SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity and In-
frastructure Security Agency Act of 2017’’. 
SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 
AGENCY. 
(a) IN GENERAL.—The Homeland Security Act of 
2002 is amended by adding at the end the following new 
title: 
‘‘TITLE 
XXII—CYBERSECURITY 
AND INFRASTRUCTURE SECU-
RITY AGENCY 
‘‘Subtitle A—Cybersecurity and 
Infrastructure Security 
‘‘SEC. 2201. DEFINITIONS. 
‘‘In this subtitle: 
‘‘(1) CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘critical infrastructure information’ 
has the meaning given such term in section 2215. 
‘‘(2) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
section 2209. 
‘‘(3) CYBERSECURITY THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given such term 
in paragraph (5) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(4) FEDERAL ENTITY.—The term ‘Federal en-
tity’ has the meaning given such term in paragraph 
(8) of section 102 of the Cybersecurity Act of 2015 
(contained in division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(5) NON-FEDERAL ENTITY.—The term ‘non- 
Federal entity’ has the meaning given such term in 
paragraph (14) of section 102 of the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113; 6 U.S.C. 1501)). 
‘‘(6) SECTOR-SPECIFIC
AGENCY.—The term 
‘Sector-Specific Agency’ means a Federal depart-
ment or agency, designated by law or presidential di-
rective, with responsibility for providing institutional 
knowledge and specialized expertise of a sector, as 
well as leading, facilitating, or supporting programs 
and associated activities of its designated critical in-
frastructure sector in the all hazards environment in 
coordination with the Department. 
‘‘(7) SHARING.—The term ‘sharing’ has the 
meaning given such term in section 2209.
‘‘(8) NATIONAL
CYBERSECURITY
ASSET
RE-
SPONSE ACTIVITIES.—The term ‘national cybersecu-
rity asset response activities’ means— 
‘‘(A) furnishing cybersecurity technical as-
sistance to entities affected by cybersecurity 
risks to protect assets, mitigate vulnerabilities, 
and reduce impacts of cyber incidents; 
‘‘(B) identifying other entities that may be 
at risk of an incident and assessing risk to the 
same or similar vulnerabilities; 
‘‘(C) assessing potential cybersecurity risks 
to a sector or region, including potential cas-
cading effects, and developing courses of action 
to mitigate such risks; 
‘‘(D) facilitating information sharing and 
operational coordination with threat response; 
and 
‘‘(E) providing guidance on how best to 
utilize Federal resources and capabilities in a 
timely, effective manner to speed recovery from 
cybersecurity risks. 
‘‘SEC. 2202. CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AGENCY. 
‘‘(a) REDESIGNATION.—
‘‘(1) IN
GENERAL.—The National Protection 
and Programs Directorate of the Department shall, 
on and after the date of the enactment of this sub-
title, be known as the ‘Cybersecurity and Infrastruc-
ture Security Agency’ (in this subtitle referred to as 
the ‘Agency’). 
‘‘(2) REFERENCES.—Any reference to the Na-
tional Protection and Programs Directorate of the 
Department in any law, regulation, map, document, 
record, or other paper of the United States shall be 
deemed to be a reference to the Cybersecurity and 
Infrastructure Security Agency of the Department. 
‘‘(b) DIRECTOR.— 
‘‘(1) IN GENERAL.—The Agency shall be head-
ed by a Director of Cybersecurity and Infrastructure 
Security (in this subtitle referred to as the ‘Direc-
tor’), who shall report to the Secretary. 
‘‘(2) REFERENCE.—Any reference to an Under 
Secretary responsible for overseeing critical infra-
structure protection, cybersecurity, and any other re-
lated program of the Department as described in 
section 103(a)(1)(H) as in effect on the day before 
the date of the enactment of this subtitle in any law, 
regulation, map, document, record, or other paper of 
the United States shall be deemed to be a reference
to the Director of Cybersecurity and Infrastructure 
Security of the Department. 
