Cyber Preparedness Act of 2016

Bill: 114-hr-5459
Sponsor: full_name: Rep. Donovan, Daniel M., Jr. [R-NY-11]
Introduced: 2016-06-13
Policy area: Science, Technology, Communications
Subjects: Computer security and identity theft

Elections, voting, political campaign regulation

Government information and archives

Homeland security

Intelligence activities, surveillance, classified information

Intergovernmental relations

Public-private cooperation

State and local government operations

Terrorism
Latest action: action_date: 2016-09-27
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2016-06-13
action_desc: Introduced in House
text: <p><b>Cyber Preparedness Act of 2016</b></p> <p>This bill amends the Homeland Security Act of 2002 to expand the responsibilities of the Department of Homeland Security's (DHS's) State, Local, and Regional Fusion Center Initiative to include serving as a point of contact to ensure the dissemination of cybersecurity risk information within the scope of its information sharing environment with state, local, and regional fusion centers. (A fusion center serves as a focal point within the state and local environment for the receipt, analysis, gathering, and sharing of threat-related information between the federal government and state, local, tribal, territorial, and private sector partners.) </p> <p>Fusion center officers or intelligence analysts must assist law enforcement agencies and emergency response providers in using such cybersecurity risk information. </p> <p>DHS's national cybersecurity and communications integration center may include, and must share analysis and best practices with, state and major urban area fusion centers.</p> <p>States, local or tribal governments, or high-risk urban areas receiving grants to protect against terrorism under the Urban Area Security Initiative or the State Homeland Security Grant Program may use the funds to prepare for and respond to cybersecurity risks and incidents.</p> <p>The bill expresses the sense of Congress that DHS should share actionable information related to cyber threats in an unclassified form to facilitate the timely dissemination to state, local, and private sector stakeholders.</p>

action_date: 2016-09-19
action_desc: Reported to House with amendment(s)
text: <p><b>Cyber Preparedness Act of 2016</b></p> <p>(Sec. 2) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security's (DHS's) State, Local, and Regional Fusion Center Initiative to coordinate with the national cybersecurity and communications integration center (NCCIC) to provide state, local, and regional fusion centers with expertise on DHS cybersecurity resources. (A fusion center serves as a focal point within the state and local environment for the receipt, analysis, gathering, and sharing of threat-related information between the federal government and state, local, tribal, territorial, and private sector partners.) </p> <p>DHS must: (1) provide timely access to technical assistance, risk management support, and incident response capabilities for cybersecurity threat indicators, defensive measures, risks, and incidents, including cybersecurity risks to equipment and technology related to the electoral process; (2) review cybersecurity risk information gathered by fusion centers to incorporate into DHS's cybersecurity risk information; and (3) disseminate cybersecurity risk information to fusion centers.</p> <p>Fusion center officers or intelligence analysts may be assigned from the NCCIC. Such officers and analysts must assist fusion centers in using cybersecurity risk information to develop a comprehensive and accurate threat picture.</p> <p>The NCCIC may include, and must share analysis and best practices with, state and major urban area fusion centers.</p> <p>(Sec. 3) States, local or tribal governments, or high-risk urban areas receiving grants to protect against terrorism under the Urban Area Security Initiative or the State Homeland Security Grant Program may use the funds to: (1) prepare for and respond to cybersecurity risks and incidents, and (2) develop statewide cyber threat information analysis and dissemination activities.</p> <p>(Sec. 4) The bill expresses the sense of Congress that DHS should share actionable information related to cyber threats in an unclassified form to facilitate the timely dissemination to state, local, and private sector stakeholders.</p>

action_date: 2016-09-26
action_desc: Passed House amended
text: <p>(This measure has not been amended since it was reported to the House on September 19, 2016. The summary of that version is repeated here.)</p> <p><b>Cyber Preparedness Act of 2016</b></p> <p>(Sec. 2) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security's (DHS's) State, Local, and Regional Fusion Center Initiative to coordinate with the national cybersecurity and communications integration center (NCCIC) to provide state, local, and regional fusion centers with expertise on DHS cybersecurity resources. (A fusion center serves as a focal point within the state and local environment for the receipt, analysis, gathering, and sharing of threat-related information between the federal government and state, local, tribal, territorial, and private sector partners.) </p> <p>DHS must: (1) provide timely access to technical assistance, risk management support, and incident response capabilities for cybersecurity threat indicators, defensive measures, risks, and incidents, including cybersecurity risks to equipment and technology related to the electoral process; (2) review cybersecurity risk information gathered by fusion centers to incorporate into DHS's cybersecurity risk information; and (3) disseminate cybersecurity risk information to fusion centers.</p> <p>Fusion center officers or intelligence analysts may be assigned from the NCCIC. Such officers and analysts must assist fusion centers in using cybersecurity risk information to develop a comprehensive and accurate threat picture.</p> <p>The NCCIC may include, and must share analysis and best practices with, state and major urban area fusion centers.</p> <p>(Sec. 3) States, local or tribal governments, or high-risk urban areas receiving grants to protect against terrorism under the Urban Area Security Initiative or the State Homeland Security Grant Program may use the funds to: (1) prepare for and respond to cybersecurity risks and incidents, and (2) develop statewide cyber threat information analysis and dissemination activities.</p> <p>(Sec. 4) The bill expresses the sense of Congress that DHS should share actionable information related to cyber threats in an unclassified form to facilitate timely dissemination to state, local, and private sector stakeholders.</p>

tv_txt: I 114th CONGRESS 2d Session H. R. 5459 IN THE HOUSE OF REPRESENTATIVES June 13, 2016 Mr. Donovan (for himself, Mr. McCaul , Mr. Ratcliffe , and Mr. Payne ) introduced the following bill; which was referred to the Committee on Homeland Security A BILL To amend the Homeland Security Act of 2002 to enhance preparedness and response capabilities for cyber attacks, bolster the dissemination of homeland security information related to cyber threats, and for other purposes.

1. Short title This Act may be cited as the Cyber Preparedness Act of 2016 . 2. Information sharing Title II of the Homeland Security Act of 2002 is amended— (1) in section 210A ( 6 U.S.C. 124h )— (A) in subsection (b)— (i) in paragraph (6), by inserting cybersecurity risk information, after terrorism information, ; and (ii) in paragraph (8), by inserting cybersecurity risk information, after terrorism information, ; and (B) in subsection (d)(1), by inserting cybersecurity risk information, after terrorism information, ; and (2) in section 227 ( 6 U.S.C. 148 )— (A) in subsection (c)— (i) in paragraph (5)(B), by inserting , including State and major urban area fusion centers, as appropriate before the semicolon at the end; (ii) in paragraph (7)(C), by inserting and best practices after defensive measures ; and (iii) in paragraph (9), by inserting and best practices after defensive measures ; and (B) in subsection (d)(1)(B)(ii), by inserting and State and major urban area fusion centers, as appropriate before the semicolon at the end. 3. Homeland security grants Subsection (a) of section 2008 of the Homeland Security Act of 2002 ( 6 U.S.C. 609 ) is amended— (1) by redesignating paragraphs (4) through (13) as paragraphs (5) through (14), respectively; and (2) by inserting after paragraph (3) the following new paragraph: (4) enhancing cybersecurity, including preparing for and responding to cybersecurity risks and incidents; . 4. Sense of Congress It is the sense of Congress that to facilitate the timely dissemination to appropriate State, local, and private sector stakeholders of homeland security information related to cyber threats, the Secretary of Homeland Security should, to the greatest extent practicable, work to share actionable information related to cyber threats in an unclassified form.

tv_txt: I 114th CONGRESS 2d Session H. R. 5459 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Homeland Security Act of 2002 to enhance preparedness and response capabilities for cyber attacks, bolster the dissemination of homeland security information related to cyber threats, and for other purposes.

