IB 
Union Calendar No. 411 
113TH CONGRESS 
2D SESSION 
H. R. 3696 
[Report No. 113–550, Part I] 
To amend the Homeland Security Act of 2002 to make certain improvements 
regarding cybersecurity and critical infrastructure protection, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
DECEMBER 11, 2013 
Mr. MCCAUL (for himself, Mr. MEEHAN, Mr. THOMPSON of Mississippi, and 
Ms. CLARKE) introduced the following bill; which was referred to the 
Committee on Homeland Security, and in addition to the Committees on 
Science, Space, and Technology and Oversight and Government Reform, 
for a period to be subsequently determined by the Speaker, in each case 
for consideration of such provisions as fall within the jurisdiction of the 
committee concerned 
JULY 23, 2014 
Reported from the Committee on Homeland Security with an amendment 
[Strike out all after the enacting clause and insert the part printed in italic] 
JULY 23, 2014 
The Committees on Science, Space, and Technology and Oversight and Gov-
ernment Reform discharged; committed to the Committee of the Whole 
House on the State of the Union and ordered to be printed 
[For text of introduced bill, see copy of bill as introduced on December 11, 2013] 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
A BILL 
To amend the Homeland Security Act of 2002 to make 
certain improvements regarding cybersecurity and critical 
infrastructure protection, and for other purposes. 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘National Cybersecurity 
and Critical Infrastructure Protection Act of 2014’’. 
SEC. 2. TABLE OF CONTENTS. 
The table of contents for this Act is as follows: 
Sec. 1. Short title. 
Sec. 2. Table of contents. 
TITLE I—SECURING THE NATION AGAINST CYBER ATTACK 
Sec. 101. Homeland Security Act of 2002 definitions. 
Sec. 102. Enhancement of cybersecurity. 
Sec. 103. Protection of critical infrastructure and information sharing. 
Sec. 104. National Cybersecurity and Communications Integration Center. 
Sec. 105. Cyber incident response and technical assistance. 
Sec. 106. Streamlining of Department cybersecurity organization. 
TITLE II—PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY 
Sec. 201. Public-private collaboration on cybersecurity. 
Sec. 202. SAFETY Act and qualifying cyber incidents. 
Sec. 203. Prohibition on new regulatory authority. 
Sec. 204. Prohibition on additional authorization of appropriations. 
Sec. 205. Prohibition on collection activities to track individuals’ personally iden-
tifiable information. 
Sec. 206. Cybersecurity scholars. 
Sec. 207. National Research Council study on the resilience and reliability of the 
Nation’s power grid. 
TITLE III—HOMELAND SECURITY CYBERSECURITY WORKFORCE 
Sec. 301. Homeland security cybersecurity workforce. 
Sec. 302. Personnel authorities. 
TITLE I—SECURING THE NATION 
AGAINST CYBER ATTACK 
SEC. 101. HOMELAND SECURITY ACT OF 2002 DEFINITIONS. 
Section 2 of the Homeland Security Act of 2002 (6 
U.S.C. 101) is amended by adding at the end the following 
new paragraphs: 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(19) The term ‘critical infrastructure’ has the 
meaning given that term in section 1016(e) of the 
USA Patriot Act (42 U.S.C. 5195c(e)). 
‘‘(20) The term ‘critical infrastructure owner’ 
means a person that owns critical infrastructure. 
‘‘(21) The term ‘critical infrastructure operator’ 
means a critical infrastructure owner or other person 
that manages, runs, or operates, in whole or in part, 
the day-to-day operations of critical infrastructure. 
‘‘(22) The term ‘cyber incident’ means an inci-
dent, or an attempt to cause an incident, that, if suc-
cessful, would— 
‘‘(A) jeopardize or imminently jeopardize, 
without lawful authority, the security, integrity, 
confidentiality, or availability of an information 
system or network of information systems or any 
information 
stored 
on, 
processed 
on, 
or 
transiting such a system or network; 
‘‘(B) constitute a violation or imminent 
threat of violation of law, security policies, secu-
rity procedures, or acceptable use policies related 
to such a system or network, or an act of ter-
rorism against such a system or network; or 
‘‘(C) result in the denial of access to or deg-
radation, disruption, or destruction of such a 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
unauthorized 
access 
for 
the 
purpose 
of 
exfiltrating information stored on, processed on, 
or transiting such a system or network; or 
‘‘(E) an act of terrorism against an infor-
mation system or network of information sys-
tems. 
‘‘(27) The term ‘Federal civilian information 
systems’— 
‘‘(A) means information, information sys-
tems, and networks of information systems that 
are owned, operated, controlled, or licensed for 
use by, or on behalf of, any Federal agency, in-
cluding such systems or networks used or oper-
ated by another entity on behalf of a Federal 
agency; but 
‘‘(B) does not include— 
‘‘(i) a national security system; or 
‘‘(ii) information, information systems, 
and networks of information systems that 
are owned, operated, controlled, or licensed 
solely for use by, or on behalf of, the De-
partment of Defense, a military depart-
ment, or an element of the intelligence com-
munity. 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(28) The term ‘information security’ means the 
protection of information, information systems, and 
networks of information systems from unauthorized 
access, use, disclosure, disruption, modification, or de-
struction in order to provide— 
‘‘(A) integrity, including guarding against 
improper information modification or destruc-
tion, including ensuring nonrepudiation and au-
thenticity; 
‘‘(B) confidentiality, including preserving 
authorized restrictions on access and disclosure, 
including means for protecting personal privacy 
and proprietary information; and 
‘‘(C) availability, including ensuring timely 
and reliable access to and use of information. 
‘‘(29) The term ‘information system’ means the 
underlying framework and functions used to process, 
transmit, receive, or store information electronically, 
including programmable electronic devices, commu-
nications networks, and industrial or supervisory 
control systems and any associated hardware, soft-
ware, or data. 
‘‘(30) The term ‘private entity’ means any indi-
vidual or any private or publically-traded company, 
public or private utility (including a utility that is 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
a unit of a State or local government, or a political 
subdivision of a State government), organization, or 
corporation, including an officer, employee, or agent 
thereof. 
‘‘(31) The term ‘shared situational awareness’ 
means an environment in which cyber threat infor-
mation is shared in real time between all designated 
Federal cyber operations centers to provide actionable 
information about all known cyber threats.’’. 
SEC. 102. ENHANCEMENT OF CYBERSECURITY. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 is amended by adding at the end 
the following new section: 
‘‘SEC. 226. ENHANCEMENT OF CYBERSECURITY. 
‘‘The Secretary, in collaboration with the heads of 
other appropriate Federal Government entities, shall con-
duct activities for cybersecurity purposes, including the pro-
vision of shared situational awareness to each other to en-
able real-time, integrated, and operational actions to pro-
tect from, prevent, mitigate, respond to, and recover from 
cyber incidents.’’. 
