#aac? ,,congress  #b;d ,session  ,s4    
#beai  ,,an ,,act  ,to codify an exi/+  
op]ations c5t] = cyb]security4  #a4     
,%ort title ,?is ,act may be cit$ z !   
,national ,cyb]security ,protection ,act
 ( #bjad4  #b4 ,def9itions ,9 ?is ,act--
 7#a7 ! t]m ,c5t] means ! national      
cyb]security & communications           
integration c5t] "u section #bbf ( !    
,homel& ,security ,act ( #bjjb1 z add$  
by section #c2  7#b7 ! t]m critical     
infra/ructure has ! mean+ giv5 t t]m 9  
section #b ( ! ,homel& ,security ,act ( 
#bjjb 7#f ,u4,s4,c4 #aja72  7#c7 ! t]m  
cyb]security risk has ! mean+ giv5 t t]m
 9 section #bbf ( ! ,homel& ,security   
,act ( #bjjb1 z add$ by section #c2     
7#d7 ! t]m in=mation %>+ & analysis     
organization has ! mean+ giv5 t t]m 9   
section #bab7e7 ( ! ,homel& ,security   
,act ( #bjjb 7#f ,u4,s4,c4 #aca7e772    
7#e7 ! t]m in=mation sy/em has ! mean+  
giv5 t t]m 9 section #cejb7h7 ( title   
#dd1 ,unit$ ,/ates ,code2 &  7#f7 ! t]m 
,secret>y means ! ,secret>y ( ,homel&   

,security4  #c4 ,national cyb]security &
 communications integration c5t]  7a7 ,9
 g5]al ,subtitle ,c ( title ,,ii ( !    
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #ada et seq47 is am5d$ by add+
 at ! end ! foll[+3  #bbf4 ,national    
cyb]security & communications           
integration c5t]  7a7 ,def9itions ,9 ?is
 section-- 7#a7 ! t]m cyb]security risk 
means ?reats to & vuln]abilities (      
in=mation or in=mation sy/ems & any     
relat$ consequ5ces caus$ by or result+ f
 unau?oriz$ access1 use1 disclosure1    
degradation1 disruption1 modification1  
or de/ruction ( in=mation or in=mation  
sy/ems1 includ+ su* relat$ consequ5ces  
caus$ by an act ( t]rorism2  7#b7 ! t]m 
incid5t means an occurr5ce t-- 7,a7     
actually or imm95tly jeop>dizes1 )\t    
lawful au?ority1 ! integrity1           
confid5tiality1 or availability (       
in=mation on an in=mation sy/em2 or     
7,b7 con/itutes a violation or imm95t   
?reat ( violation ( law1 security       
policies1 security proc$ures1 or        

acceptable use policies2  7#c7 ! t]m    
in=mation %>+ & analysis organization   
has ! mean+ giv5 t t]m 9 section        
#bab7e72 &  7#d7 ! t]m in=mation sy/em  
has ! mean+ giv5 t t]m 9 section        
#cejb7h7 ( title #dd1 ,unit$ ,/ates     
,code4  7b7 ,c5t] ,!re is 9 ! ,dep>tm5t 
a national cyb]security & communications
 integration c5t] 7ref]r$ to 9 ?is      
section z ! ,c5t]7 to c>ry out c]ta9    
responsibilities ( ! ,"u ,secret>y      
appo9t$ "u section #ajc7;a77#a77;,h74   
7c7 ,functions ,! cyb]security functions
 ( ! ,c5t] %all include-- 7#a7 be+ a    
,f$]al civilian int]face = !            
multi-directional & cross-sector %>+ (  
in=mation relat$ to cyb]security risks1 
incid5ts1 analysis1 & w>n+s = ,f$]al &  
non-,f$]al entities2  7#b7 provid+ %>$  
situational aw>5ess to enable real-"t1  
integrat$1 & op]ational actions across !
 ,f$]al ,gov]nm5t & non-,f$]al entities 
to address cyb]security risks & incid5ts
 to ,f$]al & non-,f$]al entities2  7#c7 
coord9at+ ! %>+ ( in=mation relat$ to   

