Summary:
Highlights:

This bill requires the Director of National Intelligence and the Departments of Homeland Security (DHS), Defense, and Justice to develop procedures to share cybersecurity threat information with private entities, nonfederal government agencies, state, tribal, and local governments, the public, and entities under threats.

To detect, prevent, or mitigate cybersecurity threats or security vulnerabilities, private entities may monitor and operate defensive measures on: (1) their own information systems; and (2) with written consent, the information systems of other private or government entities.

Liability protections are provided to entities that voluntarily share and receive cyber threat indicators and defensive measures with other entities or the government.

A sharing process must be developed within DHS for the federal government to: (1) receive indicators and defensive measures that are shared by any entity, and (2) ensure that appropriate federal entities receive shared indicators in an automated, real-time manner.

The bill limits the purposes for which the government may use shared information to certain cybersecurity purposes and responses to imminent threats or serious threats to a minor. The crimes that may be prosecuted with such information are restricted to offenses relating to fraud and identity theft, espionage, censorship, trade secrets, or an imminent threat of death, serious bodily harm, or serious economic harm, including a terrorist act or use of a weapon of mass destruction.

DHS must also deploy a system to: (1) detect cybersecurity risks in network traffic transiting or traveling to or from an agency information system, and (2) prevent or modify such traffic to remove cybersecurity risks.

The DHS Secretary may: (1) issue emergency directives to agencies in response to a substantial information security threat, vulnerability, or incident; or (2) authorize intrusion detection and prevention capabilities to secure agency information systems in the case of an imminent threat.

Federal agencies must identify and mitigate skill shortages in federal workforce positions requiring the performance of cybersecurity functions.

The Department of State must develop a diplomacy strategy to obtain agreements on international behavior in cyberspace and consult with countries regarding the prosecution and prevention of cyber or intellectual property crimes.

The National Cybersecurity and Communications Integration Center must establish a process for statewide interoperability coordinators to report risks or incidents involving networks used by emergency response providers.

The Department of Health and Human Services must convene a task force to: (1) plan a single system for the federal government to share intelligence regarding cybersecurity threats to the health care industry, and (2) recommend protections for networked medical devices and electronic health records.

DHS must develop a strategy to ensure that a cyber incident affecting critical infrastructure entities will not result in catastrophic regional or national effects on public health or safety, economic security, or national security.

The bill also allows criminal penalties for fraud involving account access devices to be imposed regardless of whether the underlying articles, property, or proceeds are held within, or have transferred through, U.S. jurisdiction.

Full Summary:

TITLE I--CYBERSECURITY INFORMATION SHARING

Cybersecurity Information Sharing Act of 2015

(Sec. 103) This title requires the Director of National Intelligence (DNI) and the Departments of Homeland Security (DHS), Defense (DOD), and Justice (DOJ) to develop and promulgate procedures to promote the sharing of: (1) classified and declassified cyber threat indicators in possession of the federal government with private entities, nonfederal government agencies, or state, tribal, or local governments; (2) unclassified indicators with the public; (3) information with entities under cybersecurity threats to prevent or mitigate adverse effects; and (4) cybersecurity best practices with attention to the challenges faced by small businesses.

The procedures must incorporate sector specific information sharing and analysis centers and other existing processes of federal and nonfederal entities for information sharing by the federal government. The procedures must also include a process for timely notifications to: (1) recipients of threat indicators from federal entities when the federal government has shared indicators in error or in contravention of law, and (2) U.S. persons whose personal information has been shared by the federal government in violation of this Act. The DNI must submit such procedures to Congress within 60 days after enactment of this Act.

(Sec. 104) To detect, prevent, or mitigate cybersecurity threats or security vulnerabilities, private entities may monitor and operate defensive measures on: (1) their own information systems; and (2) with authorization and written consent, the information systems of other private or government entities.

A "defensive measure" is an action, device, procedure, signature, technique, or other measure applied to an information system or information that is stored on or processed by, or that is transiting, an information system that detects, prevents, or mitigates a known or suspected cybersecurity threat or security vulnerability. Defensive measures do not include measures that destroy, render unusable, provide unauthorized access to, or substantially harm an information system or data not belonging to: (1) the private entity operating the measure, or (2) another entity that is authorized to provide, and has provided, consent to that private entity for operation of such measure.

The term "private entity" includes state, tribal, or local governments performing electric or other utility services but excludes foreign powers under the Foreign Intelligence Surveillance Act of 1978.

Entities may share and receive indicators and defensive measures with other entities or the federal government for a cybersecurity purpose. Recipients must comply with lawful restrictions that sharing entities place on the sharing or use of shared indicators or defensive measures.

The federal government and entities monitoring, operating, or sharing indicators or defensive measures must: (1) utilize security controls to protect against unauthorized access or acquisitions, and (2) remove personal information, or information that identifies a specific person not directly related to a cybersecurity threat, prior to sharing an indicator.

State, tribal, or local agencies may use shared indicators (with the consent of the entity sharing the indicators) to prevent, investigate, or prosecute offenses relating to: (1) an imminent threat of death, serious bodily harm, or serious economic harm, including a terrorist act or use of a weapon of mass destruction; or (2) crimes involving fraud and identity theft, espionage and censorship, or trade secrets.

This title exempts from antitrust laws private entities that, for cybersecurity purposes, exchange or provide: (1) cyber threat indicators; or (2) assistance relating to the prevention, investigation, or mitigation of cybersecurity threats. The exemption is inapplicable to price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, boycotting, or exchanges of price or cost information, customer lists, or information regarding future competitive planning.

(Sec. 105) DOJ and DHS must promulgate procedures relating to the receipt of indicators and defensive measures by the federal government. The procedures must include automated real-time sharing procedures, an audit capability, and appropriate sanctions for federal officers, employees, or agents who conduct unauthorized activities.

DOJ and DHS must also develop, and make publicly available, guidelines to assist entities in sharing indicators with the federal government, including guidance for identifying and protecting personal information.

DOJ must promulgate, and review at least every two years, privacy and civil liberties guidelines to limit receipt, retention, use, and dissemination of personal or identifying information. The guidelines must include steps to make dissemination of cyber threat indicators consistent with the protection of classified and other sensitive national security information.

DHS must develop a process within DHS for the federal government to: (1) accept cyber threat indicators and defensive measures from any entity in real time, and (2) ensure that appropriate federal entities receive the shared indicators in an automated manner through that real-time process. Before the process is implemented, DHS must certify to Congress that the DHS sharing capability is fully operational.

This title requires the DHS capability to be the process by which the federal government receives indicators and defensive measures under this title that are shared by a private entity with the federal government through electronic mail or media, an interactive Internet website form, or a real-time, automated process between information systems, except: (1) communications between a federal entity and a private entity regarding a previously shared cyber threat indicator to describe the relevant cybersecurity threat or develop a defensive measure based on such indicator, and (2) communications by a regulated entity with such entity's federal regulatory authority regarding a cybersecurity threat.

DHS's process is prohibited from limiting lawful disclosures of communications, records, or other information to: (1) report known or suspected criminal activity, (2) participate in a federal investigation voluntarily or upon being legally compelled, or (3) provide indicators or defensive measures as part of a statutory or authorized contractual requirement.

DHS must ensure that there is public notice of, and access to, the DHS sharing procedures.

DHS must report to Congress regarding implementation of the sharing process within DHS.

Cyber threat indicators and defensive measures shared with the federal government and threat indicators shared with state, tribal, or local governments are: (1) deemed voluntarily shared information, and (2) exempt from disclosure and withheld from the public under any laws of such jurisdictions requiring disclosure of information or records.

Consistent with otherwise applicable federal law, indicators and defensive measures may be disclosed to, retained by, and used by any federal agency or federal government agent solely for:

 protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability; identifying a cybersecurity threat, including the source, or a security vulnerability; identifying the use of an information system by a foreign adversary or terrorist; responding to, or otherwise preventing or mitigating, a serious threat to a minor or an imminent threat of death, serious bodily harm, or serious economic harm, including a terrorist act or a use of a weapon of mass destruction; or preventing, investigating, disrupting, or prosecuting an offense arising out of an imminent threat of death, serious bodily harm, or serious economic harm, as well as offenses relating to fraud and identity theft, espionage and censorship, or trade secrets. Indicators and defensive measures provided to the government may not be used by government agencies to regulate the lawful activities of an entity.

