Advancing Cybersecurity Diagnostics and Mitigation Act

Mr. Speaker, I rise today in support of H.R. 6443, the ``Advancing Cybersecurity Diagnostics and Mitigation Act'' which codifies the Continuous Diagnostics and Mitigation (CDM) Program administered by the Department of Homeland Security.

At a time when the computer networks of our government are under constant attack, and have suffered serious breaches in recent years, we must take action to ensure that the information of our citizens and the ability of federal agencies to carry out their duties are resilient.

As a long-time advocate of a government that works efficiently for the people, it is clear that current information security practices of federal agencies are neither sufficient nor consistent.

Without an honest effort to even get to obtain a view of the security state of federal networks, users, and devices, we will continue to be increasingly vulnerable.

To that end, H.R. 6443 recognizes the importance of a dynamic approach that will help secure federal networks and data, as well as provide improved information on vulnerabilities and security practices across the various agencies.

In particular, this measure codifies the Continuous Diagnostics and Mitigation (CDM) Program to which:

1. Deploys DHS sensors which perform ongoing scans for vulnerabilities and known flaws; and

2. Feed the collected data to an enterprise dashboard to provide increased insight into the information security posture of federal agencies.

Without codifying this concrete measure to fortify federal networks and devices, federal agencies will remain vulnerable.

While codifying the DHS CDM Program will harden the security posture of the federal government, we are still suffering from a shortage of workers with the requisite skills in this area.

To address this, I have introduced the Cyber Security Education and Federal Workforce Enhancement Act (H.R. 1981), which would address our cyber workforce shortage by establishing an Office of Cybersecurity Education and Awareness within DHS which will focus on:

1. Recruiting information assurance, cybersecurity, and computer security professionals;

2. Providing grants, training programs, and other support for kindergarten through grade 12, secondary, and post-secondary computer security education programs;

3. Supporting guest lecturer programs in which professional computer security experts lecture computer science students at institutions of higher education;

4. Identifying youth training programs for students to work in part- time or summer positions at federal agencies; and

5. Developing programs to support underrepresented minorities in computer security fields with programs at minority-serving institutions, including Historically Black Colleges and Universities, Hispanic-serving institutions, Native American colleges, Asian-American institutions, and rural colleges and universities.

Mr. Speaker, government agencies and the private sector alike continue to struggle to identify the motivations and methods behind a cyber-attack and, in many cases, lack timely information on tactics and techniques hackers are using.

Despite this, the White House has eliminated the position of Cybersecurity Coordinator from the National Security Council.

This occurred even after Federal Risk Determination Reports found that communication of threat information within agencies is also inconsistent, with only 59 percent of agencies reporting a capability to share threat information to all employees within an enterprise so they have the knowledge necessary to block attacks.

Federal agencies are not taking advantage of all available information such as threat intelligence, incident data, and network traffic flow to improve situational awareness regarding systems at risk and to prioritize investments.

For this reason, earlier this Congress, I introduced H.R. 3202, the ``Cyber Vulnerability Disclosure Reporting Act'', which was passed by the full House and is now in the Senate.

H.R. 3202 requires the Secretary of Homeland Security to submit a report on the policies and procedures developed for coordinating cyber vulnerability disclosures.

The report will include an annex with information on instances in which cyber security vulnerability disclosure policies and procedures were used to disclose details on identified weaknesses in computing systems or digital devices at risk.

The report will provide information on the degree to which the information provided by DHS was used by industry and other stakeholders.

I would also like to recognize the University of Houston, which has been recognized by the Department of Homeland Security and the National Security Agency as a Center of Academic Excellence for the programs in cybersecurity and cyber defense.

In closing, Mr. Speaker, I urge all members to join me in voting to pass H.R. 6433, the ``Advancing Cybersecurity Diagnostics and Mitigation Act''.

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 6443) to amend the Homeland Security Act of 2002 to authorize the Secretary of Homeland Security to establish a continuous diagnostics and mitigation program at the Department of Homeland Security, and for other purposes, as amended.

Mr. Speaker, I ask unanimous consent that all Members have 5 legislative days in which to revise and extend their remarks and include any extraneous material on the bill under consideration.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, earlier this year, the Office of Management and Budget and the Department of Homeland Security

released a report on the cybersecurity risks faced by Federal agencies. Among the findings of that report was that almost 75 percent of our Federal agencies are vulnerable to cyber threats, in large part due to their inability to understand cybersecurity risks and, therefore, to properly prioritize resources.

