National Cybersecurity Awareness Act

II Calendar No. 382 118TH CONGRESS 2D SESSION S. 1835 [Report No. 118–171] To require the Cybersecurity and Infrastructure Security Agency of the De- partment of Homeland Security to develop a campaign program to raise awareness regarding the importance of cybersecurity in the United States. IN THE SENATE OF THE UNITED STATES JUNE 6, 2023 Mr. PETERS (for himself and Mr. CASSIDY) introduced the following bill; which was read twice and referred to the Committee on Homeland Secu- rity and Governmental Affairs MAY 9, 2024 Reported by Mr. PETERS, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To require the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security to de- velop a campaign program to raise awareness regarding the importance of cybersecurity in the United States. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 2 •S 1835 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘National Cybersecurity 2 Awareness Act’’. 3 SEC. 2. FINDINGS. 4 Congress finds the following: 5 (1) The presence of ubiquitous internet-con- 6 nected devices in the everyday lives of citizens of the 7 United States has created opportunities for constant 8 connection and modernization. 9 (2) A connected society is subject to cybersecu- 10 rity threats that can compromise even the most per- 11 sonal and sensitive of information. 12 (3) Connected critical infrastructure is subject 13 to cybersecurity threats that can compromise funda- 14 mental economic and health and safety functions. 15 (4) The Government of the United States plays 16 an important role in safeguarding the nation from 17 malicious cyber activity. 18 (5) A citizenry that is knowledgeable regarding 19 cybersecurity is critical to building a robust cyberse- 20 curity posture and reducing the threat of cyber 21 attackers stealing sensitive information and causing 22 public harm. 23 (6) While Cybersecurity Awareness Month is 24 critical to supporting national cybersecurity aware- 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 3 •S 1835 RS ness, it cannot be a once-a-year activity and must be 1 a sustained, constant effort. 2 SEC. 3. CYBERSECURITY AWARENESS. 3 (a) IN GENERAL.—Subtitle A of title XXII of the 4 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 5 is amended by adding at the end the following: 6 ‘‘SEC. 2220F. CYBERSECURITY AWARENESS CAMPAIGNS. 7 ‘‘(a) DEFINITION.—In this section, the term ‘Cam- 8 paign Program’ means the campaign program established 9 under subsection (b). 10 ‘‘(b) AWARENESS CAMPAIGN PROGRAM.— 11 ‘‘(1) IN GENERAL.—Not later than 90 days 12 after the date of enactment of the National Cyberse- 13 curity Awareness Act, the Director shall establish a 14 program for planning and coordinating Federal cy- 15 bersecurity awareness campaigns. 16 ‘‘(2) ACTIVITIES.—In carrying out the Cam- 17 paign Program, the Director shall— 18 ‘‘(A) inform non-Federal entities of vol- 19 untary cyber hygiene best practices, including 20 information on how to— 21 ‘‘(i) prevent cyberattacks; and 22 ‘‘(ii) mitigate cybersecurity risks; and 23 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 4 •S 1835 RS ‘‘(B) consult with private sector entities, 1 State, local, Tribal, and territorial governments, 2 academia, and civil society— 3 ‘‘(i) to promote cyber hygiene best 4 practices, including by focusing on tactics 5 that are cost effective and result in signifi- 6 cant cybersecurity improvement, such as— 7 ‘‘(I) maintaining strong pass- 8 words and the use of password man- 9 agers; 10 ‘‘(II) enabling multi-factor au- 11 thentication, including phishing-resist- 12 ant multi-factor authentication; 13 ‘‘(III) regularly installing soft- 14 ware updates; 15 ‘‘(IV) using caution with email 16 attachments and website links; and 17 ‘‘(V) other cyber hygienic consid- 18 erations, as appropriate; 19 ‘‘(ii) to promote awareness of cyberse- 20 curity risks and mitigation with respect to 21 malicious applications on internet-con- 22 nected devices, including applications to 23 control those devices or use devices for un- 24 authorized surveillance of users; 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 5 •S 1835 RS ‘‘(iii) to help consumers identify prod- 1 ucts that are designed to support user and 2 product security, such as products de- 3 signed using the Secure-by-Design and Se- 4 cure-by-Default principles of the Agency; 5 ‘‘(iv) to coordinate with other Federal 6 agencies and departments, as determined 7 appropriate by the Director, to— 8 ‘‘(I) promote relevant cybersecu- 9 rity-related awareness activities; and 10 ‘‘(II) ensure the Federal Govern- 11 ment is coordinated in communicating 12 accurate and timely cybersecurity in- 13 formation; and 14 ‘‘(v) to expand nontraditional out- 15 reach mechanisms to ensure that entities 16 including low-income and rural commu- 17 nities, small and medium sized businesses 18 and institutions, and State, local, Tribal, 19 and territorial partners receive cybersecu- 20 rity awareness outreach in an equitable 21 manner. 