Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015

Bill: 114-hr-3878
Sponsor: full_name: Rep. Torres, Norma J. [D-CA-35]
Introduced: 2015-11-02
Policy area: Transportation and Public Works
Subjects: Computer security and identity theft

Federal-Indian relations

Government information and archives

Government studies and investigations

Intergovernmental relations

Law enforcement administration and funding

Marine and inland water transportation

Navigation, waterways, harbors

State and local government operations

Transportation safety and security
Latest action: action_date: 2016-02-01
text: Star Print ordered on the bill.

Summaries:
action_date: 2015-11-02
action_desc: Introduced in House
text: <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015</strong></p> This bill requires the Department of&nbsp;Homeland Security (DHS) to seek to enhance cybersecurity situational awareness and information sharing between and with maritime security stakeholders from federal, state, local, and tribal governments, public safety and emergency response agencies, law enforcement and security organizations, maritime industry participants, port owners and operators, and maritime terminal owners and operators. <p>DHS must: (1)&nbsp;consult with the Coast Guard to enhance participation by the Maritime Information Sharing and Analysis Center in the National Cybersecurity and Communications Integration Center; and (2) request that the National Maritime Security Advisory Committee report and make recommendations to DHS on methods to enhance cybersecurity and information sharing between such stakeholders, including the establishment of a council to facilitate national-level sharing of security information and coordination of strategies to mitigate cybersecurity risks in the maritime sector.</p> The Coast Guard must direct captains of designated ports to establish a working group of members of Area Maritime Security Advisory Committees to facilitate the sharing of information about, and development of plans to address, port-specific cybersecurity vulnerabilities. <p>The Coast Guard must also require that Area Maritime Security Plans and facility security plans approved after enactment of this Act&nbsp;include mitigation measures to prevent, manage, and respond to cyber threats and vulnerabilities.</p> <p>DHS must ensure that maritime security risk assessments include cybersecurity risks to ports and the maritime border of the United States. </p>

action_date: 2015-12-15
action_desc: Reported to House amended, Part I
text: <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015</strong></p> <p>(Sec. 2) This bill requires the Department of&nbsp;Homeland Security (DHS) to implement, and evaluate at least every two years, a maritime cybersecurity risk assessment model to evaluate current and future cybersecurity risks. The model must be consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any updates pursuant to the Cybersecurity Enhancement Act of 2014.</p> <p>DHS must also: (1) seek to ensure participation of at least one information sharing and analysis organization representing the maritime community in the National Cybersecurity and Communications Integration Center (NCCIC); (2) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents to the NCCIC and other appropriate federal agencies; and (3) request the National Maritime Security Advisory Committee to report and make recommendations to DHS regarding the enhancement of cybersecurity information sharing between relevant federal agencies and state, local, and tribal governments, public safety and emergency response agencies, law enforcement and security organizations, the maritime industry, port owners and operators, and terminal owners and operators.</p> <p>(Sec. 3) The Coast Guard must: (1) direct Area Maritime Security Advisory Committees to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, including, possibly, by establishing a working group of members of such committees to address port-specific cybersecurity vulnerabilities; and (2) require area maritime security plans and facility security plans to include a mitigation plan to prevent, manage, and respond to cybersecurity risks.</p> <p>(Sec. 4) DHS's vulnerability assessments of facilities and vessels that may be involved in a transportation security incident must identify weaknesses in cybersecurity. Owners or operators of such vessels or facilities must include cybersecurity provisions in their security plans for deterring such incidents. </p>

action_date: 2015-12-16
action_desc: Passed House amended
text: <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015</strong></p> <p>(Sec. 2) This bill requires the Department of&nbsp;Homeland Security (DHS) to implement, and evaluate at least every two years, a maritime cybersecurity risk assessment model to evaluate current and future cybersecurity risks. The model must be consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any updates pursuant to the Cybersecurity Enhancement Act of 2014.</p> <p>DHS must also: (1) seek to ensure participation of at least one information sharing and analysis organization representing the maritime community in the National Cybersecurity and Communications Integration Center (NCCIC); (2) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents to the NCCIC and other appropriate federal agencies; and (3) request the National Maritime Security Advisory Committee to report and make recommendations to DHS regarding the enhancement of cybersecurity information sharing between relevant federal agencies and state, local, and tribal governments, public safety and emergency response agencies, law enforcement and security organizations, the maritime industry, port owners and operators, and terminal owners and operators.</p> <p>(Sec. 3) The Coast Guard must: (1) direct Area Maritime Security Advisory Committees to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, including, possibly, by establishing a working group of members of such committees to address port-specific cybersecurity vulnerabilities; and (2) require area maritime security plans and facility security plans to include a mitigation plan to prevent, manage, and respond to cybersecurity risks.</p> <p>(Sec. 4) DHS's vulnerability assessments of facilities and vessels that may be involved in a transportation security incident must identify weaknesses in cybersecurity. Owners or operators of such vessels or facilities must include provisions regarding prevention, management, and response to cybersecurity risks in their security plans for deterring such incidents. </p>

