§ 660. Cybersecurity plans

Legislative history

Reconstructed from this section’s Code source credit and amendment notes, resolved against the local Statutes at Large. Editorial notes are evidence, not the law that made the change.

1. 2015

   Homeland Security Act of 2002

   Pub. L. 107–296 title XXII § 2210 · 116 Stat. 2135

   Enacted · 6 U.S.C. § 660

   Pub. L. 107–296, title XXII, § 2210, formerly title II, § 228, as added and amended Pub. L. 114–113, div. N, title II, §§ 205, 223(a)(2), (4), (5), Dec. 18, 2015, 129 Stat. 2961, 2963, 2964

   Source evidence

   Code source credit
   Pub. L. 107–296, title XXII, § 2210, formerly title II, § 228, as added and amended Pub. L. 114–113, div. N, title II, §§ 205, 223(a)(2), (4), (5), Dec. 18, 2015, 129 Stat. 2961, 2963, 2964

2. 2015

   Department of Health and Human Services Appropriations Act, 2016

   Pub. L. 114–113 § 223(a)(5) · 129 Stat. 2242

   Changed · 6 U.S.C. § 660(c)

   Pub. L. 114–113, § 223(a)(5), made technical amendment to reference in original act which appears in text as reference to section 148 of this title

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 114–113, § 223(a)(5), made technical amendment to reference in original act which appears in text as reference to section 148 of this title.

   Enacted provision · exact public law section
   Sec. 223. The Secretary shall publish, as part of the fiscal year 2017 budget of the President submitted under section 1105(a) of title 31, United States Code, information that details the uses of all funds used by the Centers for Medicare and Medicaid Services specifically for Health Insurance Exchanges for each fiscal year since the enactment of the ACA and the proposed uses for such funds for fiscal year 2017. Such information shall include, for each such fiscal year, the amount of funds used for each activity specified under the heading “Health Insurance Exchange Transparency” in the explanatory statement described in section 4 (in the matter preceding division A of this consolidated Act).

3. 2015

   Department of Health and Human Services Appropriations Act, 2016

   Pub. L. 114–113 § 223(a)(2) · 129 Stat. 2242

   Changed · 6 U.S.C. § 660(c)

   Pub. L. 114–113, § 223(a)(2), transferred former section 149 of this title to subsec. (c) of this section. See Codification note above

   Target inherited from the preceding amendment note.

   Source evidence

   Code amendment note
   Pub. L. 114–113, § 223(a)(2), transferred former section 149 of this title to subsec. (c) of this section. See Codification note above.

   Enacted provision · exact public law section
   Sec. 223. The Secretary shall publish, as part of the fiscal year 2017 budget of the President submitted under section 1105(a) of title 31, United States Code, information that details the uses of all funds used by the Centers for Medicare and Medicaid Services specifically for Health Insurance Exchanges for each fiscal year since the enactment of the ACA and the proposed uses for such funds for fiscal year 2017. Such information shall include, for each such fiscal year, the amount of funds used for each activity specified under the heading “Health Insurance Exchange Transparency” in the explanatory statement described in section 4 (in the matter preceding division A of this consolidated Act).

4. 2015

   Department of Justice Appropriations Act, 2016

   Pub. L. 114–113 § 205 · 129 Stat. 2242

   Added · 6 U.S.C. § 660(d)

   Pub. L. 114–113, § 205, added subsec. (d)

   Source evidence

   Code amendment note
   Subsec. (d). Pub. L. 114–113, § 205, added subsec. (d).

   Enacted provision · exact public law section
   Sec. 205. Not to exceed 5 percent of any appropriation made available for the current fiscal year for the Department of Justice in this Act may be transferred between such appropriations, but no such appropriation, except as otherwise specifically provided, shall be increased by more than 10 percent by any such transfers: Provided, That any transfer pursuant to this section shall be treated as a reprogramming of funds under section 505 of this Act and shall not be available for obligation except in compliance with the procedures set forth in that section.

5. 2018

   Cybersecurity and Infrastructure Security Agency Act of 2018

   Pub. L. 115–278 § 2(g)(9)(A)(iv)(I) · 132 Stat. 4168

   Substituted · 6 U.S.C. § 660(a)(2)

   Pub. L. 115–278, § 2(g)(9)(A)(iv)(I), substituted “section 659 of this title” for “section 148 of this title”

   Source evidence

   Code amendment note
   Subsec. (a)(2). Pub. L. 115–278, § 2(g)(9)(A)(iv)(I), substituted “section 659 of this title” for “section 148 of this title”.

   Enacted provision · exact public law section
   (I) by striking “section 227” each place that term appears and inserting “section 2209”; and

6. 2018

   Cybersecurity and Infrastructure Security Agency Act of 2018

   Pub. L. 115–278 § 2(g)(9)(A)(iv) · 132 Stat. 4168

   1. Substituted · 6 U.S.C. § 660(c)

      Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted “Director of Cybersecurity and Infrastructure Security” for “Under Secretary appointed under section 113(a)(1)(H) of this title”

   2. Substituted · 6 U.S.C. § 660(c)

      Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted “section 671(5) of this title” for “section 131(5) of this title”

   3. Substituted · 6 U.S.C. § 660(c)

      Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted “section 659 of this title” for “section 148 of this title”

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 115–278, § 2(g)(9)(A)(iv), substituted “Director of Cybersecurity and Infrastructure Security” for “Under Secretary appointed under section 113(a)(1)(H) of this title”, “section 671(5) of this title” for “section 131(5) of this title”, and “section 659 of this title” for “section 148 of this title”.

   Enacted provision · exact public law section
   (iv) in section 2210, as so redesignated— (I) by striking “section 227” each place that term appears and inserting “section 2209”; and (II) in subsection (c)— (aa) by striking “Under Secretary appointed under section 103(a)(1)(H)” and inserting “Director of Cybersecurity and Infrastructure Security”; and (bb) by striking “section 212(5)” and inserting “section 2222(5)”;

7. 2021

   National Defense Authorization Act for Fiscal Year 2022

   Pub. L. 117–81 § 1546 · 135 Stat. 1541

   1. Substituted · 6 U.S.C. § 660(c)

      Pub. L. 117–81, § 1546, substituted “update not less often than biennially” for “regularly update”

   2. Inserted · 6 U.S.C. § 660(c)

      Pub. L. 117–81, § 1546, inserted “The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.” at end

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 117–81, § 1546, substituted “update not less often than biennially” for “regularly update” and inserted “The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.” at end.

   Enacted provision · exact public law section
   SEC. 1546. CYBER INCIDENT RESPONSE PLAN.   Subsection (c) of section 2210 of the Homeland Security Act of 2002 (6 U.S.C. 660) is amended— (1) by striking “regularly update” and inserting “update not less often than biennially”; and (2) by adding at the end the following new sentence: “The Director, in consultation with relevant Sector Risk Management Agencies and the National Cyber Director, shall develop mechanisms to engage with stakeholders to educate such stakeholders regarding Federal Government cybersecurity roles and responsibilities for cyber incident response.”.

8. 2021

   National Defense Authorization Act for Fiscal Year 2022

   Pub. L. 117–81 § 1545 · 135 Stat. 1541

   Added · 6 U.S.C. § 660(e)

   Pub. L. 117–81, § 1545, added subsec. (e)

   Source evidence

   Code amendment note
   Subsec. (e). Pub. L. 117–81, § 1545, added subsec. (e).

