unless such 
notice would risk compromising a criminal or 
civil enforcement investigation or proceeding. 
‘‘(e) RULES OF CONSTRUCTION.—Nothing in this 
section shall be construed to— 
‘‘(1) limit or otherwise affect the right, ability, 
duty, or obligation of any entity to use or disclose 
any information of that entity, including in the con-
duct of any judicial or other proceeding; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
103 
‘‘(2) prevent the classification of information 
submitted under this section if that information 
meets the standards for classification under Execu-
tive Order 12958 or any successor of that order; 
‘‘(3) limit the right of an individual to make 
any disclosure— 
‘‘(A) protected or authorized under section 
2302(b)(8) or 7211 of title 5, United States 
Code; 
‘‘(B) to an appropriate official of informa-
tion that the individual reasonably believes evi-
dences a violation of any law, rule, or regula-
tion, gross mismanagement, or substantial and 
specific danger to public health, safety, or secu-
rity, and that is protected under any Federal or 
State law (other than those referenced in sub-
paragraph (A)) that shields the disclosing indi-
vidual against retaliation or discrimination for 
having made the disclosure if such disclosure is 
not specifically prohibited by law and if such in-
formation is not specifically required by Execu-
tive order to be kept secret in the interest of 
national defense or the conduct of foreign af-
fairs; or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
104 
‘‘(C) to the Special Counsel, the inspector 
general of an agency, or any other employee 
designated by the head of an agency to receive 
similar disclosures; 
‘‘(4) prevent the Director from using informa-
tion required to be submitted under sections 246, 
248, or 249 for enforcement of this subtitle, includ-
ing enforcement proceedings subject to appropriate 
safeguards; 
‘‘(5) authorize information to be withheld from 
Congress, the Government Accountability Office, or 
Inspector General of the Department; or 
‘‘(6) create a private right of action for enforce-
ment of any provision of this section. 
‘‘(f) AUDIT.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Protecting Cyberspace 
as a National Asset Act of 2010, the Inspector Gen-
eral of the Department shall conduct an audit of the 
management of information submitted under sub-
section (b) and report the findings to appropriate 
committees of Congress. 
‘‘(2) CONTENTS.—The audit under paragraph 
(1) shall include assessments of— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
105 
‘‘(A) whether the information is adequately 
safeguarded against inappropriate disclosure; 
‘‘(B) the processes for marking and dis-
seminating the information and resolving any 
disputes; 
‘‘(C) how the information is used for the 
purposes of this section, and whether that use 
is effective; 
‘‘(D) whether information sharing has been 
effective to fulfill the purposes of this section; 
‘‘(E) whether the kinds of information sub-
mitted have been appropriate and useful, or 
overbroad or overnarrow; 
‘‘(F) whether the information protections 
allow for adequate accountability and trans-
parency of the regulatory, enforcement, and 
other aspects of implementing this subtitle; and 
‘‘(G) any other factors at the discretion of 
the Inspector General. 
‘‘SEC. 252. SECTOR-SPECIFIC AGENCIES. 
‘‘(a) IN GENERAL.—The head of each sector-specific 
agency and the head of any Federal agency that is not 
a sector-specific agency with responsibilities for regulating 
covered critical infrastructure shall coordinate with the 
Director on any activities of the sector-specific agency or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
106 
Federal agency that relate to the efforts of the agency re-
garding security or resiliency of the national information 
infrastructure, including critical infrastructure and cov-
ered critical infrastructure, within or under the super-
vision of the agency. 
‘‘(b) DUPLICATIVE REPORTING REQUIREMENTS.— 
The head of each sector-specific agency and the head of 
any Federal agency that is not a sector-specific agency 
with responsibilities for regulating covered critical infra-
structure shall coordinate with the Director to eliminate 
and avoid the creation of duplicate reporting or compli-
ance requirements relating to the security or resiliency of 
the national information infrastructure, including critical 
infrastructure and covered critical infrastructure, within 
or under the supervision of the agency. 
‘‘(c) REQUIREMENTS.— 
‘‘(1) IN GENERAL.—To the extent that the head 
of each sector-specific agency and the head of any 
Federal agency that is not a sector-specific agency 
with responsibilities for regulating covered critical 
infrastructure has the authority to establish regula-
tions, rules, or requirements or other required ac-
tions that are applicable to the security of national 
information infrastructure, including critical infra-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
107 
structure and covered critical infrastructure, the 
head of that agency shall— 
‘‘(A) notify the Director in a timely fash-
ion of the intent to establish the regulations, 
rules, requirements, or other required actions; 
‘‘(B) coordinate with the Director to en-
sure that the regulations, rules, requirements, 
or other required actions are consistent with, 
and do not conflict or impede, the activities of 
the Director under sections 247, 248, and 249; 
and 
‘‘(C) in coordination with the Director, en-
sure that the regulations, rules, requirements, 
or other required actions are implemented, as 
they relate to covered critical infrastructure, in 
accordance with subsection (a). 
‘‘(2) 
COORDINATION.—Coordination 
under 
paragraph (1)(B) shall include the active participa-
tion of the Director in the process for developing 
regulations, rules, requirements, or other required 
actions. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
this section shall be construed to provide additional 
authority for any sector-specific agency or any Fed-
eral agency that is not a sector-specific agency with 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
108 
responsibilities for regulating national information 
infrastructure, including critical infrastructure or 
covered critical infrastructure, to establish standards 
or other measures that are applicable to the security 
of national information infrastructure not otherwise 
authorized by law. 
‘‘SEC. 253. STRATEGY FOR FEDERAL CYBERSECURITY SUP-
PLY CHAIN MANAGEMENT. 
‘‘(a) IN GENERAL.—The Secretary, in consultation 
with the Director of Cyberspace Policy, the Director, the 
Secretary of Defense, the Secretary of Commerce, the Sec-
retary of State, the Director of National Intelligence, the 
Administrator of General Services, the Administrator for 
Federal Procurement Policy, the other members of the 
Chief Information Officers Council established under sec-
tion 3603 of title 44, United States Code, the Chief Acqui-
sition Officers Council established under section 16A of 
the Office of Federal Procurement Policy Act (41 U.S.C. 
414b), the Chief Financial Officers Council established 
under section 302 of the Chief Financial Officers Act of 
1990 (31 U.S.C. 901 note), and the private sector, shall 
develop, periodically update, and implement a supply chain 
risk management strategy designed to ensure the security 
of the Federal information infrastructure, including pro-
tection against unauthorized access to, alteration of infor-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
109 
mation in, disruption of operations of, interruption of com-
munications or services of, and insertion of malicious soft-
ware, engineering vulnerabilities, or otherwise corrupting 
software, hardware, services, or products intended for use 
in Federal information infrastructure. 
‘‘(b) CONTENTS.—The supply chain risk manage-
ment strategy developed under subsection (a) shall— 
‘‘(1) address risks in the supply chain during 
the entire life cycle of any part of the Federal infor-
mation infrastructure; 
‘‘(2) place particular emphasis on— 
‘‘(A) securing critical information systems 
and the Federal information infrastructure; 
‘‘(B) developing processes that— 
‘‘(i) incorporate all-source intelligence 
analysis into assessments of the supply 
chain for the Federal information infra-
structure; 
‘‘(ii) assess risks from potential sup-
pliers providing critical components or 
services of the Federal information infra-
structure; 
‘‘(iii) assess risks from individual 
components, including all subcomponents, 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
110 
or software used in or affecting the Fed-
eral information infrastructure; 
‘‘(iv) manage the quality, configura-
tion, and security of software, hardware, 
and systems of the Federal information in-
frastructure throughout the life cycle of 
the software, hardware, or system, includ-
ing components or subcomponents from 
secondary and tertiary sources; 
‘‘(v) detect the occurrence, reduce the 
likelihood of occurrence, and mitigate or 
remediate the risks associated with prod-
ucts containing counterfeit components or 
malicious functions; 
‘‘(vi) enhance developmental and oper-
ational test and evaluation capabilities, in-
cluding software vulnerability detection 
methods and automated tools that shall be 
integrated into acquisition policy practices 
by Federal agencies and, where appro-
priate, make the capabilities available for 
use by the private sector; and 
‘‘(vii) protect the intellectual property 
and trade secrets of suppliers of informa-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
111 
tion and communications technology prod-
ucts and services; 
‘‘(C) the use of internationally recognized 
standards and standards developed by the pri-
vate sector and developing a process, with the 
National Institute for Standards and Tech-
nology, to make recommendations for improve-
ments of the standards; 
‘‘(D) identifying acquisition practices of 
Federal agencies that increase risks in the sup-
ply chain and developing a process to provide 
recommendations for revisions to those proc-
esses; and 
‘‘(E) sharing with the private sector, to the 
fullest extent possible, the threats identified in 
the supply chain and working with the private 
sector to develop responses to those threats as 
identified; and 
‘‘(3) to the extent practicable, promote the abil-
ity of Federal agencies to procure commercial off the 
shelf information and communications technology 
products and services from a diverse pool of sup-
pliers. 
