,i #aacth ,,congress #ast ,session ,h4 ,r4 #cfif ,,in ,,the ,,house ,,of ,,representatives ,december #aa1 #bjac,mr4 ,mc,caul 7for himself1 ,mr4 ,meehan1 ,mr4 ,thompson of ,mississippi1 and ,ms4 ,clarke7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security1 and in addition to the ,committees on ,science1 ,space1 and ,technology and ,oversight and ,government ,reform1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to make certain improvements regarding cybersecurity and critical infrastructure protection1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,national ,cybersecurity and ,critical ,infrastructure ,protection ,act of #bjac4 #b4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4,sec4 #b4 ,table of contents4,title ,i--,securing the ,nation ,against ,cyber ,attack,sec4 #aja4 ,homeland ,security ,act of #bjjb definitions4,sec4 #ajb4 ,enhancement of cybersecurity4,sec4 #ajc4 ,protection of critical infrastructure and information sharing4,sec4 #ajd4 ,national ,cybersecurity and ,communications ,integration ,center4,sec4 #aje4 ,cyber incident response and technical assistance4,sec4 #ajf4 ,assessment of cybersecurity workforce4,sec4 #ajg4 ,personnel authorities4,sec4 #ajh4 ,streamlining of ,department cybersecurity organization4,title ,,ii--,public-,private ,collaboration on ,cybersecurity,sec4 #bja4 ,public-private collaboration on cybersecurity4,sec4 #bjb4 ,,safety ,act and qualifying cyber incidents4,sec4 #bjc4 ,prohibition on new regulatory authority4,sec4 #bjd4 ,prohibition on additional authorization of appropriations4 ,i ,securing the ,nation ,against ,cyber ,attack #aja4 ,homeland ,security ,act of #bjjb definitions ,section #b of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja7 is amended by adding at the end the following new paragraphs3 7#ai7 ,the term critical infrastructure has the meaning given that term in section #ajaf7;e7 of the ,,usa ,patriot ,act 7#db ,u4,s4,c4 #eaie;c7e774 7#bj7 ,the term critical infrastructure owner means a person that owns critical infrastructure4 7#ba7 ,the term critical infrastructure operator means a critical infrastructure owner or other person that manages1 runs1 or operates1 in whole or in part1 the day-to-day operations of critical infrastructure4 7#bb7 ,the term cyber incident means an incident resulting in1 or an attempt to cause an incident that1 if successful1 would-- 7,a7 jeopardize or imminently jeopardize1 without lawful authority1 the security1 integrity1 confidentiality1 or availability of an information system or network of information systems or any information stored on1 processed on1 or transiting such a system2 7,b7 constitute a violation or imminent threat of violation of law1 security policies1 security procedures1 or acceptable use policies related to an information system or network of information systems1 or an act of terrorism against an information system or network of information systems2 or 7,c7 result in the denial of access to or degradation1 disruption1 or destruction of an information system or network of information systems1 or the defeat of an operations control or technical control essential to the security or operation of an information system or network of information systems4 7#bc7 ,the term cybersecurity provider means a non-,federal entity that provides goods or services intended to be used for cybersecurity purposes4 7#bd7 ,the term cybersecurity purpose means the purpose of ensuring the security1 integrity1 confidentiality1 or availability of1 or safeguarding1 an information system or network of information systems1 including protecting an information system or network of information systems1 or data residing on an information system or network of information systems1 including protection of an information system or network of information systems1 from-- 7,a7 a vulnerability of an information system or network of information systems2 7,b7 a threat to the security1 integrity1 confidentiality1 or availability of an information system or network of information systems1 or any information stored on1 processed on1 or transiting such a system or network2 7,c7 efforts to deny access to or degrade1 disrupt1 or destroy an information system or network of information systems2 or 7,d7 efforts to gain unauthorized access to an information system or network of information systems1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting such a system or network4 7#be7 ,the term cybersecurity system means a system designed or employed to ensure the security1 integrity1 confidentiality1 or availability of1 or safeguard1 an information system or network of information systems1 including protecting such a system or network from-- 7,a7 a vulnerability of an information system or network of information systems2 7,b7 a threat to the security1 integrity1 confidentiality1 or availability of an information system or network of information systems or any information stored on1 processed on1 or transiting such a system or network2 7,c7 efforts to deny access to or degrade1 disrupt1 or destroy an information system or network of information systems of a private entity2 or 7,d7 efforts to gain unauthorized access to an information system or network of information systems1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting such a system or network4 7#bf7 ,the term cyber threat means any action that may result in unauthorized access to1 exfiltration of1 manipulation of1 harm of1 or impairment to the security1 integrity1 confidentiality1 or availability of an information system or network of information systems1 or information that is stored on1 processed by1 or transiting an information system or network of information systems4 7#bg7 ,the term cyber threat information means information directly pertaining to-- 7,a7 a vulnerability of an information system or network of information systems of a government or private entity2 7,b7 a threat to the security1 integrity1 confidentiality1 or availability of an information system or network of information systems of a government or private entity or any information stored on1 processed on1 or transiting such a system or network2 7,c7 efforts to deny access to or degrade1 disrupt1 or destroy an information system or network of information systems of a government or private entity2 7,d7 efforts to gain unauthorized access to an information system or network of information systems of a government or private entity1 including to gain such unauthorized access for the purpose of exfiltrating information stored on1 processed on1 or transiting such a system or network2 or 7,e7 an act of terrorism against an information system or network of information systems4 7#bh7 ,the term ,federal civilian information systems-- 7,a7 means information1 information systems1 and networks of information systems that are owned1 operated1 controlled1 or licensed for use by1 or on behalf of1 any ,federal agency1 including information systems or networks of information systems used or operated by another