(C) of paragraph (2) shall be by a majority vote of 
the members of the interagency working group, in 
which each agency with a voting representative on 
the interagency working group has one vote. 
‘‘(c) CODIFICATION OF AGREEMENTS.—All measures 
adopted under subsection (b) shall be submitted by the 
Secretary to the Office of Management and Budget for 
establishment in a binding Governmentwide memo or cir-
cular. 
‘‘(d) ENFORCEMENT OF CYBERSECURITY REQUIRE-
MENTS FOR FEDERAL GOVERNMENT NETWORKS.—The 
Assistant Secretary, acting through the Director of the 
Cybersecurity Compliance Division, may enforce all re-
quirements adopted under subsection (b)(2)(B). 
‘‘(e) CERTIFICATIONS, AUDITS, AND INSPECTIONS.— 
The Director of the Cybersecurity Compliance Division, in 
carrying out the Assistant Secretary for Cybersecurity and 
Communications’ enforcement authority under subsection 
(d), shall require a certification of compliance from the 
head of each civilian Federal agency that is subject to the 
requirements under subsection (b)(2)(B), and may con-
duct announced or unannounced audits and inspections of 
any network owned, operated, or used by a Federal civilian 
agency. 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(f) ENFORCEMENT.—If a certification, audit, or in-
spection carried out under subsection (e) shows non-
compliance 
with 
a 
requirement 
under 
subsection 
(b)(2)(B), Assistant Secretary, acting through the Direc-
tor of the Cybersecurity Compliance Division, may identify 
the appropriate remedies, including penalties, under sub-
section (b)(2)(C). 
‘‘(g) EXECUTION OF PENALTIES BY OMB.—The Di-
rector of the Office of Management and Budget shall exe-
cute each remedy identified by the Director of the Cyber-
security Compliance Division under subsection (f) on be-
half of the Assistant Secretary. 
‘‘(h) REPORTING OF CYBER INCIDENTS ON FEDERAL 
NETWORKS.—The 
requirements 
under 
subsection 
(b)(2)(B) shall include a requirement that all Federal enti-
ties report any cyber incidents on their computer networks 
to the Director and to the United States Computer Emer-
gency Readiness Team. 
‘‘(i) RESPONDING TO CYBER INCIDENTS ON FED-
ERAL NETWORKS.—If an incident is reported under sub-
section (h), the United States Computer Emergency Read-
iness Team shall, in coordination with the reporting agen-
cy, research the incident to determine and report to the 
Director and the reporting agency— 
‘‘(1) the extent of any compromise; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(2) an identification of any attackers, includ-
ing any affiliations with terrorists, terrorist organi-
zations, criminal organizations, state entities, and 
nonstate entities; 
‘‘(3) the method of penetration; 
‘‘(4) ramifications of any such compromise on 
future operations; 
‘‘(5) secondary ramifications of any such com-
promise on other Federal or non-Federal networks; 
‘‘(6) ramifications of any such compromise on 
national security, including war fighting capability; 
and 
‘‘(7) recommended mitigation activities. 
‘‘SEC. 224. DEPARTMENT RESPONSIBILITIES AND AUTHORI-
TIES FOR SECURING PRIVATE SECTOR NET-
WORKS. 
‘‘(a) FINDINGS.—Congress finds that— 
‘‘(1) pursuant to Homeland Security Presi-
dential Directive 7 the Department established pub-
lic-private partnerships including Government Co-
ordinating Councils (GCCs) and Sector Coordinating 
Councils (SCCs) to aid in the task of protecting the 
Nation’s critical infrastructures; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(2) as part of this structure, each critical in-
frastructure sector has a designated sector-specific 
agency; 
‘‘(3) the designated sector-specific agency for 
the Information Technology sector is the Office of 
Cybersecurity and Communications, and the des-
ignated sector-specific agency for the communica-
tions sector is the National Communications System, 
which resides within the Office of Cybersecurity and 
Communications; 
‘‘(4) if cybersecurity regulation are necessary, 
the Department, consistent with the entire GCC/ 
SCC structure, as the sector-specific agency, will be 
the regulator for cybersecurity requirements within 
the information technology and communications sec-
tors; and 
‘‘(5) in other critical infrastructure sectors, en-
forcement of cybersecurity regulations should be ac-
complished through appropriate first-party regu-
latory agencies or sector-specific agencies. 