(Sec. 106) Liability protections are provided to entities acting in accordance with this title that: (1) monitor information systems; or (2) share or receive indicators or defensive measures, provided that the manner in which an entity shares such indicators or measures with the federal government is consistent with specified procedures and exceptions set forth under the DHS sharing process.

(Sec. 107) The appropriate federal entities and inspectors general must report to Congress at least every two years concerning the implementation of this title. The reports must include:

 whether cyber threat indicators have been properly classified; an accounting of the number of security clearances authorized for purposes of this title; the type of indicators shared with appropriate federal entities, the number of indicators received through the DHS sharing process, and the number of times shared information was used by a federal entity to prosecute an offense consistent with purposes for which the federal government is authorized to disclose, retain, and use indicators and defensive measures under this title; the effect on privacy and civil liberties of specific persons, including the number of notices that were issued for a failure to remove personal information or information that identified a specific person not directly related to a cybersecurity threat; actions taken by the federal government based on shared cyber threat indicators, including the appropriateness of any federal entity's subsequent use or dissemination of such cyber threat indicators; any significant violations by the federal government; and the types of entities that received classified cyber threat indicators from the federal government. This title also requires reports to Congress, at least every two years, by: (1) the Privacy and Civil Liberties Oversight Board; and (2) inspectors general of DHS, the Intelligence Community, DOJ, DOD, and the Department of Energy regarding shared indicators and defensive measures.

(Sec. 108) Nothing in this title shall be construed to permit a federal entity to require an entity to provide information to a federal entity or another entity.

(Sec. 109) The DNI must report to Congress regarding cybersecurity threats, including cyber attacks, theft, and data breaches. The report must include: (1) an assessment of current U.S. intelligence sharing and cooperation relationships with other countries regarding cybersecurity threats to the U.S. national security interests, economy, and intellectual property; (2) a list of countries and nonstate actors that are primary threats; (3) a description of the U.S. government's response and prevention capabilities; and (4) an assessment of additional technologies that would enhance U.S. capabilities, including private sector technologies that could be rapidly fielded to assist the intelligence community.

(Sec. 110) The National Defense Authorization Act for Fiscal Year 2013 is amended to authorize DOD to share with other federal entities information reported by a cleared defense contractor regarding a penetration of network or information systems.

TITLE II--FEDERAL CYBERSECURITY ENHANCEMENT

Federal Cybersecurity Enhancement Act of 2015

(Sec. 203) This title amends the Homeland Security Act of 2002 to require DHS, in coordination with the Office of Management and Budget (OMB), to implement an intrusion assessment plan to identify and remove intruders in federal agency information systems.

DHS must deploy, operate, and maintain, for use by other agencies, capabilities to: (1) detect cybersecurity risks in network traffic transiting or traveling to or from an agency information system, and (2) prevent or modify such traffic to remove cybersecurity risks. The DHS Secretary may access, and agency heads may disclose to the Secretary, information transiting agency systems, regardless of the location from which the information is accessed, notwithstanding any laws that would otherwise restrict or prevent such disclosures.

Agencies must utilize such capabilities and adopt subsequent improvements.

DHS must establish a pilot to test and deploy advanced technologies to improve detection and prevention.

DHS must also ensure that: (1) the activities are reasonably necessary to protect agency information and systems from a cybersecurity risk, (2) information accessed by DHS will be retained no longer than reasonably necessary for such purposes, and (3) notice is provided to users of agency information systems concerning access to their communications.

This title provides liability protections to private entities authorized to assist the Secretary with such capabilities. It prohibits the liability protections from being construed to authorize an Internet service provider to break a user agreement with customers without their consent.

DOJ must review the intrusion detection and prevention system for consistency with laws governing acquisition, interception, retention, use, and disclosure of communications.

The authority for such capabilities expires seven years after enactment of this Act.

DOD, national security systems, and the intelligence community are excluded from procedures of this title.

(Sec. 204) DHS must include in the Continuous Diagnostics and Mitigation Program advanced network security tools to improve visibility of network activity to detect and mitigate intrusions and anomalous activity. The OMB must implement a plan to ensure that agencies utilize such advanced tools.

DHS must collaborate with the OMB to update government information security metrics to include measures of intrusion and incident detection and response times. The OMB must display additional agency metrics on federal government performance websites.

Upon an agency's request, DHS is authorized to operate and maintain technology that is deployed to agencies to diagnose and mitigate against cyber threats and vulnerabilities.

(Sec. 205) DHS must issue binding operational directives to assist the OMB in ensuring timely agency adoption of and compliance with standards for securing agency information systems.

Agencies must: (1) encrypt sensitive and mission critical data or otherwise render such data indecipherable to unauthorized users; (2) implement single sign-on trusted identity platforms for public websites; and (3) implement identity management, including multifactor authentication standards, for remote access to agency systems and user accounts with elevated privileges. Agency information systems are exempted from such cybersecurity requirements if the agency certifies to the OMB and Congress that the agency has taken all steps necessary to secure the agency's systems and that the requirements would be excessively burdensome and unnecessary.

(Sec. 206) The Government Accountability Office (GAO), within three years after enactment of this Act, must report on the effectiveness of the federal government's approach to securing agency information systems.

DHS must report annually to Congress on the implementation status of the intrusion detection and prevention capabilities.

The OMB must submit to Congress: (1) an annual analysis of agency application of the intrusion detection and prevention capabilities; (2) updated intrusion assessment plans; and (3) annual updates on implementation, assessment findings, agency compliance, utilization of advanced security tools, and security metrics.

(Sec. 207) When authority expires for DHS's federal intrusion detection and prevention capabilities, the reporting requirements concerning such capabilities shall also expire.

(Sec. 208) The DNI and the OMB must submit to Congress an assessment of: (1) the risks that would result from the breach of unclassified information systems that provide access to information that may enable an adversary to derive information that would otherwise be considered classified, and (2) the cost and impact on the mission carried out by each agency if such systems were subsequently designated as national security systems.

(Sec. 209) The DHS Secretary may issue an emergency directive to an agency to take any lawful action with respect to the operation of the agency's information system in response to a known or reasonably suspected information security threat, vulnerability, or incident that represents a substantial threat to information security. DHS must report annually to Congress regarding the specific actions taken pursuant to such directive.

The Secretary may also authorize intrusion detection and prevention capabilities to ensure the security of agency information systems if the Secretary: (1) determines that there is an imminent threat to such systems, that operational or emergency directives are unlikely to be timely, and that the risk outweighs any adverse consequences; (2) provides prior notice to the OMB and the chief information officers of the affected agencies and notice to Congress within seven days of taking an action; and (3) authorizes the use of protective capabilities under procedures established in coordination with the OMB.

The Secretary may direct or authorize such lawful action or protective capability only: (1) to protect agency information from unauthorized access, use, disclosure, disruption, modification, or destruction; or (2) to require the remediation of, or to protect against, identified information security risks for information collected or maintained by or on behalf of an agency or that portion of an information system used or operated by an agency or by a contractor or other organization on behalf of an agency.

The OMB must report to Congress annually regarding specific actions it has taken to enforce agency compliance and accountability.

TITLE III--FEDERAL CYBERSECURITY WORKFORCE ASSESSMENT

Federal Cybersecurity Workforce Assessment Act of 2015

(Sec. 303) This title requires federal agencies to: (1) identify all personnel positions that require the performance of cybersecurity or other cyber-related functions, and (2) assign a corresponding employment code to such positions using a coding structure that the National Institute of Standards and Technology (NIST) must include in the National Initiative for Cybersecurity Education's National Cybersecurity Workforce Framework. To implement the coding structure: (1) the Office of Personnel Management (OPM) must coordinate with NIST and the DNI to establish procedures to identify such federal civilian positions, and (2) DOD must establish procedures to identify such federal noncivilian positions.

Federal agencies must submit to Congress a report identifying: (1) the percentage of personnel with such job functions who currently hold industry-recognized certifications, (2) the preparedness of other civilian and noncivilian cyber personnel without existing credentials to take certification exams, and (3) a strategy for mitigating any identified gaps with training and certification for existing personnel.

The agencies must establish procedures to identify all encumbered and vacant positions with such functions and assign the appropriate employment code to each position.

(Sec. 304) Annually through 2022, the agencies must submit a report to the OPM that identifies cyber-related roles designated as critical needs in the agency's workforce. The OPM must provide agencies with guidance for identifying roles with acute and emerging skill shortages.

The OPM, within two years after enactment of this Act, must identify critical needs for the cyber workforce across all federal agencies and report to Congress regarding the implementation of this Act.

(Sec. 305) The GAO must report on the status of the implementation of this title within three years after enactment of this Act.

