I 
114TH CONGRESS 
1ST SESSION H. R. 3510 
To amend the Homeland Security Act of 2002 to require the Secretary 
of Homeland Security to develop a cybersecurity strategy for the Depart-
ment of Homeland Security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 15, 2015 
Mr. RICHMOND introduced the following bill; which was referred to the 
Committee on Homeland Security 
A BILL 
To amend the Homeland Security Act of 2002 to require 
the Secretary of Homeland Security to develop a cyberse-
curity strategy for the Department of Homeland Secu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Department of Home-
land Security Cybersecurity Strategy Act of 2015’’. 
VerDate Sep 11 2014 
22:22 Sep 15, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3510.IH
H3510
srobinson on DSK5SPTVN1PROD with BILLS
SEC. 2. CYBERSECURITY STRATEGY FOR THE DEPARTMENT 
OF HOMELAND SECURITY. 
(a) IN GENERAL.—Subtitle C of title II of the Home-
land Security Act (6 U.S.C. 141 et seq.) is amended by 
adding at the end the following new section: 
‘‘SEC. 230. CYBERSECURITY STRATEGY. 
‘‘(a) IN GENERAL.—Not later than 60 days after the 
date of the enactment of this section, the Secretary shall 
develop a departmental strategy to carry out cybersecurity 
responsibilities as set forth in law. 
‘‘(b) CONTENTS.—The strategy required under sub-
section (a) shall include the following: 
‘‘(1) Strategic and operational goals and prior-
ities to successfully execute the full range of the Sec-
retary’s cybersecurity responsibilities. 
‘‘(2) Information on the programs, policies, and 
activities that are required to successfully execute 
the full range of the Secretary’s cybersecurity re-
sponsibilities, including programs, policies, and ac-
tivities in furtherance of the following: 
‘‘(A) Cybersecurity functions set forth in 
the second section 226 (relating to the national 
cybersecurity and communications integration 
center). 
‘‘(B) Cybersecurity investigations capabili-
ties. 
VerDate Sep 11 2014 
22:22 Sep 15, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3510.IH
H3510
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(C) Cybersecurity research and develop-
ment. 
‘‘(D) Engagement with international cyber-
security partners. 
‘‘(c) CONSIDERATIONS.—In developing the strategy 
required under subsection (a), the Secretary shall— 
‘‘(1) consider— 
‘‘(A) the cybersecurity strategy for the 
Homeland Security Enterprise published by the 
Secretary in November 2011; 
‘‘(B) the Department of Homeland Secu-
rity Fiscal Years 2014–2018 Strategic Plan; 
and 
‘‘(C) the most recent Quadrennial Home-
land Security Review issued pursuant to section 
707; and 
‘‘(2) include information on the roles and re-
sponsibilities of components and offices of the De-
partment, to the extent practicable, to carry out 
such strategy. 
‘‘(d) IMPLEMENTATION PLAN.—Not later than 90 
days after the development of the strategy required under 
subsection (a), the Secretary shall issue an implementa-
tion plan for the strategy that includes the following: 
VerDate Sep 11 2014 
22:22 Sep 15, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3510.IH
H3510
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(1) Strategic objectives and corresponding 
tasks. 
‘‘(2) Projected timelines and costs for such 
tasks. 
‘‘(3) Metrics to evaluate performance of such 
tasks. 
‘‘(e) CONGRESSIONAL OVERSIGHT.—The Secretary 
shall submit to the Committee on Homeland Security of 
the House of Representatives and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate for assessment the following: 
‘‘(1) A copy of the strategy required under sub-
section (a) upon issuance. 
‘‘(2) A copy of the implementation plan re-
quired under subsection (d) upon issuance, together 
with detailed information on any associated legisla-
tive or budgetary proposals. 
‘‘(f) PROHIBITION
ON REORGANIZATION.—In the 
event that the strategy required under subsection (a) or 
implementation plan required under subsection (d) in-
cludes actions to reorganize departmental components or 
offices, such actions may not be executed without prior 
congressional authorization. 
VerDate Sep 11 2014 
22:22 Sep 15, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3510.IH
H3510
srobinson on DSK5SPTVN1PROD with BILLS
‘‘(g) CLASSIFIED INFORMATION.—The strategy re-
quired under subsection (a) shall be in an unclassified 
form but may contain a classified annex. 
‘‘(h) DEFINITIONS.—In this section: 
‘‘(1) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
the second section 226, relating to the national cy-
bersecurity and communications integration center. 
‘‘(2) HOMELAND SECURITY ENTERPRISE.—The 
term ‘Homeland Security Enterprise’ means relevant 
governmental and nongovernmental entities involved 
in homeland security, including Federal, State, local, 
and tribal government officials, private sector rep-
resentatives, academics, and other policy experts. 
‘‘(3) INCIDENT.—The term ‘incident’ has the 
meaning given such term in the second section 226, 
relating to the national cybersecurity and commu-
nications integration center.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by adding at the end of the list of items for sub-
title C of title II the following new item: 
‘‘Sec. 230. Cybersecurity strategy.’’. 
(c) AMENDMENT TO DEFINITION.—Paragraph (2) of 
subsection (a) of the second section 226 of the Homeland 
Security Act of 2002 (6 U.S.C. 148; relating to the na-
VerDate Sep 11 2014 
22:22 Sep 15, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3510.IH
H3510
srobinson on DSK5SPTVN1PROD with BILLS