Cybersecurity Advisory Committee Authorization Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 1975 To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a Chief Information Security Officer Advisory Committee. IN THE HOUSE OF REPRESENTATIVES MARCH 28, 2019 Mr. KATKO (for himself, Mr. NEWHOUSE, Mr. FITZPATRICK, and Mr. LIPIN- SKI) introduced the following bill; which was referred to the Committee on Homeland Security, and in addition to the Committees on Energy and Commerce, and Oversight and Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provi- sions as fall within the jurisdiction of the committee concerned A BILL To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a Chief Information Security Officer Advisory Committee. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Cybersecurity Advisory 4 Committee Authorization Act of 2019’’. 5 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 2 •HR 1975 IH SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 1 (a) IN GENERAL.—Subtitle A of title XXII of the 2 Homeland Security Act of 2002 is amended by adding at 3 the end the following new section: 4 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 5 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab- 6 lish within the Cybersecurity and Infrastructure Security 7 Agency a Cybersecurity Advisory Committee. 8 ‘‘(b) DUTIES.— 9 ‘‘(1) IN GENERAL.—The Advisory Committee 10 may advise, consult with, report to, and make rec- 11 ommendations to the Director of Cybersecurity and 12 Infrastructure Security on the development, refine- 13 ment, and implementation of policies, programs, 14 rulemakings, planning, training, and security direc- 15 tives pertaining to the mission of the Cybersecurity 16 and Infrastructure Security Agency. 17 ‘‘(2) RECOMMENDATIONS.— 18 ‘‘(A) IN GENERAL.—The Advisory Com- 19 mittee shall develop, at the request of the Di- 20 rector, recommendations for improvements to 21 the cybersecurity mission of the Cybersecurity 22 and Infrastructure Security Agency. 23 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT- 24 TEES.—Recommendations agreed upon by the 25 subcommittees established under subsection (d) 26 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 3 •HR 1975 IH for any year shall be approved by the Advisory 1 Committee before the Advisory Committee sub- 2 mits to the Director the annual report under 3 paragraph (4) for that year. 4 ‘‘(3) PERIODIC REPORTS.—The Advisory Com- 5 mittee shall periodically submit to the Director— 6 ‘‘(A) reports on matters identified by the 7 Director; and 8 ‘‘(B) reports on other matters identified by 9 a majority of the members of the Advisory 10 Committee. 11 ‘‘(4) ANNUAL REPORT.—The Advisory Com- 12 mittee shall submit to the Director an annual report 13 providing information on the activities, findings, and 14 recommendations of the Advisory Committee, includ- 15 ing its subcommittees, for the preceding year. Not 16 later than six months after the date that the Direc- 17 tor receives an annual report for a year, the Director 18 shall publish a public version of the report describ- 19 ing the activities of the Advisory Committee and 20 such related matters as would be informative to the 21 public during that year, consistent with section 22 552(b) of title 5, United States Code. 23 ‘‘(5) FEEDBACK.—Not later than 90 days after 24 receiving any recommendation submitted by the Ad- 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 4 •HR 1975 IH visory Committee under paragraph (2), (3), or (4), 1 the Director shall respond in writing to the Advisory 2 Committee with feedback on the recommendation. 3 Such a response shall include— 4 ‘‘(A) with respect to any recommendation 5 with which the Director concurs, an action plan 6 to implement the recommendation; and 7 ‘‘(B) with respect to any recommendation 8 with which the Director does not concur, a jus- 9 tification for why the Director does not plan to 10 implement the recommendation. 