‘‘(c) IMPLEMENTATION.—The Federal Acquisition 
Regulatory Council established under section 25(a) of the 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
112 
Office of Federal Procurement Policy Act (41 U.S.C. 
421(a)) shall— 
‘‘(1) amend the Federal Acquisition Regulation 
issued under section 25 of that Act to— 
‘‘(A) incorporate, where relevant, the sup-
ply chain risk management strategy developed 
under subsection (a) to improve security 
throughout the acquisition process; and 
‘‘(B) direct that all software and hardware 
purchased by the Federal Government shall 
comply with standards developed or be inter-
operable with automated tools approved by the 
National Institute of Standards and Tech-
nology, to continually enhance security; and 
‘‘(2) develop a clause or set of clauses for inclu-
sion in solicitations, contracts, and task and delivery 
orders that sets forth the responsibility of the con-
tractor under the Federal Acquisition Regulation 
provisions implemented under this subsection.’’. 
TITLE III—FEDERAL INFORMA-
TION 
SECURITY 
MANAGE-
MENT 
SEC. 301. COORDINATION OF FEDERAL INFORMATION POL-
ICY. 
(a) FINDINGS.—Congress finds that— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
113 
(1) since 2002 the Federal Government has ex-
perienced multiple high-profile incidents that re-
sulted in the theft of sensitive information amount-
ing to more than the entire print collection con-
tained in the Library of Congress, including person-
ally identifiable information, advanced scientific re-
search, and prenegotiated United States diplomatic 
positions; and 
(2) chapter 35 of title 44, United States Code, 
must be amended to increase the coordination of 
Federal agency activities and to enhance situational 
awareness throughout the Federal Government using 
more effective enterprise-wide automated moni-
toring, detection, and response capabilities. 
(b) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by striking subchapters II and 
III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3550. Purposes 
‘‘The purposes of this subchapter are to— 
‘‘(1) provide a comprehensive framework for en-
suring the effectiveness of information security con-
trols over information resources that support the 
Federal information infrastructure and the oper-
ations and assets of agencies; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
114 
‘‘(2) recognize the highly networked nature of 
the current Federal information infrastructure and 
provide effective Government-wide management and 
oversight of the related information security risks, 
including coordination of information security efforts 
throughout the civilian, national security, and law 
enforcement communities; 
‘‘(3) provide for development and maintenance 
of prioritized and risk-based security controls re-
quired to protect Federal information infrastructure 
and information systems; 
‘‘(4) provide a mechanism for improved over-
sight of Federal agency information security pro-
grams; 
‘‘(5) acknowledge that commercially developed 
information security products offer advanced, dy-
namic, robust, and effective information security so-
lutions, reflecting market solutions for the protection 
of critical information infrastructures important to 
the national defense and economic security of the 
Nation that are designed, built, and operated by the 
private sector; and 
‘‘(6) recognize that the selection of specific 
technical hardware and software information secu-
VerDate Mar 15 2010 
04:59 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
115 
rity solutions should be left to individual agencies 
from among commercially developed products. 
‘‘§ 3551. Definitions 
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under section 3502 shall apply 
to this subchapter. 
‘‘(b) ADDITIONAL DEFINITIONS.—In this subchapter: 
‘‘(1) The term ‘agency information infrastruc-
ture’— 
‘‘(A) means information infrastructure 
that is owned, operated, controlled, or licensed 
for use by, or on behalf of, an agency, including 
information systems used or operated by an-
other entity on behalf of the agency; and 
‘‘(B) does not include national security 
systems. 
‘‘(2) The term ‘automated and continuous mon-
itoring’ means monitoring at a frequency and suffi-
ciency such that the data exchange requires little to 
no human involvement and is not interrupted; 
‘‘(3) The term ‘incident’ means an occurrence 
that— 
‘‘(A) actually or potentially jeopardizes— 
‘‘(i) the information security of an in-
formation system; or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
116 
‘‘(ii) the information the system proc-
esses, stores, or transmits; or 
‘‘(B) constitutes a violation or threat of 
violation of security policies, security proce-
dures, or acceptable use policies. 
‘‘(4) The term ‘information infrastructure’ 
means the underlying framework that information 
systems and assets rely on to process, transmit, re-
ceive, or store information electronically, including 
programmable electronic devices and communica-
tions networks and any associated hardware, soft-
ware, or data. 
‘‘(5) The term ‘information security’ means 
protecting information and information systems 
from disruption or unauthorized access, use, disclo-
sure, modification, or destruction in order to pro-
vide— 
‘‘(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
‘‘(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
117 
‘‘(C) availability, by ensuring timely and 
reliable access to and use of information. 
‘‘(6) The term ‘information technology’ has the 
meaning given that term in section 11101 of title 
40. 
‘‘(7) The term ‘management controls’ means 
safeguards or countermeasures for an information 
system that focus on the management of risk and 
the management of information system security. 
‘‘(8)(A) The term ‘national security system’ 
means any information system (including any tele-
communications system) used or operated by an 
agency or by a contractor of an agency, or other or-
ganization on behalf of an agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activities; 
‘‘(II) involves cryptologic activities re-
lated to national security; 
‘‘(III) involves command and control 
of military forces; 
‘‘(IV) involves equipment that is an 
integral part of a weapon or weapons sys-
tem; or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
118 
‘‘(V) subject to subparagraph (B), is 
critical to the direct fulfillment of military 
or intelligence missions; or 
‘‘(ii) that is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria es-
tablished by an Executive order or an Act of 
Congress to be kept classified in the interest of 
national defense or foreign policy. 
‘‘(B) Subparagraph (A)(i)(V) does not include a 
system that is to be used for routine administrative 
and business applications (including payroll, finance, 
logistics, and personnel management applications). 
‘‘(9) The term ‘operational controls’ means the 
safeguards and countermeasures for an information 
system that are primarily implemented and executed 
by individuals, not systems. 
‘‘(10) The term ‘risk’ means the potential for 
an unwanted outcome resulting from an incident, as 
determined by the likelihood of the occurrence of the 
incident and the associated consequences, including 
potential for an adverse outcome assessed as a func-
tion of threats, vulnerabilities, and consequences as-
sociated with an incident. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
119 
‘‘(11) The term ‘risk-based security’ means se-
curity commensurate with the risk and magnitude of 
harm resulting from the loss, misuse, or unauthor-
ized access to, or modification, of information, in-
cluding assuring that systems and applications used 
by the agency operate effectively and provide appro-
priate confidentiality, integrity, and availability. 
‘‘(12) The term ‘security controls’ means the 
management, operational, and technical controls pre-
scribed for an information system to protect the in-
formation security of the system. 
‘‘(13) The term ‘technical controls’ means the 
safeguards or countermeasures for an information 
system that are primarily implemented and executed 
by the information system through mechanism con-
tained in the hardware, software, or firmware com-
ponents of the system. 
