Title: Cyber Security Exchange Act
Policy area: Government Operations and Politics

Summary:
Cyber Security Exchange Act
This bill provides for the establishment of voluntary employee exchange programs relating to cybersecurity positions between the private sector and certain federal agencies.
The Office of the Director of National Intelligence, the Department of Defense, the Department of Homeland Security, the Department of Energy, and the Department of Justice must each submit to Congress a plan for implementing an exchange program at the agency and an evaluation of the benefits.
If an agency determines that it is unable to establish the program, it shall submit a notification describing the legal basis for that inability and any other specific factor that prevents its establishment.

[Congressional Bills 116th Congress]
[From the U.S. Government Publishing Office]
[S. 429 Introduced in Senate (IS)]

<DOC>






116th CONGRESS
  1st Session
                                 S. 429

     To require the establishment of exchange programs relating to 
cybersecurity positions between the private sector and certain Federal 
                   agencies, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                            February 7, 2019

  Ms. Klobuchar (for herself and Mr. Thune) introduced the following 
 bill; which was read twice and referred to the Committee on Homeland 
                   Security and Governmental Affairs

_______________________________________________________________________

                                 A BILL


 
     To require the establishment of exchange programs relating to 
cybersecurity positions between the private sector and certain Federal 
                   agencies, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cyber Security Exchange Act''.

SEC. 2. CYBERSECURITY PROFESSIONAL EXCHANGE PROGRAMS.

    (a) Establishment of Programs.--
            (1) Reports to congress.--
                    (A) In general.--Not later than 180 days after the 
                date of enactment of this Act, the Director of National 
                Intelligence, the Secretary of Defense, the Secretary 
                of Homeland Security, the Secretary of Energy, and the 
                Attorney General shall each submit to the appropriate 
                committees of Congress with respect to that agency head 
                a report that contains--
                            (i) a plan and timeline for implementing 
                        the program described in paragraph (2) at the 
                        agency (or, in the case of the Director of 
                        National Intelligence, at an element of the 
                        intelligence community); and
                            (ii) an evaluation of the benefits to the 
                        agency (or, in the case of the Director of 
                        National Intelligence, to an element of the 
                        intelligence community) from the establishment 
                        of the program described in paragraph (2).
                    (B) Inability to establish program.--If an agency 
                head described in subparagraph (A) determines that the 
                agency head is unable to establish the program required 
                under paragraph (2) at the agency (or, in the case of 
                the Director of National Intelligence, at an element of 
                the intelligence community), the agency head shall 
                submit to Congress a notification that describes--
                            (i) the legal basis for that inability; and
                            (ii) any other specific factor that 
                        prevents the establishment of the program.
            (2) Establishment.--Except in the case of a determination 
        made under paragraph (1)(B), not later than 180 days after the 
        date on which each agency head described in paragraph (1)(A) 
        submits the report required under that paragraph, the agency 
        head shall, after consultation with the Director of the Office 
        of Personnel Management, establish a voluntary exchange program 
        between the applicable agency (or, with respect to the Director 
        of National Intelligence, an element of the intelligence 
        community) and private sector institutions, under which--
                    (A) a covered individual who is an employee of the 
                agency, or of an element of the intelligence community, 
                as applicable--
                            (i) may elect to be temporarily detailed to 
                        a private sector institution that has elected 
                        to receive the covered individual; and
                            (ii) during the period of detail described 
                        in clause (i), shall be considered to be on 
                        detail to a regular work assignment in that 
                        agency or element for all purposes; and
                    (B) a covered individual who is an employee of a 
                private sector institution--
                            (i) may elect to be temporarily detailed to 
                        the agency or element--
                                    (I) if the agency or element has 
                                elected to receive the covered 
                                individual; and
                                    (II) for a period of not shorter 
                                than 90 days and not longer than 2 
                                years; and
                            (ii) during the period of detail described 
                        in clause (i)(II), shall--
                                    (I) receive from the private sector 
                                institution financial compensation, 
                                benefits, and any other type of 
                                compensation or support otherwise 
                                provided by or through the private 
                                sector institution during the course of 
                                the employment of the covered 
                                individual with the private sector 
                                institution; and
                                    (II) be considered to be an 
                                employee of the private sector 
                                institution, and not of the agency or 
                                element, for all purposes.
    (b) Rules of Construction.--Nothing in this Act may be construed 
to--
            (1) modify or otherwise affect any program that is in 
        effect on the day before the date of enactment of this Act; or
            (2) prevent a covered individual who is detailed under 
        subsection (a)(2)(B) from serving as an instructor at an 
        institution of higher education or a research institution 
        during that period of detail.
    (c) Definitions.--In this section--
            (1) the term ``appropriate committees of Congress'' means--
                    (A) with respect to the Director of National 
                Intelligence--
                            (i) the Select Committee on Intelligence of 
                        the Senate; and
                            (ii) the Permanent Select Committee on 
                        Intelligence of the House of Representatives;
                    (B) with respect to the Secretary of Defense--
                            (i) the Committee on Armed Services of the 
                        Senate; and
                            (ii) the Committee on Armed Services of the 
                        House of Representatives;
                    (C) with respect to the Secretary of Homeland 
                Security--
                            (i) the Committee on Homeland Security and 
                        Governmental Affairs of the Senate; and
                            (ii) the Committee on Oversight and Reform 
                        of the House of Representatives;
                    (D) with respect to the Secretary of Energy--
                            (i) the Committee on Armed Services of the 
                        Senate;
                            (ii) the Committee on Energy and Natural 
                        Resources of the Senate;
                            (iii) the Committee on Armed Services of 
                        the House of Representatives; and
                            (iv) the Committee on Energy and Commerce 
                        of the House of Representatives; and
                    (E) with respect to the Attorney General--
                            (i) the Committee on the Judiciary of the 
                        Senate; and
                            (ii) the Committee on the Judiciary of the 
                        House of Representatives;
            (2) the term ``covered individual'' means an individual who 
        has demonstrated expertise and work experience in cybersecurity 
        or a related discipline;
            (3) the term ``cybersecurity or a related discipline''--
                    (A) means a discipline relating to cybersecurity; 
                and
                    (B) includes--
                            (i) a field or discipline relating to--
                                    (I) intrusion detection;
                                    (II) secure software development;
                                    (III) attack mitigation;
                                    (IV) system administration;
                                    (V) network services;
                                    (VI) operating systems;
                                    (VII) software application;
                                    (VIII) enterprise architecture;
                                    (IX) internet services;
                                    (X) data management;
                                    (XI) system analysis; or
                                    (XII) malware analysis; and
                            (ii) any other field or discipline that the 
                        Director of National Intelligence, the 
                        Secretary of Defense, the Secretary of Homeland 
                        Security, the Secretary of Energy, or the 
                        Attorney General determines appropriate for the 
                        purposes of the applicable program established 
                        by that agency head under subsection (a)(2);
            (4) the term ``institution of higher education'' has the 
        meaning given the term in section 101 of the Higher Education 
        Act of 1965 (20 U.S.C. 1001);
            (5) the term ``intelligence community'' has the meaning 
        given the term in section 3 of the National Security Act of 
        1947 (50 U.S.C. 3003); and
            (6) the term ``private sector institution'' includes--
                    (A) a nonpublic or commercial person or business;
                    (B) a research institution;
                    (C) an institution of higher education; and
                    (D) any other institution that the Director of 
                National Intelligence, the Secretary of Defense, the 
                Secretary of Homeland Security, the Secretary of 
                Energy, or the Attorney General determines appropriate 
                for the purposes of the applicable program established 
                by that agency head under subsection (a)(2).
                                 <all>