‘‘(c) RESPONSIBILITIES.—The Director shall— 
‘‘(1) lead cybersecurity and critical infrastruc-
ture security programs, operations, and associated 
policy for the Agency, including national cybersecu-
rity asset response activities; 
‘‘(2) coordinate with Federal entities, including 
Sector-Specific Agencies, and non-Federal entities, 
including international entities, to carry out the cy-
bersecurity and critical infrastructure activities of 
the Agency, as appropriate; 
‘‘(3) carry out the Secretary’s responsibilities to 
secure Federal information and information systems 
consistent with law, including subchapter II of chap-
ter 35 of title 44, United States Code, and the Cy-
bersecurity Act of 2015 (contained in division N of 
the Consolidated Appropriations Act, 2016 (Public 
Law 114–113)); 
‘‘(4) coordinate a national effort to secure and 
protect against critical infrastructure risks, con-
sistent with subsection (e)(1)(E); 
‘‘(5) upon request provide analyses, expertise, 
and other technical assistance to critical infrastruc-
ture owners and operators and, where appropriate,
provide such analyses, expertise, and other technical 
assistance in coordination with Sector-Specific Agen-
cies and other Federal departments and agencies; 
‘‘(6) develop and utilize mechanisms for active 
and frequent collaboration between the Agency and 
Sector-Specific Agencies to ensure appropriate co-
ordination, situational awareness, and communica-
tions with Sector-Specific Agencies; 
‘‘(7) maintain and utilize mechanisms for the 
regular and ongoing consultation and collaboration 
among the Agency’s Divisions to further operational 
coordination, integrated situational awareness, and 
improved integration across the Agency in accord-
ance with this Act; 
‘‘(8) develop, coordinate, and implement— 
‘‘(A) comprehensive strategic plans for the 
activities of the Agency; and 
‘‘(B) risk assessments by and for the 
Agency; 
‘‘(9) carry out emergency communications re-
sponsibilities, in accordance with title XVIII; 
‘‘(10) carry out cybersecurity, infrastructure se-
curity, and emergency communications stakeholder 
outreach and engagement and coordinate such out-
reach and engagement with critical infrastructure 
Sector-Specific Agencies, as appropriate; and 
‘‘(11) carry out such other duties and powers 
prescribed by law or delegated by the Secretary. 
‘‘(d) DEPUTY DIRECTOR.—There shall be in the 
Agency a Deputy Director of Cybersecurity and Infra-
structure Security who shall— 
‘‘(1) assist the Director in the management of 
the Agency; and 
‘‘(2) report to the Director. 
‘‘(e) CYBERSECURITY AND INFRASTRUCTURE SECU-
RITY AUTHORITIES OF THE SECRETARY.— 
‘‘(1) IN GENERAL.—The responsibilities of the 
Secretary relating to cybersecurity and infrastruc-
ture security shall include the following: 
‘‘(A) To access, receive, and analyze law 
enforcement information, intelligence informa-
tion, and other information from Federal Gov-
ernment agencies, State, local, tribal, and terri-
torial government agencies (including law en-
forcement agencies), and private sector entities, 
and to integrate such information, in support of 
the mission responsibilities of the Department, 
in order to—
‘‘(i) identify and assess the nature 
and scope of terrorist threats to the home-
land; 
‘‘(ii) detect and identify threats of ter-
rorism against the United States; and 
‘‘(iii) understand such threats in light 
of actual and potential vulnerabilities of 
the homeland. 
‘‘(B) To carry out comprehensive assess-
ments of the vulnerabilities of the key resources 
and critical infrastructure of the United States, 
including the performance of risk assessments 
to determine the risks posed by particular types 
of terrorist attacks within the United States 
(including an assessment of the probability of 
success of such attacks and the feasibility and 
potential efficacy of various countermeasures to 
such attacks). At the discretion of the Sec-
retary, such assessments may be carried out in 
coordination with Sector-Specific Agencies. 
‘‘(C) To integrate relevant information, 
analysis, and vulnerability assessments (regard-
less of whether such information, analysis, or 
assessments are provided or produced by the 
Department) in order to make recommenda-
tions, including prioritization, for protective and 
support measures by the Department, other 
Federal Government agencies, State, local, trib-
al, and territorial government agencies and au-
thorities, the private sector, and other entities 
regarding terrorist and other threats to home-
land security. 
‘‘(D) To ensure, pursuant to section 202, 
the timely and efficient access by the Depart-
ment to all information necessary to discharge 
the responsibilities under this title, including 
obtaining such information from other Federal 
Government agencies. 
‘‘(E) To develop, in coordination with the 
Sector-Specific Agencies with available exper-
tise, a comprehensive national plan for securing 
the key resources and critical infrastructure of 
the United States, including power production, 
generation, and distribution systems, informa-
tion technology and telecommunications systems 
(including satellites), electronic financial and 
property record storage and transmission sys-
tems, emergency communications systems, and 
the physical and technological assets that sup-
port such systems.
‘‘(F) To recommend measures necessary to 
protect the key resources and critical infra-
structure of the United States in coordination 
with other Federal Government agencies, in-
cluding Sector-Specific Agencies, and in co-
operation with State, local, tribal, and terri-
torial government agencies and authorities, the 
private sector, and other entities. 