22 ‘‘(3) REPORTING.— 23 ‘‘(A) IN GENERAL.—Not later than 180 24 days after the date of enactment of the Na- 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 6 •S 1835 RS tional Cybersecurity Awareness Act, and annu- 1 ally thereafter, the Director shall, in consulta- 2 tion with the heads of appropriate Federal 3 agencies, submit to the appropriate congres- 4 sional committees a report regarding the Cam- 5 paign Program. 6 ‘‘(B) CONTENTS.—Each report submitted 7 pursuant to subparagraph (A) shall include— 8 ‘‘(i) a summary of the activities of the 9 Agency that support promoting cybersecu- 10 rity awareness under the Campaign Pro- 11 gram, including consultations made under 12 paragraph (2)(B); 13 ‘‘(ii) an assessment of the effective- 14 ness of techniques and methods used to 15 promote national cybersecurity awareness 16 under the Campaign Program; and 17 ‘‘(iii) recommendations on how to best 18 promote cybersecurity awareness nation- 19 ally. 20 ‘‘(c) CYBERSECURITY CAMPAIGN RESOURCES.— 21 ‘‘(1) IN GENERAL.—Not later than 180 days 22 after the date of enactment of the National Cyberse- 23 curity Awareness Act, the Director shall develop and 24 maintain a central repository for the resources, 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6401 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 7 •S 1835 RS tools, and public communications of the Agency that 1 promote cybersecurity awareness. 2 ‘‘(2) REQUIREMENTS.—The resources described 3 in paragraph (1) shall be— 4 ‘‘(A) made publicly available online; and 5 ‘‘(B) regularly updated to ensure the pub- 6 lic has access to relevant and timely cybersecu- 7 rity awareness information.’’. 8 (b) RESPONSIBILITIES OF THE CYBERSECURITY AND 9 INFRASTRUCTURE SECURITY AGENCY.—Section 2202(c) 10 of the Homeland Security Act of 2002 (6 U.S.C. 652(c)) 11 is amended— 12 (1) in paragraph (13), by striking ‘‘; and’’ and 13 inserting a semicolon; 14 (2) by redesignating paragraph (14) as para- 15 graph (15); and 16 (3) by inserting after paragraph (13) the fol- 17 lowing: 18 ‘‘(14) lead and coordinate Federal efforts to 19 promote national cybersecurity awareness; and’’. 20 (c) CLERICAL AMENDMENT.—The table of contents 21 in section 1(b) of the Homeland Security Act of 2002 22 (Public Law 107–296; 116 Stat. 2135) is amended by in- 23 serting after the item relating to section 2220E the fol- 24 lowing: 25 ‘‘Sec. 2220F. Cybersecurity awareness campaigns’’. VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6411 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 8 •S 1835 RS SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘National Cybersecurity 2 Awareness Act’’. 3 SEC. 2. FINDINGS. 4 Congress finds the following: 5 (1) The presence of ubiquitous internet-connected 6 devices in the everyday lives of citizens of the United 7 States has created opportunities for constant connec- 8 tion and modernization. 9 (2) A connected society is subject to cybersecurity 10 threats that can compromise even the most personal 11 and sensitive of information. 12 (3) Connected critical infrastructure is subject to 13 cybersecurity threats that can compromise funda- 14 mental economic, health, and safety functions. 15 (4) The Government of the United States plays 16 an important role in safeguarding the nation from 17 malicious cyber activity. 18 (5) A citizenry that is knowledgeable regarding 19 cybersecurity is critical to building a robust cyberse- 20 curity posture and reducing the threat of cyber 21 attackers stealing sensitive information and causing 22 public harm. 23 (6) While Cybersecurity Awareness Month is 24 critical to supporting national cybersecurity aware- 25 ness, it cannot be a once-a-year activity, and there 26 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 9 •S 1835 RS must be a sustained, constant effort to raise aware- 1 ness about cyber hygiene, encourage individuals in 2 the United States to learn cyber skills, and commu- 3 nicate the ways that cyber skills and careers in cyber 4 advance individual and societal security, privacy, 5 safety, and well-being. 