National Cybersecurity Protection Act of 2014

Bill: 113-s-2519
Sponsor: full_name: Sen. Carper, Thomas R. [D-DE]
Introduced: 2014-06-24
Policy area: Government Operations and Politics
Subjects: Computer security and identity theft

Congressional oversight

Department of Homeland Security

Executive agency funding and structure

Government information and archives

Performance measurement
Latest action: action_date: 2014-12-18
text: Became Public Law No: 113-282.

Summaries:
action_date: 2014-06-24
action_desc: Introduced in Senate
text: <p>National Cybersecurity and Communications Integration Center Act of 2014 - Amends the Homeland Security Act of 2002 to authorize an operations center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs with respect to security and resilience.</p> <p>Specifies activities that may be carried out, including: (1) federal civilian information sharing; (2) sharing of cybersecurity threat, vulnerability, impact, and incident information and analysis by and among federal, state, and local government entities and private sector entities; and (3) providing technical assistance and recommendations to federal and non-federal entities.</p> <p>Requires the operations center to be composed of: (1) representatives of federal agencies, including civilian and law enforcement agencies and elements of the intelligence community; and (2) state and local governments and other non-federal entities, including private sector owners and operators of critical information systems.</p> <p>Provides the Under Secretary with discretion as to whether governmental or private entities are included in the operations center or are provided assistance or information.</p>

action_date: 2014-07-31
action_desc: Reported to Senate with amendment(s)
text: <p>National Cybersecurity and Communications Integration Center Act of 2014 - Amends the Homeland Security Act of 2002 to authorize an operations center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs with respect to security and resilience.</p> <p>Specifies activities that may be carried out, including: (1) federal civilian information sharing; (2) sharing of cybersecurity threat, vulnerability, impact, and incident information and analysis by and among federal, state, and local government entities and private sector entities; and (3) providing technical assistance and recommendations to federal and non-federal entities.</p> <p>Requires the operations center to be composed of: (1) representatives of federal agencies, including civilian and law enforcement agencies and elements of the intelligence community; and (2) state and local governments and other non-federal entities, including private sector owners and operators of critical information systems.</p> <p>Provides the Under Secretary with discretion as to whether governmental or private entities are included in the operations center or are provided assistance or information.</p> <p>Prohibits this Act from being construed to grant the DHS Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the enactment of this Act.</p>

action_date: 2014-12-10
action_desc: Passed Senate amended
text: <p>National Cybersecurity Protection Act of 2014 - (Sec. 3) Amends the Homeland Security Act of 2002 to establish a national cybersecurity and communications integration center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs.</p> <p>Requires the center to be the federal civilian interface for sharing cybersecurity risks, incidents, analysis, and warnings for federal and non-federal entities. Directs the center to: (1) enable real-time, integrated, and operational actions across federal and non-federal entities; (2) facilitate cross-sector coordination to address risks and incidents that may be related or could have consequential impacts across multiple sectors; (3) conduct and share analysis; and (4) provide technical assistance, risk management, and security measure recommendations.</p>  <p>Directs the center to ensure: (1) continuous, collaborative, and inclusive coordination across sectors and with sector coordinating councils, information sharing and analysis organizations, and other appropriate non-federal partners; (2) development and use of technology-neutral, real-time mechanisms for sharing information about risks and incidents; and (3) safeguards against unauthorized access. </p> <p>Provides the Under Secretary with unreviewable discretion as to whether governmental or private entities are included in the center or are provided assistance or information. </p> <p>(Sec. 4) Requires the DHS Secretary to submit to Congress recommendations regarding how to expedite implementation of information-sharing agreements for cybersecurity purposes between the center and non-federal entities. </p> <p>(Sec. 5) Directs the Secretary to report annually to Congress concerning: (1) the number of non-federal participants, the length of time taken to resolve requests to participate in the center, and the reasons for any denials of such requests; (2) DHS's information sharing with each critical infrastructure sector; and (3) privacy and civil liberties safeguards. </p> <p>(Sec. 6) Requires a Comptroller General (GAO) report on the effectiveness of the center. </p> <p>(Sec. 7) Directs the Under Secretary to develop, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks to critical infrastructure. </p> <p>Requires the Secretary to make the application process for security clearances relating to a classified national security information program available to sector coordinating councils, sector information sharing and analysis organizations, and owners and operators of critical infrastructure. </p> <p>Directs the Office of Management and Budget (OMB) to ensure that data breach notification policies require affected agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General (DOJ), heads of elements of the intelligence community, or the Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions. </p> <p>Requires OMB to assess agency implementation of data breach notification policies. </p> <p>(Sec. 8) Prohibits this Act from being construed to: (1) grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the enactment of this Act, or (2) require any private entity to request the Secretary's assistance or to implement any recommendation suggested by the Secretary in response to such a request. </p>