11 ‘‘(6) CONGRESSIONAL NOTIFICATION.—For 12 each fiscal quarter beginning after the date of the 13 enactment of this section, the Director shall provide 14 to the Committee on Homeland Security and Gov- 15 ernmental Affairs and the Committee on Appropria- 16 tions of the Senate and the Committee on Homeland 17 Security and the Committee on Appropriations of 18 the House of Representatives a briefing on feedback 19 from the Advisory Committee. 20 ‘‘(c) MEMBERSHIP.— 21 ‘‘(1) APPOINTMENT.— 22 ‘‘(A) IN GENERAL.—Not later than 180 23 days after the date of the enactment of this 24 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 5 •HR 1975 IH Act, the Director shall appoint the members of 1 the Advisory Committee. 2 ‘‘(B) COMPOSITION.—The membership of 3 the Advisory Committee shall consist of not 4 more than 35 individuals, each of whom rep- 5 resent a category referred to in subparagraph 6 (C)(i). 7 ‘‘(C) REPRESENTATION.— 8 ‘‘(i) IN GENERAL.—The membership 9 of the Advisory Committee shall include 10 representatives of State and local govern- 11 ments and of a broad range of industries, 12 including the following: 13 ‘‘(I) Defense. 14 ‘‘(II) Education. 15 ‘‘(III) Financial services. 16 ‘‘(IV) Healthcare. 17 ‘‘(V) Manufacturing. 18 ‘‘(VI) Media and entertainment. 19 ‘‘(VII) Chemicals. 20 ‘‘(VIII) Retail. 21 ‘‘(IX) Transportation. 22 ‘‘(X) Energy. 23 ‘‘(XI) Information Technology. 24 ‘‘(XII) Communications. 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 6 •HR 1975 IH ‘‘(XIII) Other relevant fields 1 identified by the Director. 2 ‘‘(ii) PROHIBITION.—Not more than 3 three members may represent any one cat- 4 egory under clause (i). 5 ‘‘(2) TERM OF OFFICE.— 6 ‘‘(A) TERMS.—The term of each member 7 of the Advisory Committee shall be two years, 8 but a member may continue to serve until a 9 successor is appointed. 10 ‘‘(B) REMOVAL.—The Director may review 11 the participation of a member of the Advisory 12 Committee and remove such member for cause 13 at any time. 14 ‘‘(C) REAPPOINTMENT.—A member of the 15 Advisory Committee may be reappointed for an 16 unlimited number of terms. 17 ‘‘(3) DELEGATION OF RESPONSIBILITIES.—A 18 member of the Advisory Committee may delegate 19 that member’s responsibilities under this section to 20 another individual, with the exception of access to 21 protected information and classified information 22 under paragraph (6). 23 ‘‘(4) PROHIBITION ON COMPENSATION.—The 24 members of the Advisory Committee may not receive 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 7 •HR 1975 IH pay or benefits from the United States Government 1 by reason of their service on the Advisory Com- 2 mittee. 3 ‘‘(5) MEETINGS.— 4 ‘‘(A) IN GENERAL.—The Director shall re- 5 quire the Advisory Committee to meet at least 6 quarterly, and may convene additional meetings 7 as necessary. 8 ‘‘(B) PUBLIC MEETINGS.—At least one of 9 the meetings referred to in subparagraph (A) 10 shall be open to the public. 11 ‘‘(C) ATTENDANCE.—The Advisory Com- 12 mittee shall maintain a record of the persons 13 present at each meeting. 14 ‘‘(6) MEMBER ACCESS TO CLASSIFIED AND 15 PROTECTED INFORMATION.— 16 ‘‘(A) IN GENERAL.—Not later than 60 17 days after the date on which a member is first 18 appointed to the Advisory Committee and be- 19 fore the member is granted access to any classi- 20 fied information or protected information, the 21 Director shall determine if there is cause for 22 such member to be restricted from reviewing, 23 discussing, or possessing such information. 24 ‘‘(B) ACCESS.— 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 8 •HR 1975 IH ‘‘(i) PROTECTED INFORMATION.—If 1 the Director does not restrict a member 2 from reviewing, discussing, or possessing 3 sensitive information under subparagraph 4 (A) and the member voluntarily signs a 5 nondisclosure agreement with respect to 6 protected information, the member may be 7 granted access to protected information 8 that the Director determines is relevant to 9 such member’s service on the Advisory 10 Committee. 11 ‘‘(ii) CLASSIFIED INFORMATION.—Ac- 12 cess to classified materials shall be man- 13 aged in accordance with Executive Order 14 No. 13526 of December 29, 2009 (75 Fed. 15 Reg 707), or any subsequent corresponding 16 Executive Order. 17 ‘‘(C) PROTECTIONS.—A member of the 18 Advisory Committee shall agree, as a condition 19 of such membership, to protect all classified in- 20 formation in accordance with the applicable re- 21 quirements for the particular level of classifica- 22 tion of such information and to protect all pro- 23 tected information appropriately. 24 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 9 •HR 1975 IH ‘‘(D) PROTECTED INFORMATION DE- 1 FINED.—In this section, the term ‘protected in- 2 formation’ means— 3 ‘‘(i) information specifically exempted 4 from disclosure by statute or regulation; 5 ‘‘(ii) trade secrets and commercial or 6 financial information obtained from a per- 7 son and privileged or confidential; 8 ‘‘(iii) deliberative process privileged 9 information; 10 ‘‘(iv) personally identifiable informa- 11 tion, the disclosure of which would con- 12 stitute an invasion of personal privacy; 13 ‘‘(v) records containing law enforce- 14 ment sensitive information; and 15 ‘‘(vi) other categories of information, 16 as determined by the Director. 17 ‘‘(7) CHAIRPERSON.—The Advisory Committee 18 shall select, from among the members of the Advi- 19 sory Committee— 20 ‘‘(A) a member to serve as chairperson of 21 the Advisory Committee; and 22 ‘‘(B) a member to serve as chairperson of 23 each subcommittee of the Advisory Committee 24 established under subsection (d). 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 10 •HR 1975 IH ‘‘(d) SUBCOMMITTEES.— 1 ‘‘(1) IN GENERAL.—The Director and the Advi- 2 sory Committee shall establish subcommittees within 3 the Advisory Committee to address cybersecurity 4 issues, including relating to the following: 5 ‘‘(A) Information exchange. 6 ‘‘(B) Critical infrastructure. 7 ‘‘(C) Risk management. 8 ‘‘(D) Public and private partnerships. 9 ‘‘(2) ADDITIONAL SUBCOMMITTEES.—In addi- 10 tion to the subcommittees established pursuant to 11 paragraph (1), the Advisory Committee chairperson, 12 in coordination with the Director, may establish 13 within the Advisory Committee additional sub- 14 committees that the Director and Advisory Com- 15 mittee determine to be necessary. 16 ‘‘(3) MEETINGS AND REPORTING.—Each sub- 17 committee shall meet at least bimonthly, and submit 18 to the Advisory Committee for inclusion in the an- 19 nual report required under subsection (b)(4) infor- 20 mation, including activities, findings, and rec- 21 ommendations, regarding subject matter considered 22 by the subcommittee. 23 ‘‘(4) SUBJECT MATTER EXPERTS.—The chair of 24 the Advisory Committee shall appoint members to 25 VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS 11 •HR 1975 IH subcommittees and shall ensure that each member 1 appointed to a subcommittee has subject matter ex- 2 pertise relevant to the subject matter of the sub- 3 committee. 4 ‘‘(e) NONAPPLICABILITY OF FACA.—The Federal 5 Advisory Committee Act (5 U.S.C. App.) shall not apply 6 to the Advisory Committee and its subcommittees.’’. 7 (b) CLERICAL AMENDMENT.—The table of contents 8 in section 1(b) of such Act is amended by inserting after 9 the item relating to section 2214 the following new item: 10 ‘‘2215. Cybersecurity Advisory Committee.’’. Æ VerDate Sep 11 2014 06:34 Apr 11, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6301 E:\BILLS\H1975.IH H1975 kjohnson on DSK79L0C42 with BILLS