‘‘§ 3552. Authority and functions of the National Cen-
ter for Cybersecurity and Communica-
tions 
‘‘(a) IN GENERAL.—The Director of the National 
Center for Cybersecurity and Communications shall— 
‘‘(1) develop, oversee the implementation of, 
and enforce policies, principles, and guidelines on in-
formation security, including through ensuring time-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
120 
ly agency adoption of and compliance with standards 
developed under section 20 of the National Institute 
of Standards and Technology Act (15 U.S.C. 278g– 
3) and subtitle E of title II of the Homeland Secu-
rity Act of 2002; 
‘‘(2) provide to agencies security controls that 
agencies shall be required to be implemented to miti-
gate and remediate vulnerabilities, attacks, and ex-
ploitations discovered as a result of activities re-
quired under this subchapter or subtitle E of title II 
of the Homeland Security Act of 2002; 
‘‘(3) to the extent practicable— 
‘‘(A) prioritize the policies, principles, 
standards, and guidelines promulgated under 
section 20 of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3), 
paragraph (1), and subtitle E of title II of the 
Homeland Security Act of 2002, based upon 
the risk of an incident; and 
‘‘(B) develop guidance that requires agen-
cies to monitor, including automated and con-
tinuous monitoring of, the effective implementa-
tion of policies, principles, standards, and 
guidelines developed under section 20 of the 
National Institute of Standards and Technology 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
121 
Act (15 U.S.C. 278g–3), paragraph (1), and 
subtitle E of title II of the Homeland Security 
Act of 2002; 
‘‘(C) ensure the effective operation of tech-
nical capabilities within the National Center for 
Cybersecurity and Communications to enable 
automated and continuous monitoring of any 
information collected as a result of the guidance 
developed under subparagraph (B) and use the 
information to enhance the risk-based security 
of the Federal information infrastructure; and 
‘‘(D) ensure the effective operation of a se-
cure system that satisfies information reporting 
requirements 
under 
sections 
3553(c) 
and 
3556(c); 
‘‘(4) require agencies, consistent with the stand-
ards developed under section 20 of the National In-
stitute of Standards and Technology Act (15 U.S.C. 
278g–3) or paragraph (1) and the requirements of 
this subchapter, to identify and provide information 
security protections commensurate with the risk re-
sulting from the disruption or unauthorized access, 
use, disclosure, modification, or destruction of— 
‘‘(A) information collected or maintained 
by or on behalf of an agency; or 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
122 
‘‘(B) information systems used or operated 
by an agency or by a contractor of an agency 
or other organization on behalf of an agency; 
‘‘(5) oversee agency compliance with the re-
quirements of this subchapter, including coordi-
nating with the Office of Management and Budget 
to use any authorized action under section 11303 of 
title 40 to enforce accountability for compliance with 
such requirements; 
‘‘(6) review, at least annually, and approve or 
disapprove, agency information security programs 
required under section 3553(b); and 
‘‘(7) coordinate information security policies 
and procedures with the Administrator for Elec-
tronic Government and the Administrator for the 
Office of Information and Regulatory Affairs with 
related information resources management policies 
and procedures. 
‘‘(b) NATIONAL SECURITY SYSTEMS.—The authori-
ties of the Director under this section shall not apply to 
national security systems. 
‘‘§ 3553. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
123 
‘‘(A) providing information security protec-
tions commensurate with the risk and mag-
nitude of the harm resulting from unauthorized 
access, use, disclosure, disruption, modification, 
or destruction of— 
‘‘(i) information collected or main-
tained by or on behalf of the agency; and 
‘‘(ii) agency information infrastruc-
ture; 
‘‘(B) complying with the requirements of 
this subchapter and related policies, procedures, 
standards, and guidelines, including— 
‘‘(i) 
information 
security 
require-
ments, including security controls, devel-
oped by the Director of the National Cen-
ter for Cybersecurity and Communications 
under section 3552, subtitle E of title II of 
the Homeland Security Act of 2002, or 
any other provision of law; 
‘‘(ii) information security policies, 
principles, standards, and guidelines pro-
mulgated under section 20 of the National 
Institute of Standards and Technology Act 
(15 
U.S.C. 
278g–3) 
and 
section 
3552(a)(1); 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
124 
‘‘(iii) information security standards 
and guidelines for national security sys-
tems issued in accordance with law and as 
directed by the President; and 
‘‘(iv) ensuring the standards imple-
mented for information systems and na-
tional security systems of the agency are 
complementary and uniform, to the extent 
practicable; 
‘‘(C) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning proc-
esses, including policies, procedures, and prac-
tices described in subsection (c)(1)(C); 
‘‘(D) as appropriate, maintaining secure 
facilities that have the capability of accessing, 
sending, receiving, and storing classified infor-
mation; 
‘‘(E) maintaining a sufficient number of 
personnel with security clearances, at the ap-
propriate levels, to access, send, receive and 
analyze classified information to carry out the 
responsibilities of this subchapter; and 
‘‘(F) ensuring that information security 
performance indicators and measures are in-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
125 
cluded in the annual performance evaluations of 
all managers, senior managers, senior executive 
service personnel, and political appointees; 
‘‘(2) ensure that senior agency officials provide 
information security for the information and infor-
mation systems that support the operations and as-
sets under the control of those officials, including 
through— 
‘‘(A) assessing the risk and magnitude of 
the harm that could result from the disruption 
or unauthorized access, use, disclosure, modi-
fication, or destruction of such information or 
information systems; 
‘‘(B) determining the levels of information 
security appropriate to protect such information 
and information systems in accordance with 
policies, principles, standards, and guidelines 
promulgated under section 20 of the National 
Institute of Standards and Technology Act (15 
U.S.C. 278g–3), section 3552(a)(1), and sub-
title E of title II of the Homeland Security Act 
of 2002, for information security categoriza-
tions and related requirements; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
126 
‘‘(C) implementing policies and procedures 
to cost effectively reduce risks to an acceptable 
level; 
‘‘(D) periodically testing and evaluating in-
formation security controls and techniques to 
ensure that such controls and techniques are 
operating effectively; and 
‘‘(E) withholding all bonus and cash 
awards to senior agency officials accountable 
for the operation of such agency information in-
frastructure that are recognized by the Chief 
Information Security Officer as impairing the 
risk-based security information, information 
system, or agency information infrastructure; 
‘‘(3) delegate to a senior agency officer des-
ignated as the Chief Information Security Officer 
the authority and budget necessary to ensure and 
enforce compliance with the requirements imposed 
on the agency under this subchapter, subtitle E of 
title II of the Homeland Security Act of 2002, or 
any other provision of law, including— 
‘‘(A) overseeing the establishment, mainte-
nance, and management of a security oper-
ations center that has technical capabilities that 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
127 
can, through automated and continuous moni-
toring— 
‘‘(i) detect, report, respond to, con-
tain, remediate, and mitigate incidents 
that impair risk-based security of the in-
formation, information systems, and agen-
cy information infrastructure, in accord-
ance with policy provided by the National 
Center for Cybersecurity and Communica-
tions; 
‘‘(ii) monitor and, on a risk-based 
basis, mitigate and remediate the vulnera-
bilities of every information system within 
the agency information infrastructure; 
‘‘(iii) continually evaluate risks posed 
to information collected or maintained by 
or on behalf of the agency and information 
systems and hold senior agency officials 
accountable for ensuring the risk-based se-
curity of such information and information 
systems; 
‘‘(iv) collaborate with the National 
Center for Cybersecurity and Communica-
tions and appropriate public and private 
sector security operations centers to ad-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00127
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
128 
dress incidents that impact the security of 
information and information systems that 
extend beyond the control of the agency; 
and 
‘‘(v) report any incident described 
under clauses (i) and (ii), as directed by 
the policy of the National Center for Cy-
bersecurity and Communications or the In-
spector General of the agency; 
‘‘(B) collaborating with the Administrator 
for E–Government and the Chief Information 
Officer to establish, maintain, and update an 
enterprise network, system, storage, and secu-
rity architecture, that can be accessed by the 
National Cybersecurity Communications Center 
and includes— 
‘‘(i) information on how security con-
trols are implemented throughout the 
agency information infrastructure; and 
‘‘(ii) information on how the controls 
described under subparagraph (A) main-
tain the appropriate level of confidentiality, 
integrity, and availability of information 
and information systems based on— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00128
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
129 
‘‘(I) the policy of the National 
Center for Cybersecurity and Commu-
nications; and 
‘‘(II) the standards or guidance 
developed by the National Institute of 
Standards and Technology; 
‘‘(C) developing, maintaining, and over-
seeing an agency-wide information security pro-
gram as required by subsection (b); 
‘‘(D) developing, maintaining, and over-
seeing information security policies, procedures, 
and control techniques to address all applicable 
requirements, including those issued under sec-
tion 3552; 
‘‘(E) training, consistent with the require-
ments of section 406 of the Protecting Cyber-
space as a National Asset Act of 2010, and 
overseeing personnel with significant respon-
sibilities for information security with respect to 
such responsibilities; and 
‘‘(F) assisting senior agency officers con-
cerning their responsibilities under paragraph 
(2); 
‘‘(4) ensure that the Chief Information Security 
Officer has a sufficient number of cleared and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00129
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
130 
trained personnel with technical skills identified by 
the National Center for Cybersecurity and Commu-
nications as critical to maintaining the risk-based se-
curity of agency information infrastructure as re-
quired by the subchapter and other applicable laws; 
‘‘(5) ensure that the agency Chief Information 
Security Officer, in coordination with appropriate 
senior agency officials, reports not less than annu-
ally to the head of the agency on the effectiveness 
of the agency information security program, includ-
ing progress of remedial actions; 
‘‘(6) ensure that the Chief Information Security 
Officer— 
‘‘(A) possesses necessary qualifications, in-
cluding education, professional certifications, 
training, experience, and the security clearance 
required to administer the functions described 
under this subchapter; and 
‘‘(B) has information security duties as the 
primary duty of that officer; and 
‘‘(7) ensure that components of that agency es-
tablish and maintain an automated reporting mecha-
nism that allows the Chief Information Security Of-
ficer with responsibility for the entire agency, and all 
components thereof, to implement, monitor, and hold 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00130
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
131 
senior agency officers accountable for the implemen-
tation of appropriate security policies, procedures, 
and controls of agency components. 
