The National Protection and Programs Directorate of the Department shall, on and after November 16, 2018, be known as the "Cybersecurity and Infrastructure Security Agency".
Any reference to the National Protection and Programs Directorate of the Department in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Cybersecurity and Infrastructure Security Agency of the Department.
The Agency shall be headed by the Director, who shall report to the Secretary.
The Director shall be appointed from among individuals who have-
The areas specified in this subparagraph are the following:
Any reference to an Under Secretary responsible for overseeing critical infrastructure protection, cybersecurity, and any other related program of the Department as described in section 113(a)(1)(H) of this title as in effect on the day before November 16, 2018, in any law, regulation, map, document, record, or other paper of the United States shall be deemed to be a reference to the Director of the Cybersecurity and Infrastructure Security Agency.
The Director shall-
There shall be in the Agency a Deputy Director of the Cybersecurity and Infrastructure Security Agency who shall-
The responsibilities of the Secretary relating to cybersecurity and infrastructure security shall include the following:
The Secretary may reallocate within the Agency the functions specified in sections 653(b) and 654(b) of this title, consistent with the responsibilities provided in paragraph (1), upon certifying to and briefing the appropriate congressional committees, and making available to the public, at least 60 days prior to the reallocation that the reallocation is necessary for carrying out the activities of the Agency.
The Secretary shall provide the Agency with a staff of analysts having appropriate expertise and experience to assist the Agency in discharging the responsibilities of the Agency under this section.
Analysts under this subsection may include analysts from the private sector.
Analysts under this subsection shall possess security clearances appropriate for their work under this section.
In order to assist the Agency in discharging the responsibilities of the Agency under this section, personnel of the Federal agencies described in subparagraph (B) may be detailed to the Agency for the performance of analytic functions and related duties.
The Federal agencies described in this subparagraph are-
The Secretary and the head of a Federal agency described in subparagraph (B) may enter into agreements for the purpose of detailing personnel under this paragraph.
The detail of personnel under this paragraph may be on a reimbursable or non-reimbursable basis.
The Agency shall be composed of the following divisions:
To the maximum extent practicable, the Director shall examine the establishment of central locations in geographical regions with a significant Agency presence.
When establishing the central locations described in paragraph (1), the Director shall coordinate with component heads and the Under Secretary for Management to co-locate or partner on any new real property leases, renewing any occupancy agreements for existing leases, or agreeing to extend or newly occupy any Federal space or new construction.
There shall be a Privacy Officer of the Agency with primary responsibility for privacy policy and compliance for the Agency.
The responsibilities of the Privacy Officer of the Agency shall include-
Nothing in this subchapter may be construed as affecting in any manner the authority, existing on the day before November 16, 2018, of any other component of the Department or any other Federal department or agency, including the authority provided to the Sector Risk Management Agency specified in section 61003(c) of division F of the Fixing America's Surface Transportation Act (6 U.S.C. 121 note; Public Law 114-94).
6 U.S.C. § 652
EDITORIAL NOTES
REFERENCES IN TEXTThe Cybersecurity Act of 2015, referred to in subsec. (c)(3), is div. N of Pub. L. 114-113, 129 Stat. 2935. For complete classification of this Act to the Code, see Short Title note set out under section 1501 of this title and Tables.This chapter, referred to in subsecs. (c)(7) and (e)(1)(J), was in the original "this Act", meaning Pub. L. 107-296, 116 Stat. 2135, known as the Homeland Security Act of 2002, which is classified principally to this chapter. For complete classification of this Act to the Code, see Short Title note set out under section 101 of this title and Tables.
AMENDMENTS2022- Pub. L. 117-263, §7143(a)(1), made amendment identical to that made by Pub. L. 117-81, §1547(b)(1)(B). See 2021 Amendment note below.Subsec. (a)(1). Pub. L. 117-263, §7143(b)(2)(C)(i), which directed striking out "(in this part referred to as the Agency)", was executed by striking out "(in this part referred to as the 'Agency')" before period at end, to reflect the probable intent of Congress.Subsec. (b)(1). Pub. L. 117-263, §7143(b)(2)(C)(ii), substituted "the Director" for "a Director of Cybersecurity and Infrastructure Security (in this part referred to as the 'Director')".Subsec. (b)(3). Pub. L. 117-263, §7143(c)(5)(A), substituted "Director of the Cybersecurity and Infrastructure Security Agency" for "Director of Cybersecurity and Infrastructure Security of the Department".Subsec. (d). Pub. L. 117-263, §7143(c)(5)(B), substituted "Director of the Cybersecurity and Infrastructure Security Agency" for "Director of Cybersecurity and Infrastructure Security" in introductory provisions.Subsec. (f). Pub. L. 117-263, §7143(b)(2)(C)(iii), inserted "Executive" before "Assistant Director" in pars. (1) to (3).2021- Pub. L. 117-81, §1547(b)(1)(B), made technical amendment to directory language of Pub. L. 116-260, §904(b)(1). See 2020 Amendment notes below.Subsec. (b)(2), (3). Pub. L. 116-283, §9001(a), added par. (2) and redesignated former par. (2) as (3).Subsec. (c)(3). Pub. L. 117-81, §1549(a), substituted ", including by carrying out a periodic strategic assessment of the related programs and activities of the Agency to ensure such programs and activities contemplate the innovation of information systems and changes in cybersecurity risks and cybersecurity threats;" for semicolon at end.Subsec. (c)(10). Pub. L. 116-283, §§1717(a)(1)(A)(i), 1719, which directed identical amendments of par. (10) by striking out "and" at end, could not be executed because the word "and" did not appear at end after amendment by Pub. L. 116-260, §904(b)(1)(A)(i). See 2020 Amendment note below.Subsec. (c)(11). Pub. L. 117-81, §1547(b)(1)(A)(i)(I), struck out "and" after the semicolon. Pub. L. 116-283, §1719(b)(3), added par. (11) relating to providing education, training, and capacity development to Federal and non-Federal entities. Former par. (11), relating to appointment of a Cybersecurity State Coordinator, redesignated (12). Pub. L. 116-283, §1717(a)(1)(A)(iii), added par. (11) relating to appointment of a Cybersecurity State Coordinator. Former par. (11), relating to the .gov internet domain, redesignated (12).Subsec. (c)(12). Pub. L. 117-81, §1547(b)(1)(A)(i)(II), struck out "and" at end and made technical amendment to reference in original Act which appears in text as reference to section 665c of this title. Pub. L. 116-283, §1719(b)(2), redesignated par. (11) relating to appointment of a Cybersecurity State Coordinator as (12). Pub. L. 116-283, §1717(a)(1)(A)(ii), redesignated par. (11) relating to the .gov internet domain as (12).Subsec. (c)(13). Pub. L. 117-81, §1547(b)(1)(A)(i)(III), redesignated par. (12) relating to the .gov internet domain as (13).Subsec. (c)(14). Pub. L. 117-81, §1547(b)(1)(A)(i)(IV), redesignated par. (12) relating to carrying out such other duties and powers as (14).Subsec. (e)(1)(R). Pub. L. 116-283, §1719(a), added subpar. (R).Subsec. (i). Pub. L. 116-283, §9002(c)(2)(D), substituted "Sector Risk Management Agency" for "Sector-Specific Agency".2020-Subsec. (c)(10). Pub. L. 116-260, §904(b)(1)(A)(i), as amended by Pub. L. 117-81, §1547(b)(1)(B), struck out "and" at end.Subsec. (c)(11), (12). Pub. L. 116-260, §904(b)(1)(A)(ii), (iii), as amended by Pub. L. 117-81, §1547(b)(1)(B), added par. (11) relating to the .gov internet domain and redesignated former par. (11) relating to carrying out such other duties and powers as (12).
STATUTORY NOTES AND RELATED SUBSIDIARIES
EFFECTIVE DATE OF 2022 AMENDMENT Pub. L. 117-263, div. G, title LXXI, §7143(a)(2), Dec. 23, 2022, 136 Stat. 3654, provided that: "The amendment made by paragraph (1) [amending this section and section 665 of this title] shall take effect as if enacted as part of the DOTGOV Act of 2020 (title IX of division U of Public Law 116-260)."
CONSTRUCTION OF 2022 AMENDMENTNothing in amendment made by Pub. L. 117-263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117-263 set out as a note under section 650 of this title.
CONSTRUCTION OF 2021 AMENDMENTAmendment by section 1717(a)(1)(A) of Pub. L. 116-283 not to be construed to affect or otherwise modify the authority of Federal law enforcement agencies with respect to investigations relating to cybersecurity incidents, see section 1717(a)(4) of Pub. L. 116-283 set out as a note under section 665c of this title.
NATIONAL CYBERSECURITY PREPAREDNESS CONSORTIUM Pub. L. 117-122, 136 Stat. 1193, provided that:
"SECTION 1. SHORT TITLE."This Act may be cited as the 'National Cybersecurity Preparedness Consortium Act of 2021'.
"SEC. 2. NATIONAL CYBERSECURITY PREPAREDNESS CONSORTIUM."(a) IN GENERAL.-The Secretary may work with one or more consortia to support efforts to address cybersecurity risks and incidents."(b) ASSISTANCE TO DHS.-The Secretary may work with one or more consortia to carry out the Secretary's responsibility pursuant to section 2202(e)(1)(P) of the Homeland Security Act of 2002 (6 U.S.C. 652(e)(1)(P)) to-"(1) provide training and education to State, Tribal, and local first responders and officials specifically for preparing for and responding to cybersecurity risks and incidents, in accordance with applicable law;"(2) develop and update a curriculum utilizing existing training and educational programs and models in accordance with section 2209 of the Homeland Security Act of 2002 (6 U.S.C. 659), for State, Tribal, and local first responders and officials, related to cybersecurity risks and incidents;"(3) provide technical assistance services, training, and educational programs to build and sustain capabilities in support of preparedness for and response to cybersecurity risks and incidents, including threats of acts of terrorism, in accordance with such section 2209;"(4) conduct cross-sector cybersecurity training, education, and simulation exercises for entities, including State and local governments and Tribal organizations, critical infrastructure owners and operators, and private industry, to encourage community-wide coordination in defending against and responding to cybersecurity risks and incidents, in accordance with section 2210(c) of the Homeland Security Act of 2002 (6 U.S.C. 660(c));"(5) help States, Tribal organizations, and communities develop cybersecurity information sharing programs, in accordance with section 2209 of the Homeland Security Act of 2002 (6 U.S.C. 659), for the dissemination of homeland security information related to cybersecurity risks and incidents;"(6) help incorporate cybersecurity risk and incident prevention and response into existing State, Tribal, and local emergency plans, including continuity of operations plans; and"(7) assist State governments and Tribal organizations in developing cybersecurity plans."(c) CONSIDERATIONS REGARDING SELECTION OF A CONSORTIUM.-In selecting a consortium with which to work under this Act, the Secretary shall take into consideration the following:"(1) Prior experience conducting cybersecurity training, education, and exercises for State and local entities."(2) Geographic diversity of the members of any such consortium so as to maximize coverage of the different regions of the United States."(3) The participation in such consortium of one or more historically Black colleges and universities, Hispanic-serving institutions, Tribal Colleges and Universities, other minority-serving institutions, and community colleges that participate in the National Centers of Excellence in Cybersecurity program, as carried out by the Department of Homeland Security."(d) METRICS.-If the Secretary works with a consortium under subsection (a), the Secretary shall measure the effectiveness of the activities undertaken by the consortium under this Act."(e) OUTREACH.-The Secretary shall conduct outreach to universities and colleges, including, in particular, outreach to historically Black colleges and universities, Hispanic-serving institutions, Tribal Colleges and Universities, other minority-serving institutions, and community colleges, regarding opportunities to support efforts to address cybersecurity risks and incidents, by working with the Secretary under subsection (a)."(f) RULE OF CONSTRUCTION.-Nothing in this section may be construed to authorize a consortium to control or direct any law enforcement agency in the exercise of the duties of the law enforcement agency."(g) DEFINITIONS.-In this section-"(1) the term 'community college' has the meaning given the term 'junior or community college' in section 312 of the Higher Education Act of 1965 (20 U.S.C. 1058);"(2) the term 'consortium' means a group primarily composed of nonprofit entities, including academic institutions, that develop, update, and deliver cybersecurity training and education in support of homeland security;"(3) the terms 'cybersecurity risk' and 'incident' have the meanings given those terms in section 2209(a) of the Homeland Security Act of 2002 (6 U.S.C. 659(a)) [see 6 U.S.C. 650(7), (12)] ;"(4) the term 'Department' means the Department of Homeland Security;"(5) the term 'Hispanic-serving institution' has the meaning given the term in section 502 of the Higher Education Act of 1965 (20 U.S.C. 1101a);"(6) the term 'historically Black college and university' has the meaning given the term 'part B institution' in section 322 of the Higher Education Act of 1965 (20 U.S.C. 1061);"(7) the term 'minority-serving institution' means an institution of higher education described in section 371(a) of the Higher Education Act of 1965 (20 U.S.C. 1067q(a));"(8) the term 'Secretary' means the Secretary of Homeland Security;"(9) The term 'State' means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the United States Virgin Islands, Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, and any possession of the United States;"(10) the term 'Tribal Colleges and Universities' has the meaning given the term in section 316 of the Higher Education Act of 1965 (20 U.S.C. 1059c); and"(11) the term 'Tribal organization' has the meaning given the term in section 4(e) of the Indian Self-Determination and Education Assistance Act (2 5 U.S.C. 5304(e))."
RANSOMWARE VULNERABILITY WARNING PILOT PROGRAM Pub. L. 117-103, div. Y, §105, Mar. 15, 2022, 136 Stat. 1055, provided that:"(a) PROGRAM.-Not later than 1 year after the date of enactment of this Act [Mar. 15, 2022], the Director [of the Cybersecurity and Infrastructure Security Agency] shall establish a ransomware vulnerability warning pilot program to leverage existing authorities and technology to specifically develop processes and procedures for, and to dedicate resources to, identifying information systems that contain security vulnerabilities associated with common ransomware attacks, and to notify the owners of those vulnerable systems of their security vulnerability."(b) IDENTIFICATION OF VULNERABLE SYSTEMS.-The pilot program established under subsection (a) shall-"(1) identify the most common security vulnerabilities utilized in ransomware attacks and mitigation techniques; and"(2) utilize existing authorities to identify information systems that contain the security vulnerabilities identified in paragraph (1)."(c) ENTITY NOTIFICATION.-"(1) IDENTIFICATION.-If the Director is able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may notify the owner of the information system."(2) NO IDENTIFICATION.-If the Director is not able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection (b), the Director may utilize the subpoena authority pursuant to section 2209 of the Homeland Security Act of 2002 (6 U.S.C. 659) to identify and notify the entity at risk pursuant to the procedures under that section."(3) REQUIRED INFORMATION.-A notification made under paragraph (1) shall include information on the identified security vulnerability and mitigation techniques."(d) PRIORITIZATION OF NOTIFICATIONS.-To the extent practicable, the Director shall prioritize covered entities for identification and notification activities under the pilot program established under this section."(e) LIMITATION ON PROCEDURES.-No procedure, notification, or other authorities utilized in the execution of the pilot program established under subsection (a) shall require an owner or operator of a vulnerable information system to take any action as a result of a notice of a security vulnerability made pursuant to subsection (c)."(f) RULE OF CONSTRUCTION.-Nothing in this section shall be construed to provide additional authorities to the Director to identify vulnerabilities or vulnerable systems."(g) TERMINATION.-The pilot program established under subsection (a) shall terminate on the date that is 4 years after the date of enactment of this Act."[For definitions of terms used in section 105 of div. Y of Pub. L. 117-103 set out above, see section 681 of this title, as made applicable by section 102(1) of div. Y of Pub. L. 117-103 which is set out as a note under section 665j of this title, and see section 650 of this title, as made applicable by section 7143(f)(2) of div. G of Pub. L. 117-263 which is set out as a note under section 650 of this title.]
