CISA Cyber Exercise Act

IIB 117TH CONGRESS 1ST SESSION H. R. 3223 IN THE SENATE OF THE UNITED STATES JULY 21, 2021 Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs AN ACT To amend the Homeland Security Act of 2002 to establish in the Cybersecurity and Infrastructure Security Agency the National Cyber Exercise Program, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS 2 HR 3223 RFS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘CISA Cyber Exercise 2 Act’’. 3 SEC. 2. NATIONAL CYBER EXERCISE PROGRAM. 4 (a) IN GENERAL.—Subtitle A of title XXII of the 5 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 6 is amended by adding at the end the following new section: 7 ‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 8 ‘‘(a) ESTABLISHMENT OF PROGRAM.— 9 ‘‘(1) IN GENERAL.—There is established in the 10 Agency the National Cyber Exercise Program (re- 11 ferred to in this section as the ‘Exercise Program’) 12 to evaluate the National Cyber Incident Response 13 Plan, and other related plans and strategies. 14 ‘‘(2) REQUIREMENTS.— 15 ‘‘(A) IN GENERAL.—The Exercise Program 16 shall be— 17 ‘‘(i) based on current risk assess- 18 ments, including credible threats, 19 vulnerabilities, and consequences; 20 ‘‘(ii) designed, to the extent prac- 21 ticable, to simulate the partial or complete 22 incapacitation of a government or critical 23 infrastructure network resulting from a 24 cyber incident; 25 VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS 3 HR 3223 RFS ‘‘(iii) designed to provide for the sys- 1 tematic evaluation of cyber readiness and 2 enhance operational understanding of the 3 cyber incident response system and rel- 4 evant information sharing agreements; and 5 ‘‘(iv) designed to promptly develop 6 after-action reports and plans that can 7 quickly incorporate lessons learned into fu- 8 ture operations. 9 ‘‘(B) MODEL EXERCISE SELECTION.—The 10 Exercise Program shall— 11 ‘‘(i) include a selection of model exer- 12 cises that government and private entities 13 can readily adapt for use; and 14 ‘‘(ii) aid such governments and pri- 15 vate entities with the design, implementa- 16 tion, and evaluation of exercises that— 17 ‘‘(I) conform to the requirements 18 described in subparagraph (A); 19 ‘‘(II) are consistent with any ap- 20 plicable national, State, local, or Trib- 21 al strategy or plan; and 22 ‘‘(III) provide for systematic 23 evaluation of readiness. 24 VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS 4 HR 3223 RFS ‘‘(3) CONSULTATION.—In carrying out the Ex- 1 ercise Program, the Director may consult with ap- 2 propriate representatives from Sector Risk Manage- 3 ment Agencies, cybersecurity research stakeholders, 4 and Sector Coordinating Councils. 5 ‘‘(b) DEFINITIONS.—In this section: 6 ‘‘(1) STATE.—The term ‘State’ means any 7 State of the United States, the District of Columbia, 8 the Commonwealth of Puerto Rico, the Northern 9 Mariana Islands, the United States Virgin Islands, 10 Guam, American Samoa, and any other territory or 11 possession of the United States. 12 ‘‘(2) PRIVATE ENTITY.—The term ‘private enti- 13 ty’ has the meaning given such term in section 102 14 of the Cybersecurity Information Sharing Act of 15 2015 (6 U.S.C. 1501).’’. 16 (b) TECHNICAL AMENDMENTS.— 17 (1) HOMELAND SECURITY ACT OF 2002.—Sub- 18 title A of title XXII of the Homeland Security Act 19 of 2002 (6 U.S.C. 651 et seq.) is amended— 20 (A) in the first section 2215 (6 U.S.C. 21 665; relating to the duties and authorities relat- 22 ing to .gov internet domain), by amending the 23 section enumerator and heading to read as fol- 24 lows: 25 VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS 5 HR 3223 RFS ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 1 INTERNET DOMAIN.’’; 2 (B) in the second section 2215 (6 U.S.C. 3 665b; relating to the joint cyber planning of- 4 fice), by amending the section enumerator and 5 heading to read as follows: 6 ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 7 (C) in the third section 2215 (6 U.S.C. 8 665c; relating to the Cybersecurity State Coor- 9 dinator), by amending the section enumerator 10 and heading to read as follows: 11 ‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 12 (D) in the fourth section 2215 (6 U.S.C. 13 665d; relating to Sector Risk Management 14 Agencies), by amending the section enumerator 15 and heading to read as follows: 16 ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 17 (E) in section 2216 (6 U.S.C. 665e; relat- 18 ing to the Cybersecurity Advisory Committee), 19 by amending the section enumerator and head- 20 ing to read as follows: 21 ‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; 22 and 23 (F) in section 2217 (6 U.S.C. 665f; relat- 24 ing to Cybersecurity Education and Training 25 VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS 6 HR 3223 RFS Programs), by amending the section enu- 1 merator and heading to read as follows: 2 ‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 3 PROGRAMS.’’. 4 (2) CONSOLIDATED APPROPRIATIONS ACT, 5 2021.—Paragraph (1) of section 904(b) of division U 6 of the Consolidated Appropriations Act, 2021 (Pub- 7 lic Law 116–260) is amended, in the matter pre- 8 ceding subparagraph (A), by inserting ‘‘of 2002’’ 9 after ‘‘Homeland Security Act’’. 10 (c) CLERICAL AMENDMENT.—The table of contents 11 in section 1(b) of the Homeland Security Act of 2002 is 12 amended by striking the items relating to sections 2214 13 through 2217 and inserting the following new items: 14 ‘‘Sec. 2214. National Asset Database. ‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. ‘‘Sec. 2216. Joint cyber planning office. ‘‘Sec. 2217. Cybersecurity State Coordinator. ‘‘Sec. 2218. Sector Risk Management Agencies. ‘‘Sec. 2219. Cybersecurity Advisory Committee. ‘‘Sec. 2220. Cybersecurity Education and Training Programs. ‘‘Sec. 2220A. National Cyber Exercise Program.’’. Passed the House of Representatives July 20, 2021. Attest: CHERYL L. JOHNSON, Clerk. VerDate Sep 11 2014 02:20 Jul 22, 2021 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3223.RFS H3223 kjohnson on DSK79L0C42PROD with BILLS