action_date: 2014-12-11
action_desc: Passed House without amendment
text: <p><b>(This measure has not been amended since it was passed by the Senate on December 10, 2014. The summary of that version is repeated here.)</b></p> <p>National Cybersecurity Protection Act of 2014 - (Sec. 3) Amends the Homeland Security Act of 2002 to establish a national cybersecurity and communications integration center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs.</p> <p>Requires the center to be the federal civilian interface for sharing cybersecurity risks, incidents, analysis, and warnings for federal and non-federal entities. Directs the center to: (1) enable real-time, integrated, and operational actions across federal and non-federal entities; (2) facilitate cross-sector coordination to address risks and incidents that may be related or could have consequential impacts across multiple sectors; (3) conduct and share analysis; and (4) provide technical assistance, risk management, and security measure recommendations.</p> <p>Directs the center to ensure: (1) continuous, collaborative, and inclusive coordination across sectors and with sector coordinating councils, information sharing and analysis organizations, and other appropriate non-federal partners; (2) development and use of technology-neutral, real-time mechanisms for sharing information about risks and incidents; and (3) safeguards against unauthorized access. </p> <p>Provides the Under Secretary with unreviewable discretion as to whether governmental or private entities are included in the center or are provided assistance or information. </p> <p>(Sec. 4) Requires the DHS Secretary to submit to Congress recommendations regarding how to expedite implementation of information-sharing agreements for cybersecurity purposes between the center and non-federal entities. </p> <p>(Sec. 5) Directs the Secretary to report annually to Congress concerning: (1) the number of non-federal participants, the length of time taken to resolve requests to participate in the center, and the reasons for any denials of such requests; (2) DHS's information sharing with each critical infrastructure sector; and (3) privacy and civil liberties safeguards. </p> <p>(Sec. 6) Requires a Comptroller General (GAO) report on the effectiveness of the center. </p> <p>(Sec. 7) Directs the Under Secretary to develop, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks to critical infrastructure. </p> <p>Requires the Secretary to make the application process for security clearances relating to a classified national security information program available to sector coordinating councils, sector information sharing and analysis organizations, and owners and operators of critical infrastructure. </p> <p>Directs the Office of Management and Budget (OMB) to ensure that data breach notification policies require affected agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General (DOJ), heads of elements of the intelligence community, or the Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions. </p> <p>Requires OMB to assess agency implementation of data breach notification policies. </p> <p>(Sec. 8) Prohibits this Act from being construed to: (1) grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the enactment of this Act, or (2) require any private entity to request the Secretary's assistance or to implement any recommendation suggested by the Secretary in response to such a request. </p>

action_date: 2014-12-18
action_desc: Public Law
text: <p> <b>(This measure has not been amended since it was passed by the Senate on December 10, 2014. The summary of that version is repeated here.)</b></p> <p>National Cybersecurity Protection Act of 2014 - (Sec. 3) Amends the Homeland Security Act of 2002 to establish a national cybersecurity and communications integration center in the Department of Homeland Security (DHS) to carry out the responsibilities of the DHS Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and related DHS programs.</p> <p>Requires the center to be the federal civilian interface for sharing cybersecurity risks, incidents, analysis, and warnings for federal and non-federal entities. Directs the center to: (1) enable real-time, integrated, and operational actions across federal and non-federal entities; (2) facilitate cross-sector coordination to address risks and incidents that may be related or could have consequential impacts across multiple sectors; (3) conduct and share analysis; and (4) provide technical assistance, risk management, and security measure recommendations.</p> <p>Directs the center to ensure: (1) continuous, collaborative, and inclusive coordination across sectors and with sector coordinating councils, information sharing and analysis organizations, and other appropriate non-federal partners; (2) development and use of technology-neutral, real-time mechanisms for sharing information about risks and incidents; and (3) safeguards against unauthorized access. </p> <p>Provides the Under Secretary with unreviewable discretion as to whether governmental or private entities are included in the center or are provided assistance or information. </p> <p>(Sec. 4) Requires the DHS Secretary to submit to Congress recommendations regarding how to expedite implementation of information-sharing agreements for cybersecurity purposes between the center and non-federal entities. </p> <p>(Sec. 5) Directs the Secretary to report annually to Congress concerning: (1) the number of non-federal participants, the length of time taken to resolve requests to participate in the center, and the reasons for any denials of such requests; (2) DHS's information sharing with each critical infrastructure sector; and (3) privacy and civil liberties safeguards. </p> <p>(Sec. 6) Requires a Comptroller General (GAO) report on the effectiveness of the center. </p> <p>(Sec. 7) Directs the Under Secretary to develop, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks to critical infrastructure. </p> <p>Requires the Secretary to make the application process for security clearances relating to a classified national security information program available to sector coordinating councils, sector information sharing and analysis organizations, and owners and operators of critical infrastructure. </p> <p>Directs the Office of Management and Budget (OMB) to ensure that data breach notification policies require affected agencies, after discovering an unauthorized acquisition or access, to notify: (1) Congress within 30 days, and (2) affected individuals as expeditiously as practicable. Allows the Attorney General (DOJ), heads of elements of the intelligence community, or the Secretary to delay notice to affected individuals for purposes of law enforcement investigations, national security, or security remediation actions. </p> <p>Requires OMB to assess agency implementation of data breach notification policies. </p> <p>(Sec. 8) Prohibits this Act from being construed to: (1) grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the enactment of this Act, or (2) require any private entity to request the Secretary's assistance or to implement any recommendation suggested by the Secretary in response to such a request. </p>

