Congressional Record, July 20, 2021 — House
Summary
Congressional Record, House, page H3689, July 20, 2021. The page opens with the end of a letter closing with the name of Bennie G. Thompson, Chairman, Committee on Homeland Security. Mr. Guest speaks in support of H.R. 2795, the DHS Blue Campaign Enhancement Act, which would create an advisory board to coordinate training on recognizing human trafficking. Ms. Barragán's motion to suspend the rules and pass that bill is put to a vote, Mr. Moore of Alabama demands the yeas and nays, and further proceedings are postponed. Ms. Clarke of New York then moves to suspend the rules and pass H.R. 3138, the State and Local Cybersecurity Improvement Act.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Congressional Record, July 20, 2021 — House.”
Original at www.govinfo.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/crec-crec-2021-07-20-crec-2021-07-20-pt1-pgh3689-b89df39caa/
, SHA-256 4e5c8c4a23c603fb3ca7381e1c80a4e64b8242f14776531fe5a3cb3998f5615e.Full text
July 20, 2021 CONGRESSIONAL RECORD — HOUSE H3689
with you on this legislation and other mat- one very specific goal, to combat the gentlewoman from California (Ms.
ters of great importance to this Nation. human trafficking. BARRAGÁN) that the House suspend the
Sincerely, According to the Department of rules and pass the bill, H.R. 2795, as
BENNIE G. THOMPSON, State’s Trafficking in Persons Report, amended.
Chairman,
every year, around the world tens of The question was taken.
Committee on Homeland Security.
thousands of men, women, and children The SPEAKER pro tempore. In the
Mr. GUEST. Madam Speaker, I yield are trafficked, including far too many opinion of the Chair, two-thirds being
myself such time as I may consume. right here in the United States. Human in the affirmative, the ayes have it.
Madam Speaker, I rise today in sup- traffickers use fraud and coercion to Mr. MOORE of Alabama. Madam
port of H.R. 2795, the DHS Blue Cam- compel people into situations of forced Speaker, on that I demand the yeas
paign Enhancement Act. As vice-rank- labor or sexual exploitation. False and nays.
ing member of the Homeland Security promises of well-paying jobs, romantic The SPEAKER pro tempore. Pursu-
Committee, I know how important it is relationships, and violence are all ant to section 3(s) of House Resolution
for us to approach protecting this great methods used by human traffickers. 8, the yeas and nays are ordered.
Nation in a comprehensive manner by Victims can be any age, race, gender, Pursuant to clause 8 of rule XX, fur-
tackling all types of threats, including: or nationality and from any socio- ther proceedings on this motion are
hackers, terrorists, violent criminals, economic background. postponed.
and human traffickers. To curb this horrific practice, we
f
Criminal organizations use human must use a multipronged approach, and
trafficking to fund their operations by a critical component to this strategy is b 1300
defrauding, coercing, and exploiting ensuring that law enforcement per- STATE AND LOCAL CYBER-
both adults and children, forcing them sonnel and employees in customer-fac- SECURITY IMPROVEMENT ACT
into labor and commercial sex acts. ing industries are trained to identify a
The DHS Blue Campaign enables and potential victim of human trafficking Ms. CLARKE of New York. Madam
empowers the DHS workforce and cus- by recognizing key indicators and tak- Speaker, I move to suspend the rules
tomer-facing industries they work ing appropriate action. and pass the bill (H.R. 3138) to amend
with—industries such as airlines—to DHS started the Blue Campaign in the Homeland Security Act of 2002 to
recognize the indicators of human traf- 2010 to do just that; to unify and co- authorize a grant program relating to
ficking and take the proper steps to ordinate Department efforts to address the cybersecurity of State and local
alert authorities. human trafficking. The Blue Campaign governments, and for other purposes,
H.R. 2795 enhances the Department’s enables and empowers the DHS work- as amended.
existing training opportunities by de- force and the industries they work The Clerk read the title of the bill.
veloping internet-based training pro- with—including airlines and the pub- The text of the bill is as follows:
grams to train Federal, State, local, lic—to recognize the indicators of H.R. 3138
Tribal law enforcement officers, and human trafficking and take steps to Be it enacted by the Senate and House of Rep-
others as part of the Department’s alert the appropriate authorities. resentatives of the United States of America in
Blue Campaign. This important piece My bill, the DHS Blue Campaign En- Congress assembled,
of legislation also established the Blue hancement Act, bolsters these efforts SECTION 1. SHORT TITLE.
Campaign Advisory Board within the by creating an advisory board to in- This Act may be cited as the ‘‘State and
form and coordinate training among Local Cybersecurity Improvement Act’’.
Department to coordinate Blue Cam-
the DHS components to increase the ef- SEC. 2.STATE AND LOCAL CYBERSECURITY
paign efforts and work cohesively to GRANT PROGRAM.
combat human trafficking. ficiency and effectiveness of the train-
(a) IN GENERAL.—Subtitle A of title XXII of
Empowering State and local law en- ing that DHS provides for its per- the Homeland Security Act of 2002 (6 U.S.C.
forcement to recognize potential sonnel, its industries, and State and 651 et seq.) is amended by adding at the end
human trafficking is the first step in local law enforcement partners. the following new sections:
helping them assist these victims, This legislation also increases the ‘‘SEC. 2220A. STATE AND LOCAL CYBERSECURITY
many of whom have been told that online trainings that DHS will provide, GRANT PROGRAM.
they have broken the law and can’t enabling the Department to reach a ‘‘(a) DEFINITIONS.—In this section:
seek police assistance by their traf- broader audience more quickly. ‘‘(1) CYBER THREAT INDICATOR.—The term
fickers. H.R. 2795 does this and helps I would like to thank my good friend ‘cyber threat indicator’ has the meaning
from California (Mr. CORREA) for join- given the term in section 102 of the Cyberse-
disrupt these criminal networks, which curity Act of 2015 (6 U.S.C. 1501).
is an important component in disman- ing me in this effort and supporting
‘‘(2) CYBERSECURITY PLAN.—The term ‘Cy-
tling criminals and the terrorists fi- this important piece of legislation.
bersecurity Plan’ means a plan submitted by
Madam Speaker, I urge my col-
nancing their acts around the world. an eligible entity under subsection (e)(1).
leagues to approve this bill and help ‘‘(3) ELIGIBLE ENTITY.—The term ‘eligible
I want to thank Representative
DHS do its part to combat human traf- entity’ means—
MEIJER for his leadership, and Chair-
ficking. ‘‘(A) a State; or
man THOMPSON for moving this legisla- Mr. GUEST. Madam Speaker, I have ‘‘(B) an Indian tribe that, not later than
tion out of committee, and I urge my no further speakers, and I urge Mem- 120 days after the date of the enactment of
colleagues to support this important bers to support this bill. this section or not later than 120 days before
bill to further secure the homeland. Madam Speaker, I yield back the bal- the start of any fiscal year in which a grant
Madam Speaker, I reserve the bal- ance of my time. under this section is awarded—
ance of my time. Ms. BARRAGÁN. Madam Speaker, I ‘‘(i) notifies the Secretary that the Indian
Ms. BARRAGÁN. Madam Speaker, I yield myself the balance of my time. tribe intends to develop a Cybersecurity
have no more speakers, and I am pre- Plan; and
Madam Speaker, DHS is uniquely po-
pared to close after the gentleman ‘‘(ii) agrees to forfeit any distribution
sitioned to address human trafficking under subsection (n)(2).
from Mississippi closes. I reserve the through the Blue Campaign. H.R. 2795 ‘‘(4) INCIDENT.—The term ‘incident’ has the
balance of my time. seeks to build upon the success of the meaning given the term in section 2209.
Mr. GUEST. Madam Speaker, I yield Blue Campaign, which was first estab- ‘‘(5) INDIAN TRIBE; TRIBAL ORGANIZATION.—
2 minutes to the gentleman from lished in August 2010, and to bolster The term ‘Indian tribe’ or ‘Tribal organiza-
Michigan (Mr. MEIJER). human trafficking awareness by ensur- tion’ has the meaning given that term in sec-
Mr. MEIJER. Madam Speaker, I rise ing that public-facing materials re- tion 4(e) of the of the Indian Self-Determina-
in support of H.R. 2795, the DHS Blue tion and Education Assistance Act (25 U.S.C.
main as current and accessible as pos-
ctelli on DSK11ZRN23PROD with HOUSE
Campaign Enhancement Act. This bill, 5304(e)).
sible. This is a worthwhile endeavor. ‘‘(6) INFORMATION SHARING AND ANALYSIS
which I am proud to have introduced Madam Speaker, I urge passage of ORGANIZATION.—The term ‘information shar-
with my colleague, the chairman of the the bill, and I yield back the balance of ing and analysis organization’ has the mean-
Homeland Security Subcommittee on my time. ing given the term in section 2222.
Oversight, Management, and Account- The SPEAKER pro tempore. The ‘‘(7) INFORMATION SYSTEM.—The term ‘in-
ability, Representative CORREA, has question is on the motion offered by formation system’ has the meaning given the
VerDate Sep 11 2014 04:35 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00017 Fmt 7634 Sfmt 0634 E:\CR\FM\A20JY7.008 H20JYPT1
H3690 CONGRESSIONAL RECORD — HOUSE July 20, 2021
term in section 102 of the Cybersecurity Act Tribal organizations within the jurisdiction rity threats to information systems of the
of 2015 (6 U.S.C. 1501). of the eligible entity and between those in- eligible entity in consultation with—
‘‘(8) ONLINE SERVICE.—The term ‘online formation systems and information systems ‘‘(I) local and Tribal organizations within
service’ means any internet-facing service, not owned or operated by the eligible entity the jurisdiction of the eligible entity; and
including a website, email, virtual private or by local or Tribal organizations within ‘‘(II) as applicable—
network, or custom application. the jurisdiction of the eligible entity; ‘‘(aa) States that neighbor the jurisdiction
‘‘(9) RANSOMWARE INCIDENT.—The term ‘‘(iii) enhance the preparation, response, of the eligible entity or, as appropriate,
‘ransomware incident’ means an incident and resilience of information systems, appli- members of an information sharing and anal-
that actually or imminently jeopardizes, cations, and user accounts owned or operated ysis organization; and
without lawful authority, the integrity, con- by or on behalf of the eligible entity or local ‘‘(bb) countries that neighbor the jurisdic-
fidentiality, or availability of information or Tribal organizations against cybersecu- tion of the eligible entity; and
on an information system, or actually or im- rity risks and cybersecurity threats; ‘‘(xv) implement an information tech-
minently jeopardizes, without lawful author- ‘‘(iv) implement a process of continuous nology and operational technology mod-
ity, an information system for the purpose of cybersecurity vulnerability assessments and ernization cybersecurity review process that
coercing the information system’s owner, op- threat mitigation practices prioritized by de- ensures alignment between information
erator, or another person. gree of risk to address cybersecurity risks technology and operational technology cy-
‘‘(10) STATE AND LOCAL CYBERSECURITY and cybersecurity threats on information bersecurity objectives;
GRANT PROGRAM.—The term ‘State and Local
systems of the eligible entity or local or ‘‘(C) describe, to the extent practicable,
Cybersecurity Grant Program’ means the the individual responsibilities of the eligible
Tribal organizations;
program established under subsection (b). entity and local and Tribal organizations
‘‘(v) ensure that State, local, and Tribal or-
‘‘(11) STATE AND LOCAL CYBERSECURITY RE- within the jurisdiction of the eligible entity
ganizations that own or operate information
SILIENCE COMMITTEE.—The term ‘State and in implementing the plan;
systems that are located within the jurisdic-
Local Cybersecurity Resilience Committee’ ‘‘(D) outline, to the extent practicable, the
tion of the eligible entity—
means the committee established under sub- necessary resources and a timeline for imple-
‘‘(I) adopt best practices and methodolo-
section (o)(1). menting the plan; and
gies to enhance cybersecurity, such as the
‘‘(b) ESTABLISHMENT.— ‘‘(E) describe how the eligible entity will
practices set forth in the cybersecurity measure progress towards implementing the
‘‘(1) IN GENERAL.—The Secretary, acting
framework developed by, and the cyber sup- plan.
through the Director, shall establish a pro-
ply chain risk management best practices ‘‘(3) DISCRETIONARY ELEMENTS.—A Cyberse-
gram, to be known as the ‘the State and
identified by, the National Institute of curity Plan of an eligible entity may include
Local Cybersecurity Grant Program’, to
Standards and Technology; and a description of—
award grants to eligible entities to address
‘‘(II) utilize knowledge bases of adversary ‘‘(A) cooperative programs developed by
cybersecurity risks and cybersecurity
tools and tactics to assess risk; groups of local and Tribal organizations
threats to information systems of State,
‘‘(vi) promote the delivery of safe, rec- within the jurisdiction of the eligible entity
local, or Tribal organizations.
ognizable, and trustworthy online services to address cybersecurity risks and cyberse-
‘‘(2) APPLICATION.—An eligible entity seek-
by State, local, and Tribal organizations, in- curity threats; and
ing a grant under the State and Local Cyber-
cluding through the use of the .gov internet ‘‘(B) programs provided by the eligible en-
security Grant Program shall submit to the
domain; tity to support local and Tribal organiza-
Secretary an application at such time, in
‘‘(vii) ensure continuity of operations of tions and owners and operators of critical in-
such manner, and containing such informa-
the eligible entity and local, and Tribal or- frastructure to address cybersecurity risks
tion as the Secretary may require.
‘‘(c) BASELINE REQUIREMENTS.—An eligible ganizations in the event of a cybersecurity and cybersecurity threats.
entity or multistate group that receives a incident (including a ransomware incident), ‘‘(4) MANAGEMENT OF FUNDS.—An eligible
grant under this section shall use the grant including by conducting exercises to practice entity applying for a grant under this sec-
in compliance with— responding to such an incident; tion shall agree to designate the Chief Infor-
‘‘(1)(A) the Cybersecurity Plan of the eligi- ‘‘(viii) use the National Initiative for Cy- mation Officer, the Chief Information Secu-
ble entity or the Cybersecurity Plans of the bersecurity Education Cybersecurity Work- rity Officer, or an equivalent official of the
eligible entities that comprise the force Framework developed by the National eligible entity as the primary official for the
multistate group; and Institute of Standards and Technology to management and allocation of funds awarded
‘‘(B) the Homeland Security Strategy to identify and mitigate any gaps in the cyber- under this section.
Improve the Cybersecurity of State, Local, security workforces of State, local, or Tribal ‘‘(f) MULTISTATE GRANTS.—
Tribal, and Territorial Governments devel- organizations, enhance recruitment and re- ‘‘(1) IN GENERAL.—The Secretary, acting
oped under section 2210(e)(1); or tention efforts for such workforces, and bol- through the Director, may award grants
‘‘(2) activities carried out under para- ster the knowledge, skills, and abilities of under this section to a group of two or more
graphs (3), (4), and (5) of subsection (h). State, local, and Tribal organization per- eligible entities to support multistate efforts
‘‘(d) ADMINISTRATION.—The State and Local sonnel to address cybersecurity risks and cy- to address cybersecurity risks and cyberse-
Cybersecurity Grant Program shall be ad- bersecurity threats, such as through cyberse- curity threats to information systems within
ministered in the same office of the Depart- curity hygiene training; the jurisdictions of the eligible entities.
ment that administers grants made under ‘‘(ix) ensure continuity of communications ‘‘(2) SATISFACTION OF OTHER REQUIRE-
sections 2003 and 2004. and data networks within the jurisdiction of MENTS.—In order to be eligible for a
‘‘(e) CYBERSECURITY PLANS.— the eligible entity between the eligible enti- multistate grant under this subsection, each
‘‘(1) IN GENERAL.—An eligible entity apply- ty and local and Tribal organizations that eligible entity that comprises a multistate
ing for a grant under this section shall sub- own or operate information systems within group shall submit to the Secretary—
mit to the Secretary a Cybersecurity Plan the jurisdiction of the eligible entity in the ‘‘(A) a Cybersecurity Plan for approval in
for approval. event of an incident involving such commu- accordance with subsection (i); and
‘‘(2) REQUIRED ELEMENTS.—A Cybersecurity nications or data networks within the juris- ‘‘(B) a plan for establishing a cybersecurity
Plan of an eligible entity shall— diction of the eligible entity; planning committee under subsection (g).
‘‘(A) incorporate, to the extent practicable, ‘‘(x) assess and mitigate, to the greatest ‘‘(3) APPLICATION.—
any existing plans of the eligible entity to degree possible, cybersecurity risks and cy- ‘‘(A) IN GENERAL.—A multistate group ap-
protect against cybersecurity risks and cy- bersecurity threats related to critical infra- plying for a multistate grant under para-
bersecurity threats to information systems structure and key resources, the degradation graph (1) shall submit to the Secretary an
of State, local, or Tribal organizations; of which may impact the performance of in- application at such time, in such manner,
‘‘(B) describe, to the extent practicable, formation systems within the jurisdiction of and containing such information as the Sec-
how the eligible entity will— the eligible entity; retary may require.
‘‘(i) manage, monitor, and track informa- ‘‘(xi) enhance capabilities to share cyber ‘‘(B) MULTISTATE PROJECT DESCRIPTION.—
tion systems, applications, and user ac- threat indicators and related information be- An application of a multistate group under
counts owned or operated by or on behalf of tween the eligible entity and local and Trib- subparagraph (A) shall include a plan de-
the eligible entity or by local or Tribal orga- al organizations that own or operate infor- scribing—
nizations within the jurisdiction of the eligi- mation systems within the jurisdiction of ‘‘(i) the division of responsibilities among
ble entity and the information technology the eligible entity, including by expanding the eligible entities that comprise the
deployed on those information systems, in- existing information sharing agreements multistate group for administering the grant
cluding legacy information systems and in- with the Department; for which application is being made;
ctelli on DSK11ZRN23PROD with HOUSE
formation technology that are no longer sup- ‘‘(xii) enhance the capability of the eligible ‘‘(ii) the distribution of funding from such
ported by the manufacturer of the systems entity to share cyber threat indictors and re- a grant among the eligible entities that com-
or technology; lated information with the Department; prise the multistate group; and
‘‘(ii) monitor, audit, and track activity be- ‘‘(xiii) leverage cybersecurity services of- ‘‘(iii) how the eligible entities that com-
tween information systems, applications, fered by the Department; prise the multistate group will work to-
and user accounts owned or operated by or ‘‘(xiv) develop and coordinate strategies to gether to implement the Cybersecurity Plan
on behalf of the eligible entity or by local or address cybersecurity risks and cybersecu- of each of those eligible entities.
VerDate Sep 11 2014 04:35 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00018 Fmt 7634 Sfmt 0634 E:\CR\FM\A20JY7.027 H20JYPT1
July 20, 2021 CONGRESSIONAL RECORD — HOUSE H3691
‘‘(g) PLANNING COMMITTEES.— the Cybersecurity Plan of the eligible entity; ‘‘(B) ALLOCATION.—Of the amount reserved
‘‘(1) IN GENERAL.—An eligible entity that and under subparagraph (A), funds shall be allo-
receives a grant under this section shall es- ‘‘(ii) the eligible entity will submit by Sep- cated in a manner determined by the Sec-
tablish a cybersecurity planning committee tember 30, 2023, to the Secretary a Cyberse- retary in consultation with Indian tribes.
to— curity Plan for review, and if appropriate, ‘‘(C) EXCEPTION.—This paragraph shall not
‘‘(A) assist in the development, implemen- approval; or apply in any fiscal year in which the Sec-
tation, and revision of the Cybersecurity ‘‘(B) the eligible entity certifies to the Sec- retary—
Plan of the eligible entity; retary, and the Director confirms, that the ‘‘(i) receives fewer than five applications
‘‘(B) approve the Cybersecurity Plan of the eligible entity will use funds from the grant from Indian tribes; or
eligible entity; and to assist with the activities described in sub- ‘‘(ii) does not approve at least two applica-
‘‘(C) assist in the determination of effec- section (h)(3). tions from Indian tribes.
tive funding priorities for a grant under this ‘‘(j) LIMITATIONS ON USES OF FUNDS.— ‘‘(m) FEDERAL SHARE.—
section in accordance with subsection (h). ‘‘(1) IN GENERAL.—An eligible entity that ‘‘(1) IN GENERAL.—The Federal share of the
‘‘(2) COMPOSITION.—A committee of an eli- receives a grant under this section may not cost of an activity carried out using funds
gible entity established under paragraph (1) use the grant— made available with a grant under this sec-
shall— ‘‘(A) to supplant State, local, or Tribal tion may not exceed—
‘‘(A) be comprised of representatives from funds; ‘‘(A) in the case of a grant to an eligible
the eligible entity and counties, cities, ‘‘(B) for any recipient cost-sharing con- entity—
towns, Tribes, and public educational and tribution; ‘‘(i) for fiscal year 2022, 90 percent;
health institutions within the jurisdiction of ‘‘(C) to pay a demand for ransom in an at- ‘‘(ii) for fiscal year 2023, 80 percent;
the eligible entity; and tempt to— ‘‘(iii) for fiscal year 2024, 70 percent;
‘‘(B) include, as appropriate, representa- ‘‘(i) regain access to information or an in- ‘‘(iv) for fiscal year 2025, 60 percent; and
tives of rural, suburban, and high-population formation system of the eligible entity or of ‘‘(v) for fiscal year 2026 and each subse-
jurisdictions. a local or Tribal organization within the ju- quent fiscal year, 50 percent; and
‘‘(3) CYBERSECURITY EXPERTISE.—Not less risdiction of the eligible entity; or ‘‘(B) in the case of a grant to a multistate
than 1⁄2 of the representatives of a committee ‘‘(ii) prevent the disclosure of information group—
established under paragraph (1) shall have that has been removed without authoriza- ‘‘(i) for fiscal year 2022, 95 percent;
professional experience relating to cyberse- tion from an information system of the eligi- ‘‘(ii) for fiscal year 2023, 85 percent;
curity or information technology.
ble entity or of a local or Tribal organization ‘‘(iii) for fiscal year 2024, 75 percent;
‘‘(4) RULE OF CONSTRUCTION REGARDING EX-
within the jurisdiction of the eligible entity; ‘‘(iv) for fiscal year 2025, 65 percent; and
ISTING PLANNING COMMITTEES.—Nothing in
‘‘(D) for recreational or social purposes; or ‘‘(v) for fiscal year 2026 and each subse-
this subsection may be construed to require
‘‘(E) for any purpose that does not address quent fiscal year, 55 percent.
an eligible entity to establish a cybersecu-
cybersecurity risks or cybersecurity threats ‘‘(2) WAIVER.—The Secretary may waive or
rity planning committee if the eligible enti-
on information systems of the eligible entity modify the requirements of paragraph (1) for
ty has established and uses a multijuris-
or of a local or Tribal organization within an Indian tribe if the Secretary determines
dictional planning committee or commission
the jurisdiction of the eligible entity. such a waiver is in the public interest.
that meets, or may be leveraged to meet, the
‘‘(2) PENALTIES.—In addition to any other ‘‘(n) RESPONSIBILITIES OF GRANTEES.—
requirements of this subsection.