TITLE IV--OTHER CYBER MATTERS

(Sec. 401) DHS must report to Congress on threats relating to the security of the mobile devices of the federal government, including a plan for accelerated adoption of secure mobile device technology by DHS.

(Sec. 402) The Department of State shall produce a comprehensive strategy relating to U.S. international cyberspace policy. The strategy must include:

 a review of activities undertaken to support the goal of the President's International Strategy for Cyberspace; a plan to guide the diplomacy of the State Department to obtain agreements on the norms of responsible international behavior in cyberspace; a review of alternative concepts with regard to international norms in cyberspace offered by other foreign countries, including China, Russia, Brazil, and India; a description of cyberspace threats to U.S. national security from foreign countries, state-sponsored actors, and private actors to federal and private sector infrastructure, U.S. intellectual property, and U.S. citizens; a review of deterrent policy tools available to the President; and a review of resources required by the State Department, including the Office of the Coordinator for Cyber Issues, to build international cyber behavior norms. The State Department must brief congressional committees on such issues and make the strategy available to the public.

(Sec. 403) The State Department must consult with countries in which international cyber criminals are physically present, and from which extradition is unlikely, to determine what actions those governments have taken to prosecute and prevent cyber or intellectual property crimes against U.S. interests or citizens.

The State Department must also report annually to Congress regarding: (1) the number of such criminals located in other countries, including an indication of countries from which extradition is unlikely; (2) its discussions with officials of other countries; and (3) each international cyber criminal extradited to the United States.

(Sec. 404) The National Cybersecurity and Communications Integration Center must: (1) establish a process for statewide interoperability coordinators to report cybersecurity risks or incidents involving information systems or networks used by emergency response providers within their states, and (2) develop security and resilience recommendations for such networks. NIST must support, and report to Congress regarding, the development of methods for reducing cybersecurity risks to such emergency response providers.

(Sec. 405) The Department of Health and Human Services (HHS) must report to Congress regarding the preparedness of the health care industry in responding to cybersecurity threats. The report must identify the HHS official responsible for coordinating HHS cyber threat efforts and include plans on how HHS divisions will communicate with each other regarding such threats.

HHS must convene a one-year task force of health care industry stakeholders, cybersecurity experts, and federal agencies to plan a single system for the federal government to share intelligence regarding cybersecurity threats to the health care industry in near real time without charging a fee to the recipients. The task force must report to Congress regarding the plan and recommendations for securing private entities against cyber attacks and protecting networked medical devices and other software or systems that connect to an electronic health record. The task force must also provide HHS with cybersecurity preparedness information to disseminate to the health care industry.

HHS must collaborate with DHS, health care industry stakeholders, NIST, and other entities to establish a single, voluntary, national, health-specific cybersecurity framework with a common set of standards and security practices as a resource for cost-effectively reducing cybersecurity risks for health care organizations.

(Sec. 406) Inspectors general of agencies operating national security systems or federal computer systems that provide access to personally identifiable information must report to Congress regarding their agencies': (1) logical access standards for granting or denying requests to obtain and use information and processing services; (2) use of multi-factor logical access controls that require at least two of specified controls (information known to the user, an access device provided to the user, or a unique biometric characteristic of the user) to gain access to information; (3) procedures to detect exfiltration and inventory software and licenses; and (4) policies to ensure that contractors and other entities providing services to the agency implement appropriate data security management practices.

(Sec. 407) DHS, in conjunction with appropriate sector-specific agencies or federal entities that regulate critical infrastructure, must: (1) assess entities identified under Executive Order 13636, which provides for the identification of critical infrastructure where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security; (2) report to Congress regarding the extent to which such entities report significant intrusions of information systems essential to the operation of critical infrastructure to DHS or appropriate agency heads in a timely manner; and (3) develop a strategy to ensure that a cybersecurity incident affecting such entities would no longer reasonably result in such catastrophic regional or national effects.

(Sec. 408) This section amends the federal criminal code to extend extraterritorially the application of penalties for fraud offenses involving an access device issued, owned, managed, or controlled by a financial institution, account issuer, credit card system member, or other entity organized under the laws of the United States or any U.S. state or territory. (An access device is any card, code, electronic serial number, telecommunications service, or other means of account access that can be used to initiate a transfer of funds or to obtain money, goods, or services.) This section also removes a condition under current law that subjects a person to such penalties only if the underlying articles, property, or proceeds are held within or have transferred through U.S. jurisdiction.

(Sec. 409) This Act shall be in effect for ten years beginning on the date of its enactment.