tv_txt: II 113th CONGRESS 2d Session S. 2519 IN THE SENATE OF THE UNITED STATES June 24, 2014 Mr. Carper (for himself and Mr. Coburn ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To codify an existing operations center for cybersecurity.

1. Short title This Act may be cited as the National Cybersecurity and Communications Integration Center Act of 2014 . 2. National Cybersecurity and Communications Integration Center (a) In general Subtitle A of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 121 et seq. ) is amended by adding at the end the following: 210G. Operations center (a) Functions There is in the Department an operations center, which may carry out the responsibilities of the Under Secretary appointed under section 103(a)(1)(H) with respect to security and resilience, including by— (1) serving as a Federal civilian information sharing interface for cybersecurity; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government; (3) sharing cybersecurity threat, vulnerability, impact, and incident information and analysis by and among Federal, State, and local government entities and private sector entities; (4) coordinating cybersecurity information sharing throughout the Federal Government; (5) conducting analysis of cybersecurity risks and incidents; (6) upon request, providing timely technical assistance to Federal and non-Federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and remediation; and (7) providing recommendations on security and resilience measures to Federal and non-Federal entities. (b) Composition The operations center shall be composed of— (1) personnel or other representatives of Federal agencies, including civilian and law enforcement agencies and elements of the intelligence community, as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)); and (2) representatives from State and local governments and other non-Federal entities, including— (A) representatives from information sharing and analysis organizations; and (B) private sector owners and operators of critical information systems. (c) Annual report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 , and every year thereafter for 3 years, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the operations center, which shall include— (1) an analysis of the performance of the operations center in carrying out the functions under subsection (a); (2) information on the composition of the center, including— (A) the number of representatives from non-Federal entities that are participating in the operations center, including the number of representatives from States, nonprofit organizations, and private sector entities, respectively; and (B) the number of requests from non-Federal entities to participate in the operations center and the response to such requests, including— (i) the average length of time to fulfill such identified requests by the Federal agency responsible for fulfilling such requests; and (ii) a description of any obstacles or challenges to fulfilling such requests; and (3) the policies and procedures established by the operations center to safeguard privacy and civil liberties. (d) GAO report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 , the Comptroller General of the United States shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the effectiveness of the operations center. (e) No right or benefit The provision of assistance or information to, and inclusion in the operations center of, governmental or private entities under this section shall be at the discretion of the Under Secretary appointed under section 103(a)(1)(H). The provision of certain assistance or information to, or inclusion in the operations center of, one governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity. . (b) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note) is amended by inserting after the item relating to section 210F the following: Sec. 210G. Operations center. .

tv_txt: II Calendar No. 526 113th CONGRESS 2d Session S. 2519 [Report No. 113–240] IN THE SENATE OF THE UNITED STATES June 24, 2014 Mr. Carper (for himself and Mr. Coburn ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs July 31, 2014 Reported by Mr. Carper , with an amendment Insert the part printed in italic A BILL To codify an existing operations center for cybersecurity.

