6 U.S.C. § 660 — Cybersecurity plans

submitted 11 years ago by Pub. L. 107-296 to r/title-6-DOMESTIC-SECURITY · 861 words · no verdicts yet

in plain englishAI-generated · not legal advice

The Secretary must maintain a plan to detect intruders in agency information systems, with specified national-security exceptions. Federal officials must maintain cyber-incident response plans and develop a public strategy to improve cybersecurity for State, local, Tribal, and territorial governments.

(a) “Agency information system” means a system used or operated by an agency or for an agency by another entity; this section does not define the term further. (b)(1) With the Office of Management and Budget Director, the Secretary must develop, implement, and update as needed a plan to routinely and proactively detect, identify, and remove intruders from agency systems. (2) It does not apply to the Department of Defense, a national security system, or an intelligence-community element. (c) With appropriate Federal and non-Federal participants, the Cybersecurity and Infrastructure Security Agency Director must develop, update at least every two years, maintain, and exercise adaptable plans addressing critical-infrastructure cybersecurity risks, and create ways to educate stakeholders about Federal incident-response roles. (d) Consistently with the required National Cybersecurity Incident Response Plan, the Secretary must regularly update, maintain, and exercise the Department’s Cyber Incident Annex to the National Response Framework. (e)(1)(A) Within one year after December 27, 2021, the Secretary through the Director must develop and publish a strategy to improve State, local, Tribal, and territorial cybersecurity, coordinating with appropriate agencies, governments, and stakeholders. (B) It must recommend Federal support for identifying, mitigating, protecting against, detecting, responding to, and recovering from risks, threats, and incidents. (2) It must identify capability gaps, available or possible Federal resources, resource limits and solutions, coordination opportunities including with the Multi-State Information Sharing and Analysis Center, exercise and notice procedures, voluntary use of Federal directive guidance, Federal investment schedules under title 40 section 502, new initiatives, short- and long-term goals, and dates and interim benchmarks for baseline capabilities, including for ransomware. (3) The Director must consider lessons from incidents and exercises, impacts and costs, threat actors’ interest and ability to compromise systems, and new risks from new technologies. (4) Title 44 chapter 35, the “Paperwork Reduction Act,” does not apply to implementing actions.

the actual law source: uscode.house.gov ↗public domain

(a) Definitions

In this section, the term “agency information system” means an information system used or operated by an agency or by another entity on behalf of an agency.

(b) Intrusion assessment plan

(1) Requirement

The Secretary, in coordination with the Director of the Office of Management and Budget, shall—

(A)

develop and implement an intrusion assessment plan to proactively detect, identify, and remove intruders in agency information systems on a routine basis; and

(B)

update such plan as necessary.

(2) Exception

The intrusion assessment plan required under paragraph (1) shall not apply to the Department of Defense, a national security system, or an element of the intelligence community.

The Director of the Cybersecurity and Infrastructure Security Agency shall, in coordination with appropriate Federal departments and agencies, State and local governments, sector coordinating councils, Information Sharing and Analysis Organizations, owners and operators of critical infrastructure, and other appropriate entities and individuals, develop, update not less often than biennially, maintain, and exercise adaptable cyber incident response plans to address cybersecurity risks to critical infrastructure. The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.

(d) National Response Framework

The Secretary, in coordination with the heads of other appropriate Federal departments and agencies, and in accordance with the National Cybersecurity Incident Response Plan required under subsection (c), shall regularly update, maintain, and exercise the Cyber Incident Annex to the National Response Framework of the Department.

(e) Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments

(1) In general

(A) Requirement

Not later than one year after December 27, 2021, the Secretary, acting through the Director, shall, in coordination with the heads of appropriate Federal agencies, State, local, Tribal, and territorial governments, and other stakeholders, as appropriate, develop and make publicly available a Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments.

(B) Recommendations and requirements

The strategy required under subparagraph (A) shall provide recommendations relating to the ways in which the Federal Government should support and promote the ability of State, local, Tribal, and territorial governments to identify, mitigate against, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, and incidents.

(2) Contents

The strategy required under paragraph (1) shall—

(A)

identify capability gaps in the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents;

(B)

identify Federal resources and capabilities that are available or could be made available to State, local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents;

(C)

identify and assess the limitations of Federal resources and capabilities available to State, local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents and make recommendations to address such limitations;

(D)

identify opportunities to improve the coordination of the Agency with Federal and non-Federal entities, such as the Multi-State Information Sharing and Analysis Center, to improve—

(i)

incident exercises, information sharing and incident notification procedures;

(ii)

the ability for State, local, Tribal, and territorial governments to voluntarily adapt and implement guidance in Federal binding operational directives; and

(iii)

opportunities to leverage Federal schedules for cybersecurity investments under section 502 of title 40;

(E)

recommend new initiatives the Federal Government should undertake to improve the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents;

(F)

set short-term and long-term goals that will improve the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; and

(G)

set dates, including interim benchmarks, as appropriate for State, local, Tribal, and territorial governments to establish baseline capabilities to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents.

(3) Considerations

In developing the strategy required under paragraph (1), the Director, in coordination with the heads of appropriate Federal agencies, State, local, Tribal, and territorial governments, and other stakeholders, as appropriate, shall consider—

(A)

lessons learned from incidents that have affected State, local, Tribal, and territorial governments, and exercises with Federal and non-Federal entities;

(B)

the impact of incidents that have affected State, local, Tribal, and territorial governments, including the resulting costs to such governments;

(C)

the information related to the interest and ability of state and non-state threat actors to compromise information systems owned or operated by State, local, Tribal, and territorial governments; and

(D)

emerging cybersecurity risks and cybersecurity threats to State, local, Tribal, and territorial governments resulting from the deployment of new technologies.

(4) Exemption

Chapter 35 of title 44 (commonly known as the “Paperwork Reduction Act”) shall not apply to any action to implement this subsection.

Source credit: (Pub. L. 107–296, title XXII, § 2210, formerly title II, § 228, as added and amended Pub. L. 114–113, div. N, title II, §§ 205, 223(a)(2), (4), (5), Dec. 18, 2015, 129 Stat. 2961, 2963, 2964; renumbered title XXII, § 2210, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(iv), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–81, div. A, title XV, §§ 1545, 1546, Dec. 27, 2021, 135 Stat. 2057, 2059; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(E), (c)(8), Dec. 23, 2022, 136 Stat. 3660, 3663.)

history & why it existsrecord from the source credit

2015Enacted · Pub. L. 107-296 · 129 Stat. 2961, 2963, 2964
2018Amended · Pub. L. 115-278 · 132 Stat. 4178, 4181
2021Amended · Pub. L. 117-81 · 135 Stat. 2057, 2059
2022Amended · Pub. L. 117-263 · 136 Stat. 3660, 3663

A history note hasn’t been published yet. The record shows enactment by Pub. L. 107-296 on 2015-12-18.

all 0 arguments · sorted by: best

no arguments yet — make the first case