---
kind: "section"
citation: "6 U.S.C. § 661"
title: "6"
title_heading: "Domestic Security"
number: "661"
heading: "Cybersecurity strategy"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/661"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §661. Cybersecurity strategy

- (a) **In general—** Not later than 90 days after December 23, 2016, the [Secretary](/usc/6/641.md?p=3) shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law.
- (b) **Contents—** The strategy required under [subsection (a)](#a) shall include the following:
  - (1) Strategic and operational goals and priorities to successfully execute the full range of the [Secretary](/usc/6/641.md?p=3)’s cybersecurity responsibilities.
  - (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the [Secretary](/usc/6/641.md?p=3)’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following:
    - (A) Cybersecurity [functions](/usc/6/101.md?p=9) set forth in [section 659 of this title](/usc/6/659.md) (relating to the national cybersecurity and communications integration [center](/usc/6/681.md?p=1)).
    - (B) Cybersecurity investigations capabilities.
    - (C) Cybersecurity research and development.
    - (D) Engagement with international cybersecurity partners.
- (c) **Considerations—** In developing the strategy required under [subsection (a)](#a), the [Secretary](/usc/6/641.md?p=3) shall—
  - (1) consider—
    - (A) the cybersecurity strategy for the [Homeland Security Enterprise](/usc/6/650.md?p=11) published by the [Secretary](/usc/6/641.md?p=3) in November 2011;
    - (B) the [Department](/usc/6/641.md?p=1) of [Homeland](/usc/6/101.md?p=1) Security Fiscal Years 2014–2018 Strategic Plan; and
    - (C) the most recent Quadrennial [Homeland](/usc/6/101.md?p=1) Security Review issued pursuant to [section 347 of this title](/usc/6/347.md); and
  - (2) include information on the roles and responsibilities of components and offices of the [Department](/usc/6/641.md?p=1), to the extent practicable, to carry out such strategy.
- (d) **Implementation plan—** Not later than 90 days after the development of the strategy required under [subsection (a)](#a), the [Secretary](/usc/6/641.md?p=3) shall issue an implementation plan for the strategy that includes the following:
  - (1) Strategic objectives and corresponding tasks.
  - (2) Projected timelines and costs for such tasks.
  - (3) Metrics to evaluate performance of such tasks.
- (e) **Congressional oversight—** The [Secretary](/usc/6/641.md?p=3) shall submit to Congress for assessment the following:
  - (1) A copy of the strategy required under [subsection (a)](#a) upon issuance.
  - (2) A copy of the implementation plan required under [subsection (d)](#d) upon issuance, together with detailed information on any associated legislative or budgetary proposals.
- (f) **Classified information—** The strategy required under [subsection (a)](#a) shall be in an unclassified form but may contain a classified annex.
- (g) **Rule of construction—** Nothing in this section may be construed as permitting the [Department](/usc/6/641.md?p=1) to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information.

## Source credit

(Pub. L. 107–296, title XXII, § 2211, formerly title II, § 228A, as added Pub. L. 114–328, div. A, title XIX, § 1912(a), Dec. 23, 2016, 130 Stat. 2683; renumbered title XXII, § 2211, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(v), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(F), Dec. 23, 2022, 136 Stat. 3660.)

## Notes

### Editorial Notes

### Codification

Section was formerly classified to section 149a of this title prior to renumbering by Pub. L. 115–278.

### Amendments

2022—Subsec. (h). Pub. L. 117–263 struck out subsec. (h). Text read as follows: “In this section, the term ‘Homeland Security Enterprise’ means relevant governmental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representatives, academics, and other policy experts.”

2018—Subsec. (b)(2)(A). Pub. L. 115–278, § 2(g)(9)(A)(v), substituted “section 659 of this title” for “the section 148 of this title”.