1. Short title This Act may be cited as the National Cybersecurity and Communications Integration Center Act of 2014 . 2. National Cybersecurity and Communications Integration Center (a) In general Subtitle A of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 121 et seq. ) is amended by adding at the end the following: 210G. Operations center (a) Functions There is in the Department an operations center, which may carry out the responsibilities of the Under Secretary appointed under section 103(a)(1)(H) with respect to security and resilience, including by— (1) serving as a Federal civilian information sharing interface for cybersecurity; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government; (3) sharing cybersecurity threat, vulnerability, impact, and incident information and analysis by and among Federal, State, and local government entities and private sector entities; (4) coordinating cybersecurity information sharing throughout the Federal Government; (5) conducting analysis of cybersecurity risks and incidents; (6) upon request, providing timely technical assistance to Federal and non-Federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and remediation; and (7) providing recommendations on security and resilience measures to Federal and non-Federal entities. (b) Composition The operations center shall be composed of— (1) personnel or other representatives of Federal agencies, including civilian and law enforcement agencies and elements of the intelligence community, as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)); and (2) representatives from State and local governments and other non-Federal entities, including— (A) representatives from information sharing and analysis organizations; and (B) private sector owners and operators of critical information systems. (c) Annual report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 , and every year thereafter for 3 years, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the operations center, which shall include— (1) an analysis of the performance of the operations center in carrying out the functions under subsection (a); (2) information on the composition of the center, including— (A) the number of representatives from non-Federal entities that are participating in the operations center, including the number of representatives from States, nonprofit organizations, and private sector entities, respectively; and (B) the number of requests from non-Federal entities to participate in the operations center and the response to such requests, including— (i) the average length of time to fulfill such identified requests by the Federal agency responsible for fulfilling such requests; and (ii) a description of any obstacles or challenges to fulfilling such requests; and (3) the policies and procedures established by the operations center to safeguard privacy and civil liberties. (d) GAO report Not later than 1 year after the date of enactment of the National Cybersecurity and Communications Integration Center Act of 2014 , the Comptroller General of the United States shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the effectiveness of the operations center. (e) No right or benefit The provision of assistance or information to, and inclusion in the operations center of, governmental or private entities under this section shall be at the discretion of the Under Secretary appointed under section 103(a)(1)(H). The provision of certain assistance or information to, or inclusion in the operations center of, one governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity. . (b) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note) is amended by inserting after the item relating to section 210F the following: Sec. 210G. Operations center. . 3. Rule of construction (a) Definition In this section, the term critical infrastructure has the meaning given that term under section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101). (b) Rule of construction Nothing in this Act shall be construed to grant the Secretary of Homeland Security any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this Act.

July 31, 2014 Reported with an amendment

tv_txt: One Hundred Thirteenth Congress of the United States of America 2d Session Begun and held at the City of Washington on Friday, the third day of January, two thousand and fourteen S. 2519 IN THE SENATE OF THE UNITED STATES AN ACT To codify an existing operations center for cybersecurity.

