6 U.S.C. § 658 — Cybersecurity recruitment and retention

Page 338 TITLE 6—DOMESTIC SECURITY § 658 (v) the extent to which the offense vio- lated the privacy rights of individuals harmed; (vi) whether the offense involved a com- puter used by the government in further- ance of national defense, national secu- rity, or the administration of justice; (vii) whether the violation was intended to or had the effect of significantly inter- fering with or disrupting a critical infra- structure; and (viii) whether the violation was intended to or had the effect of creating a threat to public health or safety, or injury to any person; (C) assure reasonable consistency with other relevant directives and with other sen- tencing guidelines; (D) account for any additional aggravating or mitigating circumstances that might jus- tify exceptions to the generally applicable sentencing ranges; (E) make any necessary conforming changes to the sentencing guidelines; and (F) assure that the guidelines adequately meet the purposes of sentencing as set forth in section 3553(a)(2) of title 18. (c) Study and report on computer crimes Not later than May 1, 2003, the United States Sentencing Commission shall submit a brief re- port to Congress that explains any actions taken by the Sentencing Commission in response to this section and includes any recommendations the Commission may have regarding statutory penalties for offenses under section 1030 of title 18. (d) Emergency disclosure exception (1) Omitted (2) Reporting of disclosures A government entity that receives a disclo- sure under section 2702(b) of title 18 shall file, not later than 90 days after such disclosure, a report to the Attorney General stating the paragraph of that section under which the dis- closure was made, the date of the disclosure, the entity to which the disclosure was made, the number of customers or subscribers to whom the information disclosed pertained, and the number of communications, if any, that were disclosed. The Attorney General shall publish all such reports into a single re- port to be submitted to Congress 1 year after November 25, 2002. (Pub. L. 107–296, title XXII, § 2207, formerly title II, § 225, Nov. 25, 2002, 116 Stat. 2156; renumbered title XXII, § 2207, Pub. L. 115–278, § 2(g)(2)(I), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 145 of this title prior to renumbering by Pub. L. 115–278. Section is comprised of section 2207 of Pub. L. 107–296. Subsecs. (d)(1) and (e) to (j) of section 2207 of Pub. L. 107–296 amended sections 1030, 2511, 2512, 2520, 2701 to 2703, and 3125 of Title 18, Crimes and Criminal Proce- dure. § 658. Cybersecurity recruitment and retention (a) Definitions In this section: (1) Appropriate committees of Congress The term ‘‘appropriate committees of Con- gress’’ means the Committee on Homeland Se- curity and Governmental Affairs and the Com- mittee on Appropriations of the Senate and the Committee on Homeland Security and the Committee on Appropriations of the House of Representatives. (2) Collective bargaining agreement The term ‘‘collective bargaining agreement’’ has the meaning given that term in section 7103(a)(8) of title 5. (3) Excepted service The term ‘‘excepted service’’ has the mean- ing given that term in section 2103 of title 5. (4) Preference eligible The term ‘‘preference eligible’’ has the meaning given that term in section 2108 of title 5. (5) Qualified position The term ‘‘qualified position’’ means a posi- tion, designated by the Secretary for the pur- pose of this section, in which the incumbent performs, manages, or supervises functions that execute the responsibilities of the De- partment relating to cybersecurity. (6) Senior Executive Service The term ‘‘Senior Executive Service’’ has the meaning given that term in section 2101a of title 5. (b) General authority (1) Establish positions, appoint personnel, and fix rates of pay (A) General authority The Secretary may— (i) establish, as positions in the excepted service, such qualified positions in the De- partment as the Secretary determines nec- essary to carry out the responsibilities of the Department relating to cybersecurity, including positions formerly identified as— (I) senior level positions designated under section 5376 of title 5; and (II) positions in the Senior Executive Service; (ii) appoint an individual to a qualified position (after taking into consideration the availability of preference eligibles for appointment to the position); and (iii) subject to the requirements of para- graphs (2) and (3), fix the compensation of an individual for service in a qualified po- sition. (B) Construction with other laws The authority of the Secretary under this subsection applies without regard to the pro- visions of any other law relating to the ap- pointment, number, classification, or com- pensation of employees. Page 339 TITLE 6—DOMESTIC SECURITY § 658 (2) Basic pay (A) Authority to fix rates of basic pay In accordance with this section, the Sec- retary shall fix the rates of basic pay for any qualified position established under para- graph (1) in relation to the rates of pay pro- vided for employees in comparable positions in the Department of Defense and subject to the same limitations on maximum rates of pay established for such employees by law or regulation. (B) Prevailing rate systems The Secretary may, consistent with sec- tion 5341 of title 5, adopt such provisions of that title as provide for prevailing rate sys- tems of basic pay and may apply those pro- visions to qualified positions for employees in or under which the Department may em- ploy individuals described by section 5342(a)(2)(A) of that title. (3) Additional compensation, incentives, and allowances (A) Additional compensation based on title 5 authorities The Secretary may provide employees in qualified positions compensation (in addi- tion to basic pay), including benefits, incen- tives, and allowances, consistent with, and not in excess of the level authorized for, comparable positions authorized by title 5. (B) Allowances in nonforeign areas An employee in a qualified position whose rate of basic pay is fixed under paragraph (2)(A) shall be eligible for an allowance under section 5941 of title 5, on the same basis and to the same extent as if the em- ployee was an employee covered by such sec- tion 5941, including eligibility conditions, al- lowance rates, and all other terms and con- ditions in law or regulation. (4) Plan for execution of authorities Not later than 120 days after December 18, 2014, the Secretary shall submit a report to the appropriate committees of Congress with a plan for the use of the authorities provided under this subsection. (5) Collective bargaining agreements Nothing in paragraph (1) may be construed to impair the continued effectiveness of a col- lective bargaining agreement with respect to an office, component, subcomponent, or equiv- alent of the Department that is a successor to an office, component, subcomponent, or equiv- alent of the Department covered by the agree- ment before the succession. (6) Required regulations The Secretary, in coordination with the Di- rector of the Office of Personnel Management, shall prescribe regulations for the administra- tion of this section. (c) Annual report Not later than 1 year after December 18, 2014, and every year thereafter for 4 years, the Sec- retary shall submit to the appropriate commit- tees of Congress a detailed report that— (1) discusses the process used by the Sec- retary in accepting applications, assessing candidates, ensuring adherence to veterans’ preference, and selecting applicants for vacan- cies to be filled by an individual for a qualified position; (2) describes— (A) how the Secretary plans to fulfill the critical need of the Department to recruit and retain employees in qualified positions; (B) the measures that will be used to measure progress; and (C) any actions taken during the reporting period to fulfill such critical need; (3) discusses how the planning and actions taken under paragraph (2) are integrated into the strategic workforce planning of the De- partment; (4) provides metrics on actions occurring during the reporting period, including— (A) the number of employees in qualified positions hired by occupation and grade and level or pay band; (B) the placement of employees in quali- fied positions by directorate and office with- in the Department; (C) the total number of veterans hired; (D) the number of separations of employ- ees in qualified positions by occupation and grade and level or pay band; (E) the number of retirements of employ- ees in qualified positions by occupation and grade and level or pay band; and (F) the number and amounts of recruit- ment, relocation, and retention incentives paid to employees in qualified positions by occupation and grade and level or pay band; and (5) describes the training provided to super- visors of employees in qualified positions at the Department on the use of the new authori- ties. (d) Three-year probationary period The probationary period for all employees hired under the authority established in this section shall be 3 years. (e) Incumbents of existing competitive service positions (1) In general An individual serving in a position on De- cember 18, 2014, that is selected to be con- verted to a position in the excepted service under this section shall have the right to refuse such conversion. (2) Subsequent conversion After the date on which an individual who refuses a conversion under paragraph (1) stops serving in the position selected to be con- verted, the position may be converted to a po- sition in the excepted service. (f) Study and report Not later than 120 days after December 18, 2014, the National Protection and Programs Di- rectorate shall submit a report regarding the availability of, and benefits (including cost sav- ings and security) of using, cybersecurity per- sonnel and facilities outside of the National Page 340 TITLE 6—DOMESTIC SECURITY § 659 Capital Region (as defined in section 2674 of title 10) to serve the Federal and national need to— (1) the Subcommittee on Homeland Security of the Committee on Appropriations and the Committee on Homeland Security and Govern- mental Affairs of the Senate; and (2) the Subcommittee on Homeland Security of