bill requires director national_intelligence departments homeland_security dhs defense justice develop procedures share cybersecurity threat information private entities nonfederal government agencies state tribal local governments public entities threats detect prevent mitigate cybersecurity threats security vulnerabilities private entities monitor operate defensive measures information systems written consent information systems private government entities liability protections provided entities voluntarily share receive cyber threat indicators defensive measures entities government sharing process developed dhs federal_government receive indicators defensive measures shared entity ensure appropriate federal entities receive shared indicators automated real time manner bill limits purposes government use shared information certain cybersecurity purposes responses imminent threats threats minor crimes prosecuted information restricted offenses relating fraud identity theft espionage censorship trade secrets imminent threat death bodily harm economic harm including terrorist act use weapon mass destruction dhs deploy system detect cybersecurity risks network traffic transiting traveling agency information system prevent modify traffic remove cybersecurity risks dhs secretary issue emergency directives agencies response substantial information security threat vulnerability incident authorize intrusion detection prevention capabilities secure agency information systems case imminent threat federal agencies identify mitigate skill shortages federal workforce positions requiring performance cybersecurity functions department_of_state develop diplomacy strategy obtain agreements international behavior cyberspace consult countries prosecution prevention cyber intellectual property crimes national cybersecurity communications integration center establish process statewide interoperability coordinators report risks incidents involving networks emergency response providers department_of_health_and_human_services convene task_force plan single system federal_government share intelligence cybersecurity threats health_care industry recommend protections networked medical devices electronic health records dhs develop strategy ensure cyber incident affecting critical infrastructure entities result catastrophic regional national effects public health safety economic security national security bill allows criminal penalties fraud involving account access devices imposed regardless underlying articles property proceeds held transferred jurisdiction summary title cybersecurity information sharing cybersecurity information sharing act sec title requires director national_intelligence dni departments homeland_security dhs defense dod justice doj develop promulgate procedures promote sharing classified declassified cyber threat indicators possession federal_government private entities nonfederal government agencies state tribal local governments unclassified indicators public information entities cybersecurity threats prevent mitigate adverse effects cybersecurity best practices attention challenges faced small businesses procedures incorporate sector specific information sharing analysis centers existing processes federal nonfederal entities information sharing federal_government procedures include process timely notifications recipients threat indicators federal entities federal_government shared indicators error contravention law persons personal information shared federal_government violation act dni submit procedures congress days enactment act sec detect prevent mitigate cybersecurity threats security vulnerabilities private entities monitor operate defensive measures information systems authorization written consent information systems private government entities defensive measure action device procedure signature technique measure applied information system information stored processed transiting information system detects prevents known suspected cybersecurity threat security vulnerability defensive measures include measures destroy render unusable provide unauthorized access substantially harm information system data belonging private entity operating measure entity authorized provide provided consent private entity operation measure term private entity includes state tribal local governments performing electric utility services excludes foreign powers foreign_intelligence_surveillance_act entities share receive indicators defensive measures entities federal_government cybersecurity purpose recipients comply lawful restrictions sharing entities place sharing use shared indicators defensive measures federal_government entities monitoring operating sharing indicators defensive measures utilize security controls protect unauthorized access acquisitions remove personal information information identifies specific person directly related cybersecurity threat prior sharing indicator state tribal local agencies use shared indicators consent entity sharing indicators prevent investigate prosecute offenses relating imminent threat death bodily harm economic harm including terrorist act use weapon mass destruction crimes involving fraud identity theft espionage censorship trade secrets title exempts antitrust laws private entities cybersecurity purposes exchange provide cyber threat indicators assistance relating prevention investigation mitigation cybersecurity threats exemption inapplicable price fixing allocating market competitors attempting market exchanges price cost information customer lists information future competitive planning sec doj dhs promulgate procedures relating receipt indicators defensive measures federal_government procedures include automated real time sharing procedures audit capability appropriate sanctions federal officers employees agents conduct unauthorized activities doj dhs develop publicly available guidelines assist entities sharing indicators federal_government including guidance identifying protecting personal information doj promulgate review years privacy civil liberties guidelines limit receipt retention use dissemination personal identifying information guidelines include steps dissemination cyber threat indicators consistent protection classified sensitive national security information dhs develop process dhs federal_government accept cyber threat indicators defensive measures entity real time ensure appropriate federal entities receive shared indicators automated manner real time process process implemented dhs certify congress dhs sharing capability fully operational title requires dhs capability process federal_government receives indicators defensive measures title shared private entity federal_government electronic mail media interactive internet website form real time automated process information systems communications federal entity private entity previously shared cyber threat indicator describe relevant cybersecurity threat develop defensive measure based indicator communications regulated entity entity federal regulatory authority cybersecurity threat dhs process prohibited limiting lawful disclosures communications records information report known suspected criminal activity participate federal investigation voluntarily legally compelled provide indicators defensive measures statutory authorized contractual requirement dhs ensure public notice access dhs sharing procedures dhs report congress implementation sharing process dhs cyber threat indicators defensive measures shared federal_government threat indicators shared state tribal local governments deemed voluntarily shared information exempt disclosure withheld public laws jurisdictions requiring disclosure information records consistent applicable federal law indicators defensive measures disclosed retained federal agency federal_government agent solely protecting information system information stored processed transiting information system cybersecurity threat security vulnerability identifying cybersecurity threat including source security vulnerability identifying use information system foreign terrorist responding preventing mitigating threat minor imminent threat death bodily harm economic harm including terrorist act use weapon mass destruction preventing investigating disrupting prosecuting offense arising imminent threat death bodily harm economic harm offenses relating fraud identity theft espionage censorship trade secrets indicators defensive measures provided government government agencies regulate lawful activities entity sec liability protections provided entities acting accordance title monitor information systems share receive indicators defensive measures provided manner entity shares indicators measures federal_government consistent specified procedures exceptions set forth dhs sharing process sec appropriate federal entities inspectors_general report congress years concerning implementation title reports include cyber threat indicators properly classified accounting number security clearances authorized purposes title type indicators shared appropriate federal entities number indicators received dhs sharing process number times shared information federal entity prosecute offense consistent purposes federal_government authorized disclose retain use indicators defensive measures title effect privacy civil liberties specific persons including number notices issued failure remove personal information information identified specific person directly related cybersecurity threat actions taken federal_government based shared cyber threat indicators including appropriateness federal entity subsequent use dissemination cyber threat indicators significant violations federal_government types entities received classified cyber threat indicators federal_government title requires reports congress years privacy_and_civil_liberties_oversight_board inspectors_general dhs intelligence_community doj dod department_of_energy shared indicators defensive measures sec title shall construed permit federal entity require entity provide information federal entity entity sec dni report congress cybersecurity threats including cyber attacks theft data breaches report include assessment current intelligence sharing cooperation relationships countries cybersecurity threats national security interests economy intellectual property list countries actors primary threats description government response prevention capabilities assessment additional technologies enhance capabilities including private sector technologies rapidly fielded assist intelligence_community sec national_defense_authorization_act fiscal year amended authorize dod share federal entities information reported cleared defense contractor penetration network information systems title federal cybersecurity enhancement federal cybersecurity enhancement_act sec title amends homeland_security act require dhs coordination office_of_management_and_budget omb implement intrusion assessment plan identify remove federal agency information systems dhs deploy operate maintain use agencies capabilities detect cybersecurity risks network traffic transiting traveling agency information system prevent modify traffic remove cybersecurity risks dhs secretary access agency heads disclose secretary information transiting agency systems regardless location information accessed notwithstanding laws restrict prevent disclosures agencies utilize capabilities adopt subsequent improvements dhs establish pilot test deploy advanced technologies improve detection prevention dhs ensure activities reasonably necessary protect agency information systems cybersecurity risk information accessed dhs retained longer reasonably necessary purposes notice provided users agency information systems concerning access communications title provides liability protections private entities authorized assist secretary capabilities prohibits liability protections construed authorize internet service provider break user agreement customers consent doj review intrusion detection prevention system consistency laws governing acquisition interception retention use disclosure communications authority capabilities expires seven years enactment act dod national security systems intelligence_community excluded procedures title sec dhs include continuous diagnostics mitigation program advanced network security tools improve visibility network activity detect mitigate activity omb implement plan ensure agencies utilize advanced tools dhs collaborate omb update government information security metrics include measures intrusion incident detection response times omb display additional agency metrics federal_government performance websites agency request dhs authorized operate maintain technology deployed agencies diagnose mitigate cyber threats vulnerabilities sec dhs issue binding operational directives assist omb ensuring timely agency adoption compliance standards securing agency information systems agencies sensitive mission critical data render data unauthorized users implement single sign trusted identity platforms public websites implement identity management including authentication standards remote access agency systems user accounts elevated privileges agency information systems exempted cybersecurity requirements agency certifies omb congress agency taken steps necessary secure agency systems requirements excessively burdensome unnecessary sec government_accountability_office gao years enactment act report effectiveness federal_government approach securing agency information systems dhs report annually congress implementation status intrusion detection prevention capabilities omb submit congress annual analysis agency application intrusion detection prevention capabilities updated intrusion assessment plans annual updates implementation assessment findings agency compliance utilization advanced security tools security metrics sec authority expires dhs federal intrusion detection prevention capabilities reporting requirements concerning capabilities shall expire sec dni omb submit congress assessment risks result breach unclassified information systems provide access information enable derive information considered classified cost impact mission carried agency systems subsequently designated national security systems sec dhs secretary issue emergency directive agency lawful action respect operation agency information system response known reasonably suspected information security threat vulnerability incident represents substantial threat information security dhs report annually congress specific actions taken pursuant directive secretary authorize intrusion detection prevention capabilities ensure security agency information systems secretary determines imminent threat systems operational emergency directives unlikely timely risk outweighs adverse consequences provides prior notice omb chief information officers affected agencies notice congress seven days taking action authorizes use protective capabilities procedures established coordination omb secretary direct authorize lawful action protective capability protect agency information unauthorized access use disclosure disruption modification destruction require remediation protect identified information security risks information collected maintained behalf agency portion information system operated agency contractor organization behalf agency omb report congress annually specific actions taken enforce agency compliance accountability title iii federal cybersecurity workforce assessment federal cybersecurity workforce assessment act sec title requires federal agencies identify personnel positions require performance cybersecurity cyber related functions assign corresponding employment code positions coding structure national_institute_of_standards_and_technology nist include national initiative cybersecurity education national cybersecurity workforce framework implement coding structure office_of_personnel_management opm coordinate nist dni establish procedures identify federal civilian positions dod establish procedures identify federal positions federal agencies submit congress report identifying percentage personnel job functions currently hold industry recognized certifications preparedness civilian cyber personnel existing credentials certification exams strategy mitigating identified gaps training certification existing personnel agencies establish procedures identify vacant positions functions assign appropriate employment code position sec annually agencies submit report opm identifies cyber related roles designated critical needs agency workforce opm provide agencies guidance identifying roles acute emerging skill shortages opm years enactment act identify critical needs cyber workforce federal agencies report congress implementation act sec gao report status implementation title years enactment act title cyber matters sec dhs report congress threats relating security mobile devices federal_government including plan accelerated adoption secure mobile device technology dhs sec department_of_state shall produce comprehensive strategy relating international cyberspace policy strategy include review activities undertaken support goal president international strategy cyberspace plan guide diplomacy state_department obtain agreements norms responsible international behavior cyberspace review alternative concepts regard international norms cyberspace offered foreign countries including china russia brazil india description cyberspace threats national security foreign countries state sponsored actors private actors federal private sector infrastructure intellectual property citizens review deterrent policy tools available president review resources required state_department including office coordinator cyber issues build international cyber behavior norms state_department brief congressional committees issues strategy available public sec state_department consult countries international cyber criminals physically present extradition unlikely determine actions governments taken prosecute prevent cyber intellectual property crimes interests citizens state_department report annually congress number criminals located countries including indication countries extradition unlikely discussions officials countries international cyber criminal united_states sec national cybersecurity communications integration center establish process statewide interoperability coordinators report cybersecurity risks incidents involving information systems networks emergency response providers states develop security resilience recommendations networks nist support report congress development methods reducing cybersecurity risks emergency response providers sec department_of_health_and_human_services hhs report congress preparedness health_care industry responding cybersecurity threats report identify hhs official responsible coordinating hhs cyber threat efforts include plans hhs divisions communicate threats hhs convene year task_force health_care industry stakeholders cybersecurity experts federal agencies plan single system federal_government share intelligence cybersecurity threats health_care industry near real time charging fee recipients task_force report congress plan recommendations securing private entities cyber attacks protecting networked medical devices software systems connect electronic health record task_force provide hhs cybersecurity preparedness information disseminate health_care industry hhs collaborate dhs health_care industry stakeholders nist entities establish single voluntary national health specific cybersecurity framework common set standards security practices resource cost effectively reducing cybersecurity risks health_care organizations sec inspectors_general agencies operating national security systems federal computer systems provide access personally identifiable information report congress agencies access standards granting denying requests obtain use information processing services use multi factor access controls require specified controls information known user access device provided user unique biometric characteristic user gain access information procedures detect inventory software licenses policies ensure contractors entities providing services agency implement appropriate data_security management practices sec dhs conjunction appropriate sector specific agencies federal entities regulate critical infrastructure assess entities identified executive order provides identification critical infrastructure cybersecurity incident reasonably result catastrophic regional national effects public health safety economic security national security report congress extent entities report significant information systems essential operation critical infrastructure dhs appropriate agency heads timely manner develop strategy ensure cybersecurity incident affecting entities longer reasonably result catastrophic regional national effects sec section amends federal criminal code extend application penalties fraud offenses involving access device issued owned managed controlled financial institution account issuer credit card system member entity organized laws united_states state territory access device card code electronic serial number telecommunications service means account access initiate transfer funds obtain money goods services section removes condition current law subjects person penalties underlying articles property proceeds held transferred jurisdiction sec act shall effect years beginning date enactment


Summary:
This bill amends the Federal Power Act to authorize the Secretary of Energy to require an entity that owns, controls, or operates a bulk-power system facility to take whatever actions the Secretary determines will best avert or mitigate a cyber security threat pursuant to a written notice from the President that immediate action is necessary to protect the bulk-power system from such threat.

The Secretary is encouraged to coordinate with Canadian and Mexican officials responsible for the protection of cyber security of the interconnected North American electricity grid.

The Secretary, before exercising this authority, shall consult about the cyber security threat with: (1) the entities indicated, (2) the Electric Reliability Organization, (3) the Electricity Sub-sector Coordinating Council, and (4) other appropriate federal officials.

The Federal Energy Regulatory Commission shall establish a mechanism that permits owners, operators, or users of the bulk-power system to seek recovery of prudently incurred costs required to implement actions ordered by the Secretary.

Rates or charges approved under this mechanism must be just and reasonable, and neither unduly discriminatory nor preferential.

Emergency orders under the bill are limited to a 30-day period unless the Secretary: (1) provides interested persons an opportunity to submit written data, recommendations, and arguments; and (2) affirms, amends (for up to 90 days), or repeals the order.

bill amends federal power act authorize secretary energy require entity owns controls operates bulk power system facility actions secretary determines best avert mitigate cyber security threat pursuant written notice president immediate action necessary protect bulk power system threat secretary encouraged coordinate canadian mexican officials responsible protection cyber security interconnected north american electricity grid secretary exercising authority shall consult cyber security threat entities indicated electric reliability organization electricity sub sector coordinating council appropriate federal officials federal_energy_regulatory_commission shall establish mechanism permits owners operators users bulk power system seek recovery incurred costs required implement actions ordered secretary rates charges approved mechanism reasonable unduly discriminatory preferential emergency orders bill limited day period secretary provides interested persons opportunity submit written data recommendations arguments affirms amends days repeals order


Summary:
Department of Defense Cyber Support to Civil Authorities Act of 2015

Directs the Department of Defense (DOD) to develop a comprehensive plan for the U.S. Cyber Command to support civil authorities in responding to cyber attacks by foreign powers against the United States or a U.S. person.

Requires the plan to include: (1) a plan for internal DOD collective training activities to be integrated with exercises conducted with other federal agencies and state and local governments; (2) any historical frameworks used in the formulation of the plan; (3) descriptions of the roles, responsibilities, and expectations of federal, state, and local authorities, as well as the active and reserve components of the Armed Forces; and (4) any legislative and administrative actions necessary to carry out the plan.

Directs the Government Accountability Office to review such plan.

department_of_defense cyber support civil authorities act directs department_of_defense dod develop comprehensive plan cyber command support civil authorities responding cyber attacks foreign powers united_states person requires plan include plan internal dod collective training activities integrated exercises conducted federal agencies state local governments historical frameworks formulation plan descriptions roles responsibilities expectations federal state local authorities active reserve components armed_forces legislative administrative actions necessary carry plan directs government_accountability_office review plan


Summary:
Domain Openness Through Continued Oversight Matters Act of 2015 or the DOTCOM Act of 2015

(Sec. 2) This bill prohibits the Assistant Secretary of Commerce for Communications and Information from permitting the National Telecommunications and Information Administration's (NTIA's) role in the performance of the Internet Assigned Numbers Authority (IANA) functions to cease until 30 legislative days after the Assistant Secretary submits to Congress a report that contains: (1) the proposal relating to the transition of the NTIA's stewardship of the IANA functions that was developed in a process convened by the Internet Corporation for Assigned Names and Numbers (ICANN) at the request of the NTIA, and (2) the following required certifications by the Assistant Secretary.

The bill requires the Assistant Secretary to certify that: (1) such proposal supports and enhances the multistakeholder model of Internet governance, maintains the security, stability, and resiliency of the Internet domain name system, meets the needs of global customers and partners of the IANA services, maintains the openness of the Internet, and does not replace the role of the NTIA with a government-led or intergovernmental organization solution; and (2) the required changes to ICANN's bylaws contained in the final report of ICANN's Cross Community Working Group on Enhancing ICANN Accountability and the changes to ICANN's bylaws required by ICANN's IANA Stewardship Transition Coordination Group have been adopted.

domain openness continued oversight matters act act sec bill prohibits assistant secretary commerce_for_communications_and_information permitting national_telecommunications_and_information_administration ntia role performance internet assigned numbers authority functions cease legislative days assistant secretary submits congress report contains proposal relating transition ntia stewardship functions developed process convened internet corporation assigned names numbers request ntia following required certifications assistant secretary bill requires assistant secretary certify proposal supports enhances model internet governance maintains security stability resiliency internet domain system meets needs global customers partners services maintains openness internet replace role ntia government led intergovernmental organization solution required changes bylaws contained final report cross community working_group enhancing accountability changes bylaws required stewardship transition coordination group adopted


Summary:
Federal Cybersecurity Enhancement Act of 2016

(Sec. 3) This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security (DHS) to coordinate with the Office of Management and Budget (OMB) to implement an intrusion assessment plan to identify and remove intruders in federal agency information systems.

DHS must deploy and operate, for use by other agencies, capabilities to detect and prevent or remove cybersecurity risks in network traffic transiting or traveling to or from agency information systems. DHS may access, and agencies may disclose to DHS, information transiting agency systems, regardless of the location from which the information is accessed, notwithstanding any laws that would otherwise restrict or prevent such disclosures. Agencies must utilize such capabilities and adopt subsequent improvements.

DHS must establish a pilot to test and deploy advanced technologies to improve detection and prevention.

DHS must ensure that: (1) activities are reasonably necessary to protect agency information and systems from cybersecurity risks, (2) information accessed by DHS will be retained no longer than reasonably necessary, (3) notice has been provided to users of agency information systems concerning access to their communications, and (4) activities are implemented pursuant to policies governing the operation of the intrusion detection and prevention capabilities.

Liability protections are provided to private entities authorized to assist DHS with such capabilities. But such liability protections shall not be construed to authorize an Internet service provider to break a user agreement with a customer.

The Department of Justice must ensure that guidelines for such capabilities are consistent with laws governing the acquisition, interception, retention, use, and disclosure of communications.

The OMB and DHS must update government-wide policies and brief Congress regarding the prioritization and use of network security monitoring tools within agency networks.

The Department of Defense and the intelligence community are exempt from this bill's procedures.

(Sec. 4) DHS must include in the Continuous Diagnostics and Mitigation Program advanced network security tools to improve visibility of network activity to detect and mitigate intrusions and anomalous activity. The OMB must implement a plan to ensure that agencies utilize such advanced tools.

DHS must collaborate with the OMB to update government information security metrics to include measures of intrusion and incident detection and response times. The OMB must display additional agency metrics on federal government performance websites.

Upon an agency's request, DHS may operate and maintain technology that is deployed to agencies to diagnose and mitigate against cyber threats and vulnerabilities.

