,i #aac? ,,congress #a/ ,session ,h4 ,r4 #adfh ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,april #aj1 #bjac ,mrs4 ,blackburn introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,sci5ce1 ,space1 & ,te*nology1 & 9 addition to ! ,committees on ,ov]sight & ,gov]nm5t ,re=m1 ! ,judici>y1 ,arm$ ,s]vices1 ,select ,intellig5ce 7,p]man5t ,select71 & ,en]gy & ,comm]ce1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to improve in=mation security1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac or ,,secure ,,x4 7b7 ,table ( cont5ts ,! table ( cont5ts ( ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4 ,title ,i--,facilitat+ %>+ ( cyb] ?reat in=mation ,sec4 #aja4 ,def9itions4 ,sec4 #ajb4 ,au?orization to %>e cyb] ?reat in=mation4 ,sec4 #ajc4 ,in=mation %>+ by ! ,f$]al ,gov]nm5t4 ,sec4 #ajd4 ,con/ruction4 ,sec4 #aje4 ,report on implem5tation4 ,sec4 #ajf4 ,inspector ,g5]al review4 ,sec4 #ajg4 ,te*nical am5dm5ts4 ,sec4 #ajh4 ,access to classifi$ in=mation4 ,title ,,ii--,coord9ation ( ,f$]al in=mation security policy ,sec4 #bja4 ,coord9ation ( ,f$]al in=mation security policy4 ,sec4 #bjb4 ,managem5t ( in=mation te*nology4 ,sec4 #bjc4 ,no new fund+4 ,sec4 #bjd4 ,te*nical & con=m+ am5dm5ts4 ,sec4 #bje4 ,cl>ification ( au?orities4 ,title ,,iii--,crim9al p5alties ,sec4 #cja4 ,p5alties = fraud & relat$ activity 9 connection ) comput]s4 ,sec4 #cjb4 ,traffick+ 9 passwords4 ,sec4 #cjc4 ,conspiracy & attempt$ comput] fraud (f5ses4 ,sec4 #cjd4 ,crim9al & civil =feiture = fraud & relat$ activity 9 connection ) comput]s4 ,sec4 #cje4 ,damage to critical infra/ructure comput]s4 ,sec4 #cjf4 ,limitation on actions involv+ unau?oriz$ use4 ,sec4 #cjg4 ,no new fund+4 ,title ,,iv--,cyb]security rese>* & developm5t ,sec4 #dja4 ,national ,high-,p]=mance ,comput+ ,program plann+ & coord9ation4 ,sec4 #djb4 ,rese>* 9 areas ( national importance4 ,sec4 #djc4 ,program improvem5ts4 ,sec4 #djd4 ,improv+ education ( network+ & in=mation te*nology1 includ+ high p]=mance comput+4 ,sec4 #dje4 ,con=m+ & te*nical am5dm5ts to ! ,high-,p]=mance ,comput+ ,act ( #aiia4 ,sec4 #djf4 ,f$]al cyb] s*ol>%ip-=-s]vice program4 ,sec4 #djg4 ,/udy & analysis ( c]tification & tra9+ ( in=mation infra/ructure pr(essionals4 ,sec4 #djh4 ,int]national cyb]security te*nical /&>ds4 ,sec4 #dji4 ,id5tity managem5t rese>* & developm5t4 ,sec4 #daj4 ,f$]al cyb]security rese>* & developm5t4 ,title ,v--,data ,security & ,brea* ,notification ,sec4 #eja4 ,requirem5ts = in=mation security4 ,sec4 #ejb4 ,notification ( in=mation security brea*4 ,sec4 #ejc4 ,application & en=cem5t4 ,sec4 #ejd4 ,def9itions4 ,sec4 #eje4 ,effect on o!r laws4 ,sec4 #ejf4 ,effective date4 ,i ,facilitat+ %>+ ( cyb] ?reat in=mation #aja4 ,def9itions ,9 ?is title3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,antitru/ laws ,! t]m antitru/ laws-- 7,a7 has ! mean+ giv5 ! t]m 9 section #a7;a7 ( ! ,clayton ,act 7#ae ,u4,s4,c4 #ab7;a772 7,b7 includes section #e ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7 to ! ext5t t section #e ( t ,act applies to unfair me?ods ( competition2 & 7,c7 includes any ,/ate law t has ! same int5t & effect z ! laws "u subp>agraphs 7,a7 & 7,b74 7#c7 ,c\nt]measure ,! t]m c\nt]measure means an automat$ or a manual action ) def5sive int5t to mitigate cyb] ?reats4 7#d7 ,cyb] ?reat in=mation ,! t]m cyb] ?reat in=mation means in=mation t indicates or describes-- 7,a7 a te*nical or op]ation vuln]ability or a cyb] ?reat mitigation measure2 7,b7 an action or op]ation to mitigate a cyb] ?reat2 7,c7 malici\s reconnaissance1 includ+ anomal\s patt]ns ( network activity t appe> to be transmitt$ = ! purpose ( ga!r+ te*nical in=mation relat$ to a cyb]security ?reat2 7,d7 a me?od ( defeat+ a te*nical control2 7,e7 a me?od ( defeat+ an op]ational control2 7,f7 network activity or protocols kn[n to be associat$ ) a malici\s cyb] actor or t signify malici\s cyb] int5t2 7,g7 a me?od ( caus+ a us] ) legitimate access to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em to inadv]t5tly enable ! defeat ( a te*nical or op]ational control2 7,h7 any o!r attribute ( a cyb]security ?reat or cyb] def5se in=mation t w\ld fo/] situational aw>5ess ( ! ,unit$ ,/ates cyb]security po/ure1 if disclosure ( su* attribute or in=mation is n o!rwise prohibit$ by law2 7,i7 ! actual or pot5tial h>m caus$ by a cyb] incid5t1 includ+ in=mation exfiltrat$ :5 x is necess>y 9 ord] to id5tify or describe a cyb]security ?reat2 or 7,j7 any comb9ation ( subp>agraphs 7,a7 ?r\gh 7,i74 7#e7 ,cyb]security c5t] ,! t]m cyb]security c5t] means ! ,dep>tm5t ( ,def5se ,cyb] ,crime ,c5t]1 ! ,intellig5ce ,community ,incid5t ,response ,c5t]1 ! ,unit$ ,/ates ,cyb] ,comm& ,jo9t ,op]ations ,c5t]1 ! ,national ,cyb] ,inve/igative ,jo9t ,task ,=ce1 ! ,national ,security ,ag5cy_/,c5tral ,security ,s]vice ,?reat ,op]ations ,c5t]1 ! ,national ,cyb]security & ,communications ,integration ,c5t]1 & any successor c5t]4 7#f7 ,cyb]security sy/em ,! t]m cyb]security sy/em means a sy/em design$ or employ$ to ensure ! integrity1 confid5tiality1 or availability (1 or to safegu>d1 a sy/em or network1 includ+ measures int5d$ to protect a sy/em or network f-- 7,a7 ef=ts to degrade1 disrupt1 or de/roy su* sy/em or network2 or 7,b7 !ft or misappropriations ( private or gov]nm5t in=mation1 intellectual prop]ty1 or p]sonally id5tifiable in=mation4 7#g7 ,entity 7,a7 ,9 g5]al ,! t]m entity means any private entity1 non-,f$]al ,gov]nm5t ag5cy or dep>tm5t1 or ,/ate1 tribal1 or local gov]nm5t ag5cy or dep>tm5t 7includ+ an (fic]1 employee1 or ag5t !re(74 7,b7 ,inclusions ,! t]m entity includes a gov]nm5t ag5cy or dep>tm5t 7includ+ an (fic]1 employee1 or ag5t !re(7 ( ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ! ,virg9 ,isl&s1 ,guam1 ,am]ican ,samoa1 ! ,nor!rn ,m>iana ,isl&s1 & any o!r t]ritory or possession ( ! ,unit$ ,/ates4 7#h7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em means an in=mation sy/em ( a ,f$]al dep>tm5t or ag5cy us$ or op]at$ by an executive ag5cy1 by a contractor ( an executive ag5cy1 or by ano!r organization on behalf ( an executive ag5cy4 7#i7 ,in=mation security ,! t]m in=mation security means protect+ in=mation & in=mation sy/ems f disruption or unau?oriz$ access1 use1 disclosure1 modification1 or de/ruction 9 ord] to provide-- 7,a7 integrity1 by gu>d+ aga9/ improp] in=mation modification or de/ruction1 includ+ by ensur+ in=mation nonrepudiation & au!nticity2 7,b7 confid5tiality1 by pres]v+ au?oriz$ re/rictions on access & disclosure1 includ+ means = protect+ p]sonal privacy & propriet>y in=mation2 or 7,c7 availability1 by ensur+ timely & reliable access to & use ( in=mation4 7#aj7 ,in=mation sy/em ,! t]m in=mation sy/em has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#aa7 ,local gov]nm5t ,! t]m local gov]nm5t means any bor\gh1 city1 c\nty1 p>i%1 t[n1 t[n%ip1 village1 or o!r g5]al purpose political subdivision ( a ,/ate4 7#ab7 ,malici\s reconnaissance ,! t]m malici\s reconnaissance means a me?od = actively prob+ or passively monitor+ an in=mation sy/em = ! purpose ( disc]n+ te*nical vuln]abilities ( ! in=mation sy/em1 if su* me?od is associat$ ) a kn[n or suspect$ cyb]security ?reat4 7#ac7 ,op]ational control ,! t]m op]ational control means a security control = an in=mation sy/em t prim>ily is implem5t$ & execut$ by p4 7#ad7 ,op]ational vuln]ability ,! t]m op]ational vuln]ability means any attribute ( policy1 process1 or proc$ure t c\ld enable or facilitate ! defeat ( an op]ational control4 7#ae7 ,private entity ,! t]m private entity means any individual or any private gr\p1 organization1 or corporation1 includ+ an (fic]1 employee1 or ag5t !re(4 7#af7 ,significant cyb] incid5t ,! t]m significant cyb] incid5t means a cyb] incid5t result+ 91 or an attempt$ cyb] incid5t t1 if successful1 w\ld h result$ 9-- 7,a7 ! exfiltration f a ,f$]al in=mation sy/em ( data t is ess5tial to ! op]ation ( ! ,f$]al in=mation sy/em2 or 7,b7 an incid5t 9 :i* an op]ational or te*nical control ess5tial to ! security or op]ation ( a ,f$]al in=mation sy/em 0 defeat$4 7#ag7 ,te*nical control ,! t]m te*nical control means a h>dw>e or s(tw>e re/riction on1 or audit (1 access or use ( an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em t is int5d$ to ensure ! confid5tiality1 integrity1 or availability ( t sy/em4 7#ah7 ,te*nical vuln]ability ,! t]m te*nical vuln]ability means any attribute ( h>dw>e or s(tw>e t c\ld enable or facilitate ! defeat ( a te*nical control4 7#ai7 ,tribal ,! t]m tribal has ! mean+ giv5 ! t]m ,indian tribe 9 section #d ( ! ,indian ,self-,det]m9ation & ,education ,assi/ance ,act 7#be ,u4,s4,c4 #dej;b74 #ajb4 ,au?orization to %>e cyb] ?reat in=mation 7a7 ,volunt>y disclosure 7#a7 ,private entities ,not)/&+ any o!r provision ( law1 a private entity may1 = ! purpose ( prev5t+1 inve/igat+1 or o!rwise mitigat+ ?reats to in=mation security1 on its own networks1 or z au?oriz$ by ano!r entity1 on su* entity's networks1 employ c\nt]measures & use cyb]security sy/ems 9 ord] to obta91 id5tify1 or o!rwise possess cyb] ?reat in=mation4 7#b7 ,entities ,not)/&+ any o!r provision ( law1 an entity may disclose cyb] ?reat in=mation to-- 7,a7 a cyb]security c5t]2 or 7,b7 any o!r entity 9 ord] to assi/ ) prev5t+1 inve/igat+1 or o!rwise mitigat+ ?reats to in=mation security4 7#c7 ,in=mation security provid]s ,if ! cyb] ?reat in=mation describ$ 9 p>agraph 7#a7 is obta9$1 id5tifi$1 or o!rwise possess$ 9 ! c\rse ( provid+ in=mation security products or s]vices "u contract to ano!r entity1 t entity %all be giv51 at any "t prior to disclosure ( su* in=mation1 a reasonable opportunity to au?orize or prev5t su* disclosure1 to reque/ anonymization ( su* in=mation1 or to reque/ t reasonable ef=ts be made to safegu>d su* in=mation t id5tifies specific p]sons f unau?oriz$ access or disclosure4 7b7 ,significant cyb] incid5ts involv+ ,f$]al in=mation sy/ems 7#a7 ,9 g5]al ,an entity provid+ electronic communication s]vices1 remote comput+ s]vices1 or in=mation security s]vices to a ,f$]al dep>tm5t or ag5cy %all in=m ! ,f$]al dep>tm5t or ag5cy ( a significant cyb] incid5t involv+ ! ,f$]al in=mation sy/em ( t ,f$]al dep>tm5t or ag5cy t-- 7,a7 is directly kn[n to ! entity z a result ( provid+ su* s]vices2 7,b7 is directly relat$ to ! provision ( su* s]vices by ! entity2 & 7,c7 z det]m9$ by ! entity1 has imp$$ or w imp$e ! p]=mance ( a critical mission ( ! ,f$]al dep>tm5t or ag5cy4 7#b7 ,advance coord9ation ,a ,f$]al dep>tm5t or ag5cy receiv+ ! s]vices describ$ 9 p>agraph 7#a7 %all coord9ate 9 advance ) an entity describ$ 9 p>agraph 7#a7 to develop ! p>amet]s ( any in=mation t may be provid$ "u p>agraph 7#a71 includ+ cl>ification ( ! type ( significant cyb] incid5t t w imp$e ! p]=mance ( a critical mission ( ! ,f$]al dep>tm5t or ag5cy4 7#c7 ,report ,a ,f$]al dep>tm5t or ag5cy %all report in=mation provid$ "u ?is subsection to a cyb]security c5t]4 7#d7 ,con/ruction ,any in=mation provid$ to a cyb]security c5t] "u p>agraph 7#c7 %all be treat$ 9 ! same mann] z in=mation provid$ to a cyb]security c5t] "u subsection 7a74 7c7 ,in=mation %>$ ) or provid$ to a cyb]security c5t] ,cyb] ?reat in=mation provid$ to a cyb]security c5t] "u ?is section-- 7#a7 may be disclos$ to1 reta9$ by1 & us$ by1 consi/5t ) o!rwise applicable ,f$]al law1 any ,f$]al ag5cy or dep>tm5t1 compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t = a cyb]security purpose1 a national security purpose1 or 9 ord] to prev5t1 inve/igate1 or prosecute any ( ! (f5ses li/$ 9 section #beaf ( title #ah1 ,unit$ ,/ates ,code1 & su* in=mation %all n be disclos$ to1 reta9$ by1 or us$ by any ,f$]al ag5cy or dep>tm5t = any use n p]mitt$ "u ?is p>agraph2 7#b7 may1 ) ! prior writt5 cons5t ( ! entity submitt+ su* in=mation1 be disclos$ to & us$ by a ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy = ! purpose ( protect+ in=mation sy/ems1 or 9 fur!rance ( prev5t+1 inve/igat+1 or prosecut+ a crim9al act1 except t if ! ne$ = imm$iate disclosure prev5ts obta9+ writt5 cons5t1 su* cons5t may be provid$ orally ) subsequ5t docum5tation ( su* cons5t2 7#c7 %all be consid]$ ! comm]cial1 f9ancial1 or propriet>y in=mation ( ! entity provid+ su* in=mation to ! ,f$]al ,gov]nm5t & any disclosure outside ! ,f$]al ,gov]nm5t may only be made ^u ! prior writt5 cons5t by su* entity & %all n con/itute a waiv] ( any applicable privilege or protection provid$ by law1 except t if ! ne$ = imm$iate disclosure prev5ts obta9+ writt5 cons5t1 su* cons5t may be provid$ orally ) subsequ5t docum5tation ( su* cons5t2 7#d7 %all be deem$ volunt>ily %>$ in=mation & exempt f disclosure "u section #eeb ( title #e1 ,unit$ ,/ates ,code1 & any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records2 7#e7 %all be1 )\t discretion1 )held f ! public "u section #eeb7;b77#c77;,b7 ( title #e1 ,unit$ ,/ates ,code1 & any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records2 7#f7 %all n be subject to ! rules ( any ,f$]al ag5cy or dep>tm5t or any judicial doctr9e reg>d+ ex p>te communications ) a decisionmak+ (ficial2 7#g7 %all n1 if subsequ5tly provid$ to a ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy1 o!rwise be disclos$ or di/ribut$ to any entity by su* ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy )\t ! prior writt5 cons5t ( ! entity submitt+ su* in=mation1 not)/&+ any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records1 except t if ! ne$ = imm$iate disclosure prev5ts obta9+ writt5 cons5t1 su* cons5t may be provid$ orally ) subsequ5t docum5tation ( su* cons5t2 & 7#h7 %all n be directly us$ by any ,f$]al1 ,/ate1 tribal1 or local dep>tm5t or ag5cy to regulate ! lawful activities ( an entity1 includ+ activities relat+ to obta9+1 id5tify+1 or o!rwise possess+ cyb] ?reat in=mation1 except t ! proc$ures requir$ to be develop$ & implem5t$ "u ?is title %all n be consid]$ regulations )9 ! mean+ ( ?is p>agraph4 7d7 ,proc$ures relat+ to in=mation %>+ ) a cyb]security c5t] ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! heads ( ea* dep>tm5t or ag5cy conta9+ a cyb]security c5t] %all jo9tly develop1 promulgate1 & submit to ,congress proc$ures to ensure t cyb] ?reat in=mation %>$ ) or provid$ to-- 7#a7 a cyb]security c5t] "u ?is section-- 7,a7 may be submitt$ to a cyb]security c5t] by an entity1 to ! greate/ ext5t possible1 ?r\gh a uni=m1 publicly available process or =mat t is easily accessible on ! website ( su* cyb]security c5t]1 & t includes ! ability to provide relevant details ab\t ! cyb] ?reat in=mation & writt5 cons5t to any subsequ5t disclosures au?oriz$ by ?is p>agraph2 7,b7 %all imm$iately be fur!r %>$ ) ea* cyb]security c5t] 9 ord] to prev5t1 inve/igate1 or o!rwise mitigate ?reats to in=mation security across ! ,f$]al ,gov]nm5t2 7,c7 is h&l$ by ! ,f$]al ,gov]nm5t 9 a reasonable mann]1 includ+ consid]ation ( ! ne$ to protect ! privacy & civil lib]ties ( individuals ?r\gh anonymization or o!r appropriate me?ods1 :ile fully accompli%+ ! objectives ( ?is title1 & ! ,f$]al ,gov]nm5t may und]take ef=ts consi/5t ) ?is subp>agraph to limit ! impact on privacy & civil lib]ties ( ! %>+ ( cyb] ?reat in=mation ) ! ,f$]al ,gov]nm5t2 & 7,d7 except z provid$ 9 ?is section1 %all only be us$1 disclos$1 or h&l$ 9 accordance ) ! provisions ( subsection 7c72 & 7#b7 a ,f$]al ag5cy or dep>tm5t "u subsection 7b7 is provid$ imm$iately to a cyb]security c5t] 9 ord] to prev5t1 inve/igate1 or o!rwise mitigate ?reats to in=mation security across ! ,f$]al ,gov]nm5t4 7e7 ,in=mation %>$ betwe5 entities 7#a7 ,9 g5]al ,an entity %>+ cyb] ?reat in=mation ) ano!r entity "u ?is title may re/rict ! use or %>+ ( su* in=mation by su* o!r entity4 7#b7 ,fur!r %>+ ,cyb] ?reat in=mation %>$ by any entity ) ano!r entity "u ?is title-- 7,a7 %all only be fur!r %>$ 9 accordance ) any re/rictions plac$ on ! %>+ ( su* in=mation by ! entity au?oriz+ su* %>+1 su* z appropriate anonymization ( su* in=mation2 & 7,b7 may n be us$ by any entity to ga9 an unfair competitive advantage to ! detrim5t ( ! entity au?oriz+ ! %>+ ( su* in=mation1 except t ! conduct describ$ 9 p>agraph 7#c7 %all n con/itute unfair competitive conduct4 7#c7 ,in=mation %>$ ) ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy ,cyb] ?reat in=mation %>$ ) a ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy "u ?is title-- 7,a7 may1 ) ! prior writt5 cons5t ( ! entity %>+ su* in=mation1 be disclos$ to & us$ by a ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy = ! purpose ( protect+ in=mation sy/ems1 or 9 fur!rance ( prev5t+1 inve/igat+1 or prosecut+ a crim9al act1 except if ! ne$ = imm$iate disclosure prev5ts obta9+ writt5 cons5t1 cons5t may be provid$ orally ) subsequ5t docum5tation ( ! cons5t2 7,b7 %all be deem$ volunt>ily %>$ in=mation & exempt f disclosure "u any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records2 7,c7 %all n be disclos$ or di/ribut$ to any entity by ! ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy )\t ! prior writt5 cons5t ( ! entity submitt+ su* in=mation1 not)/&+ any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records1 except if ! ne$ = imm$iate disclosure prev5ts obta9+ writt5 cons5t1 cons5t may be provid$ orally ) subsequ5t docum5tation ( ! cons5t2 & 7,d7 %all n be directly us$ by any ,/ate1 tribal1 or local dep>tm5t or ag5cy to regulate ! lawful activities ( an entity1 includ+ activities relat+ to obta9+1 id5tify+1 or o!rwise possess+ cyb] ?reat in=mation1 except t ! proc$ures requir$ to be develop$ & implem5t$ "u ?is title %all n be consid]$ regulations )9 ! mean+ ( ?is subp>agraph4 7#d7 ,antitru/ exemption ,! ex*ange or provision ( cyb] ?reat in=mation or assi/ance betwe5 #b or m private entities "u ?is title %all n be consid]$ a violation ( any provision ( antitru/ laws if ex*ang$ or provid$ 9 ord] to assi/ )-- 7,a7 facilitat+ ! prev5tion1 inve/igation1 or mitigation ( ?reats to in=mation security2 or 7,b7 communicat+ or disclos+ ( cyb] ?reat in=mation to help prev5t1 inve/igate or o!rwise mitigate ! effects ( a ?reat to in=mation security4 7#e7 ,no "r or b5efit ,! provision ( cyb] ?reat in=mation to an entity "u ?is section %all n create a "r or a b5efit to simil> in=mation by su* entity or any o!r entity4 7f7 ,f$]al preemption 7#a7 ,9 g5]al ,?is section sup]s$es any /atute or o!r law ( a ,/ate or political subdivision ( a ,/ate t re/ricts or o!rwise expressly regulates an activity au?oriz$ "u ?is section4 7#b7 ,/ate law en=cem5t ,no?+ 9 ?is section %all be con/ru$ to sup]s$e any /atute or o!r law ( a ,/ate or political subdivision ( a ,/ate conc]n+ ! use ( au?oriz$ law en=cem5t te*niques4 7#c7 ,public disclosure ,no in=mation %>$ ) or provid$ to a ,/ate1 tribal1 or local gov]nm5t or gov]nm5t ag5cy pursuant to ?is section %all be made publicly available pursuant to any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records4 7g7 ,civil & crim9al liability 7#a7 ,g5]al protections 7,a7 ,private entities ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt aga9/ any private entity =-- 7i7 ! use ( c\nt]measures & cyb]security sy/ems z au?oriz$ by ?is title2 7ii7 ! use1 receipt1 or disclosure ( any cyb] ?reat in=mation z au?oriz$ by ?is title2 or 7iii7 ! subsequ5t actions or inactions ( any lawful recipi5t ( cyb] ?reat in=mation provid$ by su* private entity4 7,b7 ,entities ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt aga9/ any entity =-- 7i7 ! use1 receipt1 or disclosure ( any cyb] ?reat in=mation z au?oriz$ by ?is title2 or 7ii7 ! subsequ5t actions or inactions ( any lawful recipi5t ( cyb] ?reat in=mation provid$ by su* entity4 7#b7 ,con/ruction ,no?+ 9 ?is subsection %all be con/ru$ z creat+ any immunity aga9/1 or o!rwise affect+1 any action br\ght by ! ,f$]al ,gov]nm5t1 or any ag5cy or dep>tm5t !re(1 to en=ce any law1 ,executive ord]1 or proc$ure gov]n+ ! appropriate h&l+1 disclosure1 & use ( classifi$ in=mation4 7h7 ,o!rwise lawful disclosures ,no?+ 9 ?is section %all be con/ru$ to limit or prohibit o!rwise lawful disclosures ( communications1 records1 or o!r in=mation by a private entity to any o!r gov]nm5tal or private entity n cov]$ "u ?is section4 7i7 ,:i/lebl[] protection ,no?+ 9 ?is ,act %all be con/ru$ to preempt or preclude any employee f ex]cis+ rights curr5tly provid$ "u any :i/lebl[] law1 rule1 or regulation4 7j7 ,relation%ip to ,o!r ,laws ,! submission ( cyb] ?reat in=mation "u ?is section to a cyb]security c5t] %all n affect any requirem5t "u any o!r provision ( law = an entity to provide in=mation to ! ,f$]al ,gov]nm5t4 #ajc4 ,in=mation %>+ by ! ,f$]al ,gov]nm5t 7a7 ,classifi$ in=mation 7#a7 ,proc$ures ,consi/5t ) ! protection ( intellig5ce s\rces & me?ods1 & z o!rwise det]m9$ appropriate1 ! ,director ( ,national ,intellig5ce & ! ,secret>y ( ,def5se1 9 consultation ) ! heads ( ! appropriate ,f$]al dep>tm5ts or ag5cies1 %all develop & promulgate proc$ures to facilitate & promote-- 7,a7 ! imm$iate %>+1 ?r\gh ! cyb]security c5t]s1 ( classifi$ cyb] ?reat in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t ) appropriately cle>$ repres5tatives ( any appropriate entity2 & 7,b7 ! declassification & imm$iate %>+1 ?r\gh ! cyb]security c5t]s1 ) any entity or1 if appropriate1 public availability ( cyb] ?reat in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t4 7#b7 ,h&l+ ( classifi$ in=mation ,! proc$ures develop$ "u p>agraph 7#a7 %all ensure t ea* entity receiv+ classifi$ cyb] ?reat in=mation pursuant to ?is section has ackn[l$g$ 9 writ+ ! ongo+ obligation to comply ) all laws1 ,executive ord]s1 & proc$ures conc]n+ ! appropriate h&l+1 disclosure1 or use ( classifi$ in=mation4 7b7 ,unclassifi$ cyb] ?reat in=mation ,! heads ( ea* dep>tm5t or ag5cy conta9+ a cyb]security c5t] %all jo9tly develop & promulgate proc$ures t ensure t1 consi/5t ) ! provisions ( ?is section1 unclassifi$1 includ+ controll$ unclassifi$1 cyb] ?reat in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t-- 7#a7 is %>$1 ?r\gh ! cyb]security c5t]s1 9 an imm$iate & adequate mann] ) appropriate entities2 & 7#b7 if appropriate1 is made publicly available4 7c7 ,developm5t ( proc$ures 7#a7 ,9 g5]al ,! proc$ures develop$ "u ?is section %all incorporate1 to ! greate/ ext5t possible1 exi/+ processes utiliz$ by sector specific in=mation %>+ & analysis c5t]s4 7#b7 ,coord9ation ) entities ,9 develop+ ! proc$ures requir$ "u ?is section1 ! ,director ( ,national ,intellig5ce & ! heads ( ea* dep>tm5t or ag5cy conta9+ a cyb]security c5t] %all coord9ate ) appropriate entities to ensure t protocols are implem5t$ t w facilitate & promote ! %>+ ( cyb] ?reat in=mation by ! ,f$]al ,gov]nm5t4 7d7 ,additional ,responsibilities ( ,cyb]security ,c5t]s ,consi/5t ) section #ajb1 a cyb]security c5t] %all-- 7#a7 facilitate in=mation %>+1 int]action1 & collaboration among & betwe5 cyb]security c5t]s &-- 7,a7 o!r ,f$]al entities2 7,b7 any entity2 & 7,c7 int]national p>tn]s1 9 consultation ) ! ,secret>y ( ,/ate2 7#b7 dissem9ate timely & actionable cyb]security ?reat1 vuln]ability1 mitigation1 & w>n+ in=mation1 includ+ al]ts1 advisories1 indicators1 signatures1 & mitigation & response measures1 to improve ! security & protection ( in=mation sy/ems2 & 7#c7 coord9ate ) o!r ,f$]al entities1 z appropriate1 to integrate in=mation f across ! ,f$]al ,gov]nm5t to provide situational aw>5ess ( ! cyb]security po/ure ( ! ,unit$ ,/ates4 7e7 ,%>+ )9 ! ,f$]al ,gov]nm5t ,! heads ( appropriate ,f$]al dep>tm5ts & ag5cies %all ensure t cyb] ?reat in=mation 9 ! possession ( su* ,f$]al dep>tm5ts or ag5cies t relates to ! prev5tion1 inve/igation1 or mitigation ( ?reats to in=mation security across ! ,f$]al ,gov]nm5t is %>$ effectively ) ! cyb]security c5t]s4 7f7 ,submission to ,congress ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ,national ,intellig5ce1 9 coord9ation ) ! appropriate head ( a dep>tm5t or an ag5cy conta9+ a cyb]security c5t]1 %all submit ! proc$ures requir$ by ?is section to ,congress4 #ajd4 ,con/ruction 7a7 ,in=mation ,%>+ ,relation%ips ,no?+ 9 ?is title %all be con/ru$-- 7#a7 to limit or modify an exi/+ in=mation %>+ relation%ip2 7#b7 to prohibit a new in=mation %>+ relation%ip2 7#c7 to require a new in=mation %>+ relation%ip betwe5 any entity & ! ,f$]al ,gov]nm5t1 except z specifi$ "u section #ajb7;b72 or 7#d7 to modify ! au?ority ( a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t to protect s\rces & me?ods & ! national security ( ! ,unit$ ,/ates4 7b7 ,anti-,task+ ,re/riction ,no?+ 9 ?is title %all be con/ru$ to p]mit ! ,f$]al ,gov]nm5t-- 7#a7 to require an entity to %>e in=mation ) ! ,f$]al ,gov]nm5t1 except z expressly provid$ "u section #ajb7;b72 or 7#b7 to condition ! %>+ ( cyb] ?reat in=mation ) an entity on su* entity's provision ( cyb] ?reat in=mation to ! ,f$]al ,gov]nm5t4 7c7 ,no liability = ,non-,p>ticipation ,no?+ 9 ?is title %all be con/ru$ to subject any entity to liability = *oos+ n to engage 9 ! volunt>y activities au?oriz$ "u ?is title4 7d7 ,use & ,ret5tion ( ,in=mation ,no?+ 9 ?is title %all be con/ru$ to au?orize1 or to modify any exi/+ au?ority (1 a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t to reta9 or use any in=mation %>$ "u section #ajb = any use o!r ?an a use p]mitt$ "u subsection #ajb7;c77#a74 7e7 ,no new fund+ ,an applicable ,f$]al ag5cy %all c>ry out ! provisions ( ?is title ) exi/+ facilities & funds o!rwise available1 ?r\gh su* means z ! head ( ! ag5cy consid]s appropriate4 #aje4 ,report on implem5tation 7a7 ,cont5t ( report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & bi5nially !reaft]1 ! heads ( ea* dep>tm5t or ag5cy conta9+ a cyb]security c5t] %all jo9tly submit1 9 coord9ation ) ! privacy & civil lib]ties (ficials ( su* dep>tm5ts or ag5cies & ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d1 a detail$ report to ,congress conc]n+ ! implem5tation ( ?is title1 includ+-- 7#a7 an assessm5t ( ! suffici5cy ( ! proc$ures develop$ "u section #ajc ( ?is ,act 9 ensur+ t cyb] ?reat in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t is provid$ 9 an imm$iate & adequate mann] to appropriate entities or1 if appropriate1 is made publicly available2 7#b7 an assessm5t ( :e!r in=mation has be5 appropriately classifi$ & an acc\nt+ ( ! numb] ( security cle>ances au?oriz$ by ! ,f$]al ,gov]nm5t = purposes ( ?is title2 7#c7 a review ( ! type ( cyb] ?reat in=mation %>$ ) a cyb]security c5t] "u section #ajb ( ?is ,act1 includ+ :e!r su* in=mation meets ! def9ition ( cyb] ?reat in=mation "u section #aja1 ! degree to :i* su* in=mation may impact ! privacy & civil lib]ties ( individuals1 any appropriate metrics to det]m9e any impact ( ! %>+ ( su* in=mation ) ! ,f$]al ,gov]nm5t on privacy & civil lib]ties1 & ! adequacy ( any /eps tak5 to r$uce su* impact2 7#d7 a review ( actions tak5 by ! ,f$]al ,gov]nm5t bas$ on in=mation provid$ to a cyb]security c5t] "u section #ajb ( ?is ,act1 includ+ ! appropriat5ess ( any subsequ5t use "u section #ajb7;c77#a7 ( ?is ,act & :e!r !re 0 inappropriate /ovepip+ )9 ! ,f$]al ,gov]nm5t ( any su* in=mation2 7#e7 a description ( any violations ( ! requirem5ts ( ?is title by ! ,f$]al ,gov]nm5t2 7#f7 a classifi$ li/ ( entities t receiv$ classifi$ in=mation f ! ,f$]al ,gov]nm5t "u section #ajc ( ?is ,act & a description ( any indication t su* in=mation may n h be5 appropriately h&l$2 7#g7 a summ>y ( any brea* ( in=mation security1 if kn[n1 attributable to a specific failure by any entity or ! ,f$]al ,gov]nm5t to act on cyb] ?reat in=mation 9 ! possession ( su* entity or ! ,f$]al ,gov]nm5t t result$ 9 sub/antial economic h>m or injury to a specific entity or ! ,f$]al ,gov]nm5t2 & 7#h7 any recomm5dation = improvem5ts or modifications to ! au?orities "u ?is title4 7b7 ,=m ( report ,! report "u subsection 7a7 %all be submitt$ 9 unclassifi$ =m1 b %all include a classifi$ annex4 #ajf4 ,inspector ,g5]al review 7a7 ,9 g5]al ,! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy are au?oriz$ to review compliance by ! cyb]security c5t]s1 & by any ,f$]al dep>tm5t or ag5cy receiv+ cyb] ?reat in=mation f su* cyb]security c5t]s1 ) ! proc$ures requir$ "u section #ajb ( ?is ,act4 7b7 ,scope ( review ,! review "u subsection 7a7 %all consid] :e!r ! ,f$]al ,gov]nm5t has h&l$ su* cyb] ?reat in=mation 9 a reasonable mann]1 includ+ consid]ation ( ! ne$ to protect ! privacy & civil lib]ties ( individuals ?r\gh anonymization or o!r appropriate me?ods1 :ile fully accompli%+ ! objectives ( ?is title4 7c7 ,report to ,congress ,ea* review conduct$ "u ?is section %all be provid$ to ,congress n lat] ?an #cj days aft] ! date ( completion ( ! review4 #ajg4 ,te*nical am5dm5ts ,section #eeb7;b7 ( title #e1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 p>agraph 7#h71 by /rik+ or2 7#b7 9 p>agraph 7#i71 by /rik+ wells4 & ins]t+ wells2 or2 & 7#c7 by add+ at ! end ! foll[+3 7#aj7 in=mation %>$ ) or provid$ to a cyb]security c5t] "u section #ajb ( title ,i ( ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac4 4 #ajh4 ,access to classifi$ in=mation 7a7 ,au?orization requir$ ,no p]son %all be provid$ ) access to classifi$ in=mation 7z def9$ 9 section #f4a ( ,executive ,ord] #acebf 7#ej ,u4,s4,c4 #dce note2 relat+ to classifi$ national security in=mation77 relat+ to cyb] security ?reats or cyb] security vuln]abilities "u ?is title )\t ! appropriate security cle>ances4 7b7 ,security cle>ances ,! appropriate ,f$]al ag5cies or dep>tm5ts %all1 consi/5t ) applicable proc$ures & requirem5ts1 & if o!rwise deem$ appropriate1 assi/ an individual 9 timely obta9+ an appropriate security cle>ance :]e su* individual has be5 det]m9$ to be eligible = su* cle>ance & has a ne$-to-"k 7z def9$ 9 section #f4a ( t ,executive ord]7 classifi$ in=mation to c>ry out ?is title4 ,,ii ,coord9ation ( ,f$]al in=mation security policy #bja4 ,coord9ation ( ,f$]al in=mation security policy 7a7 ,9 ,g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ sub*apt]s ,,ii & ,,iii & ins]t+ ! foll[+3 ,,ii ,in=mation ,security #ceea4 ,purposes ,! purposes ( ?is sub*apt] are-- 7#a7 to provide a compreh5sive framework = ensur+ ! effectiv5ess ( in=mation security controls ov] in=mation res\rces t support ,f$]al op]ations & assets2 7#b7 to recognize ! highly network$ nature ( ! curr5t ,f$]al comput+ environm5t & provide effective gov]nm5t-wide managem5t ( policies1 directives1 /&>ds1 & guidel9es1 z well z effective & nimble ov]sight ( & response to in=mation security risks1 includ+ coord9ation ( in=mation security ef=ts ?r\gh\t ! ,f$]al civilian1 national security1 & law en=cem5t communities2 7#c7 to provide = developm5t & ma9t5ance ( controls requir$ to protect ag5cy in=mation & in=mation sy/ems & contribute to ! ov]all improvem5t ( ag5cy in=mation security po/ure2 7#d7 to provide = ! developm5t ( tools & me?ods to assess & respond to real-"t situational risk = ,f$]al in=mation sy/em op]ations & assets2 & 7#e7 to provide a me*anism = improv+ ag5cy in=mation security programs ?r\gh cont9u\s monitor+ ( ag5cy in=mation sy/ems & /reaml9$ report+ requirem5ts r ?an ov]ly prescriptive manual report+4 #ceeb4 ,def9itions ,9 ?is sub*apt]3 7#a7 ,adequate security ,! t]m adequate security means security comm5surate ) ! risk & magnitude ( ! h>m result+ f ! unau?oriz$ access to or loss1 misuse1 de/ruction1 or modification ( in=mation4 7#b7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd4 7#c7 ,cyb]security c5t] ,! t]m cyb]security c5t] means ! ,dep>tm5t ( ,def5se ,cyb] ,crime ,c5t]1 ! ,intellig5ce ,community ,incid5t ,response ,c5t]1 ! ,unit$ ,/ates ,cyb] ,comm& ,jo9t ,op]ations ,c5t]1 ! ,national ,cyb] ,inve/igative ,jo9t ,task ,=ce1 ! ,national ,security ,ag5cy_/,c5tral ,security ,s]vice ,?reat ,op]ations ,c5t]1 ! ,national ,cyb]security & ,communications ,integration ,c5t]1 & any successor c5t]4 7#d7 ,cyb] ?reat in=mation ,! t]m cyb] ?reat in=mation means in=mation t indicates or describes-- 7,a7 a te*nical or op]ation vuln]ability or a cyb] ?reat mitigation measure2 7,b7 an action or op]ation to mitigate a cyb] ?reat2 7,c7 malici\s reconnaissance1 includ+ anomal\s patt]ns ( network activity t appe> to be transmitt$ = ! purpose ( ga!r+ te*nical in=mation relat$ to a cyb]security ?reat2 7,d7 a me?od ( defeat+ a te*nical control2 7,e7 a me?od ( defeat+ an op]ational control2 7,f7 network activity or protocols kn[n to be associat$ ) a malici\s cyb] actor or t signify malici\s cyb] int5t2 7,g7 a me?od ( caus+ a us] ) legitimate access to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em to inadv]t5tly enable ! defeat ( a te*nical or op]ational control2 7,h7 any o!r attribute ( a cyb]security ?reat or cyb] def5se in=mation t w\ld fo/] situational aw>5ess ( ! ,unit$ ,/ates cyb]security po/ure1 if disclosure ( su* attribute or in=mation is n o!rwise prohibit$ by law2 7,i7 ! actual or pot5tial h>m caus$ by a cyb] incid5t1 includ+ in=mation exfiltrat$ :5 x is necess>y 9 ord] to id5tify or describe a cyb]security ?reat2 or 7,j7 any comb9ation ( subp>agraphs 7,a7 ?r\gh 7,i74 7#e7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget unless o!rwise specifi$4 7#f7 ,environm5t ( op]ation ,! t]m environm5t ( op]ation means ! in=mation sy/em & environm5t 9 :i* ^? sy/ems op]ate1 includ+ *ang+ ?reats1 vuln]abilities1 te*nologies1 & missions & bus9ess practices4 7#g7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em means an in=mation sy/em us$ or op]at$ by an executive ag5cy1 by a contractor ( an executive ag5cy1 or by ano!r organization on behalf ( an executive ag5cy4 7#h7 ,incid5t ,! t]m incid5t means an occurr5ce t-- 7,a7 actually or imm95tly jeop>dizes ! integrity1 confid5tiality1 or availability ( an in=mation sy/em or ! in=mation t sy/em controls1 processes1 /ores1 or transmits2 or 7,b7 con/itutes a violation ( law or an imm95t ?reat ( violation ( a law1 a security policy1 a security proc$ure1 or an acceptable use policy4 7#i7 ,in=mation res\rces ,! t]m in=mation res\rces has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd4 7#aj7 ,in=mation security ,! t]m in=mation security means protect+ in=mation & in=mation sy/ems f disruption or unau?oriz$ access1 use1 disclosure1 modification1 or de/ruction 9 ord] to provide-- 7,a7 integrity1 by gu>d+ aga9/ improp] in=mation modification or de/ruction1 includ+ by ensur+ in=mation nonrepudiation & au!nticity2 7,b7 confid5tiality1 by pres]v+ au?oriz$ re/rictions on access & disclosure1 includ+ means = protect+ p]sonal privacy & propriet>y in=mation2 or 7,c7 availability1 by ensur+ timely & reliable access to & use ( in=mation4 7#aa7 ,in=mation sy/em ,! t]m in=mation sy/em has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd4 7#ab7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 ! t]m 9 section #aaaja ( title #dj4 7#ac7 ,malici\s reconnaissance ,! t]m malici\s reconnaissance means a me?od = actively prob+ or passively monitor+ an in=mation sy/em = ! purpose ( disc]n+ te*nical vuln]abilities ( ! in=mation sy/em1 if su* me?od is associat$ ) a kn[n or suspect$ cyb]security ?reat4 7#ad7 ,national security sy/em 7,a7 ,9 g5]al ,! t]m national security sy/em means any in=mation sy/em 7includ+ any telecommunications sy/em7 us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy1 or o!r organization on behalf ( an ag5cy-- 7i7 ! function1 op]ation1 or use ( :i*-- 7,i7 involves intellig5ce activities2 7,,ii7 involves cryptologic activities relat$ to national security2 7,,iii7 involves comm& & control ( milit>y =ces2 7,,iv7 involves equipm5t t is an integral "p ( a weapon or weapons sy/em2 or 7,v7 subject to subp>agraph 7,b71 is critical to ! direct fulfillm5t ( milit>y or intellig5ce missions2 or 7ii7 is protect$ at all times by proc$ures e/abli%$ = in=mation t h be5 specifically au?oriz$ "u crit]ia e/abli%$ by an ,executive ord] or an ,act ( ,congress to be kept classifi$ 9 ! int]e/ ( national def5se or =eign policy4 7,b7 ,limitation ,subp>agraph 7,a77i77,v7 does n include a sy/em t is to be us$ = r\t9e adm9i/rative & bus9ess applications 7includ+ payroll1 f9ance1 logi/ics1 & p]sonnel managem5t applications74 7#ae7 ,op]ational control ,! t]m op]ational control means a security control = an in=mation sy/em t prim>ily is implem5t$ & execut$ by p4 7#af7 ,p]son ,! t]m p]son has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd4 7#ag7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,comm]ce unless o!rwise specifi$4 7#ah7 ,security control ,! t]m security control means ! managem5t1 op]ational1 & te*nical controls1 includ+ safegu>ds or c\nt]measures1 prescrib$ = an in=mation sy/em to protect ! confid5tiality1 integrity1 & availability ( ! sy/em & its in=mation4 7#ai7 ,significant cyb] incid5t ,! t]m significant cyb] incid5t means a cyb] incid5t result+ 91 or an attempt$ cyb] incid5t t1 if successful1 w\ld h result$ 9-- 7,a7 ! exfiltration f a ,f$]al in=mation sy/em ( data t is ess5tial to ! op]ation ( ! ,f$]al in=mation sy/em2 or 7,b7 an incid5t 9 :i* an op]ational or te*nical control ess5tial to ! security or op]ation ( a ,f$]al in=mation sy/em 0 defeat$4 7#bj7 ,te*nical control ,! t]m te*nical control means a h>dw>e or s(tw>e re/riction on1 or audit (1 access or use ( an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em t is int5d$ to ensure ! confid5tiality1 integrity1 or availability ( t sy/em4 #ceec4 ,f$]al in=mation security au?ority & coord9ation 7a7 ,9 g5]al ,! ,secret>y1 9 consultation ) ! ,secret>y ( ,homel& ,security1 %all-- 7#a7 issue compulsory & b9d+ policies & directives gov]n+ ag5cy in=mation security op]ations1 & require implem5tation ( su* policies & directives1 includ+-- 7,a7 policies & directives consi/5t ) ! /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj to id5tify & provide in=mation security protections prioritiz$ & comm5surate ) ! risk & impact result+ f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction (-- 7i7 in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy2 or 7ii7 in=mation sy/ems us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or o!r organization on behalf ( an ag5cy2 7,b7 m9imum op]ational requirem5ts = ! ,f$]al ,gov]nm5t to protect ag5cy in=mation sy/ems & provide common situational aw>5ess across all ag5cy in=mation sy/ems2 7,c7 report+ requirem5ts1 consi/5t ) relevant law1 reg>d+ in=mation security incid5ts & cyb] ?reat in=mation2 7,d7 requirem5ts = ag5cywide in=mation security programs2 7,e7 p]=mance requirem5ts & metrics = ! security ( ag5cy in=mation sy/ems2 7,f7 tra9+ requirem5ts to ensure t ag5cies are able to fully & timely comply ) ! policies & directives issu$ by ! ,secret>y "u ?is sub*apt]2 7,g7 tra9+ requirem5ts reg>d+ privacy1 civil rights1 & civil lib]ties1 & in=mation ov]sight = ag5cy in=mation security p]sonnel2 7,h7 requirem5ts = ! annual reports to ! ,secret>y "u section #ceed7;d72 7,i7 any o!r in=mation security op]ations or in=mation security requirem5ts z det]m9$ by ! ,secret>y 9 coord9ation ) relevant ag5cy heads2 & 7,j7 coord9at+ ! developm5t ( /&>ds & guidel9es "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 ) ag5cies & (fices op]at+ or ex]cis+ control ( national security sy/ems 7includ+ ! ,national ,security ,ag5cy7 to assure1 to ! maximum ext5t feasible1 t su* /&>ds & guidel9es are complem5t>y ) /&>ds & guidel9es develop$ = national security sy/ems2 7#b7 review ! ag5cywide in=mation security programs "u section #ceed2 & 7#c7 designate an individual or an entity at ea* cyb]security c5t]1 among o!r responsibilities-- 7,a7 to receive reports & in=mation ab\t in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security control affect+ ag5cy in=mation sy/ems2 & 7,b7 to act on or %>e ! in=mation "u subp>agraph 7,a7 9 accordance ) ?is sub*apt]4 7b7 ,consid]ations ,:5 issu+ policies & directives "u subsection 7a71 ! ,secret>y %all consid] any applicable /&>ds or guidel9es develop$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u section #aacca ( title #dj4 7c7 ,limitation ( au?ority ,! au?orities ( ! ,secret>y "u ?is section %all n apply to national security sy/ems4 ,in=mation security policies1 directives1 /&>ds & guidel9es = national security sy/ems %all be ov]se5 z direct$ by ! ,presid5t &1 9 accordance ) t direction1 c>ri$ out "u ! au?ority ( ! heads ( ag5cies t op]ate or ex]cise au?ority ov] su* national security sy/ems4 7d7 ,/atutory con/ruction ,no?+ 9 ?is sub*apt] %all be con/ru$ to alt] or am5d any law reg>d+ ! au?ority ( any head ( an ag5cy ov] su* ag5cy4 #ceed4 ,ag5cy responsibilities 7a7 ,9 g5]al ,! head ( ea* ag5cy %all-- 7#a7 be responsible =-- 7,a7 comply+ ) ! policies & directives issu$ "u section #ceec2 7,b7 provid+ in=mation security protections comm5surate ) ! risk result+ f unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction (-- 7i7 in=mation collect$ or ma9ta9$ by ! ag5cy or by a contractor ( an ag5cy or o!r organization on behalf ( an ag5cy2 & 7ii7 in=mation sy/ems us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or o!r organization on behalf ( an ag5cy2 7,c7 comply+ ) ! requirem5ts ( ?is sub*apt]1 includ+-- 7i7 in=mation security /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj2 7ii7 = any national security sy/ems op]at$ or controll$ by t ag5cy1 in=mation security policies1 directives1 /&>ds & guidel9es issu$ z direct$ by ! ,presid5t2 & 7iii7 = any non-national security sy/ems op]at$ or controll$ by t ag5cy1 in=mation security policies1 directives1 /&>ds & guidel9es issu$ "u section #ceec2 7,d7 ensur+ t in=mation security managem5t processes are integrat$ ) ag5cy /rategic & op]ational plann+ processes2 7,e7 report+ & %>+1 = an ag5cy op]at+ or ex]cis+ control ( a national security sy/em1 in=mation ab\t in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security controls to ! individual or entity designat$ at ea* cyb]security c5t] & to o!r appropriate entities consi/5t ) policies & directives = national security sy/ems issu$ z direct$ by ! ,presid5t2 & 7,f7 report+ & %>+1 = ^? ag5cies op]at+ or ex]cis+ control ( non-national security sy/ems1 in=mation ab\t in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security controls to ! individual or entity designat$ at ea* cyb]security c5t] & to o!r appropriate entities consi/5t ) policies & directives = non-national security sy/ems z prescrib$ "u section #ceec7;a71 includ+ in=mation to assi/ ! entity designat$ "u section #ceee7;a7 ) ! ongo+ security analysis "u section #ceee2 7#b7 ensure t ea* s5ior ag5cy (ficial provides in=mation security = ! in=mation & in=mation sy/ems t support ! op]ations & assets "u ! s5ior ag5cy (ficial's control1 includ+ by-- 7,a7 assess+ ! risk & impact t c\ld result f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( su* in=mation or in=mation sy/ems2 7,b7 det]m9+ ! level ( in=mation security appropriate to protect su* in=mation & in=mation sy/ems 9 accordance ) policies & directives issu$ "u section #ceec7;a71 & /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj = in=mation security classifications & relat$ requirem5ts2 7,c7 implem5t+ policies1 proc$ures1 & capabilities to r$uce risks to an acceptable level 9 a co/-effective mann]2 7,d7 actively monitor+ ! effective implem5tation ( in=mation security controls & te*niques2 & 7,e7 report+ in=mation ab\t in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security controls 9 a timely & adequate mann] to ! entity designat$ "u section #ceec7;a77#c7 9 accordance ) p>agraph 7#a72 7#c7 assess & ma9ta9 ! resili5cy ( in=mation te*nology sy/ems critical to ag5cy mission & op]ations2 7#d7 designate ! ag5cy ,inspector ,g5]al 7or an indep5d5t entity select$ 9 consultation ) ! ,director & ! ,c\ncil ( ,inspectors ,g5]al on ,integrity & ,effici5cy if ! ag5cy does n h an ,inspector ,g5]al7 to conduct ! annual indep5d5t evaluation requir$ "u section #ceef1 & all[ ! ag5cy ,inspector ,g5]al to contract ) an indep5d5t entity to p]=m su* evaluation2 7#e7 delegate to ! ,*ief ,in=mation ,(fic] or equival5t 7or to a s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t7-- 7,a7 ! au?ority & prim>y responsibility to implem5t an ag5cywide in=mation security program2 & 7,b7 ! au?ority to provide in=mation security = ! in=mation collect$ & ma9ta9$ by ! ag5cy 7or by a contractor1 o!r ag5cy1 or o!r s\rce on behalf ( ! ag5cy7 & = ! in=mation sy/ems t support ! op]ations1 assets1 & mission ( ! ag5cy 7includ+ any in=mation sy/em provid$ or manag$ by a contractor1 o!r ag5cy1 or o!r s\rce on behalf ( ! ag5cy72 7#f7 delegate to ! appropriate ag5cy (ficial 7:o is responsible = a p>ticul> ag5cy sy/em or subsy/em7 ! responsibility to ensure & en=ce compliance ) all requirem5ts ( ! ag5cy's ag5cywide in=mation security program 9 coord9ation ) ! ,*ief ,in=mation ,(fic] or equival5t 7or ! s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t7 "u p>agraph 7#e72 7#g7 ensure t an ag5cy has tra9$ p]sonnel :o h obta9$ any necess>y security cle>ances to p]mit !m to assi/ ! ag5cy 9 comply+ ) ?is sub*apt]2 7#h7 ensure t ! ,*ief ,in=mation ,(fic] or equival5t 7or ! s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t7 "u p>agraph 7#e71 9 coord9ation ) o!r s5ior ag5cy (ficials1 reports to ! ag5cy head on ! effectiv5ess ( ! ag5cywide in=mation security program1 includ+ ! progress ( any rem$ial actions2 & 7#i7 ensure t ! ,*ief ,in=mation ,(fic] or equival5t 7or ! s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t7 "u p>agraph 7#e7 has ! necess>y qualifications to adm9i/] ! functions describ$ 9 ?is sub*apt] & has in=mation security duties z a prim>y duty ( t (ficial4 7b7 ,*ief ,in=mation ,(fic]s ,ea* ,*ief ,in=mation ,(fic] or equival5t 7or ! s5ior ag5cy (ficial :o reports to ! ,*ief ,in=mation ,(fic] or equival5t7 "u subsection 7a77#e7 %all-- 7#a7 e/abli% & ma9ta9 an ent]prise security op]ations capability t on a cont9u\s basis-- 7,a7 detects1 reports1 conta9s1 mitigates1 & responds to in=mation security incid5ts t impair adequate security ( ! ag5cy's in=mation or in=mation sy/em 9 a timely mann] & 9 accordance ) ! policies & directives "u section #ceec2 & 7,b7 reports any in=mation security incid5t "u subp>agraph 7,a7 to ! entity designat$ "u section #ceee2 7#b7 develop1 ma9ta91 & ov]see an ag5cywide in=mation security program2 7#c7 develop1 ma9ta91 & ov]see in=mation security policies1 proc$ures1 & control te*niques to address applicable requirem5ts1 includ+ requirem5ts "u section #ceec ( ?is title & section #aacca ( title #dj2 & 7#d7 tra9 & ov]see ! ag5cy p]sonnel :o h significant responsibility = in=mation security ) respect to t responsibility4 7c7 ,ag5cywide in=mation security programs 7#a7 ,9 g5]al ,ea* ag5cywide in=mation security program "u subsection 7b77#b7 %all include-- 7,a7 relevant security risk assessm5ts1 includ+ te*nical assessm5ts & o!rs relat$ to ! acquisition process2 7,b7 security te/+ comm5surate ) risk & impact2 7,c7 mitigation ( det]ioration ( security controls comm5surate ) risk & impact2 7,d7 risk-bas$ cont9u\s monitor+ & ?reat assessm5t ( ! op]ational /atus & security ( ag5cy in=mation sy/ems to enable evaluation ( ! effectiv5ess ( & compliance ) in=mation security policies1 proc$ures1 & practices1 includ+ a relevant & appropriate selection ( security controls ( in=mation sy/ems id5tifi$ 9 ! inv5tory "u section #ceje7;c72 7,e7 op]ation ( appropriate te*nical capabilities 9 ord] to detect1 mitigate1 report1 & respond to in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security controls 9 a mann] t is consi/5t ) ! policies & directives "u section #ceec1 includ+-- 7i7 mitigat+ risks associat$ ) su* in=mation security incid5ts2 7ii7 notify+ & consult+ ) ! entity designat$ "u section #ceee2 & 7iii7 notify+ & consult+ )1 z appropriate-- 7,i7 law en=cem5t & ! relevant ,(fice ( ! ,inspector ,g5]al2 & 7,,ii7 any o!r entity1 9 accordance ) law & z direct$ by ! ,presid5t2 7,f7 a process to ensure t rem$ial action is tak5 to address any defici5cies 9 ! in=mation security policies1 proc$ures1 & practices ( ! ag5cy2 & 7,g7 a plan & proc$ures to ensure ! cont9uity ( op]ations = in=mation sy/ems t support ! op]ations & assets ( ! ag5cy4 7#b7 ,risk managem5t /rategies ,ea* ag5cywide in=mation security program "u subsection 7b77#b7 %all include ! developm5t & ma9t5ance ( a risk managem5t /rategy = in=mation security4 ,! risk managem5t /rategy %all include-- 7,a7 consid]ation ( in=mation security incid5ts1 cyb] ?reat in=mation1 & det]ioration ( security controls2 & 7,b7 consid]ation ( ! consequ5ces t c\ld result f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( in=mation & in=mation sy/ems t support ! op]ations & assets ( ! ag5cy1 includ+ any in=mation sy/em provid$ or manag$ by a contractor1 o!r ag5cy1 or o!r s\rce on behalf ( ! ag5cy4 7#c7 ,policies & proc$ures ,ea* ag5cywide in=mation security program "u subsection 7b77#b7 %all include policies & proc$ures t-- 7,a7 are bas$ on ! risk managem5t /rategy "u p>agraph 7#b72 7,b7 r$uce in=mation security risks to an acceptable level 9 a co/-effective mann]2 7,c7 ensure t co/-effective & adequate in=mation security is address$ z "p ( ! acquisition & ongo+ managem5t ( ea* ag5cy in=mation sy/em2 & 7,d7 ensure compliance )-- 7i7 ?is sub*apt]2 & 7ii7 any o!r applicable requirem5ts4 7#d7 ,tra9+ requirem5ts ,ea* ag5cywide in=mation security program "u subsection 7b77#b7 %all include in=mation security1 privacy1 civil rights1 civil lib]ties1 & in=mation ov]sight tra9+ t meets any applicable requirem5ts "u section #ceec4 ,! tra9+ %all in=m ea* in=mation security p]sonnel t has access to ag5cy in=mation sy/ems 7includ+ contractors & o!r us]s ( in=mation sy/ems t support ! op]ations & assets ( ! ag5cy7 (-- 7,a7 ! in=mation security risks associat$ ) ! in=mation security p]sonnel's activities2 & 7,b7 ! individual's responsibility to comply ) ! ag5cy policies & proc$ures t r$uce ! risks "u subp>agraph 7,a74 7d7 ,annual report ,ea* ag5cy %all submit a report annually to ! ,secret>y ( ,homel& ,security on its ag5cywide in=mation security program & in=mation sy/ems4 #ceee4 ,multiag5cy ongo+ ?reat assessm5t 7a7 ,implem5tation ,! ,director ( ! ,(fice ( ,managem5t & ,budget1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 %all designate an entity to implem5t ongo+ security analysis conc]n+ ag5cy in=mation sy/ems-- 7#a7 bas$ on cyb] ?reat in=mation2 7#b7 bas$ on ag5cy in=mation sy/em & environm5t ( op]ation *anges1 includ+-- 7,a7 an ongo+ evaluation ( ! in=mation sy/em security controls2 & 7,b7 ! security /ate1 risk level1 & environm5t ( op]ation ( an ag5cy in=mation sy/em1 includ+-- 7i7 a *ange 9 risk level due to a new cyb] ?reat2 7ii7 a *ange result+ f a new te*nology2 7iii7 a *ange result+ f ! ag5cy's mission2 & 7iv7 a *ange result+ f ! bus9ess practice2 & 7#c7 us+ automat$ processes to ! maximum ext5t possible-- 7,a7 to increase in=mation sy/em security2 7,b7 to r$uce pap]-bas$ report+ requirem5ts2 & 7,c7 to ma9ta9 timely & actionable k ( ! /ate ( ! in=mation sy/em security4 7b7 ,/&>ds ,! ,national ,in/itute ( ,/&>ds & ,te*nology may promulgate /&>ds1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 to assi/ an ag5cy ) its duties "u ?is section4 7c7 ,compliance ,! head ( ea* appropriate dep>tm5t & ag5cy %all be responsible = ensur+ compliance & implem5t+ necess>y proc$ures to comply ) ?is section4 ,! head ( ea* appropriate dep>tm5t & ag5cy1 9 consultation ) ! ,director ( ! ,(fice ( ,managem5t & ,budget & ! ,secret>y ( ,homel& ,security1 %all-- 7#a7 monitor compliance "u ?is section2 7#b7 develop a timel9e & implem5t = ! dep>tm5t or ag5cy-- 7,a7 adoption ( any te*nology1 sy/em1 or me?od t facilitates cont9u\s monitor+ & ?reat assessm5ts ( an ag5cy in=mation sy/em2 7,b7 adoption or updat+ ( any te*nology1 sy/em1 or me?od t prev5ts1 detects1 or rem$iates a significant cyb] incid5t to a ,f$]al in=mation sy/em ( ! dep>tm5t or ag5cy t has imp$$1 or is reasonably likely to imp$e1 ! p]=mance ( a critical mission ( ! dep>tm5t or ag5cy2 & 7,c7 adoption ( any te*nology1 sy/em1 or me?od t satisfies a requirem5t "u ?is section4 7d7 ,limitation ( ,au?ority ,! au?orities ( ! ,director ( ! ,(fice ( ,managem5t & ,budget & ( ! ,secret>y ( ,homel& ,security "u ?is section %all n apply to national security sy/ems4 7e7 ,report ,n lat] ?an #f mon?s aft] ! date ( enactm5t ( ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac1 ! ,gov]nm5t ,acc\ntability ,(fice %all issue a report evaluat+ ea* ag5cy's /atus t[>d implem5t+ ?is section4 #ceef4 ,indep5d5t evaluations 7a7 ,9 g5]al ,! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 9 consultation ) ! ,director & ! ,secret>y ( ,homel& ,security1 ! ,secret>y ( ,comm]ce1 & ! ,secret>y ( ,def5se1 %all issue & ma9ta9 crit]ia = ! timely1 co/-effective1 risk-bas$1 & indep5d5t evaluation ( ea* ag5cywide in=mation security program 7& practices7 to det]m9e ! effectiv5ess ( ! ag5cywide in=mation security program 7& practices74 ,! crit]ia %all include measures to assess any conflicts ( int]e/ 9 ! p]=mance ( ! evaluation & :e!r ! ag5cywide in=mation security program includes appropriate safegu>ds aga9/ disclosure ( in=mation :]e su* disclosure may adv]sely affect in=mation security4 7b7 ,annual indep5d5t evaluations ,ea* ag5cy %all p]=m an annual indep5d5t evaluation ( its ag5cywide in=mation security program 7& practices7 9 accordance ) ! crit]ia "u subsection 7a74 7c7 ,di/ribution ( reports ,n lat] ?an #cj days aft] receiv+ an indep5d5t evaluation "u subsection 7b71 ea* ag5cy head %all transmit a copy ( ! indep5d5t evaluation to ! ,secret>y ( ,homel& ,security1 ! ,secret>y ( ,comm]ce1 & ! ,secret>y ( ,def5se4 7d7 ,national security sy/ems ,evaluations involv+ national security sy/ems %all be conduct$ z direct$ by ,presid5t4 #ceeg4 ,national security sy/ems4 ,! head ( ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all be responsible = ensur+ t ! ag5cy-- 7#a7 provides in=mation security protections comm5surate ) ! risk & magnitude ( ! h>m result+ f ! unau?oriz$ access1 use1 disclosure1 disruption1 modification1 or de/ruction ( ! in=mation conta9$ 9 su* sy/em2 & 7#b7 implem5ts in=mation security policies & practices z requir$ by /&>ds & guidel9es = national security sy/ems1 issu$ 9 accordance ) law & z direct$ by ! ,presid5t4 4 7b7 ,sav+s ,provisions 7#a7 ,policy & compliance guidance ,policy & compliance guidance issu$ by ! ,director be=e ! date ( enactm5t ( ?is ,act "u section #cedc7;a77#a7 ( title #dd1 ,unit$ ,/ates ,code 7z 9 effect on ! day be=e ! date ( enactm5t ( ?is ,act71 %all cont9ue 9 effect1 accord+ to its t]ms1 until modifi$1 t]m9at$1 sup]s$$1 or repeal$ pursuant to section #ceec7;a77#a7 ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,/&>ds & guidel9es ,/&>ds & guidel9es issu$ by ! ,secret>y ( ,comm]ce or by ! ,director be=e ! date ( enactm5t ( ?is ,act "u section #aacca7;a77#a7 ( title #dj1 ,unit$ ,/ates ,code1 7z 9 effect on ! day be=e ! date ( enactm5t ( ?is ,act7 %all cont9ue 9 effect1 accord+ to _! t]ms1 until modifi$1 t]m9at$1 sup]s$$1 or repeal$ pursuant to section #aacca7;a77#a7 ( title #dj1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7c7 ,te*nical & con=m+ am5dm5ts 7#a7 ,*apt] analysis ,! *apt] analysis = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by /rik+ ! items relat+ to sections #ceca ?r\gh #cech2 7,b7 by /rik+ ! items relat+ to sections #ceda ?r\gh #cedi2 & 7,c7 by ins]t+ ! foll[+3 #ceea4 ,purposes4 #ceeb4 ,def9itions4 #ceec4 ,f$]al in=mation security au?ority & coord9ation4 #ceed4 ,ag5cy responsibilities4 #ceee4 ,multiag5cy ongo+ ?reat assessm5t4 #ceef4 ,indep5d5t evaluations4 #ceeg4 ,national security sy/ems4 4 7#b7 ,o!r ref]5ces 7,a7 ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is am5d$ by /rik+ section #cecb7c7 & ins]t+ section #ceeb4 7,b7 ,section #bbbb7;j77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb4 7,c7 ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$1 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb4 7,d7 ,section #bcae ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb4 7,e7 ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7i7 9 subsection 7a77#b71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb2 7ii7 9 subsection 7c77#c71 by /rik+ ,director ( ! ,(fice ( ,managem5t & ,budget & ins]t+ ,secret>y ( ,comm]ce2 7iii7 9 subsection 7d77#a71 by /rik+ ,director ( ! ,(fice ( ,managem5t & ,budget & ins]t+ ,secret>y ( ,comm]ce2 7iv7 9 subsection 7d77#h7 by /rik+ ,director ( ! ,(fice ( ,managem5t & ,budget & ins]t+ ,secret>y ( ,comm]ce2 7v7 9 subsection 7d77#h71 by /rik+ submitt$ to ! ,director & ins]t+ submitt$ to ! ,secret>y2 7vi7 9 subsection 7e77#b71 by /rik+ section #cecb7a7 ( su* title & ins]t+ section #ceeb ( title #dd2 & 7vii7 9 subsection 7e77#e71 by /rik+ section #cecb7;b77#b7 ( su* title & ins]t+ section #ceeb ( title #dd4 7,f7 ,section #h7;d77#a7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjf7;d77#a77 is am5d$ by /rik+ section #cecd7;b7 & ins]t+ section #ceed7;b77#b74 #bjb4 ,managem5t ( in=mation te*nology 7a7 ,9 g5]al ,section #aacca ( title #dj1 ,unit$ ,/ates ,code1 is am5d$ to read z foll[s3 #aacca4 ,responsibilities = ,f$]al in=mation sy/ems /&>ds 7a7 ,/&>ds & guidel9es 7#a7 ,au?ority to prescribe ,except z provid$ "u p>agraph 7#b71 ! ,secret>y ( ,comm]ce %all prescribe /&>ds & guidel9es