Department of Homeland Security Cybersecurity Strategy Act of 2015

Bill: 114-hr-3510
Sponsor: full_name: Rep. Richmond, Cedric L. [D-LA-2]
Introduced: 2015-09-15
Policy area: Immigration
Subjects: Armed Forces and National Security

Computer security and identity theft

Congressional oversight

Department of Homeland Security

Executive agency funding and structure

Government studies and investigations

Homeland security

Intergovernmental relations

International organizations and cooperation

Research administration and funding

Research and development

State and local government operations
Latest action: action_date: 2015-10-07
text: Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Summaries:
action_date: 2015-09-15
action_desc: Introduced in House
text: <p><b>Department of Homeland Security Cybersecurity Strategy Act of 2015</b></p> <p>This bill requires the Department of Homeland Security (DHS) to develop a cybersecurity strategy that includes: (1) strategic and operational goals and priorities to execute the full range of DHS's cybersecurity responsibilities; and (2) information on programs, policies, and activities in furtherance of the cybersecurity functions of the national cybersecurity and communications integration center (NCCIC), investigations capabilities, research and development, and engagement with international partners.</p> <p>The strategy must include the roles and responsibilities of DHS components and offices. </p> <p>Congressional authorization is required for any reorganization of such components or offices.</p> <p>For purposes of the NCCIC, the bill redefines &quot;incident&quot; to include occurrences that actually or imminently jeopardize, without lawful authority, an information system, thereby replacing a standard that currently includes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.</p>

action_date: 2015-10-06
action_desc: Reported to House with amendment(s)
text: <p><b>Department of Homeland Security Cybersecurity Strategy Act of 2015</b></p> <p>(Sec. 2) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS) to develop a cybersecurity strategy that includes: (1) strategic and operational goals and priorities to execute the full range of DHS's cybersecurity responsibilities; and (2) information on programs, policies, and activities in furtherance of the cybersecurity functions of the national cybersecurity and communications integration center (NCCIC), investigations capabilities, research and development, and engagement with international partners.</p> <p>In developing the strategy, DHS must consider: (1) the cybersecurity strategy published in November 2011 for governmental and nongovernmental entities involved in homeland security, including federal, state, local, and tribal government officials, private sector representatives, academics, and other policy experts; (2) the Department of Homeland Security Fiscal Years 2014-2018 Strategic Plan; and (3) the most recent Quadrennial Homeland Security Review.</p> <p>The strategy must include the roles and responsibilities of DHS components and offices.</p> <p>DHS must also issue an implementation plan that includes strategic objectives, projected timelines, costs for tasks, and evaluation metrics. </p> <p>DHS must submit the strategy and implementation plan to Congress. Congressional authorization is required for any reorganization of DHS components or offices.</p> <p>The bill prohibits the strategy from being construed as permitting DHS to engage in monitoring, surveillance, exfiltration, or other collection activities to track an individual's personally identifiable information.</p> <p>For purposes of the NCCIC, the bill redefines &quot;incident&quot; to include occurrences that actually or imminently jeopardize, without lawful authority, an information system, thereby replacing a standard that currently includes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.</p>

