National Cyber Director Act

I 116TH CONGRESS 2D SESSION H. R. 7331 To establish the Office of the National Cyber Director, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JUNE 25, 2020 Mr. LANGEVIN (for himself, Mr. GALLAGHER, Mrs. CAROLYN B. MALONEY of New York, Mr. KATKO, Mr. RUPPERSBERGER, and Mr. HURD of Texas) introduced the following bill; which was referred to the Committee on Oversight and Reform, and in addition to the Committees on Armed Services, Foreign Affairs, and Intelligence (Permanent Select), for a pe- riod to be subsequently determined by the Speaker, in each case for con- sideration of such provisions as fall within the jurisdiction of the com- mittee concerned A BILL To establish the Office of the National Cyber Director, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘National Cyber Direc- 4 tor Act’’. 5 SEC. 2. NATIONAL CYBER DIRECTOR. 6 (a) ESTABLISHMENT.—There is established, within 7 the Executive Office of the President, the Office of the 8 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 7331 IH National Cyber Director (in this section referred to as the 1 ‘‘Office’’). 2 (b) NATIONAL CYBER DIRECTOR.— 3 (1) IN GENERAL.—The Office shall be headed 4 by the National Cyber Director (in this section re- 5 ferred to as the ‘‘Director’’) who shall be appointed 6 by the President, by and with the advice and consent 7 of the Senate. As an exercise of the rulemaking 8 power of the Senate, any nomination of the Director 9 submitted to the Senate for confirmation, and re- 10 ferred to a committee, shall be jointly referred to the 11 Homeland Security and Governmental Affairs and 12 the Armed Services Committees of the Senate. The 13 Director shall hold office at the pleasure of the 14 President, and shall be entitled to receive the same 15 pay and allowances as are provided for level I of the 16 Executive Schedule under section 5312 of title 5, 17 United States Code. 18 (2) DEPUTY DIRECTORS.—There shall be two 19 Deputy National Cyber Directors, to be appointed 20 by the President, who shall hold office at the pleas- 21 ure of the President, and who shall report to the Di- 22 rector, as follows: 23 (A) The Deputy National Cyber Director 24 for Strategy, Capabilities, and Budget. 25 VerDate Sep 11 2014 03:40 Jul 21, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 7331 IH (B) The Deputy National Cyber Director 1 for Plans and Operations. 2 (c) DUTIES OF THE NATIONAL CYBER DIRECTOR.— 3 (1) IN GENERAL.—Subject to the authority, di- 4 rection, and control of the President, the Director 5 shall— 6 (A) serve as the principal advisor to the 7 President on cybersecurity strategy and policy; 8 (B) in consultation with appropriate Fed- 9 eral departments and agencies, develop the 10 United States National Cyber Strategy, which 11 shall include elements related to Federal de- 12 partments and agencies— 13 (i) information security; and 14 (ii) programs and policies intended to 15 improve the United States cybersecurity 16 posture; 17 (C) in consultation with appropriate Fed- 18 eral departments and agencies and upon ap- 19 proval of the National Cyber Strategy by the 20 President, supervise implementation of the 21 strategy by— 22 (i) in consultation with the Director of 23 the Office of Management and Budget, 24 monitoring and assessing the effectiveness, 25 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 7331 IH including cost-effectiveness, of Federal de- 1 partments and agencies’ implementation of 2 the strategy; 3 (ii) making recommendations relevant 4 to changes in the organization, personnel 5 and resource allocation, and policies of 6 Federal departments and agencies to the 7 Director of the Office of Management and 8 Budget and heads of such departments 9 and agencies in order to implement the 10 strategy; 11 (iii) reviewing the annual budget pro- 12 posal for each Federal department or agen- 13 cy and certifying to the head of each Fed- 14 eral department or agency and the Direc- 15 tor of the Office of Management and 16 Budget whether the department or agency 17 proposal is consistent with the strategy; 18 (iv) continuously assessing and mak- 19 ing relevant recommendations to the Presi- 20 dent on the appropriate level of integration 21 and interoperability across the Federal 22 cybersecurity operations centers; 23 (v) coordinating with the Federal 24 Chief Information Officer, the Federal 25 VerDate Sep 11 2014 20:41 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 7331 IH Chief Information Security Officer, the Di- 1 rector of the Cybersecurity and Infrastruc- 2 ture Security Agency, and the Director of 3 National Institute of Standards and Tech- 4 nology on the development and implemen- 5 tation of policies and guidelines related to 6 issues of Federal department and agency 7 information security; and 8 (vi) reporting annually to the Presi- 9 dent and the Congress on the state of the 10 United States cybersecurity posture, the 11 effectiveness of the strategy, and the sta- 12 tus of Federal departments and agencies’ 13 implementation of the strategy; 14 (D) lead joint interagency planning for the 15 Federal Government’s integrated response to 16 cyberattacks and cyber campaigns of significant 17 consequence, to include— 18 (i) coordinating with relevant Federal 19 departments and agencies in the develop- 20 ment of, for the approval of the President, 21 joint, integrated operational plans, proc- 22 esses, and playbooks for incident response 23 that feature— 24 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 7331 IH (I) clear lines of authority and 1 lines of effort across the Federal Gov- 2 ernment; 3 (II) authorities that have been 4 delegated to an appropriate level to 5 facilitate effective operational re- 6 sponses across the Federal Govern- 7 ment; and 8 (III) support for the integration 9 of defensive cyber plans and capabili- 10 ties with offensive cyber plans and ca- 11 pabilities in a manner consistent with 12 improving the United States cyberse- 13 curity posture; 14 (ii) exercising these operational plans, 15 processes, and playbooks; 16 (iii) updating these operational plans, 17 processes, and playbooks for incident re- 18 sponse as needed in coordination with on- 19 going offensive cyber plans and operations; 20 and 21 (iv) ensuring these plans, processes, 22 and playbooks are properly coordinated 23 with relevant private sector entities, as ap- 24 propriate; 25 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 7331 IH (E) direct the Federal Government’s re- 1 sponse to cyberattacks and cyber campaigns of 2 significant consequence, to include— 3 (i) developing for the approval of the 4 President, with the heads of relevant Fed- 5 eral departments and agencies independ- 6 ently or through the National Security 7 Council as directed by the President, oper- 8 ational priorities, requirements, and tasks; 9 (ii) coordinating, deconflicting, and 10 ensuring the execution of operational ac- 11 tivities in incident response; and 12 (iii) coordinating operational activities 13 with relevant private sector entities; 14 (F) engage with private sector leaders on 15 cybersecurity and emerging technology issues 16 with the support of, and in coordination with, 17 the Cybersecurity and Infrastructure Security 18 Agency and other Federal departments and 19 agencies, as appropriate; 20 (G) annually report to Congress on cyber- 21 security threats and issues facing the nation, 22 including any new or emerging technologies 23 that may impact national security, economic 24 prosperity, or enforcing the rule of law; and 25 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 7331 IH (H) be responsible for such other functions 1 as the President may direct. 2 (2) DELEGATION OF AUTHORITY.—The Direc- 3 tor may— 4 (A) serve as the senior representative on 5 any body that the President may establish for 6 the purpose of providing the President advice 7 on cybersecurity; 8 (B) be empowered to convene National Se- 9 curity Council, National Economic Council and 10 Homeland Security Council meetings, with the 11 concurrence of the National Security Advisor, 12 Homeland Security Advisor, or Director of the 13 National Economic Council, as appropriate; 14 (C) be included as a participant in prep- 15 arations for and, if appropriate, execution of cy- 16 bersecurity summits and other international 17 meetings at which cybersecurity is a major 18 topic; 19 (D) delegate any of the Director’s func- 20 tions, powers, and duties to such officers and 21 employees of the Office as he may designate; 22 and 23 (E) authorize such successive re-delega- 24 tions of such functions, powers, and duties to 25 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 7331 IH such officers and employees of the Office as he 1 may deem appropriate. 2 (d) ATTENDANCE AND PARTICIPATION IN NATIONAL 3 SECURITY COUNCIL MEETINGS.