,,ii ,calendar ,no4 #deh #aafth         
,,congress  #b;d ,session  ,s4 #cbjg    
,report ,no4 #aaf-bbg ,,in ,,the        
,,senate ,,of ,,the ,,united ,,states   
,january #af1 #bjbj,ms4 ,hassan 7for    
herself1 ,mr4 ,cornyn1 ,mr4 ,portman1   
,mr4 ,peters1 ,ms4 ,rosen1 ,mr4 ,van    
,hollen1 and ,ms4 ,sinema7 introduced   
the following bill2 which was read twice
 and referred to the ,committee on      
,homeland ,security and ,governmental   
,affairs  ,june #a1 #bjbj,reported by   
,mr4 ,johnson1 with an amendment,strike 
out all after the enacting clause and   
insert the part printed in italic  ,a   
,,bill  ,to require the ,director of the
 ,cybersecurity and ,infrastructure     
,security ,agency to establish a        
,cybersecurity ,state ,coordinator in   
each ,state1 and for other purposes4    
#a4 ,short title ,this ,act may be cited
 as the ,cybersecurity ,state           
,coordinator ,act of #bjbj4  #b4        
,findings ,congress finds that-- 7#a7   
cyber threats1 such as ransomware1      

against ,state1 local1 ,tribal1 and     
territorial entities have grown at an   
alarming rate2  7#b7 ,state1 local1     
,tribal1 and territorial entities face a
 growing threat from advanced persistent
 threat actors1 hostile nation states1  
criminal groups1 and other malicious    
cyber actors2  7#c7 there is an urgent  
need for greater engagement and         
expertise from the ,federal ,government 
to help these entities build their      
resilience and defenses2 and  7#d7      
coordination within ,federal entities   
and between ,federal and non-,federal   
entities1 including ,state1 local1      
,tribal1 and territorial governments1   
,information ,sharing and ,analysis     
,centers1 election officials1 ,state    
adjutants general1 and other            
non-,federal entities1 is critical to   
anticipating1 preventing1 managing1 and 
recovering from cyberattacks4  #c4      
,cybersecurity ,state ,coordinator  7a7 
,in general ,subtitle ,a of title ,,xxii
 of the ,homeland ,security ,act of     

#bjjb 7#f ,u4,s4,c4 #fea et seq47 is    
amended-- 7#a7 in section #bbjb7;c7 7#f 
,u4,s4,c4 #feb7;c77-- 7,a7 in paragraph 
7#aj71 by striking and at the end2  7,b7
 by redesignating paragraph 7#aa7 as    
paragraph 7#ab72 and  7,c7 by inserting 
after paragraph 7#aj7 the following3    
7#aa7 appoint a ,cybersecurity ,state   
,coordinator in each ,state1 as         
described in section #bbae2 and  2 and  
7#b7 by adding at the end the following3
  #bbae4 ,cybersecurity ,state          
,coordinator  7a7 ,appointment ,the     
,director shall appoint an employee of  
the ,agency in each ,state who shall    
serve as the ,cybersecurity ,state      
,coordinator4  7b7 ,duties ,the duties  
of a ,cybersecurity ,state ,coordinator 
appointed under subsection 7b7 shall    
include-- 7#a7 building strategic       
relationships across ,federal and       
non-,federal entities by advising on    
establishing governance structures to   
facilitate developing and maintaining   
secure and resilient infrastructure2    

7#b7 serving as a principal ,federal    
cybersecurity risk advisor and          
coordinating between ,federal and       
non-,federal entities to support        
preparation1 response1 and remediation  
efforts relating to cybersecurity risks 
and incidents2  7#c7 facilitating the   
sharing of cyber threat information     
between ,federal and non-,federal       
entities to improve understanding of    
cybersecurity risks and situational     
awareness of cybersecurity incidents2   
7#d7 raising awareness of the financial1
 technical1 and operational resources   
available from the ,federal ,government 
to non-,federal entities to increase    
resilience against cyber threats2  7#e7 
supporting training1 exercises1 and     
planning for continuity of operations to
 expedite recovery from cybersecurity   
incidents1 including ransomware2  7#f7  
serving as a principal point of contact 
for non-,federal entities to engage with
 the ,federal ,government on preparing1 
managing1 and responding to             

cybersecurity incidents2  7#g7 assisting
 non-,federal entities in developing and
 coordinating vulnerability disclosure  
programs consistent with ,federal and   
information security industry standards2
 and  7#h7 performing such other duties 
as necessary to achieve the goal of     
managing cybersecurity risks in the     
,united ,states and reducing the impact 
of cyber threats to non-,federal        
entities4  7c7 ,feedback ,the ,director 
shall take into account relevant        
feedback provided by ,state and local   
officials regarding the appointment1 and
 ,state and local officials and other   
non-,federal entities regarding the     
performance1 of the ,cybersecurity      
,state ,coordinator of a ,state4  4  7b7
 ,oversight ,not later than #a year     
after the date of enactment of this     
,act1 the ,director of the              
,cybersecurity and ,infrastructure      
,security ,agency shall provide to the  
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate   

and the ,committee on ,homeland         
,security of the ,house of              
,representatives a briefing on the      
placement and efficacy of the           
,cybersecurity ,state ,coordinators     
appointed under section #bbae of the    
,homeland ,security ,act of #bjjb1 as   
added by subsection 7a74  7c7 ,rule of  
construction ,nothing in this section or
 the amendments made by this section    
shall be construed to affect or         
otherwise modify the authority of       
,federal law enforcement agencies with  
respect to investigations relating to   
cybersecurity incidents4  7d7 ,technical
 and conforming amendment ,the table of 
contents in section #a7;b7 of the       
,homeland ,security ,act of #bjjb       
7,public ,law #ajg-bif2 #aaf ,stat4     
#bace7 is amended by inserting after the
 item relating to section #bbad the     
following3  ,sec4 #bbae4 ,cybersecurity 
,state ,coordinator4  4  #a4 ,short     
title ,this ,act may be cited as the    
,cybersecurity ,state ,coordinator ,act 

of #bjbj4  #b4 ,findings ,congress finds
 that-- 7#a7 cyber threats1 such as     
ransomware1 against ,state1 local1      
,tribal1 and territorial entities have  
grown at an alarming rate2  7#b7 ,state1
 local1 ,tribal1 and territorial        
entities face a growing threat from     
advanced persistent threat actors1      
hostile nation states1 criminal groups1 
and other malicious cyber actors2  7#c7 
there is an urgent need for greater     
engagement and expertise from the       
,federal ,government to help these      
entities build their resilience and     
defenses2 and  7#d7 coordination within 
,federal entities and between ,federal  
and non-,federal entities1 including    
,state1 local1 ,tribal1 and territorial 
governments1 ,information ,sharing and  
,analysis ,centers1 election officials1 
,state adjutants general1 and other     
non-,federal entities1 is critical to   
anticipating1 preventing1 managing1 and 
recovering from cyberattacks4  #c4      
,cybersecurity ,state ,coordinator  7a7 

,in general ,subtitle ,a of title ,,xxii
 of the ,homeland ,security ,act of     
#bjjb 7#f ,u4,s4,c4 #fea et seq47 is    
amended-- 7#a7 in section #bbjb7;c7 7#f 
,u4,s4,c4 #feb7;c77-- 7,a7 in paragraph 
7#aj71 by striking and at the end2  7,b7
 by redesignating paragraph 7#aa7 as    
paragraph 7#ab72 and  7,c7 by inserting 
after paragraph 7#aj7 the following3    
7#aa7 appoint a ,cybersecurity ,state   
,coordinator in each ,state1 as         
described in section #bbae2 and  2 and  
7#b7 by adding at the end the following3
  #bbae4 ,cybersecurity ,state          
,coordinator  7a7 ,appointment ,the     
,director shall appoint an employee of  
the ,agency in each ,state1 with the    
appropriate cybersecurity qualifications
 and expertise1 who shall serve as the  
,cybersecurity ,state ,coordinator4  7b7
 ,duties ,the duties of a ,cybersecurity
 ,state ,coordinator appointed under    
subsection 7a7 shall include-- 7#a7     
building strategic relationships across 
,federal and1 on a voluntary basis1     

non-,federal entities by advising on    
establishing governance structures to   
facilitate the development and          
maintenance of secure and resilient     
infrastructure2  7#b7 serving as a      
,federal cybersecurity risk advisor and 
coordinating between ,federal and1 on a 
voluntary basis1 non-,federal entities  
to support preparation1 response1 and   
remediation efforts relating to         
cybersecurity risks and incidents2  7#c7
 facilitating the sharing of cyber      
threat information between ,federal and1
 on a voluntary basis1 non-,federal     
entities to improve understanding of    
cybersecurity risks and situational     
awareness of cybersecurity incidents2   
7#d7 raising awareness of the financial1
 technical1 and operational resources   
available from the ,federal ,government 
to non-,federal entities to increase    
resilience against cyber threats2  7#e7 
supporting training1 exercises1 and     
planning for continuity of operations to
 expedite recovery from cybersecurity   

incidents1 including ransomware2  7#f7  
serving as a principal point of contact 
for non-,federal entities to engage1 on 
a voluntary basis1 with the ,federal    
,government on preparing1 managing1 and 
responding to cybersecurity incidents2  
7#g7 assisting non-,federal entities in 
developing and coordinating             
vulnerability disclosure programs       
consistent with ,federal and information
 security industry standards2 and  7#h7 
performing such other duties as         
determined necessary by the ,director to
 achieve the goal of managing           
cybersecurity risks in the ,united      
,states and reducing the impact of cyber
 threats to non-,federal entities4  7c7 
,feedback ,the ,director shall consult  
with relevant ,state and local officials
 regarding the appointment1 and ,state  
and local officials and other           
non-,federal entities regarding the     
performance1 of the ,cybersecurity      
,state ,coordinator of a ,state4  4  7b7
 ,oversight ,the ,director of the       

,cybersecurity and ,infrastructure      
,security ,agency shall provide to the  
,committee on ,homeland ,security and   
,governmental ,affairs of the ,senate   
and the ,committee on ,homeland         
,security of the ,house of              
,representatives a briefing on the      
placement and efficacy of the           
,cybersecurity ,state ,coordinators     
appointed under section #bbae of the    
,homeland ,security ,act of #bjjb1 as   
added by subsection 7a7-- 7#a7 not later
 than #a year after the date of         
enactment of this ,act2 and  7#b7 not   
later than #b years after providing the 
first briefing under this subsection4   
7c7 ,rule of construction ,nothing in   
this section or the amendments made by  
this section shall be construed to      
affect or otherwise modify the authority
 of ,federal law enforcement agencies   
with respect to investigations relating 
to cybersecurity incidents4  7d7        
,technical and conforming amendment ,the
 table of contents in section #a7;b7 of 

the ,homeland ,security ,act of #bjjb   
7,public ,law #ajg-bif2 #aaf ,stat4     
#bace7 is amended by inserting after the
 item relating to section #bbad the     
following3  ,sec4 #bbae4 ,cybersecurity 
,state ,coordinator4  4  ,june #a1      
#bjbj,reported with an amendment