‘‘(b) AGENCY-WIDE INFORMATION SECURITY PRO-
GRAM.—Each agency shall develop, document, and imple-
ment an agency-wide information security program, ap-
proved by the National Center for Cybersecurity and Com-
munications under section 3552(a)(6) and consistent with 
components across and within agencies, to provide infor-
mation security for the information and information sys-
tems that support the operations and assets of the agency, 
including those provided or managed by another agency, 
contractor, or other source, that includes— 
‘‘(1) frequent assessments, at least twice each 
month— 
‘‘(A) of the risk and magnitude of the 
harm that could result from the disruption or 
unauthorized access, use, disclosure, modifica-
tion, or destruction of information and informa-
tion systems that support the operations and 
assets of the agency; and 
‘‘(B) that assess whether information or 
information systems should be removed or mi-
grated to more secure networks or standards 
and make recommendations to the head of the 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00131
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
132 
agency and the Director of the National Center 
for Cybersecurity and Communications based 
on that assessment; 
‘‘(2) consistent with guidance developed under 
section 3554, vulnerability assessments and penetra-
tion tests commensurate with the risk posed to an 
agency information infrastructure; 
‘‘(3) ensure that information security vulnera-
bilities are remediated or mitigated based on the risk 
posed to the agency; 
‘‘(4) policies and procedures that— 
‘‘(A) are informed and revised by the as-
sessments required under paragraphs (1) and 
(2); 
‘‘(B) cost effectively reduce information se-
curity risks to an acceptable level; 
‘‘(C) ensure that information security is 
addressed throughout the life cycle of each 
agency information system; and 
‘‘(D) ensure compliance with— 
‘‘(i) the requirements of this sub-
chapter; 
‘‘(ii) policies and procedures pre-
scribed by the National Center for Cyber-
security and Communications; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00132
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
133 
‘‘(iii) minimally acceptable system 
configuration requirements, as determined 
by the National Center for Cybersecurity 
and Communications; and 
‘‘(iv) any other applicable require-
ments, including standards and guidelines 
for national security systems issued in ac-
cordance with law and as directed by the 
President; 
‘‘(5) subordinate plans for providing risk-based 
information security for networks, facilities, and sys-
tems or groups of information systems, as appro-
priate; 
‘‘(6) role-based security awareness training, 
consistent with the requirements of section 406 of 
the Protecting Cyberspace as a National Asset Act 
of 2010, to inform personnel with access to the 
agency network, including contractors and other 
users of information systems that support the oper-
ations and assets of the agency, of— 
‘‘(A) information security risks associated 
with agency activities; and 
‘‘(B) agency responsibilities in complying 
with agency policies and procedures designed to 
reduce those risks; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00133
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
134 
‘‘(7) periodic testing and evaluation of the ef-
fectiveness of information security policies, proce-
dures, and practices, to be performed with a rigor 
and frequency depending on risk, which shall in-
clude— 
‘‘(A) testing and evaluation not less than 
twice each year of security controls of informa-
tion collected or maintained by or on behalf of 
the agency and every information system identi-
fied in the inventory required under section 
3505(c); 
‘‘(B) the effectiveness of ongoing moni-
toring, including automated and continuous 
monitoring, vulnerability scanning, and intru-
sion detection and prevention of incidents posed 
to the risk-based security of information and in-
formation systems as required under subsection 
(a)(3); and 
‘‘(C) testing relied on in— 
‘‘(i) an operational evaluation under 
section 3554; 
‘‘(ii) an independent assessment under 
section 3556; or 
‘‘(iii) another evaluation, to the extent 
specified by the Director; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00134
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
135 
‘‘(8) a process for planning, implementing, eval-
uating, and documenting remedial action to address 
any deficiencies in the information security policies, 
procedures, and practices of the agency; 
‘‘(9) procedures for detecting, reporting, and re-
sponding to incidents, consistent with requirements 
issued under section 3552, that include— 
‘‘(A) to the extent practicable, automated 
and continuous monitoring of the use of infor-
mation and information systems; 
‘‘(B) requirements for mitigating risks and 
remediating vulnerabilities associated with such 
incidents systemically within the agency infor-
mation infrastructure before substantial dam-
age is done; and 
‘‘(C) notifying and coordinating with the 
National Center for Cybersecurity and Commu-
nications, as required by this subchapter, sub-
title E of title II of the Homeland Security Act 
of 2002, and any other provision of law; and 
‘‘(10) plans and procedures to ensure continuity 
of operations for information systems that support 
the operations and assets of the agency. 
‘‘(c) AGENCY REPORTING.— 
‘‘(1) IN GENERAL.—Each agency shall— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00135
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
136 
‘‘(A) ensure that information relating to 
the adequacy and effectiveness of information 
security policies, procedures, and practices, is 
available to the entities identified under para-
graph (2) through the system developed under 
section 3552(a)(3), including information relat-
ing to— 
‘‘(i) compliance with the requirements 
of this subchapter; 
‘‘(ii) the effectiveness of the informa-
tion security policies, procedures, and prac-
tices of the agency based on a determina-
tion of the aggregate effect of identified 
deficiencies and vulnerabilities; 
‘‘(iii) an identification and analysis of 
any significant deficiencies identified in 
such policies, procedures, and practices; 
‘‘(iv) an identification of any vulner-
ability that could impair the risk-based se-
curity of the agency information infra-
structure; and 
‘‘(v) results of any operational evalua-
tion conducted under section 3554 and 
plans of action to address the deficiencies 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00136
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
137 
and vulnerabilities identified as a result of 
such operational evaluation; 
‘‘(B) follow the policy, guidance, and 
standards of the National Center for Cybersecu-
rity and Communications, in consultation with 
the Federal Information Security Taskforce, to 
continually update, and ensure the electronic 
availability of both a classified and unclassified 
version of the information required under sub-
paragraph (A); 
‘‘(C) ensure the information under sub-
paragraph (A) addresses the adequacy and ef-
fectiveness of information security policies, pro-
cedures, and practices in plans and reports re-
lating to— 
‘‘(i) annual agency budgets; 
‘‘(ii) information resources manage-
ment of this subchapter; 
‘‘(iii) information technology manage-
ment and procurement under this chapter 
or any other applicable provision of law; 
‘‘(iv) subtitle E of title II of the 
Homeland Security Act of 2002; 
‘‘(v) program performance under sec-
tions 1105 and 1115 through 1119 of title 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00137
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
138 
31, and sections 2801 and 2805 of title 
39; 
‘‘(vi) financial management under 
chapter 9 of title 31, and the Chief Finan-
cial Officers Act of 1990 (31 U.S.C. 501 
note; Public Law 101–576) (and the 
amendments made by that Act); 
‘‘(vii) financial management systems 
under the Federal Financial Management 
Improvement Act (31 U.S.C. 3512 note); 
‘‘(viii) internal accounting and admin-
istrative controls under section 3512 of 
title 31; and 
‘‘(ix) performance ratings, salaries, 
and bonuses provided to the senior man-
agers and supporting personnel taking into 
account program performance as it relates 
to complying with this subchapter; and 
‘‘(D) report any significant deficiency in a 
policy, procedure, or practice identified under 
subparagraph (A) or (B)— 
‘‘(i) as a material weakness in report-
ing under section 3512 of title 31; and 
‘‘(ii) if relating to financial manage-
ment systems, as an instance of a lack of 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00138
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
139 
substantial compliance under the Federal 
Financial Management Improvement Act 
(31 U.S.C. 3512 note). 
