I 
114TH CONGRESS 
1ST SESSION H. R. 3313 
To amend the Homeland Security Act of 2002 to strengthen the ability 
of the Secretary of Homeland Security to detect and prevent intrusions 
against, and to use countermeasures to protect, agency information sys-
tems, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 29, 2015 
Mr. MCCAUL (for himself and Mr. RATCLIFFE) introduced the following bill; 
which was referred to the Committee on Oversight and Government Re-
form, and in addition to the Committee on Homeland Security, for a pe-
riod to be subsequently determined by the Speaker, in each case for con-
sideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To amend the Homeland Security Act of 2002 to strengthen 
the ability of the Secretary of Homeland Security to 
detect and prevent intrusions against, and to use coun-
termeasures to protect, agency information systems, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Defense of Fed-
eral Networks Act of 2015’’. 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 2. CYBER DEFENSE OF FEDERAL NETWORKS. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act of 2002 (6 U.S.C. 141 et seq.) is amend-
ed by adding at the end the following new sections: 
‘‘SEC. 230. CYBERSECURITY PLANS. 
‘‘(a) 
INTRUSION
DETECTION
AND
RESPONSE 
PLAN.—Not later than one year after the date of the en-
actment of this section, the Secretary, in coordination with 
the Director of the Office of Management and Budget, 
shall develop and implement an intrusion detection and 
response plan to detect, identify, and remove intruders in 
agency information systems. The Secretary, in coordina-
tion with the Director, shall update such plan as nec-
essary. 
‘‘(b) EXCEPTION.—The intrusion detection and re-
sponse plan required under subsection (a) shall not apply 
to the Department of Defense or an element of the intel-
ligence community. 
‘‘(c) DEFINITIONS.—In this section and sections 231, 
232, and 233: 
‘‘(1) AGENCY.—The term ‘agency’ has the 
meaning given such term in section 3502 of title 44, 
United States Code. 
‘‘(2) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
the second section 226 (relating to the national cy-
bersecurity and communications integration center). 
‘‘(3) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given such term in 
the second section 226 (relating to the national cy-
bersecurity and communications integration center). 
‘‘(4) INTELLIGENCE
COMMUNITY.—The term 
‘intelligence community’ has the meaning given such 
term in section 3(4) of the National Security Act of 
1947 (50 U.S.C. 3003(4)). 
‘‘SEC. 231. ADVANCED INTERNAL DEFENSES. 
‘‘(a) ADVANCED NETWORK SECURITY TOOLS.— 
‘‘(1) IN GENERAL.—The Secretary shall include 
in the Department’s efforts to continuously diagnose 
and mitigate cybersecurity risks advanced network 
security tools to improve visibility of network activ-
ity, including through the use of commercial and 
free or open source tools, to detect and mitigate in-
trusions and anomalous activity in agencies’ infor-
mation systems. 
‘‘(2) DEVELOPMENT OF PLAN.—The Secretary, 
in coordination with the Director of the Office of 
Management and Budget, shall develop and imple-
ment a plan to ensure advanced network security 
tools, including tools described in paragraph (1), to 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
detect and mitigate intrusions and anomalous activ-
ity are available for use by each agency. 
‘‘(b) PRIORITIZING ADVANCED SECURITY TOOLS.— 
The Secretary, in coordination with the Director of the 
Office of Management and Budget, and in consultation 
with the heads of appropriate agencies, shall— 
‘‘(1) review and update operational capabilities 
to ensure appropriate prioritization and use of net-
work security monitoring tools within such agency 
networks; and 
‘‘(2) brief the Committee on Homeland Security 
of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of 
the Senate on such prioritization and use. 
‘‘(c) IMPROVED METRICS.—The Secretary, in coordi-
nation with the Director of the Office of Management and 
Budget, shall review and update the metrics used to meas-
ure security under section 3554 of title 44, United States 
Code, to include measures of intrusion and incident detec-
tion and response times. 