PILOT PROGRAM ON PUBLIC-PRIVATE PARTNERSHIPS WITH INTERNET ECOSYSTEM COMPANIES TO DETECT AND DISRUPT ADVERSARY CYBER OPERATIONS Pub. L. 117-81, div. A, title XV, §15501550,, 135 Stat. 2064, provided that:"(a) PILOT REQUIRED.-Not later than one year after the date of the enactment of this Act [Dec. 27, 2021], the Secretary, acting through the Director of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security and in coordination with the Secretary of Defense and the National Cyber Director, shall commence a pilot program to assess the feasibility and advisability of entering into public-private partnerships with internet ecosystem companies to facilitate, within the bounds of applicable provisions of law and such companies' terms of service, policies, procedures, contracts, and other agreements, actions by such companies to discover and disrupt use by malicious cyber actors of the platforms, systems, services, and infrastructure of such companies."(b) PUBLIC-PRIVATE PARTNERSHIPS.-"(1) IN GENERAL.-In carrying out the pilot program under subsection (a), the Secretary shall seek to enter into one or more public-private partnerships with internet ecosystem companies."(2) VOLUNTARY PARTICIPATION.-"(A) IN GENERAL.-Participation by an internet ecosystem company in a public-private partnership under the pilot program, including in any activity described in subsection (c), shall be voluntary."(B) PROHIBITION.-No funds appropriated by any Act may be used to direct, pressure, coerce, or otherwise require that any internet ecosystem company take any action on their platforms, systems, services, or infrastructure as part of the pilot program."(c) AUTHORIZED ACTIVITIES.-In carrying out the pilot program under subsection (a), the Secretary may-"(1) provide assistance to a participating internet ecosystem company to develop effective know-your-customer processes and requirements;"(2) provide information, analytics, and technical assistance to improve the ability of participating companies to detect and prevent illicit or suspicious procurement, payment, and account creation on their own platforms, systems, services, or infrastructure;"(3) develop and socialize best practices for the collection, retention, and sharing of data by participating internet ecosystem companies to support discovery of malicious cyber activity, investigations, and attribution on the platforms, systems, services, or infrastructure of such companies;"(4) provide to participating internet ecosystem companies actionable, timely, and relevant information, such as information about ongoing operations and infrastructure, threats, tactics, and procedures, and indicators of compromise, to enable such companies to detect and disrupt the use by malicious cyber actors of the platforms, systems, services, or infrastructure of such companies;"(5) provide recommendations for (but not design, develop, install, operate, or maintain) operational workflows, assessment and compliance practices, and training that participating internet ecosystem companies can implement to reliably detect and disrupt the use by malicious cyber actors of the platforms, systems, services, or infrastructure of such companies;"(6) provide recommendations for accelerating, to the greatest extent practicable, the automation of existing or implemented operational workflows to operate at line-rate in order to enable real-time mitigation without the need for manual review or action;"(7) provide recommendations for (but not design, develop, install, operate, or maintain) technical capabilities to enable participating internet ecosystem companies to collect and analyze data on malicious activities occurring on the platforms, systems, services, or infrastructure of such companies to detect and disrupt operations of malicious cyber actors; and"(8) provide recommendations regarding relevant mitigations for suspected or discovered malicious cyber activity and thresholds for action."(d) COMPETITION CONCERNS.-Consistent with section 1905 of title 18, United States Code, the Secretary shall ensure that any trade secret or proprietary information of a participating internet ecosystem company made known to the Federal Government pursuant to a public-private partnership under the pilot program remains private and protected unless explicitly authorized by such company."(e) IMPARTIALITY.