   Enacted provision · exact public law section
   SEC. 1545. STRATEGY.   Section 2210 of the Homeland Security Act of 2002 (6 U.S.C. 660) is amended by adding at the end the following new subsection: “(e) Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments.— “(1) In general.— “(A) Requirement.— Not later than one year after the date of the enactment of this subsection, the Secretary, acting through the Director, shall, in coordination with the heads of appropriate Federal agencies, State, local, Tribal, and territorial governments, and other stakeholders, as appropriate, develop and make publicly available a Homeland Security Strategy to Improve the Cybersecurity of State, Local, Tribal, and Territorial Governments. “(B) Recommendations and requirements.— The strategy required under subparagraph (A) shall provide recommendations relating to the ways in which the Federal Government should support and promote the ability of State, local, Tribal, and territorial governments to identify, mitigate against, protect against, detect, respond to, and recover from cybersecurity risks (as such term is defined in section 2209), cybersecurity threats, and incidents (as such term is defined in section 2209). “(2) Contents.— The strategy required under paragraph (1) shall— “(A) identify capability gaps in the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; “(B) identify Federal resources and capabilities that are available or could be made available to State, local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; “(C) identify and assess the limitations of Federal resources and capabilities available to State, local, Tribal, and territorial governments to help those governments identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents and make recommendations to address such limitations; “(D) identify opportunities to improve the coordination of the Agency with Federal and non-Federal entities, such as the Multi-State Information Sharing and Analysis Center, to improve— “(i) incident exercises, information sharing and incident notification procedures; “(ii) the ability for State, local, Tribal, and territorial governments to voluntarily adapt and implement guidance in Federal binding operational directives; and “(iii) opportunities to leverage Federal schedules for cybersecurity investments under section 502 of title 40, United States Code; “(E) recommend new initiatives the Federal Government should undertake to improve the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; “(F) set short-term and long-term goals that will improve the ability of State, local, Tribal, and territorial governments to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents; and “(G) set dates, including interim benchmarks, as appropriate for State, local, Tribal, and territorial governments to establish baseline capabilities to identify, protect against, detect, respond to, and recover from cybersecurity risks, cybersecurity threats, incidents, and ransomware incidents. “(3) Considerations.— In developing the strategy required under paragraph (1), the Director, in coordination with the heads of appropriate Federal agencies, State, local, Tribal, and territorial governments, and other stakeholders, as appropriate, shall consider— “(A) lessons learned from incidents that have affected State, local, Tribal, and territorial governments, and exercises with Federal and non-Federal entities; “(B) the impact of incidents that have affected State, local, Tribal, and territorial governments, including the resulting costs to such governments; “(C) the information related to the interest and ability of state and non-state threat actors to compromise information systems (as such term is defined in section 102 of the Cybersecurity Act of 2015 (6 U.S.C. 1501)) owned or operated by State, local, Tribal, and territorial governments; and “(D) emerging cybersecurity risks and cybersecurity threats to State, local, Tribal, and territorial governments resulting from the deployment of new technologies. “(4) Exemption.— Chapter 35 of title 44, United States Code (commonly known as the ‘Paperwork Reduction Act’), shall not apply to any action to implement this subsection.” .

9. 2022

   James M. Inhofe National Defense Authorization Act for Fiscal Year 2023

   Pub. L. 117–263 § 7143(b)(2)(E)(i) · 136 Stat. 2395

   1. Substituted · 6 U.S.C. § 660(a)

      Pub. L. 117–263, § 7143(b)(2)(E)(i), substituted “section, the term ‘agency information system’ means an information system used or operated by an agency or by another entity on behalf of an agency.” for “section—”

   2. Struck · 6 U.S.C. § 660(a)

      Pub. L. 117–263, § 7143(b)(2)(E)(i), struck out pars. (1) to (4) which defined agency information system, cybersecurity risk, information system, intelligence community, and national security system

   Source evidence

   Code amendment note
   Subsec. (a). Pub. L. 117–263, § 7143(b)(2)(E)(i), substituted “section, the term ‘agency information system’ means an information system used or operated by an agency or by another entity on behalf of an agency.” for “section—” and struck out pars. (1) to (4) which defined agency information system, cybersecurity risk, information system, intelligence community, and national security system.

