S 2519 Reported in Senate – NCCIC Act

On the last real day of Senate activity before the current recess the Senate Homeland Security and Government Affairs Committee ordered the publishing of their report on S 2519, the National Cybersecurity and Communications Integration Center Act of 2014. As I reported in my original blog posting on this bill this bill was ordered reported the day after its introduction by HSGAC Chair Carper (D,DE).

There was one amendment made to the bill during the markup hearing (.PDF Download link) on June 25^th; an amendment by Sen. Johnson (R,WI). That amendment {§3(b)} clarifies that the legislation does not provide an new authority for the Secretary of Homeland Security to “promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure”.

Writing and publishing a committee report in just 30 days (for a non-appropriations bill) is pretty quick in the Senate. That combined with insuring that the report was ordered printed before the recess probably indicates that at least Sen. Carper expects this bill to come to the floor of the Senate early after the return of the Senate in September. We will just have to wait and see if Sen. Reid (D,NV) shares that intention.

S 2519 Introduced – Cybersecurity Operations Center

As I noted earlier Sen. Carper (D,DE) introduced S 2519, the National Cybersecurity and Communications Integration Center (NCCIC) Act of 2014. This bill would add a new section {§210G} to the Homeland Security Act of 2002 formally establishing the existing NCCIC.

The mandate included in this bill is very wide and vaguely written. Two of the subparagraphs describing the functions of the NCCIC directly affect the effect the industrial control system community through the functions of the ICS-CERT which is part of the NCCIC:

• Sharing cybersecurity threat, vulnerability, impact, and incident information and analysis by and among Federal, State, and local government entities and private sector entities {§210G(a)(3)}; and

• Upon request, providing timely technical assistance to Federal and non-Federal entities with respect to cybersecurity threats and attribution, vulnerability mitigation, and incident response and remediation {§210G(a)(3)}.

Both of these (actually all of the) activities are clearly identified as discretionary:

The provision of assistance or information to, and inclusion in the operations center of, governmental or private entities under this section shall be at the discretion of the Under Secretary appointed under section 103(a)(1)(H) [Under Secretary for NPPD] {§210G(e)}.

The current organization of the NCCIC can be seen here on the NCCIC web site. An interesting side note; the link to this organizational chart provided on the NCCIC landing page is an editing link which leads to one of those nasty ‘Access Denied’ warnings.

This bill was ordered reported by the Senate Homeland Security and Governmental Affairs Committee on the day of its introduction. If this bill makes it to the floor it will certainly be approved, probably under the unanimous consent process in the Senate and under suspension of the rules in the House. It could also find its way into a spending bill. It all depends on the discretion of the leadership of the respective bodies. 

Bills Introduced – 06-24-14

Mid-way through the legislative week and 27 bills were introduced yesterday. Two of those may be of specific interest to readers of this blog:

S 2519 Latest Title: A bill to codify an existing operations center for cybersecurity. Sponsor: Sen Carper, Thomas R. (D,DE)

S 2521 Latest Title: A bill to amend chapter 35 of title 44, United States Code, to provide for reform to Federal information security. Sponsor: Sen Carper, Thomas R. (D,DE)

It is very likely that there will be no control system security language in either of these bills, but they are being marked-up [.PDF download link] this afternoon in a hearing before the Senate Homeland Security and Governmental Affairs Committee, so I thought they should be mentioned; at least in passing.