Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017

Bill: 115-hr-3101
Sponsor: full_name: Rep. Torres, Norma J. [D-CA-35]
Introduced: 2017-06-28
Policy area: Transportation and Public Works
Subjects: Computer security and identity theft

Federal-Indian relations

Government information and archives

Government studies and investigations

Intergovernmental relations

Law enforcement administration and funding

Marine and inland water transportation

Navigation, waterways, harbors

State and local government operations

Transportation safety and security
Latest action: action_date: 2017-10-25
text: Received in the Senate and Read twice and referred to the Committee on Commerce, Science, and Transportation.

Summaries:
action_date: 2017-06-28
action_desc: Introduced in House
text: <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017</strong></p> <p>This bill requires the Department of Homeland Security (DHS) to facilitate increased information sharing about cybersecurity among maritime interests.</p> <p>DHS must:</p> <ul> <li>develop, implement, and&nbsp;continually&nbsp;review&nbsp;a maritime cybersecurity&nbsp;risk assessment model&nbsp;to evaluate current and future cybersecurity risks; </li> <li>seek input from at least one information sharing and analysis organization representing maritime interests in the National Cybersecurity and Communications Integration Center; </li> <li>establish voluntary reporting guidelines for maritime-related cybersecurity risks and incidents; and</li> <li>request that the National Maritime Security Advisory Committee report and make recommendations to DHS about methods to enhance cybersecurity and information sharing among security stakeholders from federal, state, local, and tribal governments; public safety and emergency response agencies; law enforcement and security organizations; maritime industry participants; port owners and operators; and maritime terminal owners and operators.</li></ul> <p>Through the Coast Guard, DHS must also:</p> <ul> <li>direct each Area Maritime Security Advisory Committee to facilitate the sharing of information about, and development of plans to address, port-specific cybersecurity vulnerabilities; and&nbsp; </li> <li>require that area maritime security plans and facility security plans approved after enactment of this Act&nbsp;include mitigation measures to prevent, manage, and respond to cyber threats and vulnerabilities.</li></ul> <p>The bill amends the federal shipping codes to include cybersecurity in facility and vessel vulnerability assessments.</p>

action_date: 2017-10-19
action_desc: Reported to House without amendment, Part I
text: <p>(This measure has not been amended since it was introduced. The summary has been expanded because action occurred on the measure.)</p> <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017</strong></p> <p>(Sec. 2) This bill requires the Department of Homeland Security (DHS) to facilitate increased information sharing about cybersecurity among maritime interests.</p> <p>DHS must:</p> <ul> <li>develop, implement, and&nbsp;continually&nbsp;review&nbsp;a maritime cybersecurity&nbsp;risk assessment model&nbsp;to evaluate current and future cybersecurity risks; </li> <li>seek input from at least one information sharing and analysis organization representing maritime interests in the National Cybersecurity and Communications Integration Center; </li> <li>establish voluntary reporting guidelines for maritime-related cybersecurity risks and incidents; </li> <li>request that the National Maritime Security Advisory Committee report and make recommendations to DHS about methods to enhance cybersecurity and information sharing among security stakeholders from federal, state, local, and tribal governments; public safety and emergency response agencies; law enforcement and security organizations; maritime industry participants; port owners and operators; and maritime terminal owners and operators; and </li> <li>ensure that maritime security risk assessments include cybersecurity risks to ports and the maritime border of the United States.</li></ul> <p>(Sec. 3) Through the Coast Guard, DHS must also:</p> <ul> <li>direct each Area Maritime Security Advisory Committee to facilitate the sharing of information about, and development of plans to address, port-specific cybersecurity vulnerabilities; and&nbsp; </li> <li>require that area maritime security plans and facility security plans approved after enactment of this Act&nbsp;include mitigation measures to prevent, manage, and respond to cyber threats and vulnerabilities.</li></ul> <p>(Sec. 4) The bill amends the federal shipping codes to include cybersecurity in facility and vessel vulnerability assessments.</p> <UL> </UL>

action_date: 2017-10-24
action_desc: Passed House amended
text: <p><strong>Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017</strong></p> <p>(Sec. 2) This bill requires the Department of Homeland Security (DHS) to facilitate increased information sharing about cybersecurity among maritime interests.</p> <p>DHS must:</p><ul> <li>develop, implement, and&nbsp;continually&nbsp;review&nbsp;a maritime cybersecurity&nbsp;risk assessment model&nbsp;to evaluate current and future cybersecurity risks; </li> <li>seek input from at least one information sharing and analysis organization representing maritime interests in the National Cybersecurity and Communications Integration Center; </li> <li>establish voluntary reporting guidelines for maritime-related cybersecurity risks and incidents; and </li> <li>request that the National Maritime Security Advisory Committee report and make recommendations to DHS about methods to enhance cybersecurity and information sharing among security stakeholders from federal, state, local, and tribal governments; public safety and emergency response agencies; law enforcement and security organizations; maritime industry participants; port owners and operators; and maritime terminal owners and operators. </li> </ul> <p>(Sec. 3) Through the Coast Guard, DHS must also:</p> <ul> <li>direct each Area Maritime Security Advisory Committee to facilitate the sharing of information about, and development of plans to address, port-specific cybersecurity vulnerabilities; and&nbsp; </li> <li>require that area maritime transportation&nbsp;security plans and vessel and facility security plans approved after enactment of this Act&nbsp;include mitigation measures to prevent, manage, and respond to cyber threats and vulnerabilities.</li></ul> <p>(Sec. 4) The bill amends the federal shipping codes to include cybersecurity in facility and vessel vulnerability assessments.</p> <ul></ul>

