---
kind: "section"
citation: "6 U.S.C. § 660"
title: "6"
title_heading: "Domestic Security"
number: "660"
heading: "Cybersecurity plans"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/660"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §660. Cybersecurity plans

- (a) **Definitions—** In this section, the term “[agency](/usc/6/650.md?p=1) [information system](/usc/6/650.md?p=14)” means an [information system](/usc/6/650.md?p=14) used or operated by an [agency](/usc/6/650.md?p=1) or by another [entity](/usc/6/301c.md?p=2) on behalf of an [agency](/usc/6/650.md?p=1).
- (b) **Intrusion assessment plan—**
  - (1) **Requirement—** The [Secretary](/usc/6/641.md?p=3), in coordination with the [Director](/usc/6/650.md?p=10) of the Office of Management and Budget, shall—
    - (A) develop and implement an intrusion assessment plan to proactively detect, identify, and remove intruders in [agency](/usc/6/650.md?p=1) [information systems](/usc/6/650.md?p=14) on a routine basis; and
    - (B) update such plan as necessary.
  - (2) **Exception—** The intrusion assessment plan required under [paragraph (1)](#b-1) shall not apply to the [Department](/usc/6/641.md?p=1) of Defense, a [national security system](/usc/6/650.md?p=21), or an element of the [intelligence community](/usc/6/650.md?p=15).
- (c) **Cyber incident response plan—** The [Director](/usc/6/650.md?p=10) of the Cybersecurity and Infrastructure Security [Agency](/usc/6/650.md?p=1) shall, in coordination with appropriate Federal [departments](/usc/6/641.md?p=1) and [agencies](/usc/6/650.md?p=1), [State](/usc/6/101.md?p=17) and [local governments](/usc/6/101.md?p=13), sector coordinating [councils](/usc/6/681.md?p=2), [Information Sharing and Analysis Organizations](/usc/6/650.md?p=13), owners and operators of [critical infrastructure](/usc/6/101.md?p=4), and other appropriate [entities](/usc/6/301c.md?p=2) and individuals, develop, update not less often than biennially, maintain, and exercise adaptable [cyber incident](/usc/6/681.md?p=5) response plans to address [cybersecurity risks](/usc/6/650.md?p=7) to [critical infrastructure](/usc/6/101.md?p=4). The [Director](/usc/6/650.md?p=10), in consultation with relevant [Sector Risk Management Agencies](/usc/6/650.md?p=23) and the National Cyber [Director](/usc/6/650.md?p=10), shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for [cyber incident](/usc/6/681.md?p=5) response.
- (d) **National Response Framework—** The [Secretary](/usc/6/641.md?p=3), in coordination with the heads of other appropriate Federal [departments](/usc/6/641.md?p=1) and [agencies](/usc/6/650.md?p=1), and in accordance with the National Cybersecurity [Incident](/usc/6/650.md?p=12) Response Plan required under [subsection (c)](#c), shall regularly update, maintain, and exercise the [Cyber Incident](/usc/6/681.md?p=5) Annex to the National Response Framework of the [Department](/usc/6/641.md?p=1).
- (e) **Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments—**
  - (1) **In general—**
    - (A) **Requirement—** Not later than one year after December 27, 2021, the [Secretary](/usc/6/641.md?p=3), acting through the [Director](/usc/6/650.md?p=10), shall, in coordination with the heads of appropriate [Federal agencies](/usc/6/677a.md?p=4), [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, and other stakeholders, as appropriate, develop and make publicly available a [Homeland](/usc/6/101.md?p=1) Security Strategy to Improve the Cybersecurity of [State](/usc/6/101.md?p=17), Local, Tribal, and Territorial Governments.
    - (B) **Recommendations and requirements—** The strategy required under [subparagraph (A)](#e-1-A) shall provide recommendations relating to the ways in which the Federal Government should support and promote the ability of [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to identify, mitigate against, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), and [incidents](/usc/6/650.md?p=12).
  - (2) **Contents—** The strategy required under [paragraph (1)](#e-1) shall—
    - (A) identify capability gaps in the ability of [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12);
    - (B) identify Federal resources and capabilities that are available or could be made available to [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12);
    - (C) identify and assess the limitations of Federal resources and capabilities available to [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12) and make recommendations to address such limitations;
    - (D) identify opportunities to improve the coordination of the [Agency](/usc/6/650.md?p=1) with Federal and non-[Federal entities](/usc/6/681.md?p=7), such as the Multi-[State](/usc/6/101.md?p=17) Information [Sharing](/usc/6/650.md?p=26) and Analysis [Center](/usc/6/681.md?p=1), to improve—
      - (i) [incident](/usc/6/650.md?p=12) exercises, information [sharing](/usc/6/650.md?p=26) and [incident](/usc/6/650.md?p=12) notification procedures;
      - (ii) the ability for [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to voluntarily adapt and implement guidance in Federal binding operational directives; and
      - (iii) opportunities to leverage Federal schedules for cybersecurity investments under [section 502 of title 40](/usc/40/502.md);
    - (E) recommend new initiatives the Federal Government should undertake to improve the ability of [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12);
    - (F) set short-term and long-term goals that will improve the ability of [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12); and
    - (G) set dates, including interim benchmarks, as appropriate for [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments to establish baseline capabilities to identify, protect against, detect, respond to, and recover from [cybersecurity risks](/usc/6/650.md?p=7), [cybersecurity threats](/usc/6/650.md?p=8-A), [incidents](/usc/6/650.md?p=12), and ransomware [incidents](/usc/6/650.md?p=12).
  - (3) **Considerations—** In developing the strategy required under [paragraph (1)](#e-1), the [Director](/usc/6/650.md?p=10), in coordination with the heads of appropriate [Federal agencies](/usc/6/677a.md?p=4), [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, and other stakeholders, as appropriate, shall consider—
    - (A) lessons learned from [incidents](/usc/6/650.md?p=12) that have affected [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, and exercises with Federal and non-[Federal entities](/usc/6/681.md?p=7);
    - (B) the impact of [incidents](/usc/6/650.md?p=12) that have affected [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments, including the resulting costs to such governments;
    - (C) the information related to the interest and ability of [state](/usc/6/101.md?p=17) and non-[state](/usc/6/101.md?p=17) threat actors to compromise [information systems](/usc/6/650.md?p=14) owned or operated by [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments; and
    - (D) emerging [cybersecurity risks](/usc/6/650.md?p=7) and [cybersecurity threats](/usc/6/650.md?p=8-A) to [State](/usc/6/101.md?p=17), local, Tribal, and territorial governments resulting from the deployment of new technologies.
  - (4) **Exemption—** [Chapter 35](/usc/44/chch35.md) of title 44 (commonly known as the “Paperwork Reduction Act”) shall not apply to any action to implement this subsection.

## Source credit

(Pub. L. 107–296, title XXII, § 2210, formerly title II, § 228, as added and amended Pub. L. 114–113, div. N, title II, §§ 205, 223(a)(2), (4), (5), Dec. 18, 2015, 129 Stat. 2961, 2963, 2964; renumbered title XXII, § 2210, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(iv), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–81, div. A, title XV, §§ 1545, 1546, Dec. 27, 2021, 135 Stat. 2057, 2059; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(E), (c)(8), Dec. 23, 2022, 136 Stat. 3660, 3663.)

## Notes

### Editorial Notes

### Codification

Section was formerly classified to section 149 of this title prior to renumbering by Pub. L. 115–278.

Former section 149 of this title, which was transferred and redesignated as subsec. (c) of this section by Pub. L. 114–113, div. N, title II, § 223(a)(2), Dec. 18, 2015, 129 Stat. 2963, was based on Pub. L. 107–296, title II, § 227, as added by Pub. L. 113–282, § 7(a), Dec. 18, 2014, 128 Stat. 3070.

### Amendments

2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(E)(i), substituted “section, the term ‘agency information system’ means an information system used or operated by an agency or by another entity on behalf of an agency.” for “section—” and struck out pars. (1) to (4) which defined agency information system, cybersecurity risk, information system, intelligence community, and national security system.

Subsec. (c). Pub. L. 117–263, § 7143(c)(8), substituted “Director of the Cybersecurity and Infrastructure Security Agency” for “Director of Cybersecurity and Infrastructure Security”.

Pub. L. 117–263, § 7143(b)(2)(E)(ii), substituted “Information Sharing and Analysis Organizations” for “information sharing and analysis organizations (as defined in section 671(5) of this title)” and struck out “(as defined in section 659 of this title)” after “cybersecurity risks”.

Subsec. (e)(1)(B). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(I), which directed striking out “(as such term is defined in section 659 of this title)”, was executed by striking out “(as such term is defined in section 659 of this title)” after “cybersecurity risks” and after “incidents”, to reflect the probable intent of Congress.

Subsec. (e)(3)(C). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(II), struck out “(as such term is defined in section 1501 of this title)” after “information systems”.

2021—Subsec. (c). Pub. L. 117–81, § 1546, substituted “update not less often than biennially” for “regularly update” and inserted “The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.” at end.

Subsec. (e). Pub. L. 117–81, § 1545, added subsec. (e).

2018—Subsec. (a)(2). Pub. L. 115–278, § 2(g)(9)(A)(iv)(I), substituted “section 659 of this title” for “section 148 of this title”.

Subsec. (c). Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted “Director of Cybersecurity and Infrastructure Security” for “Under Secretary appointed under section 113(a)(1)(H) of this title”, “section 671(5) of this title” for “section 131(5) of this title”, and “section 659 of this title” for “section 148 of this title”.

2015—Subsec. (c). Pub. L. 114–113, § 223(a)(5), made technical amendment to reference in original act which appears in text as reference to section 148 of this title.

Pub. L. 114–113, § 223(a)(2), transferred former section 149 of this title to subsec. (c) of this section. See Codification note above.

Subsec. (d). Pub. L. 114–113, § 205, added subsec. (d).

### Statutory Notes and Related Subsidiaries

### Rules of Construction

Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under section 650 of this title.

Pub. L. 113–282, § 7(c), Dec. 18, 2014, 128 Stat. 3072, provided that: “Nothing in the amendment made by subsection (a) [enacting subsec. (c) of this section and section 150 of this title] or in subsection (b)(1) [formerly classified as a note under section 3543 of Title 44, Public Printing and Documents, see now section 2(d)(1) of Pub. L. 113–283, set out as a note under section 3553 of Title 44] shall be construed to alter any authority of a Federal agency or department.”