Strengthening the Cybersecurity and Infrastructure Security Agency Act of 2020

I 116TH CONGRESS 2D SESSION H. R. 7588 To require the Secretary of Homeland Security to conduct a review of the ability of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to fulfill its current mission require- ments, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 13, 2020 Mr. KATKO (for himself, Mr. RUPPERSBERGER, and Mr. GALLAGHER) intro- duced the following bill; which was referred to the Committee on Home- land Security, and in addition to the Committees on Oversight and Re- form, Energy and Commerce, and Transportation and Infrastructure, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the com- mittee concerned A BILL To require the Secretary of Homeland Security to conduct a review of the ability of the Cybersecurity and Infra- structure Security Agency of the Department of Home- land Security to fulfill its current mission requirements, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 01:11 Aug 19, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS 2 •HR 7588 IH SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Strengthening the Cy- 2 bersecurity and Infrastructure Security Agency Act of 3 2020’’. 4 SEC. 2. CYBERSECURITY AND INFRASTRUCTURE SECURITY 5 AGENCY REVIEW. 6 (a) IN GENERAL.—The Director of the Cybersecurity 7 and Infrastructure Security Agency of the Department of 8 Homeland Security shall conduct a review of the ability 9 of the Cybersecurity and Infrastructure Security Agency 10 to carry out its mission requirements, as well as the rec- 11 ommendations detailed in the U.S. Cyberspace Solarium 12 Commission’s Report regarding the Agency. 13 (b) ELEMENTS OF REVIEW.—The review conducted 14 in accordance with subsection (a) shall include the fol- 15 lowing elements: 16 (1) An assessment of how additional budget re- 17 sources could be used by the Cybersecurity and In- 18 frastructure Security Agency for projects and pro- 19 grams that— 20 (A) support the national risk management 21 mission; 22 (B) support public and private-sector cy- 23 bersecurity; 24 (C) promote public-private integration; and 25 VerDate Sep 11 2014 00:29 Aug 02, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS 3 •HR 7588 IH (D) provide situational awareness of cyber- 1 security threats. 2 (2) A force structure assessment of the Cyber- 3 security and Infrastructure Security Agency, includ- 4 ing— 5 (A) a determination of the appropriate size 6 and composition of personnel to carry out the 7 mission requirements of the Agency, as well as 8 the recommendations detailed in the U.S. 9 Cyberspace Solarium Commission’s Report re- 10 garding the Agency; 11 (B) as assessment of whether existing per- 12 sonnel are appropriately matched to the 13 prioritization of threats in the cyber domain 14 and risks to critical infrastructure; 15 (C) an assessment of whether the Agency 16 has the appropriate personnel and resources 17 to— 18 (i) perform risk assessments, threat 19 hunting, and incident response to support 20 both private and public cybersecurity; 21 (ii) carry out its responsibilities re- 22 lated to the security of Federal information 23 and Federal information systems (as such 24 VerDate Sep 11 2014 00:29 Aug 02, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS 4 •HR 7588 IH term is defined in section 3502 of title 44, 1 United States Code); and 2 (iii) carry out its critical infrastruc- 3 ture responsibilities, including national risk 4 management; 5 (D) an assessment of whether current 6 structure, personnel, and resources of regional 7 field offices are sufficient to carry out Agency 8 responsibilities and mission requirements; and 9 (E) an assessment of current Cybersecu- 10 rity and Infrastructure Security Agency facili- 11 ties, including a review of the suitability of such 12 facilities to fully support current and projected 13 mission requirements nationally and regionally, 14 and recommendations regarding future facility 15 requirements. 16 (c) SUBMISSION OF REVIEW.—Not later than one 17 year after the date of the enactment of this Act, the Sec- 18 retary of Homeland Security shall submit to the Com- 19 mittee on Homeland Security of the House of Representa- 20 tives and the Committee on Homeland Security and Gov- 21 ernmental Affairs of the Senate a report detailing the re- 22 sult of the review conducted in accordance with subsection 23 (a), including recommendations to address any identified 24 gaps. 25 VerDate Sep 11 2014 00:29 Aug 02, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS 5 •HR 7588 IH SEC. 3. GENERAL SERVICES ADMINISTRATION REVIEW. 1 (a) SUBMISSION OF ASSESSMENT.—Upon submission 2 to the Committee on Homeland Security of the House of 3 Representatives and the Committee on Homeland Security 4 and Governmental Affairs of the Senate of the report re- 5 quired under section 2(c), the Director of the Cybersecu- 6 rity and Infrastructure Security Agency of the Depart- 7 ment of Homeland Security shall submit to the Adminis- 8 trator of the General Services Administration the results 9 of the assessment required under section (b)(2)(E). 10 (b) REVIEW.—The Administrator of the General 11 Services Administration shall— 12 (1) conduct a review of Cybersecurity and In- 13 frastructure Security Agency assessment required 14 under section 2(b)(2)(E); and 15 (2) make recommendations regarding resources 16 needed to procure or build a new facility or augment 17 existing facilities to ensure sufficient size and ac- 18 commodations to fully support current and projected 19 mission requirements, including the integration of 20 personnel from the private sector and other Federal 21 departments and agencies. 22 (c) SUBMISSION OF REVIEW.—Not later than 30 23 days after receipt of the assessment under subsection (a), 24 the Administrator of the General Services Administration 25 shall submit to the President, the Secretary of Homeland 26 VerDate Sep 11 2014 00:29 Aug 02, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS 6 •HR 7588 IH Security, the Committee on Homeland Security and Gov- 1 ernmental Affairs of the Senate, and the Committee on 2 Homeland Security of the House of Representatives the 3 review required under subsection (b). 4 Æ VerDate Sep 11 2014 00:29 Aug 02, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6301 E:\BILLS\H7588.IH H7588 SSpencer on DSK126QN23PROD with BILLS