,i #aacth ,,congress #ast ,session ,h4 ,r4 #adfh ,,in ,,the ,,house ,,of ,,representatives ,april #aj1 #bjac ,mrs4 ,blackburn introduced the following bill2 which was referred to the ,committee on ,science1 ,space1 and ,technology1 and in addition to the ,committees on ,oversight and ,government ,reform1 the ,judiciary1 ,armed ,services1 ,select ,intelligence 7,permanent ,select71 and ,energy and ,commerce1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to improve information security1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac or ,,secure ,,it4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,title ,i--,facilitating sharing of cyber threat information ,sec4 #aja4 ,definitions4 ,sec4 #ajb4 ,authorization to share cyber threat information4 ,sec4 #ajc4 ,information sharing by the ,federal ,government4 ,sec4 #ajd4 ,construction4 ,sec4 #aje4 ,report on implementation4 ,sec4 #ajf4 ,inspector ,general review4 ,sec4 #ajg4 ,technical amendments4 ,sec4 #ajh4 ,access to classified information4 ,title ,,ii--,coordination of ,federal information security policy ,sec4 #bja4 ,coordination of ,federal information security policy4 ,sec4 #bjb4 ,management of information technology4 ,sec4 #bjc4 ,no new funding4 ,sec4 #bjd4 ,technical and conforming amendments4 ,sec4 #bje4 ,clarification of authorities4 ,title ,,iii--,criminal penalties ,sec4 #cja4 ,penalties for fraud and related activity in connection with computers4 ,sec4 #cjb4 ,trafficking in passwords4 ,sec4 #cjc4 ,conspiracy and attempted computer fraud offenses4 ,sec4 #cjd4 ,criminal and civil forfeiture for fraud and related activity in connection with computers4 ,sec4 #cje4 ,damage to critical infrastructure computers4 ,sec4 #cjf4 ,limitation on actions involving unauthorized use4 ,sec4 #cjg4 ,no new funding4 ,title ,,iv--,cybersecurity research and development ,sec4 #dja4 ,national ,high-,performance ,computing ,program planning and coordination4 ,sec4 #djb4 ,research in areas of national importance4 ,sec4 #djc4 ,program improvements4 ,sec4 #djd4 ,improving education of networking and information technology1 including high performance computing4 ,sec4 #dje4 ,conforming and technical amendments to the ,high-,performance ,computing ,act of #aiia4 ,sec4 #djf4 ,federal cyber scholarship-for-service program4 ,sec4 #djg4 ,study and analysis of certification and training of information infrastructure professionals4 ,sec4 #djh4 ,international cybersecurity technical standards4 ,sec4 #dji4 ,identity management research and development4 ,sec4 #daj4 ,federal cybersecurity research and development4 ,title ,v--,data ,security and ,breach ,notification ,sec4 #eja4 ,requirements for information security4 ,sec4 #ejb4 ,notification of information security breach4 ,sec4 #ejc4 ,application and enforcement4 ,sec4 #ejd4 ,definitions4 ,sec4 #eje4 ,effect on other laws4 ,sec4 #ejf4 ,effective date4 ,i ,facilitating sharing of cyber threat information #aja4 ,definitions ,in this title3 7#a7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,antitrust laws ,the term antitrust laws-- 7,a7 has the meaning given the term in section #a7;a7 of the ,clayton ,act 7#ae ,u4,s4,c4 #ab7;a772 7,b7 includes section #e of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to the extent that section #e of that ,act applies to unfair methods of competition2 and 7,c7 includes any ,state law that has the same intent and effect as the laws under subparagraphs 7,a7 and 7,b74 7#c7 ,countermeasure ,the term countermeasure means an automated or a manual action with defensive intent to mitigate cyber threats4 7#d7 ,cyber threat information ,the term cyber threat information means information that indicates or describes-- 7,a7 a technical or operation vulnerability or a cyber threat mitigation measure2 7,b7 an action or operation to mitigate a cyber threat2 7,c7 malicious reconnaissance1 including anomalous patterns of network activity that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat2 7,d7 a method of defeating a technical control2 7,e7 a method of defeating an operational control2 7,f7 network activity or protocols known to be associated with a malicious cyber actor or that signify malicious cyber intent2 7,g7 a method of causing a user with legitimate access to an information system or information that is stored on1 processed by1 or transiting an information system to inadvertently enable the defeat of a technical or operational control2 7,h7 any other attribute of a cybersecurity threat or cyber defense information that would foster situational awareness of the ,united ,states cybersecurity posture1 if disclosure of such attribute or information is not otherwise prohibited by law2 7,i7 the actual or potential harm caused by a cyber incident1 including information exfiltrated when it is necessary in order to identify or describe a cybersecurity threat2 or 7,j7 any combination of subparagraphs 7,a7 through 7,i74 7#e7 ,cybersecurity center ,the term cybersecurity center means the ,department of ,defense ,cyber ,crime ,center1 the ,intelligence ,community ,incident ,response ,center1 the ,united ,states ,cyber ,command ,joint ,operations ,center1 the ,national ,cyber ,investigative ,joint ,task ,force1 the ,national ,security ,agency_/,central ,security ,service ,threat ,operations ,center1 the ,national ,cybersecurity and ,communications ,integration ,center1 and any successor center4 7#f7 ,cybersecurity system ,the term cybersecurity system means a system designed or employed to ensure the integrity1 confidentiality1 or availability of1 or to safeguard1 a system or network1 including measures intended to protect a system or network from-- 7,a7 efforts to degrade1 disrupt1 or destroy such system or network2 or 7,b7 theft or misappropriations of private or government information1 intellectual property1 or personally identifiable information4 7#g7 ,entity 7,a7 ,in general ,the term entity means any private entity1 non-,federal ,government agency or department1 or ,state1 tribal1 or local government agency or department 7including an officer1 employee1 or agent thereof74 7,b7 ,inclusions ,the term entity includes a government agency or department 7including an officer1 employee1 or agent thereof7 of the ,district of ,columbia1 the ,commonwealth of ,puerto ,rico1 the ,virgin ,islands1 ,guam1 ,american ,samoa1 the ,northern ,mariana ,islands1 and any other territory or possession of the ,united ,states4 7#h7 ,federal information system ,the term ,federal information system means an information system of a ,federal department or agency used or operated by an executive agency1 by a contractor of an executive agency1 or by another organization on behalf of an executive agency4 7#i7 ,information security ,the term information security means protecting information and information systems from disruption or unauthorized access1 use1 disclosure1 modification1 or destruction in order to provide-- 7,a7 integrity1 by guarding against improper information modification or destruction1 including by ensuring information nonrepudiation and authenticity2 7,b7 confidentiality1 by preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 or 7,c7 availability1 by ensuring timely and reliable access to and use of information4 7#aj7 ,information system ,the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#aa7 ,local government ,the term local government means any borough1 city1 county1 parish1 town1 township1 village1 or other general purpose political subdivision of a ,state4 7#ab7 ,malicious reconnaissance ,the term malicious reconnaissance means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system1 if such method is associated with a known or suspected cybersecurity threat4 7#ac7 ,operational control ,the term operational control means a security control for an information system that primarily is implemented and executed by people4 7#ad7 ,operational vulnerability ,the term operational vulnerability means any attribute of policy1 process1 or procedure that could enable or facilitate the defeat of an operational control4 7#ae7 ,private entity ,the term private entity means any individual or any private group1 organization1 or corporation1 including an officer1 employee1 or agent thereof4 7#af7 ,significant cyber incident ,the term significant cyber incident means a cyber incident resulting in1 or an attempted cyber incident that1 if successful1 would have resulted in-- 7,a7 the exfiltration from a ,federal information system of data that is essential to the operation of the ,federal information system2 or 7,b7 an incident in which an operational or technical control essential to the security or operation of a ,federal information system was defeated4 7#ag7 ,technical control ,the term technical control means a hardware or software restriction on1 or audit of1 access or use of an information system or information that is stored on1 processed by1 or transiting an information system that is intended to ensure the confidentiality1 integrity1 or availability of that system4 7#ah7 ,technical vulnerability ,the term technical vulnerability means any attribute of hardware or software that could enable or facilitate the defeat of a technical control4 7#ai7 ,tribal ,the term tribal has the meaning given the term ,indian tribe in section #d of the ,indian ,self-,determination and ,education ,assistance ,act 7#be ,u4,s4,c4 #dej;b74 #ajb4 ,authorization to share cyber threat information 7a7 ,voluntary disclosure 7#a7 ,private entities ,notwithstanding any other provision of law1 a private entity may1 for the purpose of preventing1 investigating1 or otherwise mitigating threats to information security1 on its own networks1 or as authorized by another entity1 on such entity's networks1 employ countermeasures and use cybersecurity systems in order to obtain1 identify1 or otherwise possess cyber threat information4 7#b7 ,entities ,notwithstanding any other provision of law1 an entity may disclose cyber threat information to-- 7,a7 a cybersecurity center2 or 7,b7 any other entity in order to assist with preventing1 investigating1 or otherwise mitigating threats to information security4 7#c7 ,information security providers ,if the cyber threat information described in paragraph 7#a7 is obtained1 identified1 or otherwise possessed in the course of providing information security products or services under contract to another entity1 that entity shall be given1 at any time prior to disclosure of such information1 a reasonable opportunity to authorize or prevent such disclosure1 to request anonymization of such information1 or to request that reasonable efforts be made to safeguard such information that identifies specific persons from unauthorized access or disclosure4 7b7 ,significant cyber incidents involving ,federal information systems 7#a7 ,in general ,an entity providing electronic communication services1 remote computing services1 or information security services to a ,federal department or agency shall inform the ,federal department or agency of a significant cyber incident involving the ,federal information system of that ,federal department or agency that-- 7,a7 is directly known to the entity as a result of providing such services2 7,b7 is directly related to the provision of such services by the entity2 and 7,c7 as determined by the entity1 has impeded or will impede the performance of a critical mission of the ,federal department or agency4 7#b7 ,advance coordination ,a ,federal department or agency receiving the services described in paragraph 7#a7 shall coordinate in advance with an entity described in paragraph 7#a7 to develop the parameters of any information that may be provided under paragraph 7#a71 including clarification of the type of significant cyber incident that will impede the performance of a critical mission of the ,federal department or agency4 7#c7 ,report ,a ,federal department or agency shall report information provided under this subsection to a cybersecurity center4 7#d7 ,construction ,any information provided to a cybersecurity center under paragraph 7#c7 shall be treated in the same manner as information provided to a cybersecurity center under subsection 7a74 7c7 ,information shared with or provided to a cybersecurity center ,cyber threat information provided to a cybersecurity center under this section-- 7#a7 may be disclosed to1 retained by1 and used by1 consistent with otherwise applicable ,federal law1 any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government for a cybersecurity purpose1 a national security purpose1 or in order to prevent1 investigate1 or prosecute any of the offenses listed in section #beaf of title #ah1 ,united ,states ,code1 and such information shall not be disclosed to1 retained by1 or used by any ,federal agency or department for any use not permitted under this paragraph2 7#b7 may1 with the prior written consent of the entity submitting such information1 be disclosed to and used by a ,state1 tribal1 or local government or government agency for the purpose of protecting information systems1 or in furtherance of preventing1 investigating1 or prosecuting a criminal act1 except that if the need for immediate disclosure prevents obtaining written consent1 such consent may be provided orally with subsequent documentation of such consent2 7#c7 shall be considered the commercial1 financial1 or proprietary information of the entity providing such information to the ,federal ,government and any disclosure outside the ,federal ,government may only be made upon the prior written consent by such entity and shall not constitute a waiver of any applicable privilege or protection provided by law1 except that if the need for immediate disclosure prevents obtaining written consent1 such consent may be provided orally with subsequent documentation of such consent2 7#d7 shall be deemed voluntarily shared information and exempt from disclosure under section #eeb of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local law requiring disclosure of information or records2 7#e7 shall be1 without discretion1 withheld from the public under section #eeb7;b77#c77;,b7 of title #e1 ,united ,states ,code1 and any ,state1 tribal1 or local law requiring disclosure of information or records2 7#f7 shall not be subject to the rules of any ,federal agency or department or any judicial doctrine regarding ex parte communications with a decisionmaking official2 7#g7 shall not1 if subsequently provided to a ,state1 tribal1 or local government or government agency1 otherwise be disclosed or distributed to any entity by such ,state1 tribal1 or local government or government agency without the prior written consent of the entity submitting such information1 notwithstanding any ,state1 tribal1 or local law requiring disclosure of information or records1 except that if the need for immediate disclosure prevents obtaining written consent1 such consent may be provided orally with subsequent documentation of such consent2 and 7#h7 shall not be directly used by any ,federal1 ,state1 tribal1 or local department or agency to regulate the lawful activities of an entity1 including activities relating to obtaining1 identifying1 or otherwise possessing cyber threat information1 except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this paragraph4 7d7 ,procedures relating to information sharing with a cybersecurity center ,not later than #fj days after the date of enactment of this ,act1 the heads of each department or agency containing a cybersecurity center shall jointly develop1 promulgate1 and submit to ,congress procedures to ensure that cyber threat information shared with or provided to-- 7#a7 a cybersecurity center under this section-- 7,a7 may be submitted to a cybersecurity center by an entity1 to the greatest extent possible1 through a uniform1 publicly available process or format that is easily accessible on the website of such cybersecurity center1 and that includes the ability to provide relevant details about the cyber threat information and written consent to any subsequent disclosures authorized by this paragraph2 7,b7 shall immediately