1. Short title This Act may be cited as the National Cybersecurity Protection Act of 2014 . 2. Definitions In this Act— (1) the term Center means the national cybersecurity and communications integration center under section 226 of the Homeland Security Act of 2002, as added by section 3; (2) the term critical infrastructure has the meaning given that term in section 2 of the Homeland Security Act of 2002 ( 6 U.S.C. 101 ); (3) the term cybersecurity risk has the meaning given that term in section 226 of the Homeland Security Act of 2002, as added by section 3; (4) the term information sharing and analysis organization has the meaning given that term in section 212(5) of the Homeland Security Act of 2002 ( 6 U.S.C. 131(5) ); (5) the term information system has the meaning given that term in section 3502(8) of title 44, United States Code; and (6) the term Secretary means the Secretary of Homeland Security. 3. National cybersecurity and communications integration center (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following: 226. National cybersecurity and communications integration center (a) Definitions In this section— (1) the term cybersecurity risk means threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or destruction of information or information systems, including such related consequences caused by an act of terrorism; (2) the term incident means an occurrence that— (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies; (3) the term information sharing and analysis organization has the meaning given that term in section 212(5); and (4) the term information system has the meaning given that term in section 3502(8) of title 44, United States Code. (b) Center There is in the Department a national cybersecurity and communications integration center (referred to in this section as the Center ) to carry out certain responsibilities of the Under Secretary appointed under section 103(a)(1)(H). (c) Functions The cybersecurity functions of the Center shall include— (1) being a Federal civilian interface for the multi-directional and cross-sector sharing of information related to cybersecurity risks, incidents, analysis, and warnings for Federal and non-Federal entities; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government and non-Federal entities to address cybersecurity risks and incidents to Federal and non-Federal entities; (3) coordinating the sharing of information related to cybersecurity risks and incidents across the Federal Government; (4) facilitating cross-sector coordination to address cybersecurity risks and incidents, including cybersecurity risks and incidents that may be related or could have consequential impacts across multiple sectors; (5) (A) conducting integration and analysis, including cross-sector integration and analysis, of cybersecurity risks and incidents; and (B) sharing the analysis conducted under subparagraph (A) with Federal and non-Federal entities; (6) upon request, providing timely technical assistance, risk management support, and incident response capabilities to Federal and non-Federal entities with respect to cybersecurity risks and incidents, which may include attribution, mitigation, and remediation; and (7) providing information and recommendations on security and resilience measures to Federal and non-Federal entities, including information and recommendations to— (A) facilitate information security; and (B) strengthen information systems against cybersecurity risks and incidents. (d) Composition (1) In general The Center shall be composed of— (A) appropriate representatives of Federal entities, such as— (i) sector-specific agencies; (ii) civilian and law enforcement agencies; and (iii) elements of the intelligence community, as that term is defined under section 3(4) of the National Security Act of 1947 ( 50 U.S.C. 3003(4) ); (B) appropriate representatives of non-Federal entities, such as— (i) State and local governments; (ii) information sharing and analysis organizations; and (iii) owners and operators of critical information systems; (C) components within the Center that carry out cybersecurity and communications activities; (D) a designated Federal official for operational coordination with and across each sector; and (E) other appropriate representatives or entities, as determined by the Secretary. (2) Incidents In the event of an incident, during exigent circumstances the Secretary may grant a Federal or non-Federal entity immediate temporary access to the Center. (e) Principles In carrying out the functions under subsection (c), the Center shall ensure— (1) to the extent practicable, that— (A) timely, actionable, and relevant information related to cybersecurity risks, incidents, and analysis is shared; (B) when appropriate, information related to cybersecurity risks, incidents, and analysis is integrated with other relevant information and tailored to the specific characteristics of a sector; (C) activities are prioritized and conducted based on the level of risk; (D) industry sector-specific, academic, and national laboratory expertise is sought and receives appropriate consideration; (E) continuous, collaborative, and inclusive coordination occurs— (i) across sectors; and (ii) with— (I) sector coordinating councils; (II) information sharing and analysis organizations; and (III) other appropriate non-Federal partners; (F) as appropriate, the Center works to develop and use mechanisms for sharing information related to cybersecurity risks and incidents that are technology-neutral, interoperable, real-time, cost-effective, and resilient; and (G) the Center works with other agencies to reduce unnecessarily duplicative sharing of information related to cybersecurity risks and incidents; (2) that information related to cybersecurity risks and incidents is appropriately safeguarded against unauthorized access; and (3) that activities conducted by the Center comply with all policies, regulations, and laws that protect the privacy and civil liberties of United States persons. (f) No right or benefit (1) In general The provision of assistance or information to, and inclusion in the Center of, governmental or private entities under this section shall be at the sole and unreviewable discretion of the Under Secretary appointed under section 103(a)(1)(H). (2) Certain assistance or information The provision of certain assistance or information to, or inclusion in the Center of, one governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity. . (b) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note) is amended by inserting after the item relating to section 225 the following: Sec. 226. National cybersecurity and communications integration center. . 4. Recommendations regarding new agreements (a) In general Not later than 180 days after the date of enactment of this Act, the Secretary shall submit recommendations on how to expedite the implementation of information-sharing agreements for cybersecurity purposes between the Center and non-Federal entities (referred to in this section as cybersecurity information-sharing agreements ) to— (1) the Committee on Homeland Security and Governmental Affairs and the Committee on the Judiciary of the Senate; and (2) the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives. (b) Contents In submitting recommendations under subsection (a), the Secretary shall— (1) address the development and utilization of a scalable form that retains all privacy and other protections in cybersecurity information-sharing agreements that are in effect as of the date on which the Secretary submits the recommendations, including Cooperative Research and Development Agreements; and (2) include in the recommendations any additional authorities or resources that may be needed to carry out the implementation of any new cybersecurity information-sharing agreements. 5. Annual report Not later than 1 year after the date of enactment of this Act, and every year thereafter for 3 years, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs and the Committee on the Judiciary of the Senate, the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives, and the Comptroller General of the United States a report on the Center, which shall include— (a) information on the Center, including— (1) an assessment of the capability and capacity of the Center to carry out its cybersecurity mission under this Act; (2) the number of representatives from non-Federal entities that are participating in the Center, including the number of representatives from States, nonprofit organizations, and private sector entities, respectively; (3) the number of requests from non-Federal entities to participate in the Center and the response to such requests; (4) the average length of time taken to resolve requests described in paragraph (3); (5) the identification of— (A) any delay in resolving requests described in paragraph (3) involving security clearance processing; and (B) the agency involved with a delay described in subparagraph (A); (6) a description of any other obstacles or challenges to resolving requests described in paragraph (3) and a summary of the reasons for denials of any such requests; (7) the extent to which the Department is engaged in information sharing with each critical infrastructure sector, including— (A) the extent to which each sector has representatives at the Center; (B) the extent to which owners and operators of critical infrastructure in each critical infrastructure sector participate in information sharing at the Center; and (C) the volume and range of activities with respect to which the Secretary has collaborated with the sector coordinating councils and the sector-specific agencies to promote greater engagement with the Center; and (8) the policies and procedures established by the Center to safeguard privacy and civil liberties. 6. GAO report Not later than 2 years after the date of enactment of this Act, the Comptroller General of the United States shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the effectiveness of the Center in carrying out its cybersecurity mission. 7. Cyber incident response plan; clearances; breaches (a) Cyber incident response plan; clearances Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ), as amended by section 3, is amended by adding at the end the following: 227. Cyber incident response plan The Under Secretary appointed under section 103(a)(1)(H) shall, in coordination with appropriate Federal departments and agencies, State and local governments, sector coordinating councils, information sharing and analysis organizations (as defined in section 212(5)), owners and operators of critical infrastructure, and other appropriate entities and individuals, develop, regularly update, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks (as defined in section 226) to critical infrastructure. 228. Clearances The Secretary shall make available the process of application for security clearances under Executive Order 13549 (75 Fed. Reg. 162; relating to a classified national security information program) or any successor Executive Order to appropriate representatives of sector coordinating councils, sector information sharing and analysis organizations (as defined in section 212(5)), owners and operators of critical infrastructure, and any other person that the Secretary determines appropriate. . (b) Breaches (1) Requirements The Director of the Office of Management and Budget shall ensure that data breach notification policies and guidelines are updated periodically and require— (A) except as provided in paragraph (4), notice by the affected agency to each committee of Congress described in section 3544(c)(1) of title 44, United States Code, the Committee on the Judiciary of the Senate, and the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives, which shall— (i) be provided expeditiously and not later than 30 days after the date on which the agency discovered the unauthorized acquisition or access; and (ii) include— (I) information about the breach, including a summary of any information that the agency knows on the date on which notification is provided about how the breach occurred; (II) an estimate of the number of individuals affected by the breach, based on information that the agency knows on the date on which notification is provided, including an assessment of the risk of harm to affected individuals; (III) a description of any circumstances necessitating a delay in providing notice to affected individuals; and (IV) an estimate of whether and when the agency will provide notice to affected individuals; and (B) notice by the affected agency to affected individuals, pursuant to data breach notification policies and guidelines, which shall be provided as expeditiously as practicable and without unreasonable delay after the agency discovers the unauthorized acquisition or access. (2) National security; law enforcement; remediation The Attorney General, the head of an element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)), or the Secretary may delay the notice to affected individuals under paragraph (1)(B) if the notice would disrupt a law enforcement investigation, endanger national security, or hamper security remediation actions. (3) OMB report During the first 2 years beginning after the date of enactment of this Act, the Director of the Office of Management and Budget shall, on an annual basis— (A) assess agency implementation of data breach notification policies and guidelines in aggregate; and (B) include the assessment described in clause (i) in the report required under section 3543(a)(8) of title 44, United States Code. (4) Exception Any element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)) that is required to provide notice under paragraph (1)(A) shall only provide such notice to appropriate committees of Congress. (c) Rule of construction Nothing in the amendment made by subsection (a) or in subsection (b)(1) shall be construed to alter any authority of a Federal agency or department. (d) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note), as amended by section 3, is amended by inserting after the item relating to section 226 the following: Sec. 227. Cyber incident response plan. Sec. 228. Clearances. . 8. Rules of construction (a) Prohibition on new regulatory authority Nothing in this Act or the amendments made by this Act shall be construed to grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this Act. (b) Private entities Nothing in this Act or the amendments made by this Act shall be construed to require any private entity— (1) to request assistance from the Secretary; or (2) that requested such assistance from the Secretary to implement any measure or recommendation suggested by the Secretary.