   Enacted provision · exact public law section
   (i) in subsection (a), by striking “section—” and all that follows and inserting “section, the term ‘agency information system’ means an information system used or operated by an agency or by another entity on behalf of an agency.”;

10. 2022

    James M. Inhofe National Defense Authorization Act for Fiscal Year 2023

    Pub. L. 117–263 § 7143(c)(8) · 136 Stat. 2395

    Substituted · 6 U.S.C. § 660(c)

    Pub. L. 117–263, § 7143(c)(8), substituted “Director of the Cybersecurity and Infrastructure Security Agency” for “Director of Cybersecurity and Infrastructure Security”

    Source evidence

    Code amendment note
    Subsec. (c). Pub. L. 117–263, § 7143(c)(8), substituted “Director of the Cybersecurity and Infrastructure Security Agency” for “Director of Cybersecurity and Infrastructure Security”.

    Enacted provision · exact public law section
    (8) in section 2210(c), by striking “Director of Cybersecurity and Infrastructure Security” and inserting “Director of the Cybersecurity and Infrastructure Security Agency”.

11. 2022

    James M. Inhofe National Defense Authorization Act for Fiscal Year 2023

    Pub. L. 117–263 § 7143(b)(2)(E)(ii) · 136 Stat. 2395

    1. Substituted · 6 U.S.C. § 660(c)

       Pub. L. 117–263, § 7143(b)(2)(E)(ii), substituted “Information Sharing and Analysis Organizations” for “information sharing and analysis organizations (as defined in section 671(5) of this title)”

    2. Struck · 6 U.S.C. § 660(c)

       Pub. L. 117–263, § 7143(b)(2)(E)(ii), struck out “(as defined in section 659 of this title)” after “cybersecurity risks”

    Target inherited from the preceding amendment note.

    Source evidence

    Code amendment note
    Pub. L. 117–263, § 7143(b)(2)(E)(ii), substituted “Information Sharing and Analysis Organizations” for “information sharing and analysis organizations (as defined in section 671(5) of this title)” and struck out “(as defined in section 659 of this title)” after “cybersecurity risks”.

    Enacted provision · exact public law section
    (ii) in subsection (c)— (I) by striking “information sharing and analysis organizations (as defined in section 2222(5))” and inserting “Information Sharing and Analysis Organizations”; and (II) by striking “(as defined in section 2209)”; and

12. 2022

    James M. Inhofe National Defense Authorization Act for Fiscal Year 2023

    Pub. L. 117–263 § 7143(b)(2)(E)(iii)(I) · 136 Stat. 2395

    Struck · 6 U.S.C. § 660(e)(1)(B)

    Pub. L. 117–263, § 7143(b)(2)(E)(iii)(I), which directed striking out “(as such term is defined in section 659 of this title)”, was executed by striking out “(as such term is defined in section 659 of this title)” after “cybersecurity risks” and after “incidents”, to reflect the probable intent of Congress

    Source evidence

    Code amendment note
    Subsec. (e)(1)(B). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(I), which directed striking out “(as such term is defined in section 659 of this title)”, was executed by striking out “(as such term is defined in section 659 of this title)” after “cybersecurity risks” and after “incidents”, to reflect the probable intent of Congress.

    Enacted provision · exact public law section
    (I) in paragraph (1)(B), by striking “(as such term is defined in section 2209)”; and

13. 2022

    James M. Inhofe National Defense Authorization Act for Fiscal Year 2023

    Pub. L. 117–263 § 7143(b)(2)(E)(iii)(II) · 136 Stat. 2395

    Struck · 6 U.S.C. § 660(e)(3)(C)

    Pub. L. 117–263, § 7143(b)(2)(E)(iii)(II), struck out “(as such term is defined in section 1501 of this title)” after “information systems”

    Source evidence

    Code amendment note
    Subsec. (e)(3)(C). Pub. L. 117–263, § 7143(b)(2)(E)(iii)(II), struck out “(as such term is defined in section 1501 of this title)” after “information systems”.

    Enacted provision · exact public law section
    (II) in paragraph (3)(C), by striking “(as such term is defined in section 102 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501))”;

17 of 18 references resolved to an enrolled provision · 1 partial