6 SEC. 3. CYBERSECURITY AWARENESS. 7 (a) IN GENERAL.—Subtitle A of title XXII of the 8 Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) is 9 amended by adding at the end the following: 10 ‘‘SEC. 2220F. CYBERSECURITY AWARENESS CAMPAIGNS. 11 ‘‘(a) DEFINITION.—In this section, the term ‘Cam- 12 paign Program’ means the campaign program established 13 under subsection (b)(1). 14 ‘‘(b) AWARENESS CAMPAIGN PROGRAM.— 15 ‘‘(1) IN GENERAL.—Not later than 90 days after 16 the date of enactment of the National Cybersecurity 17 Awareness Act, the Director, in coordination with ap- 18 propriate Federal agencies, shall establish a program 19 for planning and coordinating Federal cybersecurity 20 awareness campaigns. 21 ‘‘(2) ACTIVITIES.—In carrying out the Cam- 22 paign Program, the Director shall— 23 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 10 •S 1835 RS ‘‘(A) inform non-Federal entities of vol- 1 untary cyber hygiene best practices, including 2 information on how to— 3 ‘‘(i) prevent cyberattacks; and 4 ‘‘(ii) mitigate cybersecurity risks; and 5 ‘‘(B) consult with private sector entities, 6 State, local, Tribal, and territorial governments, 7 academia, nonprofit organizations, and civil so- 8 ciety— 9 ‘‘(i) to promote cyber hygiene best 10 practices and the importance of cyber skills, 11 including by focusing on tactics that are 12 cost effective and result in significant cyber- 13 security improvement, such as— 14 ‘‘(I) maintaining strong pass- 15 words and the use of password man- 16 agers; 17 ‘‘(II) enabling multi-factor au- 18 thentication, including phishing-resist- 19 ant multi-factor authentication; 20 ‘‘(III) regularly installing soft- 21 ware updates; 22 ‘‘(IV) using caution with email 23 attachments and website links; and 24 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 11 •S 1835 RS ‘‘(V) other cyber hygienic consid- 1 erations, as appropriate; 2 ‘‘(ii) to promote awareness of cyberse- 3 curity risks and mitigation with respect to 4 malicious applications on internet-con- 5 nected devices, including applications to 6 control those devices or use devices for un- 7 authorized surveillance of users; 8 ‘‘(iii) to help consumers identify prod- 9 ucts that are designed to support user and 10 product security, such as products designed 11 using the Secure-by-Design and Secure-by- 12 Default principles of the Agency or the Rec- 13 ommended Criteria for Cybersecurity Label- 14 ing for Consumer Internet of Things (IoT) 15 Products of the National Institute of Stand- 16 ards and Technology, published February 4, 17 2022 (or any subsequent version); 18 ‘‘(iv) to coordinate with other Federal 19 agencies, as determined appropriate by the 20 Director, to— 21 ‘‘(I) develop and promote relevant 22 cybersecurity-related and cyber skills- 23 related awareness activities and re- 24 sources; and 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 12 •S 1835 RS ‘‘(II) ensure the Federal Govern- 1 ment is coordinated in communicating 2 accurate and timely cybersecurity in- 3 formation; 4 ‘‘(v) to expand nontraditional outreach 5 mechanisms to ensure that entities, includ- 6 ing low-income and rural communities, 7 small and medium sized businesses and in- 8 stitutions, and State, local, Tribal, and ter- 9 ritorial partners, receive cybersecurity 10 awareness outreach in an equitable manner; 11 and 12 ‘‘(vi) to encourage participation in 13 cyber workforce development ecosystems and 14 to expand adoption of best practices to grow 15 the national cyber workforce. 16 ‘‘(3) REPORTING.— 17 ‘‘(A) IN GENERAL.—Not later than 180 18 days after the date of enactment of the National 19 Cybersecurity Awareness Act, and annually 20 thereafter, the Director, in consultation with the 21 heads of appropriate Federal agencies, shall sub- 22 mit to the appropriate congressional committees 23 a report regarding the Campaign Program. 24 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\S1835.RS S1835 kjohnson on DSK7ZCZBW3PROD with $$_JOB 13 •S 1835 RS ‘‘(B) CONTENTS.—Each report submitted 1 pursuant to subparagraph (A) shall include— 2 ‘‘(i) a summary of the activities of the 3 Agency that support promoting cybersecu- 4 rity awareness under the Campaign Pro- 5 gram, including consultations made under 6 paragraph (2)(B); 7 ‘‘(ii) an assessment of the effectiveness 8 of techniques and methods used to promote 9 national cybersecurity awareness under the 10 [Text truncated for display. Full text available on Congress.gov.]