‘‘(b) GENERAL AUTHORITY.—The Secretary, acting 
through the Director, may establish and enforce risk- 
based cybersecurity requirements for private sector com-
puter networks within covered critical infrastructures. 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(c) RISK-BASED CYBERSECURITY REQUIREMENTS 
FOR CRITICAL INFRASTRUCTURE.— 
‘‘(1) IN GENERAL.—The Director shall promul-
gate risk-based, performance-based cybersecurity re-
quirements for covered critical infrastructures, that 
are designed to prevent, deter, prepare for, detect, 
report, attribute, mitigate, respond to and recover 
from cyber incidents. 
‘‘(2) RISK FACTORS.—The requirements shall 
be 
based 
on 
the 
risk 
factors 
of 
threats, 
vulnerabilities, and consequences, as follows: 
‘‘(A) THREATS.—The requirements shall 
be based on terrorist or other known adversary 
capabilities and intent, or the likelihood of a po-
tential terrorist or other adversary attacking or 
causing a cyber incident against critical infra-
structure, as identified by the Secretary in con-
sultation with the Director of National Intel-
ligence, including— 
‘‘(i) theft, modification, compromise, 
damage, or destruction of data or data-
bases; 
‘‘(ii) physical compromise, damage, or 
destruction of covered critical infrastruc-
tures; and 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(iii) national, corporate, or personal 
espionage. 
‘‘(3) 
VULNERABILITIES.—The 
requirements 
shall require security measures based on— 
‘‘(A) preparedness; 
‘‘(B) target attractiveness; and 
‘‘(C) deterrence capabilities. 
‘‘(4) CONSEQUENCES.—The requirements shall 
require security measures based on— 
‘‘(A) the potential extent and likelihood of 
death, injury, or serious adverse effects to 
human health and safety caused by a disruption 
of the reliable operation of covered critical in-
frastructure; 
‘‘(B) the threat to or potential impact on 
national security caused by a disruption of the 
reliable operation of covered critical infrastruc-
ture; 
‘‘(C) the extent to which the disruption of 
the reliable operation of covered critical infra-
structure will disrupt the reliable operation of 
other covered critical infrastructure; 
‘‘(D) the potential for harm to the econ-
omy that would result from a disruption of the 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
reliable operation of covered critical infrastruc-
ture; and 
‘‘(E) other risk-based security factors that 
the Director, in consultation with the head of 
the sector-specific agency that is the first-party 
regulatory agency with responsibility for the 
covered critical infrastructure concerned, deter-
mines to be appropriate and necessary to pro-
tect public health and safety, critical infrastruc-
ture, national security, or economic security. 
‘‘(d) CONSULTATION.—In establishing security per-
formance requirements under subsection (c), the Director 
shall, to the maximum extent practicable, consult with— 
‘‘(1) the Assistant Secretary for Infrastructure 
Protection of the Department; 
‘‘(2) the Officer for Civil Rights and Civil Lib-
erties of the Department; 
‘‘(3) the Chief Privacy Officer of the Depart-
ment; 
‘‘(4) the Under Secretary for Intelligence and 
Analysis; 
‘‘(5) the Director of National Intelligence; 
‘‘(6) the Director of the National Security 
Agency; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(7) the Director of the National Institute of 
Standards and Technology; 
‘‘(8) the heads of sector-specific agencies; 
‘‘(9) the heads of first-party regulatory agen-
cies; 
‘‘(10) private sector companies or industry 
groups, including but not limited to members of ap-
propriate sector coordinating councils; 
‘‘(11) State, local, and tribal agency representa-
tives; 
‘‘(12) academic institutions and think tanks; 
‘‘(13) private sector, government, and nonprofit 
entities that specialize in privacy and civil liberties; 
and 
‘‘(14) the White House Cybersecurity Coordi-
nator. 