‘‘(d) TRANSPARENCY
AND ACCOUNTABILITY.—The 
Secretary, in coordination with the Director of the Office 
of Management and Budget, shall increase transparency 
to the public on agency cybersecurity postures, including 
by increasing the number of metrics available on Federal 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
Government performance websites and, to the greatest ex-
tent practicable, displaying metrics for agencies. 
‘‘(e) MAINTENANCE OF TECHNOLOGIES.—Subpara-
graph (B) of section 3553(b)(6) of title 44, United States 
Code, is amended by inserting ‘, operating, and maintain-
ing’ after ‘deploying’. 
‘‘SEC. 232. FEDERAL CYBERSECURITY BEST PRACTICES. 
‘‘The Secretary, in consultation with the Director of 
the Office of Management and Budget, shall regularly as-
sess and require implementation of best practices for— 
‘‘(1) securing agency information systems 
against intrusion; and 
‘‘(2) preventing data exfiltration from such sys-
tems in the event of an intrusion. 
‘‘SEC. 233. ASSESSMENT; REPORTS. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘appropriate congressional com-
mittees’ means the Committee on Homeland Secu-
rity of the House of Representatives and the Com-
mittee on Homeland Security and Governmental Af-
fairs of the Senate. 
‘‘(2) INTRUSION ASSESSMENTS.—The term ‘in-
trusion assessments’ means actions taken under the 
intrusion detection and response plan described in 
VerDate Sep 11 2014 
21:41 Aug 05, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
section 230 to detect, identify, and remove intruders 
in agency information systems. 
‘‘(3) INTRUSION
DETECTION
AND
RESPONSE 
PLAN.—The term ‘intrusion detection and response 
plan’ means the intrusion detection and response 
plan described in section 230. 
‘‘(b) GAO ASSESSMENT.—Not later than three years 
after the date of the enactment of this section, the Comp-
troller General of the United States shall conduct a study 
and publish a report on the effectiveness of the approach 
and strategy of the Department’s capabilities and plans 
in securing agency information systems, including in the 
plans and assessments under sections 230, 231, and 232. 
‘‘(c) REPORT TO CONGRESS.—The Secretary, in co-
ordination with the Director of the Office of Management 
and Budget, shall— 
‘‘(1) not later than six months after the date of 
the enactment of this section and 30 days after any 
update thereto, submit to the appropriate congres-
sional committees the intrusion detection and re-
sponse plan described in section 230; and 
‘‘(2) not later than one year after the date of 
the enactment of this section and annually there-
after, submit to Congress— 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(A) a description of the implementation 
of such intrusion detection and response plan; 
‘‘(B) the findings of the intrusion assess-
ments conducted pursuant to such intrusion de-
tection and response plan; 
‘‘(C) a description of the advanced network 
security tools referred to in section 231; 
‘‘(D) information relating to the results of 
the assessment of the Secretary of Federal cy-
bersecurity best practices under section 232; 
and 
‘‘(E) the improved metrics referred to in 
section 231.’’. 
(b) DEFINITIONS.—Paragraphs (1) and (2) of the 
second section 226 of the Homeland Security Act of 2002 
(6 U.S.C. 148; relating to the national cybersecurity and 
communications integration center) are amended to read 
as follows: 
‘‘(1)(A) except as provided in subparagraph 
(B), the term ‘cybersecurity risk’ means threats to 
and vulnerabilities of information or information sys-
tems and any related consequences caused by or re-
sulting from unauthorized access, use, disclosure, 
degradation, disruption, modification, or destruction 
of such information or information systems, includ-
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
ing such related consequences caused by an act of 
terrorism; and 
‘‘(B) such term does not include any action that 
solely involves a violation of a consumer term of 
service or a consumer licensing agreement; 
‘‘(2) the term ‘incident’ means an occurrence 
that actually or imminently jeopardizes, without law-
ful authority, the integrity, confidentiality, or avail-
ability of information on an information system, or 
actually or imminently jeopardizes, without lawful 
authority, an information system;’’. 