tv_txt: I 114th CONGRESS 1st Session H. R. 3878 IN THE HOUSE OF REPRESENTATIVES November 2, 2015 Mrs. Torres introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Transportation and Infrastructure , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 . 2. Enhancing cybersecurity situational awareness and information sharing Not later than 30 days after the date of the enactment of this Act, the Secretary of Homeland Security shall seek to enhance cybersecurity situational awareness and information sharing between and with maritime security stakeholders, by— (1) directing the Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department of Homeland Security, in consultation with the Commandant of the Coast Guard, to seek to enhance participation by the Maritime Information Sharing and Analysis Center (an independent, non-profit entity sponsored and managed by the Maritime Security Council) in the National Cybersecurity and Communications Integration Center, pursuant to section 226(d)(1)(B) of the Homeland Security Act of 2002 ( 6 U.S.C. 148(d)(1)(B) ); and (2) requesting that the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, report and make recommendations to the Secretary on matters relating to methods to enhance cybersecurity situational awareness and information sharing between and with maritime security stakeholders, including the establishment of a council to facilitate national-level sharing of security information and coordination of strategies to mitigate cybersecurity risks in the maritime sector. 3. Improving cybersecurity information sharing at ports The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, in coordination with the Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and other related programs of the Department of Homeland Security, shall direct each captain of the port designated under section 634 of title 14, United States Code, to establish a working group of members of Area Maritime Security Advisory Committees established under section 70112 of title 46, United States Code, to facilitate the sharing of information about and development of plans to address port-specific cybersecurity vulnerabilities. 4. Area Maritime Security Plans The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall require that any Area Maritime Security Plan and facility security plan required by section 70103 of title 46, United States Code, that is approved after the date of enactment of this Act address cyber threats and vulnerabilities and include mitigation measures to prevent, manage, and respond to such threats and vulnerabilities. 5. Cyber risk assessment The Secretary of Homeland Security shall ensure that any maritime security risk assessment prepared by the Department of Homeland Security after the date of the enactment of this Act shall include cybersecurity risks to ports and the maritime border of the United States. 6. Reports to Congress (a) Status updates The Secretary of Homeland Security shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate— (1) not later than one year after the date of the enactment of this Act and on an annual basis thereafter, information on the actions taken pursuant to this Act and their impact and effectiveness at enhancing cybersecurity situational awareness and information sharing between and with maritime security stakeholders; and (2) not later than 90 days after receiving recommendations from the National Maritime Security Advisory Committee pursuant to section 2, the advisory committee recommendations and any feedback from the Secretary regarding such recommendations. 7. Maritime security stakeholders defined In this Act the term maritime security stakeholders means appropriate Federal, State, local, and tribal governments; public safety and emergency response agencies; law enforcement and security organizations; maritime industry participants; port owners and operators; and maritime terminal owners and operators.

tv_txt: I 114th CONGRESS 1st Session H. R. 3878 IN THE HOUSE OF REPRESENTATIVES AN ACT To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as that term is defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ); (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )) to the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); relevant public safety and emergency response agencies; relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

Passed the House of Representatives December 16, 2015. Karen L. Haas, Clerk.

tv_txt: IB Union Calendar No. 288 114th CONGRESS 1st Session H. R. 3878 [Report No. 114–379, Part I] IN THE HOUSE OF REPRESENTATIVES November 2, 2015 Mrs. Torres introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Transportation and Infrastructure , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned December 15, 2015 Additional sponsors: Mrs. Miller of Michigan , Mr. Richmond , and Mr. Lowenthal December 15, 2015 Reported from the Committee on Homeland Security with an amendment Strike out all after the enacting clause and insert the part printed in italic December 15, 2015 The Committee on Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed For text of introduced bill, see copy of bill as introduced on November 2, 2015 A BILL To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as that term is defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ); (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )) to the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); relevant public safety and emergency response agencies; relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) cybersecurity; and .

December 15, 2015 Reported from the Committee on Homeland Security with an amendment December 15, 2015 The Committee on Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed

tv_txt: IIB 114th CONGRESS 1st Session H. R. 3878 IN THE SENATE OF THE UNITED STATES December 17, 2015 Received; read twice and referred to the Committee on Commerce, Science, and Transportation AN ACT To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2015 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as that term is defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ); (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )) to the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); relevant public safety and emergency response agencies; relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

Passed the House of Representatives December 16, 2015. Karen L. Haas, Clerk