(Sec. 5) DHS must require implementation of best practices for securing agency information systems against intrusion and preventing data exfiltration in the event of an intrusion. Agencies must: (1) identify their stored sensitive and mission critical data, (2) assess data access controls, (3) encrypt data consistent with federal information system standards, (4) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that requires user authentication, and (5) implement multifactor authentication for remote access to agency systems and for user accounts with elevated privileges.

(Sec. 6) The Government Accountability Office must report on the effectiveness of the federal government's strategy to secure agency information systems. On an annual basis: (1) DHS must report on the implementation status of intrusion detection and prevention capabilities, and (2) the OMB must report on agency application of such capabilities.

The OMB must submit updated intrusion assessment plans to Congress and report annually on intrusion assessment findings, advanced network security tools, and agency compliance.

(Sec. 7) The authority for operating such federal intrusion detection and prevention capabilities terminates seven years after enactment of this bill.

(Sec. 8) The Office of the Director of National Intelligence (ODNI) must submit to Congress an assessment of: (1) the risks that would result from the breach of unclassified information systems that provide access to information that, when combined with other unclassified information, may comprise classified information; and (2) the cost and impact on the mission carried out by each agency if such systems were subsequently classified.

(Sec. 9) DHS and the ODNI must coordinate with agencies to conduct an ongoing damage and risk assessment relating to data breaches at the Office of Personnel Management (OPM). The ODNI must report on: (1) the extent to which federal data was compromised, exfiltrated, or manipulated by the same entity that caused the OPM data breach; (2) national security impacts; and (3) whether information accessed through the breach has been released or deployed.

(Sec. 10) DHS may issue an emergency directive to an agency to take any lawful action regarding the operation of the agency's information system (including systems owned or operated by another entity on behalf of an agency) in response to a known or reasonably suspected information security threat, vulnerability, or incident that represents a substantial threat to information security. DHS must report annually to Congress regarding specific actions taken pursuant to such directives.

If DHS determines that there is an imminent threat for which a directive is unlikely to result in a timely response, DHS may authorize the use of protective capabilities under DHS control for communications or system traffic transiting to or from, or stored on, an agency information system without prior consultation with the affected agency. But DHS must immediately notify the OMB, each affected agency, and Congress of the use of such imminent threat authority and the reasons for, and duration of, the action.

DHS may direct or authorize such lawful action or protective capability only: (1) to protect agency information from unauthorized access, use, disclosure, disruption, modification, or destruction; or (2) to require the remediation of, or to protect against, identified information security risks for information collected or maintained by or on behalf of an agency or that portion of an information system used or operated by an agency or other organization on an agency's behalf.

The OMB must report annually regarding specific actions it has taken to enforce agency compliance and accountability.

federal cybersecurity enhancement_act sec bill amends homeland_security act require department_of_homeland_security dhs coordinate office_of_management_and_budget omb implement intrusion assessment plan identify remove federal agency information systems dhs deploy operate use agencies capabilities detect prevent remove cybersecurity risks network traffic transiting traveling agency information systems dhs access agencies disclose dhs information transiting agency systems regardless location information accessed notwithstanding laws restrict prevent disclosures agencies utilize capabilities adopt subsequent improvements dhs establish pilot test deploy advanced technologies improve detection prevention dhs ensure activities reasonably necessary protect agency information systems cybersecurity risks information accessed dhs retained longer reasonably necessary notice provided users agency information systems concerning access communications activities implemented pursuant policies governing operation intrusion detection prevention capabilities liability protections provided private entities authorized assist dhs capabilities liability protections shall construed authorize internet service provider break user agreement customer department_of_justice ensure guidelines capabilities consistent laws governing acquisition interception retention use disclosure communications omb dhs update government wide policies brief congress prioritization use network security monitoring tools agency networks department_of_defense intelligence_community exempt bill procedures sec dhs include continuous diagnostics mitigation program advanced network security tools improve visibility network activity detect mitigate activity omb implement plan ensure agencies utilize advanced tools dhs collaborate omb update government information security metrics include measures intrusion incident detection response times omb display additional agency metrics federal_government performance websites agency request dhs operate maintain technology deployed agencies diagnose mitigate cyber threats vulnerabilities sec dhs require implementation best practices securing agency information systems intrusion preventing data event intrusion agencies identify stored sensitive mission critical data assess data access controls data consistent federal information system standards implement single sign trusted identity platform individuals accessing public website agency requires user authentication implement authentication remote access agency systems user accounts elevated privileges sec government_accountability_office report effectiveness federal_government strategy secure agency information systems annual basis dhs report implementation status intrusion detection prevention capabilities omb report agency application capabilities omb submit updated intrusion assessment plans congress report annually intrusion assessment findings advanced network security tools agency compliance sec authority operating federal intrusion detection prevention capabilities terminates seven years enactment bill sec office_of_the_director national_intelligence odni submit congress assessment risks result breach unclassified information systems provide access information combined unclassified information comprise classified information cost impact mission carried agency systems subsequently classified sec dhs odni coordinate agencies conduct ongoing damage risk assessment relating data breaches office_of_personnel_management opm odni report extent federal data compromised manipulated entity caused opm data breach national security impacts information accessed breach released deployed sec dhs issue emergency directive agency lawful action operation agency information system including systems owned operated entity behalf agency response known reasonably suspected information security threat vulnerability incident represents substantial threat information security dhs report annually congress specific actions taken pursuant directives dhs determines imminent threat directive unlikely result timely response dhs authorize use protective capabilities dhs control communications system traffic transiting stored agency information system prior consultation affected agency dhs immediately notify omb affected agency congress use imminent threat authority reasons duration action dhs direct authorize lawful action protective capability protect agency information unauthorized access use disclosure disruption modification destruction require remediation protect identified information security risks information collected maintained behalf agency portion information system operated agency organization agency behalf omb report annually specific actions taken enforce agency compliance accountability


Summary:
Mobile Device Theft Deterrence Act of 2015

Amends the federal criminal code to prohibit knowingly: (1) removing, obliterating, tampering with, or altering a mobile device identification number; or (2) using, producing, trafficking in, having control or custody of, or possessing hardware or software, knowing it has been configured to engage in such conduct.

Exempts the manufacturer of a mobile device, a person that engineers, tests, repairs, or refurbishes a mobile device, or a person that implements technologies for the purpose of protecting the security and privacy of mobile device end users while allowing the transmission of the mobile device identification number to service providers, unless such manufacturer or person knows that the mobile device or part involved is stolen.

mobile device theft deterrence act amends federal criminal code prohibit knowingly removing tampering altering mobile device identification number producing trafficking having control custody possessing hardware software knowing configured engage conduct exempts manufacturer mobile device person engineers tests repairs mobile device person implements technologies purpose protecting security privacy mobile device end users allowing transmission mobile device identification number service providers manufacturer person knows mobile device involved stolen


Summary: Federal Cybersecurity Workforce Assessment ActThis bill requires federal agencies to: (1) identify all personnel positions that require the performance of information technology, cybersecurity, or other cyber-related functions; and (2) assign a corresponding employment code to such positions using a coding structure that the National Institute of Standards and Technology must include in the National Initiative for Cybersecurity Education's National Cybersecurity Workforce Framework.To implement the coding structure: (1) the Office of Personnel Management (OPM) must coordinate with the Director of National Intelligence to establish procedures to identify such federal civilian positions, and (2) the Department of Defense must establish procedures to identify such federal noncivilian positions. Federal agencies must submit to Congress a report identifying: (1) the percentage of personnel with such job functions who currently hold industry-recognized certifications, (2) the preparedness of other civilian and noncivilian cyber personnel without existing credentials to pass certification exams, and (3) a strategy for mitigating any identified gaps with training and certification for existing personnel. The agencies must establish procedures to identify all encumbered and vacant positions with such functions and assign the appropriate employment code to each position.Annually through 2022, the agencies must submit a report to the OPM that identifies cyber-related roles designated as critical needs in the agency's workforce. The OPM must provide agencies with guidance for identifying roles with acute and emerging skill shortages. The OPM, within two years after enactment of this Act, must identify critical needs for the cyber workforce across all federal agencies and report to Congress regarding the implementation of this Act.

federal cybersecurity workforce assessment bill requires federal agencies identify personnel positions require performance information technology cybersecurity cyber related functions assign corresponding employment code positions coding structure national_institute_of_standards_and_technology include national initiative cybersecurity education national cybersecurity workforce framework implement coding structure office_of_personnel_management opm coordinate director national_intelligence establish procedures identify federal civilian positions department_of_defense establish procedures identify federal positions federal agencies submit congress report identifying percentage personnel job functions currently hold industry recognized certifications preparedness civilian cyber personnel existing credentials pass certification exams strategy mitigating identified gaps training certification existing personnel agencies establish procedures identify vacant positions functions assign appropriate employment code position annually agencies submit report opm identifies cyber related roles designated critical needs agency workforce opm provide agencies guidance identifying roles acute emerging skill shortages opm years enactment act identify critical needs cyber workforce federal agencies report congress implementation act


Summary:
Streamlining and Investing in Broadband Infrastructure Act

This bill requires the National Telecommunications and Information Administration to issue best practices relating to broadband infrastructure and installation for state broadband coordination offices, with an emphasis on rural areas.

