IIB 
117TH CONGRESS 
1ST SESSION H. R. 3223 
IN THE SENATE OF THE UNITED STATES 
JULY 21, 2021 
Received; read twice and referred to the Committee on Homeland Security and 
Governmental Affairs 
AN ACT 
To amend the Homeland Security Act of 2002 to establish 
in the Cybersecurity and Infrastructure Security Agency 
the National Cyber Exercise Program, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS
HR 3223 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘CISA Cyber Exercise 
Act’’. 
SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 
‘‘(a) ESTABLISHMENT OF PROGRAM.— 
‘‘(1) IN GENERAL.—There is established in the 
Agency the National Cyber Exercise Program (re-
ferred to in this section as the ‘Exercise Program’) 
to evaluate the National Cyber Incident Response 
Plan, and other related plans and strategies. 
‘‘(2) REQUIREMENTS.— 
‘‘(A) IN GENERAL.—The Exercise Program 
shall be— 
‘‘(i) based on current risk assess-
ments, 
including 
credible 
threats, 
vulnerabilities, and consequences; 
‘‘(ii) designed, to the extent prac-
ticable, to simulate the partial or complete 
incapacitation of a government or critical 
infrastructure network resulting from a 
cyber incident; 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS
HR 3223 RFS
‘‘(iii) designed to provide for the sys-
tematic evaluation of cyber readiness and 
enhance operational understanding of the 
cyber incident response system and rel-
evant information sharing agreements; and 
‘‘(iv) designed to promptly develop 
after-action reports and plans that can 
quickly incorporate lessons learned into fu-
ture operations. 
‘‘(B) MODEL EXERCISE SELECTION.—The 
Exercise Program shall— 
‘‘(i) include a selection of model exer-
cises that government and private entities 
can readily adapt for use; and 
‘‘(ii) aid such governments and pri-
vate entities with the design, implementa-
tion, and evaluation of exercises that— 
‘‘(I) conform to the requirements 
described in subparagraph (A); 
‘‘(II) are consistent with any ap-
plicable national, State, local, or Trib-
al strategy or plan; and 
‘‘(III) 
provide 
for 
systematic 
evaluation of readiness. 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS
HR 3223 RFS
‘‘(3) CONSULTATION.—In carrying out the Ex-
ercise Program, the Director may consult with ap-
propriate representatives from Sector Risk Manage-
ment Agencies, cybersecurity research stakeholders, 
and Sector Coordinating Councils. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) STATE.—The term ‘State’ means any 
State of the United States, the District of Columbia, 
the Commonwealth of Puerto Rico, the Northern 
Mariana Islands, the United States Virgin Islands, 
Guam, American Samoa, and any other territory or 
possession of the United States. 
‘‘(2) PRIVATE ENTITY.—The term ‘private enti-
ty’ has the meaning given such term in section 102 
of the Cybersecurity Information Sharing Act of 
2015 (6 U.S.C. 1501).’’. 
(b) TECHNICAL AMENDMENTS.— 
(1) HOMELAND SECURITY ACT OF 2002.—Sub-
title A of title XXII of the Homeland Security Act 
of 2002 (6 U.S.C. 651 et seq.) is amended— 
(A) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities relat-
ing to .gov internet domain), by amending the 
section enumerator and heading to read as fol-
lows: 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS
HR 3223 RFS
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(B) in the second section 2215 (6 U.S.C. 
665b; relating to the joint cyber planning of-
fice), by amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(C) in the third section 2215 (6 U.S.C. 
665c; relating to the Cybersecurity State Coor-
dinator), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(D) in the fourth section 2215 (6 U.S.C. 
665d; relating to Sector Risk Management 
Agencies), by amending the section enumerator 
and heading to read as follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(E) in section 2216 (6 U.S.C. 665e; relat-
ing to the Cybersecurity Advisory Committee), 
by amending the section enumerator and head-
ing to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 
and 
(F) in section 2217 (6 U.S.C. 665f; relat-
ing to Cybersecurity Education and Training 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS
HR 3223 RFS
Programs), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(2) 
CONSOLIDATED
APPROPRIATIONS
ACT, 
2021.—Paragraph (1) of section 904(b) of division U 
of the Consolidated Appropriations Act, 2021 (Pub-
lic Law 116–260) is amended, in the matter pre-
ceding subparagraph (A), by inserting ‘‘of 2002’’ 
after ‘‘Homeland Security Act’’. 
(c) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Homeland Security Act of 2002 is 
amended by striking the items relating to sections 2214 
through 2217 and inserting the following new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs. 
‘‘Sec. 2220A. National Cyber Exercise Program.’’. 
Passed the House of Representatives July 20, 2021. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
02:20 Jul 22, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3223.RFS
H3223
kjohnson on DSK79L0C42PROD with BILLS