,,ii #aad? ,,congress #a/ ,session ,h4 ,r4 #aefj ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,april #bg1 #bjae,receiv$ ,,an ,,act ,to improve cyb]security 9 ! ,unit$ ,/ates ?r\gh enhanc$ %>+ ( in=mation ab\t cyb]security ?reats1 to am5d ! ,homel& ,security ,act ( #bjjb to enhance multi-directional %>+ ( in=mation relat$ to cyb]security risks & /r5g!n privacy & civil lib]ties protections1 & = o!r purposes4 #a4 ,table ( ,cont5ts ,! table ( cont5ts ( ?is ,act is z foll[s3 ,sec4 #a4 ,table ( ,cont5ts4 ,title ,i--,protect+ ,cyb] ,networks ,act ,sec4 #aja4 ,%ort title4 ,sec4 #ajb4 ,%>+ ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t ) non-,f$]al entities4 ,sec4 #ajc4 ,au?orizations = prev5t+1 detect+1 analyz+1 & mitigat+ cyb]security ?reats4 ,sec4 #ajd4 ,%>+ ( cyb] ?reat indicators & def5sive measures ) appropriate ,f$]al entities o!r ?an ! ,dep>tm5t ( ,def5se or ! ,national ,security ,ag5cy4 ,sec4 #aje4 ,f$]al ,gov]nm5t liability = violations ( privacy or civil lib]ties4 ,sec4 #ajf4 ,protection f liability4 ,sec4 #ajg4 ,ov]sight ( ,gov]nm5t activities4 ,sec4 #ajh4 ,report on cyb]security ?reats4 ,sec4 #aji4 ,con/ruction & preemption4 ,sec4 #aaj4 ,def9itions4 ,sec4 #aaa4 ,comptroll] ,g5]al report on removal ( p]sonal id5tify+ in=mation4 ,sec4 #aab4 ,sunset4 ,title ,,ii--,national ,cyb]security ,protection ,advancem5t ,act ,sec4 #bja4 ,%ort title4 ,sec4 #bjb4 ,national ,cyb]security & ,communications ,integration ,c5t]4 ,sec4 #bjc4 ,in=mation %>+ /ructure & processes4 ,sec4 #bjd4 ,in=mation %>+ & analysis organizations4 ,sec4 #bje4 ,/reaml9+ ( ,dep>tm5t ( ,homel& ,security cyb]security & infra/ructure protection organization4 ,sec4 #bjf4 ,cyb] incid5t response plans4 ,sec4 #bjg4 ,security & resili5cy ( public safety communications2 ,cyb]security aw>5ess campaign4 ,sec4 #bjh4 ,critical infra/ructure protection rese>* & developm5t4 ,sec4 #bji4 ,report on r$uc+ cyb]security risks 9 ,,dhs data c5t]s4 ,sec4 #baj4 ,assessm5t4 ,sec4 #baa4 ,consultation4 ,sec4 #bab4 ,te*nical assi/ance4 ,sec4 #bac4 ,prohibition on new regulatory au?ority4 ,sec4 #bad4 ,sunset4 ,sec4 #bae4 ,prohibition on new fund+4 ,sec4 #baf4 ,protection ( ,f$]al in=mation sy/ems4 ,sec4 #bag4 ,sunset4 ,sec4 #bah4 ,report on cyb]security vuln]abilities ( ,unit$ ,/ates ports4 ,sec4 #bai4 ,report on cyb]security & critical infra/ructure4 ,sec4 #bbj4 ,,gao report on impact privacy & civil lib]ties4 ,i ,protect+ ,cyb] ,networks ,act #aja4 ,%ort title ,?is title may be cit$ z ! ,protect+ ,cyb] ,networks ,act4 #ajb4 ,%>+ ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t ) non-,f$]al entities 7a7 ,9 g5]al ,title ,i ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjba et seq47 is am5d$ by ins]t+ aft] section #aaj 7#ej ,u4,s4,c4 #cjde7 ! foll[+ new section3 #aaa4 ,%>+ ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t ) non-,f$]al entities 7a7 ,%>+ by ! ,f$]al ,gov]nm5t 7#a7 ,9 g5]al ,consi/5t ) ! protection ( classifi$ in=mation1 intellig5ce s\rces & me?ods1 & privacy & civil lib]ties1 ! ,director ( ,national ,intellig5ce1 9 consultation ) ! heads ( ! o!r appropriate ,f$]al entities1 %all develop & promulgate proc$ures to facilitate & promote-- 7,a7 ! timely %>+ ( classifi$ cyb] ?reat indicators 9 ! possession ( ! ,f$]al ,gov]nm5t ) repres5tatives ( relevant non-,f$]al entities ) appropriate security cle>ances2 7,b7 ! timely %>+ ) relevant non-,f$]al entities ( cyb] ?reat indicators 9 ! possession ( ! ,f$]al ,gov]nm5t t may be declassifi$ & %>$ at an unclassifi$ level2 & 7,c7 ! %>+ ) non-,f$]al entities1 if appropriate1 ( in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t ab\t imm95t or ongo+ cyb]security ?reats to su* entities to prev5t or mitigate adv]se impacts f su* cyb]security ?reats4 7#b7 ,developm5t ( proc$ures ,! proc$ures develop$ & promulgat$ "u p>agraph 7#a7 %all-- 7,a7 ensure ! ,f$]al ,gov]nm5t has & ma9ta9s ! capability to %>e cyb] ?reat indicators 9 real "t consi/5t ) ! protection ( classifi$ in=mation2 7,b7 incorporate1 to ! greate/ ext5t practicable1 exi/+ processes & exi/+ roles & responsibilities ( ,f$]al & non-,f$]al entities = in=mation %>+ by ! ,f$]al ,gov]nm5t1 includ+ sector-specific in=mation %>+ & analysis c5t]s2 7,c7 include proc$ures = notify+ non-,f$]al entities t h receiv$ a cyb] ?reat indicator f a ,f$]al entity "u ?is ,act t is kn[n or det]m9$ to be 9 error or 9 contrav5tion ( ! requirem5ts ( ?is section1 ! ,protect+ ,cyb] ,networks ,act1 or ! am5dm5ts made by su* ,act or ano!r provision ( ,f$]al law or policy ( su* error or contrav5tion2 7,d7 include requirem5ts = ,f$]al entities receiv+ a cyb] ?reat indicator or def5sive measure to implem5t appropriate security controls to protect aga9/ unau?oriz$ access to1 or acquisition (1 su* cyb] ?reat indicator or def5sive measure2 7,e7 include proc$ures t require ,f$]al entities1 prior to ! %>+ ( a cyb] ?reat indicator1 to-- 7i7 review su* cyb] ?reat indicator to assess :e!r su* cyb] ?reat indicator1 9 contrav5tion ( ! requirem5t "u section #c7;d77#b7 ( ! ,protect+ ,cyb] ,networks ,act1 conta9s any in=mation t su* ,f$]al entity kn[s at ! "t ( %>+ to be p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat & remove su* in=mation2 or 7ii7 implem5t a te*nical capability configur$ to remove or exclude any p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat2 & 7,f7 include proc$ures to promote ! effici5t grant+ ( security cle>ances to appropriate repres5tatives ( non-,f$]al entities4 7b7 ,def9itions ,9 ?is section1 ! t]ms appropriate ,f$]al entities1 cyb] ?reat indicator1 def5sive measure1 ,f$]al entity1 & non-,f$]al entity h ! mean+ giv5 su* t]ms 9 section #aa ( ! ,protect+ ,cyb] ,networks ,act4 4 7b7 ,submittal to ,congress ,n lat] ?an #ij days aft] ! date ( ! enactm5t ( ?is title1 ! ,director ( ,national ,intellig5ce1 9 consultation ) ! heads ( ! o!r appropriate ,f$]al entities1 %all submit to ,congress ! proc$ures requir$ by section #aaa7;a7 ( ! ,national ,security ,act ( #aidg1 z ins]t$ by subsection 7a7 ( ?is section4 7c7 ,table ( cont5ts am5dm5t ,! table ( cont5ts 9 ! fir/ section ( ! ,national ,security ,act ( #aidg is am5d$ by ins]t+ aft] ! item relat+ to section #aaj ! foll[+ new item3 ,sec4 #aaa4 ,%>+ ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t ) non-,f$]al entities4 4 #ajc4 ,au?orizations = prev5t+1 detect+1 analyz+1 & mitigat+ cyb]security ?reats 7a7 ,au?orization = private-sector def5sive monitor+ 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 a private entity may1 = a cyb]security purpose1 monitor-- 7,a7 an in=mation sy/em ( su* private entity2 7,b7 an in=mation sy/em ( a non-,f$]al entity or a ,f$]al entity1 ^u ! writt5 au?orization ( su* non-,f$]al entity or su* ,f$]al entity2 & 7,c7 in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em monitor$ by ! private entity "u ?is p>agraph4 7#b7 ,con/ruction ,no?+ 9 ?is subsection %all be con/ru$ to-- 7,a7 au?orize ! monitor+ ( an in=mation sy/em1 or ! use ( any in=mation obta9$ ?r\gh su* monitor+1 o!r ?an z provid$ 9 ?is title2 7,b7 au?orize ! ,f$]al ,gov]nm5t to conduct surveillance ( any p]son2 or 7,c7 limit o!rwise lawful activity4 7b7 ,au?orization = op]ation ( def5sive measures 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b7 & not)/&+ any o!r provision ( law1 a private entity may1 = a cyb]security purpose1 op]ate a def5sive measure t is op]at$ on-- 7,a7 an in=mation sy/em ( su* private entity to protect ! rights or prop]ty ( ! private entity2 & 7,b7 an in=mation sy/em ( a non-,f$]al entity or