‘‘(e) COVERED CRITICAL INFRASTRUCTURES.— 
‘‘(1) DESIGNATION.—The Director shall— 
‘‘(A) determine, in consultation with the 
heads of sector-specific agencies and the heads 
of first-party regulatory agencies, which sys-
tems or assets of critical infrastructure shall be 
subject to the requirements of this section and 
designate them as covered critical infrastruc-
tures for purposes of this section; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(B) notify each first-party regulatory 
agency or sector-specific agency of each such 
determination; and 
‘‘(C) acting through the corresponding 
first-party regulatory agency or sector-specific 
agency, notify owners or operators of covered 
critical infrastructure sectors of the require-
ments of this subtitle. 
‘‘(2) REQUIREMENTS.—A system or asset may 
not be designated as covered critical infrastructure 
under paragraph (1) unless— 
‘‘(A) the system or asset meets the re-
quirements for inclusion on the prioritized crit-
ical infrastructure list established by the Sec-
retary under section 210E(a)(2); 
‘‘(B) the system or asset is a component of 
the national information infrastructure or the 
national information infrastructure is essential 
to the reliable operation of the system or asset; 
or 
‘‘(C) the destruction or the disruption of 
the reliable operation of the system or asset 
would cause a national or regional catastrophe. 
‘‘(3) FACTORS TO BE CONSIDERED.—In desig-
nating systems or assets under this section, the Di-
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
rector shall consider cyber risks and consequences by 
sector, including— 
‘‘(A) the factors listed in section subsection 
(c); 
‘‘(B) known cyber incidents or cyber risks 
identified by existing risk assessments; 
‘‘(C) interdependencies between compo-
nents of covered critical infrastructure; and 
‘‘(D) the potential for the destruction or 
disruption of the system or asset to cause— 
‘‘(i) a mass casualty event with an ex-
traordinary number of fatalities; 
‘‘(ii) severe economic consequences; 
‘‘(iii) mass evacuations with a pro-
longed absence; or 
‘‘(iv) severe degradation of national 
security capabilities, including intelligence 
and defense functions. 
‘‘(4) RECONSIDERATION.—Prior to a final des-
ignation of a system or asset of critical infrastruc-
ture under this subsection, the Director shall provide 
the owner or operator of the system or asset an op-
portunity to appeal the determination made under 
paragraph (1)(A). 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(f) CYBERSECURITY PLANS.—The Director shall re-
quire entities determined under subsection (e) to be cov-
ered critical infrastructures to comply with the require-
ments under subsection (c) and to submit to the first- 
party regulatory agency or sector-specific agency, a pro-
posed cybersecurity plan to satisfy the security perform-
ance requirements described in subsection (c) on a 
timeline determined by the Director. 
‘‘(g) CYBERSECURITY PLAN REVIEW.—Upon submis-
sion of the plan, the first-party regulatory agency or sec-
tor-specific agency shall, based on guidance provided by 
the Director— 
‘‘(1) review cybersecurity plans submitted pur-
suant to subsection (f); 
‘‘(2) approve or disapprove each cybersecurity 
plan; 
‘‘(3) notify the submitter of the cybersecurity 
plan of approval or disapproval; 
‘‘(4) in the case of disapproval, provide a clear 
explanation of the reasons for disapproval, possible 
changes that would result in approval, and provide 
a timetable for resubmission for compliance; and 
‘‘(5) inform the Director of any approvals or 
disapprovals. 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘(h) 
IMPLEMENTATION
OF
CYBERSECURITY 
PLANS.— 
‘‘(1) IN GENERAL.—The owners and operators 
of covered critical infrastructure shall have flexibility 
in their cybersecurity plans to implement any cyber-
security measure, or combination thereof, to satisfy 
the cybersecurity performance requirements de-
scribed in subsection (c) and the first-party regu-
latory agency or sector-specific agency may not dis-
approve under this section any proposed cybersecu-
rity measures, or combination thereof, based on the 
presence or absence of any particular cybersecurity 
measure if the proposed cybersecurity measures, or 
combination thereof, satisfy the cybersecurity per-
formance requirements established by the Director 
under subsection (c). 
‘‘(2) RECOMMENDED
CYBERSECURITY
MEAS-
URES.—The Assistant Secretary for Cybersecurity 
and Communications may, at the request of an 
owner and operator of covered critical infrastructure, 
recommend a specific cybersecurity measure, or com-
bination thereof, that will satisfy the cybersecurity 
performance requirements established by the Direc-
tor. The absence of the recommended security meas-
ures, or combination thereof, may not serve as the 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS