The frequency of cybersecurity incidents and their effects on the U.S. economy and national security have elevated congressional interest in cybersecurity issues. This report provides an overview of cybersecurity concepts, the role of selected federal agencies in addressing cybersecurity threats, and a discussion of cybersecurity issues that may be of interest to Congress, including the following: 
protecting critical infrastructure; data breaches and data security; education and training; encryption; information sharing; insurance; international issues; the Internet of Things; oversight of federal agency information technology; and incident response. A fourth term for information security is gaining prominence in discussions on cybersecurity: "authentication," or the ability to confirm that parties using a system and accessing data are who they claim to be and have legitimate access to that data and system. Elements to ensure cybersecurity involve policies spanning a range of fields, including education, workforce management, investment, entrepreneurship, and research and development. Software development, law enforcement, intelligence, incident response, and national defense may be involved in the response when something goes awry in cyberspace. Selected Federal Roles and Responsibilities

		Department of Defense20

The Department of Defense (DOD) is responsible for defending the nation and supporting the Department of Homeland Security's (DHS's) coordination of efforts for cyber defense, for protecting the defense industrial base (DIB), and for securing the DOD information networks (DODIN). Military cyber assets may be deployed in the event of a major cyberattack on U.S. critical infrastructure only when directed to do so. DHS secures federal networks, coordinates critical infrastructure protection efforts, responds to cyber threats, investigates cybercrimes, funds cybersecurity research and development, and promotes cybersecurity education and awareness. In order to accomplish these roles, DHS collects information on cybersecurity threats and shares that information across the federal government and with the private sector so others may be able to better protect themselves. DHS's agencies also carry out other cybersecurity responsibilities. DOJ is responsible for investigating and prosecuting a range of modern-day cyber threats. The FBI pursues cybercrime cases ranging from computer hacking and intellectual property rights violations to child exploitation, fraud, and identity theft. Selected Policy Issues

Below is a list of selected policy issues related to cybersecurity which may be of interest to Congress. One key policy issue for the 115 th Congress may relate to the Framework 's implementation. Victims may opt to respond to incidents with in-house teams, or by retaining cybersecurity firms. 113-66 on December 26, 2013, included a variety of cybersecurity-related provisions. Recent Executive Action

The White House has taken actions independent of Congress to address a variety of cybersecurity issues. Selected Hearings

The House has held over 30 hearings during the first session of the 115 th Congress on cybersecurity issues, and the Senate has held over 25.
Cybersecurity has been gaining attention as a national issue for the past decade. During this time, the country has witnessed cyber incidents affecting both public and private sector systems and data. These incidents have included attacks in which data was stolen, altered, or access to it was disrupted or denied. The frequency of these attacks, and their effects on the U.S. economy, national security, and people's lives have driven cybersecurity issues to the forefront of congressional policy conversations. This report provides an overview of selected cybersecurity concepts and a discussion of cybersecurity issues that are likely to be of interest during the 115th Congress.
From a policymaking standpoint, cybersecurity includes the security of the devices, infrastructure, data, and users that make up cyberspace. The elements of ensuring cybersecurity involve policies spanning a range of fields, including education, workforce management, investment, entrepreneurship, and research and development. Software development, law enforcement, intelligence, incident response, and national defense are involved in the response when something goes awry in cyberspace.
To help secure and respond to incidents in cyberspace federal departments and agencies carry out their authorized responsibilities, run programs, and work with the private sector. While every federal agency has a role in protecting its own data and systems, certain agencies have significant responsibilities with regard to national cybersecurity. The Department of Defense supports domestic efforts on cybersecurity with its capabilities and capacity, and deploys military assets to protect American critical infrastructure from a cyberattack when directed to do so. The Department of Homeland Security secures federal networks, coordinates critical infrastructure protection efforts, responds to cyber threats, investigates cybercrimes, funds cybersecurity research and development, and promotes cybersecurity education and awareness. The Department of Justice investigates and prosecutes a variety of cyber threats, which range from computer hacking and intellectual property rights violations to fraud, child exploitation, and identity theft.
Congress passed five laws related to cybersecurity during the 113th Congress and an additional law during the 114th Congress. Congress also held 119 hearings on cybersecurity-related issues during the 114th Congress. The White House issued presidential actions on cybersecurity related to critical infrastructure cybersecurity, information sharing, and sanctions in retaliation for malicious cyber activities.
Cybersecurity policy has continued to hold congressional interest during the 115th Congress. Recent congressional hearings have examined several cybersecurity issues, including data breaches, critical infrastructure protection, education and training, and the security of federal information technology. Other issues discussed during the 114th Congress continue to hold stakeholder interest, including debates concerning government access to encrypted data.
This report covers a variety of topics related to cybersecurity in order to provide context and a framework for further discussion on selected policy areas. These topics include cybersecurity incidents, major federal agency roles and responsibilities, recent policy actions by Congress and the White House, and descriptions of policy issues that may be of interest in the 115th Congress.