Strengthening State and Local Cybersecurity Defenses Act

I 116TH CONGRESS 1ST SESSION H. R. 5394 To amend the Homeland Security Act of 2002 to require certain coordination between the Department of Homeland Security and Federal and non- Federal entities relating to cybersecurity risks and incidents, and for other purposes. IN THE HOUSE OF REPRESENTATIVES DECEMBER 11, 2019 Mr. TAYLOR (for himself, Mr. ROGERS of Alabama, Mr. HURD of Texas, Mr. PANETTA, Mr. GREEN of Texas, Mr. GUEST, and Ms. SLOTKIN) intro- duced the following bill; which was referred to the Committee on Home- land Security, and in addition to the Committee on Oversight and Re- form, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To amend the Homeland Security Act of 2002 to require certain coordination between the Department of Home- land Security and Federal and non-Federal entities relat- ing to cybersecurity risks and incidents, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Strengthening State 4 and Local Cybersecurity Defenses Act’’. 5 VerDate Sep 11 2014 04:13 Dec 20, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H5394.IH H5394 kjohnson on DSK79L0C42 with BILLS 2 •HR 5394 IH SEC. 2. COOPERATION RELATING TO CYBERSECURITY 1 RISKS AND INCIDENTS. 2 Subtitle A of title XXII of the Homeland Security 3 Act of 2002 (6 U.S.C. 652 et seq.) is amended— 4 (1) in section 2201 (6 U.S.C. 651)— 5 (A) by redesignating paragraphs (4), (5), 6 and (6) as paragraphs (5), (6), and (7), respec- 7 tively; and 8 (B) by inserting after paragraph (3) the 9 following new paragraph: 10 ‘‘(4) ENTITY.—The term ‘entity’ includes— 11 ‘‘(A) an association, corporation, whether 12 for-profit or nonprofit, partnership, proprietor- 13 ship, organization, institution, establishment, or 14 individual, whether domestic or foreign; 15 ‘‘(B) a government agency or other govern- 16 mental entity, whether domestic or foreign, in- 17 cluding State, local, Tribal, and territorial gov- 18 ernment entities; and 19 ‘‘(C) the general public.’’; 20 (2) in section 2209 of the Homeland Security 21 Act of 2002 (6 U.S.C. 659), by adding at the end 22 the following new subsection: 23 ‘‘(n) COORDINATION.—The Director shall, to the ex- 24 tent practicable, and in coordination as appropriate with 25 VerDate Sep 11 2014 04:13 Dec 20, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5394.IH H5394 kjohnson on DSK79L0C42 with BILLS 3 •HR 5394 IH Federal and non-Federal entities, such as the Multi-State 1 Information Sharing and Analysis Center— 2 ‘‘(1) conduct exercises with Federal and non- 3 Federal entities; 4 ‘‘(2) provide operational and technical cyberse- 5 curity training related to cyber threat indicators, de- 6 fensive measures, cybersecurity risks, and incidents 7 to Federal and non-Federal entities to address cy- 8 bersecurity risks or incidents, with or without reim- 9 bursement; 10 ‘‘(3) assist Federal and non-Federal entities, 11 upon request, in sharing cyber threat indicators, de- 12 fensive measures, cybersecurity risks, and incidents 13 from and to the Federal Government as well as 14 among Federal and non-Federal entities, in order to 15 increase situational awareness and help prevent inci- 16 dents; 17 ‘‘(4) provide Federal and non-Federal entities 18 timely notifications containing specific incident and 19 malware information that may affect such entities or 20 individuals with respect to whom such entities have 21 a relationship; 22 ‘‘(5) provide and periodically update via a web 23 portal and other means tools, products, resources, 24 policies, guidelines, controls, procedures, and other 25 VerDate Sep 11 2014 04:13 Dec 20, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H5394.IH H5394 kjohnson on DSK79L0C42 with BILLS 4 •HR 5394 IH cybersecurity standards and best practices and pro- 1 cedures related to information security; 2 ‘‘(6) work with senior Federal and non-Federal 3 officials, including State and local Chief Information 4 Officers, senior election officials, and through na- 5 tional associations, to coordinate a nationwide effort 6 to ensure effective implementation of tools, products, 7 resources, policies, guidelines, controls, procedures, 8 and other cybersecurity standards and best practices 9 and procedures related to information security to se- 10 cure and ensure the resiliency of Federal and non- 11 Federal information systems, including election sys- 12 tems; 13 ‘‘(7) provide, upon request, operational and 14 technical assistance to Federal and non-Federal enti- 15 ties to implement tools, products, resources, policies, 16 guidelines, controls, procedures, and other cyberse- 17 curity standards and best practices and procedures 18 related to information security, including by, as ap- 19 propriate, deploying and sustaining cybersecurity 20 technologies, such as an intrusion detection capa- 21 bility, to assist such Federal and non-Federal enti- 22 ties in detecting cybersecurity risks and incidents; 23 ‘‘(8) assist Federal and non-Federal entities in 24 developing policies and procedures for coordinating 25 VerDate Sep 11 2014 04:13 Dec 20, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H5394.IH H5394 kjohnson on DSK79L0C42 with BILLS 5 •HR 5394 IH vulnerability disclosures, to the extent practicable, 1 consistent with international and national standards 2 in the information technology industry; 3 ‘‘(9) ensure that Federal and non-Federal enti- 4 ties, as appropriate, are made aware of the tools, 5 products, resources, policies, guidelines, controls, 6 procedures, and other cybersecurity standards and 7 best practices and procedures related to information 8 security developed by the Department and other ap- 9 propriate Federal entities for ensuring the security 10 and resiliency of civilian information systems; and 11 ‘‘(10) promote cybersecurity education and 12 awareness through engagements with Federal and 13 non-Federal entities.’’. 14 Æ VerDate Sep 11 2014 04:13 Dec 20, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H5394.IH H5394 kjohnson on DSK79L0C42 with BILLS