103 
HR 1560 RFS
and 
inserting 
‘‘disseminating 
cybersecurity 
risks, incidents, and critical infrastructure in-
formation’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(8) CYBERSECURITY
RISK; INCIDENT.—The 
terms ‘cybersecurity risk’ and ‘incident’ have the 
meanings given such terms in the second section 226 
(relating to the National Cybersecurity and Commu-
nications Integration Center).’’. 
SEC. 205. STREAMLINING OF DEPARTMENT OF HOMELAND 
SECURITY 
CYBERSECURITY 
AND 
INFRA-
STRUCTURE PROTECTION ORGANIZATION. 
(a) CYBERSECURITY
AND INFRASTRUCTURE PRO-
TECTION.—The National Protection and Programs Direc-
torate of the Department of Homeland Security shall, 
after the date of the enactment of this title, be known and 
designated as the ‘‘Cybersecurity and Infrastructure Pro-
tection’’. Any reference to the National Protection and 
Programs Directorate of the Department in any law, regu-
lation, map, document, record, or other paper of the 
United States shall be deemed to be a reference to the 
Cybersecurity and Infrastructure Protection of the De-
partment. 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
104 
HR 1560 RFS
(b) SENIOR LEADERSHIP OF CYBERSECURITY AND 
INFRASTRUCTURE PROTECTION.— 
(1) IN
GENERAL.—Subsection (a) of section 
103 of the Homeland Security Act of 2002 (6 
U.S.C. 113) is amended— 
(A) in paragraph (1)— 
(i) by amending subparagraph (H) to 
read as follows: 
‘‘(H) An Under Secretary for Cyber-
security and Infrastructure Protection.’’; 
and 
(ii) by adding at the end the following 
new subparagraphs: 
‘‘(K) A Deputy Under Secretary for 
Cybersecurity. 
‘‘(L) A Deputy Under Secretary for 
Infrastructure Protection.’’; and 
(B) by adding at the end the following new 
paragraph: 
‘‘(3) DEPUTY UNDER SECRETARIES.—The Dep-
uty Under Secretaries referred to in subparagraphs 
(K) and (L) of paragraph (1) shall be appointed by 
the President without the advice and consent of the 
Senate.’’. 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
105 
HR 1560 RFS
(2) CONTINUATION
IN
OFFICE.—The individ-
uals who hold the positions referred in subpara-
graphs (H), (K), and (L) of paragraph (1) of section 
103(a) the Homeland Security Act of 2002 (as 
amended and added by paragraph (1) of this sub-
section) as of the date of the enactment of this title 
may continue to hold such positions. 
(c) REPORT.—Not later than 90 days after the date 
of the enactment of this title, the Under Secretary for Cy-
bersecurity and Infrastructure Protection of the Depart-
ment of Homeland Security shall submit to the Committee 
on Homeland Security of the House of Representatives 
and the Committee on Homeland Security and Govern-
mental Affairs of the Senate a report on the feasibility 
of becoming an operational component, including an anal-
ysis of alternatives, and if a determination is rendered that 
becoming an operational component is the best option for 
achieving the mission of Cybersecurity and Infrastructure 
Protection, a legislative proposal and implementation plan 
for becoming such an operational component. Such report 
shall also include plans to more effectively carry out the 
cybersecurity mission of Cybersecurity and Infrastructure 
Protection, including expediting information sharing 
agreements. 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
106 
HR 1560 RFS
SEC. 206. CYBER INCIDENT RESPONSE PLANS. 
(a) IN GENERAL.—Section 227 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 149) is amended— 
(1) in the heading, by striking ‘‘PLAN’’ and in-
serting ‘‘PLANS’’; 
(2) by striking ‘‘The Under Secretary appointed 
under section 103(a)(1)(H) shall’’ and inserting the 
following: 
‘‘(a) IN GENERAL.—The Under Secretary for Cyber-
security and Infrastructure Protection shall’’; and 
(3) by adding at the end the following new sub-
section: 
‘‘(b) UPDATES TO THE CYBER INCIDENT ANNEX TO 
THE NATIONAL RESPONSE FRAMEWORK.—The Secretary, 
in coordination with the heads of other appropriate Fed-
eral departments and agencies, and in accordance with the 
National Cybersecurity Incident Response Plan required 
under subsection (a), shall regularly update, maintain, and 
exercise the Cyber Incident Annex to the National Re-
sponse Framework of the Department.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by 
amending the item relating to section 227 to read as fol-
lows: 
‘‘Sec. 227. Cyber incident response plans.’’. 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6211
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
107 
HR 1560 RFS
SEC. 207. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS; CYBERSECURITY AWARE-
NESS CAMPAIGN. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new sections: 
‘‘SEC. 230. SECURITY AND RESILIENCY OF PUBLIC SAFETY 
COMMUNICATIONS. 