(b) CLERICAL AMENDMENTS.— 
(1) SUBTITLE HEADING.—The heading for sub-
title C of title II of such Act is amended to read as 
follows: 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘Subtitle C—Cybersecurity and 
Information Sharing’’. 
(2) TABLE OF CONTENTS.—The table of contents 
in section 1(b) of such Act is amended— 
(A) by adding after the item relating to sec-
tion 225 the following new item: 
‘‘Sec. 226. Enhancement of cybersecurity.’’; 
and 
(B) by striking the item relating to subtitle 
C of title II and inserting the following new 
item: 
‘‘Subtitle C—Cybersecurity and Information Sharing’’. 
SEC. 103. PROTECTION OF CRITICAL INFRASTRUCTURE 
AND INFORMATION SHARING. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by section 102, is 
further amended by adding at the end the following new 
section: 
‘‘SEC. 227. PROTECTION OF CRITICAL INFRASTRUCTURE 
AND INFORMATION SHARING. 
‘‘(a) PROTECTION OF CRITICAL INFRASTRUCTURE.— 
‘‘(1) IN GENERAL.—The Secretary shall coordi-
nate, on an ongoing basis, with Federal, State, and 
local governments, national laboratories, critical in-
frastructure owners, critical infrastructure operators, 
and other cross sector coordinating entities to— 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) facilitate a national effort to strength-
en and maintain secure, functioning, and resil-
ient critical infrastructure from cyber threats; 
‘‘(B) ensure that Department policies and 
procedures enable critical infrastructure owners 
and critical infrastructure operators to receive 
real-time, actionable, and relevant cyber threat 
information; 
‘‘(C) seek industry sector-specific expertise 
to— 
‘‘(i) assist in the development of vol-
untary security and resiliency strategies; 
and 
‘‘(ii) ensure that the allocation of Fed-
eral resources are cost effective and reduce 
any burden on critical infrastructure own-
ers and critical infrastructure operators; 
‘‘(D) upon request of entities, facilitate and 
assist risk management efforts of such entities to 
reduce vulnerabilities, identify and disrupt 
threats, and minimize consequences to their crit-
ical infrastructure; 
‘‘(E) upon request of critical infrastructure 
owners or critical infrastructure operators, pro-
vide education and assistance to such owners 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
and operators on how they may use protective 
measures and countermeasures to strengthen the 
security and resilience of the Nation’s critical in-
frastructure; and 
‘‘(F) coordinate a research and development 
strategy to facilitate and promote advancements 
and innovation in cybersecurity technologies to 
protect critical infrastructure. 
‘‘(2) ADDITIONAL RESPONSIBILITIES.—The Sec-
retary shall— 
‘‘(A) manage Federal efforts to secure, pro-
tect, and ensure the resiliency of Federal civilian 
information systems using a risk-based and per-
formance-based approach, and, upon request of 
critical infrastructure owners or critical infra-
structure operators, support such owners’ and 
operators’ efforts to secure, protect, and ensure 
the resiliency of critical infrastructure from 
cyber threats; 
‘‘(B) direct an entity within the Depart-
ment to serve as a Federal civilian entity by and 
among Federal, State, and local governments, 
private entities, and critical infrastructure sec-
tors to provide multi-directional sharing of real- 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
time, actionable, and relevant cyber threat infor-
mation; 
‘‘(C) build upon existing mechanisms to 
promote a national awareness effort to educate 
the general public on the importance of securing 
information systems; 
‘‘(D) upon request of Federal, State, and 
local government entities and private entities, fa-
cilitate expeditious cyber incident response and 
recovery assistance, and provide analysis and 
warnings related to threats to and vulnerabilities 
of critical information systems, crisis and con-
sequence management support, and other remote 
or on-site technical assistance with the heads of 
other appropriate Federal agencies to Federal, 
State, and local government entities and private 
entities for cyber incidents affecting critical in-
frastructure; 
‘‘(E) engage with international partners to 
strengthen the security and resilience of domestic 
critical infrastructure and critical infrastructure 
located outside of the United States upon which 
the United States depends; and 
‘‘(F) conduct outreach to educational insti-
tutions, including historically black colleges and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
universities, Hispanic serving institutions, Na-
tive American colleges, and institutions serving 
persons with disabilities, to encourage such insti-
tutions to promote cybersecurity awareness. 
‘‘(3) RULE OF CONSTRUCTION.—Nothing in this 
section may be construed to require any private enti-
ty to request assistance from the Secretary, or require 
any private entity requesting such assistance to im-
plement any measure or recommendation suggested by 
the Secretary. 
‘‘(b) CRITICAL INFRASTRUCTURE SECTORS.—The Sec-
retary, in collaboration with the heads of other appropriate 
Federal agencies, shall designate critical infrastructure sec-
tors (that may include subdivisions of sectors within a sec-
tor as the Secretary may determine appropriate). The crit-
ical infrastructure sectors designated under this subsection 
may include the following: 
‘‘(1) Chemical. 
‘‘(2) Commercial facilities. 
‘‘(3) Communications. 
‘‘(4) Critical manufacturing. 
‘‘(5) Dams. 
‘‘(6) Defense Industrial Base. 
‘‘(7) Emergency services. 
‘‘(8) Energy. 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(9) Financial services. 
‘‘(10) Food and agriculture. 
‘‘(11) Government facilities. 
‘‘(12) Healthcare and public health. 
‘‘(13) Information technology. 
‘‘(14) Nuclear reactors, materials, and waste. 
‘‘(15) Transportation systems. 
‘‘(16) Water and wastewater systems. 
‘‘(17) Such other sectors as the Secretary deter-
mines appropriate. 
‘‘(c) SECTOR SPECIFIC AGENCIES.—The Secretary, in 
collaboration with the relevant critical infrastructure sector 
and the heads of other appropriate Federal agencies, shall 
recognize the Federal agency designated as of November 1, 
2013, as the ‘Sector Specific Agency’ for each critical infra-
structure sector designated under subsection (b). If the des-
ignated Sector Specific Agency for a particular critical in-
frastructure sector is the Department, for the purposes of 
this section, the Secretary shall carry out this section. The 
Secretary, in coordination with the heads of each such Sec-
tor Specific Agency shall— 
‘‘(1) support the security and resilience activities 
of the relevant critical infrastructure sector in accord-
ance with this subtitle; and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(2) provide institutional knowledge and special-
ized expertise to the relevant critical infrastructure 
sector. 
‘‘(d) SECTOR COORDINATING COUNCILS.— 
‘‘(1) RECOGNITION.—The Secretary, in collabo-
ration with each critical infrastructure sector and the 
relevant Sector Specific Agency, shall recognize and 
partner with the Sector Coordinating Council for 
each critical infrastructure sector designated under 
subsection (b) to coordinate with each such sector on 
security and resilience activities and emergency re-
sponse and recovery efforts. 