tv_txt: I 115th CONGRESS 1st Session H. R. 3101 IN THE HOUSE OF REPRESENTATIVES June 28, 2017 Mrs. Torres introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Transportation and Infrastructure , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as that term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ); (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )) to the Center (as that term is defined subsection (b) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); relevant public safety and emergency response agencies; relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code, approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

tv_txt: I 115th CONGRESS 1st Session H. R. 3101 IN THE HOUSE OF REPRESENTATIVES AN ACT To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as such term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less often than once every 2 years, the effectiveness of the maritime cybersecurity risk assessment model under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as such term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of section 227 of such Act; (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in section 227 of such Act) to the Center (as such term is defined subsection (b) of such section 227), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents, consistent with the responsibilities of the Center, between relevant Federal agencies and— (A) State, local, and tribal governments; (B) relevant public safety and emergency response agencies; (C) relevant law enforcement and security organizations; (D) maritime industry; (E) port owners and operators; and (F) terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime transportation security plan and any vessel or facility security plan required under section 70103 of title 46, United States Code, approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks (as such term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )). 4. Vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

Passed the House of Representatives October 24, 2017. Karen L. Haas, Clerk.

tv_txt: IIB 115th CONGRESS 1st Session H. R. 3101 IN THE SENATE OF THE UNITED STATES October 25, 2017 Received; read twice and referred to the Committee on Commerce, Science, and Transportation AN ACT To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as such term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less often than once every 2 years, the effectiveness of the maritime cybersecurity risk assessment model under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as such term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of section 227 of such Act; (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in section 227 of such Act) to the Center (as such term is defined subsection (b) of such section 227), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents, consistent with the responsibilities of the Center, between relevant Federal agencies and— (A) State, local, and tribal governments; (B) relevant public safety and emergency response agencies; (C) relevant law enforcement and security organizations; (D) maritime industry; (E) port owners and operators; and (F) terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime transportation security plan and any vessel or facility security plan required under section 70103 of title 46, United States Code, approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks (as such term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )). 4. Vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

Passed the House of Representatives October 24, 2017. Karen L. Haas, Clerk.

tv_txt: IB Union Calendar No. 260 115th CONGRESS 1st Session H. R. 3101 [Report No. 115–356, Part I] IN THE HOUSE OF REPRESENTATIVES June 28, 2017 Mrs. Torres introduced the following bill; which was referred to the Committee on Homeland Security , and in addition to the Committee on Transportation and Infrastructure , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned October 19, 2017 Additional sponsors: Mr. Correa , Ms. Wilson of Florida , Mr. Evans , Mr. Kilmer , Ms. Barragán , and Mr. Poe of Texas October 19, 2017 Reported from the Committee on Homeland Security October 19, 2017 The Committee on Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed A BILL To enhance cybersecurity information sharing and coordination at ports in the United States, and for other purposes.

1. Short title This Act may be cited as the Strengthening Cybersecurity Information Sharing and Coordination in Our Ports Act of 2017 . 2. Improving cybersecurity risk assessments, information sharing, and coordination The Secretary of Homeland Security shall— (1) develop and implement a maritime cybersecurity risk assessment model within 120 days after the date of the enactment of this Act, consistent with the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity and any update to that document pursuant to Public Law 113–274 , to evaluate current and future cybersecurity risks (as that term is defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); (2) evaluate, on a periodic basis but not less than once every two years, the effectiveness of the cybersecurity risk assessment model established under paragraph (1); (3) seek to ensure participation of at least one information sharing and analysis organization (as that term is defined in section 212 of the Homeland Security Act of 2002 ( 6 U.S.C. 131 )) representing the maritime community in the National Cybersecurity and Communications Integration Center, pursuant to subsection (d)(1)(B) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ); (4) establish guidelines for voluntary reporting of maritime-related cybersecurity risks and incidents (as such terms are defined in section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )) to the Center (as that term is defined subsection (b) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )), and other appropriate Federal agencies; and (5) request the National Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to cybersecurity risks and incidents between relevant Federal agencies and State, local, and tribal governments and consistent with the responsibilities of the Center (as that term is defined subsection (b) of section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 )); relevant public safety and emergency response agencies; relevant law enforcement and security organizations; maritime industry; port owners and operators; and terminal owners and operators. 3. Cybersecurity enhancements to maritime security activities The Secretary of Homeland Security, acting through the Commandant of the Coast Guard, shall direct— (1) each Area Maritime Security Advisory Committee established under section 70112 of title 46, United States Code, to facilitate the sharing of cybersecurity risks and incidents to address port-specific cybersecurity risks, which may include the establishment of a working group of members of Area Maritime Security Advisory Committees to address port-specific cybersecurity vulnerabilities; and (2) that any area maritime security plan and facility security plan required under section 70103 of title 46, United States Code, approved after the development of the cybersecurity risk assessment model required by paragraph (1) of section 2 include a mitigation plan to prevent, manage, and respond to cybersecurity risks. 4. vulnerability assessments and security plans Title 46, United States Code, is amended— (1) in section 70102(b)(1)(C), by inserting cybersecurity, after physical security, ; and (2) in section 70103(c)(3)(C), by striking and after the semicolon at the end of clause (iv), by redesignating clause (v) as clause (vi), and by inserting after clause (iv) the following: (v) prevention, management, and response to cybersecurity risks; and .

October 19, 2017 Reported from the Committee on Homeland Security October 19, 2017 The Committee on Transportation and Infrastructure discharged; committed to the Committee of the Whole House on the State of the Union and ordered to be printed