Sec. 2. Cyber defense of Federal networks
1,019 words·~5 min read·
/bill/114/hr/3313/ih/section-2A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Subtitle C of title II of the Homeland Security Act of 2002 ( 6 U.S.C. 141 et seq. ) is amended by adding at the end the following new sections: Not later than one year after the date of the enactment of this section, the Secretary, in coordination with the Director of the Office of Management and Budget, shall develop and implement an intrusion detection and response plan to detect, identify, and remove intruders in agency information systems. The Secretary, in coordination with the Director, shall update such plan as necessary. The intrusion detection and response plan required under subsection
(a)shall not apply to the Department of Defense or an element of the intelligence community. In this section and sections 231, 232, and 233: The term agency has the meaning given such term in section 3502 of title 44, United States Code. The term cybersecurity risk has the meaning given such term in the second section 226 (relating to the national cybersecurity and communications integration center). The term information system has the meaning given such term in the second section 226 (relating to the national cybersecurity and communications integration center). The term intelligence community has the meaning given such term in section 3(4) of the National Security Act of 1947 ( 50 U.S.C. 3003(4) ). The Secretary shall include in the Department’s efforts to continuously diagnose and mitigate cybersecurity risks advanced network security tools to improve visibility of network activity, including through the use of commercial and free or open source tools, to detect and mitigate intrusions and anomalous activity in agencies’ information systems. The Secretary, in coordination with the Director of the Office of Management and Budget, shall develop and implement a plan to ensure advanced network security tools, including tools described in paragraph (1), to detect and mitigate intrusions and anomalous activity are available for use by each agency. The Secretary, in coordination with the Director of the Office of Management and Budget, and in consultation with the heads of appropriate agencies, shall— review and update operational capabilities to ensure appropriate prioritization and use of network security monitoring tools within such agency networks; and brief the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate on such prioritization and use. The Secretary, in coordination with the Director of the Office of Management and Budget, shall review and update the metrics used to measure security under section 3554 of title 44, United States Code, to include measures of intrusion and incident detection and response times. The Secretary, in coordination with the Director of the Office of Management and Budget, shall increase transparency to the public on agency cybersecurity postures, including by increasing the number of metrics available on Federal Government performance websites and, to the greatest extent practicable, displaying metrics for agencies. Subparagraph
(B)of section 3553(b)(6) of title 44, United States Code, is amended by inserting , operating, and maintaining after deploying . The Secretary, in consultation with the Director of the Office of Management and Budget, shall regularly assess and require implementation of best practices for— securing agency information systems against intrusion; and preventing data exfiltration from such systems in the event of an intrusion. In this section: The term appropriate congressional committees means the Committee on Homeland Security of the House of Representatives and the Committee on Homeland Security and Governmental Affairs of the Senate. The term intrusion assessments means actions taken under the intrusion detection and response plan described in section 230 to detect, identify, and remove intruders in agency information systems. The term intrusion detection and response plan means the intrusion detection and response plan described in section 230. Not later than three years after the date of the enactment of this section, the Comptroller General of the United States shall conduct a study and publish a report on the effectiveness of the approach and strategy of the Department’s capabilities and plans in securing agency information systems, including in the plans and assessments under sections 230, 231, and 232. The Secretary, in coordination with the Director of the Office of Management and Budget, shall— not later than six months after the date of the enactment of this section and 30 days after any update thereto, submit to the appropriate congressional committees the intrusion detection and response plan described in section 230; and not later than one year after the date of the enactment of this section and annually thereafter, submit to Congress— a description of the implementation of such intrusion detection and response plan; the findings of the intrusion assessments conducted pursuant to such intrusion detection and response plan; a description of the advanced network security tools referred to in section 231; information relating to the results of the assessment of the Secretary of Federal cybersecurity best practices under section 232; and the improved metrics referred to in section 231. . Paragraphs
(1)and
(2)of the second section 226 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ; relating to the national cybersecurity and communications integration center) are amended to read as follows: except as provided in subparagraph (B), the term cybersecurity risk means threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or destruction of such information or information systems, including such related consequences caused by an act of terrorism; and such term does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement; the term incident means an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system; . The table of contents for subtitle C of title II of the Homeland Security Act of 2002 is amended by adding at the end the following new items: Sec. 230. Cybersecurity plans. Sec. 231. Advanced internal defenses. Sec. 232. Federal cybersecurity best practices. Sec. 233. Assessment; reports. .
Connectionstraces to 2
Traces to 2 documents
1 reference not yet in our index
- 6 USC 148
Citation graph
cites case law
Cites 3Cited by 0 across 0 sources