H.R. 3696 — what changed

changed This Act may be cited as the “National Cybersecurity and Critical Infrastructure Protection Act of 2013”.2014”.

Section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101) is amended by adding at the end the following new paragraphs:

“(19) The term critical infrastructure has the meaning given that term in section 1016(e) of the USA Patriot Act (42 U.S.C. 5195c(e)).

“(20) The term critical infrastructure owner means a person that owns critical infrastructure.

“(21) The term critical infrastructure operator means a critical infrastructure owner or other person that manages, runs, or operates, in whole or in part, the day-to-day operations of critical infrastructure.

changed “(22) The term cyber incident means an incident resulting in, incident, or an attempt to cause an incident incident, that, if successful, would—

changed “(A) jeopardize or imminently jeopardize, without lawful authority, the security, integrity, confidentiality, or availability of an information system or network of information systems or any information stored on, processed on, or transiting such a system;system or network;

changed “(B) constitute a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies related to an information such a system or network of information systems, network, or an act of terrorism against an information such a system or network of information systems; network; or

changed “(C) result in the denial of access to or degradation, disruption, or destruction of an information such a system or network of information systems, network, or the defeat of an operations control or technical control essential to the security or operation of an information such a system or network of information systems.network.

changed “(23) The term cybersecurity provider “cybersecurity mission” means a non-Federal entity activities that provides goods or services intended encompass the full range of threat reduction, vulnerability reduction, deterrence, incident response, resiliency, and recovery activities to be used for cybersecurity purposes.foster the security and stability of cyberspace.

changed “(24) The term cybersecurity purpose means the purpose of ensuring the security, integrity, confidentiality, or availability of, or safeguarding, an information system or network of information systems, including protecting an information such a system or network of information systems, network, or data residing on an information such a system or network of information systems, network, including protection of an information such a system or network of information systems, network, from—

changed “(A) a vulnerability of an information such a system or network of information systems;network;

changed “(B) a threat to the security, integrity, confidentiality, or availability of an information such a system or network of information systems, network, or any information stored on, processed on, or transiting such a system or network;

changed “(C) efforts to deny access to or degrade, disrupt, or destroy an information such a system or network of information systems; network; or

changed “(D) efforts to gain unauthorized access to an information such a system or network of information systems, network, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting such a system or network.

changed “(25) The term cybersecurity system cyber threat means a system designed any action that may result in unauthorized access to, exfiltration of, manipulation of, harm of, or employed impairment to ensure the security, integrity, confidentiality, or availability of, or safeguard, of an information system or network of information systems, including protecting or information that is stored on, processed by, or transiting such a system or network from—network.

changed “(A) a vulnerability of an “(26) The term cyber threat information system or network of means information systems;directly pertaining to—

removed “(B) a threat to the security, integrity, confidentiality, or availability of an information system or network of information systems or any information stored on, processed on, or transiting such a system or network;

removed “(C) efforts to deny access to or degrade, disrupt, or destroy an information system or network of information systems of a private entity; or

removed “(D) efforts to gain unauthorized access to an information system or network of information systems, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting such a system or network.

removed “(26) The term cyber threat means any action that may result in unauthorized access to, exfiltration of, manipulation of, harm of, or impairment to the security, integrity, confidentiality, or availability of an information system or network of information systems, or information that is stored on, processed by, or transiting an information system or network of information systems.

removed “(27) The term cyber threat information means information directly pertaining to—

“(A) a vulnerability of an information system or network of information systems of a government or private entity;

added “(B) a threat to the security, integrity, confidentiality, or availability of such a system or network of a government or private entity, or any information stored on, processed on, or transiting such a system or network;

added “(C) efforts to deny access to or degrade, disrupt, or destroy such a system or network of a government or private entity;

added “(D) efforts to gain unauthorized access to such a system or network, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting such a system or network; or

removed “(B) a threat to the security, integrity, confidentiality, or availability of an information system or network of information systems of a government or private entity or any information stored on, processed on, or transiting such a system or network;

removed “(C) efforts to deny access to or degrade, disrupt, or destroy an information system or network of information systems of a government or private entity;

removed “(D) efforts to gain unauthorized access to an information system or network of information systems of a government or private entity, including to gain such unauthorized access for the purpose of exfiltrating information stored on, processed on, or transiting such a system or network; or

“(E) an act of terrorism against an information system or network of information systems.

added “(27) The term Federal civilian information systems—

added “(A) means information, information systems, and networks of information systems that are owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including such systems or networks used or operated by another entity on behalf of a Federal agency; but

removed “(28) The term Federal civilian information systems—

removed “(A) means information, information systems, and networks of information systems that are owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems or networks of information systems used or operated by another entity on behalf of a Federal agency; but

“(B) does not include—

“(i) a national security system; or

“(ii) information, information systems, and networks of information systems that are owned, operated, controlled, or licensed solely for use by, or on behalf of, the Department of Defense, a military department, or an element of the intelligence community.

added “(28) The term information security means the protection of information, information systems, and networks of information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

removed “(29) The term information security means the protection of information, information systems, and networks of information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide—

“(A) integrity, including guarding against improper information modification or destruction, including ensuring nonrepudiation and authenticity;

“(B) confidentiality, including preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