be further shared with each cybersecurity center in order to prevent1 investigate1 or otherwise mitigate threats to information security across the ,federal ,government2 7,c7 is handled by the ,federal ,government in a reasonable manner1 including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods1 while fully accomplishing the objectives of this title1 and the ,federal ,government may undertake efforts consistent with this subparagraph to limit the impact on privacy and civil liberties of the sharing of cyber threat information with the ,federal ,government2 and 7,d7 except as provided in this section1 shall only be used1 disclosed1 or handled in accordance with the provisions of subsection 7c72 and 7#b7 a ,federal agency or department under subsection 7b7 is provided immediately to a cybersecurity center in order to prevent1 investigate1 or otherwise mitigate threats to information security across the ,federal ,government4 7e7 ,information shared between entities 7#a7 ,in general ,an entity sharing cyber threat information with another entity under this title may restrict the use or sharing of such information by such other entity4 7#b7 ,further sharing ,cyber threat information shared by any entity with another entity under this title-- 7,a7 shall only be further shared in accordance with any restrictions placed on the sharing of such information by the entity authorizing such sharing1 such as appropriate anonymization of such information2 and 7,b7 may not be used by any entity to gain an unfair competitive advantage to the detriment of the entity authorizing the sharing of such information1 except that the conduct described in paragraph 7#c7 shall not constitute unfair competitive conduct4 7#c7 ,information shared with ,state1 tribal1 or local government or government agency ,cyber threat information shared with a ,state1 tribal1 or local government or government agency under this title-- 7,a7 may1 with the prior written consent of the entity sharing such information1 be disclosed to and used by a ,state1 tribal1 or local government or government agency for the purpose of protecting information systems1 or in furtherance of preventing1 investigating1 or prosecuting a criminal act1 except if the need for immediate disclosure prevents obtaining written consent1 consent may be provided orally with subsequent documentation of the consent2 7,b7 shall be deemed voluntarily shared information and exempt from disclosure under any ,state1 tribal1 or local law requiring disclosure of information or records2 7,c7 shall not be disclosed or distributed to any entity by the ,state1 tribal1 or local government or government agency without the prior written consent of the entity submitting such information1 notwithstanding any ,state1 tribal1 or local law requiring disclosure of information or records1 except if the need for immediate disclosure prevents obtaining written consent1 consent may be provided orally with subsequent documentation of the consent2 and 7,d7 shall not be directly used by any ,state1 tribal1 or local department or agency to regulate the lawful activities of an entity1 including activities relating to obtaining1 identifying1 or otherwise possessing cyber threat information1 except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this subparagraph4 7#d7 ,antitrust exemption ,the exchange or provision of cyber threat information or assistance between #b or more private entities under this title shall not be considered a violation of any provision of antitrust laws if exchanged or provided in order to assist with-- 7,a7 facilitating the prevention1 investigation1 or mitigation of threats to information security2 or 7,b7 communicating or disclosing of cyber threat information to help prevent1 investigate or otherwise mitigate the effects of a threat to information security4 7#e7 ,no right or benefit ,the provision of cyber threat information to an entity under this section shall not create a right or a benefit to similar information by such entity or any other entity4 7f7 ,federal preemption 7#a7 ,in general ,this section supersedes any statute or other law of a ,state or political subdivision of a ,state that restricts or otherwise expressly regulates an activity authorized under this section4 7#b7 ,state law enforcement ,nothing in this section shall be construed to supersede any statute or other law of a ,state or political subdivision of a ,state concerning the use of authorized law enforcement techniques4 7#c7 ,public disclosure ,no information shared with or provided to a ,state1 tribal1 or local government or government agency pursuant to this section shall be made publicly available pursuant to any ,state1 tribal1 or local law requiring disclosure of information or records4 7g7 ,civil and criminal liability 7#a7 ,general protections 7,a7 ,private entities ,no cause of action shall lie or be maintained in any court against any private entity for-- 7i7 the use of countermeasures and cybersecurity systems as authorized by this title2 7ii7 the use1 receipt1 or disclosure of any cyber threat information as authorized by this title2 or 7iii7 the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such private entity4 7,b7 ,entities ,no cause of action shall lie or be maintained in any court against any entity for-- 7i7 the use1 receipt1 or disclosure of any cyber threat information as authorized by this title2 or 7ii7 the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such entity4 7#b7 ,construction ,nothing in this subsection shall be construed as creating any immunity against1 or otherwise affecting1 any action brought by the ,federal ,government1 or any agency or department thereof1 to enforce any law1 ,executive order1 or procedure governing the appropriate handling1 disclosure1 and use of classified information4 7h7 ,otherwise lawful disclosures ,nothing in this section shall be construed to limit or prohibit otherwise lawful disclosures of communications1 records1 or other information by a private entity to any other governmental or private entity not covered under this section4 7i7 ,whistleblower protection ,nothing in this ,act shall be construed to preempt or preclude any employee from exercising rights currently provided under any whistleblower law1 rule1 or regulation4 7j7 ,relationship to ,other ,laws ,the submission of cyber threat information under this section to a cybersecurity center shall not affect any requirement under any other provision of law for an entity to provide information to the ,federal ,government4 #ajc4 ,information sharing by the ,federal ,government 7a7 ,classified information 7#a7 ,procedures ,consistent with the protection of intelligence sources and methods1 and as otherwise determined appropriate1 the ,director of ,national ,intelligence and the ,secretary of ,defense1 in consultation with the heads of the appropriate ,federal departments or agencies1 shall develop and promulgate procedures to facilitate and promote-- 7,a7 the immediate sharing1 through the cybersecurity centers1 of classified cyber threat information in the possession of the ,federal ,government with appropriately cleared representatives of any appropriate entity2 and 7,b7 the declassification and immediate sharing1 through the cybersecurity centers1 with any entity or1 if appropriate1 public availability of cyber threat information in the possession of the ,federal ,government4 7#b7 ,handling of classified information ,the procedures developed under paragraph 7#a7 shall ensure that each entity receiving classified cyber threat information pursuant to this section has acknowledged in writing the ongoing obligation to comply with all laws1 ,executive orders1 and procedures concerning the appropriate handling1 disclosure1 or use of classified information4 7b7 ,unclassified cyber threat information ,the heads of each department or agency containing a cybersecurity center shall jointly develop and promulgate procedures that ensure that1 consistent with the provisions of this section1 unclassified1 including controlled unclassified1 cyber threat information in the possession of the ,federal ,government-- 7#a7 is shared1 through the cybersecurity centers1 in an immediate and adequate manner with appropriate entities2 and 7#b7 if appropriate1 is made publicly available4 7c7 ,development of procedures 7#a7 ,in general ,the procedures developed under this section shall incorporate1 to the greatest extent possible1 existing processes utilized by sector specific information sharing and analysis centers4 7#b7 ,coordination with entities ,in developing the procedures required under this section1 the ,director of ,national ,intelligence and the heads of each department or agency containing a cybersecurity center shall coordinate with appropriate entities to ensure that protocols are implemented that will facilitate and promote the sharing of cyber threat information by the ,federal ,government4 7d7 ,additional ,responsibilities of ,cybersecurity ,centers ,consistent with section #ajb1 a cybersecurity center shall-- 7#a7 facilitate information sharing1 interaction1 and collaboration among and between cybersecurity centers and-- 7,a7 other ,federal entities2 7,b7 any entity2 and 7,c7 international partners1 in consultation with the ,secretary of ,state2 7#b7 disseminate timely and actionable cybersecurity threat1 vulnerability1 mitigation1 and warning information1 including alerts1 advisories1 indicators1 signatures1 and mitigation and response measures1 to improve the security and protection of information systems2 and 7#c7 coordinate with other ,federal entities1 as appropriate1 to integrate information from across the ,federal ,government to provide situational awareness of the cybersecurity posture of the ,united ,states4 7e7 ,sharing within the ,federal ,government ,the heads of appropriate ,federal departments and agencies shall ensure that cyber threat information in the possession of such ,federal departments or agencies that relates to the prevention1 investigation1 or mitigation of threats to information security across the ,federal ,government is shared effectively with the cybersecurity centers4 7f7 ,submission to ,congress ,not later than #fj days after the date of enactment of this ,act1 the ,director of ,national ,intelligence1 in coordination with the appropriate head of a department or an agency containing a cybersecurity center1 shall submit the procedures required by this section to ,congress4 #ajd4 ,construction 7a7 ,information ,sharing ,relationships ,nothing in this title shall be construed-- 7#a7 to limit or modify an existing information sharing relationship2 7#b7 to prohibit a new information sharing relationship2 7#c7 to require a new information sharing relationship between any entity and the ,federal ,government1 except as specified under section #ajb7;b72 or 7#d7 to modify the authority of a department or agency of the ,federal ,government to protect sources and methods and the national security of the ,united ,states4 7b7 ,anti-,tasking ,restriction ,nothing in this title shall be construed to permit the ,federal ,government-- 7#a7 to require an entity to share information with the ,federal ,government1 except as expressly provided under section #ajb7;b72 or 7#b7 to condition the sharing of cyber threat information with an entity on such entity's provision of cyber threat information to the ,federal ,government4 7c7 ,no liability for ,non-,participation ,nothing in this title shall be construed to subject any entity to liability for choosing not to engage in the voluntary activities authorized under this title4 7d7 ,use and ,retention of ,information ,nothing in this title shall be construed to authorize1 or to modify any existing authority of1 a department or agency of the ,federal ,government to retain or use any information shared under section #ajb for any use other than a use permitted under subsection #ajb7;c77#a74 7e7 ,no new funding ,an applicable ,federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available1 through such means as the head of the agency considers appropriate4 #aje4 ,report on implementation 7a7 ,content of report ,not later than #a year after the date of enactment of this ,act1 and biennially thereafter1 the heads of each department or agency containing a cybersecurity center shall jointly submit1 in coordination with the privacy and civil liberties officials of such departments or agencies and the ,privacy and ,civil ,liberties ,oversight ,board1 a detailed report to ,congress concerning the implementation of this title1 including-- 7#a7 an assessment of the sufficiency of the procedures developed under section #ajc of this ,act in ensuring that cyber threat information in the possession of the ,federal ,government is provided in an immediate and adequate manner to appropriate entities or1 if appropriate1 is made publicly available2 7#b7 an assessment of whether information has been appropriately classified and an accounting of the number of security clearances authorized by the ,federal ,government for purposes of this title2 7#c7 a review of the type of cyber threat information shared with a cybersecurity center under section #ajb of this ,act1 including whether such information meets the definition of cyber threat information under section #aja1 the degree to which such information may impact the privacy and civil liberties of individuals1 any appropriate metrics to determine any impact of the sharing of such information with the ,federal ,government on privacy and civil liberties1 and the adequacy of any steps taken to reduce such impact2 7#d7 a review of actions taken by the ,federal ,government based on information provided to a cybersecurity center under section #ajb of this ,act1 including the appropriateness of any subsequent use under section #ajb7;c77#a7 of this ,act and whether there was inappropriate stovepiping within the ,federal ,government of any such information2 7#e7 a description of any violations of the requirements of this title by the ,federal ,government2 7#f7 a classified list of entities that received classified information from the ,federal ,government under section #ajc of this ,act and a description of any indication that such information may not have been appropriately handled2 7#g7 a summary of any breach of information security1 if known1 attributable to a specific failure by any entity or the ,federal ,government to act on cyber threat information in the possession of such entity or the ,federal ,government that resulted in substantial economic harm or injury to a specific entity or the ,federal ,government2 and 7#h7 any recommendation for improvements or modifications to the authorities under this title4 7b7 ,form of report ,the report under subsection 7a7 shall be submitted in unclassified form1 but shall include a classified annex4 #ajf4 ,inspector ,general review 7a7 ,in general ,the ,council of the ,inspectors ,general on ,integrity and ,efficiency are authorized to review compliance by the cybersecurity centers1 and by any ,federal department or agency receiving cyber threat information from such cybersecurity centers1 with the procedures required under section #ajb of this ,act4 7b7 ,scope of review ,the review under subsection 7a7 shall consider whether the ,federal ,government has handled such cyber threat information in a reasonable manner1 including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods1 while fully accomplishing the objectives of this title4 7c7 ,report to ,congress ,each review conducted under this section shall be provided to ,congress not later than #cj days after the date of completion of the review4 #ajg4 ,technical amendments ,section #eeb7;b7 of title #e1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#h71 by striking or2 7#b7 in paragraph 7#i71 by striking wells4 and inserting wells2 or2 and 7#c7 by adding at the end the following3 7#aj7 information shared with or provided to a cybersecurity center under section #ajb of title ,i of the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac4 4 #ajh4 ,access to classified