cyb]security risks & incid5ts across !  
,f$]al ,gov]nm5t2  7#d7 facilitat+      
cross-sector coord9ation to address     
cyb]security risks & incid5ts1 includ+  
cyb]security risks & incid5ts t may be  
relat$ or c\ld h consequ5tial impacts   
across multiple sectors2  7#e7 7,a7     
conduct+ integration & analysis1 includ+
 cross-sector integration & analysis1 ( 
cyb]security risks & incid5ts2 &  7,b7  
%>+ ! analysis conduct$ "u subp>agraph  
7,a7 ) ,f$]al & non-,f$]al entities2    
7#f7 ^u reque/1 provid+ timely te*nical 
assi/ance1 risk managem5t support1 &    
incid5t response capabilities to ,f$]al 
& non-,f$]al entities ) respect to      
cyb]security risks & incid5ts1 :i* may  
include attribution1 mitigation1 &      
rem$iation2 &  7#g7 provid+ in=mation & 
recomm5dations on security & resili5ce  
measures to ,f$]al & non-,f$]al         
entities1 includ+ in=mation &           
recomm5dations to-- 7,a7 facilitate     
in=mation security2 &  7,b7 /r5g!n      
in=mation sy/ems aga9/ cyb]security     

risks & incid5ts4  7d7 ,composition     
7#a7 ,9 g5]al ,! ,c5t] %all be compos$  
(-- 7,a7 appropriate repres5tatives (   
,f$]al entities1 su* z-- 7i7            
sector-specific ag5cies2  7ii7 civilian 
& law en=cem5t ag5cies2 &  7iii7 elem5ts
 ( ! intellig5ce community1 z t t]m is  
def9$ "u section #c7d7 ( ! ,national    
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc7d772  7,b7 appropriate            
repres5tatives ( non-,f$]al entities1   
su* z-- 7i7 ,/ate & local gov]nm5ts2    
7ii7 in=mation %>+ & analysis           
organizations2 &  7iii7 own]s & op]ators
 ( critical in=mation sy/ems2  7,c7     
compon5ts )9 ! ,c5t] t c>ry out         
cyb]security & communications           
activities2  7,d7 a designat$ ,f$]al    
(ficial = op]ational coord9ation ) &    
across ea* sector2 &  7,e7 o!r          
appropriate repres5tatives or entities1 
z det]m9$ by ! ,secret>y4  7#b7         
,incid5ts ,9 ! ev5t ( an incid5t1 dur+  
exig5t circum/ances ! ,secret>y may     
grant a ,f$]al or non-,f$]al entity     

imm$iate tempor>y access to ! ,c5t]4    
7e7 ,pr9ciples ,9 c>ry+ out ! functions 
"u subsection 7c71 ! ,c5t] %all ensure--
 7#a7 to ! ext5t practicable1 t-- 7,a7  
timely1 actionable1 & relevant in=mation
 relat$ to cyb]security risks1 incid5ts1
 & analysis is %>$2  7,b7 :5            
appropriate1 in=mation relat$ to        
cyb]security risks1 incid5ts1 & analysis
 is integrat$ ) o!r relevant in=mation &
 tailor$ to ! specific *>act]i/ics ( a  
sector2  7,c7 activities are prioritiz$ 
& conduct$ bas$ on ! level ( risk2  7,d7
 indu/ry sector-specific1 academic1 &   
national laboratory exp]tise is s\ght & 
receives appropriate consid]ation2  7,e7
 cont9u\s1 collaborative1 & inclusive   
coord9ation occurs-- 7i7 across sectors2
 &  7ii7 )-- 7,i7 sector coord9at+      
c\ncils2  7,,ii7 in=mation %>+ &        
analysis organizations2 &  7,,iii7 o!r  
appropriate non-,f$]al p>tn]s2  7,f7 z  
appropriate1 ! ,c5t] works to develop & 
use me*anisms = %>+ in=mation relat$ to 
cyb]security risks & incid5ts t are     

te*nology-neutral1 int]op]able1 real-"t1
 co/-effective1 & resili5t2 &  7,g7 !   
,c5t] works ) o!r ag5cies to r$uce      
unnecess>ily duplicative %>+ ( in=mation
 relat$ to cyb]security risks &         
incid5ts2  7#b7 t in=mation relat$ to   
cyb]security risks & incid5ts is        
appropriately safegu>d$ aga9/ unau?oriz$
 access2 &  7#c7 t activities conduct$  
by ! ,c5t] comply ) all policies1       
regulations1 & laws t protect ! privacy 
& civil lib]ties ( ,unit$ ,/ates p]sons4
  7f7 ,no "r or b5efit  7#a7 ,9 g5]al ,!
 provision ( assi/ance or in=mation to1 
& inclusion 9 ! ,c5t] (1 gov]nm5tal or  
private entities "u ?is section %all be 
at ! sole & unreviewable discretion ( ! 
,"u ,secret>y appo9t$ "u section        
#ajc7;a77#a77;,h74  7#b7 ,c]ta9         
assi/ance or in=mation ,! provision (   
c]ta9 assi/ance or in=mation to1 or     
inclusion 9 ! ,c5t] (1 "o gov]nm5tal or 
private entity pursuant to ?is section  
%all n create a "r or b5efit1 sub/antive
 or proc$ural1 to simil> assi/ance or   

in=mation = any o!r gov]nm5tal or       
private entity4  4  7b7 ,te*nical &     
con=m+ am5dm5t ,! table ( cont5ts 9     
section #a7;b7 ( ! ,homel& ,security    
,act ( #bjjb 7#f ,u4,s4,c4 #aja note7 is
 am5d$ by ins]t+ aft] ! item relat+ to  
section #bbe ! foll[+3  ,sec4 #bbf4     
,national cyb]security & communications 
integration c5t]4  4  #d4               
,recomm5dations reg>d+ new agreem5ts    
7a7 ,9 g5]al ,n lat] ?an #ahj days aft] 
! date ( enactm5t ( ?is ,act1 !         
,secret>y %all submit recomm5dations on 
h[ to exp$ite ! implem5tation (         
in=mation-%>+ agreem5ts = cyb]security  
purposes betwe5 ! ,c5t] & non-,f$]al    
entities 7ref]r$ to 9 ?is section z     
cyb]security in=mation-%>+ agreem5ts7   
to-- 7#a7 ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs & !    
,committee on ! ,judici>y ( ! ,s5ate2 & 
7#b7 ! ,committee on ,homel& ,security &
 ! ,committee on ! ,judici>y ( ! ,h\se (
 ,repres5tatives4  7b7 ,cont5ts ,9      
submitt+ recomm5dations "u subsection   

7a71 ! ,secret>y %all-- 7#a7 address !  
developm5t & utilization ( a scalable =m
 t reta9s all privacy & o!r protections 
9 cyb]security in=mation-%>+ agreem5ts t
 are 9 effect z ( ! date on :i* !       
,secret>y submits ! recomm5dations1     
includ+ ,coop]ative ,rese>* &           
,developm5t ,agreem5ts2 &  7#b7 include 
9 ! recomm5dations any additional       
au?orities or res\rces t may be ne$$ to 
c>ry out ! implem5tation ( any new      
cyb]security in=mation-%>+ agreem5ts4   
#e4 ,annual report ,n lat] ?an #a ye>   
aft] ! date ( enactm5t ( ?is ,act1 & e  
ye> !reaft] = #c ye>s1 ! ,secret>y %all 
submit to ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs & !    
,committee on ! ,judici>y ( ! ,s5ate1 ! 
,committee on ,homel& ,security & !     
,committee on ! ,judici>y ( ! ,h\se (   
,repres5tatives1 & ! ,comptroll] ,g5]al 
( ! ,unit$ ,/ates a report on ! ,c5t]1  
:i* %all include-- 7a7 in=mation on !   
,c5t]1 includ+-- 7#a7 an assessm5t ( !  
capability & capacity ( ! ,c5t] to c>ry 

out its cyb]security mission "u ?is     
,act2  7#b7 ! numb] ( repres5tatives f  
non-,f$]al entities t are p>ticipat+ 9 !
 ,c5t]1 includ+ ! numb] ( repres5tatives
 f ,/ates1 nonpr(it organizations1 &    
private sector entities1 respectively2  
7#c7 ! numb] ( reque/s f non-,f$]al     
entities to p>ticipate 9 ! ,c5t] & !    
response to su* reque/s2  7#d7 ! av]age 
l5g? ( "t tak5 to resolve reque/s       
describ$ 9 p>agraph 7#c72  7#e7 !       
id5tification (-- 7,a7 any delay 9      
resolv+ reque/s describ$ 9 p>agraph 7#c7
 involv+ security cle>ance process+2 &  
7,b7 ! ag5cy involv$ ) a delay describ$ 
9 subp>agraph 7,a72  7#f7 a description 
( any o!r ob/acles or *all5ges to       
resolv+ reque/s describ$ 9 p>agraph 7#c7
 & a summ>y ( ! reasons = d5ials ( any  
su* reque/s2  7#g7 ! ext5t to :i* !     
,dep>tm5t is engag$ 9 in=mation %>+ )   
ea* critical infra/ructure sector1      
includ+-- 7,a7 ! ext5t to :i* ea* sector
 has repres5tatives at ! ,c5t]2  7,b7 ! 
ext5t to :i* own]s & op]ators ( critical