‘‘(2) ADEQUACY AND EFFECTIVENESS INFOR-
MATION.—Information required under paragraph 
(1)(A) shall, to the extent possible and in accordance 
with applicable law, policy, guidance, and standards, 
be available on an automated and continuous basis 
to— 
‘‘(A) the National Center for Cybersecurity 
and Communications; 
‘‘(B) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
‘‘(C) the Committee on Government Over-
sight and Reform of the House of Representa-
tives; 
‘‘(D) the Committee on Homeland Security 
of the House of Representatives; 
‘‘(E) other appropriate authorization and 
appropriations committees of Congress; 
‘‘(F) the Inspector General of the Federal 
agency; and 
‘‘(G) the Comptroller General. 
‘‘(d) INCLUSIONS IN PERFORMANCE PLANS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00139
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
140 
‘‘(1) IN GENERAL.—In addition to the require-
ments of subsection (c), each agency, in consultation 
with the National Center for Cybersecurity and 
Communications, shall include as part of the per-
formance plan required under section 1115 of title 
31 a description of the time periods the resources, 
including budget, staffing, and training, that are 
necessary to implement the program required under 
subsection (b). 
‘‘(2) RISK
ASSESSMENTS.—The description 
under paragraph (1) shall be based on the risk and 
vulnerability assessments required under subsection 
(b) and evaluations required under section 3554. 
‘‘(e) NOTICE
AND COMMENT.—Each agency shall 
provide the public with timely notice and opportunities for 
comment on proposed information security policies and 
procedures to the extent that such policies and procedures 
affect communication with the public. 
‘‘(f) MORE STRINGENT STANDARDS.—The head of 
an agency may employ standards for the cost effective in-
formation security for information systems within or 
under the supervision of that agency that are more strin-
gent than the standards the Director of the National Cen-
ter for Cybersecurity and Communications prescribes 
under this subchapter, subtitle E of title II of the Home-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00140
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
141 
land Security Act of 2002, or any other provision of law, 
if the more stringent standards— 
‘‘(1) contain at least the applicable standards 
made compulsory and binding by the Director of the 
National Center for Cybersecurity and Communica-
tions; and 
‘‘(2) are otherwise consistent with policies and 
guidelines issued under section 3552. 
‘‘§ 3554. Annual operational evaluation 
‘‘(a) GUIDANCE.— 
‘‘(1) IN
GENERAL.—Each year the National 
Center for Cybersecurity and Communications shall 
oversee, coordinate, and develop guidance for the ef-
fective implementation of operational evaluations of 
the Federal information infrastructure and agency 
information security programs and practices to de-
termine the effectiveness of such program and prac-
tices. 
‘‘(2) COLLABORATION
IN
DEVELOPMENT.—In 
developing guidance for the operational evaluations 
described under this section, the National Center for 
Cybersecurity and Communications shall collaborate 
with the Federal Information Security Taskforce 
and the Council of Inspectors General on Integrity 
and Efficiency, and other agencies as necessary, to 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00141
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
142 
develop and update risk-based performance indica-
tors and measures that assess the adequacy and ef-
fectiveness of information security of an agency and 
the Federal information infrastructure. 
‘‘(3) CONTENTS
OF
OPERATIONAL
EVALUA-
TION.—Each operational evaluation under this sec-
tion— 
‘‘(A) shall be prioritized based on risk; and 
‘‘(B) shall— 
‘‘(i) test the effectiveness of agency 
information security policies, procedures, 
and practices of the information systems of 
the agency, or a representative subset of 
those information systems; 
‘‘(ii) assess (based on the results of 
the testing) compliance with— 
‘‘(I) the requirements of this sub-
chapter; and 
‘‘(II) related information security 
policies, procedures, standards, and 
guidelines; 
‘‘(iii) evaluate whether agencies— 
‘‘(I) effectively monitor, detect, 
analyze, protect, report, and respond 
to vulnerabilities and incidents; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00142
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
143 
‘‘(II) report to and collaborate 
with the appropriate public and pri-
vate security operation centers, the 
National Center for Cybersecurity and 
Communications, and law enforcement 
agencies; and 
‘‘(III) remediate or mitigate the 
risk posed by attacks and exploi-
tations in a timely fashion in order to 
prevent future vulnerabilities and inci-
dents; and 
‘‘(iv) identify deficiencies of agency in-
formation security policies, procedures, and 
controls on the agency information infra-
structure. 
‘‘(b) CONDUCT AN OPERATIONAL EVALUATION.— 
‘‘(1) IN GENERAL.—Except as provided under 
paragraph (2), and in consultation with the Chief 
Information Officer and senior officials responsible 
for the affected systems, the Chief Information Se-
curity Officer of each agency shall not less than an-
nually— 
‘‘(A) conduct an operational evaluation of 
the agency 
information 
infrastructure 
for 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00143
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
144 
vulnerabilities, attacks, and exploitations of the 
agency information infrastructure; 
‘‘(B) evaluate the ability of the agency to 
monitor, detect, correlate, analyze, report, and 
respond to incidents; and 
‘‘(C) report to the head of the agency, the 
National Center for Cybersecurity and Commu-
nications, the Chief Information Officer, and 
the Inspector General for the agency the find-
ings of the operational evaluation. 
‘‘(2) SATISFACTION
OF
REQUIREMENTS
BY 
OTHER EVALUATION.—Unless otherwise specified by 
the Director of the National Center for Cybersecu-
rity and Communications, if the National Center for 
Cybersecurity and Communications conducts an 
operational evaluation of the agency information in-
frastructure under section 245(b)(2)(A) of the 
Homeland Security Act of 2002, the Chief Informa-
tion Security Officer may deem the requirements of 
paragraph (1) satisfied for the year in which the 
operational evaluation described under this para-
graph is conducted. 
‘‘(c) CORRECTIVE MEASURES MITIGATION AND RE-
MEDIATION PLANS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00144
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
145 
‘‘(1) IN
GENERAL.—In consultation with the 
National Center for Cybersecurity and Communica-
tions and the Chief Information Officer, Chief Infor-
mation Security Officers shall remediate or mitigate 
vulnerabilities in accordance with this subsection. 
‘‘(2) RISK-BASED PLAN.—After an operational 
evaluation is conducted under this section or under 
section 245(b) of the Homeland Security Act of 
2002, the agency shall submit to the National Cen-
ter for Cybersecurity and Communications in a time-
ly fashion a risk-based plan for addressing rec-
ommendations and mitigating and remediating 
vulnerabilities identified as a result of such oper-
ational evaluation, including a timeline and budget 
for implementing such plan. 
‘‘(3) APPROVAL
OR
DISAPPROVAL.—Not later 
than 15 days after receiving a plan submitted under 
paragraph (2), the National Center for Cybersecu-
rity and Communications shall— 
‘‘(A) approve or disprove the agency plan; 
and 
‘‘(B) comment on the adequacy and effec-
tiveness of the plan. 
‘‘(4) ISOLATION FROM INFRASTRUCTURE.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00145
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
146 
‘‘(A) IN GENERAL.—The Director of the 
National Center for Cybersecurity and Commu-
nications may, consistent with the contingency 
or continuity of operation plans applicable to 
such agency information infrastructure, order 
the isolation of any component of the Federal 
information infrastructure from any other Fed-
eral information infrastructure, if— 
‘‘(i) an agency does not implement 
measures in a risk-based plan approved 
under this subsection; and 
‘‘(ii) the failure to comply presents a 
significant danger to the Federal informa-
tion infrastructure. 
