#aacth ,,congress #b;d ,session ,s4 #beai ,,an ,,act ,to codify an existing operations center for cybersecurity4 #a4 ,short title ,this ,act may be cited as the ,national ,cybersecurity ,protection ,act of #bjad4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,center means the national cybersecurity and communications integration center under section #bbf of the ,homeland ,security ,act of #bjjb1 as added by section #c2 7#b7 the term critical infrastructure has the meaning given that term in section #b of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja72 7#c7 the term cybersecurity risk has the meaning given that term in section #bbf of the ,homeland ,security ,act of #bjjb1 as added by section #c2 7#d7 the term information sharing and analysis organization has the meaning given that term in section #bab7e7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aca7e772 7#e7 the term information system has the meaning given that term in section #cejb7h7 of title #dd1 ,united ,states ,code2 and 7#f7 the term ,secretary means the ,secretary of ,homeland ,security4 #c4 ,national cybersecurity and communications integration center 7a7 ,in general ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ada et seq47 is amended by adding at the end the following3 #bbf4 ,national cybersecurity and communications integration center 7a7 ,definitions ,in this section-- 7#a7 the term cybersecurity risk means threats to and vulnerabilities of information or information systems and any related consequences caused by or resulting from unauthorized access1 use1 disclosure1 degradation1 disruption1 modification1 or destruction of information or information systems1 including such related consequences caused by an act of terrorism2 7#b7 the term incident means an occurrence that-- 7,a7 actually or imminently jeopardizes1 without lawful authority1 the integrity1 confidentiality1 or availability of information on an information system2 or 7,b7 constitutes a violation or imminent threat of violation of law1 security policies1 security procedures1 or acceptable use policies2 7#c7 the term information sharing and analysis organization has the meaning given that term in section #bab7e72 and 7#d7 the term information system has the meaning given that term in section #cejb7h7 of title #dd1 ,united ,states ,code4 7b7 ,center ,there is in the ,department a national cybersecurity and communications integration center 7referred to in this section as the ,center7 to carry out certain responsibilities of the ,under ,secretary appointed under section #ajc7;a77#a77;,h74 7c7 ,functions ,the cybersecurity functions of the ,center shall include-- 7#a7 being a ,federal civilian interface for the multi-directional and cross-sector sharing of information related to cybersecurity risks1 incidents1 analysis1 and warnings for ,federal and non-,federal entities2 7#b7 providing shared situational awareness to enable real-time1 integrated1 and operational actions across the ,federal ,government and non-,federal entities to address cybersecurity risks and incidents to ,federal and non-,federal entities2 7#c7 coordinating the sharing of information related to cybersecurity risks and incidents across the ,federal ,government2 7#d7 facilitating cross-sector coordination to address cybersecurity risks and incidents1 including cybersecurity risks and incidents that may be related or could have consequential impacts across multiple sectors2 7#e7 7,a7 conducting integration and analysis1 including cross-sector integration and analysis1 of cybersecurity risks and incidents2 and 7,b7 sharing the analysis conducted under subparagraph 7,a7 with ,federal and non-,federal entities2 7#f7 upon request1 providing timely technical assistance1 risk management support1 and incident response capabilities to ,federal and non-,federal entities with respect to cybersecurity risks and incidents1 which may include attribution1 mitigation1 and remediation2 and 7#g7 providing information and recommendations on security and resilience measures to ,federal and non-,federal entities1 including information and recommendations to-- 7,a7 facilitate information security2 and 7,b7 strengthen information systems against cybersecurity risks and incidents4 7d7 ,composition 7#a7 ,in general ,the ,center shall be composed of-- 7,a7 appropriate representatives of ,federal entities1 such as-- 7i7 sector-specific agencies2 7ii7 civilian and law enforcement agencies2 and 7iii7 elements of the intelligence community1 as that term is defined under section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d772 7,b7 appropriate representatives of non-,federal entities1 such as-- 7i7 ,state and local governments2 7ii7 information sharing and analysis organizations2 and 7iii7 owners and operators of critical information systems2 7,c7 components within the ,center that carry out cybersecurity and communications activities2 7,d7 a designated ,federal official for operational coordination with and across each sector2 and 7,e7 other appropriate representatives or entities1 as determined by the ,secretary4 7#b7 ,incidents ,in the event of an incident1 during exigent circumstances the ,secretary may grant a ,federal or non-,federal entity immediate temporary access to the ,center4 7e7 ,principles ,in carrying out the functions under subsection 7c71 the ,center shall ensure-- 7#a7 to the extent practicable1 that-- 7,a7 timely1 actionable1 and relevant information related to cybersecurity risks1 incidents1 and analysis is shared2 7,b7 when appropriate1 information related to cybersecurity risks1 incidents1 and analysis is integrated with other relevant information and tailored to the specific characteristics of a sector2 7,c7 activities are prioritized and conducted based on the level of risk2 7,d7 industry sector-specific1 academic1 and national laboratory expertise is sought and receives appropriate consideration2 7,e7 continuous1 collaborative1 and inclusive coordination occurs-- 7i7 across sectors2 and 7ii7 with-- 7,i7 sector coordinating councils2 7,,ii7 information sharing and analysis organizations2 and 7,,iii7 other appropriate non-,federal partners2 7,f7 as appropriate1 the ,center works to develop and use mechanisms for sharing information related to cybersecurity risks and incidents that are technology-neutral1 interoperable1 real-time1 cost-effective1 and resilient2 and 7,g7 the ,center works with other agencies to reduce unnecessarily duplicative sharing of information related to cybersecurity risks and incidents2 7#b7 that information related to cybersecurity risks and incidents is appropriately safeguarded against unauthorized access2 and 7#c7 that activities conducted by the ,center comply with all policies1 regulations1 and laws that protect the privacy and civil liberties of ,united ,states persons4 7f7 ,no right or benefit 7#a7 ,in general ,the provision of assistance or information to1 and inclusion in the ,center of1 governmental or private entities under this section shall be at the sole and unreviewable discretion of the ,under ,secretary appointed under section #ajc7;a77#a77;,h74 7#b7 ,certain assistance or information ,the provision of certain assistance or information to1 or inclusion in the ,center of1 one governmental or private entity pursuant to this section shall not create a right or benefit1 substantive or procedural1 to similar assistance or information for any other governmental or private entity4 4 7b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja note7 is amended by inserting after the item relating to section #bbe the following3 ,sec4 #bbf4 ,national cybersecurity and communications integration center4 4 #d4 ,recommendations regarding new agreements 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary shall submit recommendations on how to expedite the implementation of information-sharing agreements for cybersecurity purposes between the ,center and non-,federal entities 7referred to in this section as cybersecurity information-sharing agreements7 to-- 7#a7 the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on the ,judiciary of the ,senate2 and 7#b7 the ,committee on ,homeland ,security and the ,committee on the ,judiciary of the ,house of ,representatives4 7b7 ,contents ,in submitting recommendations under subsection 7a71 the ,secretary shall-- 7#a7 address the development and utilization of a scalable form that retains all privacy and other protections in cybersecurity information-sharing agreements that are in effect as of the date on which the ,secretary submits the recommendations1 including ,cooperative ,research and ,development ,agreements2 and 7#b7 include in the recommendations any additional authorities or resources that may be needed to carry out the implementation of any new cybersecurity information-sharing agreements4 #e4 ,annual report ,not later than #a year after the date of enactment of this ,act1 and every year thereafter for #c years1 the ,secretary shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on the ,judiciary of the ,senate1 the ,committee on ,homeland ,security and the ,committee on the ,judiciary of the ,house of ,representatives1 and the ,comptroller ,general of the ,united ,states a report on the ,center1 which shall include-- 7a7 information on the ,center1 including-- 7#a7 an assessment of the capability and capacity of the ,center to carry out its cybersecurity mission under this ,act2 7#b7 the number of representatives from non-,federal entities that are participating in the ,center1 including the number of representatives from ,states1 nonprofit organizations1 and private sector entities1 respectively2 7#c7 the number of requests from non-,federal entities to participate in the ,center and the response to such requests2 7#d7 the average length of time taken to resolve requests described in paragraph 7#c72 7#e7 the identification of-- 7,a7 any delay in resolving requests described in paragraph 7#c7 involving security clearance processing2 and 7,b7 the agency involved with a delay described in subparagraph 7,a72 7#f7 a description of any other obstacles or challenges to resolving requests described in paragraph 7#c7 and a summary of the reasons for denials of any such requests2 7#g7 the extent to which the ,department is engaged in information sharing with each critical infrastructure sector1 including-- 7,a7 the extent to which each sector has representatives at the ,center2 7,b7 the extent to which owners and operators of critical infrastructure in each critical infrastructure sector participate in information sharing at the ,center2 and 7,c7 the volume and range of activities with respect to which the ,secretary has collaborated with the sector coordinating councils and the sector-specific agencies to promote greater engagement with the ,center2 and 7#h7 the policies and procedures established by the ,center to safeguard privacy and civil liberties4 #f4 ,,gao report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the effectiveness of the ,center in carrying out its cybersecurity mission4 #g4 ,cyber incident response plan2 clearances2 breaches 7a7 ,cyber incident response plan2 clearances ,subtitle ,c of title ,,ii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ada et seq471 as amended by section #c1 is amended by adding at the end the following3 #bbg4 ,cyber incident response plan ,the ,under ,secretary appointed under section #ajc7;a77#a77;,h7 shall1 in coordination with appropriate ,federal departments and agencies1 ,state and local governments1 sector coordinating councils1 information sharing and analysis organizations 7as defined in section #bab7e771 owners and operators of critical infrastructure1 and other appropriate entities and individuals1 develop1 regularly update1 maintain1 and exercise adaptable cyber incident response plans to address cybersecurity risks 7as defined in section #bbf7 to critical infrastructure4 #bbh4 ,clearances ,the ,secretary shall make available the process of application for security clearances under ,executive ,order #acedi 7#ge ,fed4 ,reg4 #afb2 relating to a classified national security information program7 or any successor ,executive ,order to appropriate representatives of sector coordinating councils1 sector information sharing and analysis organizations 7as defined in section #bab7e771 owners and operators of critical infrastructure1 and any other person that the ,secretary determines appropriate4 4 7b7 ,breaches 7#a7 ,requirements ,the ,director of the ,office of ,management and ,budget shall ensure that data breach notification policies and guidelines are updated periodically and require-- 7,a7 except as provided in paragraph 7#d71 notice by the affected agency to each committee of ,congress described in section #cedd7;c77#a7 of title #dd1 ,united ,states ,code1 the ,committee on the ,judiciary of the ,senate1 and the ,committee on ,homeland ,security and the ,committee on the ,judiciary of the ,house of ,representatives1 which shall-- 7i7 be provided expeditiously and not later than #cj days after the date on which the agency discovered the unauthorized acquisition or access2 and 7ii7 include-- 7,i7 information about the breach1 including a summary of any information that the agency knows on the date on which notification is provided about how the breach occurred2 7,,ii7 an estimate of the number of individuals affected by the breach1 based on information that the agency knows on the date on which notification is provided1 including an assessment of the risk of harm to affected individuals2 7,,iii7 a description of any circumstances necessitating a delay in providing notice to affected individuals2 and 7,,iv7 an estimate of whether and when the agency will provide notice to affected individuals2 and 7,b7 notice by the affected agency to affected individuals1 pursuant to data breach notification policies and guidelines1 which shall be provided as expeditiously as practicable and without unreasonable delay after the agency discovers the unauthorized acquisition or access4 7#b7 ,national security2 law enforcement2 remediation ,the ,attorney ,general1 the head of an element of the intelligence community 7as such term is defined under section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d771 or the ,secretary may delay the notice to affected individuals under paragraph 7#a77;,b7 if the notice would disrupt a law enforcement investigation1 endanger national security1 or hamper security remediation actions4 7#c7 ,,omb report ,during the first #b years beginning after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall1 on an annual basis-- 7,a7 assess agency implementation of data breach notification policies and guidelines in aggregate2 and 7,b7 include the assessment described in clause 7i7 in the report required under section #cedc7;a77#h7 of title #dd1 ,united ,states ,code4 7#d7 ,exception ,any element of the intelligence community 7as such term is defined under section #c7d7 of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d77 that is required to provide notice under paragraph 7#a77;,a7 shall only provide such notice to appropriate committees of ,congress4 7c7 ,rule of construction ,nothing in the amendment made by subsection 7a7 or in subsection 7b77#a7 shall be construed to alter any authority of a ,federal agency or department4 7d7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja note71 as amended by section #c1 is amended by inserting after the item relating to section #bbf the following3 ,sec4 #bbg4 ,cyber incident response plan4,sec4 #bbh4 ,clearances4 4 #h4 ,rules of construction 7a7 ,prohibition on new regulatory authority ,nothing in this ,act or the amendments made by this ,act shall be construed to grant the ,secretary any authority to promulgate regulations or set standards relating to the cybersecurity of private sector critical infrastructure that was not in effect on the day before the date of enactment of this ,act4 7b7 ,private entities ,nothing in this ,act or the amendments made by this ,act shall be construed to require any private entity-- 7#a7 to request assistance from the ,secretary2 or 7#b7 that requested such assistance from the ,secretary to implement any measure or recommendation suggested by the ,secretary4 ,passed the ,senate ,december #aj1 #bjad4,secretary