6 U.S.C. § 1500 — National Cyber Director

Page 497 TITLE 6—DOMESTIC SECURITY § 1500 United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. DONALD J. TRUMP. SUBCHAPTER I—CYBERSECURITY INFORMATION SHARING § 1500. National Cyber Director (a) Establishment There is established, within the Executive Of- fice of the President, the Office of the National Cyber Director (in this section referred to as the ‘‘Office’’). (b) National Cyber Director (1) In general The Office shall be headed by the National Cyber Director (in this section referred to as the ‘‘Director’’) who shall be appointed by the President, by and with the advice and consent of the Senate. (2) Position The Director shall hold office at the pleasure of the President. (3) Pay and allowances The Director shall be entitled to receive the same pay and allowances as are provided for level II of the Executive Schedule under sec- tion 5313 of title 5. (c) Duties of the National Cyber Director (1) In general Subject to the authority, direction, and con- trol of the President, the Director shall— (A) serve as the principal advisor to the President on cybersecurity policy and strat- egy relating to the coordination of— (i) information security and data protec- tion; (ii) programs and policies intended to improve the cybersecurity posture of the United States; (iii) efforts to understand and deter ma- licious cyber activity; (iv) efforts to increase the security of in- formation and communications technology and services and to promote national sup- ply chain risk management and vendor se- curity; (v) diplomatic and other efforts to de- velop norms and international consensus around responsible state behavior in cyberspace; (vi) awareness and adoption of emerging technology that may enhance, augment, or degrade the cybersecurity posture of the United States; and (vii) such other cybersecurity matters as the President considers appropriate; (B) offer advice and consultation to the National Security Council and its staff, the Homeland Security Council and its staff, and relevant Federal departments and agencies, for their consideration, relating to the de- velopment and coordination of national cyber policy and strategy, including the Na- tional Cyber Strategy; (C) lead the coordination of implementa- tion of national cyber policy and strategy, including the National Cyber Strategy, by— (i) in coordination with the heads of rel- evant Federal departments or agencies, monitoring and assessing the effective- ness, including cost-effectiveness, of the implementation of such national cyber policy and strategy by Federal depart- ments and agencies; (ii) making recommendations, relevant to changes in the organization, personnel, and resource allocation and to policies of Federal departments and agencies, to the heads of relevant Federal departments and agencies in order to implement such na- tional cyber policy and strategy; (iii) reviewing the annual budget pro- posals for relevant Federal departments and agencies and advising the heads of such departments and agencies whether such proposals are consistent with such national cyber policy and strategy; (iv) continuously assessing and making relevant recommendations to the Presi- dent on the appropriate level of integra- tion and interoperability across the Fed- eral cyber centers; (v) coordinating with the Attorney Gen- eral, the Federal Chief Information Offi- cer, the Director of the Office of Manage- ment and Budget, the Director of National Intelligence, and the Director of the Cybersecurity and Infrastructure Security Agency, on the streamlining of Federal policies and guidelines, including with re- spect to implementation of subchapter II of chapter 35 of title 44, and, as appropriate or applicable, regulations relating to cybersecurity; (vi) reporting annually to the President, the Assistant to the President for National Security Affairs, and Congress on the state of the cybersecurity posture of the United States, the effectiveness of such national cyber policy and strategy, and the status of the implementation of such national cyber policy and strategy by Federal de- partments and agencies; and (vii) such other activity as the President considers appropriate to further such na- tional cyber policy and strategy; (D) lead coordination of the development and ensuring implementation by the Federal Government of integrated incident response to cyberattacks and cyber campaigns of sig- nificant consequence, including— (i) ensuring and facilitating coordination among relevant Federal departments and agencies in the development of integrated operational plans, processes, and play- books, including for incident response, that feature— (I) clear lines of authority and lines of effort across the Federal Government; (II) authorities that have been dele- gated to an appropriate level to facili- tate effective operational responses across the Federal Government; and (III) support for the integration of de- fensive cyber plans and capabilities with offensive cyber plans and capabilities in a manner consistent with improving the cybersecurity posture of the United States; Page 498 TITLE 6—DOMESTIC SECURITY § 1500 (ii) ensuring the exercising of defensive operational plans, processes, and play- books for incident response; (iii) ensuring the updating of defensive operational plans, processes, and play- books for incident response as needed to keep them updated; and (iv) reviewing and ensuring that defen- sive operational plans, processes, and play- books improve coordination with relevant private sector entities, as appropriate; (E) preparing the response by the Federal Government to cyberattacks and cyber cam- paigns of significant consequence across Federal departments and agencies with re- sponsibilities pertaining to cybersecurity and with the relevant private sector enti- ties, including— (i) developing for the approval of the President, in coordination with the Assist- ant to the President for National Security Affairs and the heads of relevant Federal departments and agencies, operational pri- orities, requirements, and plans; (ii) ensuring incident response is exe- cuted consistent with the plans described in clause (i); and (iii) ensuring relevant Federal depart- ment and agency consultation with rel- evant private sector entities in incident response; (F) coordinate and consult with private sector leaders on cybersecurity and emerg- ing technology issues in support of, and in coordination with, the Director of the Cybersecurity and Infrastructure Security Agency, the Director of National Intel- ligence, and the heads of other Federal de- partments and agencies, as appropriate; (G) annually report to Congress on cybersecurity threats and issues facing the United States, including any new or emerg- ing technologies that may affect national se- curity, economic prosperity, or enforcing the rule of law; and (H) be responsible for such other functions as the President may direct. (2) Delegation of authority (A) The Director may— (i) serve as the senior representative to any organization that the President may es- tablish for the purpose of providing the President advice on cybersecurity; (ii) subject to subparagraph (B), be in- cluded as a participant in preparations for and, when appropriate, the execution of do- mestic and international summits and other international meetings at which cybersecurity is a major topic; (iii) delegate any of the Director’s func- tions, powers, and duties to such officers and employees of the Office as the Director con- siders appropriate; and (iv) authorize such successive re-delega- tions of such functions, powers, and duties to such officers and employees of the Office as the Director considers appropriate. (B) In acting under subparagraph (A)(ii) in the case of a summit or a meeting with an international partner, the Director shall act in coordination with the Secretary of State. (d) Omitted (e) Powers of the Director (1) In general The Director may, for the purposes of car- rying out the functions of the Director under this section— (A) subject to the civil service and classi- fication laws, select, appoint, employ, and fix the compensation of such officers and employees as are necessary and prescribe their duties, except that not more than 75 individuals may be employed without regard to any provision of law regulating the em- ployment or compensation at rates not to exceed the basic rate of basic pay payable for level IV of the Executive Schedule under section 5315 of title 5; (B) employ experts and consultants in ac- cordance with section 3109 of title 5, and compensate individuals so employed for each day (including travel time) at rates not in excess of the maximum rate of basic pay for grade GS–15 as provided in section 5332 of such title, and while such experts and con- sultants are so serving away from their homes or regular place of business, to pay such employees travel expenses and per diem in lieu of subsistence at rates authorized by section 5703 of such title 5 for persons in Federal Government service employed inter- mittently; (C) accept officers or employees of the United States or members of the Armed Forces on a detail from an element of the in- telligence community (as such term is de- fined in section 3003(4) of title 50) or from an- other element of the Federal Government on a nonreimbursable basis, as jointly agreed to by the heads of the receiving and detailing elements, for a period not to exceed three years; (D) promulgate such rules and regulations as may be necessary to carry out the func- tions, powers, and duties vested in the Direc- tor; (E) utilize, with their consent, the serv- ices, personnel, and facilities of other Fed- eral agencies; (F) enter into and perform such contracts, leases, cooperative agreements, or other transactions as may be necessary in the con- duct of the work of the Office and on such terms as the Director may determine appro- priate, with any Federal agency, or with any public or private person or entity; (G) accept voluntary and uncompensated services, notwithstanding the provisions of section 1342 of title 31; (H) adopt an official seal, which shall be judicially noticed; and (I) provide, where authorized by law, cop- ies of documents to persons at cost, except that any funds so received shall be credited to, and be available for use from, the ac- count from which expenditures relating thereto were made. (2) Rules of construction regarding details Nothing in paragraph (1)(C) may be con- strued as imposing any limitation on any Page 499 TITLE 6—DOMESTIC SECURITY § 1501 other authority for reimbursable or non- reimbursable details. A nonreimbursable de- tail made pursuant to such paragraph shall not be considered an augmentation of the ap- propriations of the receiving element of the Office of the National Cyber Director. (f) Rules of construction Nothing in this section may be construed as— (1) modifying any authority or responsi- bility, including any operational authority or responsibility of any head of a Federal depart- ment or agency; (2) authorizing the Director or any person acting under the authority of the Director to interfere with or to direct a criminal or na- tional security investigation, arrest, search, seizure, or disruption operation; (3) amending a legal restriction that was in effect on the day before January 1, 2021 that requires a law enforcement agency to keep confidential information learned in the course of a criminal or national security investiga- tion; (4) authorizing the Director or any person acting under the authority of the Director to interfere with or to direct a military oper- ation; (5) authorizing the Director or any person acting under the authority of the Director to interfere with or to direct any diplomatic or consular activity; (6) authorizing the Director or any person acting under the authority of the Director to interfere with or to direct an intelligence ac- tivity, resource, or operation; or (7) authorizing the Director or any person acting under the authority of the Director to modify the classification of intelligence infor- mation. (g) Definitions In this section: (1) The term ‘‘cybersecurity posture’’ means the ability to identify, to protect against, to detect, to respond to, and to recover from an intrusion in an information system the com- promise of which could constitute a cyber at- tack or cyber campaign of significant con- sequence. (2) The term ‘‘cyber attack and cyber cam- paign of significant consequence’’ means an incident or series of incidents that has the purpose or effect of— (A) causing a significant disruption to the confidentiality, integrity, or availability of a Federal information system; (B) harming, or otherwise significantly compromising the provision of service by, a computer or network of computers that sup- port one or more entities in a critical infra- structure sector; (C) significantly compromising the provi- sion of services by one or more entities in a critical infrastructure sector; (D) causing a significant misappropriation of funds or economic resources, trade se- crets, personal identifiers, or financial infor- mation for commercial or competitive ad- vantage or private financial gain; or (E) otherwise constituting a significant threat to the national security, foreign pol- icy, or economic health or financial stability of the United States. (3) The term ‘‘incident’’ has the meaning given such term in section 3552 of title 44. (4) The term ‘‘incident response’’ means a government or private sector activity that de- tects, mitigates, or recovers from a cyber at- tack or cyber campaign of significant con- sequence. (5) The term ‘‘information security’’ has the meaning given such term in section 3552 of title 44. (6) The term ‘‘intelligence’’ has the meaning given such term in section 3003 of title 50. (Pub. L. 116–283, div. A, title XVII, § 1752, Jan. 1, 2021, 134 Stat. 4144; Pub. L. 117–81, div. A, title XV, § 1552, Dec. 27, 2021, 135 Stat. 2070.) Editorial Notes CODIFICATION Section was enacted as part of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, and not as part of the Cybersecurity Information Sharing Act of 2015 which comprises this subchapter and not as part of the Cybersecurity Act of 2015 which comprises this chapter. Section is comprised of section 1752 of Pub. L. 116–283. Subsec. (d) of section 1752 of Pub. L. 116–283 amended section 3021 of Title 50, War and National Defense. AMENDMENTS 2021—Subsec. (e). Pub. L. 117–81, § 1552(1), (2), (4), des- ignated existing provisions as par. (1) and inserted heading, redesignated former pars. (1) to (8) as subpars. (A) to (H), respectively, of par. (1) and realigned mar- gins, and added par. (2). Subsec. (e)(1)(C) to (I). Pub. L. 117–81, § 1552(3), added subpar. (C) and redesignated former subpars. (C) to (H) (as redesignated by section 1552(1) of Pub. L. 117–81, see above) as (D) to (I), respectively. Statutory Notes and Related Subsidiaries SHORT TITLE OF 2022 AMENDMENT Pub. L. 117–260, § 1, Dec. 21, 2022, 136 Stat. 2389, pro- vided that: ‘‘This Act [enacting section 1526 of this title and provisions set out as notes under section 1526 of this title] may be cited as the ‘Quantum Computing Cybersecurity Preparedness Act’.’’ § 1501. Definitions In this subchapter: (1) Agency The term ‘‘agency’’ has the meaning given the term in section 3502 of title 44. (2) Antitrust laws The term ‘‘antitrust laws’’— (A) has the meaning given the term in sec- tion 12 of title 15; (B) includes section 45 of title 15 to the ex- tent that section 45 of title 15 applies to un- fair methods of competition; and (C) includes any State antitrust law, but only to the extent that such law is con- sistent with the law referred to in subpara- graph (A) or the law referred to in subpara- graph (B). (3) Appropriate Federal entities The term ‘‘appropriate Federal entities’’ means the following: