Cybersecurity Advisory Committee Authorization Act of 2020

II Calendar No. 528 116TH CONGRESS 2D SESSION S. 4024 [Report No. 116–265] To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a Cybersecurity Advisory Committee. IN THE SENATE OF THE UNITED STATES JUNE 22, 2020 Mr. PERDUE (for himself and Ms. SINEMA) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs SEPTEMBER 9, 2020 Reported by Mr. JOHNSON, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a Cy- bersecurity Advisory Committee. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Cybersecurity Advisory 4 Committee Authorization Act of 2020’’. 5 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 4024 RS SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 1 (a) IN GENERAL.—Subtitle A of title XXII of the 2 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 3 is amended by adding at the end the following: 4 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 5 ‘‘(a) ESTABLISHMENT.—The Secretary shall estab- 6 lish within the Agency a Cybersecurity Advisory Com- 7 mittee (referred to in this section as the ‘Advisory Com- 8 mittee’). 9 ‘‘(b) DUTIES.— 10 ‘‘(1) IN GENERAL.—The Advisory Committee 11 may advise, consult with, report to, and make rec- 12 ommendations to the Director, as appropriate, on 13 the development, refinement, and implementation of 14 policies, programs, planning, and training pertaining 15 to the cybersecurity mission of the Agency. 16 ‘‘(2) RECOMMENDATIONS.— 17 ‘‘(A) IN GENERAL.—The Advisory Com- 18 mittee shall develop, at the request of the Di- 19 rector, recommendations for improvements to 20 advance the cybersecurity mission of the Agency 21 and strengthen the cybersecurity of the United 22 States. 23 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT- 24 TEES.—Recommendations agreed upon by sub- 25 committees established under subsection (d) for 26 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 4024 RS any year shall be approved by the Advisory 1 Committee before the Advisory Committee sub- 2 mits to the Director the annual report under 3 paragraph (4) for that year. 4 ‘‘(3) PERIODIC REPORTS.—The Advisory Com- 5 mittee shall periodically submit to the Director— 6 ‘‘(A) reports on matters identified by the 7 Director; and 8 ‘‘(B) reports on other matters identified by 9 a majority of the members of the Advisory 10 Committee. 11 ‘‘(4) ANNUAL REPORT.— 12 ‘‘(A) IN GENERAL.—The Advisory Com- 13 mittee shall submit to the Director an annual 14 report providing information on the activities, 15 findings, and recommendations of the Advisory 16 Committee, including its subcommittees, for the 17 preceding year. 18 ‘‘(B) PUBLICATION.—Not later than 180 19 days after the date on which the Director re- 20 ceives an annual report for a year under sub- 21 paragraph (A), the Director shall publish a 22 public version of the report describing the ac- 23 tivities of the Advisory Committee and such re- 24 lated matters as would be informative to the 25 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 4024 RS public during that year, consistent with section 1 552(b) of title 5, United States Code. 2 ‘‘(5) FEEDBACK.—Not later than 90 days after 3 receiving any recommendation submitted by the Ad- 4 visory Committee under paragraph (2), (3), or (4), 5 the Director shall respond in writing to the Advisory 6 Committee with feedback on the recommendation. 7 Such a response shall include— 8 ‘‘(A) with respect to any recommendation 9 with which the Director concurs, an action plan 10 to implement the recommendation; and 11 ‘‘(B) with respect to any recommendation 12 with which the Director does not concur, a jus- 13 tification for why the Director does not plan to 14 implement the recommendation. 15 ‘‘(6) CONGRESSIONAL NOTIFICATION.—Not less 16 frequently than once per year after the date of en- 17 actment of this section, the Director shall provide to 18 the Committee on Homeland Security and Govern- 19 mental Affairs and the Committee on Appropriations 20 of the Senate and the Committee on Homeland Se- 21 curity and the Committee on Appropriations of the 22 House of Representatives a briefing on feedback 23 from the Advisory Committee. 24 ‘‘(c) MEMBERSHIP.— 25 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 4024 RS ‘‘(1) APPOINTMENT.— 1 ‘‘(A) IN GENERAL.—Not later than 180 2 days after the date of enactment of the Cyber- 3 security Advisory Committee Authorization Act 4 of 2020, the Director shall appoint the mem- 5 bers of the Advisory Committee. 