To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a pilot program for the purpose of carrying out a talent exchange program between the private sector and the Cybersecurity and Infrastructure Security Agency, and for other purposes.

I 116TH CONGRESS 2D SESSION H. R. 7590 To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a pilot program for the purpose of carrying out a talent exchange program between the private sector and the Cybersecurity and Infrastructure Security Agency, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JULY 13, 2020 Mr. KATKO (for himself, Mr. BRINDISI, and Mr. GALLAGHER) introduced the following bill; which was referred to the Committee on Homeland Secu- rity, and in addition to the Committees on Oversight and Reform, and Energy and Commerce, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To establish in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security a pilot program for the purpose of carrying out a talent ex- change program between the private sector and the Cy- bersecurity and Infrastructure Security Agency, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 2 •HR 7590 IH SECTION 1. ESTABLISHMENT OF PUBLIC-PRIVATE TALENT 1 EXCHANGE FOR CYBERSECURITY SKILLS DE- 2 VELOPMENT. 3 (a) PURPOSE.—There is established, within the Cy- 4 bersecurity and Infrastructure Security Agency of the De- 5 partment of Homeland Security, a pilot program for the 6 purpose of carrying out a talent exchange program be- 7 tween the private sector and the Cybersecurity and Infra- 8 structure Security Agency (in this section referred to as 9 the ‘‘program’’) in order to— 10 (1) facilitate collaboration with the best and 11 most diverse minds from outside the Federal Gov- 12 ernment to improve national security; 13 (2) incorporate public and private sector talent 14 to challenge thinking, test innovative ideas, and en- 15 able greater understanding on cybersecurity, bring- 16 ing public and private sector expertise together in a 17 way that helps both sectors learn lessons, identify 18 systemic vulnerabilities, and reduce the future im- 19 pact of cyber attacks; and 20 (3) expand existing Cybersecurity and Infra- 21 structure Security Agency programs that integrate 22 private sector and interagency personnel. 23 (b) REQUIREMENTS.—In carrying out the program, 24 the Director of the Cybersecurity and Infrastructure Secu- 25 rity Agency shall— 26 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 3 •HR 7590 IH (1) promote public-private cooperation and in- 1 telligence sharing; 2 (2) develop and publicize the knowledge, skills, 3 and abilities, including relevant education, training, 4 apprenticeships, certifications, and other experi- 5 ences, that are required to participate in the pro- 6 gram; 7 (3) provide for participation by cleared and 8 uncleared public and private employees; and 9 (4) develop a plan and application process for 10 the private sector to participate in the program. 11 (c) ASSIGNMENT AUTHORITY.—The Director of the 12 Cybersecurity and Infrastructure Security Agency may, 13 with the agreement of a private sector entity and the con- 14 sent of a employee of the Agency or such entity, as the 15 case may be, arrange for the temporary assignment of— 16 (1) such employee of the Agency to such entity; 17 or 18 (2) such employee of such entity to the Agency. 19 (d) AGREEMENTS.— 20 (1) IN GENERAL.—Before any temporary as- 21 signment may be made under the program, the Di- 22 rector of the Cybersecurity and Infrastructure Secu- 23 rity Agency shall enter into a written agreement 24 with the private sector entity and the employee con- 25 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 4 •HR 7590 IH cerned regarding the terms and conditions of such 1 assignment, which shall— 2 (A) require that an employee of the Cyber- 3 security and Infrastructure Security Agency, 4 upon completion of such assignment, serve in 5 the Cybersecurity and Infrastructure Security 6 Agency, or, if appropriate, elsewhere in the civil 7 service, for a period of time equal to at least 8 twice the length of such assignment; 9 (B) provide that if an employee of the Cy- 10 bersecurity and Infrastructure Security Agency 11 or of the private sector entity, as the case may 12 be, fails to abide by the terms of such agree- 13 ment, such employee shall be liable to the 14 United States for payment of all expenses of 15 the assignment of such employee, including the 16 value of the salary and benefits of such em- 17 ployee, unless such failure was for good cause 18 as determined by the Director of the Cybersecu- 19 rity and Infrastructure Security Agency; and 20 (C) contain language prohibiting an em- 21 ployee of the Cybersecurity and Infrastructure 22 Security Agency from improperly utilizing pre- 23 decisional or draft deliberative information such 24 employee may be privy to or aware of related to 25 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 5 •HR 7590 IH Department of Homeland Security programing, 1 budgeting, resourcing, acquisition, or procure- 2 ment for the benefit or advantage of the private 3 sector entity at which such employee is tempo- 4 rarily assigned. 5 (2) COLLECTION OF COSTS.— 6 (A) IN GENERAL.—An amount for which 7 an employee is liable under paragraph (1)(B) 8 shall be treated as a debt due the United 9 States. 10 (B) WAIVER.