Requirement for information sharing agreements
Short title
Findings
Congress finds the following:
The legislative branch, as a separate and equal branch of the United States Government, is a target of adversary cyber actors and intelligence services.
The legislative branch relies on the executive branch to provide timely and urgent tactical and operational information to ensure that Congress can protect the constitutional officers, personnel, and facilities of Congress and the institution of Congress more broadly.
The legislative branch currently is not receiving this information in a timely manner nor as a matter of course.
Definitions
In this section—
the term “congressional leadership” means—
the Majority and Minority Leader of the Senate with respect to an agreement with the Sergeant at Arms and Doorkeeper of the Senate or the Secretary of the Senate; and
the Speaker and Minority Leader of the House of Representatives with respect to an agreement with the Chief Administrative Officer of the House of Representatives or the Sergeant at Arms of the House of Representatives; and
the terms “cybersecurity threat” and “security vulnerability” have the meanings given those terms in section 650 of title 6, as added by section 5171 1
Requirement
Designation
In general
Not later than 30 days after
an individual appointed by the President, by and with the advice and consent of the Senate, to serve as a single point of contact to the legislative branch on matters related to tactical and operational cybersecurity threats and security vulnerabilities; and
an individual appointed by the President, by and with the advice and consent of the Senate, to serve as a single point of contact to the legislative branch on matters related to tactical and operational counterintelligence.
Coordination
Information sharing agreements
In general
Not later than 90 days after
the Sergeant at Arms and Doorkeeper of the Senate with respect to cybersecurity information sharing, subject to the approval of congressional leadership and in consultation with the chairman and the ranking minority member of the Committee on Rules and Administration of the Senate;
the Secretary of the Senate with respect to counterintelligence information sharing, subject to the approval of congressional leadership and in consultation with the chairman and ranking minority member of the Committee on Rules and Administration of the Senate;
the Chief Administrative Officer of the House of Representatives with respect to cybersecurity information sharing, subject to the approval of the chair of the Committee on House Administration of the House of Representatives and in consultation with the ranking minority member of the committee and congressional leadership; and
the Sergeant at Arms of the House of Representatives with respect to counterintelligence information sharing, subject to the approval of the chair of the Committee on House Administration of the House of Representatives and in consultation with the ranking minority member of the committee and congressional leadership.
Purpose
Implementation
Elements
In general
The parties to an information sharing agreement under subsection (d)(2) shall jointly develop such elements of the agreement as the parties find appropriate, which—
with respect to an agreement covered by subsection (d)(2)(A)(i) or (ii), shall, at a minimum, include the applicable elements specified in paragraph (2); and
with respect to an agreement covered by subsection (d)(2)(A)(iii) or (iv), may include the applicable elements specified in paragraph (2).
Elements specified
The elements specified in this paragraph are—
direct and timely sharing of technical indicators and contextual information on cyber threats and security vulnerabilities, and the means for such sharing;
direct and timely sharing of counterintelligence threats and vulnerabilities, including trends of counterintelligence activity, and the means for such sharing;
identification, by position, of the officials at the operational and tactical level responsible for daily management of the agreement;
the ability to seat cybersecurity personnel of the Office of the Sergeant at Arms and Doorkeeper of the Senate or the Office of the Chief Administrative Officer of the House of Representatives at cybersecurity operations centers within the executive branch; and
any other elements the parties find appropriate.