“(C) availability, including ensuring timely and reliable access to and use of information.

added “(29) The term information system means the underlying framework and functions used to process, transmit, receive, or store information electronically, including programmable electronic devices, communications networks, and industrial or supervisory control systems and any associated hardware, software, or data.

added “(30) The term private entity means any individual or any private or publically-traded company, public or private utility (including a utility that is a unit of a State or local government, or a political subdivision of a State government), organization, or corporation, including an officer, employee, or agent thereof.

added “(31) The term shared situational awareness means an environment in which cyber threat information is shared in real time between all designated Federal cyber operations centers to provide actionable information about all known cyber threats.”

removed “(30) The term information system means the underlying framework and functions used to process, transmit, receive, or store information electronically, including programmable electronic devices, communications networks, and industrial or supervisory control systems and any associated hardware, software, or data.

removed “(31) The term private entity means any individual or any private or publically-traded company, public or private utility, organization, or corporation, including an officer, employee, or agent thereof.

removed “(32) The term protected private entity means an entity, other than an individual, that enters into a contract with a cybersecurity provider for goods and services to be used for cybersecurity purposes.

removed “(33) The term shared situational awareness means an environment in which cyber threat information is shared in real time between all designated Federal cyber operations centers to provide actionable information about all known cyber threats.”

“227. Protection of critical infrastructure and information sharing

“(a) Protection of critical infrastructure

changed “(1) In general—The Secretary shall coordinate, on an ongoing basis, with Federal, State, and local governments, national laboratories, critical infrastructure owners, critical infrastructure operators, and other cross sector coordinating entities to—

“(A) facilitate a national effort to strengthen and maintain secure, functioning, and resilient critical infrastructure from cyber threats;

“(B) ensure that Department policies and procedures enable critical infrastructure owners and critical infrastructure operators to receive real-time, actionable, and relevant cyber threat information;

“(C) seek industry sector-specific expertise to—

“(i) assist in the development of voluntary security and resiliency strategies; and

“(ii) ensure that the allocation of Federal resources are cost effective and reduce any burden on critical infrastructure owners and critical infrastructure operators;

changed “(D) upon request, request of entities, facilitate and assist risk management efforts of such entities to reduce vulnerabilities, identify and disrupt threats, and minimize consequences to their critical infrastructure;

changed “(E) upon request, request of critical infrastructure owners or critical infrastructure operators, provide education and assistance to critical infrastructure such owners and critical infrastructure operators on how they may use protective measures and countermeasures to strengthen the security and resilience of the Nation’s critical infrastructure; and

“(F) coordinate a research and development strategy to facilitate and promote advancements and innovation in cybersecurity technologies to protect critical infrastructure.

“(2) Additional responsibilities—The Secretary shall—

changed “(A) manage Federal efforts to secure, protect, and ensure the resiliency of Federal civilian information systems, systems using a risk-based and performance-based approach, and, upon request, support request of critical infrastructure owners’ and owners or critical infrastructure operators, support such owners’ and operators’ efforts to secure, protect, and ensure the resiliency of critical infrastructure from cyber threats;

“(B) direct an entity within the Department to serve as a Federal civilian entity by and among Federal, State, and local governments, private entities, and critical infrastructure sectors to provide multi-directional sharing of real-time, actionable, and relevant cyber threat information;

changed “(C) build upon existing mechanisms to promote a national awareness effort to educate the general public on the importance of securing information systems;

changed “(D) upon request, request of Federal, State, and local government entities and private entities, facilitate expeditious cyber incident response and recovery assistance, and provide analysis and warnings related to threats to and vulnerabilities of critical information systems, crisis and consequence management support, and other remote or on-site technical assistance with the heads of other appropriate Federal agencies to Federal, State, and local government entities and private entities for cyber incidents affecting critical infrastructure; andinfrastructure;

changed “(E) engage with international partners to strengthen the security and resilience of domestic critical infrastructure and critical infrastructure located outside of the United States upon which the United States depends.depends; and

added “(F) conduct outreach to educational institutions, including historically black colleges and universities, Hispanic serving institutions, Native American colleges, and institutions serving persons with disabilities, to encourage such institutions to promote cybersecurity awareness.

“(3) Rule of construction—Nothing in this section may be construed to require any private entity to request assistance from the Secretary, or require any private entity requesting such assistance to implement any measure or recommendation suggested by the Secretary.

“(b) Critical infrastructure sectors—The Secretary, in collaboration with the heads of other appropriate Federal agencies, shall designate critical infrastructure sectors (that may include subdivisions of sectors within a sector as the Secretary may determine appropriate). The critical infrastructure sectors designated under this subsection may include the following:

“(1) Chemical.

“(2) Commercial facilities.

“(3) Communications.

“(4) Critical manufacturing.

“(5) Dams.

“(6) Defense Industrial Base.

“(7) Emergency services.

“(8) Energy.

“(9) Financial services.

“(10) Food and agriculture.

“(11) Government facilities.

“(12) Healthcare and public health.

“(13) Information technology.

“(14) Nuclear reactors, materials, and waste.

“(15) Transportation systems.

“(16) Water and wastewater systems.

“(17) Such other sectors as the Secretary determines appropriate.