6 ‘‘(B) COMPOSITION.—The membership of 7 the Advisory Committee shall consist of not 8 more than 35 individuals. 9 ‘‘(C) REPRESENTATION.— 10 ‘‘(i) IN GENERAL.—The membership 11 of the Advisory Committee shall be geo- 12 graphically balanced and shall include rep- 13 resentatives of State and local governments 14 and of a broad range of industries, which 15 may include the following: 16 ‘‘(I) Defense. 17 ‘‘(II) Education. 18 ‘‘(III) Financial services and in- 19 surance. 20 ‘‘(IV) Healthcare. 21 ‘‘(V) Manufacturing. 22 ‘‘(VI) Media and entertainment. 23 ‘‘(VII) Chemicals. 24 ‘‘(VIII) Retail. 25 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 4024 RS ‘‘(IX) Transportation. 1 ‘‘(X) Energy. 2 ‘‘(XI) Information Technology. 3 ‘‘(XII) Communications. 4 ‘‘(XIII) Other relevant fields 5 identified by the Director. 6 ‘‘(ii) PROHIBITION.—Not more than 3 7 members may represent any 1 category 8 under clause (i). 9 ‘‘(2) TERM OF OFFICE.— 10 ‘‘(A) TERMS.—The term of each member 11 of the Advisory Committee shall be 2 years, ex- 12 cept that a member may continue to serve until 13 a successor is appointed. 14 ‘‘(B) REMOVAL.—The Director may review 15 the participation of a member of the Advisory 16 Committee and remove such member any time 17 at the discretion of the Director. 18 ‘‘(C) REAPPOINTMENT.—A member of the 19 Advisory Committee may be reappointed for an 20 unlimited number of terms. 21 ‘‘(3) PROHIBITION ON COMPENSATION.—The 22 members of the Advisory Committee may not receive 23 pay or benefits from the United States Government 24 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 4024 RS by reason of their service on the Advisory Com- 1 mittee. 2 ‘‘(4) MEETINGS.— 3 ‘‘(A) IN GENERAL.—The Director shall re- 4 quire the Advisory Committee to meet not less 5 frequently than semiannually, and may convene 6 additional meetings as necessary. 7 ‘‘(B) PUBLIC MEETINGS.—At least one of 8 the meetings referred to in subparagraph (A) 9 shall be open to the public. 10 ‘‘(C) ATTENDANCE.—The Advisory Com- 11 mittee shall maintain a record of the persons 12 present at each meeting. 13 ‘‘(5) MEMBER ACCESS TO CLASSIFIED INFOR- 14 MATION.— 15 ‘‘(A) IN GENERAL.—Not later than 60 16 days after the date on which a member is first 17 appointed to the Advisory Committee and be- 18 fore the member is granted access to any classi- 19 fied information, the Director shall determine if 20 the member should be restricted from review- 21 ing, discussing, or possessing classified informa- 22 tion. 23 ‘‘(B) ACCESS.—Access to classified mate- 24 rials shall be managed in accordance with Exec- 25 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 4024 RS utive Order No. 13526 of December 29, 2009 1 (75 Fed. Reg 707), or any subsequent cor- 2 responding Executive Order. 3 ‘‘(C) PROTECTIONS.—A member of the 4 Advisory Committee shall protect all classified 5 information in accordance with the applicable 6 requirements for the particular level of classi- 7 fication of such information. 8 ‘‘(6) CHAIRPERSON.—The Advisory Committee 9 shall select, from among the members of the Advi- 10 sory Committee— 11 ‘‘(A) a member to serve as chairperson of 12 the Advisory Committee; and 13 ‘‘(B) a member to serve as chairperson of 14 each subcommittee of the Advisory Committee 15 established under subsection (d). 16 ‘‘(d) SUBCOMMITTEES.— 17 ‘‘(1) IN GENERAL.—The Director shall establish 18 subcommittees within the Advisory Committee to ad- 19 dress cybersecurity issues, which may include the 20 following: 21 ‘‘(A) Information exchange. 22 ‘‘(B) Critical infrastructure. 23 ‘‘(C) Risk management. 24 ‘‘(D) Public and private partnerships. 25 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6401 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 4024 RS ‘‘(2) MEETINGS AND REPORTING.—Each sub- 1 committee shall meet not less frequently than semi- 2 annually, and submit to the Advisory Committee for 3 inclusion in the annual report required under sub- 4 section (b)(4) information, including activities, find- 5 ings, and recommendations, regarding subject mat- 6 ter considered by the subcommittee. 7 ‘‘(3) SUBJECT MATTER EXPERTS.—The chair of 8 the Advisory Committee shall appoint members to 9 subcommittees and shall ensure that each member 10 appointed to a subcommittee has subject matter ex- 11 pertise relevant to the subject matter of the sub- 12 committee. 13 ‘‘(e) NONAPPLICABILITY OF FACA.—The Federal 14 Advisory Committee Act (5 U.S.C. App.) shall not apply 15 to the Advisory Committee and its subcommittees.’’. 16 (b) CLERICAL AMENDMENT.—The table of contents 17 in section 1(b) of the Homeland Security Act of 2002 18 (Public Law 107–296; 116 Stat. 2135) is amended by in- 19 serting after the item relating to section 2214 the fol- 20 lowing: 21 ‘‘2215. Cybersecurity Advisory Committee.’’. SECTION 1. SHORT TITLE. 22 This Act may be cited as the ‘‘Cybersecurity Advisory 23 Committee Authorization Act of 2020’’. 24 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 4024 RS SEC. 2. CYBERSECURITY ADVISORY COMMITTEE. 1 (a) IN GENERAL.—Subtitle A of title XXII of the 2 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 3 amended by adding at the end the following: 4 ‘‘SEC. 2215. CYBERSECURITY ADVISORY COMMITTEE. 5 ‘‘(a) ESTABLISHMENT.—The Secretary shall establish 6 within the Agency a Cybersecurity Advisory Committee (re- 7 ferred to in this section as the ‘Advisory Committee’). 8 ‘‘(b) DUTIES.— 9 ‘‘(1) IN GENERAL.—The Advisory Committee 10 shall advise, consult with, report to, and make rec- 11 ommendations to the Director, as appropriate, on the 12 development, refinement, and implementation of poli- 13 cies, programs, planning, and training pertaining to 14 the cybersecurity mission of the Agency. 15 ‘‘(2) RECOMMENDATIONS.— 16 ‘‘(A) IN GENERAL.—The Advisory Com- 17 mittee shall develop, at the request of the Direc- 18 tor, recommendations for improvements to ad- 19 vance the cybersecurity mission of the Agency 20 and strengthen the cybersecurity of the United 21 States. 22 ‘‘(B) RECOMMENDATIONS OF SUBCOMMIT- 23 TEES.—Recommendations agreed upon by sub- 24 committees established under subsection (d) for 25 any year shall be approved by the Advisory 26 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 4024 RS Committee before the Advisory Committee sub- 1 mits to the Director the annual report under 2 paragraph (4) for that year. 3 ‘‘(3) PERIODIC REPORTS.—The Advisory Com- 4 mittee shall periodically submit to the Director— 5 ‘‘(A) reports on matters identified by the 6 Director; and 7 ‘‘(B) reports on other matters identified by 8 a majority of the members of the Advisory Com- 9 mittee. 10 ‘‘(4) ANNUAL REPORT.— 11 ‘‘(A) IN GENERAL.—The Advisory Com- 12 mittee shall submit to the Director an annual re- 13 port providing information on the activities, 14 findings, and recommendations of the Advisory 15 Committee, including its subcommittees, for the 16 preceding year. 17 ‘‘(B) PUBLICATION.—Not later than 180 18 days after the date on which the Director receives 19 an annual report for a year under subparagraph 20 (A), the Director shall publish a public version 21 of the report describing the activities of the Advi- 22 sory Committee and such related matters as 23 would be informative to the public during that 24 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 4024 RS year, consistent with section 552(b) of title 5, 1 United States Code. 2 ‘‘(5) FEEDBACK.—Not later than 90 days after 3 receiving any recommendation submitted by the Advi- 4 sory Committee under paragraph (2), (3), or (4), the 5 Director shall respond in writing to the Advisory 6 Committee with feedback on the recommendation. 7 Such a response shall include— 8 ‘‘(A) with respect to any recommendation 9 with which the Director concurs, an action plan 10 to implement the recommendation; and 11 ‘‘(B) with respect to any recommendation 12 with which the Director does not concur, a jus- 13 tification for why the Director does not plan to 14 implement the recommendation. 15 ‘‘(6) CONGRESSIONAL NOTIFICATION.—Not less 16 frequently than once per year after the date of enact- 17 ment of this section, the Director shall provide to the 18 Committee on Homeland Security and Governmental 19 Affairs and the Committee on Appropriations of the 20 Senate and the Committee on Homeland Security and 21 the Committee on Appropriations of the House of 22 Representatives a briefing on feedback from the Advi- 23 sory Committee. 24 VerDate Sep 11 2014 00:11 Sep 10, 2020 Jkt 099200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\S4024.RS S4024 pamtmann on DSKBC07HB2PROD with BILLS 13 •S 4024 RS ‘‘(7) GOVERNANCE RULES.—The Director shall 1 establish rules for the structure and governance of the 2 Advisory Committee and all subcommittees estab- 3 lished under subsection (d [Text truncated for display. Full text available on Congress.gov.]