-In carrying out the pilot program under subsection (a), the Secretary may not take any action that is intended primarily to advance the particular business interests of an internet ecosystem company but is authorized to take actions that advance the interests of the United States, notwithstanding differential impact or benefit to a given company's or given companies' business interests."(f) RESPONSIBILITIES.-"(1) SECRETARY OF HOMELAND SECURITY.-The Secretary shall exercise primary responsibility for the pilot program under subsection (a), including organizing and directing authorized activities with participating Federal Government organizations and internet ecosystem companies to achieve the objectives of the pilot program."(2) NATIONAL CYBER DIRECTOR.-The National Cyber Director shall support prioritization and cross-agency coordination for the pilot program, including ensuring appropriate participation by participating agencies and the identification and prioritization of key private sector entities and initiatives for the pilot program."(3) SECRETARY OF DEFENSE.-The Secretary of Defense shall provide support and resources to the pilot program, including the provision of technical and operational expertise drawn from appropriate and relevant officials and components of the Department of Defense, including the National Security Agency, United States Cyber Command, the Chief Information Officer, the Office of the Secretary of Defense, military department Principal Cyber Advisors, and the Defense Advanced Research Projects Agency."(g) PARTICIPATION OF OTHER FEDERAL GOVERNMENT COMPONENTS.-The Secretary may invite to participate in the pilot program required under subsection (a) the heads of such departments or agencies as the Secretary considers appropriate."(h) INTEGRATION WITH OTHER EFFORTS.-The Secretary shall ensure that the pilot program required under subsection (a) makes use of, builds upon, and, as appropriate, integrates with and does not duplicate other efforts of the Department of Homeland Security and the Department of Defense relating to cybersecurity, including the following:"(1) The Joint Cyber Defense Collaborative of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security."(2) The Cybersecurity Collaboration Center and Enduring Security Framework of the National Security Agency."(i) RULES OF CONSTRUCTION.-"(1) LIMITATION ON GOVERNMENT ACCESS TO DATA.-Nothing in this section authorizes sharing of information, including information relating to customers of internet ecosystem companies or private individuals, from an internet ecosystem company to an agency, officer, or employee of the Federal Government unless otherwise authorized by another provision of law."(2) STORED COMMUNICATIONS ACT.-Nothing in this section may be construed to permit or require disclosure by a provider of a remote computing service or a provider of an electronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter 121 of title 18, United States Code (commonly known as the 'Stored Communications Act')."(3) THIRD PARTY CUSTOMERS.-Nothing in this section may be construed to require a third party, such as a customer or managed service provider of an internet ecosystem company, to participate in the pilot program under subsection (a)."(j) BRIEFINGS.-"(1) INITIAL.-"(A) IN GENERAL.-Not later than one year after the date of the enactment of this Act, the Secretary, in coordination with the Secretary of Defense and the National Cyber Director, shall brief the appropriate committees of Congress on the pilot program required under subsection (a)."(B) ELEMENTS.-The briefing required under subparagraph (A) shall include the following:"(i) The plans of the Secretary for the implementation of the pilot program."(ii) Identification of key priorities for the pilot program."(iii) Identification of any potential challenges in standing up the pilot program or impediments, such as a lack of liability protection, to private sector participation in the pilot program."(iv) A description of the roles and responsibilities in the pilot program of each participating Federal entity."(2) ANNUAL.-"(A) IN GENERAL.-Not later than two years after the date of the enactment of this Act and annually thereafter for three years, the Secretary, in coordination with the Secretary of Defense and the National Cyber Director, shall brief the appropriate committees of Congress on the progress of the pilot program required under subsection (a)."