—The Director may waive, in 11 whole or in part, collection of a debt described 12 in subparagraph (A) based on a determination 13 that the collection would be against equity and 14 good conscience and not in the best interests of 15 the United States, after taking into account any 16 indication of fraud, misrepresentation, fault, or 17 lack of good faith on the part of the employee 18 concerned. 19 (e) TERMINATION.—An assignment under the pro- 20 gram may, at any time and for any reason, be terminated 21 by the Director of the Cybersecurity and Infrastructure 22 Security Agency or the private sector entity concerned. 23 (f) DURATION.— 24 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 6 •HR 7590 IH (1) IN GENERAL.—An assignment under the 1 program shall be for a period of not less than one 2 year and not more than three years. 3 (2) CISA EMPLOYEES.—No employee of the 4 Cybersecurity and Infrastructure Security Agency 5 may be assigned under the program for more than 6 a total of four years inclusive of all such assign- 7 ments. 8 (g) STATUS OF FEDERAL EMPLOYEES ASSIGNED TO 9 PRIVATE-SECTOR ENTITIES.—An employee of the Cyber- 10 security and Infrastructure Security Agency who is as- 11 signed to a private sector entity under the program shall 12 be considered, during the period of such assignment, to 13 be employed by the Cybersecurity and Infrastructure Se- 14 curity Agency for all purposes. 15 (h) MISSION CONTINUITY.—Before authorizing the 16 temporary assignment of an employee of the Cybersecurity 17 and Infrastructure Security Agency to a private sector en- 18 tity under the program, the Director of the Cybersecurity 19 and Infrastructure Security Agency shall— 20 (1) ensure that the normal duties and functions 21 of such employee can be reasonably performed by 22 other employees of the Cybersecurity and Infrastruc- 23 ture Security Agency without the permanent trans- 24 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 7 •HR 7590 IH fer or reassignment of other personnel of the Cyber- 1 security and Infrastructure Security Agency; 2 (2) ensure that the normal duties and functions 3 of such employee are not, as a result of and during 4 the course of such assignment, performed or aug- 5 mented by contractor personnel in violation of sec- 6 tion 1710 of title 41, United States Code; and 7 (3) certify that such assignment shall not have 8 an adverse or negative impact on mission attainment 9 or organizational capabilities associated with such 10 assignment. 11 (i) TERMS AND CONDITIONS FOR PRIVATE-SECTOR 12 EMPLOYEES.—An employee of a private sector entity who 13 is assigned to the Cybersecurity and Infrastructure Secu- 14 rity Agency under the program— 15 (1) shall continue to receive pay and benefits 16 from the private sector entity from which such em- 17 ployee is assigned and may not receive pay or bene- 18 fits from the Cybersecurity and Infrastructure Secu- 19 rity Agency; 20 (2) may not have access to any trade secrets or 21 to any other nonpublic information which is of com- 22 mercial value to such private sector entity; 23 (3) may perform work that is considered inher- 24 ently governmental in nature only when requested in 25 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 8 •HR 7590 IH writing by the Director of the Cybersecurity and In- 1 frastructure Security Agency; and 2 (4) may not be used to circumvent the provi- 3 sions of section 1710 of title 41, United States 4 Code. 5 (j) REPORTING REQUIREMENT.—The Director of the 6 Cybersecurity and Infrastructure Security Agency shall 7 submit to the Committee on Homeland Security and Gov- 8 ernmental Affairs of the Senate and the Committee on 9 Homeland Security of the House of Representatives, not 10 later than 1 month after the end of the fiscal year in- 11 volved, a report on any activities carried out utilizing the 12 authorities provided by this section during that fiscal year, 13 including information concerning— 14 (1) the private sector entities to and from which 15 employees were assigned under the program; 16 (2) the positions such employees held while so 17 assigned; 18 (3) a description of the tasks such employees 19 performed while so assigned; and 20 (4) a discussion of any actions that might be 21 taken to improve the effectiveness of the program, 22 including any proposed changes in law. 23 (k) SENSE OF CONGRESS.—It is the sense of Con- 24 gress that— 25 VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS 9 •HR 7590 IH (1) value is derived from the program when 1 participants are meaningfully integrated into their 2 host entities, which will often require a personnel se- 3 curity clearance process for participants from the 4 private sector; 5 (2) the success of the program, and the work- 6 force development efforts critical for the success of 7 key national security priorities more generally, are 8 severely hampered by the current personnel security 9 clearance process; and 10 (3) until such time as the wait times for per- 11 sonnel security clearances meet the stated goals of 12 Federal departments and agencies, in order to im- 13 plement the program, the Director of the Cybersecu- 14 rity and Critical Infrastructure Agency should en- 15 courage— 16 (A) declassification of information as 17 broadly and quickly as possible; and 18 (B) participation of the private sector at 19 the unclassified level to promote open dialogue 20 and information sharing outside the classified 21 space. 22 Æ VerDate Sep 11 2014 21:52 Aug 03, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6301 E:\BILLS\H7590.IH H7590 pbinns on DSKJLVW7X2PROD with BILLS