Speaker of the House of Representatives Vice President of the United States and President of the Senate

tv_txt: 113th CONGRESS 2d Session S. 2519 IN THE SENATE OF THE UNITED STATES AN ACT To codify an existing operations center for cybersecurity.

1. Short title This Act may be cited as the National Cybersecurity Protection Act of 2014 . 2. Definitions In this Act— (1) the term Center means the national cybersecurity and communications integration center under section 226 of the Homeland Security Act of 2002, as added by section 3; (2) the term critical infrastructure has the meaning given that term in section 2 of the Homeland Security Act of 2002 ( 6 U.S.C. 101 ); (3) the term cybersecurity risk has the meaning given that term in section 226 of the Homeland Security Act of 2002, as added by section 3; (4) the term information sharing and analysis organization has the meaning given that term in section 212(5) of the Homeland Security Act of 2002 ( 6 U.S.C. 131(5) ); (5) the term information system has the meaning given that term in section 3502(8) of title 44, United States Code; and (6) the term Secretary means the Secretary of Homeland Security. 3. National cybersecurity and communications integration center (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following: 226. National cybersecurity and communications integration center (a) Definitions In this section— (1) the term cybersecurity risk means threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or destruction of information or information systems, including such related consequences caused by an act of terrorism; (2) the term incident means an occurrence that— (A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system; or (B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies; (3) the term information sharing and analysis organization has the meaning given that term in section 212(5); and (4) the term information system has the meaning given that term in section 3502(8) of title 44, United States Code. (b) Center There is in the Department a national cybersecurity and communications integration center (referred to in this section as the Center ) to carry out certain responsibilities of the Under Secretary appointed under section 103(a)(1)(H). (c) Functions The cybersecurity functions of the Center shall include— (1) being a Federal civilian interface for the multi-directional and cross-sector sharing of information related to cybersecurity risks, incidents, analysis, and warnings for Federal and non-Federal entities; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government and non-Federal entities to address cybersecurity risks and incidents to Federal and non-Federal entities; (3) coordinating the sharing of information related to cybersecurity risks and incidents across the Federal Government; (4) facilitating cross-sector coordination to address cybersecurity risks and incidents, including cybersecurity risks and incidents that may be related or could have consequential impacts across multiple sectors; (5) (A) conducting integration and analysis, including cross-sector integration and analysis, of cybersecurity risks and incidents; and (B) sharing the analysis conducted under subparagraph (A) with Federal and non-Federal entities; (6) upon request, providing timely technical assistance, risk management support, and incident response capabilities to Federal and non-Federal entities with respect to cybersecurity risks and incidents, which may include attribution, mitigation, and remediation; and (7) providing information and recommendations on security and resilience measures to Federal and non-Federal entities, including information and recommendations to— (A) facilitate information security; and (B) strengthen information systems against cybersecurity risks and incidents. (d) Composition (1) In general The Center shall be composed of— (A) appropriate representatives of Federal entities, such as— (i) sector-specific agencies; (ii) civilian and law enforcement agencies; and (iii) elements of the intelligence community, as that term is defined under section 3(4) of the National Security Act of 1947 ( 50 U.S.C. 3003(4) ); (B) appropriate representatives of non-Federal entities, such as— (i) State and local governments; (ii) information sharing and analysis organizations; and (iii) owners and operators of critical information systems; (C) components within the Center that carry out cybersecurity and communications activities; (D) a designated Federal official for operational coordination with and across each sector; and (E) other appropriate representatives or entities, as determined by the Secretary. (2) Incidents In the event of an incident, during exigent circumstances the Secretary may grant a Federal or non-Federal entity immediate temporary access to the Center. (e) Principles In carrying out the functions under subsection (c), the Center shall ensure— (1) to the extent practicable, that— (A) timely, actionable, and relevant information related to cybersecurity risks, incidents, and analysis is shared; (B) when appropriate, information related to cybersecurity risks, incidents, and analysis is integrated with other relevant information and tailored to the specific characteristics of a sector; (C) activities are prioritized and conducted based on the level of risk; (D) industry sector-specific, academic, and national laboratory expertise is sought and receives appropriate consideration; (E) continuous, collaborative, and inclusive coordination occurs— (i) across sectors; and (ii) with— (I) sector coordinating councils; (II) information sharing and analysis organizations; and (III) other appropriate non-Federal partners; (F) as appropriate, the Center works to develop and use mechanisms for sharing information related to cybersecurity risks and incidents that are technology-neutral, interoperable, real-time, cost-effective, and resilient; and (G) the Center works with other agencies to reduce unnecessarily duplicative sharing of information related to cybersecurity risks and incidents; (2) that information related to cybersecurity risks and incidents is appropriately safeguarded against unauthorized access; and (3) that activities conducted by the Center comply with all policies, regulations, and laws that protect the privacy and civil liberties of United States persons. (f) No right or benefit (1) In general The provision of assistance or information to, and inclusion in the Center of, governmental or private entities under this section shall be at the sole and unreviewable discretion of the Under Secretary appointed under section 103(a)(1)(H). (2) Certain assistance or information The provision of certain assistance or information to, or inclusion in the Center of, one governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity. . (b) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note) is amended by inserting after the item relating to section 225 the following: Sec. 226. National cybersecurity and communications integration center. . 4. Recommendations regarding new agreements (a) In general Not later than 180 days after the date of enactment of this Act, the Secretary shall submit recommendations on how to expedite the implementation of information-sharing agreements for cybersecurity purposes between the Center and non-Federal entities (referred to in this section as cybersecurity information-sharing agreements ) to— (1) the Committee on Homeland Security and Governmental Affairs and the Committee on the Judiciary of the Senate; and (2) the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives. (b) Contents In submitting recommendations under subsection (a), the Secretary shall— (1) address the development and utilization of a scalable form that retains all privacy and other protections in cybersecurity information-sharing agreements that are in effect as of the date on which the Secretary submits the recommendations, including Cooperative Research and Development Agreements; and (2) include in the recommendations any additional authorities or resources that may be needed to carry out the implementation of any new cybersecurity information-sharing agreements. 