PoliticalRepoPoliticalRepo

United States · Bill · HR

H.R. 3696 (113th)

National Cybersecurity and Critical Infrastructure Protection Act of 2014

referredUnited States· United States Congress· EN

Introduced

11 December 2013

Last action

—

Status

Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.

Sponsors

—

Subjects

Discovery layer

Source updated

7 April 2025

Official sourceDownload fileView documentsShare

Summary

National Cybersecurity and Critical Infrastructure Protection Act of 2013 - Amends the Homeland Security Act of 2002 to require the Secretary of Homeland Security to conduct cybersecurity activities, including the provision of shared situational awareness among federal entities to enable real-time, integrated, and operational actions to protect from, prevent, mitigate, respond to, and recover from cyber incidents. Defines “cyber incident” as an incident resulting in, or an attempt to cause an incident that, if successful, would: (1) jeopardize the security, integrity, confidentiality, or availability of an information system or network or any information stored on, processed on, or transiting such a system; (2) violate laws or procedures relating to system security, acceptable use policies, or acts of terrorism against an information system or network; or (3) deny access to or degrade, disrupt, or destruct an information system or network or defeat an operations or technical control of such a system or network. Directs the Secretary to coordinate with federal, state, and local governments, critical infrastructure owners and operators, and other cross-sector coordinating entities to: (1) facilitate a national effort to strengthen and maintain critical infrastructure from cyber threats; (2) ensure that Department of Homeland Security (DHS) policies and procedures enable critical infrastructure owners and operators to receive appropriate and timely cyber threat information; (3) seek industry sector-specific expertise to develop voluntary security and resiliency strategies and to ensure that the allocation of federal resources is cost effective and reduces burdens on critical infrastructure owners and operators; (4) upon request, provide risk management assistance to entities and education to critical infrastructure owners and operators; and (5) coordinate a research and development strategy for cybersecurity technologies. Directs the Secretary: (1) to manage federal efforts to secure federal civilian information systems (excluding national security, Department of Defense [DOD], military, and intelligence community systems) and, upon request, to support the efforts of critical infrastructure owners and operators to protect against cyber threats; (2) to direct a DHS entity to serve as a federal civilian entity by and among federal, state, and local governments, private entities, and critical infrastructure sectors to share cyber threat information; (3) to promote national awareness and educate the public regarding information system security; (4) upon request, to facilitate cyber incident response and recovery assistance and provide analysis and warnings related to threats to, and vulnerabilities of, critical information systems, crisis and consequence management support, and other remote or on-site technical assistance to federal, state, and local government entities and private entities for cyber incidents affecting critical infrastructure; and (5) engage with international partners. Requires the Secretary to: (1) designate critical infrastructure sectors; and (2) recognize, for each sector, a Sector Coordinating Council (SCC) and at least one Information Sharing and Analysis Center (ISAC). Permits to be included as critical infrastructure sectors: chemical; commercial facilities; communications; critical manufacturing; dams; Defense Industrial Base; emergency services; energy; financial services; food and agriculture; government facilities; healthcare and public health; information technology; nuclear reactors, materials, and waste; transportation systems; and water and wastewater systems. Requires SCCs to: (1) be comprised of small, medium, and large critical infrastructure owners and operators, private entities, and representative trade associations; and (2) serve as a self-governing, self-organized, primary policy, planning, and strategic communications entity for coordinating with DHS, sector-specific agencies, and ISACs on security and resilience activities and emergency response and recovery efforts. Allows the Secretary to enter contracts with private entities that provide electronic communication, remote computing, or cybersecurity services. Prohibits causes of action against private entities that provide such assistance to the Secretary. Establishes the National Cybersecurity and Communications Integration Center as a federal civilian information sharing interface to: (1) provide shared situational awareness to enable real-time, integrated, and operational actions across the federal government; and (2) share cyber threat information among federal, state, and local government entities, ISACs, private entities, and critical infrastructure owners and operators that have information sharing relationships. Requires the Secretary to establish Cyber Incident Response Teams to provide technical assistance and recommendations to federal, state, and local government entities, private entities, and critical infrastructure owners and operators. Directs the Secretary, in coordination with SCCs, ISACs, and federal, state, and local governments, to develop, regularly update, and exercise a National Cybersecurity Incident Response Plan. Requires the Secretary to develop a comprehensive workforce strategy to enhance the readiness, capacity, training, recruitment, and retention of DHS cybersecurity personnel, including a 5-year recruitment plan and 10-year projections of workforce needs. Redesignates the National Protection and Programs Directorate as the Cybersecurity and Infrastructure Protection Directorate. Directs the National Institute of Standards and Technology (NIST) to facilitate and support the development of a voluntary, industry-led set of standards and processes to reduce cyber risks to critical infrastructure. Prohibits NIST from requiring the use of specific solutions, products, services, or manufacturing or design techniques. Requires the Secretary to: (1) meet biannually with each SCC, and (2) submit annual reports to Congress on the state of cybersecurity in each sector. Expands liability protections for technology providers under the Support Anti-terrorism by Fostering Effective Technologies Act of 2002 to include designated cybersecurity technologies deployed in defense of qualifying cyber incidents, which include: (1) unlawful or unauthorized access incidents; (2) disruption of the integrity, operation, confidentiality, or availability of programmable electronic devices or communication networks; (3) misappropriation, corruption, or disruption of data, assets, information, or intellectual property; and (4) harm inside or outside the United States that results in damages, disruptions, or casualties severely affecting the U.S. population, infrastructure, economy, national morale, or federal, state, local, or tribal government functions. Prohibits this Act from being construed to: (1) create or authorize any new regulations or additional federal government regulatory authority, or (2) authorize the appropriation of any additional funds.

This text is taken from the official record. PoliticalRepo does not editorialize.

Timeline

No timeline events have been ingested for this record yet.

Votes

No vote records are attached yet.

Versions

No version snapshots stored. Document URLs remain at the source.

Documents

11 official files

Referred in Senate (text)

View fileDownload file

Sponsors

No sponsors or actors listed by the source.

Related records

No cross-record relationships stored yet.

Sources

PoliticalRepo is an index and interpretation layer, not the authoritative legal source.