“(c) Sector specific agencies—The Secretary, in collaboration with the relevant critical infrastructure sector and the heads of other appropriate Federal agencies, shall recognize the Federal agency designated as of November 1, 2013, as the Sector Specific Agency for each critical infrastructure sector designated under subsection (b). If the designated Sector Specific Agency for a particular critical infrastructure sector is the Department, for the purposes of this section, the Secretary shall carry out this section. The Secretary, in coordination with the heads of each such Sector Specific Agency shall—

“(1) support the security and resilience activities of the relevant critical infrastructure sector in accordance with this subtitle; and

“(2) provide institutional knowledge and specialized expertise to the relevant critical infrastructure sector.

“(d) Sector coordinating councils

added “(1) Recognition—The Secretary, in collaboration with each critical infrastructure sector and the relevant Sector Specific Agency, shall recognize and partner with the Sector Coordinating Council for each critical infrastructure sector designated under subsection (b) to coordinate with each such sector on security and resilience activities and emergency response and recovery efforts.

removed “(1) Recognition—The Secretary, in collaboration with each critical infrastructure sector and the relevant Sector Specific Agency, shall recognize the Sector Coordinating Council for each critical infrastructure sector designated under subsection (b) to coordinate with each such sector on security and resilience activities and emergency response and recovery efforts.

“(2) Membership

“(A) In general—The Sector Coordinating Council for a critical infrastructure sector designated under subsection (b) shall—

“(i) be comprised exclusively of relevant critical infrastructure owners, critical infrastructure operators, private entities, and representative trade associations for the sector;

“(ii) reflect the unique composition of each sector; and

“(iii) include relevant small, medium, and large critical infrastructure owners, critical infrastructure operators, private entities, and representative trade associations for the sector.

“(B) Prohibition—No government entity with regulating authority shall be a member of the Sector Coordinating Council.

added “(C) Limitation—The Secretary shall have no role in the determination of the membership of a Sector Coordinating Council.

“(3) Roles and responsibilities—The Sector Coordinating Council for a critical infrastructure sector shall—

“(A) serve as a self-governing, self-organized primary policy, planning, and strategic communications entity for coordinating with the Department, the relevant Sector-Specific Agency designated under subsection (c), and the relevant Information Sharing and Analysis Centers under subsection (e) on security and resilience activities and emergency response and recovery efforts;

“(B) establish governance and operating procedures, and designate a chairperson for the sector to carry out the activities described in this subsection;

“(C) coordinate with the Department, the relevant Information Sharing and Analysis Centers under subsection (e), and other Sector Coordinating Councils to update, maintain, and exercise the National Cybersecurity Incident Response Plan in accordance with section 229(b); and

“(D) provide any recommendations to the Department on infrastructure protection technology gaps to help inform research and development efforts at the Department.

“(e) Sector information sharing and analysis centers

“(1) Recognition—The Secretary, in collaboration with the relevant Sector Coordinating Council and the critical infrastructure sector represented by such Council, and in coordination with the relevant Sector Specific Agency, shall recognize at least one Information Sharing and Analysis Center for each critical infrastructure sector designated under subsection (b) for purposes of paragraph (3). No other Information Sharing and Analysis Organizations, including Information Sharing and Analysis Centers, may be precluded from having an information sharing relationship within the National Cybersecurity and Communications Integration Center established pursuant to section 228. Nothing in this subsection or any other provision of this subtitle may be construed to limit, restrict, or condition any private entity or activity utilized by, among, or between private entities.

“(2) Roles and responsibilities—In addition to such other activities as may be authorized by law, at least one Information Sharing and Analysis Center for a critical infrastructure sector shall—

“(A) serve as an information sharing resource for such sector and promote ongoing multi-directional sharing of real-time, relevant, and actionable cyber threat information and analysis by and among such sector, the Department, the relevant Sector Specific Agency, and other critical infrastructure sector Information Sharing and Analysis Centers;

“(B) establish governance and operating procedures to carry out the activities conducted under this subsection;

“(C) serve as an emergency response and recovery operations coordination point for such sector, and upon request, facilitate cyber incident response capabilities in coordination with the Department, the relevant Sector Specific Agency and the relevant Sector Coordinating Council;

“(D) facilitate cross-sector coordination and sharing of cyber threat information to prevent related or consequential impacts to other critical infrastructure sectors;

“(E) coordinate with the Department, the relevant Sector Coordinating Council, the relevant Sector Specific Agency, and other critical infrastructure sector Information Sharing and Analysis Centers on the development, integration, and implementation of procedures to support technology neutral, real-time information sharing capabilities and mechanisms within the National Cybersecurity and Communications Integration Center established pursuant to section 228, including—

added “(i) the establishment of a mechanism to voluntarily report identified vulnerabilities and opportunities for improvement;

removed “(i) the establishment of a mechanism to voluntarily report identified vul­ner­a­bil­i­ties and opportunities for improvement;

“(ii) the establishment of metrics to assess the effectiveness and timeliness of the Department’s and Information Sharing and Analysis Centers’ information sharing capabilities; and

“(iii) the establishment of a mechanism for anonymous suggestions and comments;

“(F) implement an integration and analysis function to inform sector planning, risk mitigation, and operational activities regarding the protection of each critical infrastructure sector from cyber incidents;