Mr. Speaker, it is statistics like this that should make the state of our Nation's cyber readiness and resilience deeply troubling to all of us. And it is one of the main reasons that DHS' Continuous Diagnostics and Mitigation, or CDM, program has been one of my top priorities during my time as chairman of the Cybersecurity and Infrastructure Protection Subcommittee. That is because CDM has the potential to provide solutions to this problem by dramatically increasing visibility across Federal networks, thereby dramatically improving the ability of DHS, OMB, and agency security officers to better understand the technology assets being utilized across their agencies.

Mr. Speaker, at the end of the day, looking across all networks and systems the Federal Government owns and operates, it comes down to fingers on government keyboards, whether they be laptops, desktops, tablets, servers, or in data centers.

We need to know what we have before we can try to defend it.

That is why the CDM program is so crucial to the cybersecurity posture of our Federal Government. Through its phased rollout, CDM requires DHS to provide agencies with the capabilities to collect the cybersecurity risk information necessary to make better decisions. It not only allows the ability to combat our enemies in cyberspace, but also to help Federal CIOs manage information technology.

The security data that CDM capabilities and tools collect will help Federal CIOs and DHS make smarter choices about where taxpayer dollars are going and to understand some of the most basic questions a cybersecurity expert faces, including what devices are on the network.

Mr. Speaker, H.R. 6443 is necessary to codify the CDM program at DHS and ensure that these authorities will exist to allow the continued progress of this essential cybersecurity program.

Making sure that Federal agencies have access to the tools and capabilities they need to defend their networks and getting DHS the data to understand cybersecurity risks and vulnerabilities, and to coordinate our Federal network defenses, are paramount concerns in this technological age.

My goal, and the goal of the bipartisan group of cosponsors supporting H.R. 6443, is to help boost the long-term success of the CDM program.

This bill also ensures that this program keeps pace with the cutting- edge capabilities being developed in the private sector, thereby avoiding the type of vendor lock that has previously been a problem. In that way, this bill ensures that we will be modernizing and updating our systems before they become legacy technologies unsupported by vendors and at even greater risk of being exploited by our digital adversaries.

It is DHS' CDM program that will help Federal agencies and the whole of the Federal Government to understand the threats they face and the risks that these vulnerabilities pose in real time. Authorizing the CDM program will further DHS' role in the cybersecurity mission throughout our government and will continue to strengthen and elevate this important program.

Mr. Speaker, I urge my colleagues to support this bill, and I reserve the balance of my time.

I reserve the balance of my time, Mr. Speaker.

Mr. Speaker, I would like to thank my friends across the aisle, Ranking Member Thompson and Congressman Langevin, for their support of this bill. I would like to thank the ranking member of the Cybersecurity and Infrastructure Protection Subcommittee, Mr. Richmond, for cosponsoring this bill.

Mr. Speaker, this is, very simply, commonsense legislation that will strengthen our Nation's cybersecurity posture and thereby strengthen our Nation's national security.

Mr. Speaker, once again, I urge my colleagues to support H.R. 6443, and I yield back the balance of my time.

Mr. Speaker, I thank the gentleman for yielding, and I want to recognize and thank the gentleman from Texas for his leadership on this issue as well as for his leadership as chairman of the Subcommittee on Cybersecurity and Infrastructure Protection.

As the cofounder and co-chair of the Congressional Cybersecurity Caucus, which I have co-led for a decade with my good friend Chairman McCaul, I firmly believe that cybersecurity is the national and economic security issue of the 21st century. I believe it is, therefore, incumbent upon us as Members of Congress to enable the government to take the steps needed to protect our systems and to provide some course correction when necessary.

This bill does both, authorizing the Continuous Diagnostics and Mitigation, or CDM, program and requiring a strategy from the Department of Homeland Security to guide its future growth. CDM represents a core component of the Department's efforts to better secure the dot-gov domain. In particular, by giving agencies a better view into their networks, systems, and data, it helps provide an understanding of cybersecurity status in real time.

It also feeds back data to DHS, so that cybersecurity specialists at the National Protection and Programs Directorate can better assist agencies in closing vulnerabilities and responding to incidents.

Conceptually, CDM makes a lot of sense, but it has not been without challenges in implementation. Originally designed with a phased model that focused on incorporating new sets of tools at each milestone, it has fallen behind schedule, and many agencies have expressed skepticism about the program's utility.

I believe in CDM, and I believe that the congressional direction provided by Mr. Ratcliffe's bill will help dispel some of these doubts. I also believe that the strategy can further help refocus the program on the present and future needs of Federal networks. So I am pleased that, during the committee

consideration, my amendment requiring a re-examination of the phasing plan was adopted.

