§661 Cybersecurity Strategy

Summary

The Secretary must create a department-wide cybersecurity plan no later than 90 days after December 23, 2016. The plan must list the main goals and how to carry them out. It must describe the programs, policies, and activities needed, including work tied to the national cybersecurity and communications integration center (see section 659), cyber investigations, cyber research and development, and working with international cybersecurity partners. When making the plan, the Secretary must consider the November 2011 Homeland Security Enterprise cybersecurity strategy, the Department of Homeland Security Fiscal Years 2014–2018 Strategic Plan, and the most recent Quadrennial Homeland Security Review issued under section 347. The plan should, when practical, say which parts and offices of the Department will do each job. Within 90 days after finishing the plan, the Secretary must issue a plan to put it into action that lists objectives and tasks, shows timelines and costs, and gives measures to check progress. Copies of the plan and the action plan must be sent to Congress when issued, with any related legislative or budget proposals. The public plan must be unclassified but may have a classified annex. The Department is not allowed to monitor, surveil, extract, or collect data to track a person’s personally identifiable information.