‘‘(B) DURATION.—An isolation under sub-
paragraph (A) shall remain in effect until— 
‘‘(i) the Director of the National Cen-
ter for Cybersecurity and Communications 
determines that corrective measures have 
been implemented; or 
‘‘(ii) an updated risk-based plan is ap-
proved by the National Center for Cyberse-
curity and Communications and imple-
mented by the agency. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00146
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
147 
‘‘(d) OPERATIONAL GUIDANCE.—The Director of the 
National Center for Cybersecurity and Communications 
shall— 
‘‘(1) not later than 180 days after the date of 
enactment of the Protecting Cyberspace as a Na-
tional Asset Act of 2010, develop operational guid-
ance for operational evaluations as required under 
this section that are risk-based and cost effective; 
and 
‘‘(2) periodically evaluate and ensure informa-
tion is available on an automated and continuous 
basis through the system required under section 
3552(a)(3)(D) to Congress on— 
‘‘(A) the adequacy and effectiveness of the 
operational evaluations conducted under this 
section or section 245(b) of the Homeland Se-
curity Act of 2002; and 
‘‘(B) possible executive and legislative ac-
tions for cost-effectively managing the risks to 
the Federal information infrastructure. 
‘‘§ 3555. Federal Information Security Taskforce 
‘‘(a) ESTABLISHMENT.—There is established in the 
executive 
branch 
a 
Federal 
Information 
Security 
Taskforce. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00147
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
148 
‘‘(b) MEMBERSHIP.—The members of the Federal In-
formation Security Taskforce shall be full-time senior Gov-
ernment employees and shall be as follows: 
‘‘(1) The Director of the National Center for 
Cybersecurity and Communications. 
‘‘(2) The Administrator of the Office of Elec-
tronic Government of the Office of Management and 
Budget. 
‘‘(3) The Chief Information Security Officer of 
each agency described under section 901(b) of title 
31. 
‘‘(4) The Chief Information Security Officer of 
the Department of the Army, the Department of the 
Navy, and the Department of the Air Force. 
‘‘(5) A representative from the Office of Cyber-
space Policy. 
‘‘(6) A representative from the Office of the Di-
rector of National Intelligence. 
‘‘(7) A representative from the United States 
Cyber Command. 
‘‘(8) A representative from the National Secu-
rity Agency. 
‘‘(9) A representative from the United States 
Computer Emergency Readiness Team. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00148
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
149 
‘‘(10) A representative from the Intelligence 
Community Incident Response Center. 
‘‘(11) A representative from the Committee on 
National Security Systems. 
‘‘(12) A representative from the National Insti-
tute for Standards and Technology. 
‘‘(13) A representative from the Council of In-
spectors General on Integrity and Efficiency. 
‘‘(14) A representative from State and local 
government. 
‘‘(15) Any other officer or employee of the 
United States designated by the chairperson. 
‘‘(c) CHAIRPERSON AND VICE-CHAIRPERSON.— 
‘‘(1) CHAIRPERSON.—The Director of the Na-
tional Center for Cybersecurity and Communications 
shall act as chairperson of the Federal Information 
Security Taskforce. 
‘‘(2) VICE-CHAIRPERSON.—The vice chairperson 
of the Federal Information Security Taskforce 
shall— 
‘‘(A) be selected by the Federal Informa-
tion Security Taskforce from among its mem-
bers; 
‘‘(B) serve a 1-year term and may serve 
multiple terms; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00149
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
150 
‘‘(C) serve as a liaison to the Chief Infor-
mation Officer, Council of the Inspectors Gen-
eral on Integrity and Efficiency, Committee on 
National Security Systems, and other councils 
or committees as appointed by the chairperson. 
‘‘(d) FUNCTIONS.—The Federal Information Security 
Taskforce shall— 
‘‘(1) be the principal interagency forum for col-
laboration regarding best practices and recommenda-
tions for agency information security and the secu-
rity of the Federal information infrastructure; 
‘‘(2) assist in the development of and annually 
evaluate guidance to fulfill the requirements under 
sections 3554 and 3556; 
‘‘(3) share experiences and innovative ap-
proaches relating to threats against the Federal in-
formation infrastructure, information sharing and 
information security best practices, penetration test-
ing regimes, and incident response, mitigation, and 
remediation; 
‘‘(4) promote the development and use of stand-
ard performance indicators and measures for agency 
information security that— 
‘‘(A) are outcome-based; 
‘‘(B) focus on risk management; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00150
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
151 
‘‘(C) align with the business and program 
goals of the agency; 
‘‘(D) measure improvements in the agency 
security posture over time; and 
‘‘(E) reduce burdensome and efficient per-
formance indicators and measures; 
‘‘(5) recommend to the Office of Personnel 
Management the necessary qualifications to be es-
tablished for Chief Information Security Officers to 
be capable of administering the functions described 
under this subchapter including education, training, 
and experience; 
‘‘(6) enhance information system processes by 
establishing a prioritized baseline of information se-
curity measures and controls that can be continu-
ously monitored through automated mechanisms; 
‘‘(7) evaluate the effectiveness and efficiency of 
any reporting and compliance requirements that are 
required by law related to the information security 
of Federal information infrastructure; and 
‘‘(8) submit proposed enhancements developed 
under paragraphs (1) through (7) to the Director of 
the National Center for Cybersecurity and Commu-
nications. 
‘‘(e) TERMINATION.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00151
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
152 
‘‘(1) IN GENERAL.—Except as provided under 
paragraph (2), the Federal Information Security 
Taskforce shall terminate 4 years after the date of 
enactment of the Protecting Cyberspace as a Na-
tional Asset Act of 2010. 
‘‘(2) EXTENSION.—The President may— 
‘‘(A) extend the Federal Information Secu-
rity Taskforce by executive order; and 
‘‘(B) make more than 1 extension under 
this paragraph for any period as the President 
may determine. 
‘‘§ 3556. Independent assessments 
‘‘(a) IN GENERAL.— 
‘‘(1) INSPECTORS
GENERAL
ASSESSMENTS.— 
Not less than every 2 years, each agency with an In-
spector General appointed under the Inspector Gen-
eral Act of 1978 (5 U.S.C. App.) shall assess the 
adequacy and effectiveness of the information secu-
rity program developed under section 3553(b) and 
(c), and evaluations conducted under section 3554. 
‘‘(2) INDEPENDENT ASSESSMENTS.—For each 
agency to which paragraph (1) does not apply, the 
head of the agency shall engage an independent ex-
ternal auditor to perform the assessment. 
VerDate Mar 15 2010 
04:59 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00152
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
153 
‘‘(b) EXISTING ASSESSMENTS.—The assessments re-
quired by this section may be based in whole or in part 
on an audit, evaluation, or report relating to programs or 
practices of the applicable agency. 
‘‘(c) INSPECTORS GENERAL REPORTING.—Inspectors 
General shall ensure information obtained as a result of 
the assessment required under this section, or any other 
relevant information, is available through the system re-
quired under section 3552(a)(3)(D) to Congress and the 
National Center for Cybersecurity and Communications. 
‘‘§ 3557. Protection of information 
‘‘In complying with this subchapter, agencies, eval-
uators, and Inspectors General shall take appropriate ac-
tions to ensure the protection of information which, if dis-
closed, may adversely affect information security. Protec-
tions under this chapter shall be commensurate with the 
risk and comply with all applicable laws and regulations.’’. 
(c) TECHNICAL AND CONFORMING AMENDMENTS.— 
(1) TABLE OF SECTIONS.—The table of sections 
for chapter 35 of title 44, United States Code, is 
amended by striking the matter relating to sub-
chapters II and III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘3550. Purposes. 
‘‘3551. Definitions. 
‘‘3552. Authority and functions of the National Center for Cybersecurity and 
Communications. 
‘‘3553. Agency responsibilities. 
‘‘3554. Annual operational evaluation. 
VerDate Mar 15 2010 
04:59 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00153
Fmt 6652
Sfmt 6211
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
154 
‘‘3555. Federal Information Security Taskforce. 
‘‘3556. Independent assessments. 
‘‘3557. Protection of information.’’. 
(2) OTHER REFERENCES.— 
(A) Section 1001(c)(1)(A) of the Home-
land 
Security 
Act 
of 
2002 
(6 
U.S.C. 
511(c)(1)(A)) is amended by striking ‘‘section 
3532(3)’’ and inserting ‘‘section 3551(b)’’. 
(B) Section 2222(j)(6) of title 10, United 
States Code, is amended by striking ‘‘section 
3542(b)(2))’’ and inserting ‘‘section 3551(b)’’. 
(C) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2))’’ and inserting ‘‘section 3551(b)’’. 
(D) Section 2315 of title 10, United States 
Code, 
is 
amended 
by 
striking 
‘‘section 
3542(b)(2))’’ and inserting ‘‘section 3551(b)’’. 
(E) Section 20(a)(2) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3) is amended by striking ‘‘section 
3532(b)(2)’’ and inserting ‘‘section 3551(b)’’. 
(F) Section 21(b)(2) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–4(b)(2)) is amended by striking 
‘‘Institute and’’ and inserting ‘‘Institute, the 
Director of the National Center on Cybersecu-
rity and Communications, and’’. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00154
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
155 
(G) Section 21(b)(3) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–4(b)(3)) is amended by inserting 
‘‘the Director of the National Center on Cyber-
security and Communications,’’ after ‘‘the Di-
rector of the National Security Agency,’’. 
(H) Section 8(d)(1) of the Cyber Security 
Research and Development Act (15 U.S.C. 
7406(d)(1)) is amended by striking ‘‘section 
3534(b)’’ and inserting ‘‘section 3553(b)’’. 
(3) HOMELAND SECURITY ACT OF 2002.— 
(A) TITLE
X.—The Homeland Security 
Act of 2002 (6 U.S.C. 101 et seq.) is amended 
by striking title X. 
(B) TABLE OF CONTENTS.—The table of 
contents in section 1(b) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 101 et seq.) is 
amended by striking the matter relating to title 
X. 
(d) REPEAL OF OTHER STANDARDS.— 
(1) IN GENERAL.—Section 11331 of title 40, 
United States Code, is repealed. 
(2) TECHNICAL
AND
CONFORMING
AMEND-
MENTS.— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00155
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
156 
(A) Section 20(c)(3) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3(c)(3)) is amended by striking 
‘‘under section 11331 of title 40, United States 
Code’’. 
(B) Section 20(d)(1) of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3(d)(1)) is amended by striking 
‘‘the Director of the Office of Management and 
Budget for promulgation under section 11331 
of title 40, United States Code’’ and inserting 
‘‘the Secretary of Commerce for promulgation’’. 
(C) Section 11302(d) of title 40, United 
States Code, is amended by striking ‘‘under sec-
tion 11331 of this title and’’. 
(D) Section 1874A (e)(2)(A)(ii) of the So-
cial 
Security 
Act 
(42 
U.S.C.1395kk–1 
(e)(2)(A)(ii)) is amended by striking ‘‘section 
11331 of title 40, United States Code’’ and in-
serting ‘‘section 3552 of title 44, United States 
Code’’. 
(E) Section 3504(g)(2) of title 44, United 
States Code, is amended by striking ‘‘section 
11331 of title 40’’ and inserting ‘‘section 3552 
of title 44’’. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00156
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
157 
(F) Section 3504(h)(1) of title 44, United 
States Code, is amended by inserting ‘‘, the Di-
rector of the National Center for Cybersecurity 
and Communications,’’ after ‘‘the National In-
stitute of Standards and Technology’’. 
(G) Section 3504(h)(1)(B) of title 44, 
United States Code, is amended by striking 
‘‘under section 11331 of title 40’’ and inserting 
‘‘section 3552 of title 44’’. 
(H) Section 3518(d) of title 44, United 
States Code, is amended by striking ‘‘sections 
11331 and 11332’’ and inserting ‘‘section 
11332’’. 
(I) Section 3602(f)(8) of title 44, United 
States Code, is amended by striking ‘‘under sec-
tion 11331 of title 40. 
(J) Section 3603(f)(5) of title 44, United 
States Code, is amended by striking ‘‘and pro-
mulgated under section 11331 of title 40,’’. 
TITLE IV—RECRUITMENT AND 
PROFESSIONAL DEVELOPMENT 
SEC. 401. DEFINITIONS. 
In this title: 
(1) CYBERSECURITY MISSION.—The term ‘‘cy-
bersecurity mission’’ means the activities of the Fed-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00157
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
158 
eral Government that encompass the full range of 
threat reduction, vulnerability reduction, deterrence, 
international engagement, incident response, resil-
iency, and recovery policies and activities, including 
computer network operations, information assur-
ance, law enforcement, diplomacy, military, and in-
telligence missions as such activities relate to the se-
curity and stability of cyberspace. 
(2) FEDERAL AGENCY’S CYBERSECURITY MIS-
SION.—The term ‘‘Federal agency’s cybersecurity 
mission’’ means, with respect to any Federal agency, 
the portion of the cybersecurity mission that is the 
responsibility of the Federal agency. 
SEC. 402. ASSESSMENT OF CYBERSECURITY WORKFORCE. 
(a) IN GENERAL.—The Director of the Office of Per-
sonnel Management and the Director shall assess the 
readiness and capacity of the Federal workforce to meet 
the needs of the cybersecurity mission of the Federal Gov-
ernment. 
(b) STRATEGY.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of enactment of this Act, the Director 
of the Office of Personnel Management shall develop 
and implement a comprehensive workforce strategy 
that enhances the readiness, capacity, training, and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00158
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
159 
recruitment and retention of Federal cybersecurity 
personnel. 
(2) CONTENTS.—The strategy developed under 
paragraph (1) shall include— 
(A) a 5-year plan on recruitment of per-
sonnel for the Federal workforce; and 
(B) 10-year and 20-year projections of 
workforce needs. 
SEC. 403. STRATEGIC CYBERSECURITY WORKFORCE PLAN-
NING. 
(a) FEDERAL AGENCY DEVELOPMENT
OF STRA-
TEGIC CYBERSECURITY WORKFORCE PLANS.—Not later 
than 180 days after the date of enactment of this Act and 
in every subsequent year, the head of each Federal agency 
shall develop a strategic cybersecurity workforce plan as 
part of the Federal agency performance plan required 
under section 1115 of title 31, United States Code. 
(b) INTERAGENCY COORDINATION.—Each Federal 
agency shall develop a plan prepared under subsection 
(a)— 
(1) on the basis of the assessment developed 
under section 402 and any subsequent guidance 
from the Director of the Office of Personnel Man-
agement and the Director; and 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00159
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
160 
(2) in consultation with the Director and the 
Director of the Office of Management and Budget. 
(c) CONTENTS OF THE PLAN.— 
(1) IN GENERAL.—Each plan prepared under 
subsection (a) shall include— 
(A) a description of the Federal agency’s 
cybersecurity mission; 
(B) subject to paragraph (2), a description 
and analysis, relating to the specialized work-
force needed by the Federal agency to fulfill the 
Federal agency’s cybersecurity mission, includ-
ing— 
(i) the workforce needs of the Federal 
agency on the date of the report, and 10- 
year and 20-year projections of workforce 
needs; 
(ii) hiring projections to meet work-
force needs, including, for at least a 2-year 
period, specific occupation and grade lev-
els; 
(iii) long-term and short-term stra-
tegic goals to address critical skills defi-
ciencies, including analysis of the numbers 
of and reasons for attrition of employees; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00160
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
161 
(iv) recruitment strategies, including 
the use of student internships, part-time 
employment, student loan reimbursement, 
and telework, to attract highly qualified 
candidates from diverse backgrounds and 
geographic locations; 
(v) an assessment of the sources and 
availability of individuals with needed ex-
pertise; 
(vi) ways to streamline the hiring 
process; 
(vii) the barriers to recruiting and hir-
ing individuals qualified in cybersecurity 
and recommendations to overcome the bar-
riers; and 
(viii) a training and development plan, 
consistent with the curriculum developed 
under section 406, to enhance and improve 
the knowledge of employees. 
(2) FEDERAL AGENCIES WITH SMALL SPECIAL-
IZED
WORKFORCE.—In accordance with guidance 
provided by the Director of the Office of Personnel 
Management, a Federal agency that needs only a 
small specialized workforce to fulfill the Federal 
agency’s cybersecurity mission may present the 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00161
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
162 
workforce plan components referred to in paragraph 
(1)(B) as part of the Federal agency performance 
plan required under section 1115 of title 31, United 
States Code. 
SEC. 404. CYBERSECURITY OCCUPATION CLASSIFICATIONS. 
(a) IN GENERAL.—Not later than 1 year after the 
date of enactment of this Act, the Director of the Office 
of Personnel Management, in coordination with the Direc-
tor, shall develop and issue comprehensive occupation clas-
sifications for Federal employees engaged in cybersecurity 
missions. 
(b) APPLICABILITY OF CLASSIFICATIONS.—The Di-
rector of the Office of Personnel Management shall ensure 
that the comprehensive occupation classifications issued 
under subsection (a) may be used throughout the Federal 
Government. 