the Committee on Appropriations and the Committee on Homeland Security of the House of Representatives. (Pub. L. 107–296, title XXII, § 2208, formerly title II, § 226, as added Pub. L. 113–277, § 3(a), Dec. 18, 2014, 128 Stat. 3005; renumbered title XXII, § 2208, Pub. L. 115–278, § 2(g)(2)(I), Nov. 16, 2018, 132 Stat. 4178.) Editorial Notes CODIFICATION Section was formerly classified to section 147 of this title prior to renumbering by Pub. L. 115–278. Statutory Notes and Related Subsidiaries CHANGE OF NAME Reference to National Protection and Programs Di- rectorate of the Department of Homeland Security deemed to be a reference to the Cybersecurity and In- frastructure Security Agency of the Department, see section 652(a)(2) of this title, enacted Nov. 16, 2018. § 659. National cybersecurity and communica- tions integration center (a) Definition The term ‘‘cybersecurity vulnerability’’ has the meaning given the term ‘‘security vulner- ability’’ in section 650 of this title. (b) Center There is in the Department a national cybersecurity and communications integration center (referred to in this section as the ‘‘Cen- ter’’) to carry out certain responsibilities of the Director. The Center shall be located in the Cybersecurity and Infrastructure Security Agency. The head of the Center shall report to the Executive Assistant Director for Cybersecurity. (c) Functions The cybersecurity functions of the Center shall include— (1) being a Federal civilian interface for the multi-directional and cross-sector sharing of information related to cyber threat indicators, defensive measures, cybersecurity risks, inci- dents, analysis, and warnings for Federal and non-Federal entities, including the implemen- tation of title I of the Cybersecurity Act of 2015 [6 U.S.C. 1501 et seq.]; (2) providing shared situational awareness to enable real-time, integrated, and operational actions across the Federal Government and non-Federal entities to address cybersecurity risks and incidents to Federal and non-Federal entities; (3) coordinating the sharing of information related to cyber threat indicators, defensive measures, cybersecurity risks, and incidents across the Federal Government; (4) facilitating cross-sector coordination to address cybersecurity risks and incidents, in- cluding cybersecurity risks and incidents that may be related or could have consequential impacts across multiple sectors; (5)(A) conducting integration and analysis, including cross-sector integration and anal- ysis, of cyber threat indicators, defensive measures, cybersecurity risks, and incidents; (B) sharing mitigation protocols to counter cybersecurity vulnerabilities pursuant to sub- section (n), as appropriate; and (C) sharing the analysis conducted under subparagraph (A) and mitigation protocols to counter cybersecurity vulnerabilities in ac- cordance with subparagraph (B), as appro- priate, with Federal and non-Federal entities; (6) upon request, providing operational and timely technical assistance, risk management support, and incident response capabilities to Federal and non-Federal entities with respect to cyber threat indicators, defensive measures, cybersecurity risks, and incidents, which may include attribution, mitigation, and remedi- ation, which may take the form of continuous monitoring and detection of cybersecurity risks to critical infrastructure entities that own or operate industrial control systems that support national critical functions; (7) providing information and recommenda- tions on security and resilience measures to Federal and non-Federal entities, including in- formation and recommendations to— (A) facilitate information security; (B) strengthen information systems against cybersecurity risks and incidents; and (C) share cyber threat indicators and de- fensive measures; (8) engaging with international partners, in consultation with other appropriate agencies, to— (A) collaborate on cyber threat indicators, defensive measures, and information related to cybersecurity risks and incidents; and (B) enhance the security and resilience of global cybersecurity; (9) sharing cyber threat indicators, defensive measures, mitigation protocols to counter cybersecurity vulnerabilities, as appropriate, and other information related to cybersecurity risks and incidents with Federal and non-Federal entities, including across sec- tors of critical infrastructure and with State and major urban area fusion centers, as appro- priate; (10) participating, as appropriate, in na- tional exercises run by the Department; (11) in coordination with the Emergency Communications Division of the Department, assessing and evaluating consequence, vulner- ability, and threat information regarding cyber incidents to public safety communica- tions to help facilitate continuous improve- ments to the security and resiliency of such communications; (12) detecting, identifying, and receiving in- formation for a cybersecurity purpose about security vulnerabilities relating to critical in- frastructure in information systems and de- vices; and (13) receiving, aggregating, and analyzing re- ports related to covered cyber incidents (as de-