information 7a7 ,authorization required ,no person shall be provided with access to classified information 7as defined in section #f4a of ,executive ,order #acebf 7#ej ,u4,s4,c4 #dce note2 relating to classified national security information77 relating to cyber security threats or cyber security vulnerabilities under this title without the appropriate security clearances4 7b7 ,security clearances ,the appropriate ,federal agencies or departments shall1 consistent with applicable procedures and requirements1 and if otherwise deemed appropriate1 assist an individual in timely obtaining an appropriate security clearance where such individual has been determined to be eligible for such clearance and has a need-to-know 7as defined in section #f4a of that ,executive order7 classified information to carry out this title4 ,,ii ,coordination of ,federal information security policy #bja4 ,coordination of ,federal information security policy 7a7 ,in ,general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking subchapters ,,ii and ,,iii and inserting the following3 ,,ii ,information ,security #ceea4 ,purposes ,the purposes of this subchapter are-- 7#a7 to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support ,federal operations and assets2 7#b7 to recognize the highly networked nature of the current ,federal computing environment and provide effective government-wide management of policies1 directives1 standards1 and guidelines1 as well as effective and nimble oversight of and response to information security risks1 including coordination of information security efforts throughout the ,federal civilian1 national security1 and law enforcement communities2 7#c7 to provide for development and maintenance of controls required to protect agency information and information systems and contribute to the overall improvement of agency information security posture2 7#d7 to provide for the development of tools and methods to assess and respond to real-time situational risk for ,federal information system operations and assets2 and 7#e7 to provide a mechanism for improving agency information security programs through continuous monitoring of agency information systems and streamlined reporting requirements rather than overly prescriptive manual reporting4 #ceeb4 ,definitions ,in this subchapter3 7#a7 ,adequate security ,the term adequate security means security commensurate with the risk and magnitude of the harm resulting from the unauthorized access to or loss1 misuse1 destruction1 or modification of information4 7#b7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd4 7#c7 ,cybersecurity center ,the term cybersecurity center means the ,department of ,defense ,cyber ,crime ,center1 the ,intelligence ,community ,incident ,response ,center1 the ,united ,states ,cyber ,command ,joint ,operations ,center1 the ,national ,cyber ,investigative ,joint ,task ,force1 the ,national ,security ,agency_/,central ,security ,service ,threat ,operations ,center1 the ,national ,cybersecurity and ,communications ,integration ,center1 and any successor center4 7#d7 ,cyber threat information ,the term cyber threat information means information that indicates or describes-- 7,a7 a technical or operation vulnerability or a cyber threat mitigation measure2 7,b7 an action or operation to mitigate a cyber threat2 7,c7 malicious reconnaissance1 including anomalous patterns of network activity that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat2 7,d7 a method of defeating a technical control2 7,e7 a method of defeating an operational control2 7,f7 network activity or protocols known to be associated with a malicious cyber actor or that signify malicious cyber intent2 7,g7 a method of causing a user with legitimate access to an information system or information that is stored on1 processed by1 or transiting an information system to inadvertently enable the defeat of a technical or operational control2 7,h7 any other attribute of a cybersecurity threat or cyber defense information that would foster situational awareness of the ,united ,states cybersecurity posture1 if disclosure of such attribute or information is not otherwise prohibited by law2 7,i7 the actual or potential harm caused by a cyber incident1 including information exfiltrated when it is necessary in order to identify or describe a cybersecurity threat2 or 7,j7 any combination of subparagraphs 7,a7 through 7,i74 7#e7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget unless otherwise specified4 7#f7 ,environment of operation ,the term environment of operation means the information system and environment in which those systems operate1 including changing threats1 vulnerabilities1 technologies1 and missions and business practices4 7#g7 ,federal information system ,the term ,federal information system means an information system used or operated by an executive agency1 by a contractor of an executive agency1 or by another organization on behalf of an executive agency4 7#h7 ,incident ,the term incident means an occurrence that-- 7,a7 actually or imminently jeopardizes the integrity1 confidentiality1 or availability of an information system or the information that system controls1 processes1 stores1 or transmits2 or 7,b7 constitutes a violation of law or an imminent threat of violation of a law1 a security policy1 a security procedure1 or an acceptable use policy4 7#i7 ,information resources ,the term information resources has the meaning given the term in section #cejb of title #dd4 7#aj7 ,information security ,the term information security means protecting information and information systems from disruption or unauthorized access1 use1 disclosure1 modification1 or destruction in order to provide-- 7,a7 integrity1 by guarding against improper information modification or destruction1 including by ensuring information nonrepudiation and authenticity2 7,b7 confidentiality1 by preserving authorized restrictions on access and disclosure1 including means for protecting personal privacy and proprietary information2 or 7,c7 availability1 by ensuring timely and reliable access to and use of information4 7#aa7 ,information system ,the term information system has the meaning given the term in section #cejb of title #dd4 7#ab7 ,information technology ,the term information technology has the meaning given the term in section #aaaja of title #dj4 7#ac7 ,malicious reconnaissance ,the term malicious reconnaissance means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system1 if such method is associated with a known or suspected cybersecurity threat4 7#ad7 ,national security system 7,a7 ,in general ,the term national security system means any information system 7including any telecommunications system7 used or operated by an agency or by a contractor of an agency1 or other organization on behalf of an agency-- 7i7 the function1 operation1 or use of which-- 7,i7 involves intelligence activities2 7,,ii7 involves cryptologic activities related to national security2 7,,iii7 involves command and control of military forces2 7,,iv7 involves equipment that is an integral part of a weapon or weapons system2 or 7,v7 subject to subparagraph 7,b71 is critical to the direct fulfillment of military or intelligence missions2 or 7ii7 is protected at all times by procedures established for information that have been specifically authorized under criteria established by an ,executive order or an ,act of ,congress to be kept classified in the interest of national defense or foreign policy4 7,b7 ,limitation ,subparagraph 7,a77i77,v7 does not include a system that is to be used for routine administrative and business applications 7including payroll1 finance1 logistics1 and personnel management applications74 7#ae7 ,operational control ,the term operational control means a security control for an information system that primarily is implemented and executed by people4 7#af7 ,person ,the term person has the meaning given the term in section #cejb of title #dd4 7#ag7 ,secretary ,the term ,secretary means the ,secretary of ,commerce unless otherwise specified4 7#ah7 ,security control ,the term security control means the management1 operational1 and technical controls1 including safeguards or countermeasures1 prescribed for an information system to protect the confidentiality1 integrity1 and availability of the system and its information4 7#ai7 ,significant cyber incident ,the term significant cyber incident means a cyber incident resulting in1 or an attempted cyber incident that1 if successful1 would have resulted in-- 7,a7 the exfiltration from a ,federal information system of data that is essential to the operation of the ,federal information system2 or 7,b7 an incident in which an operational or technical control essential to the security or operation of a ,federal information system was defeated4 7#bj7 ,technical control ,the term technical control means a hardware or software restriction on1 or audit of1 access or use of an information system or information that is stored on1 processed by1 or transiting an information system that is intended to ensure the confidentiality1 integrity1 or availability of that system4 #ceec4 ,federal information security authority and coordination 7a7 ,in general ,the ,secretary1 in consultation with the ,secretary of ,homeland ,security1 shall-- 7#a7 issue compulsory and binding policies and directives governing agency information security operations1 and require implementation of such policies and directives1 including-- 7,a7 policies and directives consistent with the standards and guidelines promulgated under section #aacca of title #dj to identify and provide information security protections prioritized and commensurate with the risk and impact resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7i7 information collected or maintained by or on behalf of an agency2 or 7ii7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7,b7 minimum operational requirements for the ,federal ,government to protect agency information systems and provide common situational awareness across all agency information systems2 7,c7 reporting requirements1 consistent with relevant law1 regarding information security incidents and cyber threat information2 7,d7 requirements for agencywide information security programs2 7,e7 performance requirements and metrics for the security of agency information systems2 7,f7 training requirements to ensure that agencies are able to fully and timely comply with the policies and directives issued by the ,secretary under this subchapter2 7,g7 training requirements regarding privacy1 civil rights1 and civil liberties1 and information oversight for agency information security personnel2 7,h7 requirements for the annual reports to the ,secretary under section #ceed7;d72 7,i7 any other information security operations or information security requirements as determined by the ,secretary in coordination with relevant agency heads2 and 7,j7 coordinating the development of standards and guidelines under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 with agencies and offices operating or exercising control of national security systems 7including the ,national ,security ,agency7 to assure1 to the maximum extent feasible1 that such standards and guidelines are complementary with standards and guidelines developed for national security systems2 7#b7 review the agencywide information security programs under section #ceed2 and 7#c7 designate an individual or an entity at each cybersecurity center1 among other responsibilities-- 7,a7 to receive reports and information about information security incidents1 cyber threat information1 and deterioration of security control affecting agency information systems2 and 7,b7 to act on or share the information under subparagraph 7,a7 in accordance with this subchapter4 7b7 ,considerations ,when issuing policies and directives under subsection 7a71 the ,secretary shall consider any applicable standards or guidelines developed by the ,national ,institute of ,standards and ,technology under section #aacca of title #dj4 7c7 ,limitation of authority ,the authorities of the ,secretary under this section shall not apply to national security systems4 ,information security policies1 directives1 standards and guidelines for national security systems shall be overseen as directed by the ,president and1 in accordance with that direction1 carried out under the authority of the heads of agencies that operate or exercise authority over such national security systems4 7d7 ,statutory construction ,nothing in this subchapter shall be construed to alter or amend any law regarding the authority of any head of an agency over such agency4 #ceed4 ,agency responsibilities 7a7 ,in general ,the head of each agency shall-- 7#a7 be responsible for-- 7,a7 complying with the policies and directives issued under section #ceec2 7,b7 providing information security protections commensurate with the risk resulting from unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of-- 7i7 information collected or maintained by the agency or by a contractor of an agency or other organization on behalf of an agency2 and 7ii7 information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency2 7,c7 complying with the requirements of this subchapter1 including-- 7i7 information security standards and guidelines promulgated under section #aacca of title #dj2 7ii7 for any national security systems operated or controlled by that agency1 information security policies1 directives1 standards and guidelines issued as directed by the ,president2 and 7iii7 for any non-national security systems operated or controlled by that agency1 information security policies1 directives1 standards and guidelines issued under section #ceec2 7,d7 ensuring that information security management processes are integrated with agency strategic and operational planning processes2 7,e7 reporting and sharing1 for an agency operating or exercising control of a national security system1 information about information security incidents1 cyber threat information1 and deterioration of security controls to the individual or entity designated at each cybersecurity center and to other appropriate entities consistent with policies and directives for national security systems issued as directed by the ,president2 and 7,f7 reporting and sharing1 for those agencies operating or exercising control of non-national security systems1 information about information security incidents1 cyber threat information1 and deterioration of security controls to the individual or entity designated at each cybersecurity center and to other appropriate entities consistent with policies and directives for non-national security systems as prescribed under section #ceec7;a71 including information to assist the entity designated under section #ceee7;a7 with the ongoing security analysis under section #ceee2 7#b7 ensure that each senior agency official provides information security for the information and information systems that support the operations and assets under the senior agency official's control1 including by-- 7,a7 assessing the risk and impact that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of such information or information systems2 7,b7 determining the level of information security appropriate to protect such information and information systems in accordance with policies and directives issued under section #ceec7;a71 and standards and guidelines promulgated under section #aacca of title #dj for information security classifications and related requirements2 7,c7 implementing policies1 procedures1 and capabilities to reduce risks to an acceptable level in a cost-effective manner2 7,d7 actively monitoring the effective implementation of information security controls and techniques2 and 7,e7 reporting information about information security incidents1 cyber threat information1 and deterioration of security controls in a timely and adequate manner to the entity designated under section #ceec7;a77#c7 in accordance with paragraph 7#a72 7#c7 assess and maintain the resiliency of information