action_date: 2015-10-06
action_desc: Passed House amended
text: <p><b>Department of Homeland Security Cybersecurity Strategy Act of 2015</b></p> <p>(Sec. 2) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS) to develop a cybersecurity strategy that includes: (1) strategic and operational goals and priorities to execute the full range of DHS's cybersecurity responsibilities; and (2) information on programs, policies, and activities in furtherance of the cybersecurity functions of the national cybersecurity and communications integration center (NCCIC), investigations capabilities, research and development, and engagement with international partners.</p> <p>In developing the strategy, DHS must consider: (1) the cybersecurity strategy published in November 2011 for governmental and nongovernmental entities involved in homeland security, including federal, state, local, and tribal government officials, private sector representatives, academics, and other policy experts; (2) the Department of Homeland Security Fiscal Years 2014-2018 Strategic Plan; and (3) the most recent Quadrennial Homeland Security Review.</p> <p>The strategy must include the roles and responsibilities of DHS components and offices.</p> <p>DHS must also issue an implementation plan that includes strategic objectives, projected timelines, costs for tasks, and evaluation metrics. </p> <p>DHS must submit the strategy and implementation plan to Congress. </p> <p>The bill prohibits the strategy from being construed as permitting DHS to engage in monitoring, surveillance, exfiltration, or other collection activities to track an individual's personally identifiable information.</p> <p>The bill also prohibits DHS from changing the location or reporting structure of the National Protection and Programs Directorate without prior authorization from Congress.</p> <p>For purposes of the NCCIC, the bill redefines "incident" to include occurrences that actually or imminently jeopardize, without lawful authority, an information system, thereby replacing a standard that currently includes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.</p>

tv_txt: I 114th CONGRESS 1st Session H. R. 3510 IN THE HOUSE OF REPRESENTATIVES September 15, 2015 Mr. Richmond introduced the following bill; which was referred to the Committee on Homeland Security A BILL To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes.

1. Short title This Act may be cited as the Department of Homeland Security Cybersecurity Strategy Act of 2015 . 2. Cybersecurity strategy for the Department of Homeland Security (a) In general Subtitle C of title II of the Homeland Security Act ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 230. Cybersecurity strategy (a) In general Not later than 60 days after the date of the enactment of this section, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law. (b) Contents The strategy required under subsection (a) shall include the following: (1) Strategic and operational goals and priorities to successfully execute the full range of the Secretary’s cybersecurity responsibilities. (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following: (A) Cybersecurity functions set forth in the second section 226 (relating to the national cybersecurity and communications integration center). (B) Cybersecurity investigations capabilities. (C) Cybersecurity research and development. (D) Engagement with international cybersecurity partners. (c) Considerations In developing the strategy required under subsection (a), the Secretary shall— (1) consider— (A) the cybersecurity strategy for the Homeland Security Enterprise published by the Secretary in November 2011; (B) the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan; and (C) the most recent Quadrennial Homeland Security Review issued pursuant to section 707; and (2) include information on the roles and responsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy. (d) Implementation plan Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following: (1) Strategic objectives and corresponding tasks. (2) Projected timelines and costs for such tasks. (3) Metrics to evaluate performance of such tasks. (e) Congressional oversight The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate for assessment the following: (1) A copy of the strategy required under subsection (a) upon issuance. (2) A copy of the implementation plan required under subsection (d) upon issuance, together with detailed information on any associated legislative or budgetary proposals. (f) Prohibition on reorganization In the event that the strategy required under subsection (a) or implementation plan required under subsection (d) includes actions to reorganize departmental components or offices, such actions may not be executed without prior congressional authorization. (g) Classified information The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. (h) Definitions In this section: (1) Cybersecurity risk The term cy­ber­se­cu­ri­ty risk has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. (2) Homeland Security Enterprise The term Homeland Security Enterprise means relevant governmental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representatives, academics, and other policy experts. (3) Incident The term incident has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. . (b) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by adding at the end of the list of items for subtitle C of title II the following new item: Sec. 230. Cybersecurity strategy. . (c) Amendment to definition Paragraph (2) of subsection (a) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ; relating to the national cybersecurity and communications integration center) is amended to read as follows: (2) Incident The term incident means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system. .

tv_txt: I 114th CONGRESS 1st Session H. R. 3510 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes.

