For more than a decade, various experts have expressed concerns about information-system security—often referred to more generally as cybersecurity —in the United States and abroad. It involves both securing federal systems and fulfilling the appropriate federal role in protecting nonfederal systems. There is no overarching framework legislation in place, but many enacted statutes address various aspects of cybersecurity. Revisions to many of those laws have been proposed. Several bills propose revisions to current laws, and several have received significant debate, with four bills specifically focusing on cybersecurity being enacted at the end of the 113 th Congress. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for CI, such as the Department of Transportation for the transportation sector. The Obama Administration has also launched several initiatives. Proposed Legislation

In general, legislative proposals on cybersecurity in recent Congresses have focused largely on issues in 10 broad areas:
protection of CI (especially the electricity grid and the chemical industry), information sharing and cross-sector coordination, responsibilities and authority of federal agencies, reform of FISMA, research and development (R&D), the cybersecurity workforce, data breaches resulting in theft or exposure of personal data such as financial information, cybercrime offenses and penalties, national cybersecurity strategy, and international efforts. For most of those topics, at least some of the bills addressing them have proposed changes to current laws. None passed the Senate until the end of the 113 th Congress. Subsequently, several House bills have been considered that would address several of the issues raised and recommendations made by the Task Force Report. 113th Congress

The four bills that had passed the House in the 112 th Congress were all reintroduced and passed, with some amendments, in April 2013:
Cybersecurity Enhancement Act of 2013 ( H.R. 756 ); Cyber Intelligence Sharing and Protection Act ( H.R. 624 ); Advancing America's Networking and Information Technology Research and Development Act of 2013 ( H.R. 967 ); and Federal Information Security Amendments Act of 2013 ( H.R. 113th Congress

Several cybersecurity bills were reported out of committee in 2014:
Cybersecurity Act of 2013 ( S. 1353 ), which would address federal cybersecurity R&D, cybersecurity workforce and education, and public/private partnerships to protect CI; DHS Cybersecurity Workforce Recruitment and Retention Act of 2014 ( S. 2354 ), which would provide DHS with additional cybersecurity workforce authority and require an assessment of workforce needs; National Cybersecurity and Communications Integration Center Act of 2014 ( S. 2519 ), which would establish an information sharing and coordination center in DHS; Federal Information Security Modernization Act of 2014 ( S. 2521 ), which would address FISMA reform; and Cybersecurity Information Sharing Act of 2014 ( S. 2588 ), which would address information sharing and coordination, including sharing of classified information. S. 2519 and S. 2521 also passed the Senate in December. Bills Enacted in the 113th Congress

Four of the cybersecurity bills debated in the 113 th Congress were enacted, as amended, in December 2014:
the CIRDA Act ( H.R. 1163 . The discussion below compares various approaches from proposals in the 112 th and 113 th Congresses that would address the following issues: " Selected Issues Addressed in Proposed Legislation ," " Sharing of Cybersecurity Information " Department of Homeland Security Authorities for Protection of Federal Systems ," " Reform ," " Cybersecurity Workforce ," and " Research and Development ," as well as some " Other Topics "—cybercrime law, data breach notification, and defense-related cybersecurity. The federal role in protection of privately held CI has been one of the most contentious issues in the debate about cybersecurity legislation. The Task Force Report , H.R. They would have required three relevant reports: (1) an annual joint report to Congress by the DHS and Department of Justice privacy officers assessing impacts; (2) a report from the Privacy and Civil Liberties Oversight Board assessing impacts and recommending statutory changes; and (3) a joint report by the Secretary of Homeland Security, the Director of National Intelligence, the Attorney General, and the Secretary of Defense that would have included disclosure of significant noncompliance by nonfederal entities with the requirements of the information-sharing title of the bill, especially with respect to privacy and civil liberties, with recommendations for any statutory changes ( S. 2102 and S. 2105 ) or that identified changes in the information technology environment that challenged the adequacy of the law ( S. 3414 ). Reform of the Federal Information Security Management Act (FISMA)

The " Federal Information Security Management Act of 2002 (FISMA) " was enacted in 2002. 3696 , S. 1691 , S. 2354 ). 113th Congress

In the House, most provisions in H.R. Similar bills passed the House in the 112 th ( H.R. See also " Sharing of Cybersecurity Information Among Private and Government Entities ."
For more than a decade, various experts have expressed increasing concerns about cybersecurity, in light of the growing frequency, impact, and sophistication of attacks on information systems in the United States and abroad. Consensus has also been building that the current legislative framework for cybersecurity might need to be revised.
The complex federal role in cybersecurity involves both securing federal systems and assisting in protecting nonfederal systems. Under current law, all federal agencies have cybersecurity responsibilities relating to their own systems, and many have sector-specific responsibilities for critical infrastructure (CI).
More than 50 statutes address various aspects of cybersecurity either directly or indirectly, but there is no overarching framework legislation in place. Revisions to many of those laws have been proposed over the past several years. Recent legislative proposals, including many bills introduced in recent Congresses, have focused largely on issues in several broad areas, including the following:
"Protection of Privately Held Critical Infrastructure (CI)" "Sharing of Cybersecurity Information Among Private and Government Entities," "Department of Homeland Security Authorities for Protection of Federal Systems," "Reform of the Federal Information Security Management Act (FISMA)," "Cybersecurity Workforce," and "Research and Development."
"Other Topics"—including cybercrime law, data breach notification, and defense-related cybersecurity—have also been addressed in legislative proposals.
At least some of the bills addressing those areas have proposed explicit changes to current laws. However, no bills making such revisions were enacted until the end of the 113th Congress.
In the 112th and 113th Congresses, several bills that specifically focused on cybersecurity received committee or floor action. Comprehensive legislative proposals in the 112th Congress included the Cybersecurity Act of 2012 (S. 3414), recommendations from a House Republican task force, and a proposal by the Obama Administration. S. 3414 was debated in the Senate but failed two cloture votes. In the absence of enactment of cybersecurity legislation in that Congress, the White House issued Executive Order 13636, with provisions on protection of CI, including information sharing and standards development.
In the 113th Congress, several narrower House bills addressed some of the issues raised and recommendations made by the House task force. Four had passed the House in the 112th Congress but were not considered by the Senate. They were reintroduced and passed the House again, with some amendments:
The Cyber Intelligence Sharing and Protection Act (H.R. 624) focuses on information sharing and coordination. The Cybersecurity Enhancement Act of 2013 (H.R. 756) and the Advancing America's Networking and Information Technology Research and Development Act of 2013 (H.R. 967) address federal cybersecurity R&D and technical standards. The Federal Information Security Amendments Act of 2013 (H.R. 1163) addresses FISMA reform.
Also passing the House were three bills that address the role of the Department of Homeland Security (DHS) in cybersecurity: The CIRDA Act of 2013 (H.R. 2952), the Homeland Security Cybersecurity Boots-on-the-Ground Act (H.R. 3107), and the National Cybersecurity and Critical Infrastructure Protection Act of 2013 (H.R. 3696). They include provisions on workforce, R&D, information sharing, and public/private sector collaboration in protecting CI.
Three Senate cybersecurity bills passed in the 113th Congress:
The DHS Cybersecurity Workforce Recruitment and Retention Act of 2014 (S. 2354), bill addressing workforce issues, passed the Senate as an amendment to S. 1691. The National Cybersecurity Protection Act of 2014 (S. 2519) provides authorization for a DHS information-sharing center. The Federal Information Security Modernization Act of 2014 (S. 2521), addresses FISMA reform.
Four of the bills, as amended, were enacted at the end of the 113th Congress: H.R. 2952, S. 1691, S. 2519, and S. 2521. The bills address FISMA reform and DHS workforce issues and information-sharing activities.