,i  #aad? ,,congress  #a/ ,session  ,h4 
,r4 #ccac  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,july #bi1 #bjae ,mr4 
,mc,caul 7= himself & ,mr4 ,ratcliffe7  
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ,ov]sight & ,gov]nm5t  
,re=m1 & 9 addition to ! ,committee on  
,homel& ,security1 = a p]iod to be      
subsequ5tly det]m9$ by ! ,speak]1 9 ea* 
case = consid]ation ( su* provisions z  
fall )9 ! jurisdiction ( ! committee    
conc]n$  ,a ,,bill  ,to am5d ! ,homel&  
,security ,act ( #bjjb to /r5g!n !      
ability ( ! ,secret>y ( ,homel&         
,security to detect & prev5t intrusions 
aga9/1 & to use c\nt]measures to        
protect1 ag5cy in=mation sy/ems1 & = o!r
 purposes4  #a4 ,%ort title ,?is ,act   
may be cit$ z ! ,cyb] ,def5se ( ,f$]al  
,networks ,act ( #bjae4  #b4 ,cyb]      
def5se ( ,f$]al networks  7a7 ,9 g5]al  
,subtitle ,c ( title ,,ii ( ! ,homel&   
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ada et seq47 is am5d$ by add+ at ! end 
! foll[+ new sections3  #bcj4           

,cyb]security plans  7a7 ,intrusion     
detection & response plan ,n lat] ?an "o
 ye> aft] ! date ( ! enactm5t ( ?is     
section1 ! ,secret>y1 9 coord9ation ) ! 
,director ( ! ,(fice ( ,managem5t &     
,budget1 %all develop & implem5t an     
intrusion detection & response plan to  
detect1 id5tify1 & remove intrud]s 9    
ag5cy in=mation sy/ems4 ,! ,secret>y1 9 
coord9ation ) ! ,director1 %all update  
su* plan z necess>y4  7b7 ,exception ,! 
intrusion detection & response plan     
requir$ "u subsection 7a7 %all n apply  
to ! ,dep>tm5t ( ,def5se or an elem5t ( 
! intellig5ce community4  7c7           
,def9itions ,9 ?is section & sections   
#bca1 #bcb1 & #bcc3 7#a7 ,ag5cy ,! t]m  
ag5cy has ! mean+ giv5 su* t]m 9 section
 #cejb ( title #dd1 ,unit$ ,/ates ,code4
  7#b7 ,cyb]security risk ,! t]m        
cyb]security risk has ! mean+ giv5 su*  
t]m 9 ! second section #bbf 7relat+ to !
 national cyb]security & communications 
integration c5t]74  7#c7 ,in=mation     
sy/em ,! t]m in=mation sy/em has ! mean+

 giv5 su* t]m 9 ! second section #bbf   
7relat+ to ! national cyb]security &    
communications integration c5t]74  7#d7 
,intellig5ce community ,! t]m           
intellig5ce community has ! mean+ giv5  
su* t]m 9 section #c7d7 ( ! ,national   
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc7d774  #bca4 ,advanc$ int]nal      
def5ses  7a7 ,advanc$ network security  
tools  7#a7 ,9 g5]al ,! ,secret>y %all  
include 9 ! ,dep>tm5t's ef=ts to        
cont9u\sly diagnose & mitigate          
cyb]security risks advanc$ network      
security tools to improve visibility (  
network activity1 includ+ ?r\gh ! use ( 
comm]cial & free or op5 s\rce tools1 to 
detect & mitigate intrusions & anomal\s 
activity 9 ag5cies' in=mation sy/ems4   
7#b7 ,developm5t ( plan ,! ,secret>y1 9 
coord9ation ) ! ,director ( ! ,(fice (  
,managem5t & ,budget1 %all develop &    
implem5t a plan to ensure advanc$       
network security tools1 includ+ tools   
describ$ 9 p>agraph 7#a71 to detect &   
mitigate intrusions & anomal\s activity 

are available = use by ea* ag5cy4  7b7  
,prioritiz+ advanc$ security tools ,!   
,secret>y1 9 coord9ation ) ! ,director (
 ! ,(fice ( ,managem5t & ,budget1 & 9   
consultation ) ! heads ( appropriate    
ag5cies1 %all--  7#a7 review & update   
op]ational capabilities to ensure       
appropriate prioritization & use (      
network security monitor+ tools )9 su*  
ag5cy networks2 &  7#b7 brief !         
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives & ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate on su*              
prioritization & use4  7c7 ,improv$     
metrics ,! ,secret>y1 9 coord9ation ) ! 
,director ( ! ,(fice ( ,managem5t &     
,budget1 %all review & update ! metrics 
us$ to measure security "u section #ceed
 ( title #dd1 ,unit$ ,/ates ,code1 to   
include measures ( intrusion & incid5t  
detection & response times4  7d7        
,transp>5cy & acc\ntability ,!          
,secret>y1 9 coord9ation ) ! ,director (
 ! ,(fice ( ,managem5t & ,budget1 %all  

increase transp>5cy to ! public on ag5cy
 cyb]security po/ures1 includ+ by       
increas+ ! numb] ( metrics available on 
,f$]al ,gov]nm5t p]=mance websites &1 to
 ! greate/ ext5t practicable1 display+  
metrics = ag5cies4  7e7 ,ma9t5ance (    
te*nologies ,subp>agraph 7,b7 ( section 
#ceec7;b77#f7 ( title #dd1 ,unit$ ,/ates
 ,code1 is am5d$ by ins]t+ 1 op]at+1 &  
ma9ta9+ aft] deploy+4  #bcb4 ,f$]al     
cyb]security be/ practices ,! ,secret>y1
 9 consultation ) ! ,director ( ! ,(fice
 ( ,managem5t & ,budget1 %all regul>ly  
assess & require implem5tation ( be/    
practices =--  7#a7 secur+ ag5cy        
in=mation sy/ems aga9/ intrusion2 &     
7#b7 prev5t+ data exfiltration f su*    
sy/ems 9 ! ev5t ( an intrusion4  #bcc4  
,assessm5t2 reports  7a7 ,def9itions ,9 
?is section3 7#a7 ,appropriate          
congressional committees ,! t]m         
appropriate congressional committees    
means ! ,committee on ,homel& ,security 
( ! ,h\se ( ,repres5tatives & !         
,committee on ,homel& ,security &       

,gov]nm5tal ,affairs ( ! ,s5ate4  7#b7  
,intrusion assessm5ts ,! t]m intrusion  
assessm5ts means actions tak5 "u !      
intrusion detection & response plan     
describ$ 9 section #bcj to detect1      
id5tify1 & remove intrud]s 9 ag5cy      
in=mation sy/ems4  7#c7 ,intrusion      
detection & response plan ,! t]m        
intrusion detection & response plan     
means ! intrusion detection & response  
plan describ$ 9 section #bcj4  7b7 ,,gao
 assessm5t ,n lat] ?an ?ree ye>s aft] ! 
date ( ! enactm5t ( ?is section1 !      
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all conduct a /udy & publi% a report on
 ! effectiv5ess ( ! approa* & /rategy ( 
! ,dep>tm5t's capabilities & plans 9    
secur+ ag5cy in=mation sy/ems1 includ+ 9
 ! plans & assessm5ts "u sections #bcj1 
#bca1 & #bcb4  7c7 ,report to ,congress 
,! ,secret>y1 9 coord9ation ) !         
,director ( ! ,(fice ( ,managem5t &     
,budget1 %all-- 7#a7 n lat] ?an six     
mon?s aft] ! date ( ! enactm5t ( ?is    
section & #cj days aft] any update      

!reto1 submit to ! appropriate          
congressional committees ! intrusion    
detection & response plan describ$ 9    
section #bcj2 &  7#b7 n lat] ?an "o ye> 
aft] ! date ( ! enactm5t ( ?is section &
 annually !reaft]1 submit to ,congress--
  7,a7 a description ( ! implem5tation (
 su* intrusion detection & response     
plan2  7,b7 ! f9d+s ( ! intrusion       
assessm5ts conduct$ pursuant to su*     
intrusion detection & response plan2    
7,c7 a description ( ! advanc$ network  
security tools ref]r$ to 9 section #bca2
  7,d7 in=mation relat+ to ! results ( !
 assessm5t ( ! ,secret>y ( ,f$]al       
cyb]security be/ practices "u section   
#bcb2 &  7,e7 ! improv$ metrics ref]r$  
to 9 section #bca4  4  7b7 ,def9itions  
,p>agraphs 7#a7 & 7#b7 ( ! second       
section #bbf ( ! ,homel& ,security ,act 
( #bjjb 7#f ,u4,s4,c4 #adh2 relat+ to ! 
national cyb]security & communications  
integration c5t]7 are am5d$ to read z   
foll[s3  7#a7  7,a7 except z provid$ 9  
subp>agraph 7,b71 ! t]m cyb]security    

risk means ?reats to & vuln]abilities ( 
in=mation or in=mation sy/ems & any     
relat$ consequ5ces caus$ by or result+ f
 unau?oriz$ access1 use1 disclosure1    
degradation1 disruption1 modification1  
or de/ruction ( su* in=mation or        
in=mation sy/ems1 includ+ su* relat$    
consequ5ces caus$ by an act ( t]rorism2 
&  7,b7 su* t]m does n include any      
action t solely involves a violation ( a
 consum] t]m ( s]vice or a consum]      
lic5s+ agreem5t2  7#b7 ! t]m incid5t    
means an occurr5ce t actually or        
imm95tly jeop>dizes1 )\t lawful         
au?ority1 ! integrity1 confid5tiality1  
or availability ( in=mation on an       
in=mation sy/em1 or actually or imm95tly
 jeop>dizes1 )\t lawful au?ority1 an    
in=mation sy/em2  4  7c7 ,cl]ical       
am5dm5ts ,! table ( cont5ts = subtitle  
,c ( title ,,ii ( ! ,homel& ,security   
,act ( #bjjb is am5d$ by add+ at ! end !
 foll[+ new items3  ,sec4 #bcj4         
,cyb]security plans4 ,sec4 #bca4        
,advanc$ int]nal def5ses4 ,sec4 #bcb4   

,f$]al cyb]security be/ practices4 ,sec4
 #bcc4 ,assessm5t2 reports4  4  #c4     
,duties ( ! ,secret>y ( ,homel&         
,security relat$ to in=mation security  
,section #ceec7;b77#f7 ( title #dd1     
,unit$ ,/ates ,code1 is am5d$ by /rik+  
subp>agraphs 7,c7 & 7,d7 & ins]t+ !     
foll[+3  7,c7 provid+ incid5t detection1
 analysis1 mitigation1 & response       
in=mation1 dissem9at+ relat$ homel&     
security in=mation1 & provid+ remote or 
onsite te*nical assi/ance to ! head ( an
 ag5cy2  7,d7 compil+ & analyz+ data on 
ag5cy in=mation security & dissem9at+   
relat$ homel& security in=mation2  7,e7 
develop+ & conduct+ t>get$ risk         
assessm5ts1 includ+ assessm5ts ( ! risk 
( t]rorism1 & op]ational evaluations =  
ag5cy in=mation & in=mation sy/ems 9    
consultation ) ! heads ( o!r ag5cies or 
gov]nm5tal & private entities t own &   
op]ate su* sy/ems1 t may include ?reat1 
vuln]ability1 & impact assessm5ts2  7,f7
 9 conjunction ) o!r ag5cies & ! private
 sector1 assess+ & fo/]+ ! developm5t ( 

in=mation security te*nologies &        
capabilities = use across multiple      
ag5cies2 &  7,g7 coord9at+ ) appropriate
 ag5cies & (ficials to ensure1 to !     
maximum ext5t feasible1 t policies &    
directives issu$ "u p>agraph 7#b7 are   
complem5t>y )--  7i7 /&>ds & guidel9es  
develop$ = national security sy/ems2 &  
7ii7 policies & directives issu$ by !   
,secret>y ( ,def5se & ! ,director (     
,national ,intellig5ce "u subsection    
7e77#a72 &  4  #d4 ,directives & imm95t 
?reats ,section #ceec ( title #dd1      
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+3  7h7 ,direction to     
ag5cies  7#a7 ,au?ority  7,a7 ,9 g5]al  
,not)/&+ section #ceed1 & subject to    
subp>agraph 7,b71 9 response to a kn[n  
or reasonably suspect$ in=mation        
security ?reat1 vuln]ability1 risk1 or  
incid5t1 includ+ an act ( t]rorism1 t   
repres5ts a sub/antial ?reat to !       
in=mation security ( an ag5cy1 !        
,secret>y may issue a directive to !    
head ( an ag5cy to take any lawful      

action ) respect to ! op]ation ( !      
in=mation sy/em1 includ+ su* sy/ems own$
 or op]at$ by ano!r entity on behalf (  
an ag5cy1 t collects1 processes1 /ores1 
transmits1 dissem9ates1 or o!rwise      
ma9ta9s ag5cy in=mation1 = ! purpose (  
protect+ ! in=mation sy/em f1 or        
mitigat+1 an in=mation security ?reat or
 an act ( t]rorism4  7,b7 ,exception ,! 
au?orities ( ! ,secret>y "u ?is         
subsection %all n apply to a sy/em      
describ$ 9 p>agraph 7#b7 or 7#c7 (      
subsection 7e74  7#b7 ,proc$ures = use (
 au?ority ,! ,secret>y %all-- 7,a7 9    
coord9ation ) ! ,director & 9           
consultation ) ,f$]al contractors1 z    
appropriate1 e/abli% proc$ures "u :i* a 
directive may be issu$ "u ?is           
subsection1 :i* %all include--  7i7     
?re%olds & o!r crit]ia2  7ii7 privacy & 
civil lib]ties protections2 &  7iii7    
provid+ notice to pot5tially affect$    
?ird p>ties2  7,b7 specify ! reasons = !
 requir$ action & ! duration ( !        
directive2  7,c7 m9imize ! impact ( a   

directive "u ?is subsection by-- 7i7    
adopt+ ! lea/ intrusive means possible  
"u ! circum/ances to secure ! ag5cy     
in=mation sy/ems2 &  7ii7 limit+ !      
directive to ! %orte/ p]iod practicable2
 &  7,d7 notify ! ,director & ! head (  
any affect$ ag5cy imm$iately ^u !       
issuance ( a directive "u ?is           
subsection4  7#c7 ,imm95t ?reats  7,a7  
,9 g5]al ,if ! ,secret>y det]m9es t !re 
is an imm95t ?reat1 includ+ a ?reat (   
t]rorism1 to ag5cy in=mation sy/ems & a 
directive "u ?is subsection is n        
reasonably likely to result 9 a timely  
response to ! ?reat1 ! ,secret>y may    
au?orize ! use ( protective capabilities
 "u ! control ( ! ,secret>y =           
communications or o!r sy/em traffic     
transit+ to or f or /or$ on an ag5cy    
in=mation sy/em )\t prior consultation )
 ! affect$ ag5cy = ! purpose ( ensur+ ! 
security ( ! in=mation1 in=mation sy/em1
 or o!r ag5cy in=mation sy/ems4  7,b7   
,limitation on delegation ,! au?ority "u
 ?is p>agraph may n be delegat$ to an   

(ficial 9 a position l[] ?an an         
,assi/ant ,secret>y ( ! ,dep>tm5t (     
,homel& ,security4  7,c7 ,notice ,!     
,secret>y %all imm$iately notify !      
,director & ! head & *ief in=mation     
(fic] 7or equival5t (ficial7 ( ea*      
affect$ ag5cy (--  7i7 any action tak5  
"u ?is subsection2 &  7ii7 ! reasons = &
 duration & nature ( ! action4  7,d7    
,o!r law ,any action ( ! ,secret>y "u   
?is p>agraph %all be consi/5t )         
applicable law4  7#d7 ,limitation ,!    
,secret>y may direct or au?orize lawful 
action or protective capability "u ?is  
subsection only to--  7,a7 protect ag5cy
 in=mation f unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction2 or  7,b7 require !         
rem$iation ( or protect aga9/ id5tifi$  
in=mation security risks1 includ+ acts (
 t]rorism1 ) respect to--  7i7 in=mation
 collect$ or ma9ta9$ by or on behalf (  
an ag5cy2 or  7ii7 t portion ( an       
in=mation sy/em us$ or op]at$ by an     
ag5cy or by a contractor ( an ag5cy or  

o!r organization on behalf ( an ag5cy4  
4  #e4 ,report to ,congress reg>d+ ,,dhs
 functions ,section #ceec ( title #dd1  
,unit$ ,/ates ,code1 z am5d$ by section 
#c1 is fur!r am5d$ by add+ at ! end !   
foll[+ new subsection3  7i7 ,annual     
report to ,congress ,n lat] ?an ,febru>y
 #a ( e ye>1 ! ,secret>y %all report to 
! ,committee on ,homel& ,security ( !   
,h\se ( ,repres5tatives & ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate1 reg>d+ ! specific  
actions ! ,secret>y has tak5 pursuant to
 subsections 7b7 & 7h74  4