State and Local Government Cybersecurity Act of 2019

IC 116TH CONGRESS 1ST SESSION S. 1846 IN THE HOUSE OF REPRESENTATVES NOVEMBER 26, 2019 Referred to the Committee on Homeland Security, and in addition to the Committee on Oversight and Reform, and the Committee on Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the juris- diction of the committee concerned AN ACT To amend the Homeland Security Act of 2002 to provide for engagements with State, local, Tribal, and territorial governments, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 2 S 1846 RFH SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘State and Local Gov- 2 ernment Cybersecurity Act of 2019’’. 3 SEC. 2. AMENDMENTS TO THE HOMELAND SECURITY ACT 4 OF 2002. 5 Subtitle A of title XXII of the Homeland Security 6 Act of 2002 (6 U.S.C. 651 et seq.) is amended— 7 (1) in section 2201 (6 U.S.C. 651)— 8 (A) by redesignating paragraphs (4), (5), 9 and (6) as paragraphs (5), (6), and (7), respec- 10 tively; and 11 (B) by inserting after paragraph (3) the 12 following: 13 ‘‘(4) ENTITY.—The term ‘entity’ shall in- 14 clude— 15 ‘‘(A) an association, corporation, whether 16 for-profit or nonprofit, partnership, proprietor- 17 ship, organization, institution, establishment, or 18 individual, whether domestic or foreign; 19 ‘‘(B) a governmental agency or other gov- 20 ernmental entity, whether domestic or foreign, 21 including State, local, Tribal, and territorial 22 government entities; and 23 ‘‘(C) the general public.’’; and 24 (2) in section 2202 (6 U.S.C. 652)— 25 (A) in subsection (c)— 26 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 3 S 1846 RFH (i) in paragraph (10), by striking 1 ‘‘and’’ at the end; 2 (ii) by redesignating paragraph (11) 3 as paragraph (12); and 4 (iii) by inserting after paragraph (10) 5 the following: 6 ‘‘(11) carry out the authority of the Secretary 7 under subsection (e)(1)(R); and’’; and 8 (B) in subsection (e)(1), by adding at the 9 end the following: 10 ‘‘(R) To make grants to and enter into co- 11 operative agreements or contracts with States, 12 local, Tribal, and territorial governments, and 13 other non-Federal entities as the Secretary de- 14 termines necessary to carry out the responsibil- 15 ities of the Secretary related to cybersecurity 16 and infrastructure security under this Act and 17 any other provision of law, including grants, co- 18 operative agreements, and contracts that pro- 19 vide assistance and education related to cyber 20 threat indicators, defensive measures and cyber- 21 security technologies, cybersecurity risks, inci- 22 dents, analysis, and warnings.’’; and 23 (3) in section 2209 (6 U.S.C. 659)— 24 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 4 S 1846 RFH (A) in subsection (c)(6), by inserting 1 ‘‘operational and’’ after ‘‘timely’’; 2 (B) in subsection (d)(1)(E), by inserting ‘‘, 3 including an entity that collaborates with elec- 4 tion officials,’’ after ‘‘governments’’; and 5 (C) by adding at the end the following: 6 ‘‘(n) COORDINATION ON CYBERSECURITY FOR FED- 7 ERAL AND NON-FEDERAL ENTITIES.— 8 ‘‘(1) COORDINATION.—The Center shall, to the 9 extent practicable, and in coordination as appro- 10 priate with Federal and non-Federal entities, such 11 as the Multi-State Information Sharing and Analysis 12 Center— 13 ‘‘(A) conduct exercises with Federal and 14 non-Federal entities; 15 ‘‘(B) provide operational and technical cy- 16 bersecurity training related to cyber threat indi- 17 cators, defensive measures, cybersecurity risks, 18 and incidents to Federal and non-Federal enti- 19 ties to address cybersecurity risks or incidents, 20 with or without reimbursement; 21 ‘‘(C) assist Federal and non-Federal enti- 22 ties, upon request, in sharing cyber threat indi- 23 cators, defensive measures, cybersecurity risks, 24 and incidents from and to the Federal Govern- 25 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 5 S 1846 RFH ment as well as among Federal and non-Fed- 1 eral entities, in order to increase situational 2 awareness and help prevent incidents; 3 ‘‘(D) provide notifications containing spe- 4 cific incident and malware information that 5 may affect them or their customers and resi- 6 dents; 7 ‘‘(E) provide and periodically update via a 8 web portal and other means tools, products, re- 9 sources, policies, guidelines, controls, and other 10 cybersecurity standards and best practices and 11 procedures related to information security; 12 ‘‘(F) work with senior Federal and non- 13 Federal officials, including State and local Chief 14 Information Officers, senior election officials, 15 and through national associations, to coordinate 16 a nationwide effort to ensure effective imple- 17 mentation of tools, products, resources, policies, 18 guidelines, controls, and procedures related to 19 information security to secure and ensure the 20 resiliency of Federal and non-Federal informa- 21 tion systems and including election systems; 22 ‘‘(G) provide, upon request, operational 23 and technical assistance to Federal and non- 24 Federal entities to implement tools, products, 25 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 6 S 1846 RFH resources, policies, guidelines, controls, and pro- 1 cedures on information security, including by, 2 as appropriate, deploying and sustaining cyber- 3 security technologies, such as an intrusion de- 4 tection capability, to assist those Federal and 5 non-Federal entities in detecting cybersecurity 6 risks and incidents; 7 ‘‘(H) assist Federal and non-Federal enti- 8 ties in developing policies and procedures for 9 coordinating vulnerability disclosures, to the ex- 10 tent practicable, consistent with international 11 and national standards in the information tech- 12 nology industry; 13 ‘‘(I) ensure that Federal and non-Federal 14 entities, as appropriate, are made aware of the 15 tools, products, resources, policies, guidelines, 16 controls, and procedures on information secu- 17 rity developed by the Department and other ap- 18 propriate Federal departments and agencies for 19 ensuring the security and resiliency of civilian 20 information systems; and 21 ‘‘(J) promote cybersecurity education and 22 awareness through engagements with Federal 23 and non-Federal entities. 24 VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS 7 S 1846 RFH ‘‘(o) REPORT.—Not later than 1 year after the date 1 of enactment of this subsection, and every 2 years there- 2 after, the Secretary shall submit to the Committee on 3 Homeland Security and Governmental Affairs of the Sen- 4 ate and the Committee on Homeland Security of the 5 House of Representatives a report on the status of cyber- 6 security measures that are in place, and any gaps that 7 exist, in each State and in the largest urban areas of the 8 United States.’’. 9 Passed the Senate November 21, 2019. Attest: JULIE E. ADAMS, Secretary. VerDate Sep 11 2014 22:20 Nov 26, 2019 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S1846.RFH S1846 pamtmann on DSKBC07HB2PROD with BILLS