IIB 
115TH CONGRESS 
1ST SESSION H. R. 3359 
IN THE SENATE OF THE UNITED STATES 
DECEMBER 12, 2017 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to authorize 
the Cybersecurity and Infrastructure Security Agency of 
the Department of Homeland Security, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS
HR 3359 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity and In-
frastructure Security Agency Act of 2017’’. 
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—The Homeland Security Act of 
2002 is amended by adding at the end the following new 
title: 
‘‘TITLE 
XXII—CYBERSECURITY 
AND INFRASTRUCTURE SECU-
RITY AGENCY 
‘‘Subtitle A—Cybersecurity and 
Infrastructure Security 
‘‘SEC. 2201. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the meaning given such term in section 2215. 
‘‘(2) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
section 2209. 
‘‘(3) CYBERSECURITY THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given such term 
in paragraph (5) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS
HR 3359 RFS
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(4) FEDERAL ENTITY.—The term ‘Federal en-
tity’ has the meaning given such term in paragraph 
(8) of section 102 of the Cybersecurity Act of 2015 
(contained in division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(5) NON-FEDERAL ENTITY.—The term ‘non- 
Federal entity’ has the meaning given such term in 
paragraph (14) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(6) SECTOR-SPECIFIC
AGENCY.—The term 
‘Sector-Specific Agency’ means a Federal depart-
ment or agency, designated by law or presidential di-
rective, with responsibility for providing institutional 
knowledge and specialized expertise of a sector, as 
well as leading, facilitating, or supporting programs 
and associated activities of its designated critical in-
frastructure sector in the all hazards environment in 
coordination with the Department. 
‘‘(7) SHARING.—The term ‘sharing’ has the 
meaning given such term in section 2209. 
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS
HR 3359 RFS
‘‘(8) NATIONAL
CYBERSECURITY
ASSET
RE-
SPONSE ACTIVITIES.—The term ‘national cybersecu-
rity asset response activities’ means— 
‘‘(A) furnishing cybersecurity technical as-
sistance to entities affected by cybersecurity 
risks to protect assets, mitigate vulnerabilities, 
and reduce impacts of cyber incidents; 
‘‘(B) identifying other entities that may be 
at risk of an incident and assessing risk to the 
same or similar vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks 
to a sector or region, including potential cas-
cading effects, and developing courses of action 
to mitigate such risks; 
‘‘(D) facilitating information sharing and 
operational coordination with threat response; 
and 
‘‘(E) providing guidance on how best to 
utilize Federal resources and capabilities in a 
timely, effective manner to speed recovery from 
cybersecurity risks. 
‘‘SEC. 2202. CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AGENCY. 
‘‘(a) REDESIGNATION.— 
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS
HR 3359 RFS
‘‘(1) IN
GENERAL.—The National Protection 
and Programs Directorate of the Department shall, 
on and after the date of the enactment of this sub-
title, be known as the ‘Cybersecurity and Infrastruc-
ture Security Agency’ (in this subtitle referred to as 
the ‘Agency’). 
‘‘(2) REFERENCES.—Any reference to the Na-
tional Protection and Programs Directorate of the 
Department in any law, regulation, map, document, 
record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and 
Infrastructure Security Agency of the Department. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Agency shall be head-
ed by a Director of Cybersecurity and Infrastructure 
Security (in this subtitle referred to as the ‘Direc-
tor’), who shall report to the Secretary. 
‘‘(2) REFERENCE.—Any reference to an Under 
Secretary responsible for overseeing critical infra-
structure protection, cybersecurity, and any other re-
lated program of the Department as described in 
section 103(a)(1)(H) as in effect on the day before 
the date of the enactment of this subtitle in any law, 
regulation, map, document, record, or other paper of 
the United States shall be deemed to be a reference 
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS
HR 3359 RFS
to the Director of Cybersecurity and Infrastructure 
Security of the Department. 
‘‘(c) RESPONSIBILITIES.—The Director shall— 
‘‘(1) lead cybersecurity and critical infrastruc-
ture security programs, operations, and associated 
policy for the Agency, including national cybersecu-
rity asset response activities; 
‘‘(2) coordinate with Federal entities, including 
Sector-Specific Agencies, and non-Federal entities, 
including international entities, to carry out the cy-
bersecurity and critical infrastructure activities of 
the Agency, as appropriate; 
‘‘(3) carry out the Secretary’s responsibilities to 
secure Federal information and information systems 
consistent with law, including subchapter II of chap-
ter 35 of title 44, United States Code, and the Cy-
bersecurity Act of 2015 (contained in division N of 
the Consolidated Appropriations Act, 2016 (Public 
Law 114–113)); 
‘‘(4) coordinate a national effort to secure and 
protect against critical infrastructure risks, con-
sistent with subsection (e)(1)(E); 
‘‘(5) upon request provide analyses, expertise, 
and other technical assistance to critical infrastruc-
ture owners and operators and, where appropriate, 
VerDate Sep 11 2014 
21:55 Dec 12, 2017
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3359.RFS
H3359
daltland on DSKBBV9HB2PROD with BILLS