—Section 101(c)(2) of the 4 National Security Act of 1947 (50 U.S.C. 3021(c)(2)) is 5 amended by striking ‘‘and the Chairman of the Joint 6 Chiefs of Staff’’ and inserting ‘‘the Chairman of the Joint 7 Chiefs of Staff, and the National Cyber Director’’. 8 (e) POWERS OF THE DIRECTOR.—The Director may, 9 for the purposes of carrying out the Director’s functions 10 under this section— 11 (1) subject to the civil service and classification 12 laws, select, appoint, employ, and fix the compensa- 13 tion of such officers and employees as are necessary 14 and prescribe their authority and duties, except that 15 not more than 75 individuals may be employed with- 16 out regard to any provision of law regulating the 17 employment or compensation at rates not to exceed 18 the basic rate of basic pay payable for level IV of 19 the Executive Schedule under section 5315 of title 20 5, United States Code; 21 (2) employ experts and consultants in accord- 22 ance with section 3109 of title 5, United States 23 Code, and compensate individuals so employed for 24 each day (including travel time) at rates not in ex- 25 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 7331 IH cess of the maximum rate of basic pay for grade 1 GS–15 as provided in section 5332 of such title, and 2 while such experts and consultants are so serving 3 away from their homes or regular place of business, 4 to pay such employees travel expenses and per diem 5 in lieu of subsistence at rates authorized by section 6 5703 of such title 5 for persons in Federal Govern- 7 ment service employed intermittently; 8 (3) promulgate such rules and regulations as 9 may be necessary to carry out the functions, powers, 10 and duties vested in the Director; 11 (4) utilize, with their consent, the services, per- 12 sonnel, and facilities of other Federal agencies; 13 (5) enter into and perform such contracts, 14 leases, cooperative agreements, or other transactions 15 as may be necessary in the conduct of the work of 16 the Office and on such terms as the Director may 17 determine appropriate, with any Federal agency, or 18 with any public or private person or entity; 19 (6) accept voluntary and uncompensated serv- 20 ices, notwithstanding the provisions of section 1342 21 of title 31, United States Code; 22 (7) adopt an official seal, which shall be judi- 23 cially noticed; and 24 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 7331 IH (8) provide, where authorized by law, copies of 1 documents to persons at cost, except that any funds 2 so received shall be credited to, and be available for 3 use from, the account from which expenditures relat- 4 ing thereto were made. 5 (f) DEFINITIONS.—In this section: 6 (1) CYBERSECURITY POSTURE.—The term ‘‘cy- 7 bersecurity posture’’ means the ability to identify 8 and protect, and detect, respond to and recover from 9 intrusions in, information systems the compromise of 10 which could constitute a cyber attack or cyber cam- 11 paign of significant consequence. 12 (2) CYBER ATTACKS AND CYBER CAMPAIGNS OF 13 SIGNIFICANT CONSEQUENCE.—The term ‘‘cyber at- 14 tacks and cyber campaigns of significant con- 15 sequence’’ means an incident or series of incidents 16 that have the purpose or effect of— 17 (A) causing a significant disruption to the 18 availability of a Federal information system; 19 (B) harming, or otherwise significantly 20 compromising the provision of service by, a 21 computer or network of computers that support 22 one or more entities in a critical infrastructure 23 sector; 24 VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS 12 •HR 7331 IH (C) significantly compromising the provi- 1 sion of services by one or more entities in a 2 critical infrastructure sector; 3 (D) causing a significant misappropriation 4 of funds or economic resources, trade secrets, 5 personal identifiers, or financial information for 6 commercial or competitive advantage or private 7 financial gain; or 8 (E) otherwise constituting a significant 9 threat to the national security, foreign policy, or 10 economic health or financial stability of the 11 United States. 12 (3) INCIDENT.—The term ‘‘incident’’ has the 13 meaning given that term in section 3552 of title 44, 14 United States Code. 15 (4) INFORMATION SECURITY.—The term ‘‘infor- 16 mation security’’ has the meaning given that term in 17 section 3552 of title 44, United States Code. 18 Æ VerDate Sep 11 2014 19:08 Jul 17, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6301 E:\BILLS\H7331.IH H7331 pamtmann on DSKBC07HB2PROD with BILLS