1. Short title This Act may be cited as the Cyber Preparedness Act of 2016 . 2. Information sharing Title II of the Homeland Security Act of 2002 is amended— (1) in section 210A ( 6 U.S.C. 124h )— (A) in subsection (b)— (i) in paragraph (10), by inserting before the semicolon at the end the following: , including, in coordination with the national cybersecurity and communications integration center under section 227, accessing timely technical assistance, risk management support, and incident response capabilities with respect to cyber threat indicators, defensive measures, cybersecurity risks, and incidents (as such terms are defined in such section), which may include attribution, mitigation, and remediation, and the provision of information and recommendations on security and resilience, including implications of cybersecurity risks to equipment and technology related to the electoral process ; (ii) in paragraph (11), by striking and after the semicolon; (iii) by redesignating paragraph (12) as paragraph (14); and (iv) by inserting after paragraph (11) the following new paragraphs: (12) review information relating to cybersecurity risks that is gathered by State, local, and regional fusion centers, and incorporate such information, as appropriate, into the Department’s own information relating to cybersecurity risks; (13) ensure the dissemination to State, local, and regional fusion centers of information relating to cybersecurity risks; and ; (B) in subsection (c)(2)— (i) by redesignating subparagraphs (C) through (G) as subparagraphs (D) through (H), respectively; and (ii) by inserting after subparagraph (B) the following new subparagraph: (C) The national cybersecurity and communications integration center under section 227. ; (C) in subsection (d)— (i) in paragraph (3), by striking and after the semicolon; (ii) by redesignating paragraph (4) as paragraph (5); and (iii) by inserting after paragraph (3) the following new paragraph: (4) assist, in coordination with the national cybersecurity and communications integration center under section 227, fusion centers in using information relating to cybersecurity risks to develop a comprehensive and accurate threat picture; and ; and (D) in subsection (j)— (i) by redesignating paragraphs (1) through (5) as paragraphs (2) through (6), respectively; and (ii) by inserting before paragraph (2), as so redesignated, the following new paragraph: (1) the term cybersecurity risk has the meaning given that term in section 227; ; and (2) in section 227 ( 6 U.S.C. 148 )— (A) in subsection (c)— (i) in paragraph (5)(B), by inserting , including State and major urban area fusion centers, as appropriate before the semicolon at the end; (ii) in paragraph (7), in the matter preceding subparagraph (A), by striking information and recommendations each place it appears and inserting information, recommendations, and best practices ; and (iii) in paragraph (9), by inserting and best practices after defensive measures ; and (B) in subsection (d)(1)(B)(ii), by inserting and State and major urban area fusion centers, as appropriate before the semicolon at the end. 3. Homeland security grants Subsection (a) of section 2008 of the Homeland Security Act of 2002 ( 6 U.S.C. 609 ) is amended— (1) by redesignating paragraphs (4) through (14) as paragraphs (5) through (15), respectively; and (2) by inserting after paragraph (3) the following new paragraph: (4) enhancing cybersecurity, including preparing for and responding to cybersecurity risks and incidents and developing State-wide cyber threat information analysis and dissemination activities; . 4. Sense of Congress It is the sense of Congress that to facilitate the timely dissemination to appropriate State, local, and private sector stakeholders of homeland security information related to cyber threats, the Secretary of Homeland Security should, to the greatest extent practicable, work to share actionable information related to cyber threats in an unclassified form.

Passed the House of Representatives September 26, 2016. Karen L. Haas, Clerk.

tv_txt: IIB 114th CONGRESS 2d Session H. R. 5459 IN THE SENATE OF THE UNITED STATES September 27, 2016 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to enhance preparedness and response capabilities for cyber attacks, bolster the dissemination of homeland security information related to cyber threats, and for other purposes.

1. Short title This Act may be cited as the Cyber Preparedness Act of 2016 . 2. Information sharing Title II of the Homeland Security Act of 2002 is amended— (1) in section 210A ( 6 U.S.C. 124h )— (A) in subsection (b)— (i) in paragraph (10), by inserting before the semicolon at the end the following: , including, in coordination with the national cybersecurity and communications integration center under section 227, accessing timely technical assistance, risk management support, and incident response capabilities with respect to cyber threat indicators, defensive measures, cybersecurity risks, and incidents (as such terms are defined in such section), which may include attribution, mitigation, and remediation, and the provision of information and recommendations on security and resilience, including implications of cybersecurity risks to equipment and technology related to the electoral process ; (ii) in paragraph (11), by striking and after the semicolon; (iii) by redesignating paragraph (12) as paragraph (14); and (iv) by inserting after paragraph (11) the following new paragraphs: (12) review information relating to cybersecurity risks that is gathered by State, local, and regional fusion centers, and incorporate such information, as appropriate, into the Department’s own information relating to cybersecurity risks; (13) ensure the dissemination to State, local, and regional fusion centers of information relating to cybersecurity risks; and ; (B) in subsection (c)(2)— (i) by redesignating subparagraphs (C) through (G) as subparagraphs (D) through (H), respectively; and (ii) by inserting after subparagraph (B) the following new subparagraph: (C) The national cybersecurity and communications integration center under section 227. ; (C) in subsection (d)— (i) in paragraph (3), by striking and after the semicolon; (ii) by redesignating paragraph (4) as paragraph (5); and (iii) by inserting after paragraph (3) the following new paragraph: (4) assist, in coordination with the national cybersecurity and communications integration center under section 227, fusion centers in using information relating to cybersecurity risks to develop a comprehensive and accurate threat picture; and ; and (D) in subsection (j)— (i) by redesignating paragraphs (1) through (5) as paragraphs (2) through (6), respectively; and (ii) by inserting before paragraph (2), as so redesignated, the following new paragraph: (1) the term cybersecurity risk has the meaning given that term in section 227; ; and (2) in section 227 ( 6 U.S.C. 148 )— (A) in subsection (c)— (i) in paragraph (5)(B), by inserting , including State and major urban area fusion centers, as appropriate before the semicolon at the end; (ii) in paragraph (7), in the matter preceding subparagraph (A), by striking information and recommendations each place it appears and inserting information, recommendations, and best practices ; and (iii) in paragraph (9), by inserting and best practices after defensive measures ; and (B) in subsection (d)(1)(B)(ii), by inserting and State and major urban area fusion centers, as appropriate before the semicolon at the end. 3. Homeland security grants Subsection (a) of section 2008 of the Homeland Security Act of 2002 ( 6 U.S.C. 609 ) is amended— (1) by redesignating paragraphs (4) through (14) as paragraphs (5) through (15), respectively; and (2) by inserting after paragraph (3) the following new paragraph: (4) enhancing cybersecurity, including preparing for and responding to cybersecurity risks and incidents and developing State-wide cyber threat information analysis and dissemination activities; . 4. Sense of Congress It is the sense of Congress that to facilitate the timely dissemination to appropriate State, local, and private sector stakeholders of homeland security information related to cyber threats, the Secretary of Homeland Security should, to the greatest extent practicable, work to share actionable information related to cyber threats in an unclassified form.