technology systems critical to agency mission and operations2 7#d7 designate the agency ,inspector ,general 7or an independent entity selected in consultation with the ,director and the ,council of ,inspectors ,general on ,integrity and ,efficiency if the agency does not have an ,inspector ,general7 to conduct the annual independent evaluation required under section #ceef1 and allow the agency ,inspector ,general to contract with an independent entity to perform such evaluation2 7#e7 delegate to the ,chief ,information ,officer or equivalent 7or to a senior agency official who reports to the ,chief ,information ,officer or equivalent7-- 7,a7 the authority and primary responsibility to implement an agencywide information security program2 and 7,b7 the authority to provide information security for the information collected and maintained by the agency 7or by a contractor1 other agency1 or other source on behalf of the agency7 and for the information systems that support the operations1 assets1 and mission of the agency 7including any information system provided or managed by a contractor1 other agency1 or other source on behalf of the agency72 7#f7 delegate to the appropriate agency official 7who is responsible for a particular agency system or subsystem7 the responsibility to ensure and enforce compliance with all requirements of the agency's agencywide information security program in coordination with the ,chief ,information ,officer or equivalent 7or the senior agency official who reports to the ,chief ,information ,officer or equivalent7 under paragraph 7#e72 7#g7 ensure that an agency has trained personnel who have obtained any necessary security clearances to permit them to assist the agency in complying with this subchapter2 7#h7 ensure that the ,chief ,information ,officer or equivalent 7or the senior agency official who reports to the ,chief ,information ,officer or equivalent7 under paragraph 7#e71 in coordination with other senior agency officials1 reports to the agency head on the effectiveness of the agencywide information security program1 including the progress of any remedial actions2 and 7#i7 ensure that the ,chief ,information ,officer or equivalent 7or the senior agency official who reports to the ,chief ,information ,officer or equivalent7 under paragraph 7#e7 has the necessary qualifications to administer the functions described in this subchapter and has information security duties as a primary duty of that official4 7b7 ,chief ,information ,officers ,each ,chief ,information ,officer or equivalent 7or the senior agency official who reports to the ,chief ,information ,officer or equivalent7 under subsection 7a77#e7 shall-- 7#a7 establish and maintain an enterprise security operations capability that on a continuous basis-- 7,a7 detects1 reports1 contains1 mitigates1 and responds to information security incidents that impair adequate security of the agency's information or information system in a timely manner and in accordance with the policies and directives under section #ceec2 and 7,b7 reports any information security incident under subparagraph 7,a7 to the entity designated under section #ceee2 7#b7 develop1 maintain1 and oversee an agencywide information security program2 7#c7 develop1 maintain1 and oversee information security policies1 procedures1 and control techniques to address applicable requirements1 including requirements under section #ceec of this title and section #aacca of title #dj2 and 7#d7 train and oversee the agency personnel who have significant responsibility for information security with respect to that responsibility4 7c7 ,agencywide information security programs 7#a7 ,in general ,each agencywide information security program under subsection 7b77#b7 shall include-- 7,a7 relevant security risk assessments1 including technical assessments and others related to the acquisition process2 7,b7 security testing commensurate with risk and impact2 7,c7 mitigation of deterioration of security controls commensurate with risk and impact2 7,d7 risk-based continuous monitoring and threat assessment of the operational status and security of agency information systems to enable evaluation of the effectiveness of and compliance with information security policies1 procedures1 and practices1 including a relevant and appropriate selection of security controls of information systems identified in the inventory under section #ceje7;c72 7,e7 operation of appropriate technical capabilities in order to detect1 mitigate1 report1 and respond to information security incidents1 cyber threat information1 and deterioration of security controls in a manner that is consistent with the policies and directives under section #ceec1 including-- 7i7 mitigating risks associated with such information security incidents2 7ii7 notifying and consulting with the entity designated under section #ceee2 and 7iii7 notifying and consulting with1 as appropriate-- 7,i7 law enforcement and the relevant ,office of the ,inspector ,general2 and 7,,ii7 any other entity1 in accordance with law and as directed by the ,president2 7,f7 a process to ensure that remedial action is taken to address any deficiencies in the information security policies1 procedures1 and practices of the agency2 and 7,g7 a plan and procedures to ensure the continuity of operations for information systems that support the operations and assets of the agency4 7#b7 ,risk management strategies ,each agencywide information security program under subsection 7b77#b7 shall include the development and maintenance of a risk management strategy for information security4 ,the risk management strategy shall include-- 7,a7 consideration of information security incidents1 cyber threat information1 and deterioration of security controls2 and 7,b7 consideration of the consequences that could result from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of information and information systems that support the operations and assets of the agency1 including any information system provided or managed by a contractor1 other agency1 or other source on behalf of the agency4 7#c7 ,policies and procedures ,each agencywide information security program under subsection 7b77#b7 shall include policies and procedures that-- 7,a7 are based on the risk management strategy under paragraph 7#b72 7,b7 reduce information security risks to an acceptable level in a cost-effective manner2 7,c7 ensure that cost-effective and adequate information security is addressed as part of the acquisition and ongoing management of each agency information system2 and 7,d7 ensure compliance with-- 7i7 this subchapter2 and 7ii7 any other applicable requirements4 7#d7 ,training requirements ,each agencywide information security program under subsection 7b77#b7 shall include information security1 privacy1 civil rights1 civil liberties1 and information oversight training that meets any applicable requirements under section #ceec4 ,the training shall inform each information security personnel that has access to agency information systems 7including contractors and other users of information systems that support the operations and assets of the agency7 of-- 7,a7 the information security risks associated with the information security personnel's activities2 and 7,b7 the individual's responsibility to comply with the agency policies and procedures that reduce the risks under subparagraph 7,a74 7d7 ,annual report ,each agency shall submit a report annually to the ,secretary of ,homeland ,security on its agencywide information security program and information systems4 #ceee4 ,multiagency ongoing threat assessment 7a7 ,implementation ,the ,director of the ,office of ,management and ,budget1 in coordination with the ,secretary of ,homeland ,security1 shall designate an entity to implement ongoing security analysis concerning agency information systems-- 7#a7 based on cyber threat information2 7#b7 based on agency information system and environment of operation changes1 including-- 7,a7 an ongoing evaluation of the information system security controls2 and 7,b7 the security state1 risk level1 and environment of operation of an agency information system1 including-- 7i7 a change in risk level due to a new cyber threat2 7ii7 a change resulting from a new technology2 7iii7 a change resulting from the agency's mission2 and 7iv7 a change resulting from the business practice2 and 7#c7 using automated processes to the maximum extent possible-- 7,a7 to increase information system security2 7,b7 to reduce paper-based reporting requirements2 and 7,c7 to maintain timely and actionable knowledge of the state of the information system security4 7b7 ,standards ,the ,national ,institute of ,standards and ,technology may promulgate standards1 in coordination with the ,secretary of ,homeland ,security1 to assist an agency with its duties under this section4 7c7 ,compliance ,the head of each appropriate department and agency shall be responsible for ensuring compliance and implementing necessary procedures to comply with this section4 ,the head of each appropriate department and agency1 in consultation with the ,director of the ,office of ,management and ,budget and the ,secretary of ,homeland ,security1 shall-- 7#a7 monitor compliance under this section2 7#b7 develop a timeline and implement for the department or agency-- 7,a7 adoption of any technology1 system1 or method that facilitates continuous monitoring and threat assessments of an agency information system2 7,b7 adoption or updating of any technology1 system1 or method that prevents1 detects1 or remediates a significant cyber incident to a ,federal information system of the department or agency that has impeded1 or is reasonably likely to impede1 the performance of a critical mission of the department or agency2 and 7,c7 adoption of any technology1 system1 or method that satisfies a requirement under this section4 7d7 ,limitation of ,authority ,the authorities of the ,director of the ,office of ,management and ,budget and of the ,secretary of ,homeland ,security under this section shall not apply to national security systems4 7e7 ,report ,not later than #f months after the date of enactment of the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac1 the ,government ,accountability ,office shall issue a report evaluating each agency's status toward implementing this section4 #ceef4 ,independent evaluations 7a7 ,in general ,the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 in consultation with the ,director and the ,secretary of ,homeland ,security1 the ,secretary of ,commerce1 and the ,secretary of ,defense1 shall issue and maintain criteria for the timely1 cost-effective1 risk-based1 and independent evaluation of each agencywide information security program 7and practices7 to determine the effectiveness of the agencywide information security program 7and practices74 ,the criteria shall include measures to assess any conflicts of interest in the performance of the evaluation and whether the agencywide information security program includes appropriate safeguards against disclosure of information where such disclosure may adversely affect information security4 7b7 ,annual independent evaluations ,each agency shall perform an annual independent evaluation of its agencywide information security program 7and practices7 in accordance with the criteria under subsection 7a74 7c7 ,distribution of reports ,not later than #cj days after receiving an independent evaluation under subsection 7b71 each agency head shall transmit a copy of the independent evaluation to the ,secretary of ,homeland ,security1 the ,secretary of ,commerce1 and the ,secretary of ,defense4 7d7 ,national security systems ,evaluations involving national security systems shall be conducted as directed by ,president4 #ceeg4 ,national security systems4 ,the head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency-- 7#a7 provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access1 use1 disclosure1 disruption1 modification1 or destruction of the information contained in such system2 and 7#b7 implements information security policies and practices as required by standards and guidelines for national security systems1 issued in accordance with law and as directed by the ,president4 4 7b7 ,savings ,provisions 7#a7 ,policy and compliance guidance ,policy and compliance guidance issued by the ,director before the date of enactment of this ,act under section #cedc7;a77#a7 of title #dd1 ,united ,states ,code 7as in effect on the day before the date of enactment of this ,act71 shall continue in effect1 according to its terms1 until modified1 terminated1 superseded1 or repealed pursuant to section #ceec7;a77#a7 of title #dd1 ,united ,states ,code4 7#b7 ,standards and guidelines ,standards and guidelines issued by the ,secretary of ,commerce or by the ,director before the date of enactment of this ,act under section #aacca7;a77#a7 of title #dj1 ,united ,states ,code1 7as in effect on the day before the date of enactment of this ,act7 shall continue in effect1 according to their terms1 until modified1 terminated1 superseded1 or repealed pursuant to section #aacca7;a77#a7 of title #dj1 ,united ,states ,code1 as amended by this ,act4 7c7 ,technical and conforming amendments 7#a7 ,chapter analysis ,the chapter analysis for chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by striking the items relating to sections #ceca through #cech2 7,b7 by striking the items relating to sections #ceda through #cedi2 and 7,c7 by inserting the following3 #ceea4 ,purposes4 #ceeb4 ,definitions4 #ceec4 ,federal information security authority and coordination4 #ceed4 ,agency responsibilities4 #ceee4 ,multiagency ongoing threat assessment4 #ceef4 ,independent evaluations4 #ceeg4 ,national security systems4 4 7#b7 ,other references 7,a7 ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is amended by striking section #cecb7c7 and inserting section #ceeb4 7,b7 ,section #bbbb7;j77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb4 7,c7 ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended1 by striking section #cedb7;b77#b7 and inserting section #ceeb4 7,d7 ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb4 7,e7 ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7i7 in subsection 7a77#b71 by striking section #cecb7;b77#b7 and inserting section #ceeb2 7ii7 in subsection 7c77#c71 by striking ,director of the ,office of ,management and ,budget and inserting ,secretary of ,commerce2 7iii7 in subsection 7d77#a71 by striking ,director of the ,office of ,management and ,budget and inserting ,secretary of ,commerce2 7iv7 in subsection 7d77#h7 by striking ,director of the ,office of ,management and ,budget and inserting ,secretary of ,commerce2 7v7 in subsection 7d77#h71 by striking submitted to the ,director and inserting submitted to the ,secretary2 7vi7 in subsection 7e77#b71 by striking section #cecb7a7 of such title and inserting section #ceeb of title #dd2 and 7vii7 in subsection 7e77#e71 by striking section #cecb7;b77#b7 of such title and inserting section #ceeb of title #dd4 7,f7 ,section #h7;d77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7;d77#a77 is amended by striking section #cecd7;b7 and inserting section #ceed7;b77#b74 #bjb4 ,management of information technology 7a7 ,in general ,section #aacca of title #dj1 ,united ,states ,code1 is amended to read as follows3 #aacca4 ,responsibilities for ,federal information systems standards 7a7 ,standards and guidelines 7#a7 ,authority to prescribe ,except as provided under paragraph 7#b71 the ,secretary of ,commerce shall prescribe standards and guidelines pertaining to ,federal information systems-- 7,a7 in consultation with the ,secretary of ,homeland ,security2 and 7,b7 on the basis of standards and guidelines developed by the ,national ,institute of ,standards and ,technology under paragraphs 7#b7 and 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a77#b7 and 7a77#c774 7#b7 ,national security systems ,standards and guidelines for national security systems shall be developed1 prescribed1 enforced1 and overseen as otherwise authorized by law and as directed by the ,president4 7b7 ,mandatory standards and guidelines 7#a7 ,authority to make mandatory standards and guidelines ,the ,secretary of ,commerce shall make standards and guidelines under subsection 7a77#a7 compulsory and binding to the extent determined necessary by the ,secretary of ,commerce to improve the efficiency of operation or security of ,federal information systems4 7#b7 ,required mandatory standards and guidelines 7,a7 ,in general ,standards and guidelines under subsection 7a77#a7 shall include information security standards that-- 7i7 provide minimum information security requirements as determined under section #bj7;b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;b772 and 7ii7 are otherwise necessary to improve the security of ,federal information and information systems4 7,b7 ,binding effect ,information security standards under subparagraph 7,a7 shall be compulsory and binding4 7c7 ,exercise of authority ,to ensure fiscal and policy consistency1 the ,secretary of ,commerce shall exercise the authority conferred by this section subject to direction by the ,president and in coordination with the ,director4 7d7 ,application of more stringent standards and guidelines ,the head of an executive agency may employ standards for the cost-effective information security for information systems within or under the supervision of that agency that are more stringent than the standards and guidelines the ,secretary of ,commerce prescribes under this section if the more stringent standards and guidelines-- 7#a7 contain at least the applicable standards and guidelines made compulsory and binding by the ,secretary of ,commerce2 and 7#b7 are otherwise consistent with the policies1 directives1 and implementation memoranda issued under section #ceec7;a7 of title #dd4 7e7 ,decisions on promulgation of standards and guidelines ,the decision by the ,secretary of ,commerce regarding the promulgation of any standard or guideline under this section shall occur not later than #f months after the date of submission of the proposed standard to the ,secretary of ,commerce by the ,national ,institute of ,standards and ,technology under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7f7 ,notice and comment ,a decision by the ,secretary of ,commerce to significantly modify1 or not promulgate1 a proposed standard submitted to the ,secretary by the ,national ,institute of ,standards and ,technology under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 shall be made after the public is given an opportunity to comment on the ,secretary's proposed decision4 7g7 ,definitions ,in this section3 7#a7 ,federal information system ,the term ,federal information system has the meaning given the term in section #ceeb of title #dd4 7#b7 ,information security ,the term information security has the meaning given the term in section #ceeb of title #dd4 7#c7 ,national security system ,the term national security system has the meaning given the term in section #ceeb of title #dd4 4 #bjc4 ,no new funding ,an applicable ,federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available1 through such means as the head of the agency considers appropriate4 #bjd4 ,technical and conforming amendments ,section #ba7;b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#d7;b77 is amended-- 7#a7 in paragraph 7#b71 by striking and the ,director of the ,office of ,management and ,budget and inserting 1 the ,secretary of ,commerce1 and the ,secretary of ,homeland ,security2 and 7#b7 in paragraph 7#c71 by inserting 1 the ,secretary of ,homeland ,security1 after the ,secretary of ,commerce4 #bje4 ,clarification of authorities ,nothing in this title shall be construed to convey any new regulatory authority to any government entity implementing or complying with any provision of this title4 ,,iii ,criminal penalties #cja4 ,penalties for fraud and related activity in connection with computers ,section #ajcj7;c7 of title #ah1 ,united ,states ,code1 is amended to read as follows3 7c7 ,the punishment for an offense under subsection 7a7 or 7b7 of this section is-- 7#a7 a fine under this title or imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#a7 of this section2 7#b7 7,a7 except as provided in subparagraph 7,b71 a fine under this title or imprisonment for not more than #c years1 or both1 in the case of an offense under subsection 7a77#b72 or 7,b7 a fine under this title or imprisonment for not more than ten years1 or both1 in the case of an offense under subsection 7a77#b7 of this section1 if-- 7i7 the offense was committed for purposes of commercial advantage or private financial gain2 7ii7 the offense was committed in the furtherance of any criminal or tortious act in violation of the ,constitution or laws of the ,united ,states1 or of any ,state2 or 7iii7 the value of the information obtained1 or that would have been obtained if the offense was completed1 exceeds #e1jjj2 7#c7 a fine under this title or imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#c7 of this section2 7#d7 a fine under this title or imprisonment of not more than #bj years1 or both1 in the case of an offense under subsection 7a77#d7 of this section2 7#e7 7,a7 except as provided in subparagraph 7,c71 a fine under this title1 imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#e77;,a7 of this section1 if the offense caused-- 7i7 loss to #a or more persons during any #a-year period 7and1 for purposes of an investigation1 prosecution1 or other proceeding brought by the ,united ,states only1 loss resulting from a related course of conduct affecting #a or more other protected computers7 aggregating at least #e1jjj in value2 7ii7 the modification or impairment1 or potential modification or impairment1 of the medical examination1 diagnosis1 treatment1 or care of #a or more individuals2 7iii7 physical injury to any person2 7iv7 a threat to public health or safety2 7v7 damage affecting a computer used by1 or on behalf of1 an entity of the ,united ,states ,government in furtherance of the administration of justice1 national defense1 or national security2 or 7vi7 damage affecting #aj or more protected computers during any #a-year period2 7,b7 a fine under this title1 imprisonment for not more than #bj years1 or both1 in the case of an offense under subsection 7a77#e77;,b71 if the offense caused a harm provided in clause 7i7 through 7vi7 of subparagraph 7,a7 of this subsection2 7,c7 if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation of subsection 7a77#e77;,a71 a fine under this title1 imprisonment for any term of years or for life1 or both2 7,d7 a fine under this title1 imprisonment for not more than #aj years1 or both1 for any other offense under subsection 7a77#e72 7,e7 a fine under this title or imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#f7 of this section2 or 7,f7 a fine under this title or imprisonment for not more than #aj years1 or both1 in the case of an offense under subsection 7a77#g7 of this section4 4 #cjb4 ,trafficking in passwords ,section #ajcj7;a77#f7 of title #ah1 ,united ,states ,code1 is amended to read as follows3 7#f7 knowingly and with intent to defraud traffics 7as defined in section #ajbi7 in any password or similar information or means of access through which a protected computer 7as defined in subparagraphs 7,a7 and 7,b7 of subsection 7e77#b77 may be accessed without authorization4 4 #cjc4 ,conspiracy and attempted computer fraud offenses ,section #ajcj7;b7 of title #ah1 ,united ,states ,code1 is amended by inserting as if for the completed offense after punished as provided4 #cjd4 ,criminal and civil forfeiture for fraud and related activity in connection with computers ,section #ajcj of title #ah1 ,united ,states ,code1 is amended by striking subsections 7i7 and 7j7 and inserting the following3 7i7 ,criminal forfeiture 7#a7 ,the court1 in imposing sentence on any person convicted of a violation of this section1 or convicted of conspiracy to violate this section1 shall order1 in addition to any other sentence imposed and irrespective of any provision of ,state law1 that such person forfeit to the ,united ,states-- 7,a7 such persons interest in any property1 real or personal1 that was used1 or intended to be used1 to commit or facilitate the commission of such violation2 and 7,b7 any property1 real or personal1 constituting or derived from any gross proceeds1 or any property traceable to such property1 that such person obtained1 directly or indirectly1 as a result of such violation4 7#b7 ,the criminal forfeiture of property under this subsection1 including any seizure and disposition of the property1 and any related judicial or administrative proceeding1 shall be governed by the provisions of section #dac of the ,comprehensive ,drug ,abuse ,prevention and ,control ,act of #aigj 7#ba ,u4,s4,c4 #hec71 except subsection 7d7 of that section4 7j7 ,civil forfeiture 7#a7 ,the following shall be subject to forfeiture to the ,united ,states and no property right1 real or personal1 shall exist in them3 7,a7 ,any property1 real or personal1 that was used1 or intended to be used1 to commit or facilitate the commission of any violation of this section1 or a conspiracy to violate this section4 7,b7 ,any property1 real or personal1 constituting or derived from any gross proceeds obtained directly or indirectly1 or any property traceable to such property1 as a result of the commission of any violation of this section1 or a conspiracy to violate this section4 7#b7 ,seizures and forfeitures under this subsection shall be governed by the provisions in chapter #df relating to civil forfeitures1 except that such duties as are imposed on the ,secretary of the ,treasury under the customs laws described in section #iha7;d7 shall be performed by such officers1 agents and other persons as may be designated for that purpose by the ,secretary of ,homeland ,security or the ,attorney ,general4 4 #cje4 ,damage to critical infrastructure computers 7a7 ,in general ,chapter #dg of title #ah1 ,united ,states ,code1 is amended by inserting after section #ajcj the following3 #ajcj;,a4 ,aggravated damage to a critical infrastructure computer 7a7 ,definitions ,in this section-- 7#a7 the term computer has the meaning given the term in section #ajcj2 7#b7 the term critical infrastructure computer means a computer that manages or controls systems or assets vital to national defense1 national security1 national economic security1 public health or safety1 or any combination of those matters1 whether publicly or privately owned or operated1 including-- 7,a7 oil and gas production1 storage1 conversion1 and delivery systems2 7,b7 water supply systems2 7,c7 telecommunication networks2 7,d7 electrical power generation and delivery systems2 7,e7 finance and banking systems2 7,f7 emergency services2 7,g7 transportation systems and services2 and 7,h7 government operations that provide essential services to the public2 and 7#c7 the term damage has the meaning given the term in section #ajcj4 7b7 ,offense ,it shall be unlawful1 during and in relation to a felony violation of section #ajcj1 to knowingly cause or attempt to cause damage to a critical infrastructure computer if the damage results in 7or1 in the case of an attempt1 if completed1 would have resulted in7 the substantial impairment-- 7#a7 of the operation of the critical infrastructure computer2 or 7#b7 of the critical infrastructure associated with the computer4 7c7 ,penalty ,any person who violates subsection 7b7 shall be-- 7#a7 fined under this title2 7#b7 imprisoned for not less than #c years but not more than #bj years2 or 7#c7 penalized under paragraphs 7#a7 and 7#b74 7d7 ,consecutive sentence ,notwithstanding any other provision of law-- 7#a7 a court shall not place on probation any person convicted of a violation of this section2 7#b7 except as provided in paragraph 7#d71 no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment1 including any term of imprisonment imposed on the person under any other provision of law1 including any term of imprisonment imposed for a felony violation of section #ajcj2 7#c7 in determining any term of imprisonment to be imposed for a felony violation of section #ajcj1 a court shall not in any way reduce the term to be imposed for such crime so as to compensate for1 or otherwise take into account1 any separate term of imprisonment imposed or to be imposed for a violation of this section2 and 7#d7 a term of imprisonment imposed on a person for a violation of this section may1 in the discretion of the court1 run concurrently1 in whole or in part1 only with another term of imprisonment that is imposed by the court at the same time on that person for an additional violation of this section1 provided that such discretion shall be exercised in accordance with any applicable guidelines and policy statements issued by the ,united ,states ,sentencing ,commission pursuant to section #iid of title #bh4 4 7b7 ,technical and conforming amendment ,the chapter analysis for chapter #dg of title #ah1 ,united ,states ,code1 is amended by inserting after the item relating to section #ajcj the following3 #ajcj;,a4 ,aggravated damage to a critical infrastructure computer4 4 #cjf4 ,limitation on actions involving unauthorized use ,section #ajcj7;e77#f7 of title #ah1 ,united ,states ,code1 is amended by striking alter2 and inserting alter1 but does not include access in violation of a contractual obligation or agreement1 such as an acceptable use policy or terms of service agreement1 with an ,internet service provider1 ,internet website1 or non-government employer1 if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized24 #cjg4 ,no new funding ,an applicable ,federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available1 through such means as the head of the agency considers appropriate4 ,,iv ,cybersecurity research and development #dja4 ,national ,high-,performance ,computing ,program planning and coordination 7a7 ,goals and priorities ,section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7 is amended by adding at the end the following3 7d7 ,goals and priorities ,the goals and priorities for ,federal high-performance computing research1 development1 networking1 and other activities under subsection 7a77#b77;,a7 shall include-- 7#a7 encouraging and supporting mechanisms for interdisciplinary research and development in networking and information technology1 including-- 7,a7 through collaborations across agencies2 7,b7 through collaborations across ,program ,component ,areas2 7,c7 through collaborations with industry2 7,d7 through collaborations with institutions of higher education2 7,e7 through collaborations with ,federal laboratories 7as defined in section #d of the ,stevenson-,wydler ,technology ,innovation ,act of #aihj 7#ae ,u4,s4,c4 #cgjc772 and 7,f7 through collaborations with international organizations2 7#b7 addressing national1 multi-agency1 multi-faceted challenges of national importance2 and 7#c7 fostering the transfer of research and development results into new technologies and applications for the benefit of society4 4 7b7 ,development of strategic plan ,section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7 is amended by adding at the end the following3 7e7 ,strategic plan 7#a7 ,in general ,not later than #a year after the date of enactment of the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac1 the agencies under subsection 7a77#c77;,b71 working through the ,national ,science and ,technology ,council and with the assistance of the ,office of ,science and ,technology ,policy shall develop a #e-year strategic plan to guide the activities under subsection 7a77#a74 7#b7 ,contents ,the strategic plan shall specify-- 7,a7 the near-term objectives for the ,program2 7,b7 the long-term objectives for the ,program2 7,c7 the anticipated time frame for achieving the near-term objectives2 7,d7 the metrics that will be used to assess any progress made toward achieving the near-term objectives and the long-term objectives2 and 7,e7 how the ,program will achieve the goals and priorities under subsection 7d74 7#c7 ,implementation roadmap 7,a7 ,in general ,the agencies under subsection 7a77#c77;,b7 shall develop and annually update an implementation roadmap for the strategic plan4 7,b7 ,requirements ,the information in the implementation roadmap shall be coordinated with the database under section #ajb7;c7 and the annual report under section #aja7;a77#c74 ,the implementation roadmap shall-- 7i7 specify the role of each ,federal agency in carrying out or sponsoring research and development to meet the research objectives of the strategic plan1 including a description of how progress toward the research objectives will be evaluated1 with consideration of any relevant recommendations of the advisory committee2 7ii7 specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year2 and 7iii7 estimate the funding required for each major research objective of the strategic plan for the next #c fiscal years4 7#d7 ,recommendations ,the agencies under subsection 7a77#c77;,b7 shall take into consideration when developing the strategic plan under paragraph 7#a7 the recommendations of-- 7,a7 the advisory committee under subsection 7b72 and 7,b7 the stakeholders under section #ajb7;a77#c74 7#e7 ,report to ,congress ,the ,director of the ,office of ,science and ,technology ,policy shall transmit the strategic plan under this subsection1 including the implementation roadmap and any updates under paragraph 7#c71 to-- 7,a7 the advisory committee under subsection 7b72 7,b7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 and 7,c7 the ,committee on ,science and ,technology of the ,house of ,representatives4 4 7c7 ,periodic reviews ,section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7 is amended by adding at the end the following3 7f7 ,periodic reviews ,the agencies under subsection 7a77#c77;,b7 shall-- 7#a7 periodically assess the contents and funding levels of the ,program ,component ,areas and restructure the ,program when warranted1 taking into consideration any relevant recommendations of the advisory committee under subsection 7b72 and 7#b7 ensure that the ,program includes national1 multi-agency1 multi-faceted research and development activities1 including activities described in section #ajd4 4 7d7 ,additional responsibilities of ,director ,section #aja7;a77#b7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#b77 is amended-- 7#a7 by redesignating subparagraphs 7,e7 and 7,f7 as subparagraphs 7,g7 and 7,h71 respectively2 and 7#b7 by inserting after subparagraph 7,d7 the following3 7,e7 encourage and monitor the efforts of the agencies participating in the ,program to allocate the level of resources and management attention necessary-- 7i7 to ensure that the strategic plan under subsection 7e7 is developed and executed effectively2 and 7ii7 to ensure that the objectives of the ,program are met2 7,f7 working with the ,office of ,management and ,budget and in coordination with the creation of the database under section #ajb7;c71 direct the ,office of ,science and ,technology ,policy and the agencies participating in the ,program to establish a mechanism 7consistent with existing law7 to track all ongoing and completed research and development projects and associated funding2 4 7e7 ,advisory committee ,section #aja7;b7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;b77 is amended-- 7#a7 in paragraph 7#a7-- 7,a7 by inserting after the first sentence the following3 ,the co-chairs of the advisory committee shall meet the qualifications of committee members and may be members of the ,presidents ,council of ,advisors on ,science and ,technology42 and 7,b7 by striking high-performance in subparagraph 7,d7 and inserting high-end2 and 7#b7 by amending paragraph 7#b7 to read as follows3 7#b7 ,in addition to the duties under paragraph 7#a71 the advisory committee shall conduct periodic evaluations of the funding1 management1 coordination1 implementation1 and activities of the ,program4 ,the advisory committee shall report its findings and recommendations not less frequently than once every #c fiscal years to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science and ,technology of the ,house of ,representatives4 ,the report shall be submitted in conjunction with the update of the strategic plan4 4 7f7 ,report ,section #aja7;a77#c7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77 is amended-- 7#a7 in subparagraph 7,c7-- 7,a7 by striking is submitted1 and inserting is submitted1 the levels for the previous fiscal year12 and 7,b7 by striking each ,program ,component ,area and inserting each ,program ,component ,area and each research area supported in accordance with section #ajd2 7#b7 in subparagraph 7,d7-- 7,a7 by striking each ,program ,component ,area1 and inserting each ,program ,component ,area and each research area supported in accordance with section #ajd12 7,b7 by striking is submitted1 and inserting is submitted1 the levels for the previous fiscal year12 and 7,c7 by striking and after the semicolon2 7#c7 by redesignating subparagraph 7,e7 as subparagraph 7,g72 and 7#d7 by inserting after subparagraph 7,d7 the following3 7,e7 include a description of how the objectives for each ,program ,component ,area1 and the objectives for activities that involve multiple ,program ,component ,areas1 relate to the objectives of the ,program identified in the strategic plan under subsection 7e72 7,f7 include-- 7i7 a description of the funding required by the ,office of ,science and ,technology ,policy to perform the functions under subsections 7a7 and 7c7 of section #ajb for the next fiscal year by category of activity2 7ii7 a description of the funding required by the ,office of ,science and ,technology ,policy to perform the functions under subsections 7a7 and 7c7 of section #ajb for the current fiscal year by category of activity2 and 7iii7 the amount of funding provided for the ,office of ,science and ,technology ,policy for the current fiscal year by each agency participating in the ,program2 and 4 7g7 ,definitions ,section #d of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eejc7 is amended-- 7#a7 by redesignating paragraphs 7#a7 and 7#b7 as paragraphs 7#b7 and 7#c71 respectively2 7#b7 by redesignating paragraph 7#c7 as paragraph 7#f72 7#c7 by redesignating paragraphs 7#f7 and 7#g7 as paragraphs 7#g7 and 7#h71 respectively2 7#d7 by inserting before paragraph 7#b71 as redesignated1 the following3 7#a7 cyber-physical systems means physical or engineered systems whose networking and information technology functions and physical elements are deeply integrated and are actively connected to the physical world through sensors1 actuators1 or other means to perform monitoring and control functions2 2 7#e7 in paragraph 7#c71 as redesignated1 by striking high-performance computing and inserting networking and information technology2 7#f7 in paragraph 7#f71 as redesignated-- 7,a7 by striking high-performance computing and inserting networking and information technology2 and 7,b7 by striking supercomputer and inserting high-end computing2 7#g7 in paragraph 7#e71 by striking network referred to as and all that follows through the semicolon and inserting network1 including advanced computer networks of ,federal agencies and departments2 and 7#h7 in paragraph 7#g71 as redesignated1 by striking ,national ,high-,performance ,computing ,program and inserting networking and information technology research and development program4 #djb4 ,research in areas of national importance 7a7 ,research in areas of national importance ,title ,i of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa et seq47 is amended by adding at the end the following3 #ajd4 ,research in areas of national importance 7a7 ,in general ,the ,program shall encourage agencies under section #aja7;a77#c77;,b7 to support1 maintain1 and improve national1 multi-agency1 multi-faceted1 research and development activities in networking and information technology directed toward application areas that have the potential for significant contributions to national economic competitiveness and for other significant societal benefits4 7b7 ,technical solutions ,an activity under subsection 7a7 shall be designed to advance the development of research discoveries by demonstrating technical solutions to important problems in areas including-- 7#a7 cybersecurity2 7#b7 health care2 7#c7 energy management and low-power systems and devices2 7#d7 transportation1 including surface and air transportation2 7#e7 cyber-physical systems2 7#f7 large-scale data analysis and modeling of physical phenomena2 7#g7 large scale data analysis and modeling of behavioral phenomena2 7#h7 supply chain quality and security2 and 7#i7 privacy protection and protected disclosure of confidential data4 7c7 ,recommendations ,the advisory committee under section #aja7;b7 shall make recommendations to the ,program for candidate research and development areas for support under this section4 7d7 ,characteristics 7#a7 ,in general ,research and development activities under this section-- 7,a7 shall include projects selected on the basis of applications for support through a competitive1 merit-based process2 7,b7 shall leverage1 when possible1 ,federal investments through collaboration with related ,state initiatives2 7,c7 shall include a plan for fostering the transfer of research discoveries and the results of technology demonstration activities1 including from institutions of higher education and ,federal laboratories1 to industry for commercial development2 7,d7 shall involve collaborations among researchers in institutions of higher education and industry2 and 7,e7 may involve collaborations among nonprofit research institutions and ,federal laboratories1 as appropriate4 7#b7 ,cost-sharing ,in selecting applications for support1 the agencies under section #aja7;a77#c77;,b7 shall give special consideration to projects that include cost sharing from non-,federal sources4 7#c7 ,multidisciplinary research centers ,research and development activities under this section shall be supported through multidisciplinary research centers1 including ,federal laboratories1 that are organized to investigate basic research questions and carry out technology demonstration activities in areas described in subsection 7a74 ,research may be carried out through existing multidisciplinary centers1 including those authorized under section #gjbd7;b77#b7 of the ,america ,,competes ,act 7#db ,u4,s4,c4 #ahfbo-#aj7b774 4 7b7 ,cyber-,physical systems ,section #aja7;a77#a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#a77 is amended-- 7#a7 in subparagraph 7,h71 by striking and after the semicolon2 7#b7 in subparagraph 7,i71 by striking the period at the end and inserting a semicolon2 and 7#c7 by adding at the end the following3 7,j7 provide for increased understanding of the scientific principles of cyber-physical systems and improve the methods available for the design1 development1 and operation of cyber-physical systems that are characterized by high reliability1 safety1 and security2 and 7,k7 provide for research and development on human-computer interactions1 visualization1 and big data4 4 7c7 ,task force ,title ,i of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa et seq471 as amended by section #djb7;a7 of this ,act1 is amended by adding at the end the following3 #aje4 ,task force 7a7 ,establishment ,not later than #ahj days after the date of enactment the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac1 the ,director of the ,office of ,science and ,technology ,policy under section #ajb shall convene a task force to explore mechanisms for carrying out collaborative research and development activities for cyber-physical systems 7including the related technologies required to enable these systems7 through a consortium or other appropriate entity with participants from institutions of higher education1 ,federal laboratories1 and industry4 7b7 ,functions ,the task force shall-- 7#a7 develop options for a collaborative model and an organizational structure for such entity under which the joint research and development activities could be planned1 managed1 and conducted effectively1 including mechanisms for the allocation of resources among the participants in such entity for support of such activities2 7#b7 propose a process for developing a research and development agenda for such entity1 including guidelines to ensure an appropriate scope of work focused on nationally significant challenges and requiring collaboration and to ensure the development of related scientific and technological milestones2 7#c7 define the roles and responsibilities for the participants from institutions of higher education1 ,federal laboratories1 and industry in such entity2 7#d7 propose guidelines for assigning intellectual property rights and for transferring research results to the private sector2 and 7#e7 make recommendations for how such entity could be funded from ,federal1 ,state1 and non-governmental sources4 7c7 ,composition ,in establishing the task force under subsection 7a71 the ,director of the ,office of ,science and ,technology ,policy shall appoint an equal number of individuals from institutions of higher education and from industry with knowledge and expertise in cyber-physical systems1 and may appoint not more than #b individuals from ,federal laboratories4 7d7 ,report ,not later than #a year after the date of enactment of the ,strengthening and ,enhancing ,cybersecurity by ,using ,research1 ,education1 ,information1 and ,technology ,act of #bjac1 the ,director of the ,office of ,science and ,technology ,policy shall transmit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science and ,technology of the ,house of ,representatives a report describing the findings and recommendations of the task force4 7e7 ,termination ,the task force shall terminate upon transmittal of the report required under subsection 7d74 7f7 ,compensation and expenses ,members of the task force shall serve without compensation4 4 #djc4 ,program improvements ,section #ajb of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeab7 is amended to read as follows3 #ajb4 ,program improvements 7a7 ,functions ,the ,director of the ,office of ,science and ,technology ,policy shall continue-- 7#a7 to provide technical and administrative support to-- 7,a7 the agencies participating in planning and implementing the ,program1 including support needed to develop the strategic plan under section #aja7;e72 and 7,b7 the advisory committee under section #aja7;b72 7#b7 to serve as the primary point of contact on ,federal networking and information technology activities for government agencies1 academia1 industry1 professional societies1 ,state computing and networking technology programs1 interested citizen groups1 and others to exchange technical and programmatic information2 7#c7 to solicit input and recommendations from a wide range of stakeholders during the development of each strategic plan under section #aja7;e7 by convening at least #a workshop with invitees from academia1 industry1 ,federal laboratories1 and other relevant organizations and institutions2 7#d7 to conduct public outreach1 including the dissemination of the advisory committee's findings and recommendations1 as appropriate2 7#e7 to promote access to and early application of the technologies1 innovations1 and expertise derived from ,program activities to agency missions and systems across the ,federal ,government and to ,united ,states industry2 7#f7 to ensure accurate and detailed budget reporting of networking and information technology research and development investment2 and 7#g7 to encourage agencies participating in the ,program to use existing programs and resources to strengthen networking and information technology education and training1 and increase participation in such fields1 including by women and underrepresented minorities4 7b7 ,source of funding 7#a7 ,in general ,the functions under this section shall be supported by funds from each agency participating in the ,program4 7#b7 ,specifications ,the portion of the total budget of