H.R. 2825 — what changed
Department of Homeland Security Authorization Act
From Referred in Senate to Reported in Senate. 1 section amended between Referred in Senate and Reported in Senate.
Sec. 1561 Information sharing and cybersecurity
Federal Security Directors— Section 44933 of title 49, United States Code, is amended by adding at the end the following new subsection:
“(c) Information sharing—Not later than one year after the date of the enactment of this subsection, the Administrator shall—
“(1) require each Federal Security Director of an airport to meet at least quarterly with the airport director, airport security coordinator, and law enforcement agencies serving each such airport to discuss incident management protocols, including the resolution of screening anomalies at passenger screening checkpoints; and
“(2) require each Federal Security Director at an airport to inform, consult, and coordinate, as appropriate, with the respective airport security coordinator in a timely manner on security matters impacting airport operations and to establish and maintain operational protocols with such airport operators to ensure coordinated responses to security matters.”
Plan to improve information sharing—
In general— Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Administrator of the Transportation Security Administration, shall develop a plan to improve intelligence information sharing with State and local transportation entities that includes best practices to ensure that the information shared is actionable, useful, and not redundant.
Contents— The plan required under subsection (a) shall include the following:
The incorporation of best practices for information sharing.
The identification of areas of overlap and redundancy.
An evaluation and incorporation of stakeholder input in the development of such plan.
The integration of recommendations of the Comptroller General of the United States on information sharing.
Solicitation— The Administrator shall solicit on an annual basis input from appropriate stakeholders, including State and local transportation entities, on the quality and quantity of intelligence received by such stakeholders relating to information sharing.
Best practices sharing—
In general— Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, acting through the Administrator of the Transportation Security Administration, shall establish a mechanism to share with State and local transportation entities best practices from across the law enforcement spectrum, including Federal, State, local, and tribal entities, that relate to employee training, employee professional development, technology development and deployment, hardening tactics, and passenger and employee awareness programs.
Consultation— The Administrator of the Transportation Security Administration shall solicit and incorporate stakeholder input—
in developing the mechanism for sharing best practices as required under paragraph (1); and
not less frequently than once each year on the quality and quantity of information such stakeholders receive through the mechanism established under such subsection.
Cybersecurity—
renumbered
was (5)(3)
In general— The Secretary of Homeland Security shall—
renumbered
was (5)(3)(3)
not later than 120 days after the date of the enactment of this Act, develop and implement a cybersecurity risk assessment model for aviation security, consistent with the National Institute of Standards and Technology Framework for Improvement Critical Infrastructure Cybersecurity and any update to such Framework pursuant to section 2 of the National Institute of Standards and Technology Act (15 U.S.C. 272), to evaluate current and future cybersecurity risks;
renumbered
was (5)(3)(4)
evaluate, on a periodic basis, but not less often than once every two years, the effectiveness of the cybersecurity risk assessment model under subparagraph (A);
renumbered
was (5)(3)(5)
seek to ensure participation of at least one information sharing and analysis organization (as such term is defined in section 212 of the Homeland Security Act of 2002 (6 U.S.C. 131)) representing the aviation community in the national cybersecurity and communications integration center, pursuant to subsection (d)(1)(B) of section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148);
renumbered
was (5)(3)(6)
establish guidelines for voluntary reporting of aviation-related cybersecurity risks and incidents to the national cybersecurity and communications integration center under section 227 of the Homeland Security Act of 2002, and other appropriate Federal agencies; and
renumbered
was (5)(3)(7)
request the Aviation Security Advisory Committee established pursuant to section 44946 of title 49, United States Code, to report and make recommendations to the Secretary on enhancing the sharing of information related to aviation-related cybersecurity risks and incidents between relevant Federal, state, local, tribal, and territorial entities and the aviation stakeholder community.
renumbered
was (5)(4)
Cybersecurity enhancements to aviation security activities— The Secretary of Homeland Security, in consultation with the Secretary of Transportation, shall—
renumbered
was (5)(4)(3)
direct the sharing of information concerning cybersecurity risks and incidents to address aviation-specific risks; and
renumbered
was (5)(4)(4)
upon request, conduct cybersecurity vulnerability assessments for airports and air carriers.
added
TSA database cyber assessment—
removed
TSA database cyber assessment—
renumbered
was (5)(5)(2)
Assessment required— Not later than 120 days after the date of the enactment of this Act, the Secretary of Homeland Security shall evaluate the cybersecurity of the Transportation Security Administration databases for trusted traveler and credentialing programs that contain personal information of specific individuals or information that identifies specific individuals, including the Transportation Worker Identification Credential and Pre-Check trusted traveler programs, and the means for transmission of data to and from such databases and develop information on any identified cybersecurity vulnerabilities and remediation plans to address such vulnerabilities;
renumbered
was (5)(5)(3)
Submission to Congress— Not later than 30 days after the completion of the evaluation required under subparagraph (A), the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate information relating to such evaluation. Such submission shall be provided in a classified form.
renumbered
was (5)(5)(4)
Submission of supplementary information— Not later than 90 days after the completion of such evaluation, the Secretary shall submit to the Committee on Homeland Security of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate supplementary information relating to such evaluation, including information relating to any identified cybersecurity vulnerabilities and remediation plans to address such vulnerabilities. Such submission shall be provided in a classified form.
renumbered
was (5)(6)
Definitions— In this subsection, the terms “cybersecurity risk” and “incident” have the meanings given such terms in section 227 of the Homeland Security Act of 2002.