,in the ,senate of the ,united ,states1 ,october #c 7legislative day1 ,september #bh71 #bjah4 ,amendment3 ,that the bill from the ,house of ,representatives 7,h4,r4 #ccei7 entitled ,an ,act to amend the ,homeland ,security ,act of #bjjb to authorize the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 and for other purposes41 do pass with the following ,strike out all after the enacting clause and insert3 #a4 ,short title ,this ,act may be cited as the ,cybersecurity and ,infrastructure ,security ,agency ,act of #bjah4 #b4 ,cybersecurity and infrastructure security agency 7a7 ,in general ,the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja et seq47 is amended by adding at the end the following3 ,,xxii ,cybersecurity and ,infrastructure ,security ,agency ,a ,cybersecurity and infrastructure security #bbja4 ,definitions ,in this subtitle3 7#a7 ,critical infrastructure information ,the term critical infrastructure information has the meaning given the term in section #bbbb4 7#b7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given the term in section #bbji4 7#c7 ,cybersecurity threat ,the term cybersecurity threat has the meaning given the term in section #ajb7e7 of the ,cybersecurity ,act of #bjae 7contained in division ,n of the ,consolidated ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#d7 ,national cybersecurity asset response activities ,the term national cybersecurity asset response activities means-- 7,a7 furnishing cybersecurity technical assistance to entities affected by cybersecurity risks to protect assets1 mitigate vulnerabilities1 and reduce impacts of cyber incidents2 7,b7 identifying other entities that may be at risk of an incident and assessing risk to the same or similar vulnerabilities2 7,c7 assessing potential cybersecurity risks to a sector or region1 including potential cascading effects1 and developing courses of action to mitigate such risks2 7,d7 facilitating information sharing and operational coordination with threat response2 and 7,e7 providing guidance on how best to utilize ,federal resources and capabilities in a timely1 effective manner to speed recovery from cybersecurity risks4 7#e7 ,sector-specific agency ,the term ,sector-,specific ,agency means a ,federal department or agency1 designated by law or presidential directive1 with responsibility for providing institutional knowledge and specialized expertise of a sector1 as well as leading1 facilitating1 or supporting programs and associated activities of its designated critical infrastructure sector in the all hazards environment in coordination with the ,department4 7#f7 ,sharing ,the term sharing has the meaning given the term in section #bbji4 #bbjb4 ,cybersecurity and infrastructure security agency 7a7 ,redesignation 7#a7 ,in general ,the ,national ,protection and ,programs ,directorate of the ,department shall1 on and after the date of the enactment of this subtitle1 be known as the ,cybersecurity and ,infrastructure ,security ,agency 7in this subtitle referred to as the ,agency74 7#b7 ,references ,any reference to the ,national ,protection and ,programs ,directorate of the ,department in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,cybersecurity and ,infrastructure ,security ,agency of the ,department4 7b7 ,director 7#a7 ,in general ,the ,agency shall be headed by a ,director of ,cybersecurity and ,infrastructure ,security 7in this subtitle referred to as the ,director71 who shall report to the ,secretary4 7#b7 ,reference ,any reference to an ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and any other related program of the ,department as described in section #ajc7;a77#a77;,h7 as in effect on the day before the date of enactment of this subtitle in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,director of ,cybersecurity and ,infrastructure ,security of the ,department4 7c7 ,responsibilities ,the ,director shall-- 7#a7 lead cybersecurity and critical infrastructure security programs1 operations1 and associated policy for the ,agency1 including national cybersecurity asset response activities2 7#b7 coordinate with ,federal entities1 including ,sector-,specific ,agencies1 and non-,federal entities1 including international entities1 to carry out the cybersecurity and critical infrastructure activities of the ,agency1 as appropriate2 7#c7 carry out the responsibilities of the ,secretary to secure ,federal information and information systems consistent with law1 including subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 and the ,cybersecurity ,act of #bjae 7contained in division ,n of the ,consolidated ,appropriations ,act1 #bjaf 7,public ,law #aad-aac772 7#d7 coordinate a national effort to secure and protect against critical infrastructure risks1 consistent with subsection 7e77#a77;,e72 7#e7 upon request1 provide analyses1 expertise1 and other technical assistance to critical infrastructure owners and operators and1 where appropriate1 provide those analyses1 expertise1 and other technical assistance in coordination with ,sector-,specific ,agencies and other ,federal departments and agencies2 7#f7 develop and utilize mechanisms for active and frequent collaboration between the ,agency and ,sector-,specific ,agencies to ensure appropriate coordination1 situational awareness1 and communications with ,sector-,specific ,agencies2 7#g7 maintain and utilize mechanisms for the regular and ongoing consultation and collaboration among the ,divisions of the ,agency to further operational coordination1 integrated situational awareness1 and improved integration across the ,agency in accordance with this ,act2 7#h7 develop1 coordinate1 and implement-- 7,a7 comprehensive strategic plans for the activities of the ,agency2 and 7,b7 risk assessments by and for the ,agency2 7#i7 carry out emergency communications responsibilities1 in accordance with title ,,xviii2 7#aj7 carry out cybersecurity1 infrastructure security1 and emergency communications stakeholder outreach and engagement and coordinate that outreach and engagement with critical infrastructure ,sector-,specific ,agencies1 as appropriate2 and 7#aa7 carry out such other duties and powers prescribed by law or delegated by the ,secretary4 7d7 ,deputy director ,there shall be in the ,agency a ,deputy ,director of ,cybersecurity and ,infrastructure ,security who shall-- 7#a7 assist the ,director in the management of the ,agency2 and 7#b7 report to the ,director4 7e7 ,cybersecurity and infrastructure security authorities of the secretary 7#a7 ,in general ,the responsibilities of the ,secretary relating to cybersecurity and infrastructure security shall include the following3 7,a7 ,to access1 receive1 and analyze law enforcement information1 intelligence information1 and other information from ,federal ,government agencies1 ,state1 local1 tribal1 and territorial government agencies1 including law enforcement agencies1 and private sector entities1 and to integrate that information1 in support of the mission responsibilities of the ,department1 in order to-- 7i7 identify and assess the nature and scope of terrorist threats to the homeland2 7ii7 detect and identify threats of terrorism against the ,united ,states2 and 7iii7 understand those threats in light of actual and potential vulnerabilities of the homeland4 7,b7 ,to carry out comprehensive assessments of the vulnerabilities of the key resources and critical infrastructure of the ,united ,states1 including the performance of risk assessments to determine the risks posed by particular types of terrorist attacks within the ,united ,states1 including an assessment of the probability of success of those attacks and the feasibility and potential efficacy of various countermeasures to those attacks4 ,at the discretion of the ,secretary1 such assessments may be carried out in coordination with ,sector-,specific ,agencies4 7,c7 ,to integrate relevant information1 analysis1 and vulnerability assessments1 regardless of whether the information1 analysis1 or assessments are provided or produced by the ,department1 in order to make recommendations1 including prioritization1 for protective and support measures by the ,department1 other ,federal ,government agencies1 ,state1 local1 tribal1 and territorial government agencies and authorities1 the private sector1 and other entities regarding terrorist and other threats to homeland security4 7,d7 ,to ensure1 pursuant to section #bjb1 the timely and efficient access by the ,department to all information necessary to discharge the responsibilities under this title1 including obtaining that information from other ,federal ,government agencies4 7,e7 ,to develop1 in coordination with the ,sector-,specific ,agencies with available expertise1 a comprehensive national plan for securing the key resources and critical infrastructure of the ,united ,states1 including power production1 generation1 and distribution systems1 information technology and telecommunications systems 7including satellites71 electronic financial and property record storage and transmission systems1 emergency communications systems1 and the physical and technological assets that support those systems4 7,f7 ,to recommend measures necessary to protect the key resources and critical infrastructure of the ,united ,states in coordination with other ,federal ,government agencies1 including ,sector-,specific ,agencies1 and in cooperation with ,state1 local1 tribal1 and territorial government agencies and authorities1 the private sector1 and other entities4 7,g7 ,to review1 analyze1 and make recommendations for improvements to the policies and procedures governing the sharing of information relating to homeland security within the ,federal ,government and between ,federal ,government agencies and ,state1 local1 tribal1 and territorial government agencies and authorities4 7,h7 ,to disseminate1 as appropriate1 information analyzed by the ,department within the ,department to other ,federal ,government agencies with responsibilities relating to homeland security and to ,state1 local1 tribal1 and territorial government agencies and private sector entities with those responsibilities in order to assist in the deterrence1 prevention1 or preemption of1 or response to1 terrorist attacks against the ,united ,states4 7,i7 ,to consult with ,state1 local1 tribal1 and territorial government agencies and private sector entities to ensure appropriate exchanges of information1 including law enforcement-related information1 relating to threats of terrorism against the ,united ,states4 7,j7 ,to ensure that any material received pursuant to this ,act is protected from unauthorized disclosure and handled and used only for the performance of official duties4 7,k7 ,to request additional information from other ,federal ,government agencies1 ,state1 local1 tribal1 and territorial government agencies1 and the private sector relating to threats of terrorism in the ,united ,states1 or relating to other areas of responsibility assigned by the ,secretary1 including the entry into cooperative agreements through the ,secretary to obtain such information4 7,l7 ,to establish and utilize1 in conjunction with the ,chief ,information ,officer of the ,department1 a secure communications and information technology infrastructure1 including data-mining and other advanced analytical tools1 in order to access1 receive1 and analyze data and information in furtherance of the responsibilities under this section1 and to disseminate information acquired and analyzed by the ,department1 as appropriate4 7,m7 ,to coordinate training and other support to the elements and personnel of the ,department1 other ,federal ,government agencies1 and ,state1 local1 tribal1 and territorial government agencies that provide information to the ,department1 or are consumers of information provided by the ,department1 in order to facilitate the identification and sharing of information revealed in their ordinary duties and the optimal utilization of information received from the ,department4 7,n7 ,to coordinate with ,federal1 ,state1 local1 tribal1 and territorial law enforcement agencies1 and the private sector1 as appropriate4 7,o7 ,to exercise the authorities and oversight of the functions1 personnel1 assets1 and liabilities of those components transferred to the ,department pursuant to section #bja7;g74 7,p7 ,to carry out the functions of the national cybersecurity and communications integration center under section #bbji4 7,q7 ,to carry out the requirements of the ,chemical ,facility ,anti-,terrorism ,standards ,program established under title ,,xxi and the secure handling of ammonium nitrate program established under subtitle ,j of title ,,viii1 or any successor programs4 7#b7 ,reallocation ,the ,secretary may reallocate within the ,agency the functions specified in sections #bbjc7;b7 and #bbjd7;b71 consistent with the responsibilities provided in paragraph 7#a71 upon certifying to and briefing the appropriate congressional committees1 and making available to the public1 at least #fj days prior to the reallocation that the reallocation is necessary for carrying out the activities of the ,agency4 7#c7 ,staff 7,a7 ,in general ,the ,secretary shall provide the ,agency with a staff of analysts having appropriate expertise and experience to assist the ,agency in discharging the responsibilities of the ,agency under this section4 7,b7 ,private sector analysts ,analysts under this subsection may include analysts from the private sector4 7,c7 ,security clearances ,analysts under this subsection shall possess security clearances appropriate for their work under this section4 7#d7 ,detail of personnel 7,a7 ,in general ,in order to assist the ,agency in discharging the responsibilities of the ,agency under this section1 personnel of the ,federal agencies described in subparagraph 7,b7 may be detailed to the ,agency for the performance of analytic functions and related duties4 7,b7 ,agencies ,the ,federal agencies described in this subparagraph are-- 7i7 the ,department of ,state2 7ii7 the ,central ,intelligence ,agency2 7iii7 the ,federal ,bureau of ,investigation2 7iv7 the ,national ,security ,agency2 7v7 the ,national ,geospatial-,intelligence ,agency2 7vi7 the ,defense ,intelligence ,agency2 7vii7 ,sector-,specific ,agencies2 and 7viii7 any other agency of the ,federal ,government that the ,president considers appropriate4 7,c7 ,interagency agreements ,the ,secretary and the head of a ,federal agency described in subparagraph 7,b7 may enter into agreements for the purpose of detailing personnel under this paragraph4 7,d7 ,basis ,the detail of personnel under this paragraph may be on a reimbursable or non-reimbursable basis4 7f7 ,composition ,the ,agency shall be composed of the following divisions3 7#a7 ,the ,cybersecurity ,division1 headed by an ,assistant ,director4 7#b7 ,the ,infrastructure ,security ,division1 headed by an ,assistant ,director4 7#c7 ,the ,emergency ,communications ,division under title ,,xviii1 headed by an ,assistant ,director4 7g7 ,co-location 7#a7 ,in general ,to the maximum extent practicable1 the ,director shall examine the establishment of central locations in geographical regions with a significant ,agency presence4 7#b7 ,coordination ,when establishing the central locations described in paragraph 7#a71 the ,director shall coordinate with component heads and the ,under ,secretary for ,management to co-locate or partner on any new real property leases1 renewing any occupancy agreements for existing leases1 or agreeing to extend or newly occupy any ,federal space or new construction4 7h7 ,privacy 7#a7 ,in general ,there shall be a ,privacy ,officer of the ,agency with primary responsibility for privacy policy and compliance for the ,agency4 7#b7 ,responsibilities ,the responsibilities of the ,privacy ,officer of the ,agency shall include-- 7,a7 assuring that the use of technologies by the ,agency sustain1 and do not erode1 privacy protections relating to the use1 collection1 and disclosure of personal information2 7,b7 assuring that personal information contained in systems of records of the ,agency is handled in full compliance as specified in section #eeb;a of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd72 7,c7 evaluating legislative and regulatory proposals involving collection1 use1 and disclosure of personal information by the ,agency2 and 7,d7 conducting a privacy impact assessment of proposed rules of the ,agency on the privacy of personal information1 including the type of personal information collected and the number of people affected4 7i7 ,savings ,nothing in this title may be construed as affecting in any manner the authority1 existing on the day before the date of enactment of this title1 of any other component of the ,department or any other ,federal department or agency1 including the authority provided to the ,sector-,specific ,agency specified in section #fajjc7;c7 of division ,f of the ,fixing ,america's ,surface ,transportation ,act 7#f ,u4,s4,c4 #aba note2 ,public ,law #aad-id74 #bbjc4 ,cybersecurity division 7a7 ,establishment 7#a7 ,in general ,there is established in the ,agency a ,cybersecurity ,division4 7#b7 ,assistant director ,the ,cybersecurity ,division shall be headed by an ,assistant ,director for ,cybersecurity 7in this section referred to as the ,assistant ,director71 who shall-- 7,a7 be at the level of ,assistant ,secretary within the ,department2 7,b7 be appointed by the ,president without the advice and consent of the ,senate2 and 7,c7 report to the ,director4 7#c7 ,reference ,any reference to the ,assistant ,secretary for ,cybersecurity and ,communications in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,assistant ,director for ,cybersecurity4 7b7 ,functions ,the ,assistant ,director shall-- 7#a7 direct the cybersecurity efforts of the ,agency2 7#b7 carry out activities1 at the direction of the ,director1 related to the security of ,federal information and ,federal information systems consistent with law1 including subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 and the ,cybersecurity ,act of #bjae 7contained in division ,n of the ,consolidated ,appropriations ,act1 #bjaf 7,public ,law #aad-aac772 7#c7 fully participate in the mechanisms required under section #bbjb7;c77#g72 and 7#d7 carry out such other duties and powers as prescribed by the ,director4 #bbjd4 ,infrastructure security division 7a7 ,establishment 7#a7 ,in general ,there is established in the ,agency an ,infrastructure ,security ,division4 7#b7 ,assistant director ,the ,infrastructure ,security ,division shall be headed by an ,assistant ,director for ,infrastructure ,security 7in this section referred to as the ,assistant ,director71 who shall-- 7,a7 be at the level of ,assistant ,secretary within the ,department2 7,b7 be appointed by the ,president without the advice and consent of the ,senate2 and 7,c7 report to the ,director4 7#c7 ,reference ,any reference to the ,assistant ,secretary for ,infrastructure ,protection in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,assistant ,director for ,infrastructure ,security4 7b7 ,functions ,the ,assistant ,director shall-- 7#a7 direct the critical infrastructure security efforts of the ,agency2 7#b7 carry out1 at the direction of the ,director1 the ,chemical ,facilities ,anti-,terrorism ,standards ,program established under title ,,xxi and the secure handling of ammonium nitrate program established under subtitle ,j of title ,,viii1 or any successor programs2 7#c7 fully participate in the mechanisms required under section #bbjb7;c77#g72 and 7#d7 carry out such other duties and powers as prescribed by the ,director4 4 7b7 ,treatment of certain positions 7#a7 ,under secretary ,the individual serving as the ,under ,secretary appointed pursuant to section #ajc7;a77#a77;,h7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aac7;a77#a77;,h77 of the ,department of ,homeland ,security on the day before the date of enactment of this ,act may continue to serve as the ,director of ,cybersecurity and ,infrastructure ,security of the ,department on and after such date4 7#b7 ,director for emergency communications ,the individual serving as the ,director for ,emergency ,communications of the ,department of ,homeland ,security on the day before the date of enactment of this ,act may continue to serve as the ,assistant ,director for ,emergency ,communications of the ,department on and after such date4 7#c7 ,assistant secretary for cybersecurity and communications ,the individual serving as the ,assistant ,secretary for ,cybersecurity and ,communications on the day before the date of enactment of this ,act may continue to serve as the ,assistant ,director for ,cybersecurity on and after such date4 7#d7 ,assistant secretary for infrastructure protection ,the individual serving as the ,assistant ,secretary for ,infrastructure ,protection on the day before the date of enactment of this ,act may continue to serve as the ,assistant ,director for ,infrastructure ,security on and after such date4 7c7 ,reference ,any reference to-- 7#a7 the ,office of ,emergency ,communications in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,emergency ,communications ,division2 and 7#b7 the ,director for ,emergency ,communications in any law1 regulation1 map1 document1 record1 or other paper of the ,united ,states shall be deemed to be a reference to the ,assistant ,director for ,emergency ,communications4 7d7 ,oversight ,the ,director of ,cybersecurity and ,infrastructure ,security of the ,department of ,homeland ,security shall provide to ,congress1 in accordance with the deadlines specified in paragraphs 7#a7 through 7#f71 information on the following3 7#a7 ,not later than #fj days after the date of enactment of this ,act1 a briefing on the activities of the ,agency relating to the development and use of the mechanisms required pursuant to section #bbjb7;c77#f7 of the ,homeland ,security ,act of #bjjb 7as added by subsection 7a774 7#b7 ,not later than #a year after the date of the enactment of this ,act1 a briefing on the activities of the ,agency relating to the use and improvement by the ,agency of the mechanisms required pursuant to section #bbjb7;c77#f7 of the ,homeland ,security ,act of #bjjb and how such activities have impacted coordination1 situational awareness1 and communications with ,sector-,specific ,agencies4 7#c7 ,not later than #ij days after the date of the enactment of this ,act1 information on the mechanisms of the ,agency for regular and ongoing consultation and collaboration1 as required pursuant to section #bbjb7;c77#g7 of the ,homeland ,security ,act of #bjjb 7as added by subsection 7a774 7#d7 ,not later than #a year after the date of the enactment of this ,act1 information on the activities of the consultation and collaboration mechanisms of the ,agency as required pursuant to section #bbjb7;c77#g7 of the ,homeland ,security ,act of #bjjb1 and how such mechanisms have impacted operational coordination1 situational awareness1 and integration across the ,agency4 7#e7 ,not later than #ahj days after the date of enactment of this ,act1 information1 which shall be made publicly available and updated as appropriate1 on the mechanisms and structures of the ,agency responsible for stakeholder outreach and engagement1 as required under section #bbjb7;c77#aj7 of the ,homeland ,security ,act of #bjjb 7as added by subsection 7a774 7e7 ,cyber workforce ,not later than #ij days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 in coordination with the ,director of the ,office of ,personnel ,management1 shall submit to ,congress a report detailing how the ,agency is meeting legislative requirements under the ,cybersecurity ,workforce ,assessment ,act 7,public ,law #aac-bdf2 #abh ,stat4 #bhhj7 and the ,homeland ,security ,cybersecurity ,workforce ,assessment ,act 7enacted as section #d of the ,border ,patrol ,agent ,pay ,reform ,act of #bjad2 ,public ,law #aac-bgg7 to address cyber workforce needs4 7f7 ,facility ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security shall report to ,congress on the most efficient and effective methods of consolidating ,agency facilities1 personnel1 and programs to most effectively carry out the ,agency's mission4 7g7 ,technical and conforming amendments to the homeland security act of #bjjb ,the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja et seq47 is amended-- 7#a7 by amending section #ajc7;a77#a77;,h7 7#f ,u4,s4,c4 #aac7;a77#a77;,h77 to read as follows3 7,h7 ,a ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 2 7#b7 in title ,,ii 7#f ,u4,s4,c4 #aba et seq47-- 7,a7 in the title heading1 by striking and infrastructure protection2 7,b7 in the subtitle ,a heading1 by striking and infrastructure protection2 7,c7 in section #bja 7#f ,u4,s4,c4 #aba7-- 7i7 in the section heading1 by striking and infrastructure protection2 7ii7 in subsection 7a7-- 7,i7 in the subsection heading1 by striking and infrastructure protection2 and 7,,ii7 by striking and an ,office of ,infrastructure ,protection2 7iii7 in subsection 7b7-- 7,i7 in the subsection heading1 by striking and ,assistant ,secretary for ,infrastructure ,protection2 and 7,,ii7 by striking paragraph 7#c72 7iv7 in subsection 7c7-- 7,i7 by striking and infrastructure protection2 and 7,,ii7 by striking or the ,assistant ,secretary for ,infrastructure ,protection1 as appropriate2 7v7 in subsection 7d7-- 7,i7 in the subsection heading1 by striking and infrastructure protection2 7,,ii7 in the matter preceding paragraph 7#a71 by striking and infrastructure protection2 7,,iii7 by striking paragraphs 7#e71 7#f71 and 7#be72 7,,iv7 by redesignating paragraphs 7#g7 through 7#bd7 as paragraphs 7#e7 through 7#bb71 respectively2 7,v7 by redesignating paragraph 7#bf7 as paragraph 7#bc72 and 7,,vi7 in paragraph 7#bc77;,b77i71 as so redesignated1 by striking section #cai and inserting section #cbj2 7vi7 in subsection 7e77#a71 by striking and the ,office of ,infrastructure ,protection2 and 7vii7 in subsection 7f77#a71 by striking and the ,office of ,infrastructure ,protection2 7,d7 in section #bjb 7#f ,u4,s4,c4 #abb7-- 7i7 in subsection 7c71 in the matter preceding paragraph 7#a71 by striking ,director of ,central ,intelligence and inserting ,director of ,national ,intelligence2 and 7ii7 in subsection 7d77#b71 by striking ,director of ,central ,intelligence and inserting ,director of ,national ,intelligence2 7,e7 in section #bjd 7#f ,u4,s4,c4 #abd;a7-- 7i7 in subsection 7c77#a71 in the matter preceding subparagraph 7,a71 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7ii7 in subsection 7d77#a71 in the matter preceding subparagraph 7,a71 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,f7 in section #baj;,a7c77#b77;,b7 7#f ,u4,s4,c4 #abd;h7c77#b77;,b771 by striking ,office of ,infrastructure ,protection and inserting ,cybersecurity and ,infrastructure ,security ,agency2 7,g7 by redesignating section #baj;,e 7#f ,u4,s4,c4 #abdl7 as section #bbad and transferring such section to appear after section #bbac 7as redesignated by subparagraph 7,i772 7,h7 in subtitle ,b1 by redesignating sections #baa through #bae 7#f ,u4,s4,c4 #aja note1 and #aca through #acd7 as sections #bbba through #bbbe1 respectively1 and transferring such subtitle1 including the enumerator and heading of subtitle ,b and such sections1 to appear after section #bbad 7as redesignated by subparagraph 7,g772 7,i7 by redesignating sections #bbc through #bcj 7#f ,u4,s4,c4 #adc through #aea7 as sections #bbje through #bbac1 respectively1 and transferring such sections to appear after section #bbjd1 as added by this ,act2 7,j7 by redesignating section #baj;,f as section #baj;,e2 and 7,k7 by redesignating subtitles ,c and ,d as subtitles ,b and ,c1 respectively2 7#c7 in title ,,iii 7#f ,u4,s4,c4 #aha et seq47-- 7,a7 in section #cjb 7#f ,u4,s4,c4 #ahb7-- 7i7 by striking biological11 each place that term appears and inserting biological12 and 7ii7 in paragraph 7#c71 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,b7 by redesignating the second section #cai 7#f ,u4,s4,c4 #aie;f7 7relating to ,,emp and ,,gmd mitigation research and development7 as section #cbj2 and 7,c7 in section #cbj7;c77#a71 as so redesignated1 by striking ,section #bad and inserting ,section #bbbd2 7#d7 in title ,v 7#f ,u4,s4,c4 #caa et seq47-- 7,a7 in section #ejh7;d77#b77;,d7 7#f ,u4,s4,c4 #cah7;d77#b77;,d771 by striking ,the ,director of the ,office of ,emergency ,communications of the ,department of ,homeland ,security and inserting ,the ,assistant ,director for ,emergency ,communications2 7,b7 in section #ead 7#f ,u4,s4,c4 #cba;c7-- 7i7 by striking subsection 7b72 and 7ii7 by redesignating subsection 7c7 as subsection 7b72 and 7,c7 in section #ebc 7#f ,u4,s4,c4 #cbal7-- 7i7 in subsection 7a71 in the matter preceding paragraph 7#a71 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of ,cybersecurity and ,infrastructure ,security2 and 7ii7 in subsection 7c71 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of ,cybersecurity and ,infrastructure ,security2 7#e7 in title ,,viii 7#f ,u4,s4,c4 #cfa et seq47-- 7,a7 in section #hhd7;d77#d77;,a77ii7 7#f ,u4,s4,c4 #dfd7;d77#d77;,a77ii771 by striking ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department and inserting ,director of ,cybersecurity and ,infrastructure ,security2 and 7,b7 in section #hii;,b7a7 7#f ,u4,s4,c4 #dhh;a7a771 by adding at the end the following3 ,such regulations shall be carried out by the ,cybersecurity and ,infrastructure ,security ,agency42 7#f7 in title ,,xviii 7#f ,u4,s4,c4 #ega et seq47-- 7,a7 in section #ahja 7#f ,u4,s4,c4 #ega7-- 7i7 in the section heading1 by striking ,office of ,emergency ,communications and inserting ,emergency ,communications ,division2 7ii7 in subsection 7a7-- 7,i7 by striking ,office of ,emergency ,communications and inserting ,emergency ,communications ,division2 and 7,,ii7 by adding at the end the following3 ,the ,division shall be located in the ,cybersecurity and ,infrastructure ,security ,agency42 7iii7 by amending subsection 7b7 to read as follows3 7b7 ,assistant director ,the head of the ,division shall be the ,assistant ,director for ,emergency ,communications4 ,the ,assistant ,director shall report to the ,director of ,cybersecurity and ,infrastructure ,security4 ,all decisions of the ,assistant ,director that entail the exercise of significant authority shall be subject to the approval of the ,director of ,cybersecurity and ,infrastructure ,security4 2 7iv7 in subsection 7c7-- 7,i7 in the matter preceding paragraph 7#a71 by inserting ,assistant before ,director2 7,,ii7 in paragraph 7#ad71 by striking and at the end2 7,,iii7 in paragraph 7#ae71 by striking the period at the end and inserting 2 and2 and 7,,iv7 by inserting after paragraph 7#ae7 the following3 7#af7 fully participate in the mechanisms required under section #bbjb7;c77#g74 2 7v7 in subsection 7d71 in the matter preceding paragraph 7#a71 by inserting ,assistant before ,director2 and 7vi7 in subsection 7e71 in the matter preceding paragraph 7#a71 by inserting ,assistant before ,director2 7,b7 in sections #ahjb through #ahje 7#f ,u4,s4,c4 #egb through #ege71 by striking ,director for ,emergency ,communications each place that term appears and inserting ,assistant ,director for ,emergency ,communications2 7,c7 in section #ahji 7#f ,u4,s4,c4 #egi7-- 7i7 by striking ,director of ,emergency ,communications each place that term appears and inserting ,assistant ,director for ,emergency ,communications2 7ii7 in subsection 7b7-- 7,i7 by striking ,director for ,emergency ,communications and inserting ,assistant ,director for ,emergency ,communications2 and 7,,ii7 by striking ,office of ,emergency ,communications and inserting ,emergency ,communications ,division2 7iii7 in subsection 7e77#c71 by striking the ,director and inserting the ,assistant ,director2 and 7iv7 in subsection 7m77#a7-- 7,i7 by striking ,the ,director and inserting ,the ,assistant ,director2 7,,ii7 by striking the ,director determines and inserting the ,assistant ,director determines2 and 7,,iii7 by striking ,office of ,emergency ,communications and inserting ,cybersecurity and ,infrastructure ,security ,agency2 7,d7 in section #ahaj 7#f ,u4,s4,c4 #ehj7-- 7i7 in subsection 7a77#a71 by striking ,director of the ,office of ,emergency ,communications 7referred to in this section as the ,director7 and inserting ,assistant ,director for ,emergency ,communications 7referred to in this section as the ,assistant ,director72 7ii7 in subsection 7c71 by striking ,office of ,emergency ,communications and inserting ,emergency ,communications ,division2 and 7iii7 by striking ,director each place that term appears and inserting ,assistant ,director2 7#g7 in title ,,xx 7#f ,u4,s4,c4 #fja et seq47-- 7,a7 in paragraph 7#d77;,a77iii77,,ii7 of section #bjja 7#f ,u4,s4,c4 #fja71 by striking section #baj;,e7a77#b7 and inserting section #bbad7;a77#b72 7,b7 in section #bjjh7;a77#c7 7#f ,u4,s4,c4 #fji7;a77#c771 by striking section #baj;,e7a77#b7 and inserting section #bbad7;a77#b72 and 7,c7 in section #bjba 7#f ,u4,s4,c4 #faa7-- 7i7 by striking subsection 7c72 and 7ii7 by redesignating subsection 7d7 as subsection 7c72 7#h7 in title ,,xxi 7#f ,u4,s4,c4 #fba et seq47-- 7,a7 in section #bajb7;a77#a7 7#f ,u4,s4,c4 #fbb7;a77#a771 by inserting 1 which shall be located in the ,cybersecurity and ,infrastructure ,security ,agency before the period at the end2 and 7,b7 in section #bajd7;c77#b7 7#f ,u4,s4,c4 #fbd7;c77#b771 by striking ,under ,secretary responsible for overseeing critical infrastructure protection1 cybersecurity1 and other related programs of the ,department appointed under section #ajc7;a77#a77;,h7 and inserting ,director of ,cybersecurity and ,infrastructure ,security2 and 7#i7 in title ,,xxii1 as added by this ,act-- 7,a7 in subtitle ,a-- 7i7 in section #bbje1 as so redesignated-- 7,i7 in the matter preceding paragraph 7#a7-- 7aa7 by striking section #bja and inserting section #bbjb2 and 7bb7 by striking ,under ,secretary appointed under section #ajc7;a77#a77;,h7 and inserting ,director of ,cybersecurity and ,infrastructure ,security2 and 7,,ii7 in paragraph 7#a77;,b71 by striking and at the end2 7ii7 in section #bbjf1 as so redesignated1 by striking ,assistant ,secretary for ,infrastructure ,protection and inserting ,director of ,cybersecurity and ,infrastructure ,security2 7iii7 in section #bbji1 as so redesignated-- 7,i7 by striking ,under ,secretary appointed under section #ajc7;a77#a77;,h7 each place that term appears and inserting ,director2 7,,ii7 in subsection 7a77#d71 by striking section #bab7e7 and inserting section #bbbb7e72 7,,iii7 in subsection 7b71 by adding at the end the following3 ,the ,center shall be located in the ,cybersecurity and ,infrastructure ,security ,agency4 ,the head of the ,center shall report to the ,assistant ,director for ,cybersecurity42 and 7,,iv7 in subsection 7c77#aa71 by striking ,office of ,emergency ,communications and inserting ,emergency ,communications ,division2 7iv7 in section #bbaj1 as so redesignated-- 7,i7 by striking section #bbg each place that term appears and inserting section #bbji2 and 7,,ii7 in subsection 7c7-- 7aa7 by striking ,under ,secretary appointed under section #ajc7;a77#a77;,h7 and inserting ,director of ,cybersecurity and ,infrastructure ,security2 and 7bb7 by striking section #bab7e7 and inserting section #bbbb7e72 7v7 in section #bbaa7;b77#b77;,a71 as so redesignated1 by striking the section #bbg and inserting section #bbji2 7vi7 in section #bbab1 as so redesignated1 by striking section #bab7e7 and inserting section #bbbb7e72 7vii7 in section #bbac7;a71 as so redesignated-- 7,i7 in paragraph 7#c71 by striking section #bbh and inserting section #bbaj2 and 7,,ii7 in paragraph 7#d71 by striking section #bbg and inserting section #bbji2 and 7viii7 in section #bbad1 as so redesignated-- 7,i7 by striking subsection 7e72 and 7,,ii7 by redesignating subsection 7f7 as subsection 7e72 and 7,b7 in subtitle ,b-- 7i7 in section #bbbb7h71 as so redesignated1 by striking section #bbg and inserting section #bbji2 and 7ii7 in section #bbbd7;h71 as so redesignated1 by striking section #bac and inserting section #bbbc2 7h7 ,technical and conforming amendments to other laws 7#a7 ,cybersecurity act of #bjae ,the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq47 is amended-- 7,a7 in section #bjb7b7 7#f ,u4,s4,c4 #aca note7-- 7i7 by striking section #bbg and inserting section #bbji2 and 7ii7 by striking 1 as so redesignated by section #bbc7;a77#c7 of this division2 7,b7 in section #bjg7b7 7,public ,law #aad-aac2 #abi ,stat4 #bifb7-- 7i7 by striking section #bbg and inserting section #bbji2 and 7ii7 by striking 1 as redesignated by section #bbc7;a7 of this division12 7,c7 in section #bjh 7,public ,law #aad-aac2 #abi ,stat4 #bifb71 by striking ,under ,secretary appointed under section #ajc7;a77#a77;,h7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aac7;a77#a77;,h77 and inserting ,director of ,cybersecurity and ,infrastructure ,security of the ,department2 7,d7 in section #bbb 7#f ,u4,s4,c4 #aeba7-- 7i7 in paragraph 7#b7-- 7,i7 by striking section #bbh and inserting section #bbaj2 and 7,,ii7 by striking 1 as added by section #bbc7;a77#d7 of this division2 and 7ii7 in paragraph 7#d7-- 7,i7 by striking section #bbg and inserting section #bbji2 and 7,,ii7 by striking 1 as so redesignated by section #bbc7;a77#c7 of this division2 7,e7 in section #bbc7;b7 7#f ,u4,s4,c4 #aea note7-- 7i7 by striking section #bcj7;b77#a7 of the ,homeland ,security ,act of #bjjb1 as added by subsection 7a7 each place that term appears and inserting section #bbac7;b77#a7 of the ,homeland ,security ,act of #bjjb2 and 7ii7 in paragraph 7#a77;,b71 by striking section #bcj7;b77#b7 of the ,homeland ,security ,act of #bjjb1 as added by subsection 7a7 and inserting section #bbac7;b77#b7 of the ,homeland ,security ,act of #bjjb2 7,f7 in section #bbf 7#f ,u4,s4,c4 #aebd7-- 7i7 in subsection 7a7-- 7,i7 in paragraph 7#a7-- 7aa7 by striking section #bcj and inserting section #bbac2 and 7bb7 by striking 1 as added by section #bbc7;a77#f7 of this division2 7,,ii7 in paragraph 7#d7-- 7aa7 by striking section #bbh7;b77#a7 and inserting section #bbaj7;b77#a72 and 7bb7 by striking 1 as added by section #bbc7;a77#d7 of this division2 and 7,,iii7 in paragraph 7#e7-- 7aa7 by striking section #bcj7;b7 and inserting section #bbac7;b72 and 7bb7 by striking 1 as added by section #bbc7;a77#f7 of this division2 and 7ii7 in subsection 7c77#a77;,a77vi7-- 7,i7 by striking section #bcj7;c77#e7 and inserting section #bbac7;c77#e72 and 7,,ii7 by striking 1 as added by section #bbc7;a77#f7 of this division2 7,g7 in section #bbg 7#f ,u4,s4,c4 #aebe7-- 7i7 in subsection 7a7-- 7,i7 by striking section #bcj and inserting section #bbac2 and 7,,ii7 by striking 1 as added by section #bbc7;a77#f7 of this division12 and 7ii7 in subsection 7b7-- 7,i7 by striking section #bcj7;d77#b7 and inserting section #bbac7;d77#b72 and 7,,ii7 by striking 1 as added by section #bbc7;a77#f7 of this division12 and 7,h7 in section #djd 7#f ,u4,s4,c4 #aecb7-- 7i7 by striking ,director for ,emergency ,communications each place that term appears and inserting ,assistant ,director for ,emergency ,communications2 and 7ii7 in subsection 7a7-- 7,i7 by striking section #bbg and inserting section #bbji2 and 7,,ii7 by striking 1 as redesignated by section #bbc7;a77#c7 of this division14 7#b7 ,small ,business ,act ,section #ba7;a77#h77;,b7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fdh7;a77#h77;,b77 is amended by striking section #bbg7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #adh7;a77 and inserting section #bbji7;a7 of the ,homeland ,security ,act of #bjjb4 7#c7 ,title #e ,subchapter ,,ii of chapter #ec of title #e1 ,united ,states ,code1 is amended-- 7,a7 in section #ecad1 by inserting after ,under ,secretaries1 ,department of ,homeland ,security4 the following3 ,director1 ,cybersecurity and ,infrastructure ,security ,agency4 2 and 7,b7 in section #ecae1 by inserting after ,assistant ,secretaries1 ,department of ,homeland ,security4 the following3 ,assistant ,director for ,cybersecurity1 ,cybersecurity and ,infrastructure ,security ,agency4 ,assistant ,director for ,infrastructure ,security1 ,cybersecurity and ,infrastructure ,security ,agency4 4 7i7 ,table of contents amendments ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended-- 7#a7 by striking the item relating to title ,,ii and inserting the following3 ,,title ,,ii--,,information ,,analysis 2 7#b7 by striking the item relating to subtitle ,a of title ,,ii and inserting the following3 ,subtitle ,a--,information and analysis2 ,access to ,information 2 7#c7 by striking the item relating to section #bja and inserting the following3 ,sec4 #bja4 ,information and analysis4 2 7#d7 by striking the items relating to sections #baj;,e and #baj;,f and inserting the following3 ,sec4 #baj;,e4 ,classified ,information ,advisory ,officer4 2 7#e7 by striking the items relating to subtitle ,b of title ,,ii and sections #baa through #bae2 7#f7 by striking the items relating to section #bbc through section #bcj2 7#g7 by striking the item relating to subtitle ,c and inserting the following3 ,subtitle ,b--,information ,security 2 7#h7 by striking the item relating to subtitle ,d and inserting the following3 ,subtitle ,c--,office of ,science and ,technology 2 7#i7 by striking the items relating to sections #cag1 #cai1 #cah1 and #cai and inserting the following3 ,sec4 #cag4 ,promoting antiterrorism through international cooperation program4,sec4 #cah4 ,social media working group4,sec4 #cai4 ,transparency in research and development4,sec4 #cbj4 ,,emp and ,,gmd mitigation research and development4 2 7#aj7 by striking the item relating to section #ahja and inserting the following3 ,sec4 #ahja4 ,emergency ,communications ,division4 2 and 7#aa7 by adding at the end the following3 ,,title ,,xxii--,,cybersecurity ,,and ,,infrastructure ,,security ,a,g,e,n,c,y,subtitle ,a--,cybersecurity and ,infrastructure ,security,sec4 #bbja4 ,definitions4,sec4 #bbjb4 ,cybersecurity and ,infrastructure ,security ,agency4,sec4 #bbjc4 ,cybersecurity ,division4,sec4 #bbjd4 ,infrastructure ,security ,division4,sec4 #bbje4 ,enhancement of ,federal and non-,federal cybersecurity4,sec4 #bbjf4 ,net guard4,sec4 #bbjg4 ,cyber ,security ,enhancement ,act of #bjjb4,sec4 #bbjh4 ,cybersecurity recruitment and retention4,sec4 #bbji4 ,national cybersecurity and communications integration center4,sec4 #bbaj4 ,cybersecurity plans4,sec4 #bbaa4 ,cybersecurity strategy4,sec4 #bbab4 ,clearances4,sec4 #bbac4 ,federal intrusion detection and prevention system4,sec4 #bbad4 ,national ,asset ,database4,subtitle ,b--,critical ,infrastructure ,information,sec4 #bbba4 ,short title4,sec4 #bbbb4 ,definitions4,sec4 #bbbc4 ,designation of critical infrastructure protection program4,sec4 #bbbd4 ,protection of voluntarily shared critical infrastructure information4,sec4 #bbbe4 ,no private right of action4 4 #c4 ,transfer of other entities 7a7 ,office of biometric identity management ,the ,office of ,biometric ,identity ,management of the ,department of ,homeland ,security located in the ,national ,protection and ,programs ,directorate of the ,department of ,homeland ,security on the day before the date of enactment of this ,act is hereby transferred to the ,management ,directorate of the ,department4 7b7 ,federal protective service 7#a7 ,in general ,not later than #ij days after the completion of the ,government ,accountability ,office review of the organizational placement of the ,federal ,protective ,service 7authorized under section #acae of title #dj1 ,united ,states ,code71 the ,secretary of ,homeland ,security shall determine the appropriate placement of the ,service within the ,department of ,homeland ,security and commence the transfer of the ,service to such component1 directorate1 or other office of the ,department that the ,secretary so determines appropriate4 7#b7 ,exception ,if the ,secretary of ,homeland ,security determines pursuant to paragraph 7#a7 that no component1 directorate1 or other office of the ,department of ,homeland ,security is an appropriate placement for the ,federal ,protective ,service1 the ,secretary shall-- 7,a7 provide to the ,committee on ,homeland ,security and the ,committee on ,transportation and ,infrastructure of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,office of ,management and ,budget a detailed explanation1 in writing1 of the reason for such determination that includes-- 7i7 information on how the ,department considered the ,government ,accountability ,office review described in such paragraph2 7ii7 a list of the components1 directorates1 or other offices of the ,department that were considered for such placement2 and 7iii7 information on why each such component1 directorate1 or other office of the ,department was determined to not be an appropriate placement for the ,service2 7,b7 not later than #abj days after the completion of the ,government ,accountability ,office review described in such paragraph1 develop and submit to the committees specified in subparagraph 7,a7 and the ,office of ,management and ,budget a plan to coordinate with other appropriate ,federal agencies1 including the ,general ,services ,administration1 to determine a more appropriate placement for the ,service2 and 7,c7 not later than #ahj days after the completion of such ,government ,accountability ,office review1 submit to such committees and the ,office of ,management and ,budget a recommendation regarding the appropriate placement of the ,service within the executive branch of the ,federal ,government4 #d4 ,,dhs report on cloud-based cybersecurity 7a7 ,definition ,in this section1 the term ,department means the ,department of ,homeland ,security4 7b7 ,report ,not later than #abj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security1 in coordination with the ,director of the ,office of ,management and ,budget and the ,administrator of ,general ,services1 shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,government ,reform and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the leadership role of the ,department in cloud-based cybersecurity deployments for civilian ,federal departments and agencies1 which shall include-- 7#a7 information on the plan of the ,department for ensuring access to a security operations center as a service capability in accordance with the ,december #ai1 #bjag ,report to the ,president on ,federal ,,it ,modernization issued by the ,american ,technology ,council2 7#b7 information on what service capabilities under paragraph 7#a7 the ,department will prioritize1 including-- 7,a7 criteria the ,department will use to evaluate capabilities offered by the private sector2 and 7,b7 how ,federal government- and private sector-provided capabilities will be integrated to enable visibility and consistency of such capabilities across all cloud and on premise environments1 as called for in the report described in paragraph 7#a72 and 7#c7 information on how the ,department will adapt the current capabilities of1 and future enhancements to1 the intrusion detection and prevention system of the ,department and the ,continuous ,diagnostics and ,mitigation ,program of the ,department to secure civilian ,federal government networks in a cloud environment4 #e4 ,rule of construction ,nothing in this ,act or an amendment made by this ,act may be construed as-- 7#a7 conferring new authorities to the ,secretary of ,homeland ,security1 including programmatic1 regulatory1 or enforcement authorities1 outside of the authorities in existence on the day before the date of enactment of this ,act2 7#b7 reducing or limiting the programmatic1 regulatory1 or enforcement authority vested in any other ,federal agency by statute2 or 7#c7 affecting in any manner the authority1 existing on the day before the date of enactment of this ,act1 of any other ,federal agency or component of the ,department of ,homeland ,security4 #f4 ,prohibition on additional funding ,no additional funds are authorized to be appropriated to carry out this ,act or the amendments made by this ,act4 ,this ,act and the amendments made by this ,act shall be carried out using amounts otherwise authorized4 ,secretary