‘‘(h) USE OF FUNDS.—An eligible entity remedy available, the Secretary may take ‘‘(1) CERTIFICATION.—Each eligible entity
that receives a grant under this section shall such actions as are necessary to ensure that or multistate group that receives a grant
use the grant to— a recipient of a grant under this section uses under this section shall certify to the Sec-
‘‘(1) implement the Cybersecurity Plan of the grant for the purposes for which the retary that the grant will be used—
the eligible entity; grant is awarded. ‘‘(A) for the purpose for which the grant is
‘‘(2) develop or revise the Cybersecurity ‘‘(3) RULE OF CONSTRUCTION.—Nothing in awarded; and
Plan of the eligible entity; or paragraph (1) may be construed to prohibit ‘‘(B) in compliance with, as the case may
‘‘(3) assist with activities that address im- the use of grant funds provided to a State, be—
minent cybersecurity risks or cybersecurity local, or Tribal organization for otherwise ‘‘(i) the Cybersecurity Plan of the eligible
threats to the information systems of the el- permissible uses under this section on the entity;
igible entity or a local or Tribal organization basis that a State, local, or Tribal organiza- ‘‘(ii) the Cybersecurity Plans of the eligi-
within the jurisdiction of the eligible entity. tion has previously used State, local, or ble entities that comprise the multistate
‘‘(i) APPROVAL OF PLANS.— Tribal funds to support the same or similar group; or
‘‘(1) APPROVAL AS CONDITION OF GRANT.—Be- uses. ‘‘(iii) a purpose approved by the Secretary
fore an eligible entity may receive a grant ‘‘(k) OPPORTUNITY TO AMEND APPLICA- under subsection (h) or pursuant to an excep-
under this section, the Secretary, acting TIONS.—In considering applications for tion under subsection (i).
through the Director, shall review the Cyber- grants under this section, the Secretary ‘‘(2) AVAILABILITY OF FUNDS TO LOCAL AND
security Plan, or any revisions thereto, of shall provide applicants with a reasonable TRIBAL ORGANIZATIONS.—Not later than 45
the eligible entity and approve such plan, or opportunity to correct defects, if any, in days after the date on which an eligible enti-
revised plan, if it satisfies the requirements such applications before making final ty or multistate group receives a grant
specified in paragraph (2). awards. under this section, the eligible entity or
‘‘(2) PLAN REQUIREMENTS.—In approving a ‘‘(l) APPORTIONMENT.—For fiscal year 2022 multistate group shall, without imposing un-
Cybersecurity Plan of an eligible entity and each fiscal year thereafter, the Sec- reasonable or unduly burdensome require-
under this subsection, the Director shall en- retary shall apportion amounts appropriated ments as a condition of receipt, obligate or
sure that the Cybersecurity Plan— to carry out this section among States as otherwise make available to local and Tribal
‘‘(A) satisfies the requirements of sub- follows: organizations within the jurisdiction of the
section (e)(2); ‘‘(1) BASELINE AMOUNT.—The Secretary eligible entity or the eligible entities that
‘‘(B) upon the issuance of the Homeland shall first apportion 0.25 percent of such comprise the multistate group, and as appli-
Security Strategy to Improve the Cybersecu- amounts to each of American Samoa, the cable, consistent with the Cybersecurity
rity of State, Local, Tribal, and Territorial Commonwealth of the Northern Mariana Is- Plan of the eligible entity or the Cybersecu-
Governments authorized pursuant to section lands, Guam, the U.S. Virgin Islands, and rity Plans of the eligible entities that com-
2210(e), complies, as appropriate, with the 0.75 percent of such amounts to each of the prise the multistate group—
goals and objectives of the strategy; and remaining States. ‘‘(A) not less than 80 percent of funds avail-
‘‘(C) has been approved by the cybersecu- ‘‘(2) REMAINDER.—The Secretary shall ap- able under the grant;
rity planning committee of the eligible enti- portion the remainder of such amounts in ‘‘(B) with the consent of the local and Trib-
ty established under subsection (g). the ratio that— al organizations, items, services, capabili-
‘‘(3) APPROVAL OF REVISIONS.—The Sec- ‘‘(A) the population of each eligible entity, ties, or activities having a value of not less
retary, acting through the Director, may ap- bears to than 80 percent of the amount of the grant;
prove revisions to a Cybersecurity Plan as ‘‘(B) the population of all eligible entities. or
the Director determines appropriate. ‘‘(3) MINIMUM ALLOCATION TO INDIAN ‘‘(C) with the consent of the local and Trib-
‘‘(4) EXCEPTION.—Notwithstanding sub- TRIBES.— al organizations, grant funds combined with
section (e) and paragraph (1) of this sub- ‘‘(A) IN GENERAL.—In apportioning other items, services, capabilities, or activi-
section, the Secretary may award a grant amounts under this section, the Secretary ties having the total value of not less than 80
ctelli on DSK11ZRN23PROD with HOUSE
under this section to an eligible entity that shall ensure that, for each fiscal year, di- percent of the amount of the grant.
does not submit a Cybersecurity Plan to the rectly eligible Tribes collectively receive, ‘‘(3) CERTIFICATIONS REGARDING DISTRIBU-
Secretary if— from amounts appropriated under the State TION OF GRANT FUNDS TO LOCAL AND TRIBAL
‘‘(A) the eligible entity certifies to the and Local Cybersecurity Grant Program, not ORGANIZATIONS.—An eligible entity or
Secretary that— less than an amount equal to three percent multistate group shall certify to the Sec-
‘‘(i) the activities that will be supported by of the total amount appropriated for grants retary that the eligible entity or multistate
the grant are integral to the development of under this section. group has made the distribution to local,
VerDate Sep 11 2014 04:35 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00019 Fmt 7634 Sfmt 0634 E:\CR\FM\A20JY7.027 H20JYPT1
H3692 CONGRESSIONAL RECORD — HOUSE July 20, 2021
Tribal, and territorial governments required ‘‘(A) NUMBER AND APPOINTMENT.—The State ‘‘(B) ABSENCE OF PLAN.—Not later than 180
under paragraph (2). and Local Cybersecurity Resilience Com- days after an eligible entity that does not
‘‘(4) EXTENSION OF PERIOD.— mittee established pursuant to paragraph (1) have a Cybersecurity Plan receives funds
‘‘(A) IN GENERAL.—An eligible entity or shall be composed of 15 members appointed under this section for developing its Cyberse-
multistate group may request in writing by the Director, as follows: curity Plan, the eligible entity shall submit
that the Secretary extend the period of time ‘‘(i) Two individuals recommended to the to the Secretary a report describing how the
specified in paragraph (2) for an additional Director by the National Governors Associa- eligible entity obligated and expended grant
period of time. tion. funds during the fiscal year to—
‘‘(B) APPROVAL.—The Secretary may ap- ‘‘(ii) Two individuals recommended to the ‘‘(i) so develop such a Cybersecurity Plan;
prove a request for an extension under sub- Director by the National Association of or
paragraph (A) if the Secretary determines State Chief Information Officers. ‘‘(ii) assist with the activities described in
the extension is necessary to ensure that the ‘‘(iii) One individual recommended to the subsection (h)(3).
obligation and expenditure of grant funds Director by the National Guard Bureau. ‘‘(2) ANNUAL REPORTS TO CONGRESS.—Not
align with the purpose of the State and ‘‘(iv) Two individuals recommended to the less frequently than once per year, the Sec-
Local Cybersecurity Grant Program. Director by the National Association of retary, acting through the Director, shall
‘‘(5) EXCEPTION.—Paragraph (2) shall not Counties. submit to Congress a report on the use of
apply to the District of Columbia, the Com- ‘‘(v) One individual recommended to the grants awarded under this section and any
monwealth of Puerto Rico, American Samoa, Director by the National League of Cities. progress made toward the following:
the Commonwealth of the Northern Mariana ‘‘(vi) One individual recommended to the ‘‘(A) Achieving the objectives set forth in
Islands, Guam, the Virgin Islands, or an In- Director by the United States Conference of the Homeland Security Strategy to Improve
dian tribe. Mayors. the Cybersecurity of State, Local, Tribal,
‘‘(6) DIRECT FUNDING.—If an eligible entity ‘‘(vii) One individual recommended to the and Territorial Governments, upon the date
does not make a distribution to a local or Director by the Multi-State Information on which the strategy is issued under section
Tribal organization required in accordance Sharing and Analysis Center. 2210.
with paragraph (2), the local or Tribal orga- ‘‘(viii) One individual recommended to the ‘‘(B) Developing, implementing, or revising
nization may petition the Secretary to re- Director by the National Congress of Amer- Cybersecurity Plans.
quest that grant funds be provided directly ican Indians. ‘‘(C) Reducing cybersecurity risks and cy-
to the local or Tribal organization. ‘‘(viii) Four individuals who have edu- bersecurity threats to information systems,
‘‘(7) PENALTIES.—In addition to other rem- cational and professional experience relating applications, and user accounts owned or op-
edies available to the Secretary, the Sec- to cybersecurity work or cybersecurity pol- erated by or on behalf of State, local, and
retary may terminate or reduce the amount icy. Tribal organizations as a result of the award
of a grant awarded under this section to an ‘‘(B) TERMS.— of such grants.
eligible entity or distribute grant funds pre- ‘‘(i) IN GENERAL.—Subject to clause (ii), ‘‘(q) AUTHORIZATION OF APPROPRIATIONS.—
viously awarded to such eligible entity di- each member of the State and Local Cyber- There are authorized to be appropriated for
rectly to the appropriate local or Tribal or- security Resilience Committee shall be ap- grants under this section—
ganization as a replacement grant in an pointed for a term of two years. ‘‘(1) for each of fiscal years 2022 through
amount the Secretary determines appro- ‘‘(ii) REQUIREMENT.—At least two members 2026, $500,000,000; and
priate if such eligible entity violates a re- of the State and Local Cybersecurity Resil-
‘‘(2) for each subsequent fiscal year, such
quirement of this subsection. ience Committee shall also be members of
sums as may be necessary.
‘‘(o) ADVISORY COMMITTEE.— the State, Local, Tribal and Territorial Gov-
‘‘(1) ESTABLISHMENT.—Not later than 120 ‘‘SEC. 2220B. CYBERSECURITY RESOURCE GUIDE
ernment Coordinating Council, within the
DEVELOPMENT FOR STATE, LOCAL,
days after the date of enactment of this sec- Critical Infrastructure Partnership Advisory TRIBAL, AND TERRITORIAL GOVERN-
tion, the Director shall establish a State and Council, established under section 871. MENT OFFICIALS.
Local Cybersecurity Resilience Committee ‘‘(iii) EXCEPTION.—A term of a member of ‘‘The Secretary, acting through the Direc-
to provide State, local, and Tribal stake- the State and Local Cybersecurity Resil- tor, shall develop, regularly update, and
holder expertise, situational awareness, and ience Committee shall be three years if the maintain a resource guide for use by State,
recommendations to the Director, as appro- member is appointed initially to the Com- local, Tribal, and territorial government of-
priate, regarding how to— mittee upon the establishment of the Com- ficials, including law enforcement officers,
‘‘(A) address cybersecurity risks and cyber- mittee. to help such officials identify, prepare for,
security threats to information systems of ‘‘(iv) TERM REMAINDERS.—Any member of
detect, protect against, respond to, and re-
State, local, or Tribal organizations; and the State and Local Cybersecurity Resil-
cover from cybersecurity risks (as such term
‘‘(B) improve the ability of State, local, ience Committee appointed to fill a vacancy
and Tribal organizations to prevent, protect is defined in section 2209), cybersecurity
occurring before the expiration of the term
against, respond to, mitigate, and recover threats, and incidents (as such term is de-
for which the member’s predecessor was ap-
from such cybersecurity risks and cybersecu- fined in section 2209).’’.
pointed shall be appointed only for the re-
rity threats. (b) CLERICAL AMENDMENT.—The table of
mainder of such term. A member may serve
contents in section 1(b) of the Homeland Se-
‘‘(2) DUTIES.—The committee established after the expiration of such member’s term
under paragraph (1) shall— curity Act of 2002, as amended by section 4,
until a successor has taken office.
‘‘(A) submit to the Director recommenda- is further amended by inserting after the
‘‘(v) VACANCIES.—A vacancy in the State
tions that may inform guidance for appli- item relating to section 2220 the following
and Local Cybersecurity Resilience Com-
cants for grants under this section; new items:
mittee shall be filled in the manner in which
‘‘(B) upon the request of the Director, pro- the original appointment was made. ‘‘Sec. 2220A. State and Local Cybersecurity
vide to the Director technical assistance to ‘‘(C) PAY.—Members of the State and Local Grant Program.
inform the review of Cybersecurity Plans Cybersecurity Resilience Committee shall ‘‘Sec. 2220B. Cybersecurity resource guide
submitted by applicants for grants under serve without pay. development for State, local,
this section, and, as appropriate, submit to ‘‘(4) CHAIRPERSON; VICE CHAIRPERSON.—The Tribal, and territorial govern-
the Director recommendations to improve members of the State and Local Cybersecu- ment officials.’’.
those plans prior to the approval of the plans rity Resilience Committee shall select a SEC. 3. STRATEGY.
under subsection (i); chairperson and vice chairperson from (a) HOMELAND SECURITY STRATEGY TO IM-
‘‘(C) advise and provide to the Director among members of the committee. PROVE THE CYBERSECURITY OF STATE, LOCAL,
input regarding the Homeland Security ‘‘(5) PERMANENT AUTHORITY.—Notwith- TRIBAL, AND TERRITORIAL GOVERNMENTS.—
Strategy to Improve Cybersecurity for State, standing section 14 of the Federal Advisory Section 2210 of the Homeland Security Act of
Local, Tribal, and Territorial Governments Committee Act (5 U.S.C. App.), the State and 2002 (6 U.S.C. 660) is amended by adding at
required under section 2210; Local Cybersecurity Resilience Committee the end the following new subsection:
‘‘(D) upon the request of the Director, pro- shall be a permanent authority. ‘‘(e) HOMELAND SECURITY STRATEGY TO IM-
vide to the Director recommendations, as ap- ‘‘(p) REPORTS.— PROVE THE CYBERSECURITY OF STATE, LOCAL,
propriate, regarding how to— ‘‘(1) ANNUAL REPORTS BY GRANT RECIPI- TRIBAL, AND TERRITORIAL GOVERNMENTS.—
‘‘(i) address cybersecurity risks and cyber- ENTS.— ‘‘(1) IN GENERAL.—
security threats on information systems of ‘‘(A) IN GENERAL.—Not later than one year ‘‘(A) REQUIREMENT.—Not later than one
State, local, or Tribal organizations; and after an eligible entity or multistate group year after the date of the enactment of this
‘‘(ii) improve the cybersecurity resilience receives funds under this section, the eligible subsection, the Secretary, acting through
ctelli on DSK11ZRN23PROD with HOUSE
of State, local, or Tribal organizations; and entity or multistate group shall submit to the Director, shall, in coordination with the
‘‘(E) regularly coordinate with the State, the Secretary a report on the progress of the heads of appropriate Federal agencies, State,
Local, Tribal and Territorial Government eligible entity or multistate group in imple- local, Tribal, and territorial governments,
Coordinating Council, within the Critical In- menting the Cybersecurity Plan of the eligi- the State and Local Cybersecurity Resil-
frastructure Partnership Advisory Council, ble entity or Cybersecurity Plans of the eli- ience Committee established under section
established under section 871. gible entities that comprise the multistate 2220A, and other stakeholders, as appro-
‘‘(3) MEMBERSHIP.— group, as the case may be. priate, develop and make publicly available
VerDate Sep 11 2014 04:35 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00020 Fmt 7634 Sfmt 0634 E:\CR\FM\A20JY7.027 H20JYPT1
July 20, 2021 CONGRESSIONAL RECORD — HOUSE H3693
a Homeland Security Strategy to Improve and other stakeholders, as appropriate, shall ‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING
the Cybersecurity of State, Local, Tribal, consider— TO .GOV INTERNET DOMAIN.’’;
and Territorial Governments. ‘‘(A) lessons learned from incidents that (B) in the second section 2215 (6 U.S.C. 665b;
‘‘(B) RECOMMENDATIONS AND REQUIRE- have affected State, local, Tribal, and terri- relating to the joint cyber planning office),
MENTS.—The strategy required under sub- torial governments, and exercises with Fed- by amending the section enumerator and
paragraph (A) shall— eral and non-Federal entities; heading to read as follows:
‘‘(i) provide recommendations relating to ‘‘(B) the impact of incidents that have af- ‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’;
the ways in which the Federal Government fected State, local, Tribal, and territorial (C) in the third section 2215 (6 U.S.C. 665c;
should support and promote the ability of governments, including the resulting costs relating to the Cybersecurity State Coordi-
State, local, Tribal, and territorial govern- to such governments; nator), by amending the section enumerator
ments to identify, mitigate against, protect ‘‘(C) the information related to the inter- and heading to read as follows:
against, detect, respond to, and recover from est and ability of state and non-state threat ‘‘SEC. 2217. CYBERSECURITY STATE COORDI-
cybersecurity risks (as such term is defined actors to compromise information systems NATOR.’’;
in section 2209), cybersecurity threats, and (as such term is defined in section 102 of the (D) in the fourth section 2215 (6 U.S.C. 665d;
incidents (as such term is defined in section Cybersecurity Act of 2015 (6 U.S.C. 1501)) relating to Sector Risk Management Agen-
2209); and owned or operated by State, local, Tribal, cies), by amending the section enumerator
‘‘(ii) establish baseline requirements for and territorial governments; and heading to read as follows:
cybersecurity plans under this section and ‘‘(D) emerging cybersecurity risks and cy- ‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGEN-
principles with which such plans shall align. bersecurity threats to State, local, Tribal, CIES.’’;
‘‘(2) CONTENTS.—The strategy required and territorial governments resulting from (E) in section 2216 (6 U.S.C. 665e; relating to
under paragraph (1) shall— the deployment of new technologies; and the Cybersecurity Advisory Committee), by
‘‘(A) identify capability gaps in the ability ‘‘(E) recommendations made by the State amending the section enumerator and head-
of State, local, Tribal, and territorial gov- and Local Cybersecurity Resilience Com- ing to read as follows:
ernments to identify, protect against, detect, mittee established under section 2220A. ‘‘SEC. 2219. CYBERSECURITY ADVISORY COM-
respond to, and recover from cybersecurity ‘‘(4) EXEMPTION.—Chapter 35 of title 44, MITTEE.’’; and
risks, cybersecurity threats, incidents, and United States Code (commonly known as the (F) in section 2217 (6 U.S.C. 665f; relating to
ransomware incidents; ‘Paperwork Reduction Act’), shall not apply Cybersecurity Education and Training Pro-
‘‘(B) identify Federal resources and capa- to any action to implement this sub- grams), by amending the section enumerator
bilities that are available or could be made section.’’. and heading to read as follows:
available to State, local, Tribal, and terri- (b) RESPONSIBILITIES OF THE DIRECTOR OF
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND
torial governments to help those govern- THE CYBERSECURITY AND INFRASTRUCTURE SE- TRAINING PROGRAMS.’’.
ments identify, protect against, detect, re- CURITY AGENCY.—Section 2202 of the Home-
(2) CONSOLIDATED APPROPRIATIONS ACT,
spond to, and recover from cybersecurity land Security Act of 2002 (6 U.S.C. 652) is
2021.—Paragraph (1) of section 904(b) of divi-
risks, cybersecurity threats, incidents, and amended—
sion U of the Consolidated Appropriations
ransomware incidents; (1) by redesignating subsections (d)
Act, 2021 (Public Law 116–260) is amended, in
‘‘(C) identify and assess the limitations of through (i) as subsections (e) through (j), re-
the matter preceding subparagraph (A), by
Federal resources and capabilities available spectively; and
inserting ‘‘of 2002’’ after ‘‘Homeland Security
to State, local, Tribal, and territorial gov- (2) by inserting after subsection (c) the fol-
Act’’.
ernments to help those governments iden- lowing new subsection:
(b) CLERICAL AMENDMENT.—The table of
tify, protect against, detect, respond to, and ‘‘(d) ADDITIONAL RESPONSIBILITIES.—In ad- contents in section 1(b) of the Homeland Se-
recover from cybersecurity risks, cybersecu- dition to the responsibilities under sub- curity Act of 2002 is amended by striking the
rity threats, incidents, and ransomware inci- section (c), the Director shall— items relating to sections 2214 through 2217
dents and make recommendations to address ‘‘(1) develop program guidance, in con- and inserting the following new items:
such limitations; sultation with the State and Local Govern-
ment Cybersecurity Resilience Committee ‘‘Sec. 2214. National Asset Database.
‘‘(D) identify opportunities to improve the ‘‘Sec. 2215. Duties and authorities relating
coordination of the Agency with Federal and established under section 2220A, for the
State and Local Cybersecurity Grant Pro- to .gov internet domain.
non-Federal entities, such as the Multi-State ‘‘Sec. 2216. Joint cyber planning office.
Information Sharing and Analysis Center, to gram under such section or any other home-
land security assistance administered by the ‘‘Sec. 2217. Cybersecurity State Coordinator.
improve— ‘‘Sec. 2218. Sector Risk Management Agen-
‘‘(i) incident exercises, information sharing Department to improve cybersecurity;
cies.
and incident notification procedures; ‘‘(2) review, in consultation with the State
‘‘Sec. 2219. Cybersecurity Advisory Com-
‘‘(ii) the ability for State, local, Tribal, and Local Cybersecurity Resilience Com-
mittee.
and territorial governments to voluntarily mittee, all cybersecurity plans of State,
‘‘Sec. 2220. Cybersecurity Education and
adapt and implement guidance in Federal local, Tribal, and territorial governments de-
Training Programs.’’.
binding operational directives; and veloped pursuant to any homeland security
assistance administered by the Department The SPEAKER pro tempore (Ms.
‘‘(iii) opportunities to leverage Federal
schedules for cybersecurity investments to improve cybersecurity; KAPTUR). Pursuant to the rule, the gen-
under section 502 of title 40, United States ‘‘(3) provide expertise and technical assist- tlewoman from New York (Ms. CLARKE)
Code; ance to State, local, Tribal, and territorial and the gentleman from Mississippi
‘‘(E) recommend new initiatives the Fed- government officials with respect to cyberse- (Mr. GUEST) each will control 20 min-
eral Government should undertake to im- curity; and utes.
prove the ability of State, local, Tribal, and ‘‘(4) provide education, training, and capac- The Chair recognizes the gentle-
territorial governments to identify, protect ity development to enhance the security and
woman from New York.
against, detect, respond to, and recover from resilience of cybersecurity and infrastruc-
ture security.’’. GENERAL LEAVE
cybersecurity risks, cybersecurity threats,
incidents, and ransomware incidents; (c) FEASIBILITY STUDY.—Not later than 270 Ms. CLARKE of New York. Madam
‘‘(F) set short-term and long-term goals days after the date of the enactment of this Speaker, I ask unanimous consent that
that will improve the ability of State, local, Act, the Director of the Cybersecurity and all Members may have 5 legislative
Tribal, and territorial governments to iden- Infrastructure Security of the Department of days in which to revise and extend
tify, protect against, detect, respond to, and Homeland Security shall conduct a study to their remarks and include extraneous
recover from cybersecurity risks, cybersecu- assess the feasibility of implementing a
material on this measure.
rity threats, incidents, and ransomware inci- short-term rotational program for the detail
to the Agency of approved State, local, Trib- The SPEAKER pro tempore. Is there
dents; and
‘‘(G) set dates, including interim bench- al, and territorial government employees in objection to the request of the gentle-
marks, as appropriate for State, local, Trib- cyber workforce positions. woman from New York?
al, and territorial governments to establish SEC. 4. TITLE XXII TECHNICAL AND CLERICAL There was no objection.
baseline capabilities to identify, protect AMENDMENTS. Ms. CLARKE of New York. Madam
against, detect, respond to, and recover from (a) TECHNICAL AMENDMENTS.— Speaker, I yield myself such time as I
cybersecurity risks, cybersecurity threats, (1) HOMELAND SECURITY ACT OF 2002.—Sub- may consume.
incidents, and ransomware incidents. title A of title XXII of the Homeland Secu- Madam Speaker, the recent Colonial
ctelli on DSK11ZRN23PROD with HOUSE
‘‘(3) CONSIDERATIONS.—In developing the rity Act of 2002 (6 U.S.C. 651 et seq.) is Pipeline, JBS, and Kaseya ransomware
strategy required under paragraph (1), the amended—
Director, in coordination with the heads of (A) in the first section 2215 (6 U.S.C. 665; re-
attacks have brought the Nation’s at-
appropriate Federal agencies, State, local, lating to the duties and authorities relating tention to the tremendous national se-
Tribal, and territorial governments, the to .gov internet domain), by amending the curity threat posed by ransomware.
State and Local Cybersecurity Resilience section enumerator and heading to read as The Colonial Pipeline breach alone
Committee established under section 2220A, follows: disrupted the supply of gasoline for a
VerDate Sep 11 2014 04:35 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00021 Fmt 7634 Sfmt 0634 E:\CR\FM\A20JY7.027 H20JYPT1
H3694 CONGRESSIONAL RECORD — HOUSE July 20, 2021
large portion of the Nation and con- State and local digital infrastructure. impact our constituents by taking
tributed to gas shortages across much As Congress considers ways to invest in their personal records from the Texas
of the Southeast. It also spurred con- our Nation’s infrastructure, State and Medical Center, for example, impacting
versations about how much of our Na- local digital infrastructure must be a the medical care of people, interfering
tion’s critical infrastructure is pri- part of that conversation. with various diagnostic machines, and
vately owned and operated. As we have seen in recent months, dealing with the energy infrastructure,
Lost on many Americans is how the gap between the digital world and such as the Colonial Pipeline incident.
much vulnerable critical infrastructure the physical one is smaller than ever. I These are happening in our neighbor-
is actually in the public sector. Today, appreciate the bipartisan recognition hoods.
emergency services, public schools, of that and the strong support this in- The State and Local Cybersecurity
hospitals, and agencies involved in pro- vestment in our infrastructure security Improvement Act will make $500 mil-
viding essential services or regulating received in the Homeland Security lion available in grants from the De-
important industries are all housed in Committee. partment of Homeland Security to
our State and local governments. In re- In particular, I want to thank Chair- State, local, and Tribal entities over
cent years, we have seen communities, man THOMPSON, Ranking Member the next 4 years as they address crit-
big and small, that lacked dedicated KATKO, Ranking Member GARBARINO, ical cybersecurity risks facing infor-
cybersecurity resources fall victim to and Representatives MCCAUL, RUP- mation systems.
ransomware attacks. PERSBERGER, KILMER, and SLOTKIN for I will soon rise to the floor on legisla-
The types of incidents we have seen cosponsoring this legislation. tion that I have authored, and I will
include a ransomware attack on Balti- By passing the State and Local Cy- make this point, Madam Speaker: It is
more that cost city taxpayers $18 mil- bersecurity Improvement Act today, crucial that the other body begins to
lion; a hack on the D.C. police depart- we can demonstrate to the American address the legislation that this House
ment that resulted in leaked sensitive people that Congress can work in a bi- is able to pass because we are passing
personnel files; and a cyberattack partisan way to make a meaningful dif- innovative, corrective, and needed leg-
against a Massachusetts school district ference in addressing our Nation’s cy- islation.
that forced it to cancel its first day of bersecurity risk. Cyber is not a joke, if I can say that.
in-person instruction earlier this year. Madam Speaker, I urge all of my col- Neither are the attacks on our cyber
In May, my subcommittee held a leagues to support this important bill, infrastructure.
hearing on the ransomware crisis However, the Department of Home-
and I reserve the balance of my time.
where experts shared their views on the land Security was created in 2002 to
Mr. GUEST. Madam Speaker, I yield
policy solutions that the Federal Gov- bring together the expertise of several
myself such time as I may consume.
ernment can consider to address this different government entities to pro-
Madam Speaker, I rise today in sup-
challenge. Our witnesses uniformly tect against foreign threats. At that
port of H.R. 3138, the State and Local
urged greater investment in preven- time, the Nation’s main concern was
Cybersecurity Improvement Act of
tion, particularly at the State and protecting our citizens and residents
2021.
local levels. I thank Chairwoman CLARKE, Chair- from another large-scale terrorist at-
We cannot just focus on responding tack, one that we had never seen be-
man THOMPSON, Ranking Member
to cyber incidents. We must help our fore: attacking tall buildings with air-
GARBARINO, and my other committee
communities reduce their vulnerability planes. We had never seen it.
colleagues for their leadership on H.R.
and better mitigate incidents when But, today, 2021, is not 2001. It is not
3138.
they occur. 20 years ago, and the landscape of ter-
In the long term, front-end cyberse- Over the past year, we have seen the
rorism has changed enormously. With
curity investments save money, pro- devastating impact a ransomware at-
rapid advancement in technology and
tect infrastructure, and prevent disrup- tack can have on our Nation’s most
malign foreign cyber aggression in na-
tion to our economy and in our com- critical infrastructure. But we must
tion-states that are not engaged, this
munities. not forget that no one is immune from
bill is important.
That is why I introduced the State cyber criminals, including our State Madam Speaker, I ask my colleagues
and Local Cybersecurity Improvement and local governments. to support this bipartisan legislation,
Act. It authorizes $500 million annually I am pleased today that the House is
H.R. 3138, that will provide us a way to
for grants to State, local, territorial, taking action to give our State and
address this issue.
and Tribal governments to upgrade local partners, and CISA, a leg up Mr. GUEST. Madam Speaker, I urge
their cybersecurity. It requires States against these cyber criminals. Members to support this bill, and I
to pay a graduated cost share to This bill will have a tremendous im- yield back the balance of my time.
incentivize them to budget better for pact on the cybersecurity posture of Ms. CLARKE of New York. Madam
cybersecurity, and it requires them to State and local governments by focus- Speaker, I yield myself the balance of
develop cybersecurity plans so we en- ing important funding and expertise on my time.
sure these funds are well-spent. the front lines, the State and local lev- Madam Speaker, while cybersecurity
My bill also requires DHS to create a els. threats are not new, this year has high-
plan to improve the cybersecurity pos- I urge all Members to join me in sup- lighted the serious impact cyber inci-
ture of State and local governments to porting H.R. 3138, and I reserve the bal- dents can have on our national secu-
ensure that States have goals and ob- ance of my time. rity.
jectives to which they align their own Ms. CLARKE of New York. Madam The United States has as much cy-
cybersecurity plans. Speaker, I yield 2 minutes to the gen- bersecurity expertise as any country.
We have spent considerable resources tlewoman from Texas (Ms. JACKSON But without adequate resources, State
enhancing the security of our Federal LEE). and local governments cannot imple-
networks, and President Biden’s recent Ms. JACKSON LEE. Madam Speaker, ment the policies and practices we
executive order, along with invest- I thank the gentlewoman from New know will make their digital infra-
ments included in the American Rescue York for her leadership on the Sub- structure more secure.
Plan, demonstrate a continued com- committee on Cybersecurity, Infra- Enactment of the State and Local
mitment to strengthening Federal cy- structure Protection, and Innovation. Cybersecurity Improvement Act will
bersecurity. Madam Speaker, I rise to support the ensure that they have the funding,
These actions are incredibly impor- State and Local Cybersecurity Im- planning, and support to adequately in-
tant, but we need to do more to address provement Act. vest in securing government networks
ctelli on DSK11ZRN23PROD with HOUSE
the vulnerabilities at the State and I particularly emphasize the fact and reducing risk.
local levels, where there has been inad- that we are the United States of Amer- Madam Speaker, I urge my col-
equate investment in cybersecurity for ica, but the cyberattacks occur in our leagues to support H.R. 3138, and I yield
years. neighborhoods, our hamlets, our cities, back the balance of my time.
It is essential for the Federal Govern- our counties, and our States. They The SPEAKER pro tempore. The
ment to be a partner in protecting occur right under our noses, and they question is on the motion offered by
VerDate Sep 11 2014 05:06 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00022 Fmt 7634 Sfmt 0634 E:\CR\FM\K20JY7.035 H20JYPT1
July 20, 2021 CONGRESSIONAL RECORD — HOUSE H3695
the gentlewoman from New York (Ms. control system stakeholders to identify, The SPEAKER pro tempore. Is there
CLARKE) that the House suspend the evaluate, assess, and mitigate objection to the request of the gentle-
rules and pass the bill, H.R. 3138, as vulnerabilities; woman from New York?
