Review - HR 3684 Passed in House – FY 2022 Infrastructure Bill

Last Friday the House finally got around to passing HR 3684, the Infrastructure Investment and Jobs Act, by a slightly bipartisan vote of 228 to 206. With the complexity of the bill and the large amounts of money involved, this is a good time to re-look at the cybersecurity provisions in the bill.

The bill includes language from six separate pieces of cybersecurity legislation.

S 914, the Drinking Water and Wastewater Infrastructure Act of 2021, in §50113,

S 1316, the Cyber Response and Recovery Act of 2021, in §70601,

S 1400, the PROTECT Act of 2021, in §40123,

S 2199, the Cyber Sense Act of 2020, in §40122,

S 2585, the State and Local Cybersecurity Improvement Act, in §70611, and

HR 2931, the Enhancing Grid Security through Public-Private Partnerships Act, in §40121.

It also contains two new standalone cybersecurity provisions in the Energy Division of the bill. Additional (over the current annual spending) cybersecurity spending is authorized for four agencies of the federal government. Finally, there are 23 separate instances where cybersecurity mentions are made in other provisions of the bill

For more details about those provisions, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-3684-passed-in-house - subscription required.

 

Review - S 2585 Introduced - State and Local Cybersecurity Improvement

Last month, Sen Hassan (D,NH) introduced S 2585, the State and Local Cybersecurity Improvement Act. The bill is similar to HR 3138 that was passed in the House in July in that it would require State and local government entities to formulate a cybersecurity plan to support their funding requests through a grant program established by the bill. It does not include any of the other provisions in the House bill amending the Homeland Security Act of 2002. Monies are appropriated to support the grant program at lower rates than in the House bill.

Hassan is the chair of the Emerging Threats and Spending Oversight Subcommittee of the Senate Homeland Security and Governmental Affairs Committee, the Committee to which this bill was assigned for consideration. That would be sufficient influence to see this bill considered in Committee. If considered, the bill would probably receive bipartisan support.

The Senate included a version of this bill (Division G, Title VI, Subtitle B) in the Infrastructure Investment and Jobs Act (HR 3684) passed last month. The House is scheduled to take up that bill on or before September 27^th. If the House passes that bill, further action on S 2585 will obviously be unnecessary. If it fails in the House, I suspect that the Committee would take up and pass this bill. The Senate could then take up HR 3138 either as is or substitute the language from this bill (the usual procedure).

For more details about the differences between this bill and HR 3138, including the differences in the authorized funding for the grant program, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-2585-introduced - subscription required.

Bills Introduced – 8-3-21

Yesterday, with the Senate in Washington and the House meeting in pro forma session, there were 50 bills introduced. Two of those bills may receive additional coverage in this blog:

HR 4910 To provide grants to assist States in developing and implementing plans to address cybersecurity threats or vulnerabilities, and for other purposes. Rep. Kilmer, Derek [D-WA-6]

S 2585 A bill to amend the Homeland Security Act of 2002 to authorize a grant program relating to the cybersecurity of State, local, Tribal, and territorial governments, and for other purposes. Sen. Hassan, Maggie [D-NH]

I will be watching both bills for language and definition that would include industrial control systems within their coverage.