‘‘(G) To review, analyze, and make rec-
ommendations for improvements to the policies 
and procedures governing the sharing of infor-
mation relating to homeland security within the 
Federal Government and between Federal Gov-
ernment agencies and State, local, tribal, and 
territorial government agencies and authorities. 
‘‘(H) To disseminate, as appropriate, infor-
mation analyzed by the Department within the 
Department, to other Federal Government 
agencies with responsibilities relating to home-
land security, and to State, local, tribal, and 
territorial government agencies and private sec-
tor entities with such responsibilities in order to 
assist in the deterrence, prevention, preemption 
of, or response to, terrorist attacks against the 
United States.
‘‘(I) To consult with State, local, tribal, 
and territorial government agencies and private 
sector entities to ensure appropriate exchanges 
of information, including law enforcement-re-
lated information, relating to threats of ter-
rorism against the United States. 
‘‘(J) To ensure that any material received 
pursuant to this Act is protected from unau-
thorized disclosure and handled and used only 
for the performance of official duties. 
‘‘(K) To request additional information 
from other Federal Government agencies, State, 
local, tribal, and territorial government agen-
cies, and the private sector relating to threats 
of terrorism in the United States, or relating to 
other areas of responsibility assigned by the 
Secretary, including the entry into cooperative 
agreements through the Secretary to obtain 
such information. 
‘‘(L) To establish and utilize, in conjunc-
tion with the chief information officer of the 
Department, a secure communications and in-
formation technology infrastructure, including 
data-mining and other advanced analytical 
tools, in order to access, receive, and analyze
data and information in furtherance of the re-
sponsibilities under this section, and to dissemi-
nate information acquired and analyzed by the 
Department, as appropriate. 
‘‘(M) To coordinate training and other 
support to the elements and personnel of the 
Department, other Federal Government agen-
cies, and State, local, tribal, and territorial gov-
ernment agencies that provide information to 
the Department, or are consumers of informa-
tion provided by the Department, in order to 
facilitate the identification and sharing of infor-
mation revealed in their ordinary duties and the 
optimal utilization of information received from 
the Department. 
‘‘(N) To coordinate with Federal, State, 
local, tribal, and territorial law enforcement 
agencies, and the private sector, as appropriate. 
‘‘(O) To exercise the authorities and over-
sight of the functions, personnel, assets, and li-
abilities of those components transferred to the 
Department pursuant to section 201(g). 
‘‘(P) To carry out the functions of the na-
tional cybersecurity and communications inte-
gration center under section 2209.
‘‘(Q) To carry out requirements of the 
Chemical Facilities Anti-Terrorism Standards 
Program established under title XXI and the 
secure handling of ammonium nitrate estab-
lished under subtitle J of title VIII. 
‘‘(2) REALLOCATION.—The Secretary may re-
allocate within the Agency the functions specified in 
sections 2203(b) and 2204(b), consistent with the 
responsibilities provided in paragraph (1) of this 
subsection, upon certifying to and briefing the ap-
propriate congressional committees, and making 
available to the public, at least 60 days prior to any 
such reallocation that such reallocation is necessary 
for carrying out the activities of the Agency. 
‘‘(3) STAFF.— 
‘‘(A) IN
GENERAL.—The Secretary shall 
provide the Agency with a staff of analysts hav-
ing appropriate expertise and experience to as-
sist the Agency in discharging its responsibil-
ities under this section. 
‘‘(B) PRIVATE
SECTOR
ANALYSTS.—Ana-
lysts under this subsection may include analysts 
from the private sector. 
‘‘(C) SECURITY
CLEARANCES.—Analysts 
under this subsection shall possess security
clearances appropriate for their work under this 
section. 
‘‘(4) DETAIL OF PERSONNEL.— 
‘‘(A) IN GENERAL.—In order to assist the 
Agency in discharging its responsibilities under 
this section, personnel of the Federal agencies 
referred to in subparagraph (B) may be de-
tailed to the Agency for the performance of 
analytic functions and related duties. 
‘‘(B) AGENCIES SPECIFIED.—The Federal 
agencies referred to in subparagraph (A) are 
the following: 
‘‘(i) The Department of State. 
‘‘(ii) The Central Intelligence Agency. 
‘‘(iii) The Federal Bureau of Inves-
tigation. 
‘‘(iv) The National Security Agency. 
‘‘(v) The National Geospatial-Intel-
ligence Agency. 
‘‘(vi) The Defense Intelligence Agen-
cy. 
‘‘(vii) Sector-Specific Agencies. 
‘‘(viii) Any other agency of the Fed-
eral Government that the President con-
siders appropriate.
‘‘(C) INTERAGENCY
AGREEMENTS.—The 
Secretary and the head of an agency specified 
in subparagraph (B) may enter into agreements 
for the purpose of detailing personnel under 
this paragraph. 
‘‘(D) BASIS.—The detail of personnel 
under this paragraph may be on a reimbursable 
or non-reimbursable basis. 
‘‘(f) COMPOSITION.—The Agency shall be composed 
of the following divisions: 
‘‘(1) The Cybersecurity Division, headed by an 
Assistant Director. 
‘‘(2) The Infrastructure Security Division, 
headed by an Assistant Director. 
‘‘(3) The Emergency Communications Division 
under title XVIII, headed by an Assistant Director. 
‘‘(g) CO-LOCATION.—To the maximum extent prac-
ticable, the Director shall examine the establishment of 
central locations in geographical regions with a significant 
Agency presence. When establishing such locations, the 
Director shall coordinate with component heads and the 
Under Secretary for Management to co-locate or partner 
on any new real property leases, renewing any occupancy 
agreements for existing leases, or agreeing to extend or 
newly occupy any Federal space or new construction.
‘‘(h) PRIVACY.— 
‘‘(1) IN GENERAL.—There shall be a Privacy 
Officer of the Agency with primary responsibility for 
privacy policy and compliance for the Agency. 
‘‘(2) RESPONSIBILITIES.—The responsibilities 
of the Privacy Officer of the Agency shall include— 
‘‘(A) assuring that the use of technologies 
by the Agency sustain, and do not erode, pri-
vacy protections relating to the use, collection, 
and disclosure of personal information; 
‘‘(B) assuring that personal information 
contained in Privacy Act systems of records of 
the Agency is handled in full compliance with 
fair information practices as specified in the 
Privacy Act of 1974; 
‘‘(C) evaluating legislative and regulatory 
proposals involving collection, use, and disclo-
sure of personal information by the Agency; 
and 
‘‘(D) conducting a privacy impact assess-
ment of proposed rules of the Agency on the 
privacy of personal information, including the 
type of personal information collected and the 
number of people affected.
‘‘(i) SAVINGS.—Nothing in this title may be con-
strued as affecting in any manner the authority, existing 
on the day before the date of the enactment of this title, 
of any other component of the Department or any other 
Federal department or agency. 
‘‘SEC. 2203. CYBERSECURITY DIVISION. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN GENERAL.—There is established in the 
Agency a Cybersecurity Division. 
‘‘(2) ASSISTANT DIRECTOR.—The Cybersecurity 
Division shall be headed by an Assistant Director for 
Cybersecurity (in this subtitle referred to as the ‘As-
sistant Director’), who shall— 
‘‘(A) be at the level of Assistant Secretary 
within the Department; 
‘‘(B) be appointed by the President with-
out the advice and consent of the Senate; and 
‘‘(C) report to the Director. 
‘‘(3) REFERENCE.—Any reference to the Assist-
ant Secretary for Cybersecurity and Communica-
tions in any law, regulation, map, document, record, 
or other paper of the United States shall be deemed 
to be a reference to the Assistant Director for Cy-
bersecurity. 
‘‘(b) FUNCTIONS.—The Assistant Director shall—
‘‘(1) direct the cybersecurity efforts of the 
Agency; 
‘‘(2) carry out activities, at the direction of the 
Director, related to the security of Federal informa-
tion and Federal information systems consistent 
with law, including subchapter II of chapter 35 of 
title 44, United States Code, and the Cybersecurity 
Act of 2015 (contained in division N of the Consoli-
dated Appropriations Act, 2016 (Public Law 114– 
113)); 
‘‘(3) fully participate in the mechanisms re-
quired under subsection (c)(7) of section 2202; and 
‘‘(4) carry out such other duties and powers as 
prescribed by the Director. 
‘‘SEC. 2204. INFRASTRUCTURE SECURITY DIVISION. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN GENERAL.—There is established in the 
Agency an Infrastructure Security Division. 
‘‘(2) ASSISTANT
DIRECTOR.—The Infrastruc-
ture Security Division shall be headed by an Assist-
ant Director of Infrastructure Security (in this sec-
tion referred to as the ‘Assistant Director’), who 
shall— 
‘‘(A) be at the level of Assistant Secretary 
within the Department;