the ,office of ,science and ,technology ,policy that is provided by each agency participating in the ,program for each fiscal year shall be in the same proportion as each agency's share of the total budget for the ,program for the previous fiscal year1 as specified in the database under section #ajb7;c74 7c7 ,database 7#a7 ,in general ,the ,director of the ,office of ,science and ,technology ,policy shall develop and maintain a database of projects funded by each agency for the fiscal year for each ,program ,component ,area4 7#b7 ,public accessibility ,the ,director of the ,office of ,science and ,technology ,policy shall make the database accessible to the public4 7#c7 ,database contents ,the database shall include1 for each project in the database-- 7,a7 a description of the project2 7,b7 each agency1 industry1 institution of higher education1 ,federal laboratory1 or international institution involved in the project2 7,c7 the source funding of the project 7set forth by agency72 7,d7 the funding history of the project2 and 7,e7 whether the project has been completed4 4 #djd4 ,improving education of networking and information technology1 including high performance computing ,section #bja7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeba7;a77 is amended-- 7#a7 by redesignating paragraphs 7#b7 through 7#d7 as paragraphs 7#c7 through 7#e71 respectively2 and 7#b7 by inserting after paragraph 7#a7 the following3 7#b7 the ,national ,science ,foundation shall use its existing programs1 in collaboration with other agencies1 as appropriate1 to improve the teaching and learning of networking and information technology at all levels of education and to increase participation in networking and information technology fields2 4 #dje4 ,conforming and technical amendments to the ,high-,performance ,computing ,act of #aiia 7a7 ,section #c ,section #c of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eejb7 is amended-- 7#a7 in the matter preceding paragraph 7#a71 by striking high-performance computing and inserting networking and information technology2 7#b7 in paragraph 7#a7-- 7,a7 in the matter preceding subparagraph 7,a71 by striking high-performance computing and inserting networking and information technology2 7,b7 in subparagraphs 7,a71 7,f71 and 7,g71 by striking high-performance computing each place it appears and inserting networking and information technology2 and 7,c7 in subparagraph 7,h71 by striking high-performance and inserting high-end2 and 7#c7 in paragraph 7#b7-- 7,a7 by striking high-performance computing and and inserting networking and information technology1 and2 and 7,b7 by striking high-performance computing network and inserting networking and information technology4 7b7 ,title heading ,the heading of title ,i of the ,high-,performance ,computing ,act of #aiia 7#aje ,stat4 #aeie7 is amended by striking ,high-performance computing and inserting ,networking and information technology4 7c7 ,section #aja ,section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7 is amended-- 7#a7 in the section heading1 by striking high-performance computing and inserting networking and information technology research and development2 7#b7 in subsection 7a7-- 7,a7 in the subsection heading1 by striking ,national ,high-,performance ,computing and inserting ,networking and ,information ,technology ,research and ,development2 7,b7 in paragraph 7#a7-- 7i7 by striking ,national ,high-,performance ,computing ,program and inserting networking and information technology research and development program2 7ii7 in subparagraph 7,a71 by striking high-performance computing1 including networking and inserting networking and information technology2 7iii7 in subparagraphs 7,b7 and 7,g71 by striking high-performance each place it appears and inserting high-end2 and 7iv7 in subparagraph 7,c71 by striking high-performance computing and networking and inserting high-end computing1 distributed1 and networking2 and 7,c7 in paragraph 7#b7-- 7i7 in subparagraphs 7,a7 and 7,c7-- 7,i7 by striking high-performance computing each place it appears and inserting networking and information technology2 and 7,,ii7 by striking development1 networking1 each place it appears and inserting development12 and 7ii7 in subparagraphs 7,g7 and 7,h71 as redesignated by section #dja7;d7 of this ,act1 by striking high-performance each place it appears and inserting high-end2 7#c7 in subsection 7b77#a71 in the matter preceding subparagraph 7,a71 by striking high-performance computing each place it appears and inserting networking and information technology2 and 7#d7 in subsection 7c77#a77;,a71 by striking high-performance computing and inserting networking and information technology4 7d7 ,section #bja ,section #bja7;a77#a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeba7;a77#a77 is amended by striking high-performance computing and advanced high-speed computer networking and inserting networking and information technology research and development4 7e7 ,section #bjb ,section #bjb7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebb7;a77 is amended by striking high-performance computing and inserting networking and information technology4 7f7 ,section #bjc ,section #bjc7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebc7;a77 is amended-- 7#a7 in paragraph 7#a71 by striking high-performance computing and networking and inserting networking and information technology2 and 7#b7 in paragraph 7#b77;,a71 by striking high-performance and inserting high-end4 7g7 ,section #bjd ,section #bjd of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebd7 is amended-- 7#a7 in subsection 7a77#a7-- 7,a7 in subparagraph 7,a71 by striking high-performance computing systems and networks and inserting networking and information technology systems and capabilities2 7,b7 in subparagraph 7,b71 by striking interoperability of high-performance computing systems in networks and for common user interfaces to systems and inserting interoperability and usability of networking and information technology systems2 and 7,c7 in subparagraph 7,c71 by striking high-performance computing and inserting networking and information technology2 and 7#b7 in subsection 7b7-- 7,a7 by striking ,high-,performance ,computing and ,network in the heading and inserting ,networking and ,information ,technology2 and 7,b7 by striking sensitive4 7h7 ,section #bje ,section #bje7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebe7;a77 is amended by striking computational and inserting networking and information technology4 7i7 ,section #bjf ,section #bjf7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebf7;a77 is amended by striking computational research and inserting networking and information technology research4 7j7 ,section #bjg ,section #bjg of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebg7 is amended by striking high-performance computing and inserting networking and information technology4 7k7 ,section #bjh ,section #bjh of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebh7 is amended-- 7#a7 in the section heading1 by striking high-performance computing and inserting networking and information technology2 and 7#b7 in subsection 7a7-- 7,a7 in paragraph 7#a71 by striking ,high-performance computing and associated and inserting ,networking and information2 7,b7 in paragraph 7#b71 by striking high-performance computing and inserting networking and information technologies2 7,c7 in paragraph 7#c71 by striking high-performance and inserting high-end2 7,d7 in paragraph 7#d71 by striking high-performance computers and associated and inserting networking and information2 and 7,e7 in paragraph 7#e71 by striking high-performance computing and associated and inserting networking and information4 #djf4 ,federal cyber scholarship-for-service program 7a7 ,in general ,the ,director of the ,national ,science ,foundation1 in coordination with the ,secretary of ,homeland ,security1 shall carry out a ,federal cyber scholarship-for-service program to recruit and train the next generation of information technology professionals and security managers to meet the needs of the cybersecurity mission for the ,federal ,government4 7b7 ,program description and components ,the program shall-- 7#a7 annually assess the workforce needs of the ,federal ,government for cybersecurity professionals1 including network engineers1 software engineers1 and other experts in order to determine how many scholarships should be awarded annually to ensure that the workforce needs following graduation match the number of scholarships awarded2 7#b7 provide scholarships for up to #a1jjj students per year in their pursuit of undergraduate or graduate degrees in the cybersecurity field1 in an amount that may include coverage for full tuition1 fees1 and a stipend2 7#c7 require each scholarship recipient1 as a condition of receiving a scholarship under the program1 to serve in a ,federal information technology workforce for a period equal to one and one-half times each year1 or partial year1 of scholarship received1 in addition to an internship in the cybersecurity field1 if applicable1 following graduation2 7#d7 provide a procedure for the ,national ,science ,foundation or a ,federal agency1 consistent with regulations of the ,office of ,personnel ,management1 to request and fund a security clearance for a scholarship recipient1 including providing for clearance during a summer internship and upon graduation2 and 7#e7 provide opportunities for students to receive temporary appointments for meaningful employment in the ,federal information technology workforce during school vacation periods and for internships4 7c7 ,hiring authority 7#a7 ,in general ,for purposes of any law or regulation governing the appointment of an individual in the ,federal civil service1 upon the successful completion of the student's studies1 a student receiving a scholarship under the program may-- 7,a7 be hired under section #bac4cajb7r7 of title #e1 ,code of ,federal ,regulations2 and 7,b7 be exempt from competitive service4 7#b7 ,competitive service ,upon satisfactory fulfillment of the service term under paragraph 7#a71 an individual may be converted to a competitive service position without competition if the individual meets the requirements for that position4 7d7 ,eligibility ,the eligibility requirements for a scholarship under this section shall include that a scholarship applicant-- 7#a7 be a citizen of the ,united ,states2 7#b7 be eligible to be granted a security clearance2 7#c7 maintain a grade point average of #c4b or above on a #d4j scale for undergraduate study or a #c4e or above on a #d4j scale for postgraduate study2 7#d7 demonstrate a commitment to a career in improving the security of the information infrastructure2 and 7#e7 has demonstrated a level of proficiency in math or computer sciences4 7e7 ,failure ,to complete service obligation 7#a7 ,in general ,a scholarship recipient under this section shall be liable to the ,united ,states under paragraph 7#b7 if the scholarship recipient-- 7,a7 fails to maintain an acceptable level of academic standing in the educational institution in which the individual is enrolled1 as determined by the ,director2 7,b7 is dismissed from such educational institution for disciplinary reasons2 7,c7 withdraws from the program for which the award was made before the completion of such program2 7,d7 declares that the individual does not intend to fulfill the service obligation under this section2 7,e7 fails to fulfill the service obligation of the individual under this section2 or 7,f7 loses a security clearance or becomes ineligible for a security clearance4 7#b7 ,repayment amounts 7,a7 ,less than #a year of service ,if a circumstance under paragraph 7#a7 occurs before the completion of #a year of a service obligation under this section1 the total amount of awards received by the individual under this section shall be repaid4 7,b7 ,one or more years of service ,if a circumstance described in subparagraph 7,d7 or 7,e7 of paragraph 7#a7 occurs after the completion of #a year of a service obligation under this section1 the total amount of scholarship awards received by the individual under this section1 reduced by the ratio of the number of years of service completed divided by the number of years of service required1 shall be repaid4 7f7 ,evaluation and report ,the ,director of the ,national ,science ,foundation shall-- 7#a7 evaluate the success of recruiting individuals for scholarships under this section and of hiring and retaining those individuals in the public sector workforce1 including the annual cost and an assessment of how the program actually improves the ,federal workforce2 and 7#b7 periodically report the findings under paragraph 7#a7 to ,congress4 7g7 ,authorization of appropriations ,from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 the ,secretary may use funds to carry out the requirements of this section for fiscal years #bjad through #bjae4 #djg4 ,study and analysis of certification and training of information infrastructure professionals 7a7 ,study ,the ,president shall enter into an agreement with the ,national ,academies to conduct a comprehensive study of government1 academic1 and private-sector accreditation1 training1 and certification programs for personnel working in information infrastructure4 ,the agreement shall require the ,national ,academies to consult with sector coordinating councils and relevant governmental agencies1 regulatory entities1 and nongovernmental organizations in the course of the study4 7b7 ,scope ,the study shall include-- 7#a7 an evaluation of the body of knowledge and various skills that specific categories of personnel working in information infrastructure should possess in order to secure information systems2 7#b7 an assessment of whether existing government1 academic1 and private-sector accreditation1 training1 and certification programs provide the body of knowledge and various skills described in paragraph 7#a72 7#c7 an analysis of any barriers to the ,federal ,government recruiting and hiring cybersecurity talent1 including barriers relating to compensation1 the hiring process1 job classification1 and hiring flexibility2 and 7#d7 an analysis of the sources and availability of cybersecurity talent1 a comparison of the skills and expertise sought by the ,federal ,government and the private sector1 an examination of the current and future capacity of ,united ,states institutions of higher education1 including community colleges1 to provide current and future cybersecurity professionals1 through education and training activities1 with those skills sought by the ,federal ,government1 ,state and local entities1 and the private sector4 7c7 ,report ,not later than #a year after the date of enactment of this ,act1 the ,national ,academies shall submit to the ,president and ,congress a report on the results of the study4 ,the report shall include-- 7#a7 findings regarding the state of information infrastructure accreditation1 training1 and certification programs1 including specific areas of deficiency and demonstrable progress2 and 7#b7 recommendations for the improvement of information infrastructure accreditation1 training1 and certification programs4 #djh4 ,international cybersecurity technical standards 7a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology1 in coordination with appropriate ,federal authorities1 shall-- 7#a7 as appropriate1 ensure coordination of ,federal agencies engaged in the development of international technical standards related to information system security2 and 7#b7 not later than #a year after the date of enactment of this ,act1 develop and transmit to ,congress a plan for ensuring such ,federal agency coordination4 7b7 ,consultation with the private sector ,in carrying out the activities under subsection 7a77#a71 the ,director shall ensure consultation with appropriate private sector stakeholders4 #dji4 ,identity management research and development ,the ,director of the ,national ,institute of ,standards and ,technology shall continue a program to support the development