‘‘The National Cybersecurity and Communications 
Integration Center, in coordination with the Office of 
Emergency Communications of the Department, shall as-
sess and evaluate consequence, vulnerability, and threat 
information regarding cyber incidents to public safety 
communications to help facilitate continuous improve-
ments to the security and resiliency of such communica-
tions. 
‘‘SEC. 231. CYBERSECURITY AWARENESS CAMPAIGN. 
‘‘(a) IN GENERAL.—The Under Secretary for Cyber-
security and Infrastructure Protection shall develop and 
implement an ongoing and comprehensive cybersecurity 
awareness campaign regarding cybersecurity risks and vol-
untary best practices for mitigating and responding to 
such risks. Such campaign shall, at a minimum, publish 
and disseminate, on an ongoing basis, the following: 
‘‘(1) Public service announcements targeted at 
improving awareness among State, local, and tribal 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
108 
HR 1560 RFS
governments, the private sector, academia, and 
stakeholders in specific audiences, including the el-
derly, students, small businesses, members of the 
Armed Forces, and veterans. 
‘‘(2) Vendor and technology-neutral voluntary 
best practices information. 
‘‘(b) CONSULTATION.—The Under Secretary for Cy-
bersecurity and Infrastructure Protection shall consult 
with a wide range of stakeholders in government, industry, 
academia, and the non-profit community in carrying out 
this section. 
‘‘SEC. 232. NATIONAL CYBERSECURITY PREPAREDNESS 
CONSORTIUM. 
‘‘(a) IN GENERAL.—The Secretary may establish a 
consortium to be known as the ‘National Cybersecurity 
Preparedness Consortium’ (in this section referred to as 
the ‘Consortium’). 
‘‘(b) FUNCTIONS.—The Consortium may— 
‘‘(1) provide training to State and local first re-
sponders and officials specifically for preparing and 
responding to cyber attacks; 
‘‘(2) develop and update a curriculum utilizing 
the National Protection and Programs Directorate 
of the Department sponsored Community Cyber Se-
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
109 
HR 1560 RFS
curity Maturity Model (CCSMM) for State and local 
first responders and officials; 
‘‘(3) provide technical assistance services to 
build and sustain capabilities in support of cyberse-
curity preparedness and response; 
‘‘(4) conduct cybersecurity training and simula-
tion exercises to defend from and respond to cyber- 
attacks; 
‘‘(5) coordinate with the National Cybersecurity 
and Communications Integration Center to help 
States and communities develop cybersecurity infor-
mation sharing programs; and 
‘‘(6) coordinate with the National Domestic 
Preparedness Consortium to incorporate cybersecu-
rity emergency responses into existing State and 
local emergency management functions. 
‘‘(c) MEMBERS.—The Consortium shall consist of 
academic, nonprofit, and government partners that de-
velop, update, and deliver cybersecurity training in sup-
port of homeland security. Members shall have prior expe-
rience conducting cybersecurity training and exercises for 
State and local entities.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by in-
serting after the item relating to section 226 (relating to 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
110 
HR 1560 RFS
cybersecurity recruitment and retention) the following new 
items: 
‘‘Sec. 230. Security and resiliency of public safety communications. 
‘‘Sec. 231. Cybersecurity awareness campaign. 
‘‘Sec. 232. National Cybersecurity Preparedness Consortium.’’. 
SEC. 208. CRITICAL INFRASTRUCTURE PROTECTION RE-
SEARCH AND DEVELOPMENT. 
(a) STRATEGIC PLAN; PUBLIC-PRIVATE CONSOR-
TIUMS.—Title III of the Homeland Security Act of 2002 
(6 U.S.C. 181 et seq.) is amended by adding at the end 
the following new section: 
‘‘SEC. 318. RESEARCH AND DEVELOPMENT STRATEGY FOR 
CRITICAL INFRASTRUCTURE PROTECTION. 
‘‘(a) IN GENERAL.—Not later than 180 days after 
the date of enactment of this section, the Secretary, acting 
through the Under Secretary for Science and Technology, 
shall submit to Congress a strategic plan to guide the 
overall direction of Federal physical security and cyberse-
curity technology research and development efforts for 
protecting critical infrastructure, including against all 
threats. Such plan shall be updated and submitted to Con-
gress every two years. 
‘‘(b) CONTENTS OF PLAN.—The strategic plan, in-
cluding biennial updates, required under subsection (a) 
shall include the following: 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
111 
HR 1560 RFS
‘‘(1) An identification of critical infrastructure 
security risks and any associated security technology 
gaps, that are developed following: 
‘‘(A) Consultation with stakeholders, in-
cluding critical infrastructure Sector Coordi-
nating Councils. 
‘‘(B) Performance by the Department of a 
risk and gap analysis that considers informa-
tion received in such consultations. 
‘‘(2) A set of critical infrastructure security 
technology needs that— 
‘‘(A) is prioritized based on the risks and 
gaps identified under paragraph (1); 
‘‘(B) emphasizes research and development 
of technologies that need to be accelerated due 
to rapidly evolving threats or rapidly advancing 
infrastructure technology; and 
‘‘(C) includes research, development, and 
acquisition roadmaps with clearly defined objec-
tives, goals, and measures. 
‘‘(3) An identification of laboratories, facilities, 
modeling, and simulation capabilities that will be re-
quired to support the research, development, dem-
onstration, testing, evaluation, and acquisition of the 
security technologies described in paragraph (2). 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
112 
HR 1560 RFS
‘‘(4) An identification of current and planned 
programmatic initiatives for fostering the rapid ad-
vancement and deployment of security technologies 
for critical infrastructure protection, including a 
consideration of opportunities for public-private 
partnerships, intragovernment collaboration, univer-
sity centers of excellence, and national laboratory 
technology transfer. 
‘‘(5) A description of progress made with re-
spect to each critical infrastructure security risk, as-
sociated security technology gap, and critical infra-
structure technology need identified in the preceding 
strategic plan required under subsection (a). 
‘‘(c) COORDINATION.—In carrying out this section, 
the Under Secretary for Science and Technology shall co-
ordinate with the Under Secretary for the National Pro-
tection and Programs Directorate. 
‘‘(d) CONSULTATION.—In carrying out this section, 
the Under Secretary for Science and Technology shall con-
sult with— 
‘‘(1) critical infrastructure Sector Coordinating 
Councils; 
‘‘(2) to the extent practicable, subject matter 
experts on critical infrastructure protection from 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS
118 
HR 1560 RFS
‘‘(D) an attempt, or conspiracy, to commit 
an offense described in any of subparagraphs 
(A) through (C). 
‘‘(c) CONDITIONS.—Contracts or other agreements 
under subsection (b)(2) shall include appropriate provi-
sions barring— 
‘‘(1) the disclosure of information to any entity 
other than the Department or the Federal agency 
disclosing information in accordance with subsection 
(b)(1) that can be used to identify specific persons 
and is reasonably believed to be unrelated to a cy-
bersecurity risk; and 
‘‘(2) the use of any information to which such 
private entity gains access in accordance with this 
section for any purpose other than to protect Fed-
eral agency information and information systems 
against cybersecurity risks or to administer any such 
contract or other agreement. 
‘‘(d) LIMITATION.—No cause of action shall lie 
against a private entity for assistance provided to the Sec-
retary in accordance with this section and a contract or 
agreement under subsection (b)(2).’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
of the Homeland Security Act of 2002 is amended by in-
serting after the item relating to section 226 (relating to 
VerDate Sep 11 2014 
22:57 Jul 15, 2016
Jkt 059200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H1560.RFS
H1560
sradovich on DSK3GMQ082PROD with BILLS