a ,f$]al entity ^u writt5 au?orization ( su* non-,f$]al entity or su* ,f$]al entity = op]ation ( su* def5sive measure to protect ! rights or prop]ty ( su* private entity1 su* non-,f$]al entity1 or su* ,f$]al entity4 7#b7 ,limitation ,! au?ority provid$ 9 p>agraph 7#a7 does n include a def5sive measure t de/roys1 r5d]s unusable or inaccessible 79 :ole or 9 "p71 or sub/antially h>ms an in=mation sy/em or in=mation /or$ on1 process$ by1 or transit+ su* in=mation sy/em n own$ by-- 7,a7 ! private entity op]at+ su* def5sive measure2 or 7,b7 a non-,f$]al entity or a ,f$]al entity t has provid$ writt5 au?orization to t private entity = op]ation ( su* def5sive measure on ! in=mation sy/em or in=mation ( ! entity 9 accordance ) ?is subsection4 7#c7 ,con/ruction ,no?+ 9 ?is subsection %all be con/ru$-- 7,a7 to au?orize ! use ( a def5sive measure o!r ?an z provid$ 9 ?is subsection2 or 7,b7 to limit o!rwise lawful activity4 7c7 ,au?orization = %>+ or receiv+ cyb] ?reat indicators or def5sive measures 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b7 & not)/&+ any o!r provision ( law1 a non-,f$]al entity may1 = a cyb]security purpose & consi/5t ) ! requirem5t "u subsection 7d77#b7 to remove p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat & ! protection ( classifi$ in=mation-- 7,a7 %>e a lawfully obta9$ cyb] ?reat indicator or def5sive measure ) any o!r non-,f$]al entity or an appropriate ,f$]al entity 7o!r ?an ! ,dep>tm5t ( ,def5se or any compon5t ( ! ,dep>tm5t1 includ+ ! ,national ,security ,ag5cy72 & 7,b7 receive a cyb] ?reat indicator or def5sive measure f any o!r non-,f$]al entity or an appropriate ,f$]al entity4 7#b7 ,lawful re/riction ,a non-,f$]al entity receiv+ a cyb] ?reat indicator or def5sive measure f ano!r non-,f$]al entity or a ,f$]al entity %all comply ) o!rwise lawful re/rictions plac$ on ! %>+ or use ( su* cyb] ?reat indicator or def5sive measure by ! %>+ non-,f$]al entity or ,f$]al entity4 7#c7 ,con/ruction ,no?+ 9 ?is subsection %all be con/ru$ to-- 7,a7 au?orize ! %>+ or receiv+ ( a cyb] ?reat indicator or def5sive measure o!r ?an z provid$ 9 ?is subsection2 7,b7 au?orize ! %>+ or receiv+ ( classifi$ in=mation by or ) any p]son n au?oriz$ to access su* classifi$ in=mation2 7,c7 prohibit any ,f$]al entity f engag+ 9 =mal or in=mal te*nical discussion reg>d+ cyb] ?reat indicators or def5sive measures ) a non-,f$]al entity or f provid+ te*nical assi/ance to address vuln]abilities or mitigate ?reats at ! reque/ ( su* an entity2 7,d7 limit o!rwise lawful activity2 7,e7 prohibit o!rwise lawful %>+ by a non-,f$]al entity ( a cyb] ?reat indicator or def5sive measure ) ! ,dep>tm5t ( ,def5se or any compon5t ( ! ,dep>tm5t1 includ+ ! ,national ,security ,ag5cy2 or 7,f7 au?orize ! ,f$]al ,gov]nm5t to conduct surveillance ( any p]son4 7d7 ,protection & use ( in=mation 7#a7 ,security ( in=mation ,a non-,f$]al entity monitor+ an in=mation sy/em1 op]at+ a def5sive measure1 or provid+ or receiv+ a cyb] ?reat indicator or def5sive measure "u ?is section %all implem5t an appropriate security control to protect aga9/ unau?oriz$ access to1 or acquisition (1 su* cyb] ?reat indicator or def5sive measure4 7#b7 ,removal ( c]ta9 p]sonal in=mation ,a non-,f$]al entity %>+ a cyb] ?reat indicator pursuant to ?is title %all1 prior to su* %>+1 take reasonable ef=ts to-- 7,a7 review su* cyb] ?reat indicator to assess :e!r su* cyb] ?reat indicator conta9s any in=mation t ! non-,f$]al entity reasonably believes at ! "t ( %>+ to be p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat & remove su* in=mation2 or 7,b7 implem5t a te*nical capability configur$ to remove any in=mation conta9$ )9 su* indicator t ! non-,f$]al entity reasonably believes at ! "t ( %>+ to be p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat4 7#c7 ,use ( cyb] ?reat indicators & def5sive measures by non-,f$]al entities ,a non-,f$]al entity may1 = a cyb]security purpose-- 7,a7 use a cyb] ?reat indicator or def5sive measure %>$ or receiv$ "u ?is section to monitor or op]ate a def5sive measure on-- 7i7 an in=mation sy/em ( su* non-,f$]al entity2 or 7ii7 an in=mation sy/em ( ano!r non-,f$]al entity or a ,f$]al entity ^u ! writt5 au?orization ( t o!r non-,f$]al entity or t ,f$]al entity2 & 7,b7 o!rwise use1 reta91 & fur!r %>e su* cyb] ?reat indicator or def5sive measure subject to-- 7i7 an o!rwise lawful re/riction plac$ by ! %>+ non-,f$]al entity or ,f$]al entity on su* cyb] ?reat indicator or def5sive measure2 or 7ii7 an o!rwise applicable provision ( law4 7#d7 ,use ( cyb] ?reat indicators by ,/ate1 tribal1 or local gov]nm5t 7,a7 ,law en=cem5t use ,a ,/ate1 tribal1 or local gov]nm5t may use a cyb] ?reat indicator %>$ ) su* ,/ate1 tribal1 or local gov]nm5t = ! purposes describ$ 9 clauses 7i71 7ii71 & 7iii7 ( section #ajd7;d77#e77;,a74 7,b7 ,exemption f disclosure ,a cyb] ?reat indicator or def5sive measure %>$ ) a ,/ate1 tribal1 or local gov]nm5t "u ?is section %all be-- 7i7 deem$ volunt>ily %>$ in=mation2 & 7ii7 exempt f disclosure "u any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records1 except z o!rwise requir$ by applicable ,/ate1 tribal1 or local law requir+ disclosure 9 any crim9al prosecution4 7e7 ,no "r or b5efit ,! %>+ ( a cyb] ?reat indicator ) a non-,f$]al entity "u ?is title %all n create a "r or b5efit to simil> in=mation by su* non-,f$]al entity or any o!r non-,f$]al entity4 7f7 ,small bus9ess p>ticipation 7#a7 ,assi/ance ,! ,adm9i/rator ( ! ,small ,bus9ess ,adm9i/ration %all provide assi/ance to small bus9esses & small f9ancial in/itutions to monitor in=mation & in=mation sy/ems1 op]ate def5sive measures1 & %>e & receive cyb] ?reat indicators & def5sive measures "u ?is section4 7#b7 ,report ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is title1 ! ,adm9i/rator ( ! ,small ,bus9ess ,adm9i/ration %all submit to ! ,presid5t a report on ! degree to :i* small bus9esses & small f9ancial in/itutions are able to engage 9 cyb] ?reat in=mation %>+ "u ?is section4 ,su* report %all include ! recomm5dations ( ! ,adm9i/rator = improv+ ! ability ( su* bus9esses & in/itutions to engage 9 cyb] ?reat in=mation %>+ & to use %>$ in=mation to def5d _! networks4 7#c7 ,outrea* ,! ,f$]al ,gov]nm5t %all conduct outrea* to small bus9esses & small f9ancial in/itutions to enc\rage su* bus9esses & in/itutions to ex]cise _! au?ority "u ?is section4 #ajd4 ,%>+ ( cyb] ?reat indicators & def5sive measures ) appropriate ,f$]al entities o!r ?an ! ,dep>tm5t ( ,def5se or ! ,national ,security ,ag5cy 7a7 ,requirem5t = policies & proc$ures 7#a7 ,9 g5]al ,section #aaa ( ! ,national ,security ,act ( #aidg1 z ins]t$ by section #ajb ( ?is title1 is am5d$-- 7,a7 by r$esignat+ subsection 7b7 z subsection 7c72 & 7,b7 by ins]t+ aft] subsection 7a7 ! foll[+ new subsection3 7b7 ,policies & proc$ures = %>+ ) ! appropriate ,f$]al entities o!r ?an ! ,dep>tm5t ( ,def5se or ! ,national ,security ,ag5cy 7#a7 ,e/abli%m5t ,! ,presid5t %all develop & submit to ,congress policies & proc$ures relat+ to ! receipt ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t4 7#b7 ,requirem5ts conc]n+ policies & proc$ures ,! policies & proc$ures requir$ "u p>agraph 7#a7 %all-- 7,a7 be develop$ 9 accordance ) ! privacy & civil lib]ties guidel9es requir$ "u section #d7;b7 ( ! ,protect+ ,cyb] ,networks ,act2 7,b7 ensure t-- 7i7 a cyb] ?reat indicator %>$ by a non-,f$]al entity ) an appropriate ,f$]al entity 7o!r ?an ! ,dep>tm5t ( ,def5se or any compon5t ( ! ,dep>tm5t1 includ+ ! ,national ,security ,ag5cy7 pursuant to