6 U.S.C. § 661 — Cybersecurity strategy

Page 349 TITLE 6—DOMESTIC SECURITY § 661 torial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; (F) set short-term and long-term goals that will improve the ability of State, local, Tribal, and territorial governments to iden- tify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; and (G) set dates, including interim bench- marks, as appropriate for State, local, Trib- al, and territorial governments to establish baseline capabilities to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents. (3) Considerations In developing the strategy required under paragraph (1), the Director, in coordination with the heads of appropriate Federal agen- cies, State, local, Tribal, and territorial gov- ernments, and other stakeholders, as appro- priate, shall consider— (A) lessons learned from incidents that have affected State, local, Tribal, and terri- torial governments, and exercises with Fed- eral and non-Federal entities; (B) the impact of incidents that have af- fected State, local, Tribal, and territorial governments, including the resulting costs to such governments; (C) the information related to the interest and ability of state and non-state threat ac- tors to compromise information systems owned or operated by State, local, Tribal, and territorial governments; and (D) emerging cybersecurity risks and cybersecurity threats to State, local, Tribal, and territorial governments resulting from the deployment of new technologies. (4) Exemption Chapter 35 of title 44 (commonly known as the ‘‘Paperwork Reduction Act’’) shall not apply to any action to implement this sub- section. (Pub. L. 107–296, title XXII, § 2210, formerly title II, § 228, as added and amended Pub. L. 114–113, div. N, title II, §§ 205, 223(a)(2), (4), (5), Dec. 18, 2015, 129 Stat. 2961, 2963, 2964; renumbered title XXII, § 2210, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(iv), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–81, div. A, title XV, §§ 1545, 1546, Dec. 27, 2021, 135 Stat. 2057, 2059; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(E), (c)(8), Dec. 23, 2022, 136 Stat. 3660, 3663.) Editorial Notes CODIFICATION Section was formerly classified to section 149 of this title prior to renumbering by Pub. L. 115–278. Former section 149 of this title, which was trans- ferred and redesignated as subsec. (c) of this section by Pub. L. 114–113, div. N, title II, § 223(a)(2), Dec. 18, 2015, 129 Stat. 2963, was based on Pub. L. 107–296, title II, § 227, as added by Pub. L. 113–282, § 7(a), Dec. 18, 2014, 128 Stat. 3070. AMENDMENTS 2022—Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(E)(i), substituted ‘‘section, the term ‘agency information sys- tem’ means an information system used or operated by an agency or by another entity on behalf of an agen- cy.’’ for ‘‘section—’’ and struck out pars. (1) to (4) which defined agency information system, cybersecurity risk, information system, intelligence community, and national security system. Subsec. (c). Pub. L. 117–263, § 7143(c)(8), substituted ‘‘Director of the Cybersecurity and Infrastructure Se- curity Agency’’ for ‘‘Director of Cybersecurity and In- frastructure Security’’. Pub. L. 117–263, § 7143(b)(2)(E)(ii), substituted ‘‘Infor- mation Sharing and Analysis Organizations’’ for ‘‘in- formation sharing and analysis organizations (as de- fined in section 671(5) of this title)’’ and struck out ‘‘(as defined in section 659 of this title)’’ after ‘‘cybersecurity risks’’. Subsec. (e)(1)(B). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(I), which directed striking out ‘‘(as such term is defined in section 659 of this title)’’, was executed by striking out ‘‘(as such term is defined in section 659 of this title)’’ after ‘‘cybersecurity risks’’ and after ‘‘incidents’’, to reflect the probable intent of Congress. Subsec. (e)(3)(C). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(II), struck out ‘‘(as such term is defined in section 1501 of this title)’’ after ‘‘information systems’’. 2021—Subsec. (c). Pub. L. 117–81, § 1546, substituted ‘‘update not less often than biennially’’ for ‘‘regularly update’’ and inserted ‘‘The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stake- holders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.’’ at end. Subsec. (e). Pub. L. 117–81, § 1545, added subsec. (e). 2018—Subsec. (a)(2). Pub. L. 115–278, § 2(g)(9)(A)(iv)(I), substituted ‘‘section 659 of this title’’ for ‘‘section 148 of this title’’. Subsec. (c). Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted ‘‘Director of Cybersecurity and Infrastructure Secu- rity’’ for ‘‘Under Secretary appointed under section 113(a)(1)(H) of this title’’, ‘‘section 671(5) of this title’’ for ‘‘section 131(5) of this title’’, and ‘‘section 659 of this title’’ for ‘‘section 148 of this title’’. 2015—Subsec. (c). Pub. L. 114–113, § 223(a)(5), made technical amendment to reference in original act which appears in text as reference to section 148 of this title. Pub. L. 114–113, § 223(a)(2), transferred former section 149 of this title to subsec. (c) of this section. See Codi- fication note above. Subsec. (d). Pub. L. 114–113, § 205, added subsec. (d). Statutory Notes and Related Subsidiaries RULES OF CONSTRUCTION Nothing in amendment made by Pub. L. 117–263 to be construed to alter the authorities, responsibilities, functions, or activities of any agency (as such term is defined in 44 U.S.C. 3502) or officer or employee of the United States on or before Dec. 23, 2022, see section 7143(f)(1) of Pub. L. 117–263, set out as a note under sec- tion 650 of this title. Pub. L. 113–282, § 7(c), Dec. 18, 2014, 128 Stat. 3072, pro- vided that: ‘‘Nothing in the amendment made by sub- section (a) [enacting subsec. (c) of this section and sec- tion 150 of this title] or in subsection (b)(1) [formerly classified as a note under section 3543 of Title 44, Public Printing and Documents, see now section 2(d)(1) of Pub. L. 113–283, set out as a note under section 3553 of Title 44] shall be construed to alter any authority of a Fed- eral agency or department.’’ § 661. Cybersecurity strategy (a) In general Not later than 90 days after December 23, 2016, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibil- ities as set forth in law. Page 350 TITLE 6—DOMESTIC SECURITY § 662 1 So in original. Probably should be ‘‘51609;’’. (b) Contents The strategy required under subsection (a) shall include the following: (1) Strategic and operational goals and pri- orities to successfully execute the full range of the Secretary’s cybersecurity responsibilities. (2) Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including pro- grams, policies, and activities in furtherance of the following: (A) Cybersecurity functions set forth in section 659 of this title (relating to the na- tional cybersecurity and communications integration center). (B) Cybersecurity investigations capabili- ties. (C) Cybersecurity research and develop- ment. (D) Engagement with international cybersecurity partners. (c) Considerations In developing the strategy required under sub- section (a), the Secretary shall— (1) consider— (A) the cybersecurity strategy for the Homeland Security Enterprise published by the Secretary in November 2011; (B) the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan; and (C) the most recent Quadrennial Homeland Security Review issued pursuant to section 347 of this title; and (2) include information on the roles and re- sponsibilities of components and offices of the Department, to the extent practicable, to carry out such strategy. (d) Implementation plan Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the fol- lowing: (1) Strategic objectives and corresponding tasks. (2) Projected timelines and costs for such tasks. (3) Metrics to evaluate performance of such tasks. (e) Congressional oversight The Secretary shall submit to Congress for as- sessment the following: (1) A copy of the strategy required under subsection (a) upon issuance. (2) A copy of the implementation plan re- quired under subsection (d) upon issuance, to- gether with detailed information on any asso- ciated legislative or budgetary proposals. (f) Classified information The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. (g) Rule of construction Nothing in this section may be construed as permitting the Department to engage in moni- toring, surveillance, exfiltration, or other col- lection activities for the purpose of tracking an individual’s personally identifiable information. (Pub. L. 107–296, title XXII, § 2211, formerly title II, § 228A, as added Pub. L. 114–328, div. A, title XIX, § 1912(a), Dec. 23, 2016, 130 Stat. 2683; renum- bered title XXII, § 2211, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(v), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(F), Dec. 23, 2022, 136 Stat. 3660.) Editorial Notes CODIFICATION Section was formerly classified to section 149a of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Subsec. (h). Pub. L. 117–263 struck out subsec. (h). Text read as follows: ‘‘In this section, the term ‘Homeland Security Enterprise’ means relevant govern- mental and nongovernmental entities involved in homeland security, including Federal, State, local, and tribal government officials, private sector representa- tives, academics, and other policy experts.’’ 2018—Subsec. (b)(2)(A). Pub. L. 115–278, § 2(g)(9)(A)(v), substituted ‘‘section 659 of this title’’ for ‘‘the section 148 of this title’’. § 662. Clearances The Secretary shall make available the proc- ess of application for security clearances under Executive Order 13549 (75 Fed. Reg. 162; 1 relating to a classified national security information program) or any successor Executive Order to appropriate representatives of sector coordi- nating councils, sector Information Sharing and Analysis Organizations, owners and operators of critical infrastructure, and any other person that the Secretary determines appropriate. (Pub. L. 107–296, title XXII, § 2212, formerly title II, § 229, formerly § 228, as added Pub. L. 113–282, § 7(a), Dec. 18, 2014, 128 Stat. 3070; renumbered § 229, Pub. L. 114–113, div. N, title II, § 223(a)(1), Dec. 18, 2015, 129 Stat. 2963; renumbered title XXII, § 2212, and amended Pub. L. 115–278, § 2(g)(2)(I), (9)(A)(vi), Nov. 16, 2018, 132 Stat. 4178, 4181; Pub. L. 117–263, div. G, title LXXI, § 7143(b)(2)(G), Dec. 23, 2022, 136 Stat. 3660.) Editorial Notes REFERENCES IN TEXT Executive Order 13549, referred to in text, is Ex. Ord. No. 13549, Aug. 18, 2010, 75 F.R. 51609, which is set out as a note under section 3161 of Title 50, War and Na- tional Defense. CODIFICATION Section was formerly classified to section 150 of this title prior to renumbering by Pub. L. 115–278. AMENDMENTS 2022—Pub. L. 117–263 substituted ‘‘Information Shar- ing and Analysis Organizations’’ for ‘‘information shar- ing and analysis organizations (as defined in section 671(5) of this title)’’. 2018—Pub. L. 115–278, § 2(g)(9)(A)(vi), substituted ‘‘sec- tion 671(5) of this title’’ for ‘‘section 131(5) of this title’’.