Cybersecurity strategy

Not later than 90 days after December 23, 2016, the Secretary shall develop a departmental strategy to carry out cybersecurity responsibilities as set forth in law. The strategy required under subsection (a) shall include the following: Information on the programs, policies, and activities that are required to successfully execute the full range of the Secretary’s cybersecurity responsibilities, including programs, policies, and activities in furtherance of the following: In developing the strategy required under subsection (a), the Secretary shall— consider— Not later than 90 days after the development of the strategy required under subsection (a), the Secretary shall issue an implementation plan for the strategy that includes the following: The Secretary shall submit to Congress for assessment the following: The strategy required under subsection (a) shall be in an unclassified form but may contain a classified annex. Nothing in this section may be construed as permitting the Department to engage in monitoring, surveillance, exfiltration, or other collection activities for the purpose of tracking an individual’s personally identifiable information.