For more than a decade, various experts have expressed concerns about information-system security—often referred to more generally as cybersecurity —in the United States and abroad. The frequency, impact, and sophistication of attacks on information systems and networks have added urgency to the concerns. Consensus has also grown that the current legislative framework for cybersecurity might need to be revised to address needs for improved cybersecurity, especially given the continuing evolution of the technology and threat environments. This report, with contributions from several CRS staff (see Acknowledgments ), discusses that framework and proposals, starting with the 111 th Congress, to amend more than 30 acts of Congress that are part of or relevant to it. It includes a discussion of legislative issues and activity in the 113 th Congress (see " Selected Issues Addressed in Proposed Legislation "). For a CRS compilation of reports and other resources on cybersecurity, see CRS Report R42507, Cybersecurity: Authoritative Reports and Resources, by Topic , by [author name scrubbed]. For additional selected CRS reports relevant to cybersecurity, see CRS Issues Before Congress: Cybersecurity . The federal role in addressing cybersecurity is complex. It involves both securing federal systems and fulfilling the appropriate federal role in protecting nonfederal systems. There is no overarching framework legislation in place, but many enacted statutes address various aspects of cybersecurity. Some notable provisions are in the following acts: The Counterfeit Access Device and Computer Fraud and Abuse Act of 1984 prohibits various attacks on federal computer systems and on those used by banks and in interstate and foreign commerce. The Electronic Communications Privacy Act of 1986 (ECPA) prohibits unauthorized electronic eavesdropping. The Computer Security Act of 1987 gave the National Institute of Standards and Technology (NIST) responsibility for developing security standards for federal computer systems, except the national security systems that are used for defense and intelligence missions, and gave responsibility to the Secretary of Commerce for promulgating security standards. The Paperwork Reduction Act of 1995 gave the Office of Management and Budget (OMB) responsibility for developing cybersecurity policies. The Clinger-Cohen Act of 1996 made agency heads responsible for ensuring the adequacy of agency information-security policies and procedures, established the chief information officer (CIO) position in agencies, and gave the Secretary of Commerce authority to make promulgated security standards mandatory. The Homeland Security Act of 2002 (HSA) gave the Department of Homeland Security (DHS) some cybersecurity responsibilities in addition to those implied by its general responsibilities for homeland security and critical infrastructure (CI). The Cyber Security Research and Development Act, also enacted in 2002, established research responsibilities in cybersecurity for the National Science Foundation (NSF) and NIST. The E-Government Act of 2002 serves as the primary legislative vehicle to guide federal IT management and initiatives to make information and services available online, and includes various cybersecurity requirements. The Federal Information Security Management Act of 2002 (FISMA) clarified and strengthened NIST and agency cybersecurity responsibilities, established a central federal incident center, and made OMB, rather than the Secretary of Commerce, responsible for promulgating federal cybersecurity standards. More than 40 other laws identified by CRS also have provisions relating to cybersecurity (see Table 2 ). Revisions to many of those laws have been proposed. Many cybersecurity bills and resolutions have been introduced in the last three Congresses, more than 40 each in the 113 th and 112 th Congresses, and more than 60 in the 111 th . Several bills propose revisions to current laws, and several have received significant debate, with four bills specifically focusing on cybersecurity being enacted at the end of the 113 th Congress. Figure 1 provides a simplified depiction of notable federal agency responsibilities relating to cybersecurity. Those responsibilities are complex, and this brief description is necessarily imperfect. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for CI, such as the Department of Transportation for the transportation sector. In general, in addition to the roles of White House entities, DHS is the primary civil-sector cybersecurity agency. NIST, in the Department of Commerce, develops cybersecurity standards and guidelines that are promulgated by OMB, and the Department of Justice is largely responsible for the enforcement of laws relating to cybersecurity. The National Science Foundation (NSF), NIST, and DHS all perform research and development (R&D) related to cybersecurity. The National Security Agency (NSA) is the primary cybersecurity agency in the national security sector, although other agencies also play significant roles. NSA is also a member of the Intelligence Community (IC). The U.S. Cyber Command, part of the U.S. Strategic Command in the Department of Defense (DOD), has primary responsibility for military cyberspace operations. Some notable executive actions under existing law are described below. The George W. Bush Administration established the Comprehensive National Cybersecurity Initiative (CNCI) in 2008 through National Security Presidential Directive 54 / Homeland Security Presidential Directive 23 (NSPD-54/HSPD-23). Those documents are classified, but the Obama Administration released a description of them in March 2010. Goals of the 12 subinitiatives in that description include consolidating external access points to federal systems; deploying intrusion detection and prevention systems across those systems; improving research coordination and prioritization and developing "next-generation" technology, information sharing, and cybersecurity education and awareness; mitigating risks from the global supply chain for information technology; and clarifying the federal role in protecting CI. The Obama Administration has also launched several initiatives. In December 2009, the Administration appointed the first White House Cybersecurity Coordinator, popularly called the "cyber czar," to orchestrate federal cybersecurity activities. However, the coordinator position has no direct control over agency budgets, and some observers argue that operational entities such as the National Security Agency (NSA) have far greater influence and authority. In April 2010, OMB used its authority under FISMA to implement a requirement for automated, continuous monitoring of federal information systems by agencies. In July 2010, OMB delegated operational responsibilities under FISMA to DHS, and in December 2011, it established an interagency program called FedRAMP for cloud-computing cybersecurity. The Administration has also implemented other initiatives and priorities. In April 2011, the White House sent a comprehensive, seven-part legislative proposal ( White House Proposal ) to Congress. Reports of a possible executive order circulated in September 2012. Although some opposition was expressed to such an action, President Obama issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity , in February 2013. It expanded an existing program for information sharing and collaboration between the government and the private sector; established a process for identifying CI with especially high priority for protection; required NIST to lead a public/private effort to develop a framework of cybersecurity standards and best practices for protecting CI; and required regulatory agencies to determine the adequacy of existing requirements and the authority of the agencies to establish new requirements to address cybersecurity risks to CI. A companion presidential policy directive (PPD-21) revised other aspects of policy relating to CI security with the aim of improving integration and efficiency, among other goals. For more information, see CRS Report R42984, The 2013 Cybersecurity Executive Order: Overview and Considerations for Congress , by [author name scrubbed] et al. In general, legislative proposals on cybersecurity in recent Congresses have focused largely on issues in 10 broad areas: protection of CI (especially the electricity grid and the chemical industry), information sharing and cross-sector coordination, responsibilities and authority of federal agencies, reform of FISMA, research and development (R&D), the cybersecurity workforce, data breaches resulting in theft or exposure of personal data such as financial information, cybercrime offenses and penalties, national cybersecurity strategy, and international efforts. For most of those topics, at least some of the bills addressing them have proposed changes to current laws. Despite the lack of enactment of cybersecurity legislation in previous congresses, there appeared to be considerable support in principle for significant legislation to address many of the issues identified above. The House, Senate, and White House have taken somewhat different approaches to such legislation. In recent Congresses, many bills have been introduced that would address cybersecurity issues in one or more of the areas listed above. Several bills passed the House in both the 112 th and 113 th Congresses. None passed the Senate until the end of the 113 th Congress. The two chambers have taken somewhat different approaches, with the House focusing on bills with a narrower focus and the Senate on more comprehensive legislation, especially in the 112 th Congress. The four bills that eventually passed both chambers in the 113 th Congress were relatively narrow, focusing on the protection of federal civilian information systems and on DHS workforce and information-sharing activities. In the House of Representatives, in October 2011, a 12-Member House Republican Cybersecurity Task Force, which had been formed by Speaker Boehner in June, released a series of recommendations ( Task Force Report ) to be used by House committees in developing cybersecurity legislation. Subsequently, several House bills have been considered that would address several of the issues raised and recommendations made by the Task Force Report. Four cybersecurity bills passed the House the week of April 23, 2012: Cybersecurity Enhancement Act of 2011 ( H.R. 2096 ), which addressed federal cybersecurity R&D and the development of technical standards; Cyber Intelligence Sharing and Protection Act ( H.R. 3523 ), which focused on information sharing and coordination, including sharing of classified information; Advancing America's Networking and Information Technology Research and Development Act of 2012 ( H.R. 3834 ), which addressed R&D in networking and information technology, including but not limited to security; and Federal Information Security Amendments Act of 2012 ( H.R. 4257 ), which addressed FISMA reform.