‘‘(2) MEMBERSHIP.— 
‘‘(A) IN
GENERAL.—The Sector Coordi-
nating Council for a critical infrastructure sec-
tor designated under subsection (b) shall— 
‘‘(i) be comprised exclusively of rel-
evant critical infrastructure owners, critical 
infrastructure operators, private entities, 
and representative trade associations for the 
sector; 
‘‘(ii) reflect the unique composition of 
each sector; and 
‘‘(iii) include relevant small, medium, 
and large critical infrastructure owners, 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
critical infrastructure operators, private en-
tities, and representative trade associations 
for the sector. 
‘‘(B) PROHIBITION.—No government entity 
with regulating authority shall be a member of 
the Sector Coordinating Council. 
‘‘(C) LIMITATION.—The Secretary shall 
have no role in the determination of the member-
ship of a Sector Coordinating Council. 
‘‘(3) ROLES AND RESPONSIBILITIES.—The Sector 
Coordinating Council for a critical infrastructure sec-
tor shall— 
‘‘(A) serve as a self-governing, self-organized 
primary policy, planning, and strategic commu-
nications entity for coordinating with the De-
partment, the relevant Sector-Specific Agency 
designated under subsection (c), and the relevant 
Information Sharing and Analysis Centers 
under subsection (e) on security and resilience 
activities and emergency response and recovery 
efforts; 
‘‘(B) establish governance and operating 
procedures, and designate a chairperson for the 
sector to carry out the activities described in this 
subsection; 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(C) coordinate with the Department, the 
relevant Information Sharing and Analysis Cen-
ters under subsection (e), and other Sector Co-
ordinating Councils to update, maintain, and 
exercise the National Cybersecurity Incident Re-
sponse Plan in accordance with section 229(b); 
and 
‘‘(D) provide any recommendations to the 
Department on infrastructure protection tech-
nology gaps to help inform research and develop-
ment efforts at the Department. 
‘‘(e) SECTOR INFORMATION SHARING AND ANALYSIS 
CENTERS.— 
‘‘(1) RECOGNITION.—The Secretary, in collabo-
ration with the relevant Sector Coordinating Council 
and the critical infrastructure sector represented by 
such Council, and in coordination with the relevant 
Sector Specific Agency, shall recognize at least one 
Information Sharing and Analysis Center for each 
critical infrastructure sector designated under sub-
section (b) for purposes of paragraph (3). No other 
Information Sharing and Analysis Organizations, in-
cluding Information Sharing and Analysis Centers, 
may be precluded from having an information shar-
ing relationship within the National Cybersecurity 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
and Communications Integration Center established 
pursuant to section 228. Nothing in this subsection or 
any other provision of this subtitle may be construed 
to limit, restrict, or condition any private entity or 
activity utilized by, among, or between private enti-
ties. 
‘‘(2) ROLES AND RESPONSIBILITIES.—In addi-
tion to such other activities as may be authorized by 
law, at least one Information Sharing and Analysis 
Center for a critical infrastructure sector shall— 
‘‘(A) serve as an information sharing re-
source for such sector and promote ongoing 
multi-directional sharing of real-time, relevant, 
and actionable cyber threat information and 
analysis by and among such sector, the Depart-
ment, the relevant Sector Specific Agency, and 
other critical infrastructure sector Information 
Sharing and Analysis Centers; 
‘‘(B) establish governance and operating 
procedures to carry out the activities conducted 
under this subsection; 
‘‘(C) serve as an emergency response and re-
covery operations coordination point for such 
sector, and upon request, facilitate cyber incident 
response capabilities in coordination with the 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Department, the relevant Sector Specific Agency 
and the relevant Sector Coordinating Council; 
‘‘(D) facilitate cross-sector coordination and 
sharing of cyber threat information to prevent 
related or consequential impacts to other critical 
infrastructure sectors; 
‘‘(E) coordinate with the Department, the 
relevant Sector Coordinating Council, the rel-
evant Sector Specific Agency, and other critical 
infrastructure sector Information Sharing and 
Analysis Centers on the development, integra-
tion, and implementation of procedures to sup-
port technology neutral, real-time information 
sharing capabilities and mechanisms within the 
National Cybersecurity and Communications In-
tegration Center established pursuant to section 
228, including— 
‘‘(i) the establishment of a mechanism 
to 
voluntarily 
report 
identified 
vulnerabilities and opportunities for im-
provement; 
‘‘(ii) the establishment of metrics to as-
sess the effectiveness and timeliness of the 
Department’s and Information Sharing and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Analysis Centers’ information sharing ca-
pabilities; and 
‘‘(iii) the establishment of a mecha-
nism for anonymous suggestions and com-
ments; 
‘‘(F) implement an integration and anal-
ysis function to inform sector planning, risk 
mitigation, and operational activities regarding 
the protection of each critical infrastructure sec-
tor from cyber incidents; 
‘‘(G) combine consequence, vulnerability, 
and threat information to share actionable as-
sessments of critical infrastructure sector risks 
from cyber incidents; 
‘‘(H) coordinate with the Department, the 
relevant Sector Specific Agency, and the relevant 
Sector Coordinating Council to update, main-
tain, and exercise the National Cybersecurity In-
cident Response Plan in accordance with section 
229(b); and 
‘‘(I) safeguard cyber threat information 
from unauthorized disclosure. 
‘‘(3) FUNDING.—Of the amounts authorized to be 
appropriated for each of fiscal years 2014, 2015, and 
2016 for the Cybersecurity and Communications Of-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
fice of the Department, the Secretary is authorized to 
use not less than $25,000,000 for any such year for 
operations support at the National Cybersecurity and 
Communications Integration Center established under 
section 228(a) of all recognized Information Sharing 
and Analysis Centers under paragraph (1) of this 
subsection. 
‘‘(f) CLEARANCES.—The Secretary— 
‘‘(1) shall expedite the process of security clear-
ances under Executive Order 13549 or successor or-
ders for appropriate representatives of Sector Coordi-
nating Councils and the critical infrastructure sector 
Information Sharing and Analysis Centers; and 
‘‘(2) may so expedite such processing to— 
‘‘(A) appropriate personnel of critical infra-
structure owners and critical infrastructure op-
erators; and 
‘‘(B) any other person as determined by the 
Secretary. 
‘‘(g) PUBLIC-PRIVATE
COLLABORATION.—The Sec-
retary, in collaboration with the critical infrastructure sec-
tors designated under subsection (b), such sectors’ Sector 
Specific Agencies recognized under subsection (c), and the 
Sector Coordinating Councils recognized under subsection 
(d), shall— 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(1) conduct an analysis and review of the exist-
ing public-private partnership model and evaluate 
how the model between the Department and critical 
infrastructure owners and critical infrastructure op-
erators can be improved to ensure the Department, 
critical infrastructure owners, and critical infrastruc-
ture operators are equal partners and regularly col-
laborate on all programs and activities of the Depart-
ment to protect critical infrastructure; 
‘‘(2) develop and implement procedures to ensure 
continuous, collaborative, and effective interactions 
between the Department, critical infrastructure own-
ers, and critical infrastructure operators; and 
‘‘(3) ensure critical infrastructure sectors have a 
reasonable period for review and comment of all joint-
ly produced materials with the Department. 
‘‘(h) PROTECTION OF FEDERAL CIVILIAN INFORMA-
TION SYSTEMS.— 
‘‘(1) IN GENERAL.—The Secretary shall admin-
ister the operational information security activities 
and functions to protect and ensure the resiliency of 
all Federal civilian information systems. 
‘‘(2) ROLES AND RESPONSIBILITIES.—The Sec-
retary, in coordination with the heads of other Fed-
eral civilian agencies, shall— 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(A) develop, issue, and oversee the imple-
mentation and compliance of all operational in-
formation security policies and procedures to 
protect and ensure the resiliency of Federal civil-
ian information systems; 
‘‘(B) administer Federal Government-wide 
efforts to develop and provide adequate, risk- 
based, cost-effective, and technology neutral in-
formation security capabilities; 
‘‘(C) establish and sustain continuous 
diagnostics systems for Federal civilian informa-
tion systems to aggregate data and identify and 
prioritize the mitigation of cyber vulnerabilities 
in such systems for cybersecurity purposes; 
‘‘(D) develop, acquire, and operate an inte-
grated and consolidated system of intrusion de-
tection, analytics, intrusion prevention, and 
other information sharing and protective capa-
bilities to defend Federal civilian information 
systems from cyber threats; 
‘‘(E) develop and conduct targeted risk as-
sessments and operational evaluations of Federal 
civilian information systems, in consultation 
with government and private entities that own 
and operate such information systems, including 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
threat, vulnerability, and impact assessments 
and penetration testing; 
‘‘(F) develop and provide technical assist-
ance and cyber incident response capabilities to 
secure and ensure the resilience of Federal civil-
ian information systems; 
‘‘(G) review annually the operational infor-
mation security activities and functions of each 
of the Federal civilian agencies; 
‘‘(H) develop minimum technology neutral 
operational requirements for network and secu-
rity operations centers to facilitate the protection 
of all Federal civilian information systems; 
‘‘(I) develop reporting requirements, con-
sistent with relevant law, to ensure the National 
Cybersecurity and Communications Integration 
Center established pursuant to section 228 re-
ceives all actionable cyber threat information 
identified on Federal civilian information sys-
tems; 
‘‘(J) develop technology neutral performance 
requirements and metrics for the security of Fed-
eral civilian information systems; 
‘‘(K) implement training requirements that 
include industry recognized certifications to en-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
sure that Federal civilian agencies are able to 
fully and timely comply with policies and proce-
dures issued by the Secretary under this sub-
section; and 
‘‘(L) develop training requirements regard-
ing privacy, civil rights, civil liberties, and in-
formation oversight for information security em-
ployees who operate Federal civilian information 
systems. 
‘‘(3) USE OF CERTAIN COMMUNICATIONS.— 
‘‘(A) IN
GENERAL.—The Secretary may 
enter into contracts or other agreements, or oth-
erwise request and obtain, in accordance with 
applicable law, the assistance of private entities 
that provide electronic communication services, 
remote computing services, or cybersecurity serv-
ices to acquire, intercept, retain, use, and dis-
close communications and other system traffic, 
deploy countermeasures, or otherwise operate 
protective capabilities in accordance with sub-
paragraphs (C), (D), (E), and (F) of paragraph 
(2). No cause of action shall exist against private 
entities for assistance provided to the Secretary 
in accordance with this subsection. 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(B) RULE OF CONSTRUCTION.—Nothing in 
subparagraph (A) may be construed to— 
‘‘(i) require or compel any private en-
tity to enter in a contract or agreement de-
scribed in such subparagraph; or 
‘‘(ii) authorize the Secretary to take 
any action with respect to any communica-
tions or system traffic transiting or residing 
on any information system or network of 
information systems other than a Federal 
civilian information system. 
‘‘(i) RECOMMENDATIONS REGARDING NEW AGREE-
MENTS.—Not later than 180 days after the date of the en-
actment of this section, the Secretary shall submit to the 
appropriate congressional committees recommendations on 
how to expedite the implementation of information sharing 
agreements for cybersecurity purposes between the Secretary 
and critical information owners and critical infrastructure 
operators and other private entities. Such recommendations 
shall address the development and utilization of a scalable 
form that retains all privacy and other protections in such 
agreements in existence as of such date, including Coopera-
tive and Research Development Agreements. Such rec-
ommendations should also include any additional authori-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
ties or resources that may be needed to carry out the imple-
mentation of any such new agreements. 
‘‘(j) RULE OF CONSTRUCTION.—No provision of this 
title may be construed as modifying, limiting, or otherwise 
affecting the authority of any other Federal agency under 
any other provision of law.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of such Act is amended by adding after the item 
relating to section 226 (as added by section 102) the fol-
lowing new item: 
‘‘Sec. 227. Protection of critical infrastructure and information sharing.’’. 
SEC. 104. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 102 and 
103, is further amended by adding at the end the following 
new section: 
‘‘SEC. 228. NATIONAL CYBERSECURITY AND COMMUNICA-
TIONS INTEGRATION CENTER. 
‘‘(a) ESTABLISHMENT.—There is established in the De-
partment the National Cybersecurity and Communications 
Integration Center (referred to in this section as the ‘Cen-
ter’), which shall be a Federal civilian information sharing 
interface that provides shared situational awareness to en-
able real-time, integrated, and operational actions across 
the Federal Government, and share cyber threat informa-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
tion by and among Federal, State, and local government 
entities, Information Sharing and Analysis Centers, private 
entities, and critical infrastructure owners and critical in-
frastructure operators that have an information sharing re-
lationship with the Center. 
‘‘(b) COMPOSITION.—The Center shall include each of 
the following entities: 
‘‘(1) At least one Information Sharing and Anal-
ysis Center established under section 227(e) for each 
critical infrastructure sector. 
‘‘(2) The Multi-State Information Sharing and 
Analysis Center to collaborate with State and local 
governments. 
‘‘(3) The United States Computer Emergency 
Readiness Team to coordinate cyber threat informa-
tion sharing, proactively manage cyber risks to the 
United States, collaboratively respond to cyber inci-
dents, provide technical assistance to information sys-
tem owners and operators, and disseminate timely 
notifications regarding current and potential cyber 
threats and vulnerabilities. 
‘‘(4) The Industrial Control System Cyber Emer-
gency Response Team to coordinate with industrial 
control systems owners and operators and share in-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
dustrial control systems-related security incidents and 
mitigation measures. 
‘‘(5) The National Coordinating Center for Tele-
communications to coordinate the protection, re-
sponse, and recovery of national security emergency 
communications. 
‘‘(6) Such other Federal, State, and local govern-
ment entities, private entities, organizations, or indi-
viduals as the Secretary may consider appropriate 
that agree to be included. 
‘‘(c) CYBER INCIDENT.—In the event of a cyber inci-
dent, the Secretary may grant the entities referred to in 
subsection (a) immediate temporary access to the Center as 
a situation may warrant. 
‘‘(d) ROLES
AND RESPONSIBILITIES.—The Center 
shall— 
‘‘(1) promote ongoing multi-directional sharing 
by and among the entities referred to in subsection 
(a) of timely and actionable cyber threat information 
and analysis on a real-time basis that includes 
emerging trends, evolving threats, incident reports, 
intelligence information, risk assessments, and best 
practices; 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(2) coordinate with other Federal agencies to 
streamline and reduce redundant reporting of cyber 
threat information; 
‘‘(3) provide, upon request, timely technical as-
sistance and crisis management support to Federal, 
State, and local government entities and private enti-
ties that own or operate information systems or net-
works of information systems to protect from, prevent, 
mitigate, respond to, and recover from cyber inci-
dents; 
‘‘(4) facilitate cross-sector coordination and shar-
ing of cyber threat information to prevent related or 
consequential impacts to other critical infrastructure 
sectors; 
‘‘(5) collaborate and facilitate discussions with 
Sector Coordinating Councils, Information Sharing 
and Analysis Centers, Sector Specific Agencies, and 
relevant critical infrastructure sectors on the develop-
ment of prioritized Federal response efforts, if nec-
essary, to support the defense and recovery of critical 
infrastructure from cyber incidents; 
‘‘(6) collaborate with the Sector Coordinating 
Councils, Information Sharing and Analysis Centers, 
Sector Specific Agencies, and the relevant critical in-
frastructure sectors on the development and imple-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
mentation of procedures to support technology neutral 
real-time information sharing capabilities and mech-
anisms; 
‘‘(7) collaborate with the Sector Coordinating 
Councils, Information Sharing and Analysis Centers, 
Sector Specific Agencies, and the relevant critical in-
frastructure sectors to identify requirements for data 
and information formats and accessibility, system 
interoperability, and redundant systems and alter-
native capabilities in the event of a disruption in the 
primary information sharing capabilities and mecha-
nisms at the Center; 
‘‘(8) within the scope of relevant treaties, cooper-
ate with international partners to share information 
and respond to cyber incidents; 
‘‘(9) safeguard sensitive cyber threat information 
from unauthorized disclosure; 
‘‘(10) require other Federal civilian agencies 
to— 
‘‘(A) send reports and information to the 
Center about cyber incidents, threats, and 
vulnerabilities affecting Federal civilian infor-
mation systems and critical infrastructure sys-
tems and, in the event a private vendor product 
or service of such an agency is so implicated, the 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Center shall first notify such private vendor of 
the vulnerability before further disclosing such 
information; 
‘‘(B) provide to the Center cyber incident 
detection, analysis, mitigation, and response in-
formation; and 
‘‘(C) immediately send and disclose to the 
Center cyber threat information received by such 
agencies; 
‘‘(11) perform such other duties as the Secretary 
may require to facilitate a national effort to strength-
en and maintain secure, functioning, and resilient 
critical infrastructure from cyber threats; 
‘‘(12) implement policies and procedures to— 
‘‘(A) provide technical assistance to Federal 
civilian agencies to prevent and respond to data 
breaches involving unauthorized acquisition or 
access of personally identifiable information that 
occur on Federal civilian information systems; 
‘‘(B) require Federal civilian agencies to 
notify the Center about data breaches involving 
unauthorized acquisition or access of personally 
identifiable information that occur on Federal 
civilian information systems not later than two 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
business days after the discovery of such a 
breach; and 
‘‘(C) require Federal civilian agencies to no-
tify all potential victims of a data breach involv-
ing unauthorized acquisition or access of person-
ally identifiable information that occur on Fed-
eral civilian information systems without unrea-
sonable delay consistent with the needs of law en-
forcement; and 
‘‘(13) participate in exercises run by the Depart-
ment’s National Exercise Program, where appro-
priate. 
‘‘(e) INTEGRATION AND ANALYSIS.—The Center, in co-
ordination with the Office of Intelligence and Analysis of 
the Department, shall maintain an integration and anal-
ysis function, which shall — 
‘‘(1) integrate and analyze all cyber threat infor-
mation received from other Federal agencies, State 
and local governments, Information Sharing and 
Analysis Centers, private entities, critical infrastruc-
ture owners, and critical infrastructure operators, 
and share relevant information in near real-time; 
‘‘(2) on an ongoing basis, assess and evaluate 
consequence, vulnerability, and threat information to 
share with the entities referred to in subsection (a) ac-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
tionable assessments of critical infrastructure sector 
risks from cyber incidents and to assist critical infra-
structure owners and critical infrastructure operators 
by making recommendations to facilitate continuous 
improvements to the security and resiliency of the 
critical infrastructure of the United States; 
‘‘(3) facilitate cross-sector integration, identifica-
tion, and analysis of key interdependencies to prevent 
related or consequential impacts to other critical in-
frastructure sectors; 
‘‘(4) collaborate with the Information Sharing 
and Analysis Centers to tailor the analysis of infor-
mation to the specific characteristics and risk to a 
relevant critical infrastructure sector; and 
‘‘(5) assess and evaluate consequence, vulner-
ability, and threat information regarding cyber inci-
dents in coordination with the Office of Emergency 
Communications of the Department to help facilitate 
continuous improvements to the security and resil-
iency of public safety communications networks. 
‘‘(f) REPORT OF CYBER ATTACKS AGAINST FEDERAL 
GOVERNMENT NETWORKS.—The Secretary shall submit to 
the Committee on Homeland Security of the House of Rep-
resentatives, the Committee on Homeland Security and 
Governmental Affairs of the Senate, and the Comptroller 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
General of the United States an annual report that summa-
rizes major cyber incidents involving Federal civilian agen-
cy information systems and provides aggregate statistics on 
the number of breaches, the extent of any personally identi-
fiable information that was involved, the volume of data 
exfiltrated, the consequential impact, and the estimated cost 
of remedying such breaches. 
‘‘(g) REPORT ON THE OPERATIONS OF THE CENTER.— 
The Secretary, in consultation with the Sector Coordinating 
Councils and appropriate Federal Government entities, 
shall submit to the Committee on Homeland Security of the 
House of Representatives, the Committee on Homeland Se-
curity and Governmental Affairs of the Senate, and the 
Comptroller General of the United States an annual report 
on— 
‘‘(1) the capability and capacity of the Center to 
carry out its cybersecurity mission in accordance 
with this section, and sections 226, 227, 229, 230, 
230A, and 230B; 
‘‘(2) the extent to which the Department is en-
gaged in information sharing with each critical in-
frastructure sector designated under section 227(b), 
including— 
‘‘(A) the extent to which each such sector 
has representatives at the Center; and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(B) the extent to which critical infrastruc-
ture owners and critical infrastructure operators 
of each critical infrastructure sector participate 
in information sharing at the Center; 
‘‘(3) the volume and range of activities with re-
spect to which the Secretary collaborated with the 
Sector Coordinating Councils and the Sector-Specific 
Agencies to promote greater engagement with the Cen-
ter; and 
‘‘(4) the volume and range of voluntary technical 
assistance sought and provided by the Department to 
each critical infrastructure owner and critical infra-
structure operator.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of such Act is amended by adding after the item 
relating to section 227 (as added by section 103) the fol-
lowing new item: 
‘‘Sec. 228. National Cybersecurity and Communications Integration Center.’’. 
(c) GAO REPORT.—Not later than one year after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall submit to the Committee on 
Homeland Security of the House of Representatives and the 
Committee on Homeland Security and Governmental Af-
fairs of the Senate a report on the effectiveness of the Na-
tional Cybersecurity and Communications Integration Cen-
ter established under section 228 of the Homeland Security 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Act of 2002, as added by subsection (a) of this section, in 
carrying out its cybersecurity mission (as such term is de-
fined in section 2 of the Homeland Security Act of 2002, 
as amended by section 101) in accordance with this Act 
and such section 228 and sections 226, 227, 229, 230, 230A, 
and 230B of the Homeland Security Act of 2002, as added 
by this Act. 
SEC. 105. CYBER INCIDENT RESPONSE AND TECHNICAL AS-
SISTANCE. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002, as amended by sections 102, 103, 
and 104, is further amended by adding at the end the fol-
lowing new section: 
‘‘SEC. 229. CYBER INCIDENT RESPONSE AND TECHNICAL AS-
SISTANCE. 
‘‘(a) IN GENERAL.—The Secretary shall establish 
Cyber Incident Response Teams to— 
‘‘(1) upon request, provide timely technical as-
sistance and crisis management support to Federal, 
State, and local government entities, private entities, 
and critical infrastructure owners and critical infra-
structure operators involving cyber incidents affecting 
critical infrastructure; and 
‘‘(2) upon request, provide actionable rec-
ommendations on security and resilience measures 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
and countermeasures to Federal, State, and local gov-
ernment entities, private entities, and critical infra-
structure owners and critical infrastructure operators 
prior to, during, and after cyber incidents. 
‘‘(b) COORDINATION.—In carrying out subsection (a), 
the Secretary shall coordinate with the relevant Sector Spe-
cific Agencies, if applicable. 
‘‘(c) CYBER INCIDENT RESPONSE PLAN.—The Sec-
retary, in coordination with the Sector Coordinating Coun-
cils, Information Sharing and Analysis Centers, and Fed-
eral, State, and local governments, shall develop, regularly 
update, maintain, and exercise a National Cybersecurity 
Incident Response Plan which shall— 
‘‘(1) include effective emergency response plans 
associated with cyber threats to critical infrastruc-
ture, information systems, or networks of information 
systems; 
‘‘(2) ensure that such National Cybersecurity In-
cident Response Plan can adapt to and reflect a 
changing cyber threat environment, and incorporate 
best practices and lessons learned from regular exer-
cises, training, and after-action reports; and 
‘‘(3) facilitate discussions on the best methods for 
developing innovative and useful cybersecurity exer-
cises for coordinating between the Department and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
each of the critical infrastructure sectors designated 
under section 227(b). 
‘‘(d) UPDATE TO CYBER INCIDENT ANNEX TO THE NA-
TIONAL RESPONSE FRAMEWORK.—The Secretary, in co-
ordination with the heads of other Federal agencies and in 
accordance with the National Cybersecurity Incident Re-
sponse Plan under subsection (c), shall regularly update, 
maintain, and exercise the Cyber Incident Annex to the Na-
tional Response Framework of the Department.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of such Act is amended by adding after the item 
relating to section 228 (as added by section 104) the fol-
lowing new item: 
‘‘Sec. 229. Cyber incident response and technical assistance.’’. 
SEC. 106. STREAMLINING OF DEPARTMENT CYBERSECU-
RITY ORGANIZATION. 
(a) CYBERSECURITY AND INFRASTRUCTURE PROTEC-
TION DIRECTORATE.—The National Protection and Pro-
grams Directorate of the Department of Homeland Security 
shall, after the date of the enactment of this Act, be known 
and designated as the ‘‘Cybersecurity and Infrastructure 
Protection Directorate’’. Any reference to the National Pro-
tection and Programs Directorate of the Department in any 
law, regulation, map, document, record, or other paper of 
the United States shall be deemed to be a reference to the 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
Cybersecurity and Infrastructure Protection Directorate of 
the Department. 
(b) SENIOR LEADERSHIP
OF
THE CYBERSECURITY 
AND INFRASTRUCTURE PROTECTION DIRECTORATE.— 
(1) IN
GENERAL.—Paragraph (1) of section 
103(a) of the Homeland Security Act of 2002 (6 
U.S.C. 113(a)) is amended by adding at the end the 
following new subparagraphs: 
‘‘(K) Under Secretary for Cybersecurity and 
Infrastructure Protection. 
‘‘(L) Deputy Under Secretary for Cyberse-
curity. 
‘‘(M) Deputy Under Secretary for Infra-
structure Protection.’’. 
(2) CONTINUATION IN OFFICE.—The individuals 
who hold the positions referred to in subparagraphs 
(K), (L), and (M) of subsection (a) of section 103 of 
the Homeland Security Act of 2002 (as added by 
paragraph (1) of this subsection) as of the date of the 
enactment of this Act may continue to hold such posi-
tions. 