 infra/ructure 9 ea* critical           
infra/ructure sector p>ticipate 9       
in=mation %>+ at ! ,c5t]2 &  7,c7 !     
volume & range ( activities ) respect to
 :i* ! ,secret>y has collaborat$ ) !    
sector coord9at+ c\ncils & !            
sector-specific ag5cies to promote      
great] engagem5t ) ! ,c5t]2 &  7#h7 !   
policies & proc$ures e/abli%$ by ! ,c5t]
 to safegu>d privacy & civil lib]ties4  
#f4 ,,gao report ,n lat] ?an #b ye>s    
aft] ! date ( enactm5t ( ?is ,act1 !    
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all submit to ! ,committee on ,homel&  
,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,homel&        
,security ( ! ,h\se ( ,repres5tatives a 
report on ! effectiv5ess ( ! ,c5t] 9    
c>ry+ out its cyb]security mission4  #g4
 ,cyb] incid5t response plan2 cle>ances2
 brea*es  7a7 ,cyb] incid5t response    
plan2 cle>ances ,subtitle ,c ( title    
,,ii ( ! ,homel& ,security ,act ( #bjjb 
7#f ,u4,s4,c4 #ada et seq471 z am5d$ by 
section #c1 is am5d$ by add+ at ! end ! 

foll[+3  #bbg4 ,cyb] incid5t response   
plan ,! ,"u ,secret>y appo9t$ "u section
 #ajc7;a77#a77;,h7 %all1 9 coord9ation )
 appropriate ,f$]al dep>tm5ts & ag5cies1
 ,/ate & local gov]nm5ts1 sector        
coord9at+ c\ncils1 in=mation %>+ &      
analysis organizations 7z def9$ 9       
section #bab7e771 own]s & op]ators (    
critical infra/ructure1 & o!r           
appropriate entities & individuals1     
develop1 regul>ly update1 ma9ta91 &     
ex]cise adaptable cyb] incid5t response 
plans to address cyb]security risks 7z  
def9$ 9 section #bbf7 to critical       
infra/ructure4  #bbh4 ,cle>ances ,!     
,secret>y %all make available ! process 
( application = security cle>ances "u   
,executive ,ord] #acedi 7#ge ,f$4 ,reg4 
#afb2 relat+ to a classifi$ national    
security in=mation program7 or any      
successor ,executive ,ord] to           
appropriate repres5tatives ( sector     
coord9at+ c\ncils1 sector in=mation %>+ 
& analysis organizations 7z def9$ 9     
section #bab7e771 own]s & op]ators (    

critical infra/ructure1 & any o!r p]son 
t ! ,secret>y det]m9es appropriate4  4  
7b7 ,brea*es  7#a7 ,requirem5ts ,!      
,director ( ! ,(fice ( ,managem5t &     
,budget %all ensure t data brea*        
notification policies & guidel9es are   
updat$ p]iodically & require-- 7,a7     
except z provid$ 9 p>agraph 7#d71 notice
 by ! affect$ ag5cy to ea* committee (  
,congress describ$ 9 section            
#cedd7;c77#a7 ( title #dd1 ,unit$ ,/ates
 ,code1 ! ,committee on ! ,judici>y ( ! 
,s5ate1 & ! ,committee on ,homel&       
,security & ! ,committee on ! ,judici>y 
( ! ,h\se ( ,repres5tatives1 :i* %all-- 
7i7 be provid$ exp$iti\sly & n lat] ?an 
#cj days aft] ! date on :i* ! ag5cy     
discov]$ ! unau?oriz$ acquisition or    
access2 &  7ii7 include-- 7,i7 in=mation
 ab\t ! brea*1 includ+ a summ>y ( any   
in=mation t ! ag5cy kn[s on ! date on   
:i* notification is provid$ ab\t h[ !   
brea* occurr$2  7,,ii7 an e/imate ( !   
numb] ( individuals affect$ by ! brea*1 
bas$ on in=mation t ! ag5cy kn[s on !   

date on :i* notification is provid$1    
includ+ an assessm5t ( ! risk ( h>m to  
affect$ individuals2  7,,iii7 a         
description ( any circum/ances          
necessitat+ a delay 9 provid+ notice to 
affect$ individuals2 &  7,,iv7 an       
e/imate ( :e!r & :5 ! ag5cy w provide   
notice to affect$ individuals2 &  7,b7  
notice by ! affect$ ag5cy to affect$    
individuals1 pursuant to data brea*     
notification policies & guidel9es1 :i*  
%all be provid$ z exp$iti\sly z         
practicable & )\t unreasonable delay    
aft] ! ag5cy discov]s ! unau?oriz$      
acquisition or access4  7#b7 ,national  
security2 law en=cem5t2 rem$iation ,!   
,attorney ,g5]al1 ! head ( an elem5t ( !
 intellig5ce community 7z su* t]m is    
def9$ "u section #c7d7 ( ! ,national    
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc7d771 or ! ,secret>y may delay !   
notice to affect$ individuals "u        
p>agraph 7#a77;,b7 if ! notice w\ld     
disrupt a law en=cem5t inve/igation1    
endang] national security1 or hamp]     

security rem$iation actions4  7#c7 ,,omb
 report ,dur+ ! fir/ #b ye>s beg9n+ aft]
 ! date ( enactm5t ( ?is ,act1 !        
,director ( ! ,(fice ( ,managem5t &     
,budget %all1 on an annual basis-- 7,a7 
assess ag5cy implem5tation ( data brea* 
notification policies & guidel9es 9     
aggregate2 &  7,b7 include ! assessm5t  
describ$ 9 clause 7i7 9 ! report requir$
 "u section #cedc7;a77#h7 ( title #dd1  
,unit$ ,/ates ,code4  7#d7 ,exception   
,any elem5t ( ! intellig5ce community 7z
 su* t]m is def9$ "u section #c7d7 ( !  
,national ,security ,act ( #aidg 7#ej   
,u4,s4,c4 #cjjc7d77 t is requir$ to     
provide notice "u p>agraph 7#a77;,a7    
%all only provide su* notice to         
appropriate committees ( ,congress4  7c7
 ,rule ( con/ruction ,no?+ 9 ! am5dm5t  
made by subsection 7a7 or 9 subsection  
7b77#a7 %all be con/ru$ to alt] any     
au?ority ( a ,f$]al ag5cy or dep>tm5t4  
7d7 ,te*nical & con=m+ am5dm5t ,! table 
( cont5ts 9 section #a7;b7 ( ! ,homel&  
,security ,act ( #bjjb 7#f ,u4,s4,c4    

#aja note71 z am5d$ by section #c1 is   
am5d$ by ins]t+ aft] ! item relat+ to   
section #bbf ! foll[+3  ,sec4 #bbg4     
,cyb] incid5t response plan4,sec4 #bbh4 
,cle>ances4  4  #h4 ,rules ( con/ruction
  7a7 ,prohibition on new regulatory    
au?ority ,no?+ 9 ?is ,act or ! am5dm5ts 
made by ?is ,act %all be con/ru$ to     
grant ! ,secret>y any au?ority to       
promulgate regulations or set /&>ds     
relat+ to ! cyb]security ( private      
sector critical infra/ructure t 0 n 9   
effect on ! day be=e ! date ( enactm5t (
 ?is ,act4  7b7 ,private entities ,no?+ 
9 ?is ,act or ! am5dm5ts made by ?is    
,act %all be con/ru$ to require any     
private entity-- 7#a7 to reque/         
assi/ance f ! ,secret>y2 or  7#b7 t     
reque/$ su* assi/ance f ! ,secret>y to  
implem5t any measure or recomm5dation   
sugge/$ by ! ,secret>y4  ,pass$ ! ,s5ate
 ,decemb] #aj1 #bjad4,secret>y