entity on behalf of a ,federal agency2 but 7,b7 does not include-- 7i7 a national security system2 or 7ii7 information1 information systems1 and networks of information systems that are owned1 operated1 controlled1 or licensed solely for use by1 or on behalf of1 the ,department of ,defense1 a military department1 or an element of the intelligence community4 7#bi7 ,the term information security means the protection of information1 information systems1 and networks of information systems from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction in order to provide-- 7,a7 integrity1 including guarding against improper information modification or destruction1 including ensuring nonrepudiation and authenticity2 7,b7 confidentiality1 including preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 and 7,c7 availability1 including ensuring timely and reliable access to and use of information4 7#cj7 ,the term information system means the underlying framework and functions used to process1 transmit1 receive1 or store information electronically1 including programmable electronic devices1 communications networks1 and industrial or supervisory control systems and any associated hardware1 software1 or data4 7#ca7 ,the term private entity means any individual or any private or publically-traded company1 public or private utility1 organization1 or corporation1 including an officer1 employee1 or agent thereof4 7#cb7 ,the term protected private entity means an entity1 other than an individual1 that enters into a contract with a cybersecurity provider for goods and services to be used for cybersecurity purposes4 7#cc7 ,the term shared situational awareness means an environment in which cyber threat information is shared in real time between all designated ,federal cyber operations centers to provide actionable information about all known cyber threats4 4 #ajb4 ,enhancement of cybersecurity 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb is amended by adding at the end the following new section3 #bbf4 ,enhancement of cybersecurity ,the ,secretary1 in collaboration with the heads of other appropriate ,federal ,government entities1 shall conduct activities for cybersecurity purposes1 including the provision of shared situational awareness to each other to enable real-time1 integrated1 and operational actions to protect from1 prevent1 mitigate1 respond to1 and recover from cyber incidents4 4 7b7 ,clerical amendments 7#a7 ,subtitle heading ,the heading for subtitle ,c of title ,,ii of such ,act is amended to read as follows3 ,c ,cybersecurity and ,information ,sharing 4 7#b7 ,table of contents ,the table of contents in section #a7;b7 of such ,act is amended-- 7,a7 by adding after the item relating to section #bbe the following new item3 ,sec4 #bbf4 ,enhancement of cybersecurity4 2 and 7,b7 by striking the item relating to subtitle ,c of title ,,ii and inserting the following new item3 ,subtitle ,c--,cybersecurity and ,information ,sharing 4 #ajc4 ,protection of critical infrastructure and information sharing 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by section #ajb1 is further amended by adding at the end the following new section3 #bbg4 ,protection of critical infrastructure and information sharing 7a7 ,protection of critical infrastructure 7#a7 ,in general ,the ,secretary shall coordinate1 on an ongoing basis1 with ,federal1 ,state1 and local governments1 critical infrastructure owners1 critical infrastructure operators1 and other cross sector coordinating entities to-- 7,a7 facilitate a national effort to strengthen and maintain secure1 functioning1 and resilient critical infrastructure from cyber threats2 7,b7 ensure that ,department policies and procedures enable critical infrastructure owners and critical infrastructure operators to receive real-time1 actionable1 and relevant cyber threat information2 7,c7 seek industry sector-specific expertise to-- 7i7 assist in the development of voluntary security and resiliency strategies2 and 7ii7 ensure that the allocation of ,federal resources are cost effective and reduce any burden on critical infrastructure owners and critical infrastructure operators2 7,d7 upon request1 facilitate and assist risk management efforts of entities to reduce vulnerabilities1 identify and disrupt threats1 and minimize consequences to their critical infrastructure2 7,e7 upon request1 provide education and assistance to critical infrastructure owners and critical infrastructure operators on how they may use protective measures and countermeasures to strengthen the security and resilience of the ,nation's critical infrastructure2 and 7,f7 coordinate a research and development strategy to facilitate and promote advancements and innovation in cybersecurity technologies to protect critical infrastructure4 7#b7 ,additional responsibilities ,the ,secretary shall-- 7,a7 manage ,federal efforts to secure1 protect1 and ensure the resiliency of ,federal civilian information systems1 and1 upon request1 support critical infrastructure owners' and critical infrastructure operators' efforts to secure1 protect1 and ensure the resiliency of critical infrastructure from cyber threats2 7,b7 direct an entity within the ,department to serve as a ,federal civilian entity by and among ,federal1 ,state1 and local governments1 private entities1 and critical infrastructure sectors to provide multi-directional sharing of real-time1 actionable1 and relevant cyber threat information2 7,c7 promote a national awareness effort to educate the general public on the importance of securing information systems2 7,d7 upon request1 facilitate expeditious cyber incident response and recovery assistance1 and provide analysis and warnings related to threats to and vulnerabilities of critical information systems1 crisis and consequence management support1 and other remote or on-site technical assistance with the heads of other appropriate ,federal agencies to ,federal1 ,state1 and local government entities and private entities for cyber incidents affecting critical infrastructure2 and 7,e7 engage with international partners to strengthen the security and resilience of domestic critical infrastructure and critical infrastructure located outside of the ,united ,states upon which the ,united ,states depends4 7#c7 ,rule of construction ,nothing in this section may be construed to require any private entity to request assistance from the ,secretary1 or require any private entity requesting such assistance to implement any measure or recommendation suggested by the ,secretary4 7b7 ,critical infrastructure sectors ,the ,secretary1 in collaboration with the heads of other appropriate ,federal agencies1 shall designate critical infrastructure sectors 7that may include subdivisions of sectors within a sector as the ,secretary may determine appropriate74 ,the critical infrastructure sectors designated under this subsection may include the following3 7#a7 ,chemical4 7#b7 ,commercial facilities4 7#c7 ,communications4 7#d7 ,critical manufacturing4 7#e7 ,dams4 7#f7 ,defense ,industrial ,base4 7#g7 ,emergency services4 7#h7 ,energy4 7#i7 ,financial services4 7#aj7 ,food and agriculture4 7#aa7 ,government facilities4 7#ab7 ,healthcare and public health4 7#ac7 ,information technology4 7#ad7 ,nuclear reactors1 materials1 and waste4 7#ae7 ,transportation systems4 7#af7 ,water and wastewater systems4 7#ag7 ,such other sectors as the ,secretary determines appropriate4 7c7 ,sector specific agencies ,the ,secretary1 in collaboration with the relevant critical infrastructure sector and the heads of other appropriate ,federal agencies1 shall recognize the ,federal agency designated as of ,november #a1 #bjac1 as the ,sector ,specific ,agency for each critical infrastructure sector designated under subsection 7b74 ,if the designated ,sector ,specific ,agency for a particular critical infrastructure sector is the ,department1 for the purposes of this section1 the ,secretary shall carry out this section4 ,the ,secretary1 in coordination with the heads of each such ,sector ,specific ,agency shall-- 7#a7 support the security and resilience activities of the relevant critical infrastructure sector in accordance with this subtitle2 and 7#b7 provide institutional knowledge and specialized expertise to the relevant critical infrastructure sector4 7d7 ,sector coordinating councils 7#a7 ,recognition ,the ,secretary1 in collaboration with each critical infrastructure sector and the relevant ,sector ,specific ,agency1 shall recognize the ,sector ,coordinating ,council for each critical infrastructure sector designated under subsection 7b7 to coordinate with each such sector on security and resilience activities and emergency response and recovery efforts4 7#b7 ,membership 7,a7 ,in general ,the ,sector ,coordinating ,council for a critical infrastructure sector designated under subsection 7b7 shall-- 7i7 be comprised exclusively of relevant critical infrastructure owners1 critical infrastructure operators1 private entities1 and representative trade associations for the sector2 7ii7 reflect the unique composition of each sector2 and 7iii7 include relevant small1 medium1 and large critical infrastructure owners1 critical infrastructure operators1 private entities1 and representative trade associations for the sector4 7,b7 ,prohibition ,no government entity with regulating authority shall be a member of the ,sector ,coordinating ,council4 7#c7 ,roles and responsibilities ,the ,sector ,coordinating ,council for a critical infrastructure sector shall-- 7,a7 serve as a self-governing1 self-organized primary policy1 planning1 and strategic communications entity for coordinating with the ,department1 the relevant ,sector-,specific ,agency designated under subsection 7c71 and the relevant ,information ,sharing and ,analysis ,centers under subsection 7e7 on security and resilience activities and emergency response and recovery efforts2 7,b7 establish governance and operating procedures1 and designate a chairperson for the sector to carry out the activities described in this subsection2 7,c7 coordinate with the ,department1 the relevant ,information ,sharing and ,analysis ,centers under subsection 7e71 and other ,sector ,coordinating ,councils to update1 maintain1 and exercise the ,national ,cybersecurity ,incident ,response ,plan in accordance with section #bbi7;b72 and 7,d7 provide any recommendations to the ,department on infrastructure protection technology gaps to help inform research and development efforts at the ,department4 7e7 ,sector information sharing and analysis centers 7#a7 ,recognition ,the ,secretary1 in collaboration with the relevant ,sector ,coordinating ,council and the critical infrastructure sector represented by such ,council1 and in coordination with the relevant ,sector ,specific ,agency1 shall recognize at least one ,information ,sharing and ,analysis ,center for each critical infrastructure sector designated under subsection 7b7 for purposes of paragraph 7#c74 ,no other ,information ,sharing and ,analysis ,organizations1 including ,information ,sharing and ,analysis ,centers1 may be precluded from having an information sharing relationship within the ,national ,cybersecurity and ,communications ,integration ,center established pursuant to section #bbh4 ,nothing in this subsection or any other provision of this subtitle may be construed to limit1 restrict1 or condition any private entity or activity utilized by1 among1 or between private entities4 7#b7 ,roles and responsibilities ,in addition to such other activities as may be authorized by law1 at least one ,information ,sharing and ,analysis ,center for a critical infrastructure sector shall-- 7,a7 serve as an information sharing resource for such sector and promote ongoing multi-directional sharing of real-time1 relevant1 and actionable cyber threat information and analysis by and among such sector1 the ,department1 the relevant ,sector ,specific ,agency1 and other critical infrastructure sector ,information ,sharing and ,analysis ,centers2 7,b7 establish governance and operating procedures to carry out the activities conducted under this subsection2 7,c7 serve as an emergency response and recovery operations coordination point for such sector1 and upon request1 facilitate cyber incident response capabilities in coordination with the ,department1 the relevant ,sector ,specific ,agency and the relevant ,sector ,coordinating ,council2 7,d7 facilitate cross-sector coordination and sharing of cyber threat information to prevent related or consequential impacts to other critical infrastructure sectors2 7,e7 coordinate with the ,department1 the relevant ,sector ,coordinating ,council1 the relevant ,sector ,specific ,agency1 and other critical infrastructure sector ,information ,sharing and ,analysis ,centers on the development1 integration1 and implementation of procedures to support technology neutral1 real-time information sharing capabilities and mechanisms within the ,national ,cybersecurity and ,communications ,integration ,center established pursuant to section #bbh1 including-- 7i7 the establishment of a mechanism to voluntarily report identified vulnerabilities and opportunities for improvement2 7ii7 the establishment of metrics to assess the effectiveness and timeliness of the ,department's and ,information ,sharing and ,analysis ,centers' information sharing capabilities2 and 7iii7 the establishment of a mechanism for anonymous suggestions and comments2 7,f7 implement an integration and analysis function to inform sector planning1 risk mitigation1 and operational activities regarding the protection of each critical infrastructure sector from cyber incidents2 7,g7 combine consequence1 vulnerability1 and threat information to share actionable assessments of critical infrastructure sector risks from cyber incidents2 7,h7 coordinate with the ,department1 the relevant ,sector ,specific ,agency1 and the relevant ,sector ,coordinating ,council to update1 maintain1 and exercise the ,national ,cybersecurity ,incident ,response ,plan in accordance with section #bbi7;b72 and 7,i7 safeguard cyber threat information from unauthorized disclosure4 7#c7 ,funding ,of the amounts authorized to be appropriated for each of fiscal years #bjad1 #bjae1 and #bjaf for the ,cybersecurity and ,communications ,office of the ,department1 the ,secretary is authorized to use not less than #be1jjj1jjj for any such year for operations support at the ,national ,cybersecurity and ,communications ,integration ,center established under section #bbh7;a7 of all recognized ,information ,sharing and ,analysis ,centers under paragraph 7#a7 of this subsection4 7f7 ,clearances ,the ,secretary shall expedite the processing of security clearances under ,executive ,order #acedi or successor orders to appropriate members of the ,sector ,coordinating ,councils and the critical infrastructure sector ,information ,sharing and ,analysis ,centers4 7g7 ,public-,private collaboration ,the ,secretary1 in collaboration with the critical infrastructure sectors designated under subsection 7b71 such sectors' ,sector ,specific ,agencies recognized under subsection 7c71 and the ,sector ,coordinating ,councils recognized under subsection 7d71 shall-- 7#a7 conduct an analysis and review of the existing public-private partnership model and evaluate how the model between the ,department and critical infrastructure owners and critical infrastructure operators can be improved to ensure the ,department1 critical infrastructure owners1 and critical infrastructure operators are equal partners and regularly collaborate on all programs and activities of the ,department to protect critical infrastructure2 7#b7 develop procedures to ensure continuous1 collaborative1 and effective interactions between the ,department1 critical infrastructure owners1 and critical infrastructure operators2 and 7#c7 ensure critical infrastructure sectors have a reasonable period for review and comment of all jointly produced materials with the ,department4 7h7 ,protection of ,federal civilian information systems 7#a7 ,in general ,the ,secretary shall administer the operational information security activities and functions to protect and ensure the resiliency of all ,federal civilian information systems4 7#b7 ,roles and responsibilities ,the ,secretary1 in coordination with the heads of other ,federal civilian agencies1 shall-- 7,a7 develop1 issue1 and oversee the implementation and compliance of all operational information security policies and procedures to protect and ensure the resiliency of ,federal civilian information systems2 7,b7 administer ,federal ,government-wide efforts to develop and provide adequate1 risk-based1 cost-effective1 and technology neutral information security capabilities2 7,c7 establish and sustain continuous diagnostics systems for ,federal civilian information systems to aggregate data and identify and prioritize the mitigation of cyber vulnerabilities in such systems for cybersecurity purposes2 7,d7 develop1 acquire1 and operate an integrated and consolidated system of intrusion detection1 analytics1 intrusion prevention1 and other information sharing and protective capabilities to defend ,federal civilian information systems from cyber threats2 7,e7 develop and conduct targeted risk assessments and operational evaluations of ,federal civilian information systems1 in consultation with government and private entities that own and operate such information systems1 including threat1 vulnerability1 and impact assessments and penetration testing2 7,f7 develop and provide technical assistance and cyber incident response capabilities to secure and ensure the resilience of ,federal civilian information systems2 7,g7 review annually the operational information security activities and functions of each of the ,federal civilian agencies2 7,h7 develop minimum technology neutral operational requirements for network and security operations centers to facilitate the protection of all ,federal civilian information systems2 7,i7 develop reporting requirements1 consistent with relevant law1 to ensure the ,national ,cybersecurity and ,communications ,integration ,center established pursuant to section #bbh receives all actionable cyber threat information identified on ,federal civilian information systems2 7,j7 develop technology neutral performance requirements and metrics for the security of ,federal civilian information systems2 7,k7 implement training requirements that include industry recognized certifications to ensure that ,federal civilian agencies are able to fully and timely comply with policies and procedures issued by the ,secretary under this subsection2 and 7,l7 develop training requirements regarding privacy1 civil rights1 civil liberties1 and information oversight for information security employees who operate ,federal civilian information systems4 7#c7 ,use of certain communications 7,a7 ,in general ,the ,secretary may enter into contracts or other agreements1 or otherwise request and obtain1 in accordance with applicable law1 the assistance of private entities that provide electronic communication services1 remote computing services1 or cybersecurity services to acquire1 intercept1 retain1 use1 and disclose communications and other system traffic1 deploy countermeasures1 or otherwise operate protective capabilities in accordance with subparagraphs 7,c71 7,d71 7,e71 and 7,f7 of paragraph 7#b74 ,no cause of action shall exist against private entities for assistance provided to the ,secretary in accordance with this subsection4 7,b7 ,rule of construction ,nothing in subparagraph 7,a7 may be construed to-- 7i7 require or compel any private entity to enter in a contract or agreement described in such subparagraph2 or 7ii7 authorize the ,secretary to take any action with respect to any communications or system traffic transiting or residing on any information system or network of information systems other than a ,federal civilian information system4 7i7 ,rule of construction ,no provision of this title may be construed as modifying1 limiting1 or otherwise affecting the authority of any other ,federal agency under any other provision of law4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act is amended by adding at the end of the items relating to such subtitle the following new item3 ,sec4 #bbg4 ,protection of critical infrastructure and information sharing4 4 #ajd4 ,national ,cybersecurity and ,communications ,integration ,center 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by sections #ajb and #ajc1 is further amended by adding at the end the following new section3 #bbh4 ,national ,cybersecurity and ,communications ,integration ,center 7a7 ,establishment ,there is established in the ,department the ,national ,cybersecurity and ,communications ,integration ,center 7referred to in this section as the ,center71 which shall be a ,federal civilian information sharing interface that provides shared situational awareness to enable real-time1 integrated1 and operational actions across the ,federal ,government1 and share cyber threat information by and among ,federal1 ,state1 and local government entities1 ,information ,sharing and ,analysis ,centers1 private entities1 and critical infrastructure owners and critical infrastructure operators that have an information sharing relationship with the ,center4 7b7 ,composition ,the ,center shall include each of the following entities3 7#a7 ,at least one ,information ,sharing and ,analysis ,center established under section #bbg7;e7 for each critical infrastructure sector4 7#b7 ,the ,multi-,state ,information ,sharing and ,analysis ,center to collaborate with ,state and local governments4 7#c7 ,the ,united ,states ,computer ,emergency ,readiness ,team to coordinate cyber threat information sharing1 proactively manage cyber risks to the ,united ,states1 collaboratively respond to cyber incidents1 provide technical assistance to information system owners and operators1 and disseminate timely notifications regarding current and potential cyber threats and vulnerabilities4 7#d7 ,the ,industrial ,control ,system ,cyber ,emergency ,response ,team to coordinate with industrial control systems owners and operators and share industrial control systems-related security incidents and mitigation measures4 7#e7 ,the ,national ,coordinating ,center for ,telecommunications to coordinate the protection1 response1 and recovery of national security emergency communications4 7#f7 ,such other ,federal1 ,state1 and local government entities1 private entities1 organizations1 or individuals as the ,secretary may consider appropriate that agree to be included4 7c7 ,cyber incident ,in the event of a cyber incident1 the ,secretary may grant the entities referred to in subsection 7a7 immediate temporary access to the ,center as a situation may warrant4 7d7 ,roles and responsibilities ,the ,center shall-- 7#a7 promote ongoing multi-directional sharing by and among the entities referred to in subsection 7a7 of timely and actionable cyber threat information and analysis on a real-time basis that includes emerging trends1 evolving threats1 incident reports1 intelligence information1 risk assessments1 and best practices2 7#b7 coordinate with other ,federal agencies to streamline and reduce redundant reporting of cyber threat information2 7#c7 provide1 upon request1 timely technical assistance and crisis management support to ,federal1 ,state1 and local government entities and private entities that own or operate information systems or networks of information systems to protect from1 prevent1 mitigate1 respond to1 and recover from cyber incidents2 7#d7 facilitate cross-sector coordination and sharing of cyber threat information to prevent related or consequential impacts to other critical infrastructure sectors2 7#e7 collaborate with the ,sector ,coordinating ,councils1 ,information ,sharing and ,analysis ,centers1 ,sector ,specific ,agencies1 and the relevant critical infrastructure sectors on the development and implementation of procedures to support technology neutral real-time information sharing capabilities and mechanisms2 7#f7 collaborate with the ,sector ,coordinating ,councils1 ,information ,sharing and ,analysis ,centers1 ,sector ,specific ,agencies1 and the relevant critical infrastructure sectors to identify requirements for data and information formats and accessibility1 system interoperability1 and redundant systems and alternative capabilities in the event of a disruption in the primary information sharing capabilities and mechanisms at the ,center2 7#g7 within the scope of relevant treaties1 cooperate with international partners to share information and respond to cyber incidents2 7#h7 safeguard sensitive cyber threat information from unauthorized disclosure2 7#i7 require other ,federal civilian agencies to-- 7,a7 send reports and information to the ,center about cyber incidents1 threats1 and vulnerabilities affecting ,federal civilian information systems and critical infrastructure systems and1 in the event a private vendor product or service of such an agency is so implicated1 the ,center shall first notify such private vendor of the vulnerability before further disclosing such information2 7,b7 provide to the ,center cyber incident detection1 analysis1 mitigation1 and response information2 and 7,c7 immediately send and disclose to the ,center cyber threat information received by such agencies2 and 7#aj7 perform such other duties as the ,secretary may require to facilitate a national effort to strengthen and maintain secure1 functioning1 and resilient critical infrastructure from cyber threats4 7e7 ,integration and analysis ,the ,center shall maintain an integration and analysis function1 which shall -- 7#a7 integrate and analyze all cyber threat information received from other ,federal agencies1 ,state and local governments1 ,information ,sharing and ,analysis ,centers1 private entities1 critical infrastructure owners1 and critical infrastructure operators1 and share relevant information in near real-time2 7#b7 on an ongoing basis1 assess and evaluate consequence1 vulnerability1 and threat information to share with the entities referred to in subsection 7a7 actionable assessments of critical infrastructure sector risks from cyber incidents and to assist critical infrastructure owners and critical infrastructure operators by making recommendations to facilitate continuous improvements to the security and resiliency of the critical infrastructure of the ,united ,states2 7#c7 facilitate cross-sector integration1 identification1 and analysis of key interdependencies to prevent related or consequential impacts to other critical infrastructure sectors2 and 7#d7 collaborate with the ,information ,sharing and ,analysis ,centers to tailor the analysis of information to the specific characteristics and risk to a relevant critical infrastructure sector4 7f7 ,report of cyber attacks against ,federal ,government networks ,the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,comptroller ,general of the ,united ,states an annual report that summarizes major cyber incidents involving ,federal civilian agency information systems and provides aggregate statistics on the number of breaches1 the volume of data exfiltrated1 the consequential impact1 and the estimated cost of remedying such breaches4 7g7 ,report on the operations of the ,center ,the ,secretary1 in consultation with the ,sector ,coordinating ,councils and appropriate ,federal ,government entities1 shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,comptroller ,general of the ,united ,states an annual report on-- 7#a7 the capability and capacity of the ,center to carry out its cybersecurity mission in accordance with this section1 and sections #bbf1 #bbg1 #bbi1 #bcj1 #bcj;,a1 and #bcj;,b2 7#b7 the extent to which the ,department is engaged in information sharing with each critical infrastructure sector designated under section #bbg7;b71 including-- 7,a7 the extent to which each such sector has representatives at the ,center2 and 7,b7 the extent to which critical infrastructure owners and critical infrastructure operators of each critical infrastructure sector participate in information sharing at the ,center2 7#c7 the volume and range of activities with respect to which the ,secretary collaborated with the ,sector ,coordinating ,councils and the ,sector-,specific ,agencies to promote greater engagement with the ,center2 and 7#d7 the volume and range of voluntary technical assistance sought and provided by the ,department to each critical infrastructure owner and critical infrastructure operator4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act1 as amended by section #ajc1 is further amended by adding at the end the following new item3 #bbh4 ,national ,cybersecurity and ,communications ,integration ,center4 4 7c7 ,,gao report ,not later than one year after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report on the effectiveness of the ,national ,cybersecurity and ,communications ,integration ,center established under section #bbh of the ,homeland ,security ,act of #bjjb1 as added by subsection 7a7 of this section1 in carrying out its cybersecurity mission in accordance with this ,act and such section #bbh and sections #bbf1 #bbg1 #bbi1 #bcj1 #bcj;,a1 and #bcj;,b of the ,homeland ,security ,act of #bjjb1 as added by this ,act4 #aje4 ,cyber incident response and technical assistance 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by sections #ajb1 #ajc1 and #ajd1 is further amended by adding at the end the following new section3 #bbi4 ,cyber incident response and technical assistance 7a7 ,in general ,the ,secretary shall establish ,cyber ,incident ,response ,teams to-- 7#a7 upon request1 provide timely technical assistance and crisis management support to ,federal1 ,state1 and local government entities1 private entities1 and critical infrastructure owners and critical infrastructure operators involving cyber incidents affecting critical infrastructure2 and 7#b7 upon request1 provide actionable recommendations on security and resilience measures and countermeasures to ,federal1 ,state1 and local government entities1 private entities1 and critical infrastructure owners and critical infrastructure operators prior to1 during1 and after cyber incidents4 7b7 ,coordination ,in carrying out subsection 7a71 the ,secretary shall coordinate with the relevant ,sector ,specific ,agencies1 if applicable4 7c7 ,cyber incident response plan ,the ,secretary1 in coordination with the ,sector ,coordinating ,councils1 ,information ,sharing and ,analysis ,centers1 and ,federal1 ,state1 and local governments1 shall develop1 regularly update1 maintain1 and exercise a ,national ,cybersecurity ,incident ,response ,plan which shall-- 7#a7 include effective emergency response plans associated with cyber threats to critical infrastructure1 information systems1 or networks of information systems2 and 7#b7 ensure that such ,national ,cybersecurity ,incident ,response ,plan can adapt to and reflect a changing cyber threat environment1 and incorporate best practices and lessons learned from regular exercises1 training1 and after-action reports4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act1 as amended by sections #ajc and #ajd1 is further amended by adding at the end the following new item3 #bbi4 ,cyber incident response and technical assistance4 4 #ajf4 ,assessment of cybersecurity workforce 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by sections #aja1 #ajc1 #ajd1 and #aje1 is further amended by adding at the end the following new section3 #bcj4 ,assessment of cybersecurity workforce 7a7 ,assessment ,the ,secretary1 in consultation with relevant private entities1 shall regularly assess the readiness and capacity of the workforce of the ,department to meet the needs of the cybersecurity mission of the ,department4 7b7 ,strategy required ,not later than #ahj days after the date of the enactment of this section1 the ,secretary shall develop1 maintain1 and1 as necessary1 update1 a comprehensive workforce strategy designed to enhance the readiness1 capacity1 training1 recruitment1 and retention of the cybersecurity personnel of the ,department4 ,such strategy shall include a five-year plan on recruitment of personnel for the workforce of the ,department1 and ten-year projections of the workforce needs of the ,department4 ,the ,secretary shall submit such strategy to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act1 as amended by sections #ajc1 #ajd1 and #aje1 is further amended by adding at the end the following new item3 #bcj4 ,assessment of cybersecurity workforce4 4 #ajg4 ,personnel authorities 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by sections #aja1 #ajb1 #ajc1 #ajd1 #aje1 and #ajf1 is further amended by adding at the end the following new section3 #bcj;,a4 ,personnel authorities 7a7 ,in general 7#a7 ,personnel authorities ,the ,secretary may exercise with respect to qualified employees of the ,department the same authority that the ,secretary of ,defense has with respect to civilian intelligence personnel and the scholarship program under sections #afja1 #afjb1 #afjc1 and #bbjj;a of title #aj1 ,united ,states ,code1 to establish as positions in the excepted service1 appoint individuals to such positions1 fix pay1 and pay a retention bonus to any employee appointed under this section if the ,secretary determines that such is needed to retain essential personnel4 ,before announcing the payment of a bonus under this paragraph1 the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a written explanation of such determination4 ,such authority shall be exercised-- 7,a7 to the same extent and subject to the same conditions and limitations that the ,secretary of ,defense may exercise such authority with respect to civilian intelligence personnel of the ,department of ,defense2 and 7,b7 in a manner consistent with the merit system principles set forth in section #bcja of title #e1 ,united ,states ,code4 7#b7 ,civil service protections ,sections #abba and #bcjb1 and chapter #ge of title #e1 ,united ,states ,code1 shall apply to the positions established pursuant to the authorities provided under paragraph 7#a74 7#c7 ,plan for execution of authorities ,not later than #abj days after the date of the enactment of this section1 the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report that contains a plan for the use of the authorities provided under this subsection4 7b7 ,annual report ,not later than one year after the date of the enactment of this section and annually thereafter for four years1 the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a detailed report 7including appropriate metrics on actions occurring during the reporting period7 that discusses the processes used by the ,secretary in implementing this section and accepting applications1 assessing candidates1 ensuring adherence to veterans' preference1 and selecting applicants for vacancies to be filled by a qualified employee4 7c7 ,definition of qualified employee ,in this section1 the term qualified employee means an employee who performs functions relating to the security of ,federal civilian information systems1 critical infrastructure information systems1 or networks of either of such systems4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act1 as amended by sections #ajc1 #ajd1 #aje1 and #ajf1 is further amended by adding at the end the following new item3 #bcj;,a4 ,personnel authorities4 4 #ajh4 ,streamlining of ,department cybersecurity organization 7a7 ,cybersecurity and infrastructure protection directorate ,the ,national ,protection and ,programs ,directorate of the ,department of ,homeland ,security shall1 after the date of the enactment of this ,act1 be known and designated as the ,cybersecurity and ,infrastructure ,protection ,directorate4 ,any reference to the ,national ,protection and ,programs ,directorate of the ,department in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,cybersecurity and ,infrastructure ,protection ,directorate of the ,department4 7b7 ,senior leadership of the ,cybersecurity and ,infrastructure ,protection ,directorate 7#a7 ,in general ,subsection 7a7 of section #ajc of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aac7 is amended by adding at the end the following new subparagraphs3 7,k7 ,under ,secretary for ,cybersecurity and ,infrastructure ,protection4 7,l7 ,deputy ,under ,secretary for ,cybersecurity4 7,m7 ,deputy ,under ,secretary for ,infrastructure ,protection4 4 7#b7 ,continuation in office ,the individuals who hold the positions referred to in subparagraphs 7,k71 7,l71 and 7,m7 of subsection 7a7 of section #ajc of the ,homeland ,security ,act of #bjjb 7as added by paragraph 7#a7 of this subsection7 as of the date of the enactment of this ,act may continue to hold such positions4 7c7 ,report on improving the capability and effectiveness of the ,cybersecurity and ,communications ,office ,to improve the operational capability and effectiveness in carrying out the cybersecurity mission of the ,department of ,homeland ,security1 the ,secretary of ,homeland ,security shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report on-- 7#a7 the feasibility of making the ,cybersecurity and ,communications ,office of the ,department an operational component of the ,department2 7#b7 recommendations for restructuring the ,,safety ,act ,office within the ,department to elevate the profile and mission of the ,office1 including the feasibility of utilizing third-party registrars for improving the throughput and effectiveness of the certification process4 7d7 ,report on cybersecurity acquisition capabilities ,the ,secretary of ,homeland ,security shall assess the effectiveness of the ,department of ,homeland ,security's acquisition processes and the use of existing authorities for acquiring cybersecurity technologies to ensure that such processes and authorities are capable of meeting the needs and demands of the ,department's cybersecurity mission4 ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report on the effectiveness of the ,department's acquisition processes for cybersecurity technologies4 ,,ii ,public-,private ,collaboration on ,cybersecurity #bja4 ,public-private collaboration on cybersecurity 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb1 as amended by sections #ajb1 #ajc1 #ajd1 #aje1 #ajf1 and #ajg1 is further amended by adding at the end the following new section3 #bcj;,b4 ,public-private collaboration on cybersecurity 7a7 ,national ,institute of ,standards and ,technology ,the ,director of the ,national ,institute of ,standards and ,technology1 in collaboration with the ,secretary1 shall1 on an ongoing basis1 facilitate and support the development of a voluntary1 industry-led set of standards1 guidelines1 best practices1 methodologies1 procedures1 and processes to reduce cyber risks to critical infrastructure4 ,the ,director1 in collaboration with the ,secretary-- 7#a7 shall-- 7,a7 coordinate closely and continuously with relevant private entities1 critical infrastructure owners and critical infrastructure operators1 ,sector ,coordinating ,councils1 ,information ,sharing and ,analysis ,centers1 and other relevant industry organizations1 and incorporate industry expertise to the fullest extent possible2 7,b7 consult with the ,sector ,specific ,agencies1 ,federal1 ,state and local governments1 the governments of other countries1 and international organizations2 7,c7 utilize a prioritized1 flexible1 repeatable1 performance-based1 and cost-effective approach1 including information security measures and controls1 that may be voluntarily adopted by critical infrastructure owners and critical infrastructure operators to help them identify1 assess1 and manage cyber risks2 7,d7 include methodologies to-- 7i7 identify and mitigate impacts of the cybersecurity measures or controls on business confidentiality2 and 7ii7 protect individual privacy and civil liberties2 7,e7 incorporate voluntary consensus standards and industry best practices1 and align with voluntary international standards to the fullest extent possible2 7,f7 prevent duplication of existing regulatory processes and prevent conflict with or superseding of existing regulatory requirements and processes2 and 7,g7 include such other similar and consistent elements as determined necessary2 and 7#b7 shall not prescribe or otherwise require-- 7,a7 the use of specific solutions2 7,b7 the use of specific information technology products or services2 or 7,c7 that information technology products or services be designed1 developed1 or manufactured in a particular manner4 7b7 ,meetings ,the ,secretary shall meet with the ,sector ,coordinating ,council for each critical infrastructure sector designated under section #bbg7;b7 on a biannual basis to discuss the cybersecurity threat to critical infrastructure1 voluntary activities to address cybersecurity1 and ideas to improve the public-private partnership to enhance cybersecurity1 in which the ,secretary shall-- 7#a7 provide each ,sector ,coordinating ,council an assessment of the cybersecurity threat to each critical infrastructure sector designated under section #bbg7;b71 including information relating to-- 7,a7 any actual or assessed cyber threat1 including a consideration of adversary capability and intent1 preparedness1 target attractiveness1 and deterrence capabilities2 7,b7 the extent and likelihood of death1 injury1 or serious adverse effects to human health and safety caused by an act of terrorism or other disruption1 destruction1 or unauthorized use of critical infrastructure2 7,c7 the threat to national security caused by an act of terrorism or other disruption1 destruction1 or unauthorized use of critical infrastructure2 and 7,d7 the harm to the economy that would result from an act of terrorism or other disruption1 destruction1 or unauthorized use of critical infrastructure2 and 7#b7 provide recommendations1 which may be voluntarily adopted1 on ways to improve cybersecurity of critical infrastructure4 7c7 ,report 7#a7 ,in general ,starting #cj days after the end of the fiscal year in which the ,national ,cybersecurity and ,critical ,infrastructure ,protection ,act of #bjac is enacted and annually thereafter1 the ,secretary shall submit to the ,committee on ,homeland ,security of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report on the state of cybersecurity for each critical infrastructure sector designated under section #bbg7;b7 based on discussions between the ,department and the ,sector ,coordinating ,council in accordance with subsection 7b7 of this section4 ,the ,secretary shall maintain a public copy of each report1 and each report may include a non-public annex for proprietary or business-sensitive information4 ,each report shall include1 at a minimum information relating to-- 7,a7 the risk to each critical infrastructure sector1 including known cyber threats1 vulnerabilities1 and potential consequences2 7,b7 the extent and nature of any cybersecurity incidents during the previous year1 including the extent to which cyber incidents jeopardized or imminently jeopardized information systems2 7,c7 the current status of the voluntary1 industry-led set of standards1 guidelines1 best practices1 methodologies1 procedures1 and processes to reduce cyber risks within each critical infrastructure sector2 and 7,d7 the volume and range of voluntary technical assistance sought and provided by the ,department to each critical infrastructure sector4 7#b7 ,sector ,coordinating ,council response ,before making public and submitting each report required under paragraph 7#a71 the ,secretary shall provide a draft of each report to the ,sector ,coordinating ,council for the critical infrastructure sector covered by each such report4 ,the ,sector ,coordinating ,council at issue may provide to the ,secretary a written response to such report within #de days of receiving the draft4 ,if such ,sector ,coordinating ,council provides a written response1 the ,secretary shall include such written response in the final version of each report required under paragraph 7#a74 7d7 ,limitation ,information shared with or provided to the ,director of the ,national ,institute of ,standards and ,technology or the ,secretary for the purpose of the activities under subsections 7a7 and 7b7 shall not be used by any ,federal1 ,state1 or local government department or agency to regulate the activity of any private entity4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of such ,act1 as amended by sections #ajb1 #ajc1 #ajd1 #aje1 #ajf1 and #ajg is further amended by adding at the end the following new item3 ,sec4 #bcj;,b4 ,public-private collaboration on cybersecurity4 4 #bjb4 ,,safety ,act and qualifying cyber incidents 7a7 ,in general ,the ,support ,anti-,terrorism ,by ,fostering ,effective ,technologies ,act of #bjjb 7#f ,u4,s4,c4 #dda et seq47 is amended-- 7#a7 in section #hfb7;b7 7#f ,u4,s4,c4 #dda7;b77-- 7,a7 in the heading1 by striking ,designation of ,qualified ,anti-,terrorism ,technologies and inserting ,designation of ,anti-,terrorism and ,cybersecurity ,technologies2 7,b7 in the matter preceding paragraph 7#a71 by inserting and cybersecurity after anti-terrorism2 7,c7 in paragraphs 7#c71 7#d71 and 7#e71 by inserting or cybersecurity after anti-terrorism each place it appears2 and 7,d7 in paragraph 7#g7-- 7i7 by inserting or cybersecurity technology after ,anti-terrorism technology2 and 7ii7 by inserting or qualifying cyber incidents after acts of terrorism2 7#b7 in section #hfc 7#f ,u4,s4,c4 #ddb7-- 7,a7 by inserting or cybersecurity after anti-terrorism each place it appears2 7,b7 by inserting or qualifying cyber incident after act of terrorism each place it appears2 and 7,c7 by inserting or qualifying cyber incidents after acts of terrorism each place it appears2 7#c7 in section #hfd 7#f ,u4,s4,c4 #ddc7-- 7,a7 by inserting or cybersecurity after anti-terrorism each place it appears2 and 7,b7 by inserting or qualifying cyber incident after act of terrorism each place it appears2 and 7#d7 in section #hfe 7#f ,u4,s4,c4 #ddd7-- 7,a7 in paragraph 7#a7-- 7i7 in the heading1 by inserting or cybersecurity after anti-terrorism2 7ii7 by inserting or cybersecurity after anti-terrorism2 and 7iii7 by inserting or qualifying cyber incident after acts of terrorism2 and 7,b7 by adding at the end the following new paragraph3 7#g7 ,qualifying cyber incident 7,a7 ,in general ,the term qualifying cyber incident means any act that the ,secretary determines meets the requirements under subparagraph 7,b71 as such requirements are further defined and specified by the ,secretary4 7,b7 ,requirements ,a qualifying cyber incident meets the requirements of this subparagraph if the incident-- 7i7 is unlawful or otherwise exceeds authorized access authority2 7ii7 disrupts or imminently jeopardizes the integrity1 operation1 confidentiality1 or availability of programmable electronic devices1 communication networks1 including hardware1 software and data that are essential to their reliable operation1 electronic storage devices1 or any other information system1 or the information that system controls1 processes1 stores1 or transmits2 7iii7 gains access to an information system or a network of information systems resulting in-- 7,i7 misappropriation or theft of data1 assets1 information1 or intellectual property2 7,,ii7 corruption of data1 assets1 information1 or intellectual property2 7,,iii7 operational disruption2 or 7,,iv7 an adverse effect on such system or network1 or the data1 assets1 information1 or intellectual property contained therein2 and 7iv7 causes harm inside or outside the ,united ,states that results in material levels of damage1 disruption1 or casualties severely affecting the ,united ,states population1 infrastructure1 economy1 national morale1 or ,federal1 ,state1 local1 or tribal government functions4 4 7b7 ,funding ,of the amounts authorized to be appropriated for each of fiscal years #bjad1 #bjae1 and #bjaf for the ,science and ,technology ,directorate of the ,department of ,homeland ,security1 the ,secretary of ,homeland ,security is authorized to use not less than #bj1jjj1jjj for any such year for the ,department's ,,safety ,act ,office4 #bjc4 ,prohibition on new regulatory authority ,this ,act and the amendments made by this ,act do not-- 7#a7 create or authorize the issuance of any new regulations or additional ,federal ,government regulatory authority2 or 7#b7 permit regulatory actions that would duplicate1 conflict with1 or supercede existing regulatory requirements1 mandatory standards1 or related processes4 #bjd4 ,prohibition on additional authorization of appropriations ,no additional funds are authorized to be appropriated to carry out this ,act and the amendments made by this ,act4 ,this ,act and such amendments shall be carried out using amounts otherwise available for such purposes4