6 U.S.C. § 651: Definition

In this part, the term “Cybersecurity Advisory Committee” means the advisory committee established under section 665e(a) of this title . conferring new authorities to the Secretary of Homeland Security, including programmatic, regulatory, or enforcement authorities, outside of the authorities in existence on the day before the date of enactment of this Act [ Nov. 16, 2018 ]; reducing or limiting the programmatic, regulatory, or enforcement authority vested in any other Federal agency by statute; or affecting in any manner the authority, existing on the day before the date of enactment of this Act, of any other Federal agency or component of the Department of Homeland Security.” Not later than December 31, 2023 , the Secretary of Homeland Security, in coordination with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall conduct an exercise, which may be a tabletop exercise, to test the resilience, response, and recovery of the United States to a significant cyber incident impacting critical infrastructure. The Secretary shall convene similar exercises not fewer than three times, in consultation with such officials, until 2033. the Department of Homeland Security; the Department of Defense; and the Department of Justice; and appropriate elements of the intelligence community, identified by the Director of National Intelligence. For each fiscal year in which an exercise is planned, the Secretary, in coordination with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall submit to the appropriate congressional committees a plan for the exercise not later than 180 days prior to the exercise. Each such plan shall include information regarding the goals of the exercise at issue, how the exercise is to be carried out, where and when the exercise will take place, how many individuals are expected to participate from each Federal agency specified in subsection (b), and the costs or other resources associated with the exercise. The Department of Homeland Security. The Department of Defense, as identified by the Secretary of Defense. Elements of the intelligence community, as identified by the Director of National Intelligence. The Department of Justice, as identified by the Attorney General. Sector-specific agencies, as determined by the Secretary of Homeland Security. The Secretary shall invite representatives from State, local, and Tribal governments to participate in each exercise required under subsection (a) if the Secretary determines such is appropriate. Representatives from appropriate private entities. Other individuals whom the Secretary determines will best assist the United States in preparing for, and defending against, a significant cyber incident impacting critical infrastructure. Depending on the nature of an exercise being conducted under subsection (a), the Secretary may, in coordination with the Secretary of State, invite allies and partners of the United States to participate in such exercise. The Secretary may invite representatives from the executive and legislative branches of the Federal Government to observe an exercise required under subsection (a). operational responses through interagency coordination processes and response groups; and each Federal agency participating in such exercise in accordance with subsection (d)(1). Testing of the information sharing needs and capabilities of exercise participants. Testing of the relevant policy, guidance, and doctrine, including the National Cyber Incident Response Plan of the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security. Testing of the integration and interoperability between the entities participating in the exercise in accordance with subsection (d). Exercising the integration and interoperability of the cybersecurity operation centers of the Federal Government, as appropriate, in coordination with appropriate cabinet level officials. Not later than 180 days after the date on which each exercise required under subsection (a) is conducted, the Secretary shall provide to the appropriate congressional committees a briefing on the exercise. an assessment of the decision and response gaps observed in the exercise at issue; proposed recommendations to improve the resilience, response, and recovery of the United States to a significant cyber attack against critical infrastructure; and appropriate plans to address the recommendations proposed under subparagraph (B). the Committee on Armed Services of the Senate; the Committee on Armed Services of the House of Representatives; the Committee on Homeland Security and Governmental Affairs of the Senate; the Committee on Homeland Security of the House of Representatives; the Select Committee on Intelligence of the Senate; the Permanent Select Committee on Intelligence of the House of Representatives; the Committee on the Judiciary of the Senate; the Committee on the Judiciary of the House of Representatives; the Committee on Commerce, Science, and Transportation of the Senate; the Committee on Science, Space, and Technology of the House of Representatives; the Committee on Foreign Relations of the Senate; and the Committee on Foreign Affairs of the House of Representatives. The term ‘element of the intelligence community’ means an element specified or designated under section 3 of the National Security Act of 1947 ( 50 U.S.C. 3003 ). The term ‘private entity’ has the meaning given the term in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). The term ‘Secretary’ means the Secretary of Homeland Security. The term ‘sector-specific agency’ has the meaning given the term ‘Sector-Specific Agency’ in section 2201 of the Homeland Security Act of 2002 ( 6 U.S.C. 651 ) [see 6 U.S.C. 650 ]. The term ‘State’ means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, the Northern Mariana Islands, the United States Virgin Islands, Guam, American Samoa, and any other territory or possession of the United States.”