H.R. 10474: CISA Force Structure Assessment Act

This bill would require the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to conduct a force structure assessment of the agency. In plain terms, that means CISA would have to review whether it has the right number of people, the right skills, and enough resources to do its job effectively.

What the assessment would cover

The review would look at the personnel and resources needed for CISA’s main responsibilities, including:

• Protecting federal information and federal computer systems.
• Helping state, local, tribal, and territorial governments improve cybersecurity.
• Collecting and using reports that CISA receives under existing law.
• CISA’s role in protecting critical infrastructure as a “Sector Risk Management Agency” and national coordinator for infrastructure security and resilience.
• Security risks and capabilities related to emerging technologies, including artificial intelligence and quantum computing.
• Coordinating cybersecurity efforts with international allies and partners.
• Developing cyber defense plans.
• Conducting threat hunting on federal systems and operational technology.
• Operating the Joint Cyber Defense Collaborative.
• Supporting the cybersecurity and resilience of operational technology used by both government and non-government entities.
• Providing outside support to critical infrastructure operational technology.
• Carrying out cybersecurity asset response activities under existing authorities.
• Operating the Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure.

Training and certification review

The bill would also require CISA to examine whether its workforce has the training and industry-recognized certifications needed for its current jobs, and whether it has enough staff and capabilities overall to meet its mission.

Consultation with outside stakeholders

In preparing the assessment, CISA would have to consult with relevant stakeholders, including other federal agencies, information-sharing organizations, sector coordinating councils, and state, local, tribal, and territorial governments.

Reporting requirement

CISA would have to submit a report to the House and Senate Homeland Security committees within one year after the bill becomes law. The report would describe the assessment’s findings and recommend ways to fix any shortages in staff, resources, or training/certification gaps.

Relevant Companies

None found.