(c) CLERICAL AMENDMENTS.—The table of contents 
for subtitle C of title II of the Homeland Security Act 
of 2002 is amended by adding at the end the following 
new items: 
‘‘Sec. 230. Cybersecurity plans. 
‘‘Sec. 231. Advanced internal defenses. 
‘‘Sec. 232. Federal cybersecurity best practices. 
‘‘Sec. 233. Assessment; reports.’’. 
SEC. 3. DUTIES OF THE SECRETARY OF HOMELAND SECU-
RITY RELATED TO INFORMATION SECURITY. 
Section 3553(b)(6) of title 44, United States Code, 
is amended by striking subparagraphs (C) and (D) and 
inserting the following: 
‘‘(C) providing incident detection, analysis, 
mitigation, and response information, dissemi-
nating related homeland security information, 
VerDate Sep 11 2014 
21:41 Aug 05, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
and providing remote or onsite technical assist-
ance to the head of an agency; 
‘‘(D) compiling and analyzing data on 
agency information security and disseminating 
related homeland security information; 
‘‘(E) developing and conducting targeted 
risk assessments, including assessments of the 
risk of terrorism, and operational evaluations 
for agency information and information systems 
in consultation with the heads of other agencies 
or governmental and private entities that own 
and operate such systems, that may include 
threat, vulnerability, and impact assessments; 
‘‘(F) in conjunction with other agencies 
and the private sector, assessing and fostering 
the development of information security tech-
nologies and capabilities for use across multiple 
agencies; and 
‘‘(G) coordinating with appropriate agen-
cies and officials to ensure, to the maximum ex-
tent feasible, that policies and directives issued 
under paragraph (2) are complementary with— 
‘‘(i) standards and guidelines devel-
oped for national security systems; and 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
‘‘(ii) policies and directives issued by 
the Secretary of Defense and the Director 
of National Intelligence under subsection 
(e)(1); and’’. 
SEC. 4. DIRECTIVES AND IMMINENT THREATS. 
Section 3553 of title 44, United States Code, is 
amended by adding at the end the following: 
‘‘(h) DIRECTION TO AGENCIES.— 
‘‘(1) AUTHORITY.— 
‘‘(A) IN GENERAL.—Notwithstanding sec-
tion 3554, and subject to subparagraph (B), in 
response to a known or reasonably suspected in-
formation security threat, vulnerability, risk, or 
incident, including an act of terrorism, that rep-
resents a substantial threat to the information 
security of an agency, the Secretary may issue 
a directive to the head of an agency to take any 
lawful action with respect to the operation of 
the information system, including such systems 
owned or operated by another entity on behalf 
of an agency, that collects, processes, stores, 
transmits, disseminates, or otherwise maintains 
agency information, for the purpose of pro-
tecting the information system from, or miti-
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS
gating, an information security threat or an act 
of terrorism. 
‘‘(B) EXCEPTION.—The authorities of the 
Secretary under this subsection shall not apply 
to a system described in paragraph (2) or (3) 
of subsection (e). 
‘‘(2) PROCEDURES FOR USE OF AUTHORITY.— 
The Secretary shall— 
‘‘(A) in coordination with the Director and 
in consultation with Federal contractors, as ap-
propriate, establish procedures under which a 
directive may be issued under this subsection, 
which shall include— 
‘‘(i) thresholds and other criteria; 
‘‘(ii) privacy and civil liberties protec-
tions; and 
‘‘(iii) providing notice to potentially 
affected third parties; 
‘‘(B) specify the reasons for the required 
action and the duration of the directive; 
‘‘(C) minimize the impact of a directive 
under this subsection by— 
‘‘(i) adopting the least intrusive 
means possible under the circumstances to 
VerDate Sep 11 2014 
05:06 Aug 04, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H3313.IH
H3313
SSpencer on DSK4SPTVN1PROD with BILLS