p]ta9+ to ,f$]al in=mation sy/ems-- 7,a7 9 consultation ) ! ,secret>y ( ,homel& ,security2 & 7,b7 on ! basis ( /&>ds & guidel9es develop$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u p>agraphs 7#b7 & 7#c7 ( section #bj7;a7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a77#b7 & 7a77#c774 7#b7 ,national security sy/ems ,/&>ds & guidel9es = national security sy/ems %all be develop$1 prescrib$1 en=c$1 & ov]se5 z o!rwise au?oriz$ by law & z direct$ by ! ,presid5t4 7b7 ,m&atory /&>ds & guidel9es 7#a7 ,au?ority to make m&atory /&>ds & guidel9es ,! ,secret>y ( ,comm]ce %all make /&>ds & guidel9es "u subsection 7a77#a7 compulsory & b9d+ to ! ext5t det]m9$ necess>y by ! ,secret>y ( ,comm]ce to improve ! effici5cy ( op]ation or security ( ,f$]al in=mation sy/ems4 7#b7 ,requir$ m&atory /&>ds & guidel9es 7,a7 ,9 g5]al ,/&>ds & guidel9es "u subsection 7a77#a7 %all include in=mation security /&>ds t-- 7i7 provide m9imum in=mation security requirem5ts z det]m9$ "u section #bj7;b7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;b772 & 7ii7 are o!rwise necess>y to improve ! security ( ,f$]al in=mation & in=mation sy/ems4 7,b7 ,b9d+ effect ,in=mation security /&>ds "u subp>agraph 7,a7 %all be compulsory & b9d+4 7c7 ,ex]cise ( au?ority ,to ensure fiscal & policy consi/5cy1 ! ,secret>y ( ,comm]ce %all ex]cise ! au?ority conf]r$ by ?is section subject to direction by ! ,presid5t & 9 coord9ation ) ! ,director4 7d7 ,application ( m /r+5t /&>ds & guidel9es ,! head ( an executive ag5cy may employ /&>ds = ! co/-effective in=mation security = in=mation sy/ems )9 or "u ! sup]vision ( t ag5cy t are m /r+5t ?an ! /&>ds & guidel9es ! ,secret>y ( ,comm]ce prescribes "u ?is section if ! m /r+5t /&>ds & guidel9es-- 7#a7 conta9 at lea/ ! applicable /&>ds & guidel9es made compulsory & b9d+ by ! ,secret>y ( ,comm]ce2 & 7#b7 are o!rwise consi/5t ) ! policies1 directives1 & implem5tation memor&a issu$ "u section #ceec7;a7 ( title #dd4 7e7 ,decisions on promulgation ( /&>ds & guidel9es ,! decision by ! ,secret>y ( ,comm]ce reg>d+ ! promulgation ( any /&>d or guidel9e "u ?is section %all occur n lat] ?an #f mon?s aft] ! date ( submission ( ! propos$ /&>d to ! ,secret>y ( ,comm]ce by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c74 7f7 ,notice & comm5t ,a decision by ! ,secret>y ( ,comm]ce to significantly modify1 or n promulgate1 a propos$ /&>d submitt$ to ! ,secret>y by ! ,national ,in/itute ( ,/&>ds & ,te*nology "u section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 %all be made aft] ! public is giv5 an opportunity to comm5t on ! ,secret>y's propos$ decision4 7g7 ,def9itions ,9 ?is section3 7#a7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd4 7#b7 ,in=mation security ,! t]m in=mation security has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd4 7#c7 ,national security sy/em ,! t]m national security sy/em has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd4 4 #bjc4 ,no new fund+ ,an applicable ,f$]al ag5cy %all c>ry out ! provisions ( ?is title ) exi/+ facilities & funds o!rwise available1 ?r\gh su* means z ! head ( ! ag5cy consid]s appropriate4 #bjd4 ,te*nical & con=m+ am5dm5ts ,section #ba7;b7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#d7;b77 is am5d$-- 7#a7 9 p>agraph 7#b71 by /rik+ & ! ,director ( ! ,(fice ( ,managem5t & ,budget & ins]t+ 1 ! ,secret>y ( ,comm]ce1 & ! ,secret>y ( ,homel& ,security2 & 7#b7 9 p>agraph 7#c71 by ins]t+ 1 ! ,secret>y ( ,homel& ,security1 aft] ! ,secret>y ( ,comm]ce4 #bje4 ,cl>ification ( au?orities ,no?+ 9 ?is title %all be con/ru$ to convey any new regulatory au?ority to any gov]nm5t entity implem5t+ or comply+ ) any provision ( ?is title4 ,,iii ,crim9al p5alties #cja4 ,p5alties = fraud & relat$ activity 9 connection ) comput]s ,section #ajcj7;c7 ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ to read z foll[s3 7c7 ,! puni%m5t = an (f5se "u subsection 7a7 or 7b7 ( ?is section is-- 7#a7 a f9e "u ?is title or imprisonm5t = n m ?an #bj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#a7 ( ?is section2 7#b7 7,a7 except z provid$ 9 subp>agraph 7,b71 a f9e "u ?is title or imprisonm5t = n m ?an #c ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#b72 or 7,b7 a f9e "u ?is title or imprisonm5t = n m ?an t5 ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#b7 ( ?is section1 if-- 7i7 ! (f5se 0 committ$ = purposes ( comm]cial advantage or private f9ancial ga92 7ii7 ! (f5se 0 committ$ 9 ! fur!rance ( any crim9al or torti\s act 9 violation ( ! ,con/itution or laws ( ! ,unit$ ,/ates1 or ( any ,/ate2 or 7iii7 ! value ( ! in=mation obta9$1 or t w\ld h be5 obta9$ if ! (f5se 0 complet$1 exce$s #e1jjj2 7#c7 a f9e "u ?is title or imprisonm5t = n m ?an #aj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#c7 ( ?is section2 7#d7 a f9e "u ?is title or imprisonm5t ( n m ?an #bj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#d7 ( ?is section2 7#e7 7,a7 except z provid$ 9 subp>agraph 7,c71 a f9e "u ?is title1 imprisonm5t = n m ?an #bj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#e77;,a7 ( ?is section1 if ! (f5se caus$-- 7i7 loss to #a or m p]sons dur+ any #a-ye> p]iod 7&1 = purposes ( an inve/igation1 prosecution1 or o!r proce$+ br\ght by ! ,unit$ ,/ates only1 loss result+ f a relat$ c\rse ( conduct affect+ #a or m o!r protect$ comput]s7 aggregat+ at lea/ #e1jjj 9 value2 7ii7 ! modification or impairm5t1 or pot5tial modification or impairm5t1 ( ! m$ical exam9ation1 diagnosis1 treatm5t1 or c>e ( #a or m individuals2 7iii7 physical injury to any p]son2 7iv7 a ?reat to public heal? or safety2 7v7 damage affect+ a comput] us$ by1 or on behalf (1 an entity ( ! ,unit$ ,/ates ,gov]nm5t 9 fur!rance ( ! adm9i/ration ( ju/ice1 national def5se1 or national security2 or 7vi7 damage affect+ #aj or m protect$ comput]s dur+ any #a-ye> p]iod2 7,b7 a f9e "u ?is title1 imprisonm5t = n m ?an #bj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#e77;,b71 if ! (f5se caus$ a h>m provid$ 9 clause 7i7 ?r\gh 7vi7 ( subp>agraph 7,a7 ( ?is subsection2 7,c7 if ! (f5d] attempts to cause or kn[+ly or recklessly causes dea? f conduct 9 violation ( subsection 7a77#e77;,a71 a f9e "u ?is title1 imprisonm5t = any t]m ( ye>s or = life1 or bo?2 7,d7 a f9e "u ?is title1 imprisonm5t = n m ?an #aj ye>s1 or bo?1 = any o!r (f5se "u subsection 7a77#e72 7,e7 a f9e "u ?is title or imprisonm5t = n m ?an #aj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#f7 ( ?is section2 or 7,f7 a f9e "u ?is title or imprisonm5t = n m ?an #aj ye>s1 or bo?1 9 ! case ( an (f5se "u subsection 7a77#g7 ( ?is section4 4 #cjb4 ,traffick+ 9 passwords ,section #ajcj7;a77#f7 ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ to read z foll[s3 7#f7 kn[+ly & ) int5t to defraud traffics 7z def9$ 9 section #ajbi7 9 any password or simil> in=mation or means ( access ?r\gh :i* a protect$ comput] 7z def9$ 9 subp>agraphs 7,a7 & 7,b7 ( subsection 7e77#b77 may be access$ )\t au?orization4 4 #cjc4 ,conspiracy & attempt$ comput] fraud (f5ses ,section #ajcj7;b7 ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ z if = ! complet$ (f5se aft] puni%$ z provid$4 #cjd4 ,crim9al & civil =feiture = fraud & relat$ activity 9 connection ) comput]s ,section #ajcj ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ subsections 7i7 & 7j7 & ins]t+ ! foll[+3 7i7 ,crim9al =feiture 7#a7 ,! c\rt1 9 impos+ s5t5ce on any p]son convict$ ( a violation ( ?is section1 or convict$ ( conspiracy to violate ?is section1 %all ord]1 9 addition to any o!r s5t5ce impos$ & irrespective ( any provision ( ,/ate law1 t su* p]son =feit to ! ,unit$ ,/ates-- 7,a7 su* p]sons int]e/ 9 any prop]ty1 real or p]sonal1 t 0 us$1 or int5d$ to be us$1 to commit or facilitate ! commission ( su* violation2 & 7,b7 any prop]ty1 real or p]sonal1 con/itut+ or d]iv$ f any gross proce$s1 or any prop]ty traceable to su* prop]ty1 t su* p]son obta9$1 directly or indirectly1 z a result ( su* violation4 7#b7 ,! crim9al =feiture ( prop]ty "u ?is subsection1 includ+ any seizure & disposition ( ! prop]ty1 & any relat$ judicial or adm9i/rative proce$+1 %all be gov]n$ by ! provisions ( section #dac ( ! ,compreh5sive ,drug ,abuse ,prev5tion & ,control ,act ( #aigj 7#ba ,u4,s4,c4 #hec71 except subsection 7d7 ( t section4 7j7 ,civil =feiture 7#a7 ,! foll[+ %all be subject to =feiture to ! ,unit$ ,/ates & no prop]ty "r1 real or p]sonal1 %all exi/ 9 !m3 7,a7 ,any prop]ty1 real or p]sonal1 t 0 us$1 or int5d$ to be us$1 to commit or facilitate ! commission ( any violation ( ?is section1 or a conspiracy to violate ?is section4 7,b7 ,any prop]ty1 real or p]sonal1 con/itut+ or d]iv$ f any gross proce$s obta9$ directly or indirectly1 or any prop]ty traceable to su* prop]ty1 z a result ( ! commission ( any violation ( ?is section1 or a conspiracy to violate ?is section4 7#b7 ,seizures & =feitures "u ?is subsection %all be gov]n$ by ! provisions 9 *apt] #df relat+ to civil =feitures1 except t su* duties z are impos$ on ! ,secret>y ( ! ,treasury "u ! cu/oms laws describ$ 9 section #iha7;d7 %all be p]=m$ by su* (fic]s1 ag5ts & o!r p]sons z may be designat$ = t purpose by ! ,secret>y ( ,homel& ,security or ! ,attorney ,g5]al4 4 #cje4 ,damage to critical infra/ructure comput]s 7a7 ,9 g5]al ,*apt] #dg ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #ajcj ! foll[+3 #ajcj;,a4 ,aggravat$ damage to a critical infra/ructure comput] 7a7 ,def9itions ,9 ?is section-- 7#a7 ! t]m comput] has ! mean+ giv5 ! t]m 9 section #ajcj2 7#b7 ! t]m critical infra/ructure comput] means a comput] t manages or controls sy/ems or assets vital to national def5se1 national security1 national economic security1 public heal? or safety1 or any comb9ation ( ^? matt]s1 :e!r publicly or privately own$ or op]at$1 includ+-- 7,a7 oil & gas production1 /orage1 conv]sion1 & deliv]y sy/ems2 7,b7 wat] supply sy/ems2 7,c7 telecommunication networks2 7,d7 electrical p[] g5]ation & deliv]y sy/ems2 7,e7 f9ance & bank+ sy/ems2 7,f7 em]g5cy s]vices2 7,g7 transportation sy/ems & s]vices2 & 7,h7 gov]nm5t op]ations t provide ess5tial s]vices to ! public2 & 7#c7 ! t]m damage has ! mean+ giv5 ! t]m 9 section #ajcj4 7b7 ,(f5se ,x %all be unlawful1 dur+ & 9 relation to a felony violation ( section #ajcj1 to kn[+ly cause or attempt to cause damage to a critical infra/ructure comput] if ! damage results 9 7or1 9 ! case ( an attempt1 if complet$1 w\ld h result$ 97 ! sub/antial impairm5t-- 7#a7 ( ! op]ation ( ! critical infra/ructure comput]2 or 7#b7 ( ! critical infra/ructure associat$ ) ! comput]4 7c7 ,p5alty ,any p]son :o violates subsection 7b7 %all be-- 7#a7 f9$ "u ?is title2 7#b7 imprison$ = n less ?an #c ye>s b n m ?an #bj ye>s2 or 7#c7 p5aliz$ "u p>agraphs 7#a7 & 7#b74 7d7 ,consecutive s5t5ce ,not)/&+ any o!r provision ( law-- 7#a7 a c\rt %all n place on probation any p]son convict$ ( a violation ( ?is section2 7#b7 except z provid$ 9 p>agraph 7#d71 no t]m ( imprisonm5t impos$ on a p]son "u ?is section %all run concurr5tly ) any o!r t]m ( imprisonm5t1 includ+ any t]m ( imprisonm5t impos$ on ! p]son "u any o!r provision ( law1 includ+ any t]m ( imprisonm5t impos$ = a felony violation ( section #ajcj2 7#c7 9 det]m9+ any t]m ( imprisonm5t to be impos$ = a felony violation ( section #ajcj1 a c\rt %all n 9 any way r$uce ! t]m to be impos$ = su* crime s z to comp5sate =1 or o!rwise take into acc\nt1 any sep>ate t]m ( imprisonm5t impos$ or to be impos$ = a violation ( ?is section2 & 7#d7 a t]m ( imprisonm5t impos$ on a p]son = a violation ( ?is section may1 9 ! discretion ( ! c\rt1 run concurr5tly1 9 :ole or 9 "p1 only ) ano!r t]m ( imprisonm5t t is impos$ by ! c\rt at ! same "t on t p]son = an additional violation ( ?is section1 provid$ t su* discretion %all be ex]cis$ 9 accordance ) any applicable guidel9es & policy /atem5ts issu$ by ! ,unit$ ,/ates ,s5t5c+ ,commission pursuant to section #iid ( title #bh4 4 7b7 ,te*nical & con=m+ am5dm5t ,! *apt] analysis = *apt] #dg ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] ! item relat+ to section #ajcj ! foll[+3 #ajcj;,a4 ,aggravat$ damage to a critical infra/ructure comput]4 4 #cjf4 ,limitation on actions involv+ unau?oriz$ use ,section #ajcj7;e77#f7 ( title #ah1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ alt]2 & ins]t+ alt]1 b does n include access 9 violation ( a contractual obligation or agreem5t1 su* z an acceptable use policy or t]ms ( s]vice agreem5t1 ) an ,int]net s]vice provid]1 ,int]net website1 or non-gov]nm5t employ]1 if su* violation con/itutes ! sole basis = det]m9+ t access to a protect$ comput] is unau?oriz$24 #cjg4 ,no new fund+ ,an applicable ,f$]al ag5cy %all c>ry out ! provisions ( ?is title ) exi/+ facilities & funds o!rwise available1 ?r\gh su* means z ! head ( ! ag5cy consid]s appropriate4 ,,iv ,cyb]security rese>* & developm5t #dja4 ,national ,high-,p]=mance ,comput+ ,program plann+ & coord9ation 7a7 ,goals & priorities ,section #aja ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7 is am5d$ by add+ at ! end ! foll[+3 7d7 ,goals & priorities ,! goals & priorities = ,f$]al high-p]=mance comput+ rese>*1 developm5t1 network+1 & o!r activities "u subsection 7a77#b77;,a7 %all include-- 7#a7 enc\rag+ & support+ me*anisms = int]discipl9>y rese>* & developm5t 9 network+ & in=mation te*nology1 includ+-- 7,a7 ?r\gh collaborations across ag5cies2 7,b7 ?r\gh collaborations across ,program ,compon5t ,areas2 7,c7 ?r\gh collaborations ) indu/ry2 7,d7 ?r\gh collaborations ) in/itutions ( high] education2 7,e7 ?r\gh collaborations ) ,f$]al laboratories 7z def9$ 9 section #d ( ! ,/ev5son-,wydl] ,te*nology ,innovation ,act ( #aihj 7#ae ,u4,s4,c4 #cgjc772 & 7,f7 ?r\gh collaborations ) int]national organizations2 7#b7 address+ national1 multi-ag5cy1 multi-facet$ *all5ges ( national importance2 & 7#c7 fo/]+ ! transf] ( rese>* & developm5t results into new te*nologies & applications = ! b5efit ( society4 4 7b7 ,developm5t ( /rategic plan ,section #aja ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7 is am5d$ by add+ at ! end ! foll[+3 7e7 ,/rategic plan 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac1 ! ag5cies "u subsection 7a77#c77;,b71 work+ ?r\gh ! ,national ,sci5ce & ,te*nology ,c\ncil & ) ! assi/ance ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all develop a #e-ye> /rategic plan to guide ! activities "u subsection 7a77#a74 7#b7 ,cont5ts ,! /rategic plan %all specify-- 7,a7 ! ne>-t]m objectives = ! ,program2 7,b7 ! long-t]m objectives = ! ,program2 7,c7 ! anticipat$ "t frame = a*iev+ ! ne>-t]m objectives2 7,d7 ! metrics t w be us$ to assess any progress made t[>d a*iev+ ! ne>-t]m objectives & ! long-t]m objectives2 & 7,e7 h[ ! ,program w a*ieve ! goals & priorities "u subsection 7d74 7#c7 ,implem5tation roadmap 7,a7 ,9 g5]al ,! ag5cies "u subsection 7a77#c77;,b7 %all develop & annually update an implem5tation roadmap = ! /rategic plan4 7,b7 ,requirem5ts ,! in=mation 9 ! implem5tation roadmap %all be coord9at$ ) ! database "u section #ajb7;c7 & ! annual report "u section #aja7;a77#c74 ,! implem5tation roadmap %all-- 7i7 specify ! role ( ea* ,f$]al ag5cy 9 c>ry+ out or sponsor+ rese>* & developm5t to meet ! rese>* objectives ( ! /rategic plan1 includ+ a description ( h[ progress t[>d ! rese>* objectives w be evaluat$1 ) consid]ation ( any relevant recomm5dations ( ! advisory committee2 7ii7 specify ! fund+ allocat$ to ea* major rese>* objective ( ! /rategic plan & ! s\rce ( fund+ by ag5cy = ! curr5t fiscal ye>2 & 7iii7 e/imate ! fund+ requir$ = ea* major rese>* objective ( ! /rategic plan = ! next #c fiscal ye>s4 7#d7 ,recomm5dations ,! ag5cies "u subsection 7a77#c77;,b7 %all take into consid]ation :5 develop+ ! /rategic plan "u p>agraph 7#a7 ! recomm5dations (-- 7,a7 ! advisory committee "u subsection 7b72 & 7,b7 ! /akehold]s "u section #ajb7;a77#c74 7#e7 ,report to ,congress ,! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all transmit ! /rategic plan "u ?is subsection1 includ+ ! implem5tation roadmap & any updates "u p>agraph 7#c71 to-- 7,a7 ! advisory committee "u subsection 7b72 7,b7 ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate2 & 7,c7 ! ,committee on ,sci5ce & ,te*nology ( ! ,h\se ( ,repres5tatives4 4 7c7 ,p]iodic reviews ,section #aja ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7 is am5d$ by add+ at ! end ! foll[+3 7f7 ,p]iodic reviews ,! ag5cies "u subsection 7a77#c77;,b7 %all-- 7#a7 p]iodically assess ! cont5ts & fund+ levels ( ! ,program ,compon5t ,areas & re/ructure ! ,program :5 w>rant$1 tak+ into consid]ation any relevant recomm5dations ( ! advisory committee "u subsection 7b72 & 7#b7 ensure t ! ,program includes national1 multi-ag5cy1 multi-facet$ rese>* & developm5t activities1 includ+ activities describ$ 9 section #ajd4 4 7d7 ,additional responsibilities ( ,director ,section #aja7;a77#b7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#b77 is am5d$-- 7#a7 by r$esignat+ subp>agraphs 7,e7 & 7,f7 z subp>agraphs 7,g7 & 7,h71 respectively2 & 7#b7 by ins]t+ aft] subp>agraph 7,d7 ! foll[+3 7,e7 enc\rage & monitor ! ef=ts ( ! ag5cies p>ticipat+ 9 ! ,program to allocate ! level ( res\rces & managem5t att5tion necess>y-- 7i7 to ensure t ! /rategic plan "u subsection 7e7 is develop$ & execut$ effectively2 & 7ii7 to ensure t ! objectives ( ! ,program are met2 7,f7 work+ ) ! ,(fice ( ,managem5t & ,budget & 9 coord9ation ) ! creation ( ! database "u section #ajb7;c71 direct ! ,(fice ( ,sci5ce & ,te*nology ,policy & ! ag5cies p>ticipat+ 9 ! ,program to e/abli% a me*anism 7consi/5t ) exi/+ law7 to track all ongo+ & complet$ rese>* & developm5t projects & associat$ fund+2 4 7e7 ,advisory committee ,section #aja7;b7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7;b77 is am5d$-- 7#a7 9 p>agraph 7#a7-- 7,a7 by ins]t+ aft] ! fir/ s5t5ce ! foll[+3 ,! co-*airs ( ! advisory committee %all meet ! qualifications ( committee memb]s & may be memb]s ( ! ,presid5ts ,c\ncil ( ,advisors on ,sci5ce & ,te*nology42 & 7,b7 by /rik+ high-p]=mance 9 subp>agraph 7,d7 & ins]t+ high-end2 & 7#b7 by am5d+ p>agraph 7#b7 to read z foll[s3 7#b7 ,9 addition to ! duties "u p>agraph 7#a71 ! advisory committee %all conduct p]iodic evaluations ( ! fund+1 managem5t1 coord9ation1 implem5tation1 & activities ( ! ,program4 ,! advisory committee %all report its f9d+s & recomm5dations n less frequ5tly ?an once e #c fiscal ye>s to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,sci5ce & ,te*nology ( ! ,h\se ( ,repres5tatives4 ,! report %all be submitt$ 9 conjunction ) ! update ( ! /rategic plan4 4 7f7 ,report ,section #aja7;a77#c7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77 is am5d$-- 7#a7 9 subp>agraph 7,c7-- 7,a7 by /rik+ is submitt$1 & ins]t+ is submitt$1 ! levels = ! previ\s fiscal ye>12 & 7,b7 by /rik+ ea* ,program ,compon5t ,area & ins]t+ ea* ,program ,compon5t ,area & ea* rese>* area support$ 9 accordance ) section #ajd2 7#b7 9 subp>agraph 7,d7-- 7,a7 by /rik+ ea* ,program ,compon5t ,area1 & ins]t+ ea* ,program ,compon5t ,area & ea* rese>* area support$ 9 accordance ) section #ajd12 7,b7 by /rik+ is submitt$1 & ins]t+ is submitt$1 ! levels = ! previ\s fiscal ye>12 & 7,c7 by /rik+ & aft] ! semicolon2 7#c7 by r$esignat+ subp>agraph 7,e7 z subp>agraph 7,g72 & 7#d7 by ins]t+ aft] subp>agraph 7,d7 ! foll[+3 7,e7 include a description ( h[ ! objectives = ea* ,program ,compon5t ,area1 & ! objectives = activities t involve multiple ,program ,compon5t ,areas1 relate to ! objectives ( ! ,program id5tifi$ 9 ! /rategic plan "u subsection 7e72 7,f7 include-- 7i7 a description ( ! fund+ requir$ by ! ,(fice ( ,sci5ce & ,te*nology ,policy to p]=m ! functions "u subsections 7a7 & 7c7 ( section #ajb = ! next fiscal ye> by category ( activity2 7ii7 a description ( ! fund+ requir$ by ! ,(fice ( ,sci5ce & ,te*nology ,policy to p]=m ! functions "u subsections 7a7 & 7c7 ( section #ajb = ! curr5t fiscal ye> by category ( activity2 & 7iii7 ! am\nt ( fund+ provid$ = ! ,(fice ( ,sci5ce & ,te*nology ,policy = ! curr5t fiscal ye> by ea* ag5cy p>ticipat+ 9 ! ,program2 & 4 7g7 ,def9itions ,section #d ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eejc7 is am5d$-- 7#a7 by r$esignat+ p>agraphs 7#a7 & 7#b7 z p>agraphs 7#b7 & 7#c71 respectively2 7#b7 by r$esignat+ p>agraph 7#c7 z p>agraph 7#f72 7#c7 by r$esignat+ p>agraphs 7#f7 & 7#g7 z p>agraphs 7#g7 & 7#h71 respectively2 7#d7 by ins]t+ be=e p>agraph 7#b71 z r$esignat$1 ! foll[+3 7#a7 cyb]-physical sy/ems means physical or eng9e]$ sy/ems ^: network+ & in=mation te*nology functions & physical elem5ts are deeply integrat$ & are actively connect$ to ! physical _w ?r\gh s5sors1 actuators1 or o!r means to p]=m monitor+ & control functions2 2 7#e7 9 p>agraph 7#c71 z r$esignat$1 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 7#f7 9 p>agraph 7#f71 z r$esignat$-- 7,a7 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 & 7,b7 by /rik+ sup]comput] & ins]t+ high-end comput+2 7#g7 9 p>agraph 7#e71 by /rik+ network ref]r$ to z & all t foll[s ?r\gh ! semicolon & ins]t+ network1 includ+ advanc$ comput] networks ( ,f$]al ag5cies & dep>tm5ts2 & 7#h7 9 p>agraph 7#g71 z r$esignat$1 by /rik+ ,national ,high-,p]=mance ,comput+ ,program & ins]t+ network+ & in=mation te*nology rese>* & developm5t program4 #djb4 ,rese>* 9 areas ( national importance 7a7 ,rese>* 9 areas ( national importance ,title ,i ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa et seq47 is am5d$ by add+ at ! end ! foll[+3 #ajd4 ,rese>* 9 areas ( national importance 7a7 ,9 g5]al ,! ,program %all enc\rage ag5cies "u section #aja7;a77#c77;,b7 to support1 ma9ta91 & improve national1 multi-ag5cy1 multi-facet$1 rese>* & developm5t activities 9 network+ & in=mation te*nology direct$ t[>d application areas t h ! pot5tial = significant contributions to national economic competitiv5ess & = o!r significant societal b5efits4 7b7 ,te*nical solutions ,an activity "u subsection 7a7 %all be design$ to advance ! developm5t ( rese>* discov]ies by demon/rat+ te*nical solutions to important problems 9 areas includ+-- 7#a7 cyb]security2 7#b7 heal? c>e2 7#c7 en]gy managem5t & l[-p[] sy/ems & devices2 7#d7 transportation1 includ+ surface & air transportation2 7#e7 cyb]-physical sy/ems2 7#f7 l>ge-scale data analysis & model+ ( physical ph5om5a2 7#g7 l>ge scale data analysis & model+ ( behavioral ph5om5a2 7#h7 supply *a9 quality & security2 & 7#i7 privacy protection & protect$ disclosure ( confid5tial data4 7c7 ,recomm5dations ,! advisory committee "u section #aja7;b7 %all make recomm5dations to ! ,program = c&idate rese>* & developm5t areas = support "u ?is section4 7d7 ,*>act]i/ics 7#a7 ,9 g5]al ,rese>* & developm5t activities "u ?is section-- 7,a7 %all include projects select$ on ! basis ( applications = support ?r\gh a competitive1 m]it-bas$ process2 7,b7 %all lev]age1 :5 possible1 ,f$]al inve/m5ts ?r\gh collaboration ) relat$ ,/ate initiatives2 7,c7 %all include a plan = fo/]+ ! transf] ( rese>* discov]ies & ! results ( te*nology demon/ration activities1 includ+ f in/itutions ( high] education & ,f$]al laboratories1 to indu/ry = comm]cial developm5t2 7,d7 %all involve collaborations among rese>*]s 9 in/itutions ( high] education & indu/ry2 & 7,e7 may involve collaborations among nonpr(it rese>* in/itutions & ,f$]al laboratories1 z appropriate4 7#b7 ,co/-%>+ ,9 select+ applications = support1 ! ag5cies "u section #aja7;a77#c77;,b7 %all give special consid]ation to projects t include co/ %>+ f non-,f$]al s\rces4 7#c7 ,multidiscipl9>y rese>* c5t]s ,rese>* & developm5t activities "u ?is section %all be support$ ?r\gh multidiscipl9>y rese>* c5t]s1 includ+ ,f$]al laboratories1 t are organiz$ to inve/igate basic rese>* que/ions & c>ry out te*nology demon/ration activities 9 areas describ$ 9 subsection 7a74 ,rese>* may be c>ri$ out ?r\gh exi/+ multidiscipl9>y c5t]s1 includ+ ^? au?oriz$ "u section #gjbd7;b77#b7 ( ! ,am]ica ,,competes ,act 7#db ,u4,s4,c4 #ahfbo-#aj7b774 4 7b7 ,cyb]-,physical sy/ems ,section #aja7;a77#a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#a77 is am5d$-- 7#a7 9 subp>agraph 7,h71 by /rik+ & aft] ! semicolon2 7#b7 9 subp>agraph 7,i71 by /rik+ ! p]iod at ! end & ins]t+ a semicolon2 & 7#c7 by add+ at ! end ! foll[+3 7,j7 provide = increas$ und]/&+ ( ! sci5tific pr9ciples ( cyb]-physical sy/ems & improve ! me?ods available = ! design1 developm5t1 & op]ation ( cyb]-physical sy/ems t are *>act]iz$ by high reliability1 safety1 & security2 & 7,k7 provide = rese>* & developm5t on human-comput] int]actions1 visualization1 & big data4 4 7c7 ,task =ce ,title ,i ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa et seq471 z am5d$ by section #djb7;a7 ( ?is ,act1 is am5d$ by add+ at ! end ! foll[+3 #aje4 ,task =ce 7a7 ,e/abli%m5t ,n lat] ?an #ahj days aft] ! date ( enactm5t ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac1 ! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy "u section #ajb %all conv5e a task =ce to explore me*anisms = c>ry+ out collaborative rese>* & developm5t activities = cyb]-physical sy/ems 7includ+ ! relat$ te*nologies requir$ to enable ^! sy/ems7 ?r\gh a consortium or o!r appropriate entity ) p>ticipants f in/itutions ( high] education1 ,f$]al laboratories1 & indu/ry4 7b7 ,functions ,! task =ce %all-- 7#a7 develop options = a collaborative model & an organizational /ructure = su* entity "u :i* ! jo9t rese>* & developm5t activities c\ld be plann$1 manag$1 & conduct$ effectively1 includ+ me*anisms = ! allocation ( res\rces among ! p>ticipants 9 su* entity = support ( su* activities2 7#b7 propose a process = develop+ a rese>* & developm5t ag5da = su* entity1 includ+ guidel9es to ensure an appropriate scope ( "w focus$ on nationally significant *all5ges & requir+ collaboration & to ensure ! developm5t ( relat$ sci5tific & te*nological mile/ones2 7#c7 def9e ! roles & responsibilities = ! p>ticipants f in/itutions ( high] education1 ,f$]al laboratories1 & indu/ry 9 su* entity2 7#d7 propose guidel9es = assign+ intellectual prop]ty rights & = transf]r+ rese>* results to ! private sector2 & 7#e7 make recomm5dations = h[ su* entity c\ld be fund$ f ,f$]al1 ,/ate1 & non-gov]nm5tal s\rces4 7c7 ,composition ,9 e/abli%+ ! task =ce "u subsection 7a71 ! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all appo9t an equal numb] ( individuals f in/itutions ( high] education & f indu/ry ) k & exp]tise 9 cyb]-physical sy/ems1 & may appo9t n m ?an #b individuals f ,f$]al laboratories4 7d7 ,report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ! ,/r5g!n+ & ,enhanc+ ,cyb]security by ,us+ ,rese>*1 ,education1 ,in=mation1 & ,te*nology ,act ( #bjac1 ! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all transmit to ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate & ! ,committee on ,sci5ce & ,te*nology ( ! ,h\se ( ,repres5tatives a report describ+ ! f9d+s & recomm5dations ( ! task =ce4 7e7 ,t]m9ation ,! task =ce %all t]m9ate ^u transmittal ( ! report requir$ "u subsection 7d74 7f7 ,comp5sation & exp5ses ,memb]s ( ! task =ce %all s]ve )\t comp5sation4 4 #djc4 ,program improvem5ts ,section #ajb ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeab7 is am5d$ to read z foll[s3 #ajb4 ,program improvem5ts 7a7 ,functions ,! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all cont9ue-- 7#a7 to provide te*nical & adm9i/rative support to-- 7,a7 ! ag5cies p>ticipat+ 9 plann+ & implem5t+ ! ,program1 includ+ support ne$$ to develop ! /rategic plan "u section #aja7;e72 & 7,b7 ! advisory committee "u section #aja7;b72 7#b7 to s]ve z ! prim>y po9t ( contact on ,f$]al network+ & in=mation te*nology activities = gov]nm5t ag5cies1 academia1 indu/ry1 pr(essional societies1 ,/ate comput+ & network+ te*nology programs1 int]e/$ citiz5 gr\ps1 & o!rs to ex*ange te*nical & programmatic in=mation2 7#c7 to solicit input & recomm5dations f a wide range ( /akehold]s dur+ ! developm5t ( ea* /rategic plan "u section #aja7;e7 by conv5+ at lea/ #a work%op ) invitees f academia1 indu/ry1 ,f$]al laboratories1 & o!r relevant organizations & in/itutions2 7#d7 to conduct public outrea*1 includ+ ! dissem9ation ( ! advisory committee's f9d+s & recomm5dations1 z appropriate2 7#e7 to promote access to & e>ly application ( ! te*nologies1 innovations1 & exp]tise d]iv$ f ,program activities to ag5cy missions & sy/ems across ! ,f$]al ,gov]nm5t & to ,unit$ ,/ates indu/ry2 7#f7 to ensure accurate & detail$ budget report+ ( network+ & in=mation te*nology rese>* & developm5t inve/m5t2 & 7#g7 to enc\rage ag5cies p>ticipat+ 9 ! ,program to use exi/+ programs & res\rces to /r5g!n network+ & in=mation te*nology education & tra9+1 & increase p>ticipation 9 su* fields1 includ+ by wom5 & und]repres5t$ m9orities4 7b7 ,s\rce ( fund+ 7#a7 ,9 g5]al ,! functions "u ?is section %all be support$ by funds f ea* ag5cy p>ticipat+ 9 ! ,program4 7#b7 ,specifications ,! portion ( ! total budget ( ! ,(fice ( ,sci5ce & ,te*nology ,policy t is provid$ by ea* ag5cy p>ticipat+ 9 ! ,program = ea* fiscal ye> %all be 9 ! same proportion z ea* ag5cy's %>e ( ! total budget = ! ,program = ! previ\s fiscal ye>1 z specifi$ 9 ! database "u section #ajb7;c74 7c7 ,database 7#a7 ,9 g5]al ,! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all develop & ma9ta9 a database ( projects fund$ by ea* ag5cy = ! fiscal ye> = ea* ,program ,compon5t ,area4 7#b7 ,public accessibility ,! ,director ( ! ,(fice ( ,sci5ce & ,te*nology ,policy %all make ! database accessible to ! public4 7#c7 ,database cont5ts ,! database %all include1 = ea* project 9 ! database-- 7,a7 a description ( ! project2 7,b7 ea* ag5cy1 indu/ry1 in/itution ( high] education1 ,f$]al laboratory1 or int]national in/itution involv$ 9 ! project2 7,c7 ! s\rce fund+ ( ! project 7set =? by ag5cy72 7,d7 ! fund+ hi/ory ( ! project2 & 7,e7 :e!r ! project has be5 complet$4 4 #djd4 ,improv+ education ( network+ & in=mation te*nology1 includ+ high p]=mance comput+ ,section #bja7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeba7;a77 is am5d$-- 7#a7 by r$esignat+ p>agraphs 7#b7 ?r\gh 7#d7 z p>agraphs 7#c7 ?r\gh 7#e71 respectively2 & 7#b7 by ins]t+ aft] p>agraph 7#a7 ! foll[+3 7#b7 ! ,national ,sci5ce ,f\ndation %all use its exi/+ programs1 9 collaboration ) o!r ag5cies1 z appropriate1 to improve ! tea*+ & le>n+ ( network+ & in=mation te*nology at all levels ( education & to increase p>ticipation 9 network+ & in=mation te*nology fields2 4 #dje4 ,con=m+ & te*nical am5dm5ts to ! ,high-,p]=mance ,comput+ ,act ( #aiia 7a7 ,section #c ,section #c ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eejb7 is am5d$-- 7#a7 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 7#b7 9 p>agraph 7#a7-- 7,a7 9 ! matt] prec$+ subp>agraph 7,a71 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 7,b7 9 subp>agraphs 7,a71 7,f71 & 7,g71 by /rik+ high-p]=mance comput+ ea* place x appe>s & ins]t+ network+ & in=mation te*nology2 & 7,c7 9 subp>agraph 7,h71 by /rik+ high-p]=mance & ins]t+ high-end2 & 7#c7 9 p>agraph 7#b7-- 7,a7 by /rik+ high-p]=mance comput+ & & ins]t+ network+ & in=mation te*nology1 &2 & 7,b7 by /rik+ high-p]=mance comput+ network & ins]t+ network+ & in=mation te*nology4 7b7 ,title head+ ,! head+ ( title ,i ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#aje ,/at4 #aeie7 is am5d$ by /rik+ ,high-p]=mance comput+ & ins]t+ ,network+ & in=mation te*nology4 7c7 ,section #aja ,section #aja ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeaa7 is am5d$-- 7#a7 9 ! section head+1 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology rese>* & developm5t2 7#b7 9 subsection 7a7-- 7,a7 9 ! subsection head+1 by /rik+ ,national ,high-,p]=mance ,comput+ & ins]t+ ,network+ & ,in=mation ,te*nology ,rese>* & ,developm5t2 7,b7 9 p>agraph 7#a7-- 7i7 by /rik+ ,national ,high-,p]=mance ,comput+ ,program & ins]t+ network+ & in=mation te*nology rese>* & developm5t program2 7ii7 9 subp>agraph 7,a71 by /rik+ high-p]=mance comput+1 includ+ network+ & ins]t+ network+ & in=mation te*nology2 7iii7 9 subp>agraphs 7,b7 & 7,g71 by /rik+ high-p]=mance ea* place x appe>s & ins]t+ high-end2 & 7iv7 9 subp>agraph 7,c71 by /rik+ high-p]=mance comput+ & network+ & ins]t+ high-end comput+1 di/ribut$1 & network+2 & 7,c7 9 p>agraph 7#b7-- 7i7 9 subp>agraphs 7,a7 & 7,c7-- 7,i7 by /rik+ high-p]=mance comput+ ea* place x appe>s & ins]t+ network+ & in=mation te*nology2 & 7,,ii7 by /rik+ developm5t1 network+1 ea* place x appe>s & ins]t+ developm5t12 & 7ii7 9 subp>agraphs 7,g7 & 7,h71 z r$esignat$ by section #dja7;d7 ( ?is ,act1 by /rik+ high-p]=mance ea* place x appe>s & ins]t+ high-end2 7#c7 9 subsection 7b77#a71 9 ! matt] prec$+ subp>agraph 7,a71 by /rik+ high-p]=mance comput+ ea* place x appe>s & ins]t+ network+ & in=mation te*nology2 & 7#d7 9 subsection 7c77#a77;,a71 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology4 7d7 ,section #bja ,section #bja7;a77#a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eeba7;a77#a77 is am5d$ by /rik+ high-p]=mance comput+ & advanc$ high-spe$ comput] network+ & ins]t+ network+ & in=mation te*nology rese>* & developm5t4 7e7 ,section #bjb ,section #bjb7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebb7;a77 is am5d$ by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology4 7f7 ,section #bjc ,section #bjc7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebc7;a77 is am5d$-- 7#a7 9 p>agraph 7#a71 by /rik+ high-p]=mance comput+ & network+ & ins]t+ network+ & in=mation te*nology2 & 7#b7 9 p>agraph 7#b77;,a71 by /rik+ high-p]=mance & ins]t+ high-end4 7g7 ,section #bjd ,section #bjd ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebd7 is am5d$-- 7#a7 9 subsection 7a77#a7-- 7,a7 9 subp>agraph 7,a71 by /rik+ high-p]=mance comput+ sy/ems & networks & ins]t+ network+ & in=mation te*nology sy/ems & capabilities2 7,b7 9 subp>agraph 7,b71 by /rik+ int]op]ability ( high-p]=mance comput+ sy/ems 9 networks & = common us] int]faces to sy/ems & ins]t+ int]op]ability & usability ( network+ & in=mation te*nology sy/ems2 & 7,c7 9 subp>agraph 7,c71 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 & 7#b7 9 subsection 7b7-- 7,a7 by /rik+ ,high-,p]=mance ,comput+ & ,network 9 ! head+ & ins]t+ ,network+ & ,in=mation ,te*nology2 & 7,b7 by /rik+ s5sitive4 7h7 ,section #bje ,section #bje7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebe7;a77 is am5d$ by /rik+ computational & ins]t+ network+ & in=mation te*nology4 7i7 ,section #bjf ,section #bjf7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebf7;a77 is am5d$ by /rik+ computational rese>* & ins]t+ network+ & in=mation te*nology rese>*4 7j7 ,section #bjg ,section #bjg ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebg7 is am5d$ by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology4 7k7 ,section #bjh ,section #bjh ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebh7 is am5d$-- 7#a7 9 ! section head+1 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nology2 & 7#b7 9 subsection 7a7-- 7,a7 9 p>agraph 7#a71 by /rik+ ,high-p]=mance comput+ & associat$ & ins]t+ ,network+ & in=mation2 7,b7 9 p>agraph 7#b71 by /rik+ high-p]=mance comput+ & ins]t+ network+ & in=mation te*nologies2 7,c7 9 p>agraph 7#c71 by /rik+ high-p]=mance & ins]t+ high-end2 7,d7 9 p>agraph 7#d71 by /rik+ high-p]=mance comput]s & associat$ & ins]t+ network+ & in=mation2 & 7,e7 9 p>agraph 7#e71 by /rik+ high-p]=mance comput+ & associat$ & ins]t+ network+ & in=mation4 #djf4 ,f$]al cyb] s*ol>%ip-=-s]vice program 7a7 ,9 g5]al ,! ,director ( ! ,national ,sci5ce ,f\ndation1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 %all c>ry out a ,f$]al cyb] s*ol>%ip-=-s]vice program to recruit & tra9 ! next g5]ation ( in=mation te*nology pr(essionals & security manag]s to meet ! ne$s ( ! cyb]security mission = ! ,f$]al ,gov]nm5t4 7b7 ,program description & compon5ts ,! program %all-- 7#a7 annually assess ! work=ce ne$s ( ! ,f$]al ,gov]nm5t = cyb]security pr(essionals1 includ+ network eng9e]s1 s(tw>e eng9e]s1 & o!r exp]ts 9 ord] to det]m9e h[ _m s*ol>%ips %\ld be aw>d$ annually to ensure t ! work=ce ne$s foll[+ graduation mat* ! numb] ( s*ol>%ips aw>d$2 7#b7 provide s*ol>%ips = up to #a1jjj /ud5ts p] ye> 9 _! pursuit ( und]graduate or graduate degrees 9 ! cyb]security field1 9 an am\nt t may include cov]age = full tuition1 fees1 & a /ip5d2 7#c7 require ea* s*ol>%ip recipi5t1 z a condition ( receiv+ a s*ol>%ip "u ! program1 to s]ve 9 a ,f$]al in=mation te*nology work=ce = a p]iod equal to "o & "o-half times ea* ye>1 or p>tial ye>1 ( s*ol>%ip receiv$1 9 addition to an int]n%ip 9 ! cyb]security field1 if applicable1 foll[+ graduation2 7#d7 provide a proc$ure = ! ,national ,sci5ce ,f\ndation or a ,f$]al ag5cy1 consi/5t ) regulations ( ! ,(fice ( ,p]sonnel ,managem5t1 to reque/ & fund a security cle>ance = a s*ol>%ip recipi5t1 includ+ provid+ = cle>ance dur+ a summ] int]n%ip & ^u graduation2 & 7#e7 provide opportunities = /ud5ts to receive tempor>y appo9tm5ts = mean+ful employm5t 9 ! ,f$]al in=mation te*nology work=ce dur+ s*ool vacation p]iods & = int]n%ips4 7c7 ,hir+ au?ority 7#a7 ,9 g5]al ,= purposes ( any law or regulation gov]n+ ! appo9tm5t ( an individual 9 ! ,f$]al civil s]vice1 ^u ! successful completion ( ! /ud5t's /udies1 a /ud5t receiv+ a s*ol>%ip "u ! program may-- 7,a7 be hir$ "u section #bac4cajb7r7 ( title #e1 ,code ( ,f$]al ,regulations2 & 7,b7 be exempt f competitive s]vice4 7#b7 ,competitive s]vice ,^u satisfactory fulfillm5t ( ! s]vice t]m "u p>agraph 7#a71 an individual may be conv]t$ to a competitive s]vice position )\t competition if ! individual meets ! requirem5ts = t position4 7d7 ,eligibility ,! eligibility requirem5ts = a s*ol>%ip "u ?is section %all include t a s*ol>%ip applicant-- 7#a7 be a citiz5 ( ! ,unit$ ,/ates2 7#b7 be eligible to be grant$ a security cle>ance2 7#c7 ma9ta9 a grade po9t av]age ( #c4b or above on a #d4j scale = und]graduate /udy or a #c4e or above on a #d4j scale = po/graduate /udy2 7#d7 demon/rate a commitm5t to a c>e] 9 improv+ ! security ( ! in=mation infra/ructure2 & 7#e7 has demon/rat$ a level ( pr(ici5cy 9 ma? or comput] sci5ces4 7e7 ,failure ,to complete s]vice obligation 7#a7 ,9 g5]al ,a s*ol>%ip recipi5t "u ?is section %all be liable to ! ,unit$ ,/ates "u p>agraph 7#b7 if ! s*ol>%ip recipi5t-- 7,a7 fails to ma9ta9 an acceptable level ( academic /&+ 9 ! educational in/itution 9 :i* ! individual is enroll$1 z det]m9$ by ! ,director2 7,b7 is dismiss$ f su* educational in/itution = discipl9>y reasons2 7,c7 )draws f ! program = :i* ! aw>d 0 made be=e ! completion ( su* program2 7,d7 decl>es t ! individual does n int5d to fulfill ! s]vice obligation "u ?is section2 7,e7 fails to fulfill ! s]vice obligation ( ! individual "u ?is section2 or 7,f7 loses a security cle>ance or becomes ineligible = a security cle>ance4 7#b7 ,repaym5t am\nts 7,a7 ,less ?an #a ye> ( s]vice ,if a circum/ance "u p>agraph 7#a7 occurs be=e ! completion ( #a ye> ( a s]vice obligation "u ?is section1 ! total am\nt ( aw>ds receiv$ by ! individual "u ?is section %all be repaid4 7,b7 ,"o or m ye>s ( s]vice ,if a circum/ance describ$ 9 subp>agraph 7,d7 or 7,e7 ( p>agraph 7#a7 occurs aft] ! completion ( #a ye> ( a s]vice obligation "u ?is section1 ! total am\nt ( s*ol>%ip aw>ds receiv$ by ! individual "u ?is section1 r$uc$ by ! ratio ( ! numb] ( ye>s ( s]vice complet$ divid$ by ! numb] ( ye>s ( s]vice requir$1 %all be repaid4 7f7 ,evaluation & report ,! ,director ( ! ,national ,sci5ce ,f\ndation %all-- 7#a7 evaluate ! success ( recruit+ individuals = s*ol>%ips "u ?is section & ( hir+ & reta9+ ^? individuals 9 ! public sector work=ce1 includ+ ! annual co/ & an assessm5t ( h[ ! program actually improves ! ,f$]al work=ce2 & 7#b7 p]iodically report ! f9d+s "u p>agraph 7#a7 to ,congress4 7g7 ,au?orization ( appropriations ,f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 ! ,secret>y may use funds to c>ry out ! requirem5ts ( ?is section = fiscal ye>s #bjad ?r\gh #bjae4 #djg4 ,/udy & analysis ( c]tification & tra9+ ( in=mation infra/ructure pr(essionals 7a7 ,/udy ,! ,presid5t %all ent] into an agreem5t ) ! ,national ,academies to conduct a compreh5sive /udy ( gov]nm5t1 academic1 & private-sector accr$itation1 tra9+1 & c]tification programs = p]sonnel work+ 9 in=mation infra/ructure4 ,! agreem5t %all require ! ,national ,academies to consult ) sector coord9at+ c\ncils & relevant gov]nm5tal ag5cies1 regulatory entities1 & nongov]nm5tal organizations 9 ! c\rse ( ! /udy4 7b7 ,scope ,! /udy %all include-- 7#a7 an evaluation ( ! body ( k & v>i\s skills t specific categories ( p]sonnel work+ 9 in=mation infra/ructure %\ld possess 9 ord] to secure in=mation sy/ems2 7#b7 an assessm5t ( :e!r exi/+ gov]nm5t1 academic1 & private-sector accr$itation1 tra9+1 & c]tification programs provide ! body ( k & v>i\s skills describ$ 9 p>agraph 7#a72 7#c7 an analysis ( any b>ri]s to ! ,f$]al ,gov]nm5t recruit+ & hir+ cyb]security tal5t1 includ+ b>ri]s relat+ to comp5sation1 ! hir+ process1 job classification1 & hir+ flexibility2 & 7#d7 an analysis ( ! s\rces & availability ( cyb]security tal5t1 a comp>ison ( ! skills & exp]tise s\ght by ! ,f$]al ,gov]nm5t & ! private sector1 an exam9ation ( ! curr5t & future capacity ( ,unit$ ,/ates in/itutions ( high] education1 includ+ community colleges1 to provide curr5t & future cyb]security pr(essionals1 ?r\gh education & tra9+ activities1 ) ^? skills s\ght by ! ,f$]al ,gov]nm5t1 ,/ate & local entities1 & ! private sector4 7c7 ,report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,national ,academies %all submit to ! ,presid5t & ,congress a report on ! results ( ! /udy4 ,! report %all include-- 7#a7 f9d+s reg>d+ ! /ate ( in=mation infra/ructure accr$itation1 tra9+1 & c]tification programs1 includ+ specific areas ( defici5cy & demon/rable progress2 & 7#b7 recomm5dations = ! improvem5t ( in=mation infra/ructure accr$itation1 tra9+1 & c]tification programs4 #djh4 ,int]national cyb]security te*nical /&>ds 7a7 ,9 g5]al ,! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 9 coord9ation ) appropriate ,f$]al au?orities1 %all-- 7#a7 z appropriate1 ensure coord9ation ( ,f$]al ag5cies engag$ 9 ! developm5t ( int]national te*nical /&>ds relat$ to in=mation sy/em security2 & 7#b7 n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 develop & transmit to ,congress a plan = ensur+ su* ,f$]al ag5cy coord9ation4 7b7 ,consultation ) ! private sector ,9 c>ry+ out ! activities "u subsection 7a77#a71 ! ,director %all ensure consultation ) appropriate private sector /akehold]s4 #dji4 ,id5tity managem5t rese>* & developm5t ,! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all cont9ue a program to support ! developm5t ( te*nical /&>ds1 metrology1 te/b$s1 & con=mance crit]ia1 tak+ into acc\nt appropriate us] conc]ns-- 7#a7 to improve int]op]ability among id5tity managem5t te*nologies2 7#b7 to /r5g!n au!ntication me?ods ( id5tity managem5t sy/ems2 7#c7 to improve privacy protection 9 id5tity managem5t sy/ems1 includ+ heal? in=mation te*nology sy/ems1 ?r\gh au!ntication & security protocols2 & 7#d7 to improve ! usability ( id5tity managem5t sy/ems4 #daj4 ,f$]al cyb]security rese>* & developm5t 7a7 ,national ,sci5ce ,f\ndation comput] & network security rese>* grant areas ,section #d7;a77#a7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is am5d$-- 7#a7 9 subp>agraph 7,h71 by /rik+ & aft] ! semicolon2 7#b7 9 subp>agraph 7,i71 by /rik+ prop]ty4 & ins]t+ prop]ty22 & 7#c7 by add+ at ! end ! foll[+3 7,j7 secure fundam5tal protocols t are at ! he>t ( int]-network communications & data ex*ange2 7,k7 sy/em security t addresses ! build+ ( secure sy/ems f tru/$ & untru/$ compon5ts2 7,l7 monitor+ & detection2 & 7,m7 resili5cy & rapid recov]y me?ods4 4 7b7 ,national ,sci5ce ,f\ndation comput] & network security grants ,section #d7;a77#c7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjc7;a77#c77 is am5d$-- 7#a7 9 subp>agraph 7,d71 by /rik+ &2 7#b7 9 subp>agraph 7,e71 by /rik+ #bjjg4 & ins]t+ #bjjg22 & 7#c7 by add+ at ! end ! foll[+3 7,f7 su* funds f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 z ! ,secret>y f9ds necess>y to c>ry out ! requirem5ts ( ?is subsection = fiscal ye>s #bjad ?r\gh #bjae4 4 7c7 ,comput] & network security c5t]s ,section #d7;b77#g7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjc7;b77#g77 is am5d$-- 7#a7 9 subp>agraph 7,d71 by /rik+ &2 7#b7 9 subp>agraph 7,e71 by /rik+ #bjjg4 & ins]t+ #bjjg22 & 7#c7 by add+ at ! end ! foll[+3 7,f7 su* funds f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 z ! ,secret>y f9ds necess>y to c>ry out ! requirem5ts ( ?is subsection = fiscal ye>s #bjad ?r\gh #bjae4 4 7d7 ,comput] & network security capacity build+ grants ,section #e7;a77#f7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjd7;a77#f77 is am5d$-- 7#a7 9 subp>agraph 7,d71 by /rik+ &2 7#b7 9 subp>agraph 7,e71 by /rik+ #bjjg4 & ins]t+ #bjjg22 & 7#c7 by add+ at ! end ! foll[+3 7,f7 su* funds f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 z ! ,secret>y f9ds necess>y to c>ry out ! requirem5ts ( ?is subsection = fiscal ye>s #bjad ?r\gh #bjae4 4 7e7 ,sci5tific & advanc$ te*nology ,act grants ,section #e7;b77#b7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjd7;b77#b77 is am5d$-- 7#a7 9 subp>agraph 7,d71 by /rik+ &2 7#b7 9 subp>agraph 7,e71 by /rik+ #bjjg4 & ins]t+ #bjjg22 & 7#c7 by add+ at ! end ! foll[+3 7,f7 su* funds f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 z ! ,secret>y f9ds necess>y to c>ry out ! requirem5ts ( ?is subsection = fiscal ye>s #bjad ?r\gh #bjae4 4 7f7 ,graduate tra9ee%ips 9 comput] & network security rese>* ,section #e7;c77#g7 ( ! ,cyb] ,security ,rese>* & ,developm5t ,act 7#ae ,u4,s4,c4 #gdjd7;c77#g77 is am5d$-- 7#a7 9 subp>agraph 7,d71 by /rik+ &2 7#b7 9 subp>agraph 7,e71 by /rik+ #bjjg4 & ins]t+ #bjjg22 & 7#c7 by add+ at ! end ! foll[+3 7,f7 su* funds f am\nts made available "u section #ejc ( ! ,am]ica ,,competes ,reau?orization ,act ( #bjaj 7#abd ,/at4 #djje71 z ! ,secret>y f9ds necess>y to c>ry out ! requirem5ts ( ?is subsection = fiscal ye>s #bjad ?r\gh #bjae4 4 ,v ,data ,security & ,brea* ,notification #eja4 ,requirem5ts = in=mation security ,ea* cov]$ entity %all take reasonable measures to protect & secure data 9 electronic =m conta9+ p]sonal in=mation4 #ejb4 ,notification ( in=mation security brea* 7a7 ,notification 7#a7 ,9 g5]al ,a cov]$ entity t owns or lic5ses data 9 electronic =m conta9+ p]sonal in=mation %all give notice ( any brea* ( ! security ( ! sy/em foll[+ discov]y by ! cov]$ entity ( ! brea* ( ! security ( ! sy/em to ea* individual :o is a citiz5 or resid5t ( ! ,unit$ ,/ates ^: p]sonal in=mation 0 or t ! cov]$ entity reasonably believes to h be5 access$ & acquir$ by an unau?oriz$ p]son & t ! cov]$ entity reasonably believes has caus$ or w cause1 id5tity !ft or o!r f9ancial h>m4 7#b7 ,law en=cem5t ,a cov]$ entity %all notify ! ,secret ,s]vice or ! ,f$]al ,bureau ( ,inve/igation ( ! fact t a brea* ( security has occurr$ if ! numb] ( individuals ^: p]sonal in=mation ! cov]$ entity reasonably believes to h be5 access$ & acquir$ by an unau?oriz$ p]son exce$s #aj1jjj4 7b7 ,special notification requirem5ts 7#a7 ,?ird-p>ty ag5ts 7,a7 ,9 g5]al ,9 ! ev5t ( a brea* ( security ( a sy/em ma9ta9$ by a ?ird-p>ty entity t has be5 contract$ to ma9ta91 /ore1 or process data 9 electronic =m conta9+ p]sonal in=mation on behalf ( a cov]$ entity :o owns or possesses su* data1 su* ?ird-p>ty entity %all notify su* cov]$ entity ( ! brea* ( security4 7,b7 ,cov]$ entities :o receive notice f ?ird p>ties ,^u receiv+ notification f a ?ird p>ty "u subp>agraph 7,a71 a cov]$ entity %all provide notification z requir$ "u subsection 7a74 7,c7 ,exception = s]vice provid]s ,a s]vice provid] %all n be consid]$ a ?ird-p>ty ag5t = purposes ( ?is p>agraph4 7#b7 ,s]vice provid]s 7,a7 ,9 g5]al ,if a s]vice provid] becomes aw>e ( a brea* ( security involv+ data 9 electronic =m conta9+ p]sonal in=mation t is own$ or possess$ by a cov]$ entity t connects to or uses a sy/em or network provid$ by ! s]vice provid] = ! purpose ( transmitt+1 r\t+1 or provid+ int]m$iate or transi5t /orage ( su* data1 su* s]vice provid] %all notify ! cov]$ entity :o initiat$ su* connection1 transmission1 r\t+1 or /orage if su* cov]$ entity c be reasonably id5tifi$4 7,b7 ,cov]$ entities :o receive notice f s]vice provid]s ,^u receiv+ notification f a s]vice provid] "u subp>agraph 7,a71 a cov]$ entity %all provide notification z requir$ "u subsection 7a74 7c7 ,timel9ess ( notification 7#a7 ,9 g5]al ,unless subject to a delay au?oriz$ "u p>agraph 7#b71 a notification requir$ "u subsection 7a7 ) respect to a security brea* %all be made z exp$iti\sly z practicable & )\t unreasonable delay1 consi/5t ) any measures necess>y to det]m9e ! scope ( ! security brea* & re/ore ! reasonable integrity ( ! data sy/em t 0 brea*$4 7#b7 ,delay ( notification au?oriz$ = law en=cem5t or national security purposes 7,a7 ,law en=cem5t ,if a ,f$]al law en=cem5t ag5cy det]m9es t ! notification requir$ "u subsection 7a7 w\ld imp$e a civil or crim9al inve/igation1 su* notification %all be delay$ ^u ! writt5 reque/ ( ! law en=cem5t ag5cy = any p]iod :i* ! law en=cem5t ag5cy det]m9es is reasonably necess>y4 ,a law en=cem5t ag5cy may1 by a subsequ5t writt5 reque/1 revoke su* delay or ext5d ! p]iod set =? 9 ! orig9al reque/ made "u ?is subp>agraph by a subsequ5t reque/ if fur!r delay is necess>y4 7,b7 ,national security ,if a ,f$]al national security ag5cy or homel& security ag5cy det]m9es t ! notification requir$ "u ?is section w\ld ?reat5 national or homel& security1 su* notification may be delay$ ^u ! writt5 reque/ ( ! national security ag5cy or homel& security ag5cy = any p]iod :i* ! national security ag5cy or homel& security ag5cy det]m9es is reasonably necess>y4 ,a ,f$]al national security ag5cy or homel& security ag5cy may revoke su* delay or ext5d ! p]iod set =? 9 ! orig9al reque/ made "u ?is subp>agraph by a subsequ5t writt5 reque/ if fur!r delay is necess>y4 7d7 ,me?od & cont5t ( notification 7#a7 ,direct notification 7,a7 ,me?od ( notification ,a cov]$ entity requir$ to provide notification to an individual "u subsection 7a7 %all be 9 compliance ) su* requirem5t if ! cov]$ entity provides su* notice by "o ( ! foll[+ me?ods3 7i7 ,writt5 notification1 s5t to ! po/al address ( ! individual 9 ! records ( ! cov]$ entity4 7ii7 ,telephone4 7iii7 ,email or o!r electronic means4 7,b7 ,cont5t ( notification ,reg>dless ( ! me?od by :i* notification is provid$ to an individual "u subp>agraph 7,a7 ) respect to a security brea*1 su* notification1 to ! ext5t practicable1 %all include-- 7i7 ! date1 e/imat$ date1 or e/imat$ date range ( ! brea* ( security2 7ii7 a description ( ! p]sonal in=mation t 0 access$ & acquir$1 or reasonably believ$ to h be5 access$ & acquir$1 by an unau?oriz$ p]son z a "p ( ! security brea*2 & 7iii7 in=mation t ! individual c use to contact ! cov]$ entity to inquire ab\t-- 7,i7 ! brea* ( security2 or 7,,ii7 ! in=mation ! cov]$ entity ma9ta9$ ab\t t individual4 7#b7 ,sub/itute notification 7,a7 ,circum/ances giv+ rise to sub/itute notification ,a cov]$ entity requir$ to provide notification to an individual "u subsection 7a7 may provide sub/itute notification 9 lieu ( ! direct notification requir$ by p>agraph 7#a7 if su* direct notification is n feasible due to-- 7i7 excessive co/ to ! cov]$ entity requir$ to provide su* notification relative to ! res\rces ( su* cov]$ entity2 or 7ii7 lack ( suffici5t contact in=mation = ! individual requir$ to be notifi$4 7,b7 ,=m ( sub/itute notification ,su* sub/itute notification %all include at lea/ "o ( ! foll[+3 7i7 ,a conspicu\s notice on ! ,int]net website ( ! cov]$ entity 7if su* cov]$ entity ma9ta9s su* a website74 7ii7 ,notification 9 pr9t & to broadca/ m$ia1 includ+ major m$ia 9 metropolitan & rural areas :]e ! individuals ^: p]sonal in=mation 0 acquir$ reside4 7e7 ,treatm5t ( p]sons gov]n$ by o!r ,f$]al law ,except z provid$ 9 section #ejc7;b71 a cov]$ entity :o is 9 compliance ) any o!r ,f$]al law t requires su* cov]$ entity to provide notification to individuals foll[+ a brea* ( security %all be deem$ to be 9 compliance ) ?is section4 #ejc4 ,application & en=cem5t 7a7 ,g5]al application ,! requirem5ts ( sections #eja & #ejb apply to-- 7#a7 ^? p]sons1 p>tn]%ips1 or corporations ov] :i* ! ,commission has au?ority pursuant to section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b772 & 7#b7 not)/&+ section #e7;a77#b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #de7;a77#b771 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq474 7b7 ,application to cable op]ators1 satellite op]ators1 & telecommunications c>ri]s ,sections #bbb1 #cch1 & #fca ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bbb1 #cch1 & #eea71 & any regulations promulgat$ !reund]1 %all n apply ) respect to ! in=mation security practices1 includ+ practices relat+ to ! notification ( unau?oriz$ access to data 9 electronic =m1 ( any cov]$ entity o!rwise subject to ^? sections4 7c7 ,en=cem5t by ,f$]al ,trade ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( section #eja or #ejb %all be treat$ z an unfair or deceptive act or practice 9 violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7#b7 ,p[]s ( commission 7,a7 ,9 g5]al ,except z provid$ 9 subsection 7a71 ! ,commission %all en=ce ?is title 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is title4 7,b7 ,privileges & immunities ,any p]son :o violates section #ejb or #ejc %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 su* ,act4 7#c7 ,maximum total liability ,not)/&+ ! numb] ( actions :i* may be br\ght aga9/ a cov]$ entity "u ?is subsection1 ! maximum civil p5alty = :i* any cov]$ entity may be liable "u ?is subsection = all actions %all n exce$-- 7,a7 #ejj1jjj = all violations ( section #eja result+ f ! same relat$ act or omission2 & 7,b7 #ejj1jjj = all violations ( section #ejb result+ f a s+le brea* ( security4 7d7 ,no private cause ( action ,no?+ 9 ?is title %all be con/ru$ to e/abli% a private cause ( action aga9/ a p]son = a violation ( ?is title4 #ejd4 ,def9itions ,9 ?is title3 7#a7 ,brea* ( security ,! t]m brea* ( security means unau?oriz$ access & acquisition ( data 9 electronic =m conta9+ p]sonal in=mation4 7#b7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#c7 ,cov]$ entity 7,a7 ,9 g5]al ,! t]m cov]$ entity means a sole proprietor%ip1 p>tn]%ip1 corporation1 tru/1 e/ate1 coop]ative1 association1 or o!r comm]cial entity t acquires1 ma9ta9s1 /ores1 or utilizes p]sonal in=mation4 7,b7 ,exemptions ,! t]m cov]$ entity does n include ! foll[+3 7i7 ,f9ancial in/itutions subject to title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7ii7 ,an entity cov]$ by ! regulations issu$ "u section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7,public ,law #ajd-aia7 to ! ext5t t su* entity is subject to ! requirem5ts ( su* regulations ) respect to protect$ heal? in=mation4 7#d7 ,data 9 electronic =m ,! t]m data 9 electronic =m means any data /or$ electronically or digitally on any comput] sy/em or o!r database & includes recordable tapes & o!r mass /orage devices4 7#e7 ,p]sonal in=mation 7,a7 ,9 g5]al ,! t]m p]sonal in=mation means an individual's fir/ "n or fir/ initial & la/ "n 9 comb9ation ) any #a or m ( ! foll[+ data elem5ts = t individual3 7i7 ,social ,security numb]4 7ii7 ,driv]'s lic5se numb]1 passport numb]1 milit>y id5tification numb]1 or o!r simil> numb] issu$ on a gov]nm5t docum5t us$ to v]ify id5tity4 7iii7 ,f9ancial acc\nt numb]1 or cr$it or debit c>d numb]1 & any requir$ security code1 access code1 or password t is necess>y to p]mit access to an individual's f9ancial acc\nt4 7,b7 ,exclusions 7i7 public record in=mation ,p]sonal in=mation does n include in=mation obta9$ ab\t an individual :i* has be5 lawfully made publicly available by a ,f$]al1 ,/ate1 or local gov]nm5t entity or widely di/ribut$ by m$ia4 7ii7 ,encrypt$1 r$act$1 or secur$ data ,p]sonal in=mation does n include in=mation t is encrypt$1 r$act$1 or secur$ by any o!r me?od or te*nology t r5d]s ! data elem5ts unusable4 7#f7 ,s]vice provid] ,! t]m s]vice provid] means an entity t provides electronic data transmission1 r\t+1 int]m$iate1 & transi5t /orage1 or connections to its sy/em or network1 :]e su* entity provid+ su* s]vices does n select or modify ! cont5t ( ! electronic data1 is n ! s5d] or ! int5d$ recipi5t ( ! data1 & does n diff]5tiate p]sonal in=mation f o!r in=mation t su* entity transmits1 r\tes1 /ores1 or = :i* su* entity provides connections4 ,any su* entity %all be treat$ z a s]vice provid] "u ?is title only to ! ext5t t x is engag$ 9 ! provision ( su* transmission1 r\t+1 int]m$iate & transi5t /orage1 or connections4 #eje4 ,effect on o!r laws ,?is title preempts any law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision hav+ ! =ce & effect ( law ( any ,/ate1 or political subdivision ( a ,/ate1 relat+ to ! protection or security ( data 9 electronic =m conta9+ p]sonal in=mation or ! notification ( a brea* ( security4 #ejf4 ,effective date ,?is title %all take effect on ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act4