(c) REPORT ON IMPROVING THE CAPABILITY AND EF-
FECTIVENESS OF THE CYBERSECURITY AND COMMUNICA-
TIONS OFFICE.—To improve the operational capability and 
effectiveness in carrying out the cybersecurity mission (as 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
such term is defined in section 2 of the Homeland Security 
Act of 2002, as amended by section 101) of the Department 
of Homeland Security, the Secretary of Homeland Security 
shall submit to the Committee on Homeland Security of the 
House of Representatives and the Committee on Homeland 
Security and Governmental Affairs of the Senate a report 
on— 
(1) the feasibility of making the Cybersecurity 
and Communications Office of the Department an 
operational component of the Department; 
(2) 
recommendations 
for 
restructuring 
the 
SAFETY Act Office within the Department to protect 
and maintain operations in accordance with the Of-
fice’s mission to provide incentives for the develop-
ment and deployment of anti-terrorism technologies 
while elevating the profile and mission of the Office, 
including the feasibility of utilizing third-party reg-
istrars for improving the throughput and effectiveness 
of the certification process. 
(d) REPORT ON CYBERSECURITY ACQUISITION CAPA-
BILITIES.—The Secretary of Homeland Security shall as-
sess the effectiveness of the Department of Homeland Secu-
rity’s acquisition processes and the use of existing authori-
ties for acquiring cybersecurity technologies to ensure that 
such processes and authorities are capable of meeting the 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
needs and demands of the Department’s cybersecurity mis-
sion (as such term is defined in section 2 of the Homeland 
Security Act of 2002, as amended by section 101). Not later 
than 180 days after the date of the enactment of this Act, 
the Secretary shall submit to the Committee on Homeland 
Security of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of the 
Senate a report on the effectiveness of the Department’s ac-
quisition processes for cybersecurity technologies. 
(e) RESOURCE
INFORMATION.—The Secretary of 
Homeland Security shall make available Department of 
Homeland Security contact information to serve as a re-
source for Sector Coordinating Councils and critical infra-
structure owners and critical infrastructure operators to 
better coordinate cybersecurity efforts with the Department 
relating to emergency response and recovery efforts for cyber 
incidents. 
TITLE II—PUBLIC-PRIVATE COL-
LABORATION ON CYBERSECU-
RITY 
SEC. 201. PUBLIC-PRIVATE COLLABORATION ON CYBERSE-
CURITY. 
(a) NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY.— 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology, in coordina-
tion with the Secretary of Homeland Security, shall, 
on an ongoing basis, facilitate and support the devel-
opment of a voluntary, industry-led set of standards, 
guidelines, best practices, methodologies, procedures, 
and processes to reduce cyber risks to critical infra-
structure. The Director, in coordination with the Sec-
retary— 
(A) shall— 
(i) coordinate closely and continuously 
with relevant private entities, critical infra-
structure owners and critical infrastructure 
operators, Sector Coordinating Councils, In-
formation Sharing and Analysis Centers, 
and other relevant industry organizations, 
and incorporate industry expertise to the 
fullest extent possible; 
(ii) consult with the Sector Specific 
Agencies, Federal, State and local govern-
ments, the governments of other countries, 
and international organizations; 
(iii) utilize a prioritized, flexible, re-
peatable, performance-based, and cost-effec-
tive approach, including information secu-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
rity measures and controls, that may be vol-
untarily adopted by critical infrastructure 
owners and critical infrastructure operators 
to help them identify, assess, and manage 
cyber risks; 
(iv) include methodologies to— 
(I) identify and mitigate impacts 
of the cybersecurity measures or con-
trols on business confidentiality; and 
(II) protect individual privacy 
and civil liberties; 
(v) incorporate voluntary consensus 
standards and industry best practices, and 
align with voluntary international stand-
ards to the fullest extent possible; 
(vi) prevent duplication of existing 
regulatory processes and prevent conflict 
with or superseding of existing regulatory 
requirements and processes; and 
(vii) include such other similar and 
consistent elements as determined necessary; 
and 
(B) shall not prescribe or otherwise re-
quire— 
(i) the use of specific solutions; 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
(ii) the use of specific information 
technology products or services; or 
(iii) that information technology prod-
ucts or services be designed, developed, or 
manufactured in a particular manner. 
(2) LIMITATION.—Information shared with or 
provided to the Director of the National Institute of 
Standards and Technology or the Secretary of Home-
land Security for the purpose of the activities under 
paragraph (1) may not be used by any Federal, 
State, or local government department or agency to 
regulate the activity of any private entity. 
(b) AMENDMENT.— 
(1) IN GENERAL.—Subtitle C of title II of the 
Homeland Security Act of 2002, as amended by sec-
tions 102, 103, 104, and 105, is further amended by 
adding at the end the following new section: 
‘‘SEC. 230. PUBLIC-PRIVATE COLLABORATION ON CYBERSE-
CURITY. 
‘‘(a) MEETINGS.—The Secretary shall meet with the 
Sector Coordinating Council for each critical infrastructure 
sector designated under section 227(b) on a biannual basis 
to discuss the cybersecurity threat to critical infrastructure, 
voluntary activities to address cybersecurity, and ideas to 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
improve the public-private partnership to enhance cyberse-
curity, in which the Secretary shall— 
‘‘(1) provide each Sector Coordinating Council 
an assessment of the cybersecurity threat to each crit-
ical infrastructure sector designated under section 
227(b), including information relating to— 
‘‘(A) any actual or assessed cyber threat, in-
cluding a consideration of adversary capability 
and intent, preparedness, target attractiveness, 
and deterrence capabilities; 
‘‘(B) the extent and likelihood of death, in-
jury, or serious adverse effects to human health 
and safety caused by an act of terrorism or other 
disruption, destruction, or unauthorized use of 
critical infrastructure; 
‘‘(C) the threat to national security caused 
by an act of terrorism or other disruption, de-
struction, or unauthorized use of critical infra-
structure; and 
‘‘(D) the harm to the economy that would 
result from an act of terrorism or other disrup-
tion, destruction, or unauthorized use of critical 
infrastructure; and 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(2) provide recommendations, which may be 
voluntarily adopted, on ways to improve cybersecu-
rity of critical infrastructure. 
‘‘(b) REPORT.— 
‘‘(1) IN GENERAL.—Starting 30 days after the 
end of the fiscal year in which the National Cyberse-
curity and Critical Infrastructure Protection Act of 
2013 is enacted and annually thereafter, the Sec-
retary shall submit to the appropriate congressional 
committees a report on the state of cybersecurity for 
each critical infrastructure sector designated under 
section 227(b) based on discussions between the De-
partment and the Sector Coordinating Council in ac-
cordance with subsection (a) of this section. The Sec-
retary shall maintain a public copy of each report, 
and each report may include a non-public annex for 
proprietary, business-sensitive information, or other 
sensitive information. Each report shall include, at a 
minimum information relating to— 
‘‘(A) the risk to each critical infrastructure 
sector, 
including 
known 
cyber 
threats, 
vulnerabilities, and potential consequences; 
‘‘(B) the extent and nature of any cyberse-
curity incidents during the previous year, in-
cluding the extent to which cyber incidents jeop-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
ardized or imminently jeopardized information 
systems; 
‘‘(C) the current status of the voluntary, in-
dustry-led set of standards, guidelines, best prac-
tices, methodologies, procedures, and processes to 
reduce cyber risks within each critical infra-
structure sector; and 
‘‘(D) the volume and range of voluntary 
technical assistance sought and provided by the 
Department to each critical infrastructure sector. 