(B) ELEMENTS.-Each briefing required under subparagraph (A) shall include the following:"(i) Recommendations for addressing relevant policy, budgetary, and legislative gaps to increase the effectiveness of the pilot program."(ii) Recommendations, such as providing liability protection, for increasing private sector participation in the pilot program."(iii) A description of the challenges encountered in carrying out the pilot program, including any concerns expressed by internet ecosystem companies regarding participation in the pilot program."(iv) The findings of the Secretary with respect to the feasibility and advisability of extending or expanding the pilot program."(v) Such other matters as the Secretary considers appropriate."(k) TERMINATION.-The pilot program required under subsection (a) shall terminate on the date that is five years after the date of the enactment of this Act [Dec. 27, 2021]."(l) DEFINITIONS.-In this section:"(1) APPROPRIATE COMMITTEES OF CONGRESS.-The term 'appropriate committees of Congress' means-"(A) the Committee on Homeland Security and Governmental Affairs and the Committee on Armed Services of the Senate; and"(B) the Committee on Homeland Security and the Committee on Armed Services of the House of Representatives."(2) INTERNET ECOSYSTEM COMPANY.-The term 'internet ecosystem company' means a business incorporated in the United States that provides cybersecurity services, internet service, content delivery services, Domain Name Service, cloud services, mobile telecommunications services, email and messaging services, internet browser services, or such other services as the Secretary determines appropriate for the purposes of the pilot program under subsection (a)."(3) SECRETARY.-The term 'Secretary' means the Secretary of Homeland Security."
K-12 CYBERSECURITY Pub. L. 117-47, 135 Stat. 397, provided that:
"SECTION 1. SHORT TITLE."This Act may be cited as the 'K-12 Cybersecurity Act of 2021'.
"SEC. 2. FINDINGS."Congress finds the following:"(1) K-12 educational institutions across the United States are facing cyber attacks."(2) Cyber attacks place the information systems of K-12 educational institutions at risk of possible disclosure of sensitive student and employee information, including-"(A) grades and information on scholastic development;"(B) medical records;"(C) family records; and"(D) personally identifiable information."(3) Providing K-12 educational institutions with resources to aid cybersecurity efforts will help K-12 educational institutions prevent, detect, and respond to cyber events.
"SEC. 3. K-12 EDUCATION CYBERSECURITY INITIATIVE."(a) DEFINITIONS.-In this section:"(1) CYBERSECURITY RISK.-The term 'cybersecurity risk' has the meaning given the term in section 2209 of the Homeland Security Act of 2002 (6 U.S.C. 659) [see 6 U.S.C. 650] ."(2) DIRECTOR.-The term 'Director' means the Director of Cybersecurity and Infrastructure Security."(3) INFORMATION SYSTEM.-The term 'information system' has the meaning given the term in section 3502 of title 44, United States Code."(4) K-12 EDUCATIONAL INSTITUTION.-The term 'K-12 educational institution' means an elementary school or a secondary school, as those terms are defined in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801)."(b) STUDY.-"(1) IN GENERAL.-Not later than 120 days after the date of enactment of this Act [Oct. 8, 2021], the Director, in accordance with subsection (g)(1), shall conduct a study on the specific cybersecurity risks facing K-12 educational institutions that-"(A) analyzes how identified cybersecurity risks specifically impact K-12 educational institutions;"(B) includes an evaluation of the challenges K-12 educational institutions face in-"(i) securing- "(I) information systems owned, leased, or relied upon by K-12 educational institutions; and "(II) sensitive student and employee records; and"(ii) implementing cybersecurity protocols;"(C) identifies cybersecurity challenges relating to remote learning; and"(D) evaluates the most accessible ways to communicate cybersecurity recommendations and tools."(2) CONGRESSIONAL BRIEFING.-Not later than 120 days after the date of enactment of this Act, the Director shall provide a Congressional briefing on the study conducted under paragraph (1)."(c) CYBERSECURITY RECOMMENDATIONS.-Not later than 60 days after the completion of the study required under subsection (b)(1), the Director, in accordance with subsection (g)(1), shall develop recommendations that include cybersecurity guidelines designed to assist K-12 educational institutions in facing the cybersecurity risks described in subsection (b)(1), using the findings of the study."(d) ONLINE TRAINING TOOLKIT.-Not later than 120 days after the completion of the development of the recommendations required under subsection (c), the Director shall develop an online training toolkit designed for officials at K-12 educational institutions to-"(1) educate the officials about the cybersecurity recommendations developed under subsection (c); and"(2) provide strategies for the officials to implement the recommendations developed under subsection (c)."(e) PUBLIC AVAILABILITY.-The Director shall make available on the website of the Department of Homeland Security with other information relating to school safety the following:"(1) The findings of the study conducted under subsection (b)(1)."(2) The cybersecurity recommendations developed under subsection (c)."(3) The online training toolkit developed under subsection (d)."(f) VOLUNTARY USE.-The use of the cybersecurity recommendations developed under [subsection] (c) by K-12 educational institutions shall be voluntary."(g) CONSULTATION.-"(1) IN GENERAL.-In the course of the conduction of the study required under subsection (b)(1) and the development of the recommendations required under subsection (c), the Director shall consult with individuals and entities focused on cybersecurity and education, as appropriate, including-"(A) teachers;"(B) school administrators;"(C) Federal agencies;"(D) non-Federal cybersecurity entities with experience in education issues; and"(E) private sector organizations."(2) INAPPLICABILITY OF FACA.-The Federal Advisory Committee Act ([former] 5 U.S.C App.) [see 5 U.S.C. 1001 et seq.] shall not apply to any consultation under paragraph (1)."
UNDER SECRETARY RESPONSIBLE FOR OVERSEEING CRITICAL INFRASTRUCTURE PROTECTION, CYBERSECURITY AND RELATED PROGRAMS AUTHORIZED TO SERVE AS DIRECTOR OF CYBERSECURITY AND INFRASTRUCTURE SECURITY Pub. L. 115-278, §2(b)(1), Nov. 16, 2018, 132 Stat. 4175, provided that: "The individual serving as the Under Secretary appointed pursuant to section 103(a)(1)(H) of the Homeland Security Act of 2002 (6 U.S.C. 113(a)(1)(H)) of the Department of Homeland Security on the day before the date of enactment of this Act [Nov. 16, 2018] may continue to serve as the Director of Cybersecurity and Infrastructure Security of the Department on and after such date."
- Department
- The term "Department" means the Department of Homeland Security.
- Secretary
- The term "Secretary" means the Secretary of Homeland Security.
- State
- The term "State" means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, the Commonwealth of the Northern Mariana Islands, and any possession of the United States.
- assets
- The term "assets" includes contracts, facilities, property, records, unobligated or unexpended balances of appropriations, and other funds or resources (other than personnel).
- functions
- The term "functions" includes authorities, powers, rights, privileges, immunities, programs, projects, activities, duties, and responsibilities.
- key resources
- The term "key resources" means publicly or privately controlled resources essential to the minimal operations of the economy and government.
- personnel
- The term "personnel" means officers and employees.
- terrorism
- The term "terrorism" means any activity that-(A) involves an act that-(i) is dangerous to human life or potentially destructive of critical infrastructure or key resources; and(ii) is a violation of the criminal laws of the United States or of any State or other subdivision of the United States; and(B) appears to be intended-(i) to intimidate or coerce a civilian population;(ii) to influence the policy of a government by intimidation or coercion; or(iii) to affect the conduct of a government by mass destruction, assassination, or kidnapping.
- Agency
- the term "Agency" means the Federal Emergency Management Agency;
- appropriate committees of Congress
- the term "appropriate committees of Congress" means-(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and(B) those committees of the House of Representatives that the Speaker of the House of Representatives determines appropriate;