Cybersecurity Policy Report, Bill to Revamp CISA’s Cyber Collaborative Clears Committee, (Sep 25, 2024)
A three-year-old cyber defense collaborative created by the Cybersecurity and Infrastructure Security Agency would have to develop a charter and adopt new transparency mechanisms under legislation that cleared the House Homeland Security Committee today by a vote of 17-13.
The Joint Cyber Defense Collaborative Act (H.R. 9768, 118th Cong. (2024)) would fix flaws that lawmakers and stakeholders have identified in CISA’s Joint Cyber Defense Collaborative (JCDC), according to Rep. Eric Swalwell (D., Calif.), the bill’s sponsor and ranking member of the committee’s cybersecurity and infrastructure protection subcommittee.
CISA created the JCDC in 2021 to deepen its operational collaboration with other government agencies and private-sector entities with expertise in cybersecurity and visibility into emerging cyber threats (CPR, Aug. 5, 2021). The group includes 321 organizations representing cyber defenders from 12 critical infrastructure sectors.
But it’s unclear how CISA selects entities for JCDC membership and how it establishes its priorities, among other things, Rep. Swalwell said.
“We’ve had phenomenal CISA directors over the years. My fear, though, is that if there’s not structure and scaffolding, the success of JCDC will be put wholly on the shoulders of the CISA director, and if, God forbid, you had a director who was not as competent as the last two, there’s no formal structure in place to get the best partners into JCDC, or if there’s not faithful partners in JCDC, to get them out,” he said.
“This legislation requires CISA, with the input of stakeholders, to develop a charter that it must adhere to, create an advisory council comprised of private-sector JCDC partners to define and drive its priorities, requires CISA to be transparent with JCDC about new partners and new initiatives, and establish an additional feedback loop for private-sector partners, as well as a requirement for CISA to share that feedback directly with Congress,” he explained.
Committee Chairman Mark Green (R., Tenn.) agreed that the JCDC had experienced “significant growing pains.” He noted that CISA’s own Cybersecurity Advisory Committee had recommended changes in the structure and operations of the collaborative (CPR, June 5).
“We continuously hear from industry partners that they’re not receiving information from the JCDC. We’ve also heard of some structural issues such as the lack of process to join and set priorities,” Rep. Green said. “If operated as it should, JCDC would be able to fill a critical gap.”
But Rep. Andrew Garbarino (R., N.Y.), chairman of the cybersecurity and infrastructure protection subcommittee, said Rep. Swalwell’s bill would fail to fully address JCDC’s flaws. “The ranking member spent a lot of time and effort on this bill, and he should be commended for that,” Rep. Garbarino said. “I just don’t think it’s fully baked yet, and I think it could be tightened up a little more.”
News: DataSecurity FederalLegislation