§665e Cybersecurity Advisory Committee

Summary

The Secretary must create a Cybersecurity Advisory Committee inside the Agency. The Advisory Committee is a group that advises and makes recommendations to the Director about cybersecurity policies, programs, planning, and training. At the Director’s request it will draft improvements to help the Agency and the nation. It must send periodic reports on topics the Director asks for and on topics a majority of members choose. It must send one annual report on its activities, findings, and recommendations for the prior year. The Director must publish a public version of that annual report within 180 days of receiving it, consistent with section 552(b) of title 5. The Director must reply in writing within 90 days to any recommendation, giving an action plan if they agree or a reason if they do not. At least once each year after January 1, 2021, the Director must brief specified House and Senate committees about the Advisory Committee’s feedback. The Director will set rules for how the committee and its subcommittees are run. The Director must appoint the members within 180 days after the Cybersecurity Advisory Committee Authorization Act of 2020 was enacted. The committee can have no more than 35 people. Members must be subject matter experts, balanced by geography, and include state, local, and Tribal government reps plus a wide range of industries. At least one and no more than three people may represent any one category. The committee must publish its member list at least once per fiscal year and update it as changes happen. Members serve two-year terms and may stay until a successor is named; the Director may remove members at any time and members may be reappointed without limit. Members get no federal pay or benefits for this work. The committee must meet at least twice a year, with at least one public meeting, and keep attendance records. Within 60 days after a member is first appointed, the Director must decide whether to limit that member’s access to classified information before any such access is allowed; classified access and protection follow Executive Order 13526. The committee chooses a chair and subcommittee chairs. The Director will set subcommittees (for example, on information sharing, critical infrastructure, risk management, and public-private partnerships); each subcommittee must meet at least twice a year and give its work to the Advisory Committee for the annual report.