Industrial Control Systems Cybersecurity Training Act

Madam Speaker, I move to suspend the rules and pass the bill (H.R. 7777) to amend the Homeland

Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency to establish an industrial control systems cybersecurity training initiative, and for other purposes, as amended.

Madam Speaker, I ask unanimous consent that all Members may have 5 legislative days in which to revise and extend their remarks and include extraneous material on this measure.

Madam Speaker, I yield myself such time as I may consume.

Madam Speaker, I thank the chairman and ranking member of the Committee on Homeland Security for their support for moving my bill, H.R. 7777, the Industrial Control Systems Cybersecurity Training Act, through committee. I thank the Speaker and majority leader for bringing this measure to the floor today.

Madam Speaker, H.R. 7777 is not only a winning number on a slot machine; it is a winning formula for bringing cyber hygiene to our industrial control systems across America.

Every day, we rely on critical infrastructure to power our homes, fuel our cars, and connect us online. One essential component of critical infrastructure is industrial control systems, also known as ICS, which digitally manage operations of these vital systems.

As Congress considers legislation to address cybersecurity threats to America's interests, my legislation would help to secure vulnerable ICS at every level of our economy and our government. H.R. 7777 would make permanent an existing education initiative within the Cybersecurity and Infrastructure Security Agency, also known as CISA.

This initiative, the ICS training initiative, provides free virtual and in-person cybersecurity training to public and private security entities, including critical infrastructure administrators, national laboratories, and even small businesses.

This training equips technology professionals across all levels with the tools and expertise necessary to secure themselves against advanced persistent threats.

When threats turn into successful attacks, it impacts the daily lives of every American, including sowing discord into our electoral processes, as we have seen election after election; shutting down our pipelines; or breaking down supply chains that provide essential food and other materials.

That means virtually everything that is connected to a network has a potential vulnerability, or what we would refer to as a left-of-boom vulnerability, the vulnerability that exists before the attack occurs. Every person, small business, or government database is a potential target.

In 2021 alone, cybercrimes inflicted approximately $6 trillion in damages across the world. Attacks on industrial networks account for a significant portion of that number, and it is only going to get worse in the future.

These threats often emerge from sophisticated state actors, like Russia and China, that have the ability to exploit vulnerabilities to disrupt and destroy the systems that make our way of life possible.

As Putin and his regime become increasingly isolated because of a successful sanctions regime and the effort that we are prosecuting to help keep Ukraine in the fight, we should expect the Kremlin to progressively target the United States and our allies with unconventional cyberattacks on our election systems and critical infrastructure. Any success that Russia has in exploiting vulnerabilities will inevitably be closely watched by other countries, particularly China.

In sum, we know this threat is real and that malignant actors will persistently probe our systems to find additional weaknesses to exploit, which would cause real harms, harms to Americans that would blunt innovation, steal American secrets, and destroy America's small businesses.

In my district, cybersecurity professionals deal with threats to ICS every single day. I specifically note two major Federal research centers, Sandia and Lawrence Livermore National Laboratories, which play a critical role in protecting against worldwide cyber threats. They are in the heart of my district in Livermore, California.

This support is leveraged every day by numerous Federal agencies, including CISA, which sit on the front lines of protecting our infrastructure from bad actors. We in Congress must do everything we can to equip our security protectors with the resources they need to continue the fight, and that is what this legislation does.

Resources must include proactive ways to help cybersecurity-focused entities retain a competitive workforce. The training programs in my legislation will equip technology professionals with the skills, expertise, and resources they need to build resilience against threats to some of our most sensitive facilities.

I applaud CISA for increasing these trainings, which H.R. 7777--which I love saying--would make permanent. This commonsense program is an easy solution to build resilience against cyberattacks for our most vulnerable systems.

Madam Speaker, I urge my House colleagues to support this legislation, and I reserve the balance of my time.

Madam Speaker, I yield myself the balance of my time.

I appreciate the bipartisan, cooperative effort here to make sure that our cyber professionals across America are ready to meet the growing threats from Russia, China, and even nonstate cyber actors. That is exactly what H.R. 7777 seeks to do, by authorizing CISA's ICS cybersecurity training program and directing CISA to report to Congress annually about the initiative.

Improving the state of our cybersecurity workforce will be an ongoing effort, and these reports will help Congress continue to strengthen this program in the future.

Passing this bill will help us continue to move forward in developing the cybersecurity workforce we need to defend against the growing cyber threats that we face. In particular, this will help strengthen small businesses, particularly those in critical infrastructure, who do not yet today have cybersecurity defense forces receiving that training.

Madam Speaker, I urge my colleagues to support H.R. 7777, and I yield back the balance of my time.

Mr. Speaker, I am pleased that we are closing out the Congress with overwhelming bipartisan support for 23 important measures to make our communities more secure and improve Department of Homeland Security operations in the National Defense Authorization Act for Fiscal Year 2023.

I am particularly pleased that we were able to reach agreement on the Nonprofit Security Grant Program Improvement Act to expand and strengthen this vital program so that more nonprofits and houses of worship can access security assistance at this time of heightened threats of violent extremism and terrorism. With antisemitic and other violent threats on the rise, it is clear this legislation is needed now more than ever.

I also want to thank Ranking Member John Katko, as he retires from Congress, for his contributions to the Homeland Security Committee and his critical support throughout this process for the Committee's bipartisan package found in Division G of the NDAA.

While the package reflects the contributions of so many of my colleagues, l would like to give special acknowledgment to Congresswoman Val Demings who championed the Homeland Security Capabilities Preservation Act. This legislation directs DHS to explore ways to provide needed bridge funding to cities to preserve homeland security capability gains accomplished through the Urban Area Security Initiative grant program when they no longer receive such funding.

With respect to cybersecurity, I am pleased that we were able to reach agreement on bipartisan provisions that originated in the Committee on Homeland Security. They include Congresswoman Elissa Slotkin's legislation to reauthorize the Secret Service's National Computer Forensics Institute, Congresswoman Elaine Luria's bill to authorize DHS's President's Cup Cybersecurity Competition, and legislation authored by Congressman Eric Swalwell aimed at improving DHS's cybersecurity training to protect industrial control systems.

While I am enormously proud of the bipartisan homeland security provisions that were included, I would be remiss if I did not acknowledge my disappointment that we were not able to reach agreement with the Senate on amending the law to treat TSA's workforce like most other Federal employees or authorize the vital work of DHS's Office of Civil Rights and Civil Liberties. We will continue to seek an agreement on these critical measures.

Lastly, I am particularly proud that the NDAA honors my late friend, Congressman A. Donald McEachin, by including his bill, the DHS Mentor- Protege Program Act, to help small businesses better compete for DHS contracts. It is a fitting tribute to my friend that we came together to pass a bill to open doors of opportunity to small businesses-- something that he was passionate about doing.

Mr. Speaker, the full list of Homeland Security Committee measures that will be enacted by this year's NOAA is as follows:

H.R. 6825, the Nonprofit Security Grant Program Improvement Act of 2022, sponsored by Rep. Bennie G. Thompson (D-MS).

H.R. 5615, the Homeland Security Capabilities Preservation Act, sponsored by Rep. Val Butler Demings (D-FL).

H.R. 6387, the School and Daycare Protection Act, sponsored by Rep. Donald M. Payne Jr. (D-NJ).

H.R. 8801, the DHS Joint Task Force Reauthorization Act of 2022, sponsored by Rep. J. Luis Correa (D-CA) and S. 4656, the DHS Joint Task Forces Reauthorization Act of 2022, sponsored by Sen. Gary C. Peters (D-MI).

H.R. 2915, the Homeland Procurement Reform Act, sponsored by Rep. J. Luis Correa (D-CA) and S. 1009, the Homeland Procurement Reform Act, sponsored by Sen. Jeanne Shaheen (D-NH).

H.R. 6824, the President's Cup Cybersecurity Competition Act, sponsored by Rep. Elaine G. Luria (D-VA).

H.R. 7777, the Industrial Control Systems Cybersecurity Training Act, sponsored by Rep. Eric Swalwell (D-CA).

H.R. 7174, the National Computer Forensics Institute Reauthorization Act of 2022, sponsored by Rep. Elissa Slotkin (D-MI) and S. 4673, the National Computer Forensics Institute Reauthorization Act of 2022, sponsored by Sen. Chuck Grassley (R-IA).

H.R. 5574, the TSA Reaching Across Nationalities, Societies, and Languages to Advance Traveler Education Act (``TRANSLATE Act''), sponsored by Rep. Dina Titus (D-NV) and S. 3296, the TSA Reaching Across Nationalities, Societies, and Languages to Advance Traveler Education Act (``TRANSLATE Act''), sponsored by Sen. Jacky Rosen (D-

Madam Speaker, I rise in strong support of H.R. 7777, the ``Industrial Control Systems Cybersecurity Training Act.''

H.R. 7777 amends the Homeland Security Act of 2002 to authorize the Cybersecurity and Infrastructure Security Agency to establish an industrial control systems training iniative that will strengthen the skills of our vital cyber-security workforce.

Industrial control systems are the devices, systems, networks, and controls used to operate and automate the industrial functions that keep our Nation running.

They are key components in manufacturing, electrical generation, wastewater treatment, and even oil refineries--all of which are necessary for the proper functioning of our country.

While the technological revolution has streamlined many industrial services, it has also left us vulnerable to threats targeting our national utilities and infrastructure.

The ``Industrial Control Systems Cybersecurity Training Act'' provides an instruction manual for training those on the frontlines of our defense.

First, H.R. 7777 prioritizes increasing access to cybersecurity education courses.

The Act would require the Director to make accessible to the public tuition-free virtual and in-person cyber security courses and trainings for varying skill levels.

It would also ensure that these trainings be available across the country so that those working in even the most remote corners of America have the opportunity to develop their cybersecurity skills.

Trainings would cover topics of cyber defense strategies, the evolution of cyber threats, and strategies for mitigating security vulnerabilities in industrial control systems.

All of these courses would be crafted in collaboration with the National Laboratory of the Department of Energy and when necessary, consultation with expert private sector entities.

Those who wish to harm our country are learning from the best criminals; therefore, we must equally arm our defenders right along side them.

Secondly, H.R. 7777 requires the Director to provide reports on the initiative to the House Committee on Homeland Security and the Senate Committee on Homeland Security and Governmental Affairs.

Through these reports, Congress would not only be able to monitor the quality of courses being offered, but would receive yearly recommendations on how to improve the education and training being offered.

In addition to reporting on the contents of the classes taught, the Director would also be expected to provide information on the race, gender, and regional location of those in attendance.

Through this monitoring process, Congress would be assured not only of current demographic diversity, but also the plans to expand access to industrial control systems cybersecurity training to women and underrepresented populations.

In today's increasingly interconnected world, it is critical that the United States produces highly trained cyber security professionals equipped to maintain America's security and defense.

It is also critical that the initiatives utilized to provide for their education encapsulate the needs of our diverse and varied Nation.

H.R. 7777 will put in place the framework needed to train the next generation of leaders in industrial control systems cybersecurity.

That is why I rise in strong support of ``Industrial Control Systems Cybersecurity Training Act.''

Madam Speaker, I yield myself such time as I may consume.

Madam Speaker, I rise today in support of H.R. 7777, the Industrial Control Systems Cybersecurity Training Act.

In policy discussions following recent cyber incidents, like SolarWinds and Colonial Pipeline, one constant area of concern to Congress and our cyber defenders, like the Cybersecurity and Infrastructure Security Agency, CISA, has been improving the Nation's workforce pipeline for cybersecurity and other STEM-related fields.

As the interconnectivity of our daily lives continues to grow, the estimated worldwide cost of cybercrime has risen to $6 trillion annually. Despite this alarming and growing threat, some estimates say that the cybersecurity workforce is currently short about 1 to 3 million qualified professionals.

A recent Center for Strategic and International Studies, CSIS, study of IT decisionmakers across eight countries found that 82 percent of employers report a shortage of cybersecurity skills, and 71 percent believe this talent gap causes direct and measurable damage to their organization.

Federal agencies have been working to bridge the gap in skills required to prepare a future cyber workforce.

CISA is collaborating closely with organizations like the National Institute of Standards and Technology, NIST, to identify cyber knowledge deficits on a sector-by-sector basis. One example is the National Initiative for Cybersecurity Education framework, which serves as a useful precursor for directing Federal resources into education and research priorities.

H.R. 7777 would require that CISA provide resources for the purpose of training cyber operators that are fluent across multiple segments of the cyber domain, not only information technology but also operational technology, like manufacturing systems and industrial control systems, which are commonplace within critical infrastructure sectors and are increasingly exposed to cyber risk.

We must continue to do all we can to improve our Nation's cyber posture and focus on policy that can help make our government and private sector critical infrastructure operations more resilient and prepared for future events.

Madam Speaker, I urge Members to join me in supporting H.R. 7777, and I yield back the balance of my time.

Madam Speaker, on that I demand the yeas and nays.