5. Annual report Not later than 1 year after the date of enactment of this Act, and every year thereafter for 3 years, the Secretary shall submit to the Committee on Homeland Security and Governmental Affairs and the Committee on the Judiciary of the Senate, the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives, and the Comptroller General of the United States a report on the Center, which shall include— (a) information on the Center, including— (1) an assessment of the capability and capacity of the Center to carry out its cybersecurity mission under this Act; (2) the number of representatives from non-Federal entities that are participating in the Center, including the number of representatives from States, nonprofit organizations, and private sector entities, respectively; (3) the number of requests from non-Federal entities to participate in the Center and the response to such requests; (4) the average length of time taken to resolve requests described in paragraph (3); (5) the identification of— (A) any delay in resolving requests described in paragraph (3) involving security clearance processing; and (B) the agency involved with a delay described in subparagraph (A); (6) a description of any other obstacles or challenges to resolving requests described in paragraph (3) and a summary of the reasons for denials of any such requests; (7) the extent to which the Department is engaged in information sharing with each critical infrastructure sector, including— (A) the extent to which each sector has representatives at the Center; (B) the extent to which owners and operators of critical infrastructure in each critical infrastructure sector participate in information sharing at the Center; and (C) the volume and range of activities with respect to which the Secretary has collaborated with the sector coordinating councils and the sector-specific agencies to promote greater engagement with the Center; and (8) the policies and procedures established by the Center to safeguard privacy and civil liberties. 6. GAO report Not later than 2 years after the date of enactment of this Act, the Comptroller General of the United States shall submit to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Homeland Security of the House of Representatives a report on the effectiveness of the Center in carrying out its cybersecurity mission. 7. Cyber incident response plan; clearances; breaches (a) Cyber incident response plan; clearances Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ), as amended by section 3, is amended by adding at the end the following: 227. Cyber incident response plan The Under Secretary appointed under section 103(a)(1)(H) shall, in coordination with appropriate Federal departments and agencies, State and local governments, sector coordinating councils, information sharing and analysis organizations (as defined in section 212(5)), owners and operators of critical infrastructure, and other appropriate entities and individuals, develop, regularly update, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks (as defined in section 226) to critical infrastructure. 228. Clearances The Secretary shall make available the process of application for security clearances under Executive Order 13549 (75 Fed. Reg. 162; relating to a classified national security information program) or any successor Executive Order to appropriate representatives of sector coordinating councils, sector information sharing and analysis organizations (as defined in section 212(5)), owners and operators of critical infrastructure, and any other person that the Secretary determines appropriate. . (b) Breaches (1) Requirements The Director of the Office of Management and Budget shall ensure that data breach notification policies and guidelines are updated periodically and require— (A) except as provided in paragraph (4), notice by the affected agency to each committee of Congress described in section 3544(c)(1) of title 44, United States Code, the Committee on the Judiciary of the Senate, and the Committee on Homeland Security and the Committee on the Judiciary of the House of Representatives, which shall— (i) be provided expeditiously and not later than 30 days after the date on which the agency discovered the unauthorized acquisition or access; and (ii) include— (I) information about the breach, including a summary of any information that the agency knows on the date on which notification is provided about how the breach occurred; (II) an estimate of the number of individuals affected by the breach, based on information that the agency knows on the date on which notification is provided, including an assessment of the risk of harm to affected individuals; (III) a description of any circumstances necessitating a delay in providing notice to affected individuals; and (IV) an estimate of whether and when the agency will provide notice to affected individuals; and (B) notice by the affected agency to affected individuals, pursuant to data breach notification policies and guidelines, which shall be provided as expeditiously as practicable and without unreasonable delay after the agency discovers the unauthorized acquisition or access. (2) National security; law enforcement; remediation The Attorney General, the head of an element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)), or the Secretary may delay the notice to affected individuals under paragraph (1)(B) if the notice would disrupt a law enforcement investigation, endanger national security, or hamper security remediation actions. (3) OMB report During the first 2 years beginning after the date of enactment of this Act, the Director of the Office of Management and Budget shall, on an annual basis— (A) assess agency implementation of data breach notification policies and guidelines in aggregate; and (B) include the assessment described in clause (i) in the report required under section 3543(a)(8) of title 44, United States Code. (4) Exception Any element of the intelligence community (as such term is defined under section 3(4) of the National Security Act of 1947 (50 U.S.C. 3003(4)) that is required to provide notice under paragraph (1)(A) shall only provide such notice to appropriate committees of Congress. (c) Rule of construction Nothing in the amendment made by subsection (a) or in subsection (b)(1) shall be construed to alter any authority of a Federal agency or department. (d) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 ( 6 U.S.C. 101 note), as amended by section 3, is amended by inserting after the item relating to section 226 the following: Sec. 227. Cyber incident response plan. Sec. 228. Clearances. . 8. Rules of construction (a) Prohibition on new regulatory authority Nothing in this Act or the amendments made by this Act shall be construed to grant the Secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this Act. (b) Private entities Nothing in this Act or the amendments made by this Act shall be construed to require any private entity— (1) to request assistance from the Secretary; or (2) that requested such assistance from the Secretary to implement any measure or recommendation suggested by the Secretary.

Passed the Senate December 10, 2014. Secretary