1. Short title This Act may be cited as the Department of Homeland Security Cybersecurity Strategy Act of 2015 . 2. Cybersecurity strategy for the Department of Homeland Security (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 230. Cybersecurity strategy (a) In general Not later than 60 days after the date of the enactment of this section, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law. (b) Contents The strategy required under subsection (a) shall include the following: (1) Strategic and operational goals and priorities to successfully execute the full range of the Secretary’s cybersecurity responsibilities. (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following: (A) Cybersecurity functions set forth in the second section 226 (relating to the national cybersecurity and communications integration center). (B) Cybersecurity investigations capabilities. (C) Cybersecurity research and development. (D) Engagement with international cybersecurity partners. (c) Considerations In developing the strategy required under subsection (a), the Secretary shall— (1) consider— (A) the cybersecurity strategy for the Homeland Security Enterprise published by the Secretary in November 2011; (B) the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan; and (C) the most recent Quadrennial Homeland Security Review issued pursuant to section 707; and (2) include information on the roles and responsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy. (d) Implementation plan Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following: (1) Strategic objectives and corresponding tasks. (2) Projected timelines and costs for such tasks. (3) Metrics to evaluate performance of such tasks. (e) Congressional oversight The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate for assessment the following: (1) A copy of the strategy required under subsection (a) upon issuance. (2) A copy of the implementation plan required under subsection (d) upon issuance, together with detailed information on any associated legislative or budgetary proposals. (f) Classified information The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. (g) Rule of construction Nothing in this section may be construed as permitting the Department to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information. (h) Definitions In this section: (1) Cybersecurity risk The term cybersecurity risk has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. (2) Homeland Security Enterprise The term Homeland Security Enterprise means relevant governmental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representatives, academics, and other policy experts. (3) Incident The term incident has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. . (b) Prohibition on reorganization The Secretary of Homeland Security may not change the location or reporting structure of the National Protection and Programs Directorate of the Department of Homeland Security, or the location or reporting structure of any office or component of the Directorate, unless the Secretary receives prior authorization from Congress permitting such change. (c) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by adding at the end of the list of items for subtitle C of title II the following new item: Sec. 230. Cybersecurity strategy. . (d) Amendment to definition Paragraph (2) of subsection (a) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ; relating to the national cybersecurity and communications integration center) is amended to read as follows: (2) the term incident means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system; .

Passed the House of Representatives October 6, 2015. Karen L. Haas, Clerk.

tv_txt: IB Union Calendar No. 216 114th CONGRESS 1st Session H. R. 3510 [Report No. 114–284] IN THE HOUSE OF REPRESENTATIVES September 15, 2015 Mr. Richmond introduced the following bill; which was referred to the Committee on Homeland Security October 6, 2015 Additional sponsors: Mr. Ratcliffe , Mr. McCaul , and Mr. Thompson of Mississippi October 6, 2015 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed Strike out all after the enacting clause and insert the part printed in italic For text of introduced bill, see copy of bill as introduced on September 15, 2015 A BILL To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes.

1. Short title This Act may be cited as the Department of Homeland Security Cybersecurity Strategy Act of 2015 . 2. Cybersecurity strategy for the Department of Homeland Security (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 230. Cybersecurity strategy (a) In general Not later than 60 days after the date of the enactment of this section, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law. (b) Contents The strategy required under subsection (a) shall include the following: (1) Strategic and operational goals and priorities to successfully execute the full range of the Secretary’s cybersecurity responsibilities. (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following: (A) Cybersecurity functions set forth in the second section 226 (relating to the national cybersecurity and communications integration center). (B) Cybersecurity investigations capabilities. (C) Cybersecurity research and development. (D) Engagement with international cybersecurity partners. (c) Considerations In developing the strategy required under subsection (a), the Secretary shall— (1) consider— (A) the cybersecurity strategy for the Homeland Security Enterprise published by the Secretary in November 2011; (B) the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan; and (C) the most recent Quadrennial Homeland Security Review issued pursuant to section 707; and (2) include information on the roles and responsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy. (d) Implementation plan Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following: (1) Strategic objectives and corresponding tasks. (2) Projected timelines and costs for such tasks. (3) Metrics to evaluate performance of such tasks. (e) Congressional oversight The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate for assessment the following: (1) A copy of the strategy required under subsection (a) upon issuance. (2) A copy of the implementation plan required under subsection (d) upon issuance, together with detailed information on any associated legislative or budgetary proposals. (f) Prohibition on reorganization In the event that the strategy required under subsection (a) or implementation plan required under subsection (d) includes actions to reorganize departmental components or offices, such actions may not be executed without prior congressional authorization. (g) Classified information The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. (h) Rule of construction Nothing in this section may be construed as permitting the Department to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information. (i) Definitions In this section: (1) Cybersecurity risk The term cybersecurity risk has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. (2) Homeland Security Enterprise The term Homeland Security Enterprise means relevant governmental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representatives, academics, and other policy experts. (3) Incident The term incident has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. . (b) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by adding at the end of the list of items for subtitle C of title II the following new item: Sec. 230. Cybersecurity strategy. . (c) Amendment to definition Paragraph (2) of subsection (a) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ; relating to the national cybersecurity and communications integration center) is amended to read as follows: (2) the term incident means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system; .