Passed the House of Representatives September 26, 2016. Karen L. Haas, Clerk

tv_txt: IB Union Calendar No. 588 114th CONGRESS 2d Session H. R. 5459 [Report No. 114–756] IN THE HOUSE OF REPRESENTATIVES June 13, 2016 Mr. Donovan (for himself, Mr. McCaul , Mr. Ratcliffe , and Mr. Payne ) introduced the following bill; which was referred to the Committee on Homeland Security September 19, 2016 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on June 13, 2016 A BILL To amend the Homeland Security Act of 2002 to enhance preparedness and response capabilities for cyber attacks, bolster the dissemination of homeland security information related to cyber threats, and for other purposes.

1. Short title This Act may be cited as the Cyber Preparedness Act of 2016 . 2. Information sharing Title II of the Homeland Security Act of 2002 is amended— (1) in section 210A ( 6 U.S.C. 124h )— (A) in subsection (b)— (i) in paragraph (10), by inserting before the semicolon at the end the following: , including, in coordination with the national cybersecurity and communications integration center under section 227, accessing timely technical assistance, risk management support, and incident response capabilities with respect to cyber threat indicators, defensive measures, cybersecurity risks, and incidents (as such terms are defined in such section), which may include attribution, mitigation, and remediation, and the provision of information and recommendations on security and resilience, including implications of cybersecurity risks to equipment and technology related to the electoral process ; (ii) in paragraph (11), by striking and after the semicolon; (iii) by redesignating paragraph (12) as paragraph (14); and (iv) by inserting after paragraph (11) the following new paragraphs: (12) review information relating to cybersecurity risks that is gathered by State, local, and regional fusion centers, and incorporate such information, as appropriate, into the Department’s own information relating to cybersecurity risks; (13) ensure the dissemination to State, local, and regional fusion centers of information relating to cybersecurity risks; and ; (B) in subsection (c)(2)— (i) by redesignating subparagraphs (C) through (G) as subparagraphs (D) through (H), respectively; and (ii) by inserting after subparagraph (B) the following new subparagraph: (C) The national cybersecurity and communications integration center under section 227. ; (C) in subsection (d)— (i) in paragraph (3), by striking and after the semicolon; (ii) by redesignating paragraph (4) as paragraph (5); and (iii) by inserting after paragraph (3) the following new paragraph: (4) assist, in coordination with the national cybersecurity and communications integration center under section 227, fusion centers in using information relating to cybersecurity risks to develop a comprehensive and accurate threat picture; and ; and (D) in subsection (j)— (i) by redesignating paragraphs (1) through (5) as paragraphs (2) through (6), respectively; and (ii) by inserting before paragraph (2), as so redesignated, the following new paragraph: (1) the term cybersecurity risk has the meaning given that term in section 227; ; and (2) in section 227 ( 6 U.S.C. 148 )— (A) in subsection (c)— (i) in paragraph (5)(B), by inserting , including State and major urban area fusion centers, as appropriate before the semicolon at the end; (ii) in paragraph (7), in the matter preceding subparagraph (A), by striking information and recommendations each place it appears and inserting information, recommendations, and best practices ; and (iii) in paragraph (9), by inserting and best practices after defensive measures ; and (B) in subsection (d)(1)(B)(ii), by inserting and State and major urban area fusion centers, as appropriate before the semicolon at the end. 3. Homeland security grants Subsection (a) of section 2008 of the Homeland Security Act of 2002 ( 6 U.S.C. 609 ) is amended— (1) by redesignating paragraphs (4) through (14) as paragraphs (5) through (15), respectively; and (2) by inserting after paragraph (3) the following new paragraph: (4) enhancing cybersecurity, including preparing for and responding to cybersecurity risks and incidents and developing State-wide cyber threat information analysis and dissemination activities; . 4. Sense of Congress It is the sense of Congress that to facilitate the timely dissemination to appropriate State, local, and private sector stakeholders of homeland security information related to cyber threats, the Secretary of Homeland Security should, to the greatest extent practicable, work to share actionable information related to cyber threats in an unclassified form.

September 19, 2016 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed