APPENDIX: DHS CYBERSECURITY AUTHORITIES Statutes • Title II of the Homeland Security Act of 2002, as amended (Pub. Law 107-296): Subtitle B of title II authorizes DHS, through NPPD, to enhance the security, resilience, and reliability of the Nation’s cyber and communications infrastructure— Section 227 – National cybersecurity and communications integration center (6 U.S.C. § 148). Created by the National Cybersecurity Protection Act of 2014 (Pub. Law 113-282) and amended by the Cybersecurity Act of 2015, section 227 authorizes the NCCIC within NPPD as a “Federal civilian interface for the multi-directional and cross-sector sharing of information related to … cybersecurity risks.” This provision includes the authority to receive, analyze, and disseminate information about cybersecurity risks and incidents and to provide guidance, assessments, incident response support, and other technical assistance upon request. Section 227 codifies NPPD’s coordinating role among federal and nonfederal entities, and clarifies that NPPD’s cybersecurity authorities apply broadly to federal and nonfederal entities, including international partners, sectors of critical infrastructure, information sharing organizations, or any other entity. Section 227 also authorizes NPPD to establish information sharing relationships, and to enter into information sharing agreements, and establishes a wide range of federal and nonfederal stakeholders as components of the NCCIC. Section 223 – Enhancement of Federal and Non-Federal Cybersecurity (6 U.S.C. § 143). Section 223 authorizes NPPD, in carrying out its cybersecurity responsibilities, to provide “analysis and warnings related to threats to, and vulnerabilities of, critical information systems” to state and local government entities, and upon request to owners and operators of critical information systems. Section 223 also authorizes NPPD to provide “crisis management support” and “technical assistance,” including recovery assistance, to the private sector and governmental entities. Section 223 also delegates to NPPD the Department’s responsibilities to protect federal information systems under subchapter II of chapter 35 of title 44 (discussed below). Section 201(d) (6 U.S.C. § 121(d)). Section 201 broadly authorizes NPPD’s activities to ensure security and resilience of critical infrastructure to terrorist and other threats, including by authorizing NPPD to access and integrate information, as well as to carry out comprehensive assessments of the vulnerabilities of critical infrastructure. Section 228 – Cybersecurity plans (6 U.S.C. § 149). Section 228, as amended by the Cybersecurity Act of 2015, directs DHS to develop, maintain, update, and exercise cyber incident response plans – including “the National Cybersecurity Incident Response Plan and the Cyber Incident Annex to the National Response Framework.” The NCCIC is specifically required to participate in national exercises associated with those plans. A-1