October 6, 2015 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed

tv_txt: IIB 114th CONGRESS 1st Session H. R. 3510 IN THE SENATE OF THE UNITED STATES October 7, 2015 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to require the Secretary of Homeland Security to develop a cybersecurity strategy for the Department of Homeland Security, and for other purposes.

1. Short title This Act may be cited as the Department of Homeland Security Cybersecurity Strategy Act of 2015 . 2. Cybersecurity strategy for the Department of Homeland Security (a) In general Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new section: 230. Cybersecurity strategy (a) In general Not later than 60 days after the date of the enactment of this section, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law. (b) Contents The strategy required under subsection (a) shall include the following: (1) Strategic and operational goals and priorities to successfully execute the full range of the Secretary’s cybersecurity responsibilities. (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following: (A) Cybersecurity functions set forth in the second section 226 (relating to the national cybersecurity and communications integration center). (B) Cybersecurity investigations capabilities. (C) Cybersecurity research and development. (D) Engagement with international cybersecurity partners. (c) Considerations In developing the strategy required under subsection (a), the Secretary shall— (1) consider— (A) the cybersecurity strategy for the Homeland Security Enterprise published by the Secretary in November 2011; (B) the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan; and (C) the most recent Quadrennial Homeland Security Review issued pursuant to section 707; and (2) include information on the roles and responsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy. (d) Implementation plan Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following: (1) Strategic objectives and corresponding tasks. (2) Projected timelines and costs for such tasks. (3) Metrics to evaluate performance of such tasks. (e) Congressional oversight The Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate for assessment the following: (1) A copy of the strategy required under subsection (a) upon issuance. (2) A copy of the implementation plan required under subsection (d) upon issuance, together with detailed information on any associated legislative or budgetary proposals. (f) Classified information The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. (g) Rule of construction Nothing in this section may be construed as permitting the Department to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information. (h) Definitions In this section: (1) Cybersecurity risk The term cybersecurity risk has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. (2) Homeland Security Enterprise The term Homeland Security Enterprise means relevant governmental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representatives, academics, and other policy experts. (3) Incident The term incident has the meaning given such term in the second section 226, relating to the national cybersecurity and communications integration center. . (b) Prohibition on reorganization The Secretary of Homeland Security may not change the location or reporting structure of the National Protection and Programs Directorate of the Department of Homeland Security, or the location or reporting structure of any office or component of the Directorate, unless the Secretary receives prior authorization from Congress permitting such change. (c) Clerical amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 is amended by adding at the end of the list of items for subtitle C of title II the following new item: Sec. 230. Cybersecurity strategy. . (d) Amendment to definition Paragraph (2) of subsection (a) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ; relating to the national cybersecurity and communications integration center) is amended to read as follows: (2) the term incident means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system; .

Passed the House of Representatives October 6, 2015. Karen L. Haas, Clerk