1. Short title
This Act may be cited as the “Assessing a Cyber State of Distress Act of 2020”.
Assessing a Cyber State of Distress Act of 2020
A BILL
To require the Secretary of Homeland Security to conduct an assessment of the feasibility and advisability of establishing a fund for the response to, and recovery from, a cyber state of distress, and for other purposes.
2. Definitions
In this Act:
Appropriate congressional committees— The term appropriate congressional committees means—
the Committee on Homeland Security and Governmental Affairs of the Senate; and
the Committee on Homeland Security and the Committee on Oversight and Reform of the House of Representatives.
Critical infrastructure— The term critical infrastructure has the meaning given the term in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)).
Cyber Response and Recovery Fund— The term Cyber Response and Recovery Fund means a fund intended to support the response and recovery from a significant cyber incident, the disbursement of which may be triggered by a declaration of a cyber state of distress.
Cyber state of distress— The term cyber state of distress means a state of distress that—
begins with a Federal declaration; and
triggers additional financial and material assistance in responding to significant cyber incidents.
State— The term State means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Northern Mariana Islands, the United States Virgin Islands, Guam, American Samoa, and any other territory or possession of the United States.
3. Assessment of cyber state of distress
In general— Not later than 180 days after the enactment of this Act, the Secretary of Homeland Security, in consultation with the head of any agency or non-Federal entity determined appropriate by the Secretary, shall conduct an assessment of the feasibility and advisability of establishing an authority for the declaration of a cyber state of distress.
Elements— The assessment required under subsection (a) shall include—
a review of recommendations developed by the Cyberspace Solarium Commission under section 1652(k) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 132 Stat. 2146); and
the development of additional recommendations relating to—
the determinations that the Secretary should make and any other actions that should be taken before the Secretary is authorized to declare or renew a cyber state of distress, including whether the declaration or any renewal should require congressional oversight or approval;
the definition of the term “significant cyber incident”, which shall include a consideration of the threat and scope or magnitude of the impact of such an incident;
the authority for the coordination, including the extent and type of coordination, of the response of—
Federal, State, local, and Tribal governments, including the National Guard; and
private entities;
the appropriate duration of a cyber state of distress and any renewal of a cyber state of distress;
whether there should be a limitation on the number of renewals of a cyber state of distress, with or without congressional oversight or approval;
the interaction, duplication, coordination, and deconfliction of—
authorities or functions for the preparation for, response to, or recovery from a significant cyber incident that the Secretary of Homeland Security recommends granting or assigning under this paragraph; and
existing authorities or functions established by law or policy that may relate to preparing for, responding to, or recovery from a significant cyber incident, including under—
the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5121 et seq.);
the National Emergencies Act (50 U.S.C. 1601 et seq.);
continuity of government plans;
other national disaster plans; and
any other Federal authority the Secretary of Homeland Security determines appropriate;
appropriate exemptions from applicable legal requirements necessary to facilitate activities during a cyber state of distress;
the scope of any allowable activities—
in preparation for a declaration of a cyber state of distress;
during a cyber state of distress; or
immediately following the termination of the cyber state of distress;
the scope of any other interaction between Federal entities and between Federal and non-Federal entities; and
any other aspects of a cyber state of distress that the Secretary of Homeland Security determines relevant.
4. Assessment of Cyber Response and Recovery Fund
In general— Not later than 180 days after the date of enactment of this Act, the Secretary of Homeland Security shall conduct an assessment of the feasibility and advisability of establishing a Cyber Response and Recovery Fund.
Elements— The assessment required under subsection (a) shall include—
a review of recommendations developed by the Cyberspace Solarium Commission under section 1652(k) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 132 Stat. 2146); and
the development of additional recommendations relating to—
the administration of a Cyber Response and Recovery Fund;
the eligibility of entities that may receive direct or indirect support under a Cyber Response and Recovery Fund, including eligibility for the receipt of direct or indirect support by—
Federal entities;
State, local, and Tribal governments;
owners and operators of critical infrastructure; and
private sector entities that are not owners or operators of critical infrastructure;
allowable expenses for a Cyber Response and Recovery Fund;
whether any entity receiving funds from the Cyber Response and Recovery Fund should be required to match funds or reimburse any funds to the Cyber Response and Recovery Fund; and
with respect to funding available for the response to, and recovery from a significant cyber incident, the interaction, duplication, coordination, and deconfliction of that funding, or applications for that funding, provided—
from a Cyber Response and Recovery Fund; or
under—
the Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5121 et seq.);
the National Emergencies Act (50 U.S.C. 1601 et seq.); or
any other Federal grant program relating to cybersecurity or natural disaster response or recovery.
5. Briefing
In general— Not later than 180 days after the date of enactment of this Act, the Secretary of Homeland Security shall provide a briefing to each appropriate congressional committee on the assessments carried out by the Secretary of Homeland Security under sections 3 and 4 that includes—
the findings from the assessments; and
legislative proposals for the establishment of—
an authority for the declaration of a cyber state of distress; and
a Cyber Response and Recovery Fund.
Format— Each briefing required under subsection (a)—
shall be completed in a manner that is unclassified; and
may include a classified component.