“(G) combine consequence, vulnerability, and threat information to share actionable assessments of critical infrastructure sector risks from cyber incidents;

added “(H) coordinate with the Department, the relevant Sector Specific Agency, and the relevant Sector Coordinating Council to update, maintain, and exercise the National Cybersecurity Incident Response Plan in accordance with section 229(b); and

removed “(H) coordinate with the Department, the relevant Sector Specific Agency, and the relevant Sector Coordinating Council to update, maintain, and exercise the National Cy­ber­se­cu­ri­ty Incident Response Plan in accordance with section 229(b); and

“(I) safeguard cyber threat information from unauthorized disclosure.

added “(3) Funding—Of the amounts authorized to be appropriated for each of fiscal years 2014, 2015, and 2016 for the Cybersecurity and Communications Office of the Department, the Secretary is authorized to use not less than $25,000,000 for any such year for operations support at the National Cybersecurity and Communications Integration Center established under section 228(a) of all recognized Information Sharing and Analysis Centers under paragraph (1) of this subsection.

added “(f) Clearances—The Secretary—

added “(1) shall expedite the process of security clearances under Executive Order 13549 or successor orders for appropriate representatives of Sector Coordinating Councils and the critical infrastructure sector Information Sharing and Analysis Centers; and

added “(2) may so expedite such processing to—

added “(A) appropriate personnel of critical infrastructure owners and critical infrastructure operators; and

added “(B) any other person as determined by the Secretary.

removed “(3) Funding—Of the amounts authorized to be appropriated for each of fiscal years 2014, 2015, and 2016 for the Cybersecurity and Communications Office of the Department, the Secretary is authorized to use not less than $25,000,000 for any such year for operations support at the National Cy­ber­se­cu­ri­ty and Communications Integration Center established under section 228(a) of all recognized Information Sharing and Analysis Centers under paragraph (1) of this subsection.

removed “(f) Clearances—The Secretary shall expedite the processing of security clearances under Executive Order 13549 or successor orders to appropriate members of the Sector Coordinating Councils and the critical infrastructure sector Information Sharing and Analysis Centers.

“(g) Public-Private collaboration—The Secretary, in collaboration with the critical infrastructure sectors designated under subsection (b), such sectors’ Sector Specific Agencies recognized under subsection (c), and the Sector Coordinating Councils recognized under subsection (d), shall—

“(1) conduct an analysis and review of the existing public-private partnership model and evaluate how the model between the Department and critical infrastructure owners and critical infrastructure operators can be improved to ensure the Department, critical infrastructure owners, and critical infrastructure operators are equal partners and regularly collaborate on all programs and activities of the Department to protect critical infrastructure;

added “(2) develop and implement procedures to ensure continuous, collaborative, and effective interactions between the Department, critical infrastructure owners, and critical infrastructure operators; and

removed “(2) develop procedures to ensure continuous, collaborative, and effective interactions between the Department, critical infrastructure owners, and critical infrastructure operators; and

“(3) ensure critical infrastructure sectors have a reasonable period for review and comment of all jointly produced materials with the Department.

“(h) Protection of Federal civilian information systems

“(1) In general—The Secretary shall administer the operational information security activities and functions to protect and ensure the resiliency of all Federal civilian information systems.

“(2) Roles and responsibilities—The Secretary, in coordination with the heads of other Federal civilian agencies, shall—

“(A) develop, issue, and oversee the implementation and compliance of all operational information security policies and procedures to protect and ensure the resiliency of Federal civilian information systems;

“(B) administer Federal Government-wide efforts to develop and provide adequate, risk-based, cost-effective, and technology neutral information security capabilities;

added “(C) establish and sustain continuous diagnostics systems for Federal civilian information systems to aggregate data and identify and prioritize the mitigation of cyber vulnerabilities in such systems for cybersecurity purposes;

removed “(C) establish and sustain continuous diagnostics systems for Federal civilian information systems to aggregate data and identify and prioritize the mitigation of cyber vul­ner­a­bil­i­ties in such systems for cybersecurity purposes;

“(D) develop, acquire, and operate an integrated and consolidated system of intrusion detection, analytics, intrusion prevention, and other information sharing and protective capabilities to defend Federal civilian information systems from cyber threats;

“(E) develop and conduct targeted risk assessments and operational evaluations of Federal civilian information systems, in consultation with government and private entities that own and operate such information systems, including threat, vulnerability, and impact assessments and penetration testing;

“(F) develop and provide technical assistance and cyber incident response capabilities to secure and ensure the resilience of Federal civilian information systems;

“(G) review annually the operational information security activities and functions of each of the Federal civilian agencies;

“(H) develop minimum technology neutral operational requirements for network and security operations centers to facilitate the protection of all Federal civilian information systems;

“(I) develop reporting requirements, consistent with relevant law, to ensure the National Cybersecurity and Communications Integration Center established pursuant to section 228 receives all actionable cyber threat information identified on Federal civilian information systems;

“(J) develop technology neutral performance requirements and metrics for the security of Federal civilian information systems;

“(K) implement training requirements that include industry recognized certifications to ensure that Federal civilian agencies are able to fully and timely comply with policies and procedures issued by the Secretary under this subsection; and

“(L) develop training requirements regarding privacy, civil rights, civil liberties, and information oversight for information security employees who operate Federal civilian information systems.

