On Tuesday, June 15, the Senate Homeland Security and Governmental Affairs Committee (HSGAC) held a hearing on comprehensive cyber security legislation, S. 3480, The Protecting Cyberspace as a National Asset Act of 2010, which was introduced by Senators Joseph Lieberman, Susan Collins, and Thomas Carper. The bill seeks to modernize the government’s ability to safeguard the nation’s cyber networks from attack and establish a public/private partnership to set national cyber security priorities and improve national cyber security defenses. The HSGAC will mark-up the legislation on Thursday, June 24. Specifically, key provisions of the bill include:
White House Office for Cyberspace Policy: The Act establishes an office in the Executive Office of the President, led by a Senate-confirmed directorto advise the President on all cyber security matters. The director will lead and harmonize federal efforts to secure cyberspace and will develop a national strategy that incorporates all elements of cyberspace policy, including military, law enforcement, and intelligence. The Director will also oversee all related federal cyberspace activities to ensureefficiency and coordination.
National Center for Cyber Security and Communications: The Act also establishes the National Center for Cyber Security and Communications (NCCC) at the Department of Homeland Security (DHS) to elevate and strengthen the Department’s cyber security capabilities and authorities. The NCCC will too be led by a Senate-confirmed Director, who reports to the DHS Secretary. The Director will regularly advise the President regarding the exercise of authorities relating to the security of federal networks. The NCCC will include the United States Computer Emergency Response Team (US-CERT), and will lead federal efforts to protect public and private sector cyber and communications networks. The NCCC will detect, prevent, analyze, and warn of cyber threats to these networks.
Protecting Critical Infrastructure: The NCCC will work with the private sector to establish risk-based security requirements that strengthen cyber security for the nation’s most critical infrastructure, such as components of the electric grid and telecommunications networks. These systems, if disrupted, would result in a national or regional catastrophe.
Promoting Cyber Security: The NCCC will also produce and share useful warning, analysis, and threat information with the private sector, related federal agencies, state and local governments, and international partners. The NCCC will collaborate with the private sector to develop best practices for cyber security. By developing and promoting best practices and providing voluntary technical assistance as resources permit, the NCCC will help improve cyber security across the nation.
Protecting Against Catastrophic Attack: S. 3480 will provide a framework, developed in coordination with the private sector, for the President to authorize emergency measures, limited in both scope and duration, to protect the nation’s most critical infrastructure if a cyber vulnerability is exploited or is about to be exploited.
Protection of Federal Networks: The Act will codify and strengthen DHS authorities to establish complete situational awareness for federal networks and develop tools to improve resilience of federal government systems and networks. The Act also reforms the Federal Information Security Management Act (FISMA) to transition from paper-based to real-time response to threats against government systems.
Procurement Reform: The Act will require development of a comprehensive supply chain risk management strategy to address risks and threats to the information technology products and services the federal government relies upon.
Workforce Reform: The Office of Personal Management will reform the way cyber security personnel are recruited, hired, and trained, to ensure that the federal government has the talent necessary to lead the national cyber security effort and protect its own networks. The Act also provides DHS with temporary hiring and pay flexibilities to assist in the quick establishment of the NCCC.