While I appreciate the thought underlying the original phasing approach, I believe that we make more progress if the planned phase 3 and phase 4 are constructed in parallel rather than serially.

This is a good bill, and I urge my colleagues to support its passage. However, I must take this opportunity to mention this bill's major omission. It does not address the incentive structure at other agencies to actually adopt CDM offerings. During hearings and roundtables on the program, we often heard from government stakeholders that internal dynamics at DHS' sister agencies were actually the biggest obstacle to the program's success.

Mr. Speaker, I thank the gentleman for yielding.

This is, to be sure, outside the purview of the Committee on Homeland Security, and I believe the bill before us will materially improve the program.

One other thing, I urge my colleagues to consider the wisdom of having so many committees involved with cybersecurity jurisdiction, often to the detriment of making real progress. Right now, there are some 30 committees and subcommittees that have jurisdiction over cyber, and it is very difficult to get things done. So I also urge my colleagues to look at the Executive Cyberspace Coordination Act, which would put a Senate-confirmed director of cybersecurity at the White House to help better coordinate interagency processes. Dealing with these jurisdictional problems would substantially improve our cybersecurity posture and would allow CDM to fully live up to its potential.

With that, I would like to again thank Ranking Member Thompson and Chairmen McCaul and Ratcliffe for continuing their focus on cybersecurity. I strongly urge support for H.R. 6443. I commend Chairman Ratcliffe for introducing the bill, and I certainly hope all Members will support it and DHS' ongoing cybersecurity efforts.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I rise in support of H.R. 6443, the Advanced Cybersecurity Continuous Diagnostics and Mitigation Act.

Mr. Speaker, H.R. 6443 would codify the existing Continuous Diagnostics and Mitigation, or CDM, program within the Department of Homeland Security's National Protection and Programs Directorate, NPPD.

CDM is an important part of our national approach to securing Federal networks. Through CDM, DHS works with Federal agencies to identify, purchase, and integrate cybersecurity tools and services to help defend their networks against cyber attacks.

By taking advantage of bulk pricing, CDM allows agencies to purchase security services at a discounted rate and, in turn, devote more of their limited resources to carrying out their missions. Another benefit of the program is that it enables DHS to track threats to agency networks, giving the Department a more holistic view of the threat landscape.

Still, given the enormous challenges associated with protecting such a massive and diverse set of networks, it is not surprising that DHS has, at times, struggled.

For instance, in rolling out CDM, DHS officials mapped four phases of implementation where, in the first phase, agencies would identify all the assets and devices on their networks.

At the time, DHS projected that the last phase, which is focused on protecting the data that agencies store, would begin being tackled in 2017. Unfortunately, the CDM deployment schedule has been plagued with across-the-board delays, starting with the implementation of phase 1, which took years. As a result of these delays, the data housed on agency networks--what the bad guys are really after--remains less secure than might otherwise have been.

H.R. 6443 would address CDM's challenges in a few ways, for example, by asking DHS to reconsider its phased approach to implementation and examine opportunities to streamline adoption of CDM technologies.

This bill would also require DHS to develop a comprehensive strategy that addresses deployment challenges, areas where greater coordination is needed, and recommendations for continuous improvement.

Finally, H.R. 6443 adds specificity to DHS' responsibilities under CDM and includes robust reporting requirements to inform congressional oversight.

Every year, Federal networks get hit by tens of thousands of attempted intrusions, many of them sophisticated, state-sponsored attacks. We have seen time and again the cost and damage that can flow from a high-profile Federal breach. As such, we need CDM to work.

Mr. Speaker, I yield 2 minutes to the gentleman from Rhode Island (Mr. Langevin).

Mr. Speaker, I yield an additional 1 minute to the gentleman from Rhode Island.

Mr. Speaker, I have no further speakers on this bill, and I yield myself the balance of my time.

Mr. Speaker, H.R. 6443 seeks to improve DHS' capacity to carry out one of its more important homeland security missions: the protection of Federal agency networks.

Over the past decade, we have seen the number of cyber attacks against Federal agencies rise by more than 1,000 percent. Last year alone, the Office of Management and Budget reported that Federal agencies experienced more than 35,000 cybersecurity incidents. A challenge of this magnitude cannot be undertaken by each agency on its own. They need help.

That is where the CDM program comes in. By authorizing CDM in law, DHS and its agency partners can confidently move forward to bolster Federal network security. By requiring the Department to revisit its implementation plans and work to finally resolve its longstanding CDM challenges, H.R. 6443 puts the program on an even more secure footing.

Mr. Speaker, I urge my colleagues to support this bipartisan legislation, and I yield back the balance of my time.