,,ii  #aaeth ,,congress  #ast ,session  
,s4 #dab  ,,in ,,the ,,senate ,,of ,,the
 ,,united ,,states  ,february #af1      
#bjag,mr4 ,peters 7for himself and ,mr4 
,perdue7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,homeland ,security and  
,governmental ,affairs  ,a ,,bill  ,to  
amend the ,homeland ,security ,act of   
#bjjb to require ,state and local       
coordination on cybersecurity with the  
national cybersecurity and              
communications integration center1 and  
for other purposes4  #a4 ,short title   
,this ,act may be cited as the ,state   
and ,local ,cyber ,protection ,act of   
#bjag4  #b4 ,state and local            
coordination on cybersecurity with the  
national cybersecurity and              
communications integration center  7a7  
,in general ,section #bbg of the        
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #adh7 is amended by adding at 
the end the following3  7n7 ,state and  
local coordination on cybersecurity     

7#a7 ,in general ,the ,center shall1 to 
the extent practicable-- 7,a7 assist    
,state and local governments1 upon      
request1 in identifying information     
system vulnerabilities2  7,b7 assist    
,state and local governments1 upon      
request1 in identifying information     
security protections commensurate with  
cybersecurity risks and the magnitude of
 the potential harm resulting from the  
unauthorized access1 use1 disclosure1   
disruption1 modification1 or destruction
 of--  7i7 information collected or     
maintained by or on behalf of a ,state  
or local government2 or  7ii7           
information systems used or operated by 
an agency or by a contractor of a ,state
 or local government or other           
organization on behalf of a ,state or   
local government2  7,c7 in consultation 
with ,state and local governments1      
provide and periodically update via a   
web portal tools1 products1 resources1  
policies1 guidelines1 and procedures    
related to information security2  7,d7  

work with senior ,state and local       
government officials1 including ,state  
and local ,chief ,information ,officers1
 through national associations to       
coordinate a nationwide effort to ensure
 effective implementation of tools1     
products1 resources1 policies1          
guidelines1 and procedures related to   
information security to secure and      
ensure the resiliency of ,state and     
local information systems2  7,e7        
provide1 upon request1 operational and  
technical cybersecurity training to     
,state and local government and fusion  
center analysts and operators to address
 cybersecurity risks or incidents2  7,f7
 provide1 in coordination with the      
,chief ,privacy ,officer and the ,chief 
,civil ,rights and ,civil ,liberties    
,officer of the ,department1 privacy and
 civil liberties training to ,state and 
local governments related to            
cybersecurity2  7,g7 provide1 upon      
request1 operational and technical      
assistance to ,state and local          

governments to implement tools1         
products1 resources1 policies1          
guidelines1 and procedures on           
information security by--  7i7 deploying
 technology to assist such ,state or    
local government to continuously        
diagnose and mitigate against cyber     
threats and vulnerabilities1 with or    
without reimbursement2  7ii7 compiling  
and analyzing data on ,state and local  
information security2 and  7iii7        
developing and conducting targeted      
operational evaluations1 including      
threat and vulnerability assessments1 on
 the information systems of ,state and  
local governments2  7,h7 assist ,state  
and local governments to develop        
policies and procedures for coordinating
 vulnerability disclosures1 to the      
extent practicable1 consistent with     
international and national standards in 
the information technology industry1    
including standards developed by the    
,national ,institute of ,standards and  
,technology2 and  7,i7 ensure that      

,state and local governments1 as        
appropriate1 are made aware of the      
tools1 products1 resources1 policies1   
guidelines1 and procedures on           
information security developed by the   
,department and other appropriate       
,federal departments and agencies for   
ensuring the security and resiliency of 
,federal civilian information systems4  
7#b7 ,training ,privacy and civil       
liberties training provided pursuant to 
subparagraph 7,f7 of paragraph 7#a7     
shall include processes1 methods1 and   
information that--  7,a7 are consistent 
with the ,department's ,fair            
,information ,practice ,principles      
developed pursuant to section #eeb;a of 
title #e1 ,united ,states ,code         
7commonly referred to as the ,privacy   
,act of #aigd or the ,privacy ,act72    
7,b7 reasonably limit1 to the greatest  
extent practicable1 the receipt1        
retention1 use1 and disclosure of       
information related to cybersecurity    
risks and incidents associated with     

specific persons that is not necessary1 
for cybersecurity purposes1 to protect  
an information system or network of     
information systems from cybersecurity  
risks or to mitigate cybersecurity risks
 and incidents in a timely manner2  7,c7
 minimize any impact on privacy and     
civil liberties2  7,d7 provide data     
integrity through the prompt removal and
 destruction of obsolete or erroneous   
names and personal information that is  
unrelated to the cybersecurity risk or  
incident information shared and retained
 by the ,center in accordance with this 
section2  7,e7 include requirements to  
safeguard cyber threat indicators and   
defensive measures retained by the      
,center1 including information that is  
proprietary or business-sensitive that  
may be used to identify specific persons
 from unauthorized access or            
acquisition2  7,f7 protect the          
confidentiality of cyber threat         
indicators and defensive measures       
associated with specific persons to the 

greatest extent practicable2 and  7,g7  
ensure all relevant constitutional1     
legal1 and privacy protections are      
observed1 including that information    
obtained from efforts to address        
cybersecurity risks and incidents is    
used only for such purposes1 or as      
specifically authorized by law4  4  7b7 
,congressional oversight ,not later than
 #b years after the date of enactment of
 this ,act1 the national cybersecurity  
and communications integration center of
 the ,department of ,homeland ,security 
shall provide to the ,committee on      
,homeland ,security of the ,house of    
,representatives and the ,committee on  
,homeland ,security and ,governmental   
,affairs of the ,senate information on  
the activities and effectiveness of such
 activities under subsection 7n7 of     
section #bbg of the ,homeland ,security 
,act of #bjjb 7#f ,u4,s4,c4 #adh71 as   
added by subsection 7a7 of this section1
 on ,state and local information        
security4 ,the center shall seek        

feedback from ,state and local          
governments regarding the effectiveness 
of such activities and include such     
feedback in the information required to 
be provided under this subsection4