Last week, Sen Peters (D,MI) introduced S 2520, the State and Local Government Cybersecurity Act of 2021. The bill would add additional responsibilities for CISA with regards to State and local governments. It would also provide additional coordination responsibilities for CISA’s National Cybersecurity and Communications Integration Center (NCCIC). No additional funding is authorized to support these additional responsibilities.
Definitions
Section 2(1) adds a definition for the term ‘entity’ to 6 USC 651. This is the lead section of the subtitle of 6 USC that deals with the establishment of CISA.
Amendments to 6 USC 652
Section 2(2) of the bill makes three amendments to 6 USC 652. First, it corrects a paragraph numbering problem in §652(c), that currently contains three sub-paragraph (11)s. Then it adds a paragraph (14) to that subsection referring to a new §652(e)(1)(S) that is being added as the third revision.
That new subparagraph (S) adds a new CISA responsibility:
“(S) To make grants to and enter into cooperative agreements or contracts with States, local, Tribal, and territorial governments, and other non-Federal entities as the Secretary determines necessary to carry out the responsibilities of the Secretary related to cybersecurity and infrastructure security under this Act and any other provision of law, including grants, cooperative agreements, and contracts that provide assistance and education related to cyber threat indicators, defensive measures and cybersecurity technologies, cybersecurity risks, incidents, analysis, and warnings.”
Amendments to 6 USC 659
Section 2(3) of the bill amends 6 USC 659. First it makes two relatively small wording changes that expands the functions of NCCIC. First it adds the words “operational and” before “timely” in §659(c)(6); making the first phrase of that subparagraph read: “(6) upon request, providing operational and timely technical assistance, risk management support,”. The second adds the words “, including an entity that collaborates with election officials,” after “governments” in §659(d)(1)(E; making the first phrase in that subparagraph read: “(E) an entity that collaborates with State and local governments, including an entity that collaborates with election officials, on cybersecurity risks and incidents,”.
Finally, the subsection includes adding two new subsections
The new subsection (p) adds a list of ten new coordination related responsibilities for NCCIC. The second subsection establishes a new biannual reporting to Congress requirement.
Moving Forward
As I mentioned yesterday, this bill will be taken up tomorrow by the Senate Homeland Security and Governmental Affairs Committee in a markup hearing. It is hard to predict whether amendments will be considered, but I do expect to see bipartisan support for the bill. I do not, however, see this bill making its way to the floor of the Senate for consideration. There is not enough legislative meat here for the bill to take up the time to be considered under regular order. There is, however, still time to see this bill added as an amendment to HR 3684 before the final vote later this week.
Commentary
None of the changes made by this bill are earthshattering cybersecurity movements. This bill is the necessary plodding job of the legislature to update agency requirements to adjust to changing conditions. Unfortunately, most of the cybersecurity terms used in the new language still rely on the IT restrictive definition of ‘information system’ found in §659(a). This bill would be a good place to implement the changes to §659(a) that I suggested last year. At the very least, we should see the addition of the term ‘control system’ and revision of the definition of cybersecurity risk as outlined below.
(1) the term ‘control system’ means a discrete set of information resources, sensors, communications interfaces and physical devices organized to monitor, control and/or report on physical processes, including manufacturing, transportation, access control, and facility environmental controls.
(2) the term "cybersecurity risk"-
(A) means threats to and vulnerabilities of information, information systems, or control systems and any related consequences caused by or resulting from unauthorized access, use, disclosure, degradation, disruption, modification, or destruction of such information, information systems, or control systems, including such related consequences caused by an act of terrorism; and
(B) does not include any action that solely involves a violation of a consumer term of service or a consumer