SEC. 405. MEASURES OF CYBERSECURITY HIRING EFFEC-
TIVENESS. 
(a) IN GENERAL.—The head of each Federal agency 
shall measure, and collect information on, indicators of the 
effectiveness of the recruitment and hiring by the Federal 
agency of a workforce needed to fulfill the Federal agen-
cy’s cybersecurity mission. 
(b) TYPES OF INFORMATION.—The indicators of ef-
fectiveness measured and subject to collection of informa-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00162
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
163 
tion under subsection (a) shall include indicators with re-
spect to the following: 
(1) RECRUITING AND HIRING.—In relation to 
recruiting and hiring by the Federal agency— 
(A) the ability to reach and recruit well- 
qualified individuals from diverse talent pools; 
(B) the use and impact of special hiring 
authorities and flexibilities to recruit the most 
qualified applicants, including the use of stu-
dent internship and scholarship programs for 
permanent hires; 
(C) the use and impact of special hiring 
authorities and flexibilities to recruit diverse 
candidates, including criteria such as the vet-
eran status, race, ethnicity, gender, disability, 
or national origin of the candidates; and 
(D) the educational level, and source of ap-
plicants. 
(2) SUPERVISORS.—In relation to the super-
visors of the positions being filled— 
(A) satisfaction with the quality of the ap-
plicants interviewed and hired; 
(B) satisfaction with the match between 
the skills of the individuals and the needs of the 
Federal agency; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00163
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
164 
(C) satisfaction of the supervisors with the 
hiring process and hiring outcomes; 
(D) whether any mission-critical defi-
ciencies were addressed by the individuals and 
the connection between the deficiencies and the 
performance of the Federal agency; and 
(E) the satisfaction of the supervisors with 
the period of time elapsed to fill the positions. 
(3) APPLICANTS.—The satisfaction of appli-
cants with the hiring process, including clarity of job 
announcements, any reasons for withdrawal of an 
application, the user-friendliness of the application 
process, communication regarding status of applica-
tions, and the timeliness of offers of employment. 
(4) HIRED INDIVIDUALS.—In relation to the in-
dividuals hired— 
(A) satisfaction with the hiring process; 
(B) satisfaction with the process of start-
ing employment in the position for which the 
individual was hired; 
(C) attrition; and 
(D) the results of exit interviews. 
(c) REPORTS.— 
(1) IN GENERAL.—The head of each Federal 
agency shall submit the information collected under 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00164
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
165 
this section to the Director of the Office of Per-
sonnel Management on an annual basis and in ac-
cordance with the regulations issued under sub-
section (d). 
(2) AVAILABILITY OF RECRUITING AND HIRING 
INFORMATION.— 
(A) IN GENERAL.—The Director of the Of-
fice of Personnel Management shall prepare an 
annual report containing the information re-
ceived under paragraph (1) in a consistent for-
mat to allow for a comparison of hiring effec-
tiveness and experience across demographic 
groups and Federal agencies. 
(B) SUBMISSION.—The Director of the Of-
fice of Personnel Management shall— 
(i) not later than 90 days after the re-
ceipt of all information required to be sub-
mitted under paragraph (1), make the re-
port prepared under subparagraph (A) 
publicly available, including on the Web 
site of the Office of Personnel Manage-
ment; and 
(ii) before the date on which the re-
port prepared under subparagraph (A) is 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00165
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
166 
made publicly available, submit the report 
to Congress. 
(d) REGULATIONS.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of enactment of this Act, the Director 
of the Office of Personnel Management shall issue 
regulations establishing the methodology, timing, 
and reporting of the data required to be submitted 
under this section. 
(2) SCOPE AND DETAIL OF REQUIRED INFOR-
MATION.—The regulations under paragraph (1) shall 
delimit the scope and detail of the information that 
a Federal agency is required to collect and submit 
under this section, taking account of the size and 
complexity of the workforce that the Federal agency 
needs to fulfill the Federal agency’s cybersecurity 
mission. 
SEC. 406. TRAINING AND EDUCATION. 
(a) TRAINING.— 
(1) FEDERAL GOVERNMENT EMPLOYEES AND 
FEDERAL CONTRACTORS.—The Director of the Of-
fice of Personnel Management, in conjunction with 
the Director of the National Center for Cybersecu-
rity and Communications, the Director of National 
Intelligence, the Secretary of Defense, and the Chief 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00166
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
167 
Information Officers Council established under sec-
tion 3603 of title 44, United States Code, shall es-
tablish a cybersecurity awareness and education cur-
riculum that shall be required for all Federal em-
ployees and contractors engaged in the design, devel-
opment, or operation of agency information infra-
structure, as defined under section 3551 of title 44, 
United States Code. 
(2) CONTENTS.—The curriculum established 
under paragraph (1) may include— 
(A) role-based security awareness training; 
(B) recommended cybersecurity practices; 
(C) cybersecurity recommendations for 
traveling abroad; 
(D) unclassified counterintelligence infor-
mation; 
(E) information regarding industrial espio-
nage; 
(F) information regarding malicious activ-
ity online; 
(G) information regarding cybersecurity 
and law enforcement; 
(H) identity management information; 
(I) information regarding supply chain se-
curity; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00167
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
168 
(J) information security risks associated 
with the activities of Federal employees; and 
(K) the responsibilities of Federal employ-
ees in complying with policies and procedures 
designed to reduce information security risks 
identified under subparagraph (J). 
(3) 
FEDERAL
CYBERSECURITY
PROFES-
SIONALS.—The Director of the Office of Personnel 
Management in conjunction with the Director of the 
National Center for Cybersecurity and Communica-
tions, the Director of National Intelligence, the Sec-
retary of Defense, the Director of the Office of Man-
agement and Budget, and, as appropriate, colleges, 
universities, and nonprofit organizations with cyber-
security training expertise, shall develop a program, 
to provide training to improve and enhance the skills 
and capabilities of Federal employees engaged in the 
cybersecurity mission, including training specific to 
the acquisition workforce. 
(4) HEADS OF FEDERAL AGENCIES.—Not later 
than 30 days after the date on which an individual 
is appointed to a position at level I or II of the Ex-
ecutive Schedule, the Director of the National Cen-
ter for Cybersecurity and Communications and the 
Director of National Intelligence, or their designees, 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00168
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
169 
shall provide that individual with a cybersecurity 
threat briefing. 
(5) CERTIFICATION.—The head of each Federal 
agency shall include in the annual report required 
under section 3553(c) of title 44, United States 
Code, a certification regarding whether all officers, 
employees, and contractors of the Federal agency 
have completed the training required under this sub-
section. 
(b) EDUCATION.— 
(1) FEDERAL
EMPLOYEES.—The Director of 
the Office of Personnel Management, in coordination 
with the Secretary of Education, the Director of the 
National Science Foundation, and the Director, shall 
develop and implement a strategy to provide Federal 
employees who work in cybersecurity missions with 
the opportunity to obtain additional education. 
(2) K THROUGH 12.—The Secretary of Edu-
cation, in coordination with the Director of the Na-
tional Center for Cybersecurity and Communications 
and State and local governments, shall develop cur-
riculum standards, guidelines, and recommended 
courses to address cyber safety, cybersecurity, and 
cyber ethics for students in kindergarten through 
grade 12. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00169
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
170 
(3) 
UNDERGRADUATE, 
GRADUATE, 
VOCA-
TIONAL, AND TECHNICAL INSTITUTIONS.— 
(A) SECRETARY
OF
EDUCATION.—The 
Secretary of Education, in coordination with 
the Director of the National Center for Cyber-
security and Communications, shall— 
(i) develop curriculum standards and 
guidelines to address cyber safety, cyberse-
curity, and cyber ethics for all students en-
rolled in undergraduate, graduate, voca-
tional, and technical institutions in the 
United States; and 
(ii) analyze and develop recommended 
courses for students interested in pursuing 
careers in information technology, commu-
nications, computer science, engineering, 
math, and science, as those subjects relate 
to cybersecurity. 
(B) OFFICE
OF
PERSONNEL
MANAGE-
MENT.—The Director of the Office of Personnel 
Management, in coordination with the Director, 
shall develop strategies and programs— 
(i) to recruit students from under-
graduate, graduate, vocational, and tech-
nical institutions in the United States to 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00170
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS