ers and operators and State, local, tribal, and territorial 
entities to seek voluntary participation of such agencies 
to determine how the Department of Homeland Security 
can best serve the sector-specific cybersecurity needs to 
manage risk and strengthen the security and resilience of 
the Nation’s critical infrastructure against terrorist at-
tacks that could have a debilitating impact on national se-
curity, economic stability, public health and safety, or any 
combination thereof. 
(b) OBJECTIVES.—In implementing subsection (a), 
the Secretary shall seek to reduce vulnerabilities, minimize 
consequences, identify and disrupt terrorism threats, and 
hasten response and recovery efforts related to impacted 
critical infrastructures. 
(c) INVESTIGATION OF BEST MEANS TO ENGAGE 
OWNERS AND OPERATORS.—The Secretary, in coordina-
tion with the sector-specific agencies, may investigate the 
best means for engaging sector-specific agencies in partici-
pation in a voluntary cybersecurity information sharing, 
emergency support, and emerging threat awareness pro-
gram. 
(d) LISTENING OPPORTUNITY.—The Secretary shall 
establish voluntary opportunities for sector-specific agen-
cies and critical infrastructure owners and operators to in-
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS
form the Department of Homeland Security of sector-spe-
cific challenges to cybersecurity, including regarding— 
(1) what needs they may have or may not have 
regarding critical infrastructure protection; and 
(2) how the Department of Homeland Security 
is or is not helping to meet those needs that have 
been identified, through voluntary participation. 
(e) GAO REPORT.—The Comptroller General of the 
United States shall report to the Congress by not later 
than 6 months after the date of the enactment of this Act 
on the views, experiences, and preferences of critical infra-
structure owners and operators regarding the benefits of 
engaging in voluntary cybersecurity incident reporting, in-
telligence gathering, and technical support resources pro-
vided by the Department of Homeland Security. 
(f) INTERNATIONAL
PARTNERS.—The Secretary 
shall, in consultation with appropriate Federal agencies, 
establish terrorism prevention policy to engage with inter-
national partners to strengthen the security and resilience 
of domestic critical infrastructure and critical infrastruc-
ture located outside of the United States, or in its terri-
torial waters, on which the Nation depends. 
SEC. 3. STRATEGIC IMPERATIVES. 
(a) RESEARCH AND REPORT ON THE MOST EFFI-
CIENT MEANS FOR INFORMATION EXCHANGE BY IDENTI-
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS
FYING BASELINE DATA AND SYSTEMS REQUIREMENTS 
FOR THE FEDERAL GOVERNMENT.—The Secretary shall 
facilitate the timely exchange of terrorism threat and vul-
nerability information as well as information that allows 
for the development of a situational awareness capability 
for Federal civilian agencies during terrorist incidents. 
The goal of such facilitation is to enable efficient informa-
tion exchange through the identification of requirements 
for data and information formats and accessibility, system 
interoperability, and redundant systems and alternate ca-
pabilities should there be a disruption in the primary sys-
tems. 
(b) IMPLEMENTATION
OF
AN INTEGRATION
AND 
ANALYSIS FUNCTION TO INFORM PLANNING AND OPER-
ATIONAL DECISIONS REGARDING THE PROTECTION OF 
CRITICAL
INFRASTRUCTURE
FROM
TERRORISM 
EVENTS.—The Secretary of Homeland Security shall im-
plement an integration and analysis function for critical 
infrastructure that includes operational and strategic 
analysis on terrorism incidents, threats, and emerging 
risks. Such function shall include establishment by the 
Secretary of integration of data sharing capabilities with 
Fusion Centers that accomplish the following: 
(1) Determine the appropriate role that Fusion 
Centers may fill in reporting data related to cyberse-
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS
curity threat or incident information regarding indi-
viduals or service providers with access to or ongoing 
business relationships with critical infrastructure. 
(2) Determine whether or how the National 
Protection and Programs Directorate and the Na-
tional Cybersecurity and Communications Integra-
tion Center may work with Fusion Centers to report 
possible cybersecurity incidents. 
(3) Determine a means for Fusion Centers to 
report availability of critical infrastructure to sup-
port local, State, Federal, tribal, and territorial law 
enforcement and the provision of basic public serv-
ices after disruption events such as electric power 
brownouts and blackouts, accidents that disrupt 
service, and vandalism to or near facilities. 
(4) Categorize and prioritize cybersecurity in-
take risk information based on relevance to critical 
infrastructure owners or operators in the area served 
by the Fusion Center. 
(5) Establish an emerging threat hotline and 
secure online sector-specific cybersecurity incident 
reporting portal by which information may be dis-
seminated through Fusion Centers. 
(6) Develop, keep up to date, and make avail-
able a Federal agency directory of designated offices 
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS
or individuals tasked with responding to, mitigating, 
or assisting in recovery from cybersecurity incidents 
involving critical infrastructure and make the direc-
tory available on a voluntary basis to critical infra-
structure owners and operators. 
(7) Establish a voluntary incident access portal 
with the ability to allow users to determine the 
means, methods, and level of incident reporting that 
is sector-specific and relevant to the recipient as de-
fined and controlled by the recipient. 
(8) Gather voluntary feedback from critical in-
frastructure owners and operators on the value, rel-
evance, and timeliness of the information received, 
which shall include how they believe information and 
the means used to disseminate that information 
might be improved. 
(9) Report to Congress every 2 years on the 
voluntary participation of critical infrastructure own-
ers and operators in the programs established under 
this title. 
(10) Implement a capability to collate, assess, 
and integrate vulnerability and consequence informa-
tion with threat streams and hazard information 
to— 
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS
tems and assets would have a debilitating impact on 
security, national economic security, national public 
health or safety, or any combination of those mat-
ters. 
(2) RESILIENCE.—The term ‘‘resilience’’ means 
the ability to prepare for and adapt to changing con-
ditions and withstand and recover rapidly from dis-
ruptions. The term includes the ability to withstand 
and recover from deliberate attacks, accidents, or 
naturally occurring threats or incidents. 
(3) SECTOR-SPECIFIC AGENCY.—The term ‘‘sec-
tor-specific agency’’ means a Federal department or 
agency designated as a Sector-Specific Agency by 
Presidential Policy Directive 21, relating to Critical 
Infrastructure Security and Resilience. 
(4) SECURITY.—The term ‘‘security’’ means re-
ducing the risk to critical infrastructure by physical 
means or defense cyber measures to intrusions, at-
tacks, or the effects of terrorist intrusions or at-
tacks. 
Æ 
VerDate Sep 11 2014 
22:03 Feb 16, 2017
Jkt 069200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H940.IH
H940
srobinson on DSK5SPTVN1PROD with BILLS