of technical standards1 metrology1 testbeds1 and conformance criteria1 taking into account appropriate user concerns-- 7#a7 to improve interoperability among identity management technologies2 7#b7 to strengthen authentication methods of identity management systems2 7#c7 to improve privacy protection in identity management systems1 including health information technology systems1 through authentication and security protocols2 and 7#d7 to improve the usability of identity management systems4 #daj4 ,federal cybersecurity research and development 7a7 ,national ,science ,foundation computer and network security research grant areas ,section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is amended-- 7#a7 in subparagraph 7,h71 by striking and after the semicolon2 7#b7 in subparagraph 7,i71 by striking property4 and inserting property22 and 7#c7 by adding at the end the following3 7,j7 secure fundamental protocols that are at the heart of inter-network communications and data exchange2 7,k7 system security that addresses the building of secure systems from trusted and untrusted components2 7,l7 monitoring and detection2 and 7,m7 resiliency and rapid recovery methods4 4 7b7 ,national ,science ,foundation computer and network security grants ,section #d7;a77#c7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#c77 is amended-- 7#a7 in subparagraph 7,d71 by striking and2 7#b7 in subparagraph 7,e71 by striking #bjjg4 and inserting #bjjg22 and 7#c7 by adding at the end the following3 7,f7 such funds from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 as the ,secretary finds necessary to carry out the requirements of this subsection for fiscal years #bjad through #bjae4 4 7c7 ,computer and network security centers ,section #d7;b77#g7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;b77#g77 is amended-- 7#a7 in subparagraph 7,d71 by striking and2 7#b7 in subparagraph 7,e71 by striking #bjjg4 and inserting #bjjg22 and 7#c7 by adding at the end the following3 7,f7 such funds from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 as the ,secretary finds necessary to carry out the requirements of this subsection for fiscal years #bjad through #bjae4 4 7d7 ,computer and network security capacity building grants ,section #e7;a77#f7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjd7;a77#f77 is amended-- 7#a7 in subparagraph 7,d71 by striking and2 7#b7 in subparagraph 7,e71 by striking #bjjg4 and inserting #bjjg22 and 7#c7 by adding at the end the following3 7,f7 such funds from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 as the ,secretary finds necessary to carry out the requirements of this subsection for fiscal years #bjad through #bjae4 4 7e7 ,scientific and advanced technology ,act grants ,section #e7;b77#b7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjd7;b77#b77 is amended-- 7#a7 in subparagraph 7,d71 by striking and2 7#b7 in subparagraph 7,e71 by striking #bjjg4 and inserting #bjjg22 and 7#c7 by adding at the end the following3 7,f7 such funds from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 as the ,secretary finds necessary to carry out the requirements of this subsection for fiscal years #bjad through #bjae4 4 7f7 ,graduate traineeships in computer and network security research ,section #e7;c77#g7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjd7;c77#g77 is amended-- 7#a7 in subparagraph 7,d71 by striking and2 7#b7 in subparagraph 7,e71 by striking #bjjg4 and inserting #bjjg22 and 7#c7 by adding at the end the following3 7,f7 such funds from amounts made available under section #ejc of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #djje71 as the ,secretary finds necessary to carry out the requirements of this subsection for fiscal years #bjad through #bjae4 4 ,v ,data ,security and ,breach ,notification #eja4 ,requirements for information security ,each covered entity shall take reasonable measures to protect and secure data in electronic form containing personal information4 #ejb4 ,notification of information security breach 7a7 ,notification 7#a7 ,in general ,a covered entity that owns or licenses data in electronic form containing personal information shall give notice of any breach of the security of the system following discovery by the covered entity of the breach of the security of the system to each individual who is a citizen or resident of the ,united ,states whose personal information was or that the covered entity reasonably believes to have been accessed and acquired by an unauthorized person and that the covered entity reasonably believes has caused or will cause1 identity theft or other financial harm4 7#b7 ,law enforcement ,a covered entity shall notify the ,secret ,service or the ,federal ,bureau of ,investigation of the fact that a breach of security has occurred if the number of individuals whose personal information the covered entity reasonably believes to have been accessed and acquired by an unauthorized person exceeds #aj1jjj4 7b7 ,special notification requirements 7#a7 ,third-party agents 7,a7 ,in general ,in the event of a breach of security of a system maintained by a third-party entity that has been contracted to maintain1 store1 or process data in electronic form containing personal information on behalf of a covered entity who owns or possesses such data1 such third-party entity shall notify such covered entity of the breach of security4 7,b7 ,covered entities who receive notice from third parties ,upon receiving notification from a third party under subparagraph 7,a71 a covered entity shall provide notification as required under subsection 7a74 7,c7 ,exception for service providers ,a service provider shall not be considered a third-party agent for purposes of this paragraph4 7#b7 ,service providers 7,a7 ,in general ,if a service provider becomes aware of a breach of security involving data in electronic form containing personal information that is owned or possessed by a covered entity that connects to or uses a system or network provided by the service provider for the purpose of transmitting1 routing1 or providing intermediate or transient storage of such data1 such service provider shall notify the covered entity who initiated such connection1 transmission1 routing1 or storage if such covered entity can be reasonably identified4 7,b7 ,covered entities who receive notice from service providers ,upon receiving notification from a service provider under subparagraph 7,a71 a covered entity shall provide notification as required under subsection 7a74 7c7 ,timeliness of notification 7#a7 ,in general ,unless subject to a delay authorized under paragraph 7#b71 a notification required under subsection 7a7 with respect to a security breach shall be made as expeditiously as practicable and without unreasonable delay1 consistent with any measures necessary to determine the scope of the security breach and restore the reasonable integrity of the data system that was breached4 7#b7 ,delay of notification authorized for law enforcement or national security purposes 7,a7 ,law enforcement ,if a ,federal law enforcement agency determines that the notification required under subsection 7a7 would impede a civil or criminal investigation1 such notification shall be delayed upon the written request of the law enforcement agency for any period which the law enforcement agency determines is reasonably necessary4 ,a law enforcement agency may1 by a subsequent written request1 revoke such delay or extend the period set forth in the original request made under this subparagraph by a subsequent request if further delay is necessary4 7,b7 ,national security ,if a ,federal national security agency or homeland security agency determines that the notification required under this section would threaten national or homeland security1 such notification may be delayed upon the written request of the national security agency or homeland security agency for any period which the national security agency or homeland security agency determines is reasonably necessary4 ,a ,federal national security agency or homeland security agency may revoke such delay or extend the period set forth in the original request made under this subparagraph by a subsequent written request if further delay is necessary4 7d7 ,method and content of notification 7#a7 ,direct notification 7,a7 ,method of notification ,a covered entity required to provide notification to an individual under subsection 7a7 shall be in compliance with such requirement if the covered entity provides such notice by one of the following methods3 7i7 ,written notification1 sent to the postal address of the individual in the records of the covered entity4 7ii7 ,telephone4 7iii7 ,email or other electronic means4 7,b7 ,content of notification ,regardless of the method by which notification is provided to an individual under subparagraph 7,a7 with respect to a security breach1 such notification1 to the extent practicable1 shall include-- 7i7 the date1 estimated date1 or estimated date range of the breach of security2 7ii7 a description of the personal information that was accessed and acquired1 or reasonably believed to have been accessed and acquired1 by an unauthorized person as a part of the security breach2 and 7iii7 information that the individual can use to contact the covered entity to inquire about-- 7,i7 the breach of security2 or 7,,ii7 the information the covered entity maintained about that individual4 7#b7 ,substitute notification 7,a7 ,circumstances giving rise to substitute notification ,a covered entity required to provide notification to an individual under subsection 7a7 may provide substitute notification in lieu of the direct notification required by paragraph 7#a7 if such direct notification is not feasible due to-- 7i7 excessive cost to the covered entity required to provide such notification relative to the resources of such covered entity2 or 7ii7 lack of sufficient contact information for the individual required to be notified4 7,b7 ,form of substitute notification ,such substitute notification shall include at least one of the following3 7i7 ,a conspicuous notice on the ,internet website of the covered entity 7if such covered entity maintains such a website74 7ii7 ,notification in print and to broadcast media1 including major media in metropolitan and rural areas where the individuals whose personal information was acquired reside4 7e7 ,treatment of persons governed by other ,federal law ,except as provided in section #ejc7;b71 a covered entity who is in compliance with any other ,federal law that requires such covered entity to provide notification to individuals following a breach of security shall be deemed to be in compliance with this section4 #ejc4 ,application and enforcement 7a7 ,general application ,the requirements of sections #eja and #ejb apply to-- 7#a7 those persons1 partnerships1 or corporations over which the ,commission has authority pursuant to section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 and 7#b7 notwithstanding section #e7;a77#b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq474 7b7 ,application to cable operators1 satellite operators1 and telecommunications carriers ,sections #bbb1 #cch1 and #fca of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #bbb1 #cch1 and #eea71 and any regulations promulgated thereunder1 shall not apply with respect to the information security practices1 including practices relating to the notification of unauthorized access to data in electronic form1 of any covered entity otherwise subject to those sections4 7c7 ,enforcement by ,federal ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation of section #eja or #ejb shall be treated as an unfair or deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7#b7 ,powers of commission 7,a7 ,in general ,except as provided in subsection 7a71 the ,commission shall enforce this title in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this title4 7,b7 ,privileges and immunities ,any person who violates section #ejb or #ejc shall be subject to the penalties and entitled to the privileges and immunities provided in such ,act4 7#c7 ,maximum total liability ,notwithstanding the number of actions which may be brought against a covered entity under this subsection1 the maximum civil penalty for which any covered entity may be liable under this subsection for all actions shall not exceed-- 7,a7 #ejj1jjj for all violations of section #eja resulting from the same related act or omission2 and 7,b7 #ejj1jjj for all violations of section #ejb resulting from a single breach of security4 7d7 ,no private cause of action ,nothing in this title shall be construed to establish a private cause of action against a person for a violation of this title4 #ejd4 ,definitions ,in this title3 7#a7 ,breach of security ,the term breach of security means unauthorized access and acquisition of data in electronic form containing personal information4 7#b7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#c7 ,covered entity 7,a7 ,in general ,the term covered entity means a sole proprietorship1 partnership1 corporation1 trust1 estate1 cooperative1 association1 or other commercial entity that acquires1 maintains1 stores1 or utilizes personal information4 7,b7 ,exemptions ,the term covered entity does not include the following3 7i7 ,financial institutions subject to title ,v of the ,gramm-,leach-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7ii7 ,an entity covered by the regulations issued under section #bfd7;c7 of the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia7 to the extent that such entity is subject to the requirements of such regulations with respect to protected health information4 7#d7 ,data in electronic form ,the term data in electronic form means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices4 7#e7 ,personal information 7,a7 ,in general ,the term personal information means an individual's first name or first initial and last name in combination with any #a or more of the following data elements for that individual3 7i7 ,social ,security number4 7ii7 ,driver's license number1 passport number1 military identification number1 or other similar number issued on a government document used to verify identity4 7iii7 ,financial account number1 or credit or debit card number1 and any required security code1 access code1 or password that is necessary to permit access to an individual's financial account4 7,b7 ,exclusions 7i7 public record information ,personal information does not include information obtained about an individual which has been lawfully made publicly available by a ,federal1 ,state1 or local government entity or widely distributed by media4 7ii7 ,encrypted1 redacted1 or secured data ,personal information does not include information that is encrypted1 redacted1 or secured by any other method or technology that renders the data elements unusable4 7#f7 ,service provider ,the term service provider means an entity that provides electronic data transmission1 routing1 intermediate1 and transient storage1 or connections to its system or network1 where such entity providing such services does not select or modify the content of the electronic data1 is not the sender or the intended recipient of the data1 and does not differentiate personal information from other information that such entity transmits1 routes1 stores1 or for which such entity provides connections4 ,any such entity shall be treated as a service provider under this title only to the extent that it is engaged in the provision of such transmission1 routing1 intermediate and transient storage1 or connections4 #eje4 ,effect on other laws ,this title preempts any law1 rule1 regulation1 requirement1 standard1 or other provision having the force and effect of law of any ,state1 or political subdivision of a ,state1 relating to the protection or security of data in electronic form containing personal information or the notification of a breach of security4 #ejf4 ,effective date ,this title shall take effect on the date that is #a year after the date of enactment of this ,act4