“(3) Use of certain communications

“(A) In general—The Secretary may enter into contracts or other agreements, or otherwise request and obtain, in accordance with applicable law, the assistance of private entities that provide electronic communication services, remote computing services, or cybersecurity services to acquire, intercept, retain, use, and disclose communications and other system traffic, deploy countermeasures, or otherwise operate protective capabilities in accordance with subparagraphs (C), (D), (E), and (F) of paragraph (2). No cause of action shall exist against private entities for assistance provided to the Secretary in accordance with this subsection.

“(B) Rule of construction—Nothing in subparagraph (A) may be construed to—

“(i) require or compel any private entity to enter in a contract or agreement described in such subparagraph; or

“(ii) authorize the Secretary to take any action with respect to any communications or system traffic transiting or residing on any information system or network of information systems other than a Federal civilian information system.

added “(i) Recommendations regarding new agreements—Not later than 180 days after the date of the enactment of this section, the Secretary shall submit to the appropriate congressional committees recommendations on how to expedite the implementation of information sharing agreements for cybersecurity purposes between the Secretary and critical information owners and critical infrastructure operators and other private entities. Such recommendations shall address the development and utilization of a scalable form that retains all privacy and other protections in such agreements in existence as of such date, including Cooperative and Research Development Agreements. Such recommendations should also include any additional authorities or resources that may be needed to carry out the implementation of any such new agreements.

added “(j) Rule of construction—No provision of this title may be construed as modifying, limiting, or otherwise affecting the authority of any other Federal agency under any other provision of law.”

removed “(i) Rule of construction—No provision of this title may be construed as modifying, limiting, or otherwise affecting the authority of any other Federal agency under any other provision of law.”

“228. National Cybersecurity and Communications Integration Center

“(a) Establishment—There is established in the Department the National Cybersecurity and Communications Integration Center (referred to in this section as the Center), which shall be a Federal civilian information sharing interface that provides shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government, and share cyber threat information by and among Federal, State, and local government entities, Information Sharing and Analysis Centers, private entities, and critical infrastructure owners and critical infrastructure operators that have an information sharing relationship with the Center.

“(b) Composition—The Center shall include each of the following entities:

“(1) At least one Information Sharing and Analysis Center established under section 227(e) for each critical infrastructure sector.

“(2) The Multi-State Information Sharing and Analysis Center to collaborate with State and local governments.

“(3) The United States Computer Emergency Readiness Team to coordinate cyber threat information sharing, proactively manage cyber risks to the United States, collaboratively respond to cyber incidents, provide technical assistance to information system owners and operators, and disseminate timely notifications regarding current and potential cyber threats and vulnerabilities.

“(4) The Industrial Control System Cyber Emergency Response Team to coordinate with industrial control systems owners and operators and share industrial control systems-related security incidents and mitigation measures.

“(5) The National Coordinating Center for Telecommunications to coordinate the protection, response, and recovery of national security emergency communications.

“(6) Such other Federal, State, and local government entities, private entities, organizations, or individuals as the Secretary may consider appropriate that agree to be included.

“(c) Cyber incident—In the event of a cyber incident, the Secretary may grant the entities referred to in subsection (a) immediate temporary access to the Center as a situation may warrant.

“(d) Roles and responsibilities—The Center shall—

“(1) promote ongoing multi-directional sharing by and among the entities referred to in subsection (a) of timely and actionable cyber threat information and analysis on a real-time basis that includes emerging trends, evolving threats, incident reports, intelligence information, risk assessments, and best practices;

“(2) coordinate with other Federal agencies to streamline and reduce redundant reporting of cyber threat information;

“(3) provide, upon request, timely technical assistance and crisis management support to Federal, State, and local government entities and private entities that own or operate information systems or networks of information systems to protect from, prevent, mitigate, respond to, and recover from cyber incidents;

“(4) facilitate cross-sector coordination and sharing of cyber threat information to prevent related or consequential impacts to other critical infrastructure sectors;

changed “(5) collaborate and facilitate discussions with the Sector Coordinating Councils, Information Sharing and Analysis Centers, Sector Specific Agencies, and the relevant critical infrastructure sectors on the development and implementation of procedures prioritized Federal response efforts, if necessary, to support technology neutral real-time information sharing capabilities the defense and mechanisms;recovery of critical infrastructure from cyber incidents;

changed “(6) collaborate with the Sector Coordinating Councils, Information Sharing and Analysis Centers, Sector Specific Agencies, and the relevant critical infrastructure sectors to identify requirements for data and information formats and accessibility, system interoperability, and redundant systems and alternative capabilities in on the event development and implementation of a disruption in the primary procedures to support technology neutral real-time information sharing capabilities and mechanisms at the Center;mechanisms;

changed “(7) within collaborate with the scope of Sector Coordinating Councils, Information Sharing and Analysis Centers, Sector Specific Agencies, and the relevant treaties, cooperate with international partners critical infrastructure sectors to share identify requirements for data and information formats and respond to cyber incidents;accessibility, system interoperability, and redundant systems and alternative capabilities in the event of a disruption in the primary information sharing capabilities and mechanisms at the Center;

changed “(8) safeguard sensitive cyber threat within the scope of relevant treaties, cooperate with international partners to share information from unauthorized disclosure;and respond to cyber incidents;

changed “(9) require other Federal civilian agencies to—safeguard sensitive cyber threat information from unauthorized disclosure;

added “(10) require other Federal civilian agencies to—

“(A) send reports and information to the Center about cyber incidents, threats, and vulnerabilities affecting Federal civilian information systems and critical infrastructure systems and, in the event a private vendor product or service of such an agency is so implicated, the Center shall first notify such private vendor of the vulnerability before further disclosing such information;

“(B) provide to the Center cyber incident detection, analysis, mitigation, and response information; and

removed “(C) immediately send and disclose to the Center cyber threat information received by such agencies; and

changed “(10) perform such other duties as the Secretary may require to facilitate a national effort to strengthen and maintain secure, functioning, “(C) immediately send and resilient critical infrastructure from disclose to the Center cyber threats.threat information received by such agencies;

changed “(e) Integration “(11) perform such other duties as the Secretary may require to facilitate a national effort to strengthen and analysis—The Center shall maintain an integration secure, functioning, and analysis function, which shall —resilient critical infrastructure from cyber threats;

added “(12) implement policies and procedures to—

added “(A) provide technical assistance to Federal civilian agencies to prevent and respond to data breaches involving unauthorized acquisition or access of personally identifiable information that occur on Federal civilian information systems;

added “(B) require Federal civilian agencies to notify the Center about data breaches involving unauthorized acquisition or access of personally identifiable information that occur on Federal civilian information systems not later than two business days after the discovery of such a breach; and

added “(C) require Federal civilian agencies to notify all potential victims of a data breach involving unauthorized acquisition or access of personally identifiable information that occur on Federal civilian information systems without unreasonable delay consistent with the needs of law enforcement; and

added “(13) participate in exercises run by the Department’s National Exercise Program, where appropriate.

added “(e) Integration and analysis—The Center, in coordination with the Office of Intelligence and Analysis of the Department, shall maintain an integration and analysis function, which shall —

“(1) integrate and analyze all cyber threat information received from other Federal agencies, State and local governments, Information Sharing and Analysis Centers, private entities, critical infrastructure owners, and critical infrastructure operators, and share relevant information in near real-time;

“(2) on an ongoing basis, assess and evaluate consequence, vulnerability, and threat information to share with the entities referred to in subsection (a) actionable assessments of critical infrastructure sector risks from cyber incidents and to assist critical infrastructure owners and critical infrastructure operators by making recommendations to facilitate continuous improvements to the security and resiliency of the critical infrastructure of the United States;

added “(3) facilitate cross-sector integration, identification, and analysis of key interdependencies to prevent related or consequential impacts to other critical infrastructure sectors;

added “(4) collaborate with the Information Sharing and Analysis Centers to tailor the analysis of information to the specific characteristics and risk to a relevant critical infrastructure sector; and

added “(5) assess and evaluate consequence, vulnerability, and threat information regarding cyber incidents in coordination with the Office of Emergency Communications of the Department to help facilitate continuous improvements to the security and resiliency of public safety communications networks.

added “(f) Report of cyber attacks against Federal Government networks—The Secretary shall submit to the Committee on Homeland Security of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and the Comptroller General of the United States an annual report that summarizes major cyber incidents involving Federal civilian agency information systems and provides aggregate statistics on the number of breaches, the extent of any personally identifiable information that was involved, the volume of data exfiltrated, the consequential impact, and the estimated cost of remedying such breaches.

removed “(3) facilitate cross-sector integration, identification, and analysis of key interdependencies to prevent related or consequential impacts to other critical infrastructure sectors; and

removed “(4) collaborate with the Information Sharing and Analysis Centers to tailor the analysis of information to the specific characteristics and risk to a relevant critical infrastructure sector.

removed “(f) Report of cyber attacks against Federal Government networks—The Secretary shall submit to the Committee on Homeland Security of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and the Comptroller General of the United States an annual report that summarizes major cyber incidents involving Federal civilian agency information systems and provides aggregate statistics on the number of breaches, the volume of data exfiltrated, the consequential impact, and the estimated cost of remedying such breaches.

“(g) Report on the operations of the Center—The Secretary, in consultation with the Sector Coordinating Councils and appropriate Federal Government entities, shall submit to the Committee on Homeland Security of the House of Representatives, the Committee on Homeland Security and Governmental Affairs of the Senate, and the Comptroller General of the United States an annual report on—

“(1) the capability and capacity of the Center to carry out its cybersecurity mission in accordance with this section, and sections 226, 227, 229, 230, 230A, and 230B;

“(2) the extent to which the Department is engaged in information sharing with each critical infrastructure sector designated under section 227(b), including—

“(A) the extent to which each such sector has representatives at the Center; and

“(B) the extent to which critical infrastructure owners and critical infrastructure operators of each critical infrastructure sector participate in information sharing at the Center;

“(3) the volume and range of activities with respect to which the Secretary collaborated with the Sector Coordinating Councils and the Sector-Specific Agencies to promote greater engagement with the Center; and

“(4) the volume and range of voluntary technical assistance sought and provided by the Department to each critical infrastructure owner and critical infrastructure operator.”