The Department of Transportation (DOT) must require states to install broadband conduits, which support broadband or wireless facilities for broadband service, in certain highway construction projects. DOT must ensure that: (1) standards are established that apply to all areas, including rural and remote areas with low population density; and (2) any requesting broadband provider has access to such installed conduits on a competitively neutral and nondiscriminatory basis, for a charge not to exceed a cost-based rate.

Federal easement and right-of-way procedures under the Middle Class Tax Relief and Job Creation Act of 2012 are revised to allow an executive agency, a state, a person, a firm, or an organization to apply for the grant of a real property interest (including a lease, license, easement, or right-of-way) to, in, over, or on a building or other property owned by the federal government for the right to install, construct, modify, and maintain a communications facility installation. An executive agency that owns the building or other property on behalf of the federal government must grant to the applicant, if technically feasible, a real property interest to perform such installation, construction, modification, and maintenance.

Requirements are set forth concerning the fees and terms of years for the grant of such real property interests. The bill provides for the collection of: (1) a standard fee established by the General Services Administration (GSA), or (2) agency-specific fees established by executive agencies.

The GSA must also consult with designated agencies regarding the master application forms and standard contracts that executive agencies are required to accept for the placement of such facilities. If the GSA determines that master forms or contracts are not adequate for a specific building or property, it must coordinate with the agencies to address the inadequacies and provide an adequate alternative application form or contract to the applicant.

streamlining investing broadband infrastructure act bill requires national_telecommunications_and_information_administration issue best practices relating broadband infrastructure installation state broadband coordination offices emphasis rural areas department_of_transportation dot require states install broadband conduits support broadband wireless facilities broadband service certain highway construction projects dot ensure standards established apply areas including rural remote areas low population density requesting broadband provider access installed conduits competitively neutral nondiscriminatory basis charge exceed cost based rate federal easement right way procedures middle class tax relief job creation act revised allow executive agency state person firm organization apply grant real property interest including lease license easement right way building property owned federal_government right install construct modify maintain communications facility installation executive agency owns building property behalf federal_government grant applicant technically feasible real property interest perform installation construction modification maintenance requirements set forth concerning fees terms years grant real property interests bill provides collection standard fee established general_services_administration gsa agency specific fees established executive agencies gsa consult designated agencies master application forms standard contracts executive agencies required accept placement facilities gsa determines master forms contracts adequate specific building property coordinate agencies address provide adequate alternative application form contract applicant


Summary:
Small Business Broadband Deployment Act of 2016

(Sec. 2) This bill exempts any small business broadband Internet access service provider with not more than 250,000 subscribers from the enhancements to the transparency rule of the Federal Communications Commission (FCC) under which any person providing broadband Internet access service must disclose publicly accurate information regarding the network management practices, performance, and commercial terms of its broadband Internet access services sufficient for:

 consumers to make informed choices regarding their use; and content, application, service, and device providers to develop, market, and maintain Internet offerings. The FCC shall:

 report to Congress, within 180 days of enactment of this bill, its recommendations (including supporting data) on whether the exception should be made permanent, and whether the definition of "small business," for purposes of the exception, should be modified; and within 180 days after such report, commence a rulemaking proceeding to implement the recommendations. This small business exception shall terminate after the later of: (1) three years after enactment of this bill; or (2) the date on which the FCC adopts rules in its rulemaking proceeding for implementing its recommendations.

small business broadband deployment act sec bill exempts small business broadband internet access service provider subscribers enhancements transparency rule federal_communications_commission fcc person providing broadband internet access service disclose publicly accurate information network management practices performance commercial terms broadband internet access services sufficient consumers informed choices use content application service device providers develop market maintain internet offerings fcc shall report congress days enactment bill recommendations including supporting data exception permanent definition small business purposes exception modified days report commence rulemaking proceeding implement recommendations small business exception shall terminate later years enactment bill date fcc adopts rules rulemaking proceeding implementing recommendations


Summary:
Cybersecurity Disclosure Act of 2015

This bill directs the Securities and Exchange Commission (SEC) to issue final rules requiring each reporting company to:

 disclose in its mandatory annual report or annual proxy statement whether any member of its governing body has expertise or experience in cybersecurity, including details necessary to describe fully the nature of that expertise or experience; and if no member has such expertise or experience, describe what other company cybersecurity steps were taken into account by any persons, such as a nominating committee, responsible for identifying and evaluating nominees for the governing body. The SEC shall also, in coordination with the National Institute of Standards and Technology, define what constitutes expertise or experience in cybersecurity, such as professional qualifications to administer information security program functions or experience detecting, preventing, mitigating, or addressing cybersecurity threats.

cybersecurity disclosure act bill directs securities_and_exchange_commission sec issue final rules requiring reporting company disclose mandatory annual report annual proxy statement member governing body expertise experience cybersecurity including details necessary describe fully nature expertise experience member expertise experience describe company cybersecurity steps taken account persons nominating committee responsible identifying evaluating nominees governing body sec shall coordination national_institute_of_standards_and_technology define constitutes expertise experience cybersecurity professional qualifications administer information security program functions experience detecting preventing mitigating addressing cybersecurity threats


Summary:
Restoring Internet Freedom Act

 This bill nullifies the rule adopted by the Federal Communications Commission (FCC) on February 26, 2015, relating to the reclassification of broadband Internet access service as a telecommunications service.

The FCC is prohibited from reissuing such rule in substantially the same form, or from issuing a new rule that is substantially the same, unless the rule is specifically authorized by a law enacted after enactment of this Act.

restoring internet freedom act bill nullifies rule adopted federal_communications_commission fcc february relating reclassification broadband internet access service telecommunications service fcc prohibited rule substantially form issuing new rule substantially rule specifically authorized law enacted enactment act


Summary:
Developing Innovation and Growing the Internet of Things Act or the DIGIT Act

(Sec. 2) This bill expresses the sense of Congress that policies governing the Internet of Things (IoT) should maximize the potential and development of the growing number of connected and interconnected devices to benefit businesses, governments, and consumers.

(Sec. 4) The bill requires the Department of Commerce to convene a working group of federal stakeholders to provide recommendations and a report to Congress regarding the IoT. The bill establishes a steering committee to be composed of stakeholders outside the federal government to advise the working group.

The working group must: (1) identify federal laws and regulations, grant practices, budgetary or jurisdictional challenges, and other sector-specific policies that inhibit IoT development; (2) consider policies or programs that encourage and improve coordination among federal agencies with IoT jurisdiction; (3) implement recommendations from the steering committee; (4) examine how federal agencies can benefit from, use, and prepare for the IoT; and (5) consult with nongovernmental stakeholders.

The steering committee must advise the working group about laws, budgets, spectrum needs, individual privacy, security, small business challenges, and any international proceedings or negotiations affecting the IoT.

Within 18 months after enactment of this bill, the working group must report its findings and recommendations, its reasons for inaction on steering committee recommendations, and an accounting of any progress by federal agencies to implement recommendations.

(Sec. 5) The Federal Communications Commission must: (1) seek public comment on the IoT's spectrum needs, regulatory barriers, and growth with licensed and unlicensed spectrum; and (2) submit a summary of those comments to Congress.

developing innovation growing internet things act digit act sec bill expresses sense congress policies governing internet things maximize potential development growing number connected interconnected devices benefit businesses governments consumers sec bill requires department_of_commerce convene working_group federal stakeholders provide recommendations report congress bill establishes steering committee composed stakeholders outside federal_government advise working_group working_group identify federal laws regulations grant practices budgetary jurisdictional challenges sector specific policies inhibit development consider policies programs encourage improve coordination federal agencies jurisdiction implement recommendations steering committee examine federal agencies benefit use prepare consult nongovernmental stakeholders steering committee advise working_group laws budgets spectrum needs individual privacy security small business challenges international proceedings negotiations affecting months enactment bill working_group report findings recommendations reasons inaction steering committee recommendations accounting progress federal agencies implement recommendations sec federal_communications_commission seek public comment spectrum needs regulatory barriers growth licensed unlicensed spectrum submit summary comments congress


Summary:
State and Local Cyber Protection Act of 2016

This bill amends the Homeland Security Act of 2002 to require the Department of Homeland Security's (DHS's) national cybersecurity and communications integration center (NCCIC) to assist state and local governments with cybersecurity by:

 upon request, identifying system vulnerabilities and information security protections to address unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by, or information systems used or operated by, state or local governments or other organizations or contractors on their behalf; providing via a web portal updated resources and guidelines related to information security; coordinating through national associations to implement information security tools and policies to ensure the resiliency of state and local information systems; providing training on cybersecurity, privacy, and civil liberties; providing requested technical assistance to deploy technology that continuously diagnoses and mitigates cyber threats and to conduct threat and vulnerability assessments; coordinating vulnerability disclosures under standards developed by the National Institute of Standards and Technology; and ensuring that state and local governments are aware of DHS resources and other federal tools to ensure the security and resiliency of federal civilian information systems. The NCCIC's privacy and civil liberties training must include: (1) reasonable limits on the receipt, retention, use, and disclosure of information associated with specific persons that is not necessary for cybersecurity purposes; (2) data integrity standards requiring the prompt removal and destruction of obsolete or erroneous names and personal information that is unrelated to the risk or incident information; (3) safeguards and confidentiality protections for cyber threat indicators and defensive measures, including information that is proprietary or business-sensitive that may be used to identify specific persons from unauthorized access or acquisition; and (4) methods to ensure that information obtained from efforts to address cybersecurity risks and incidents is used only for such purposes or as specifically authorized by law.

state local cyber protection act bill amends homeland_security act require department_of_homeland_security dhs national cybersecurity communications integration center assist state local governments cybersecurity request identifying system vulnerabilities information security protections address unauthorized access use disclosure disruption modification destruction information collected maintained information systems operated state local governments organizations contractors behalf providing web portal updated resources guidelines related information security coordinating national associations implement information security tools policies ensure resiliency state local information systems providing training cybersecurity privacy civil liberties providing requested technical assistance deploy technology continuously diagnoses cyber threats conduct threat vulnerability assessments coordinating vulnerability disclosures standards developed national_institute_of_standards_and_technology ensuring state local governments aware dhs resources federal tools ensure security resiliency federal civilian information systems privacy civil liberties training include reasonable limits receipt retention use disclosure information associated specific persons necessary cybersecurity purposes data integrity standards requiring prompt removal destruction obsolete erroneous names personal information unrelated risk incident information safeguards confidentiality protections cyber threat indicators defensive measures including information proprietary business sensitive identify specific persons unauthorized access acquisition methods ensure information obtained efforts address cybersecurity risks incidents purposes specifically authorized law


Summary:
Federal Information Systems Safeguards Act of 2016

(Sec. 2) This bill provides that executive agency actions that are necessary to restrict or prohibit access to a website which an agency determines presents a security weakness or risk to the information technology or information system under the agency's control shall not be subject to federal employee labor-management relations requirements.

The agency, after taking such an action, shall, upon the request of employees of the agency, consider and seek guidance on the personal communication needs of such employees.

federal information systems safeguards act sec bill provides executive agency actions necessary restrict prohibit access website agency determines presents security weakness risk information technology information system agency control shall subject federal employee labor management relations requirements agency taking action shall request employees agency consider seek guidance personal communication needs employees


Summary:
International Communications Privacy Act

This bill amends the federal criminal code by allowing a governmental entity to require providers of electronic communication services or remote computing services to disclose the contents of communications in electronic storage (e.g., the cloud), regardless of where those communications are located. Thus, a governmental entity may obtain a warrant for electronic communications stored outside of the United States if certain conditions for obtaining the warrant are met.

The bill allows a governmental entity to obtain those communications only if a court finds that the governmental entity has taken all reasonable steps to establish the nationality and location of the subscriber or customer whose communications are sought and that there are reasonable grounds to believe that such subscriber or customer is a U.S. person, a person physically located within the United States, or a national of a foreign country that has a law enforcement cooperation agreement with the United States.

The Department of Justice must: (1) establish a process for foreign governments to file mutual legal assistance treaty requests for obtaining access to electronic communications, and (2) publish annually information concerning those requests.

international communications privacy_act bill amends federal criminal code allowing governmental entity require providers electronic communication services remote computing services disclose contents communications electronic storage cloud regardless communications located governmental entity obtain warrant electronic communications stored outside united_states certain conditions obtaining warrant met bill allows governmental entity obtain communications court finds governmental entity taken reasonable steps establish nationality location subscriber customer communications sought reasonable grounds believe subscriber customer person person physically located united_states national foreign country law enforcement cooperation agreement united_states department_of_justice establish process foreign governments file mutual legal assistance treaty requests obtaining access electronic communications publish annually information concerning requests


Summary:
Driving Innovation and Growth in Internet Technology and Launching Universal Access to the Global Economy (DIGITAL AGE) Act of 2016

This bill requires the Department of State to establish a Special Representative for the Global Connect Initiative to direct, and represent the United States internationally on, U.S. foreign policy efforts to promote global universal Internet access.

The Special Representative shall: (1) oversee the State Department's Global Connect initiative to promote Internet access policies to enable first-time access to mobile and broadband Internet for at least 1.5 billion people in urban and rural areas by 2020, (2) promote investment by international finance institutions and U.S. corporations in Internet infrastructure expansion and connectivity projects, (3) encourage partner countries to adopt policies to lower prices and improve the quality of Internet service, and (4) collaborate with other federal agencies.

 The U.S. Agency for International Development may support expanded Internet connectivity worldwide by: (1) providing guidance to partner governments on establishing regulatory policies; and (2) funding and implementing programs to expand Internet infrastructure, digital literacy, and Internet connectivity and usage.

The Overseas Private Investment Corporation (OPIC) should expedite institutional efforts and partner with other investors, local institutions, and private sector actors to increase Internet access services. Investments must focus on expanding: (1) the number of people with new access to Internet services; (2) construction of fiber, mobile, and other emerging access technologies; (3) rural area Internet access hubs; (4) the capacity of developing countries to monitor and regulate the Internet sector and encourage private investment; and (5) investment priorities in sub-Saharan Africa and other regions with acute shortages of critical infrastructure.

The Foreign Assistance Act of 1961 is amended to: (1) allow OPIC to make loans for projects sponsored by, or significantly involving, U.S. investors or foreign associations with U.S. owners; (2) require systems infrastructure costs to be treated as transaction costs; and (3) extend until 2021 OPIC's authority to issue investment insurance, investment guarantees, and direct loans.

The President must report annually on a multiyear strategy encouraging developing countries to expand Internet access as a means to catalyze innovation and economic growth, promote democracy, create educational opportunities, improve health outcomes, and strengthen global research networks.

The President may establish an Interagency Working Group to coordinate U.S. government activities in carrying out the strategy.

driving innovation growth internet technology launching universal access global economy digital age act bill requires department_of_state establish special representative global connect initiative direct represent united_states internationally foreign policy efforts promote global universal internet access special representative shall oversee state_department global connect initiative promote internet access policies enable time access mobile broadband internet billion people urban rural areas promote investment international finance institutions corporations internet infrastructure expansion connectivity projects encourage partner countries adopt policies lower prices improve quality internet service collaborate federal agencies agency international_development support expanded internet connectivity worldwide providing guidance partner governments establishing regulatory policies funding implementing programs expand internet infrastructure digital literacy internet connectivity usage overseas_private_investment_corporation opic expedite institutional efforts partner investors local institutions private sector actors increase internet access services investments focus expanding number people new access internet services construction fiber mobile emerging access technologies rural area internet access hubs capacity developing countries monitor regulate internet sector encourage private investment investment priorities sub saharan africa regions acute shortages critical infrastructure foreign assistance_act amended allow opic loans projects sponsored significantly involving investors foreign associations owners require systems infrastructure costs treated transaction costs extend opic authority issue investment insurance investment guarantees direct_loans president report annually multiyear strategy encouraging developing countries expand internet access means innovation economic growth promote democracy create educational opportunities improve health outcomes strengthen global research networks president establish interagency_working_group coordinate government activities carrying strategy