,i  #aadth ,,congress  #ast ,session    
,h4 ,r4 #ccac  ,,in ,,the ,,house ,,of  
,,representatives  ,july #bi1 #bjae ,mr4
 ,mc,caul 7for himself and ,mr4         
,ratcliffe7 introduced the following    
bill2 which was referred to the         
,committee on ,oversight and ,government
 ,reform1 and in addition to the        
,committee on ,homeland ,security1 for a
 period to be subsequently determined by
 the ,speaker1 in each case for         
consideration of such provisions as fall
 within the jurisdiction of the         
committee concerned  ,a ,,bill  ,to     
amend the ,homeland ,security ,act of   
#bjjb to strengthen the ability of the  
,secretary of ,homeland ,security to    
detect and prevent intrusions against1  
and to use countermeasures to protect1  
agency information systems1 and for     
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,cyber ,defense
 of ,federal ,networks ,act of #bjae4   
#b4 ,cyber defense of ,federal networks 
7a7 ,in general ,subtitle ,c of title   

,,ii of the ,homeland ,security ,act of 
#bjjb 7#f ,u4,s4,c4 #ada et seq47 is    
amended by adding at the end the        
following new sections3  #bcj4          
,cybersecurity plans  7a7 ,intrusion    
detection and response plan ,not later  
than one year after the date of the     
enactment of this section1 the          
,secretary1 in coordination with the    
,director of the ,office of ,management 
and ,budget1 shall develop and implement
 an intrusion detection and response    
plan to detect1 identify1 and remove    
intruders in agency information systems4
 ,the ,secretary1 in coordination with  
the ,director1 shall update such plan as
 necessary4  7b7 ,exception ,the        
intrusion detection and response plan   
required under subsection 7a7 shall not 
apply to the ,department of ,defense or 
an element of the intelligence          
community4  7c7 ,definitions ,in this   
section and sections #bca1 #bcb1 and    
#bcc3 7#a7 ,agency ,the term agency has 
the meaning given such term in section  

#cejb of title #dd1 ,united ,states     
,code4  7#b7 ,cybersecurity risk ,the   
term cybersecurity risk has the meaning 
given such term in the second section   
#bbf 7relating to the national          
cybersecurity and communications        
integration center74  7#c7 ,information 
system ,the term information system has 
the meaning given such term in the      
second section #bbf 7relating to the    
national cybersecurity and              
communications integration center74     
7#d7 ,intelligence community ,the term  
intelligence community has the meaning  
given such term in section #c7d7 of the 
,national ,security ,act of #aidg 7#ej  
,u4,s4,c4 #cjjc7d774  #bca4 ,advanced   
internal defenses  7a7 ,advanced network
 security tools  7#a7 ,in general ,the  
,secretary shall include in the         
,department's efforts to continuously   
diagnose and mitigate cybersecurity     
risks advanced network security tools to
 improve visibility of network activity1
 including through the use of commercial

 and free or open source tools1 to      
detect and mitigate intrusions and      
anomalous activity in agencies'         
information systems4  7#b7 ,development 
of plan ,the ,secretary1 in coordination
 with the ,director of the ,office of   
,management and ,budget1 shall develop  
and implement a plan to ensure advanced 
network security tools1 including tools 
described in paragraph 7#a71 to detect  
and mitigate intrusions and anomalous   
activity are available for use by each  
agency4  7b7 ,prioritizing advanced     
security tools ,the ,secretary1 in      
coordination with the ,director of the  
,office of ,management and ,budget1 and 
in consultation with the heads of       
appropriate agencies1 shall--  7#a7     
review and update operational           
capabilities to ensure appropriate      
prioritization and use of network       
security monitoring tools within such   
agency networks2 and  7#b7 brief the    
,committee on ,homeland ,security of the
 ,house of ,representatives and the     

,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate on
 such prioritization and use4  7c7      
,improved metrics ,the ,secretary1 in   
coordination with the ,director of the  
,office of ,management and ,budget1     
shall review and update the metrics used
 to measure security under section #ceed
 of title #dd1 ,united ,states ,code1 to
 include measures of intrusion and      
incident detection and response times4  
7d7 ,transparency and accountability    
,the ,secretary1 in coordination with   
the ,director of the ,office of         
,management and ,budget1 shall increase 
transparency to the public on agency    
cybersecurity postures1 including by    
increasing the number of metrics        
available on ,federal ,government       
performance websites and1 to the        
greatest extent practicable1 displaying 
metrics for agencies4  7e7 ,maintenance 
of technologies ,subparagraph 7,b7 of   
section #ceec7;b77#f7 of title #dd1     
,united ,states ,code1 is amended by    

inserting 1 operating1 and maintaining  
after deploying4  #bcb4 ,federal        
cybersecurity best practices ,the       
,secretary1 in consultation with the    
,director of the ,office of ,management 
and ,budget1 shall regularly assess and 
require implementation of best practices
 for--  7#a7 securing agency information
 systems against intrusion2 and  7#b7   
preventing data exfiltration from such  
systems in the event of an intrusion4   
#bcc4 ,assessment2 reports  7a7         
,definitions ,in this section3 7#a7     
,appropriate congressional committees   
,the term appropriate congressional     
committees means the ,committee on      
,homeland ,security of the ,house of    
,representatives and the ,committee on  
,homeland ,security and ,governmental   
,affairs of the ,senate4  7#b7          
,intrusion assessments ,the term        
intrusion assessments means actions     
taken under the intrusion detection and 
response plan described in section #bcj 
to detect1 identify1 and remove         

intruders in agency information systems4
  7#c7 ,intrusion detection and response
 plan ,the term intrusion detection and 
response plan means the intrusion       
detection and response plan described in
 section #bcj4  7b7 ,,gao assessment    
,not later than three years after the   
date of the enactment of this section1  
the ,comptroller ,general of the ,united
 ,states shall conduct a study and      
publish a report on the effectiveness of
 the approach and strategy of the       
,department's capabilities and plans in 
securing agency information systems1    
including in the plans and assessments  
under sections #bcj1 #bca1 and #bcb4    
7c7 ,report to ,congress ,the           
,secretary1 in coordination with the    
,director of the ,office of ,management 
and ,budget1 shall-- 7#a7 not later than
 six months after the date of the       
enactment of this section and #cj days  
after any update thereto1 submit to the 
appropriate congressional committees the
 intrusion detection and response plan  

described in section #bcj2 and  7#b7 not
 later than one year after the date of  
the enactment of this section and       
annually thereafter1 submit to          
,congress--  7,a7 a description of the  
implementation of such intrusion        
detection and response plan2  7,b7 the  
findings of the intrusion assessments   
conducted pursuant to such intrusion    
detection and response plan2  7,c7 a    
description of the advanced network     
security tools referred to in section   
#bca2  7,d7 information relating to the 
results of the assessment of the        
,secretary of ,federal cybersecurity    
best practices under section #bcb2 and  
7,e7 the improved metrics referred to in
 section #bca4  4  7b7 ,definitions     
,paragraphs 7#a7 and 7#b7 of the second 
section #bbf of the ,homeland ,security 
,act of #bjjb 7#f ,u4,s4,c4 #adh2       
relating to the national cybersecurity  
and communications integration center7  
are amended to read as follows3  7#a7   
7,a7 except as provided in subparagraph 

7,b71 the term cybersecurity risk means 
threats to and vulnerabilities of       
information or information systems and  
any related consequences caused by or   
resulting from unauthorized access1 use1
 disclosure1 degradation1 disruption1   
modification1 or destruction of such    
information or information systems1     
including such related consequences     
caused by an act of terrorism2 and  7,b7
 such term does not include any action  
that solely involves a violation of a   
consumer term of service or a consumer  
licensing agreement2  7#b7 the term     
incident means an occurrence that       
actually or imminently jeopardizes1     
without lawful authority1 the integrity1
 confidentiality1 or availability of    
information on an information system1 or
 actually or imminently jeopardizes1    
without lawful authority1 an information
 system2  4  7c7 ,clerical amendments   
,the table of contents for subtitle ,c  
of title ,,ii of the ,homeland ,security
 ,act of #bjjb is amended by adding at  

the end the following new items3  ,sec4 
#bcj4 ,cybersecurity plans4 ,sec4 #bca4 
,advanced internal defenses4 ,sec4 #bcb4
 ,federal cybersecurity best practices4 
,sec4 #bcc4 ,assessment2 reports4  4    
#c4 ,duties of the ,secretary of        
,homeland ,security related to          
information security ,section           
#ceec7;b77#f7 of title #dd1 ,united     
,states ,code1 is amended by striking   
subparagraphs 7,c7 and 7,d7 and         
inserting the following3  7,c7 providing
 incident detection1 analysis1          
mitigation1 and response information1   
disseminating related homeland security 
information1 and providing remote or    
onsite technical assistance to the head 
of an agency2  7,d7 compiling and       
analyzing data on agency information    
security and disseminating related      
homeland security information2  7,e7    
developing and conducting targeted risk 
assessments1 including assessments of   
the risk of terrorism1 and operational  
evaluations for agency information and  

information systems in consultation with
 the heads of other agencies or         
governmental and private entities that  
own and operate such systems1 that may  
include threat1 vulnerability1 and      
impact assessments2  7,f7 in conjunction
 with other agencies and the private    
sector1 assessing and fostering the     
development of information security     
technologies and capabilities for use   
across multiple agencies2 and  7,g7     
coordinating with appropriate agencies  
and officials to ensure1 to the maximum 
extent feasible1 that policies and      
directives issued under paragraph 7#b7  
are complementary with--  7i7 standards 
and guidelines developed for national   
security systems2 and  7ii7 policies and
 directives issued by the ,secretary of 
,defense and the ,director of ,national 
,intelligence under subsection 7e77#a72 
and  4  #d4 ,directives and imminent    
threats ,section #ceec of title #dd1    
,united ,states ,code1 is amended by    
adding at the end the following3  7h7   

,direction to agencies  7#a7 ,authority 
7,a7 ,in general ,notwithstanding       
section #ceed1 and subject to           
subparagraph 7,b71 in response to a     
known or reasonably suspected           
information security threat1            
vulnerability1 risk1 or incident1       
including an act of terrorism1 that     
represents a substantial threat to the  
information security of an agency1 the  
,secretary may issue a directive to the 
head of an agency to take any lawful    
action with respect to the operation of 
the information system1 including such  
systems owned or operated by another    
entity on behalf of an agency1 that     
collects1 processes1 stores1 transmits1 
disseminates1 or otherwise maintains    
agency information1 for the purpose of  
protecting the information system from1 
or mitigating1 an information security  
threat or an act of terrorism4  7,b7    
,exception ,the authorities of the      
,secretary under this subsection shall  
not apply to a system described in      

paragraph 7#b7 or 7#c7 of subsection    
7e74  7#b7 ,procedures for use of       
authority ,the ,secretary shall-- 7,a7  
in coordination with the ,director and  
in consultation with ,federal           
contractors1 as appropriate1 establish  
procedures under which a directive may  
be issued under this subsection1 which  
shall include--  7i7 thresholds and     
other criteria2  7ii7 privacy and civil 
liberties protections2 and  7iii7       
providing notice to potentially affected
 third parties2  7,b7 specify the       
reasons for the required action and the 
duration of the directive2  7,c7        
minimize the impact of a directive under
 this subsection by-- 7i7 adopting the  
least intrusive means possible under the
 circumstances to secure the agency     
information systems2 and  7ii7 limiting 
the directive to the shortest period    
practicable2 and  7,d7 notify the       
,director and the head of any affected  
agency immediately upon the issuance of 
a directive under this subsection4  7#c7

 ,imminent threats  7,a7 ,in general ,if
 the ,secretary determines that there is
 an imminent threat1 including a threat 
of terrorism1 to agency information     
systems and a directive under this      
subsection is not reasonably likely to  
result in a timely response to the      
threat1 the ,secretary may authorize the
 use of protective capabilities under   
the control of the ,secretary for       
communications or other system traffic  
transiting to or from or stored on an   
agency information system without prior 
consultation with the affected agency   
for the purpose of ensuring the security
 of the information1 information system1
 or other agency information systems4   
7,b7 ,limitation on delegation ,the     
authority under this paragraph may not  
be delegated to an official in a        
position lower than an ,assistant       
,secretary of the ,department of        
,homeland ,security4  7,c7 ,notice ,the 
,secretary shall immediately notify the 
,director and the head and chief        

information officer 7or equivalent      
official7 of each affected agency of--  
7i7 any action taken under this         
subsection2 and  7ii7 the reasons for   
and duration and nature of the action4  
7,d7 ,other law ,any action of the      
,secretary under this paragraph shall be
 consistent with applicable law4  7#d7  
,limitation ,the ,secretary may direct  
or authorize lawful action or protective
 capability under this subsection only  
to--  7,a7 protect agency information   
from unauthorized access1 use1          
disclosure1 disruption1 modification1 or
 destruction2 or  7,b7 require the      
remediation of or protect against       
identified information security risks1  
including acts of terrorism1 with       
respect to--  7i7 information collected 
or maintained by or on behalf of an     
agency2 or  7ii7 that portion of an     
information system used or operated by  
an agency or by a contractor of an      
agency or other organization on behalf  
of an agency4  4  #e4 ,report to        

,congress regarding ,,dhs functions     
,section #ceec of title #dd1 ,united    
,states ,code1 as amended by section #c1
 is further amended by adding at the end
 the following new subsection3  7i7     
,annual report to ,congress ,not later  
than ,february #a of every year1 the    
,secretary shall report to the          
,committee on ,homeland ,security of the
 ,house of ,representatives and the     
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate1  
regarding the specific actions the      
,secretary has taken pursuant to        
subsections 7b7 and 7h74  4