“229. Cyber incident response and technical assistance

“(a) In general—The Secretary shall establish Cyber Incident Response Teams to—

“(1) upon request, provide timely technical assistance and crisis management support to Federal, State, and local government entities, private entities, and critical infrastructure owners and critical infrastructure operators involving cyber incidents affecting critical infrastructure; and

“(2) upon request, provide actionable recommendations on security and resilience measures and countermeasures to Federal, State, and local government entities, private entities, and critical infrastructure owners and critical infrastructure operators prior to, during, and after cyber incidents.

“(b) Coordination—In carrying out subsection (a), the Secretary shall coordinate with the relevant Sector Specific Agencies, if applicable.

“(c) Cyber incident response plan—The Secretary, in coordination with the Sector Coordinating Councils, Information Sharing and Analysis Centers, and Federal, State, and local governments, shall develop, regularly update, maintain, and exercise a National Cybersecurity Incident Response Plan which shall—

changed “(1) include effective emergency response plans associated with cyber threats to critical infrastructure, information systems, or networks of information systems; andsystems;

changed “(2) ensure that such National Cybersecurity Incident Response Plan can adapt to and reflect a changing cyber threat environment, and incorporate best practices and lessons learned from regular exercises, training, and after-action reports.”reports; and

added “(3) facilitate discussions on the best methods for developing innovative and useful cybersecurity exercises for coordinating between the Department and each of the critical infrastructure sectors designated under section 227(b).

added “(d) Update to Cyber Incident Annex to the National Response Framework—The Secretary, in coordination with the heads of other Federal agencies and in accordance with the National Cybersecurity Incident Response Plan under subsection (c), shall regularly update, maintain, and exercise the Cyber Incident Annex to the National Response Framework of the Department.”

added “(K) Under Secretary for Cybersecurity and Infrastructure Protection.

added “(L) Deputy Under Secretary for Cybersecurity.

added “(M) Deputy Under Secretary for Infrastructure Protection.”

removed “230. Assessment of cybersecurity workforce

removed “(a) Assessment—The Secretary, in consultation with relevant private entities, shall regularly assess the readiness and capacity of the workforce of the Department to meet the needs of the cybersecurity mission of the Department.

removed “(b) Strategy required—Not later than 180 days after the date of the enactment of this section, the Secretary shall develop, maintain, and, as necessary, update, a comprehensive workforce strategy designed to enhance the readiness, capacity, training, recruitment, and retention of the cybersecurity personnel of the Department. Such strategy shall include a five-year plan on recruitment of personnel for the workforce of the Department, and ten-year projections of the workforce needs of the Department. The Secretary shall submit such strategy to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate.”

added “230. Public-private collaboration on cybersecurity

added “(a) Meetings—The Secretary shall meet with the Sector Coordinating Council for each critical infrastructure sector designated under section 227(b) on a biannual basis to discuss the cybersecurity threat to critical infrastructure, voluntary activities to address cybersecurity, and ideas to improve the public-private partnership to enhance cybersecurity, in which the Secretary shall—

removed “230B. Public-private collaboration on cy­ber­se­cu­ri­ty

removed “(a) National Institute of Standards and Technology—The Director of the National Institute of Standards and Technology, in collaboration with the Secretary, shall, on an ongoing basis, facilitate and support the development of a voluntary, industry-led set of standards, guidelines, best practices, methodologies, procedures, and processes to reduce cyber risks to critical infrastructure. The Director, in collaboration with the Secretary—

removed “(1) shall—

removed “(A) coordinate closely and continuously with relevant private entities, critical infrastructure owners and critical infrastructure operators, Sector Coordinating Councils, Information Sharing and Analysis Centers, and other relevant industry organizations, and incorporate industry expertise to the fullest extent possible;

removed “(B) consult with the Sector Specific Agencies, Federal, State and local governments, the governments of other countries, and international organizations;

removed “(C) utilize a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, that may be voluntarily adopted by critical infrastructure owners and critical infrastructure operators to help them identify, assess, and manage cyber risks;

removed “(D) include methodologies to—

removed “(i) identify and mitigate impacts of the cybersecurity measures or controls on business confidentiality; and

removed “(ii) protect individual privacy and civil liberties;

removed “(E) incorporate voluntary consensus standards and industry best practices, and align with voluntary international standards to the fullest extent possible;

removed “(F) prevent duplication of existing regulatory processes and prevent conflict with or superseding of existing regulatory requirements and processes; and

removed “(G) include such other similar and consistent elements as determined necessary; and

removed “(2) shall not prescribe or otherwise require—

removed “(A) the use of specific solutions;

removed “(B) the use of specific information technology products or services; or

removed “(C) that information technology products or services be designed, developed, or manufactured in a particular manner.

removed “(b) Meetings—The Secretary shall meet with the Sector Coordinating Council for each critical infrastructure sector designated under section 227(b) on a biannual basis to discuss the cybersecurity threat to critical infrastructure, voluntary activities to address cybersecurity, and ideas to improve the public-private partnership to enhance cybersecurity, in which the Secretary shall—

“(1) provide each Sector Coordinating Council an assessment of the cybersecurity threat to each critical infrastructure sector designated under section 227(b), including information relating to—

“(A) any actual or assessed cyber threat, including a consideration of adversary capability and intent, preparedness, target attractiveness, and deterrence capabilities;

