6 U.S.C. § 661 — Cybersecurity strategy
submitted 10 years ago by Pub. L. 107-296 to r/title-6-DOMESTIC-SECURITY · 371 words · no verdicts yet
This section required the Secretary to create a departmental cybersecurity strategy and then an implementation plan. It lists required contents, reporting duties, classification rules, and a limit concerning tracking personally identifiable information.
(a) In general. No later than 90 days after December 23, 2016, the Secretary* must develop a departmental strategy for carrying out cybersecurity responsibilities established by law.
(b) Contents. The strategy must include: (1) strategic and operational goals and priorities for carrying out the full range of the Secretary’s cybersecurity responsibilities; and (2) information about the programs, policies, and activities needed for those responsibilities, including activities concerning (A) the cybersecurity functions* in section 659 relating to the national cybersecurity and communications integration center, (B) cybersecurity investigations, (C) cybersecurity research and development, and (D) engagement with international cybersecurity partners.
(c) Considerations. In developing the strategy, the Secretary must (1) consider (A) the Homeland Security Enterprise* cybersecurity strategy published in November 2011, (B) the Department* of Homeland* Security Fiscal Years 2014–2018 Strategic Plan, and (C) the latest Quadrennial Homeland Security Review issued under section 347; and (2) include, as practicable, information about Department components’ and offices’ roles and responsibilities in carrying out the strategy.
(d) Implementation plan. No later than 90 days after developing the strategy, the Secretary must issue an implementation plan containing (1) strategic objectives and related tasks, (2) projected timelines and costs, and (3) performance measures for the tasks.
(e) Congressional oversight. When issued, the Secretary must submit to Congress for assessment (1) the strategy and (2) the implementation plan, together with detailed information about related legislative or budget proposals.
(f) Classified information. The strategy must be unclassified, but may have a classified annex.
(g) Rule of construction. Nothing here may be read as allowing the Department to monitor*, surveil, exfiltrate, or otherwise collect information to track an individual’s personally identifiable information.
Not later than 90 days after December 23, 2016, the Secretary* shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law.
The strategy required under subsection (a) shall include the following:
Strategic and operational goals and priorities to successfully execute the full range of the Secretary’s cybersecurity responsibilities.
Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following:
Cybersecurity functions* set forth in section 659 of this title (relating to the national cybersecurity and communications integration center).
Cybersecurity investigations capabilities.
Cybersecurity research and development.
Engagement with international cybersecurity partners.
In developing the strategy required under subsection (a), the Secretary shall—
consider—
the cybersecurity strategy for the Homeland Security Enterprise* published by the Secretary in November 2011;
the Department* of Homeland* Security Fiscal Years 2014–2018 Strategic Plan; and
the most recent Quadrennial Homeland Security Review issued pursuant to section 347 of this title; and
include information on the roles and responsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy.
Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following:
Strategic objectives and corresponding tasks.
Projected timelines and costs for such tasks.
Metrics to evaluate performance of such tasks.
The Secretary shall submit to Congress for assessment the following:
A copy of the strategy required under subsection (a) upon issuance.
A copy of the implementation plan required under subsection (d) upon issuance, together with detailed information on any associated legislative or budgetary proposals.
The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex.
Nothing in this section may be construed as permitting the Department to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information.
Source credit: (Pub. L. 107–296, title XXII, § 2211, formerly title II, § 228A, as added Pub. L. 114–328, div. A, title XIX, § 1912(a), Dec. 23, 2016, 130 Stat. 2683; renumbered title XXII, § 2211, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(v), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(F), Dec. 23, 2022, 136 Stat. 3660.)
- 2016Enacted · Pub. L. 107-296 · 130 Stat. 2683
- 2018Amended · Pub. L. 115-278 · 132 Stat. 4178, 4181
- 2022Amended · Pub. L. 117-263 · 136 Stat. 3660
A history note hasn’t been published yet. The record shows enactment by Pub. L. 107-296 on 2016-12-23.
all 0 arguments · sorted by: best
no arguments yet — make the first case