IIB 
★(Star Print)
114TH CONGRESS 
1ST SESSION H. R. 3878 
IN THE SENATE OF THE UNITED STATES 
DECEMBER 17, 2015 
Received; read twice and referred to the Committee on Commerce, Science, 
and Transportation 
AN ACT 
To enhance cybersecurity information sharing and coordina-
tion at ports in the United States, and for other pur-
poses. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
21:45 Feb 01, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3878.RFS
H3878
tkelley on DSK3SPTVN1PROD with BILLS
HR 3878 RFS1S 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening Cyber-
security Information Sharing and Coordination in Our 
Ports Act of 2015’’. 
SEC. 2. IMPROVING CYBERSECURITY RISK ASSESSMENTS, 
INFORMATION 
SHARING, 
AND 
COORDINA-
TION. 
The Secretary of Homeland Security shall— 
(1) develop and implement a maritime cyberse-
curity risk assessment model within 120 days after 
the date of the enactment of this Act, consistent 
with the National Institute of Standards and Tech-
nology Framework for Improving Critical Infrastruc-
ture Cybersecurity and any update to that document 
pursuant to Public Law 113–274, to evaluate cur-
rent and future cybersecurity risks (as that term is 
defined in the second section 226 of the Homeland 
Security Act of 2002 (6 U.S.C. 148)); 
(2) evaluate, on a periodic basis but not less 
than once every two years, the effectiveness of the 
cybersecurity risk assessment model established 
under paragraph (1); 
(3) seek to ensure participation of at least one 
information sharing and analysis organization (as 
that term is defined in section 212 of the Homeland 
Security Act of 2002 (6 U.S.C. 131)) representing 
VerDate Sep 11 2014 
21:45 Feb 01, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3878.RFS
H3878
tkelley on DSK3SPTVN1PROD with BILLS
HR 3878 RFS1S 
the maritime community in the National Cybersecu-
rity and Communications Integration Center, pursu-
ant to subsection (d)(1)(B) of the second section 
226 of the Homeland Security Act of 2002 (6 
U.S.C. 148); 
(4) establish guidelines for voluntary reporting 
of maritime-related cybersecurity risks and incidents 
(as such terms are defined in the second section 226 
of the Homeland Security Act of 2002 (6 U.S.C. 
148)) to the Center (as that term is defined sub-
section (b) of the second section 226 of the Home-
land Security Act of 2002 (6 U.S.C. 148)), and 
other appropriate Federal agencies; and 
(5) request the National Maritime Security Ad-
visory Committee established under section 70112 of 
title 46, United States Code, to report and make 
recommendations to the Secretary on enhancing the 
sharing of information related to cybersecurity risks 
and incidents between relevant Federal agencies and 
State, local, and tribal governments and consistent 
with the responsibilities of the Center (as that term 
is defined subsection (b) of the second section 226 
of the Homeland Security Act of 2002 (6 U.S.C. 
148)); relevant public safety and emergency response 
agencies; relevant law enforcement and security or-
VerDate Sep 11 2014 
21:45 Feb 01, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3878.RFS
H3878
tkelley on DSK3SPTVN1PROD with BILLS
HR 3878 RFS1S 
ganizations; maritime industry; port owners and op-
erators; and terminal owners and operators. 
SEC. 3. CYBERSECURITY ENHANCEMENTS TO MARITIME 
SECURITY ACTIVITIES. 
The Secretary of Homeland Security, acting through 
the Commandant of the Coast Guard, shall direct— 
(1) each Area Maritime Security Advisory Com-
mittee established under section 70112 of title 46, 
United States Code, to facilitate the sharing of cy-
bersecurity risks and incidents to address port-spe-
cific cybersecurity risks, which may include the es-
tablishment of a working group of members of Area 
Maritime Security Advisory Committees to address 
port-specific cybersecurity vulnerabilities; and 
(2) that any area maritime security plan and 
facility security plan required under section 70103 
of title 46, United States Code approved after the 
development of the cybersecurity risk assessment 
model required by paragraph (1) of section 2 include 
a mitigation plan to prevent, manage, and respond 
to cybersecurity risks. 
SEC. 4. VULNERABILITY ASSESSMENTS AND SECURITY 
PLANS. 
Title 46, United States Code, is amended— 
VerDate Sep 11 2014 
21:45 Feb 01, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3878.RFS
H3878
tkelley on DSK3SPTVN1PROD with BILLS
HR 3878 RFS1S 
(1) in section 70102(b)(1)(C), by inserting ‘‘cy-
bersecurity,’’ after ‘‘physical security,’’; and 
(2) in section 70103(c)(3)(C), by striking 
‘‘and’’ after the semicolon at the end of clause (iv), 
by redesignating clause (v) as clause (vi), and by in-
serting after clause (iv) the following: 
‘‘(v) prevention, management, and re-
sponse to cybersecurity risks; and’’. 
Passed the House of Representatives December 16, 
2015. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Sep 11 2014 
21:45 Feb 01, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3878.RFS
H3878
tkelley on DSK3SPTVN1PROD with BILLS