“(B) the extent and likelihood of death, injury, or serious adverse effects to human health and safety caused by an act of terrorism or other disruption, destruction, or unauthorized use of critical infrastructure;

“(C) the threat to national security caused by an act of terrorism or other disruption, destruction, or unauthorized use of critical infrastructure; and

“(D) the harm to the economy that would result from an act of terrorism or other disruption, destruction, or unauthorized use of critical infrastructure; and

added “(2) provide recommendations, which may be voluntarily adopted, on ways to improve cybersecurity of critical infrastructure.

added “(b) Report

added “(1) In general—Starting 30 days after the end of the fiscal year in which the National Cybersecurity and Critical Infrastructure Protection Act of 2013 is enacted and annually thereafter, the Secretary shall submit to the appropriate congressional committees a report on the state of cybersecurity for each critical infrastructure sector designated under section 227(b) based on discussions between the Department and the Sector Coordinating Council in accordance with subsection (a) of this section. The Secretary shall maintain a public copy of each report, and each report may include a non-public annex for proprietary, business-sensitive information, or other sensitive information. Each report shall include, at a minimum information relating to—

added “(A) the risk to each critical infrastructure sector, including known cyber threats, vulnerabilities, and potential consequences;

added “(B) the extent and nature of any cybersecurity incidents during the previous year, including the extent to which cyber incidents jeopardized or imminently jeopardized information systems;

removed “(2) provide recommendations, which may be voluntarily adopted, on ways to improve cy­ber­se­cu­ri­ty of critical infrastructure.

removed “(c) Report

removed “(1) In general—Starting 30 days after the end of the fiscal year in which the National Cy­ber­se­cu­ri­ty and Critical Infrastructure Protection Act of 2013 is enacted and annually thereafter, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate a report on the state of cybersecurity for each critical infrastructure sector designated under section 227(b) based on discussions between the Department and the Sector Coordinating Council in accordance with subsection (b) of this section. The Secretary shall maintain a public copy of each report, and each report may include a non-public annex for proprietary or business-sensitive information. Each report shall include, at a minimum information relating to—

removed “(A) the risk to each critical infrastructure sector, including known cyber threats, vul­ner­a­bil­i­ties, and potential consequences;

removed “(B) the extent and nature of any cy­ber­se­cu­ri­ty incidents during the previous year, including the extent to which cyber incidents jeopardized or imminently jeopardized information systems;

“(C) the current status of the voluntary, industry-led set of standards, guidelines, best practices, methodologies, procedures, and processes to reduce cyber risks within each critical infrastructure sector; and

“(D) the volume and range of voluntary technical assistance sought and provided by the Department to each critical infrastructure sector.

“(2) Sector Coordinating Council response—Before making public and submitting each report required under paragraph (1), the Secretary shall provide a draft of each report to the Sector Coordinating Council for the critical infrastructure sector covered by each such report. The Sector Coordinating Council at issue may provide to the Secretary a written response to such report within 45 days of receiving the draft. If such Sector Coordinating Council provides a written response, the Secretary shall include such written response in the final version of each report required under paragraph (1).

added “(c) Limitation—Information shared with or provided to a Sector Coordinating Council, a critical infrastructure sector, or the Secretary for the purpose of the activities under subsections (a) and (b) may not be used by any Federal, State, or local government department or agency to regulate the activity of any private entity.”

removed “(d) Limitation—Information shared with or provided to the Director of the National Institute of Standards and Technology or the Secretary for the purpose of the activities under subsections (a) and (b) shall not be used by any Federal, State, or local government department or agency to regulate the activity of any private entity.”

“(7) Qualifying cyber incident

“(A) In general—The term qualifying cyber incident means any act that the Secretary determines meets the requirements under subparagraph (B), as such requirements are further defined and specified by the Secretary.

changed “(B) Requirements—A qualifying cyber incident meets the requirements of this subparagraph if the incident—if—

changed “(i) the incident is unlawful or otherwise exceeds authorized access authority;

changed “(ii) the incident disrupts or imminently jeopardizes the integrity, operation, confidentiality, or availability of programmable electronic devices, communication networks, including hardware, software and data that are essential to their reliable operation, electronic storage devices, or any other information system, or the information that system controls, processes, stores, or transmits;

changed “(iii) the perpetrator of the incident gains access to an information system or a network of information systems resulting in—

“(I) misappropriation or theft of data, assets, information, or intellectual property;

“(II) corruption of data, assets, information, or intellectual property;

“(III) operational disruption; or

“(IV) an adverse effect on such system or network, or the data, assets, information, or intellectual property contained therein; and

changed “(iv) the incident causes harm inside or outside the United States that results in material levels of damage, disruption, or casualties severely affecting the United States population, infrastructure, economy, or national morale, or Federal, State, local, or tribal government functions.”functions.

added “(C) Rule of construction—For purposes of clause (iv) of subparagraph (B), the term “severely” includes any qualifying cyber incident, whether at a local, regional, state, national, international, or tribal level, that affects—

added “(i) the United States population, infrastructure, economy, or national morale, or

added “(ii) Federal, State, local, or tribal government functions.”

changed This Act and the amendments made by this Act (except that this section shall not apply in the case of section 202 of this Act and the amendments made by such section 202) do not—