‘‘(2) 
SECTOR
COORDINATING
COUNCIL
RE-
SPONSE.—Before making public and submitting each 
report required under paragraph (1), the Secretary 
shall provide a draft of each report to the Sector Co-
ordinating Council for the critical infrastructure sec-
tor covered by each such report. The Sector Coordi-
nating Council at issue may provide to the Secretary 
a written response to such report within 45 days of 
receiving the draft. If such Sector Coordinating Coun-
cil provides a written response, the Secretary shall in-
clude such written response in the final version of 
each report required under paragraph (1). 
‘‘(c) LIMITATION.—Information shared with or pro-
vided to a Sector Coordinating Council, a critical infra-
structure sector, or the Secretary for the purpose of the ac-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
tivities under subsections (a) and (b) may not be used by 
any Federal, State, or local government department or 
agency to regulate the activity of any private entity.’’. 
(2) CLERICAL AMENDMENT.—The table of con-
tents in section 1(b) of such Act is amended by add-
ing after the item relating to section 229 (as added 
by section 105) the following new item: 
‘‘Sec. 230. Public-private collaboration on cybersecurity.’’. 
SEC. 202. SAFETY ACT AND QUALIFYING CYBER INCIDENTS. 
(a) IN GENERAL.—The Support Anti-Terrorism By 
Fostering Effective Technologies Act of 2002 (6 U.S.C. 441 
et seq.) is amended— 
(1) in section 862(b) (6 U.S.C. 441(b))— 
(A) in the heading, by striking ‘‘DESIGNA-
TION
OF QUALIFIED ANTI-TERRORISM TECH-
NOLOGIES’’ and inserting ‘‘DESIGNATION
OF 
ANTI-TERRORISM
AND CYBERSECURITY TECH-
NOLOGIES’’; 
(B) in the matter preceding paragraph (1), 
by inserting ‘‘and cybersecurity’’ after ‘‘anti-ter-
rorism’’; 
(C) in paragraphs (3), (4), and (5), by in-
serting ‘‘or cybersecurity’’ after ‘‘anti-terrorism’’ 
each place it appears; and 
(D) in paragraph (7)— 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
(i) by inserting ‘‘or cybersecurity tech-
nology’’ after ‘‘Anti-terrorism technology’’; 
and 
(ii) by inserting ‘‘or qualifying cyber 
incidents’’ after ‘‘acts of terrorism’’; 
(2) in section 863 (6 U.S.C. 442)— 
(A) by inserting ‘‘or cybersecurity’’ after 
‘‘anti-terrorism’’ each place it appears; 
(B) by inserting ‘‘or qualifying cyber inci-
dent’’ after ‘‘act of terrorism’’ each place it ap-
pears; and 
(C) by inserting ‘‘or qualifying cyber inci-
dents’’ after ‘‘acts of terrorism’’ each place it ap-
pears; 
(3) in section 864 (6 U.S.C. 443)— 
(A) by inserting ‘‘or cybersecurity’’ after 
‘‘anti-terrorism’’ each place it appears; and 
(B) by inserting ‘‘or qualifying cyber inci-
dent’’ after ‘‘act of terrorism’’ each place it ap-
pears; and 
(4) in section 865 (6 U.S.C. 444)— 
(A) in paragraph (1)— 
(i) in the heading, by inserting ‘‘OR 
CYBERSECURITY’’ after ‘‘ANTI-TERRORISM’’; 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
(ii) by inserting ‘‘or cybersecurity’’ 
after ‘‘anti-terrorism’’; 
(iii) by inserting ‘‘or qualifying cyber 
incidents’’ after ‘‘acts of terrorism’’; and 
(iv) by inserting ‘‘or incidents’’ after 
‘‘such acts’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(7) QUALIFYING CYBER INCIDENT.— 
‘‘(A) IN
GENERAL.—The term ‘qualifying 
cyber incident’ means any act that the Secretary 
determines meets the requirements under sub-
paragraph (B), as such requirements are further 
defined and specified by the Secretary. 
‘‘(B) REQUIREMENTS.—A qualifying cyber 
incident meets the requirements of this subpara-
graph if— 
‘‘(i) the incident is unlawful or other-
wise exceeds authorized access authority; 
‘‘(ii) the incident disrupts or immi-
nently jeopardizes the integrity, operation, 
confidentiality, or availability of program-
mable electronic devices, communication 
networks, including hardware, software and 
data that are essential to their reliable oper-
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
ation, electronic storage devices, or any 
other information system, or the informa-
tion that system controls, processes, stores, 
or transmits; 
‘‘(iii) the perpetrator of the incident 
gains access to an information system or a 
network of information systems resulting 
in— 
‘‘(I) misappropriation or theft of 
data, assets, information, or intellec-
tual property; 
‘‘(II) corruption of data, assets, 
information, or intellectual property; 
‘‘(III) operational disruption; or 
‘‘(IV) an adverse effect on such 
system or network, or the data, assets, 
information, or intellectual property 
contained therein; and 
‘‘(iv) the incident causes harm inside 
or outside the United States that results in 
material levels of damage, disruption, or 
casualties severely affecting the United 
States population, infrastructure, economy, 
or national morale, or Federal, State, local, 
or tribal government functions. 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS
‘‘(C) RULE OF CONSTRUCTION.—For pur-
poses of clause (iv) of subparagraph (B), the 
term ‘severely’ includes any qualifying cyber in-
cident, whether at a local, regional, state, na-
tional, international, or tribal level, that af-
fects— 
‘‘(i) the United States population, in-
frastructure, economy, or national morale, 
or 
‘‘(ii) Federal, State, local, or tribal 
government functions.’’. 
(b) FUNDING.—Of the amounts authorized to be appro-
priated for each of fiscal years 2014, 2015, and 2016 for 
the Department of Homeland Security, the Secretary of 
Homeland Security is authorized to use not less than 
$20,000,000 for any such year for the Department’s SAFE-
TY Act Office. 
SEC. 203. PROHIBITION ON NEW REGULATORY AUTHORITY. 
This Act and the amendments made by this Act (except 
that this section shall not apply in the case of section 202 
of this Act and the amendments made by such section 202) 
do not— 
(1) create or authorize the issuance of any new 
regulations or additional Federal Government regu-
latory authority; or 
VerDate Mar 15 2010 
21:44 Jul 23, 2014
Jkt 039200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6203
E:\BILLS\H3696.RH
H3696
tkelley on DSK3SPTVN1PROD with BILLS