‘‘(4) collect, coordinate, and provide vul-
amended. There was no objection.
nerability information to the industrial con-
The question was taken. trol systems community by, as appropriate,
Ms. CLARKE of New York. Madam
The SPEAKER pro tempore. In the working closely with security researchers, Speaker, I yield myself such time as I
opinion of the Chair, two-thirds being industry end-users, product manufacturers, may consume.
in the affirmative, the ayes have it. Sector Risk Management Agencies, other Madam Speaker, I rise in support of
Mr. BISHOP of North Carolina. Federal agencies, and other industrial con- H.R. 1833, the DHS Industrial Control
Madam Speaker, on that I demand the trol systems stakeholders; and Systems Capabilities Enhancement
yeas and nays. ‘‘(5) conduct such other efforts and assist- Act.
ance as the Secretary determines appro- This bill seeks to give the Cybersecu-
The SPEAKER pro tempore. Pursu- priate.’’.
ant to section 3(s) of House Resolution (b) REPORT TO CONGRESS.—Not later than
rity and Infrastructure Security Agen-
8, the yeas and nays are ordered. 180 days after the date of the enactment of cy, or CISA, a stronger hand in secur-
Pursuant to clause 8 of rule XX, fur- this Act and every six months thereafter ing industrial control systems and
ther proceedings on this motion are during the subsequent 4-year period, the Di- would help to clarify its central coordi-
postponed. rector of the Cybersecurity and Infrastruc- nation role across the Federal Govern-
ture Security Agency of the Department of ment.
f Homeland Security shall provide to the Com-
DHS INDUSTRIAL CONTROL SYS- mittee on Homeland Security of the House of b 1315
TEMS CAPABILITIES ENHANCE- Representatives and the Committee on The importance of securing indus-
Homeland Security and Governmental Af-
MENT ACT OF 2021 trial control systems cannot be over-
fairs of the Senate a briefing on the indus-
Ms. CLARKE of New York. Madam trial control systems capabilities of the stated. We rely on these systems to
Speaker, I move to suspend the rules Agency under section 2209 of the Homeland provide vital services, like water treat-
and pass the bill (H.R. 1833) to amend Security Act of 2002 (6 U.S.C. 659), as amend- ment, energy distribution, and critical
ed by subsection (a). manufacturing.
the Homeland Security Act of 2002 to (c) GAO REVIEW.—Not later than two years
provide for the responsibility of the Cy- As control systems have grown more
after the date of the enactment of this Act, and more connected to business and IT
bersecurity and Infrastructure Secu- the Comptroller General of the United States
rity Agency to maintain capabilities to shall review implementation of the require- networks that rely on the internet, we
identify threats to industrial control ments of subsections (e)(1)(I) and (p) of sec- have seen systems become more vul-
systems, and for other purposes, as tion 2209 of the Homeland Security Act of nerable to cyberattacks.
2002 (6 U.S.C. 659), as amended by subsection Industrial control systems have been
amended. (a), and submit to the Committee on Home- targeted by groups closely aligned with
The Clerk read the title of the bill. land Security in the House of Representa-
The text of the bill is as follows: nation-states like China and Russia
tives and the Committee on Homeland Secu- who seek to undermine the United
H.R. 1833 rity and Government Affairs of the Senate a
report containing findings and recommenda-
States and advance their own geo-
Be it enacted by the Senate and House of Rep-
tions relating to such implementation. Such political interests.
resentatives of the United States of America in
report shall include information on the fol- We have also seen criminal groups,
Congress assembled,
SECTION 1. SHORT TITLE.
lowing: like the perpetrators of the
This Act may be cited as the ‘‘DHS Indus-
(1) Any interagency coordination chal- ransomware attack on the Colonial
lenges to the ability of the Director of the Pipeline, create great economic disrup-
trial Control Systems Capabilities Enhance-
Cybersecurity and Infrastructure Agency of tion while extorting companies.
ment Act of 2021’’.
the Department of Homeland Security to It doesn’t take a criminal master-
SEC. 2. CAPABILITIES OF THE CYBERSECURITY lead Federal efforts to identify and mitigate
AND INFRASTRUCTURE SECURITY mind to infiltrate an industrial envi-
AGENCY TO IDENTIFY THREATS TO
cybersecurity threats to industrial control
systems pursuant to subsection (p)(1) of such ronment, either. Earlier this year, an
INDUSTRIAL CONTROL SYSTEMS.
section. unsophisticated, unknown perpetrator
(a) IN GENERAL.—Section 2209 of the Home-
(2) The degree to which the Agency has was able to breach a water treatment
land Security Act of 2002 (6 U.S.C. 659) is
amended— adequate capacity, expertise, and resources plant in Oldsmar, Florida, and manipu-
(1) in subsection (e)(1)— to carry out threat hunting and incident re- late chemical levels in ways that could
(A) in subparagraph (G), by striking ‘‘and’’ sponse capabilities to mitigate cybersecurity have poisoned nearby residents.
after the semicolon; threats to industrial control systems pursu- H.R. 1833 will strengthen CISA’s au-
(B) in subparagraph (H), by inserting ant to subsection (p)(2) of such section, as thority as the lead Federal coordinator
‘‘and’’ after the semicolon; and well as additional resources that would be
needed to close any operational gaps in such
for securing industrial control systems
(C) by adding at the end the following new and empower CISA to hunt for threats,
subparagraph: capabilities.
(3) The extent to which industrial control respond to incidents, and to promote
‘‘(I) activities of the Center address the se-
curity of both information technology and system stakeholders sought cybersecurity strong cybersecurity for critical infra-
operational technology, including industrial technical assistance from the Agency pursu- structure.
control systems;’’; and ant to subsection (p)(3) of such section, and The Department of Homeland Secu-
(2) by adding at the end the following new the utility and effectiveness of such tech- rity has been working on control sys-
subsection: nical assistance. tem security since 2004. H.R. 1833 rec-
‘‘(p) INDUSTRIAL CONTROL SYSTEMS.—The (4) The degree to which the Agency works ognizes that role at a pivotal time as
Director shall maintain capabilities to iden- with security researchers and other indus-
trial control systems stakeholders, pursuant
cyber threats to critical infrastructure
tify and address threats and vulnerabilities reach new heights.
to products and technologies intended for to subsection (p)(4) of such section, to pro-
vide vulnerability information to the indus- Importantly, this bill also includes a
use in the automated control of critical in-
trial control systems community. GAO review of whether CISA has the
frastructure processes. In carrying out this
subsection, the Director shall— The SPEAKER pro tempore. Pursu- resources, staffing, and authorities it
‘‘(1) lead Federal Government efforts, in ant to the rule, the gentlewoman from needs to effectively implement these
consultation with Sector Risk Management New York (Ms. CLARKE) and the gen- provisions. Such oversight will be key,
Agencies, as appropriate, to identify and tleman from New York (Mr. KATKO) given that these systems are complex,
mitigate cybersecurity threats to industrial each will control 20 minutes. diverse, and there are a limited number
control systems, including supervisory con- The Chair recognizes the gentle- of skilled cyber experts capable of se-
trol and data acquisition systems; woman from New York. curing them.
‘‘(2) maintain threat hunting and incident GENERAL LEAVE Madam Speaker, I urge my col-
ctelli on DSK11ZRN23PROD with HOUSE
response capabilities to respond to industrial
Ms. CLARKE of New York. Madam leagues to support H.R. 1833, and I re-
control system cybersecurity risks and inci-
dents; Speaker, I ask unanimous consent that serve the balance of my time.
‘‘(3) provide cybersecurity technical assist- all Members may have 5 legislative Mr. KATKO. Madam Speaker, I yield
ance to industry end-users, product manufac- days in which to revise and extend myself such time as I may consume.
turers, Sector Risk Management Agencies, their remarks and include extraneous I want to thank my colleague from
other Federal agencies, and other industrial material on this measure. New York for supporting my bill, H.R.
VerDate Sep 11 2014 05:06 Jul 21, 2021 Jkt 019060 PO 00000 Frm 00023 Fmt 7634 Sfmt 0634 E:\CR\FM\K20JY7.037 H20JYPT1
File and source
- File
- CREC_crec-2021-07-20_crec-2021-07-20-pt1-pgh3689.pdf
- Size
- 315,031 bytes
- SHA-256
- 4e5c8c4a23c603fb3ca7381e1c80a4e64b8242f14776531fe5a3cb3998f5615e
- Original
- www.govinfo.gov