section #c ( su* ,act is %>$ 9 real-"t ) all ( ! appropriate ,f$]al entities 7includ+ all relevant compon5ts !re(72 7ii7 ! %>+ ( su* cyb] ?reat indicator ) appropriate ,f$]al entities is n subject to any delay1 modification1 or any o!r action )\t good cause t c\ld imp$e receipt by all ( ! appropriate ,f$]al entities2 & 7iii7 su* cyb] ?reat indicator is provid$ to ea* o!r ,f$]al entity to :i* su* cyb] ?reat indicator is relevant2 & 7,c7 ensure !re-- 7i7 is an audit capability2 & 7ii7 are appropriate sanctions 9 place = (fic]s1 employees1 or ag5ts ( a ,f$]al entity :o kn[+ly & willfully use a cyb] ?reat indicator or def5se measure %>$ ) ! ,f$]al ,gov]nm5t by a non-,f$]al entity "u ! ,protect+ ,cyb] ,networks ,act o!r ?an 9 accordance ) ?is section & su* ,act4 4 7#b7 ,submission ,! ,presid5t %all submit to ,congress-- 7,a7 n lat] ?an #ij days aft] ! date ( ! enactm5t ( ?is title1 int]im policies & proc$ures requir$ "u section #aaa7;b77#a7 ( ! ,national ,security ,act ( #aidg1 z ins]t$ by p>agraph 7#a7 ( ?is section2 & 7,b7 n lat] ?an #ahj days aft] su* date1 f9al policies & proc$ures requir$ "u su* section #aaa7;b77#a74 7b7 ,privacy & civil lib]ties 7#a7 ,guidel9es ( ,attorney ,g5]al ,! ,attorney ,g5]al1 9 consultation ) ! heads ( ! o!r appropriate ,f$]al ag5cies & ) (fic]s designat$ "u section #ajfb ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a71 %all develop & p]iodically review guidel9es relat+ to privacy & civil lib]ties t gov]n ! receipt1 ret5tion1 use1 & dissem9ation ( cyb] ?reat indicators by a ,f$]al entity obta9$ 9 accordance ) ?is title & ! am5dm5ts made by ?is title4 7#b7 ,cont5t ,! guidel9es develop$ & review$ "u p>agraph 7#a7 %all1 consi/5t ) ! ne$ to protect in=mation sy/ems f cyb]security ?reats & mitigate cyb]security ?reats-- 7,a7 limit ! impact on privacy & civil lib]ties ( activities by ! ,f$]al ,gov]nm5t "u ?is title1 includ+ guidel9es to ensure t p]sonal in=mation ( or in=mation id5tify+ specific p]sons is prop]ly remov$ f in=mation receiv$1 reta9$1 us$1 or dissem9at$ by a ,f$]al entity 9 accordance ) ?is title or ! am5dm5ts made by ?is title2 7,b7 limit ! receipt1 ret5tion1 use1 & dissem9ation ( cyb] ?reat indicators conta9+ p]sonal in=mation ( or in=mation id5tify+ specific p]sons1 includ+ by e/abli%+-- 7i7 a process = ! prompt de/ruction ( su* in=mation t is kn[n n to be directly relat$ to a use = a cyb]security purpose2 7ii7 specific limitations on ! l5g? ( any p]iod 9 :i* a cyb] ?reat indicator may be reta9$2 & 7iii7 a process to in=m recipi5ts t su* indicators may only be us$ = a cyb]security purpose2 7,c7 include requirem5ts to safegu>d cyb] ?reat indicators conta9+ p]sonal in=mation ( or id5tify+ specific p]sons f unau?oriz$ access or acquisition1 includ+ appropriate sanctions = activities by (fic]s1 employees1 or ag5ts ( ! ,f$]al ,gov]nm5t 9 contrav5tion ( su* guidel9es2 7,d7 include proc$ures = notify+ non-,f$]al entities & ,f$]al entities if in=mation receiv$ pursuant to ?is section is kn[n or det]m9$ by a ,f$]al entity receiv+ su* in=mation n to con/itute a cyb] ?reat indicator2 7,e7 be consi/5t ) any o!r applicable provisions ( law & ! fair in=mation practice pr9ciples set =? 9 app5dix ,a ( ! docum5t entitl$ ,national ,/rategy = ,tru/$ ,id5tities 9 ,cyb]space & publi%$ by ! ,presid5t 9 ,april1 #bjaa2 & 7,f7 include /eps t may be ne$$ s t dissem9ation ( cyb] ?reat indicators is consi/5t ) ! protection ( classifi$ in=mation & o!r s5sitive national security in=mation4 7#c7 ,submission ,! ,attorney ,g5]al %all submit to ,congress-- 7,a7 n lat] ?an #ij days aft] ! date ( ! enactm5t ( ?is title1 int]im guidel9es requir$ "u p>agraph 7#a72 & 7,b7 n lat] ?an #ahj days aft] su* date1 f9al guidel9es requir$ "u su* p>agraph4 7c7 ,national ,cyb] ,?reat ,intellig5ce ,integration ,c5t] 7#a7 ,e/abli%m5t ,title ,i ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjba et seq471 z am5d$ by section #ajb ( ?is title1 is fur!r am5d$-- 7,a7 by r$esignat+ section #aai;,b z section #aai;,c2 & 7,b7 by ins]t+ aft] section #aai;,a ! foll[+ new section3 #aai;,b4 ,cyb] ,?reat ,intellig5ce ,integration ,c5t] 7a7 ,e/abli%m5t ,!re is )9 ! ,(fice ( ! ,director ( ,national ,intellig5ce a ,cyb] ,?reat ,intellig5ce ,integration ,c5t]4 7b7 ,director ,!re is a ,director ( ! ,cyb] ,?reat ,intellig5ce ,integration ,c5t]1 :o %all be ! head ( ! ,cyb] ,?reat ,intellig5ce ,integration ,c5t]1 & :o %all be appo9t$ by ! ,director ( ,national ,intellig5ce4 7c7 ,prim>y missions ,! ,cyb] ,?reat ,intellig5ce ,integration ,c5t] %all-- 7#a7 s]ve z ! prim>y organization )9 ! ,f$]al ,gov]nm5t = analyz+ & integrat+ all intellig5ce possess$ or acquir$ by ! ,unit$ ,/ates p]ta9+ to cyb] ?reats2 7#b7 ensure t appropriate dep>tm5ts & ag5cies h full access to & receive all-s\rce intellig5ce support ne$$ to execute ! cyb] ?reat intellig5ce activities ( su* ag5cies & to p]=m indep5d5t1 alt]native analyses2 7#c7 dissem9ate cyb] ?reat analysis to ! ,presid5t1 ! appropriate dep>tm5ts & ag5cies ( ! ,f$]al ,gov]nm5t1 & ! appropriate committees ( ,congress2 7#d7 coord9ate cyb] ?reat intellig5ce activities ( ! dep>tm5ts & ag5cies ( ! ,f$]al ,gov]nm5t2 & 7#e7 conduct /rategic cyb] ?reat intellig5ce plann+ = ! ,f$]al ,gov]nm5t4 7d7 ,limitations ,! ,cyb] ,?reat ,intellig5ce ,integration ,c5t] %all-- 7#a7 h n m ?an #ej p]man5t positions2 7#b7 9 c>ry+ out ! prim>y missions ( ! ,c5t] describ$ 9 subsection 7c71 may n augm5t /aff+ ?r\gh detailees1 assignees1 or core contractor p]sonnel or ent] into any p]sonal s]vices contracts to exce$ ! limitation "u p>agraph 7#a72 & 7#c7 be locat$ 9 a build+ own$ or op]at$ by an elem5t ( ! intellig5ce community z ( ! date ( ! enactm5t ( ?is section4 4 7#b7 ,table ( cont5ts am5dm5ts ,! table ( cont5ts 9 ! fir/ section ( ! ,national ,security ,act ( #aidg1 z am5d$ by section #ajb ( ?is title1 is fur!r am5d$ by /rik+ ! item relat+ to section #aai;,b & ins]t+ ! foll[+ new items3 ,sec4 #aai;,b4 ,cyb] ,?reat ,intellig5ce ,integration ,c5t]4 ,sec4 #aai;,c4 ,national intellig5ce c5t]s4 4 7d7 ,in=mation %>$ ) or provid$ to ! ,f$]al ,gov]nm5t 7#a7 ,no waiv] ( privilege or protection ,! provision ( a cyb] ?reat indicator or def5sive measure to ! ,f$]al ,gov]nm5t "u ?is title %all n con/itute a waiv] ( any applicable privilege or protection provid$ by law1 includ+ trade secret protection4 7#b7 ,propriet>y in=mation ,consi/5t ) ?is title1 a cyb] ?reat indicator or def5sive measure provid$ by a non-,f$]al entity to ! ,f$]al ,gov]nm5t "u ?is title %all be consid]$ ! comm]cial1 f9ancial1 & propriet>y in=mation ( ! non-,f$]al entity t is ! orig9ator ( su* cyb] ?reat indicator or def5sive measure :5 s designat$ by su* non-,f$]al entity or a non-,f$]al entity act+ 9 accordance ) ! writt5 au?orization ( ! non-,f$]al entity t is ! orig9ator ( su* cyb] ?reat indicator or def5sive measure4 7#c7 ,exemption f disclosure ,a cyb] ?reat indicator or def5sive measure provid$ to ! ,f$]al ,gov]nm5t "u ?is title %all be-- 7,a7 deem$ volunt>ily %>$ in=mation & exempt f disclosure "u section #eeb ( title #e1 ,unit$ ,/ates ,code1 & any ,/ate1 tribal1 or local law requir+ disclosure ( in=mation or records2 & 7,b7 )held1 )\t discretion1 f ! public "u section #eeb7;b77#c7 ( title #e1 ,unit$ ,/ates ,code1 & any ,/ate1 tribal1 or local provision ( law requir+ disclosure ( in=mation or records1 except z o!rwise requir$ by applicable ,f$]al1 ,/ate1 tribal1 or local law requir+ disclosure 9 any crim9al prosecution4 7#d7 ,ex p>te communications ,! provision ( a cyb] ?reat indicator or def5sive measure to ! ,f$]al ,gov]nm5t "u ?is title %all n be subject to a rule ( any ,f$]al dep>tm5t or ag5cy or any judicial doctr9e reg>d+ ex p>te communications ) a decision-mak+ (ficial4 7#e7 ,disclosure1 ret5tion1 & use 7,a7 ,au?oriz$ activities ,a cyb] ?reat indicator or def5sive measure provid$ to ! ,f$]al ,gov]nm5t "u ?is title may be disclos$ to1 reta9$ by1 & us$ by1 consi/5t ) o!rwise applicable provisions ( ,f$]al law1 any dep>tm5t1 ag5cy1 compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t solely =-- 7i7 a cyb]security purpose2 7ii7 ! purpose ( respond+ to1 inve/igat+1 prosecut+1 or o!rwise prev5t+ or mitigat+ a ?reat ( dea? or s]i\s bodily h>m or an (f5se aris+ out ( su* a ?reat2 7iii7 ! purpose ( respond+ to1 inve/igat+1 prosecut+1 or o!rwise prev5t+ or mitigat+1 a s]i\s ?reat to a m9or1 includ+ sexual exploitation & ?reats to physical safety2 or 7iv7 ! purpose ( prev5t+1 inve/igat+1 disrupt+1 or prosecut+ any ( ! (f5ses li/$ 9 sections #ajbh1 #ajbi1 #ajcj1 & #ceei7;c77#b77;,f7 & *apt]s #cg & #ij ( title #ah1 ,unit$ ,/ates ,code4 7,b7 ,prohibit$ activities ,a cyb] ?reat indicator or def5sive measure provid$ to ! ,f$]al ,gov]nm5t "u ?is title %all n be disclos$ to1 reta9$ by1 or us$ by any ,f$]al dep>tm5t or ag5cy = any use n p]mitt$ "u subp>agraph 7,a74 7,c7 ,privacy & civil lib]ties ,a cyb] ?reat indicator or def5sive measure provid$ to ! ,f$]al ,gov]nm5t "u ?is title %all be reta9$1 us$1 & dissem9at$ by ! ,f$]al ,gov]nm5t 9 accordance )-- 7i7 ! policies & proc$ures relat+ to ! receipt ( cyb] ?reat indicators & def5sive measures by ! ,f$]al ,gov]nm5t requir$ by subsection 7b7 ( section #aaa ( ! ,national ,security ,act ( #aidg1 z add$ by subsection 7a7 ( ?is section2 & 7ii7 ! privacy & civil lib]ties guidel9es requir$ by subsection 7b74 #aje4 ,f$]al ,gov]nm5t liability = violations ( privacy or civil lib]ties 7a7 ,9 g5]al ,if a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t int5tionally or willfully violates ! privacy & civil lib]ties guidel9es issu$ by ! ,attorney ,g5]al "u section #ajd7;b71 ! ,unit$ ,/ates %all be liable to a p]son injur$ by su* violation 9 an am\nt equal to ! sum (-- 7#a7 ! actual damages su/a9$ by ! p]son z a result ( ! violation or #a1jjj1 :i*ev] is great]2 & 7#b7 reasonable attorney fees z det]m9$ by ! c\rt & o!r litigation co/s reasonably incurr$ 9 any case "u ?is subsection 9 :i* ! compla9ant has sub/antially prevail$4 7b7 ,v5ue ,an action to en=ce liability creat$ "u ?is section may be br\ght 9 ! di/rict c\rt ( ! ,unit$ ,/ates 9-- 7#a7 ! di/rict 9 :i* ! compla9ant resides2 7#b7 ! di/rict 9 :i* ! pr9cipal place ( bus9ess ( ! compla9ant is locat$2 7#c7 ! di/rict 9 :i* ! dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t t violat$ su* privacy & civil lib]ties guidel9es is locat$2 or 7#d7 ! ,di/rict ( ,columbia4 7c7 ,/atute ( limitations ,no action %all lie "u ?is section unless su* action is comm5c$ n lat] ?an #b ye>s aft] ! date on :i* ! cause ( action arises4 7d7 ,exclusive cause ( action ,a cause ( action "u ?is section %all be ! exclusive means available to a compla9ant seek+ a rem$y = a violation by a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t "u ?is title4 #ajf4 ,protection f liability 7a7 ,monitor+ ( in=mation sy/ems ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt aga9/ any private entity1 & su* action %all be promptly dismiss$1 = ! monitor+ ( an in=mation sy/em & in=mation "u section #ajc7;a7 t is conduct$ 9 accordance ) ?is title & ! am5dm5ts made by ?is title4 7b7 ,%>+ or receipt ( cyb] ?reat indicators ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt aga9/ any non-,f$]al entity1 & su* action %all be promptly dismiss$1 = ! %>+ or receipt ( a cyb] ?reat indicator or def5sive measure "u section #ajc7;c71 or a good fai? failure to act bas$ on su* %>+ or receipt1 if su* %>+ or receipt is conduct$ 9 accordance ) ?is title & ! am5dm5ts made by ?is title4 7c7 ,willful misconduct 7#a7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$-- 7,a7 to require dismissal ( a cause ( action aga9/ a non-,f$]al entity 7includ+ a private entity7 t has engag$ 9 willful misconduct 9 ! c\rse ( conduct+ activities au?oriz$ by ?is title or ! am5dm5ts made by ?is title2 or 7,b7 to und]m9e or limit ! availability ( o!rwise applicable common law or /atutory def5ses4 7#b7 ,pro( ( willful misconduct ,9 any action claim+ t subsection 7a7 or 7b7 does n apply due to willful misconduct describ$ 9 p>agraph 7#a71 ! pla9tiff %all h ! burd5 ( prov+ by cle> & conv9c+ evid5ce ! willful misconduct by ea* non-,f$]al entity subject to su* claim & t su* willful misconduct proximately caus$ injury to ! pla9tiff4 7#c7 ,willful misconduct def9$ ,9 ?is subsection1 ! t]m willful misconduct means an act or omission t is tak5-- 7,a7 int5tionally to a*ieve a wrongful purpose2 7,b7 kn[+ly )\t legal or factual ju/ification2 & 7,c7 9 disreg>d ( a kn[n or obvi\s risk t is s great z to make x highly probable t ! h>m w outweigh ! b5efit4 #ajg4 ,ov]sight ( ,gov]nm5t activities 7a7 ,bi5nial report on implem5tation 7#a7 ,9 g5]al ,section #aaa ( ! ,national ,security ,act ( #aidg1 z add$ by section #ajb7;a7 & am5d$ by section #ajd7;a7 ( ?is title1 is fur!r am5d$-- 7,a7 by r$esignat+ subsection 7c7 7z r$esignat$ by su* section #ajd7;a77 z subsection 7d72 & 7,b7 by ins]t+ aft] subsection 7b7 7z ins]t$ by su* section #ajd7;a77 ! foll[+ new subsection3 7c7 ,bi5nial report on implem5tation 7#a7 ,9 g5]al ,n less frequ5tly ?an once e two ye>s1 ! ,director ( ,national ,intellig5ce1 9 consultation ) ! heads ( ! o!r appropriate ,f$]al entities1 %all submit to ,congress a report conc]n+ ! implem5tation ( ?is section & ! ,protect+ ,cyb] ,networks ,act4 7#b7 ,cont5ts ,ea* report submitt$ "u p>agraph 7#a7 %all include ! foll[+3 7,a7 ,an assessm5t ( ! suffici5cy ( ! policies1 proc$ures1 & guidel9es requir$ by ?is section & section #d ( ! ,protect+ ,cyb] ,networks ,act 9 ensur+ t cyb] ?reat indicators are %>$ effectively & responsibly )9 ! ,f$]al ,gov]nm5t4 7,b7 ,an assessm5t ( :e!r ! proc$ures develop$ "u section #c ( su* ,act comply ) ! goals describ$ 9 subp>agraphs 7,a71 7,b71 & 7,c7 ( subsection 7a77#a74 7,c7 ,an assessm5t ( :e!r cyb] ?reat indicators h be5 prop]ly classifi$ & an acc\nt+ ( ! numb] ( security cle>ances au?oriz$ by ! ,f$]al ,gov]nm5t = ! purposes ( ?is section & su* ,act4 7,d7 ,a review ( ! type ( cyb] ?reat indicators %>$ ) ! ,f$]al ,gov]nm5t "u ?is section & su* ,act1 includ+ ! foll[+3 7i7 ,! degree to :i* su* in=mation may impact ! privacy & civil lib]ties ( specific p]sons4 7ii7 ,a quantitative & qualitative assessm5t ( ! impact ( ! %>+ ( su* cyb] ?reat indicators ) ! ,f$]al ,gov]nm5t on privacy & civil lib]ties ( specific p]sons4 7iii7 ,! adequacy ( any /eps tak5 by ! ,f$]al ,gov]nm5t to r$uce su* impact4 7,e7 ,a review ( actions tak5 by ! ,f$]al ,gov]nm5t bas$ on cyb] ?reat indicators %>$ ) ! ,f$]al ,gov]nm5t "u ?is section or su* ,act1 includ+ ! appropriat5ess ( any subsequ5t use or dissem9ation ( su* cyb] ?reat indicators by a ,f$]al entity "u ?is section or section #d ( su* ,act4 7,f7 ,a description ( any significant violations ( ! requirem5ts ( ?is section or su* ,act by ! ,f$]al ,gov]nm5t-- 7i7 an assessm5t ( all reports ( (fic]s1 employees1 & ag5ts ( ! ,f$]al ,gov]nm5t misus+ in=mation provid$ to ! ,f$]al ,gov]nm5t "u ! ,protect+ ,cyb] ,networks ,act or ?is section1 )\t reg>d to :e!r ! misuse 0 kn[+ or wilful2 & 7ii7 an assessm5t ( all discipl9>y actions tak5 aga9/ su* (fic]s1 employees1 & ag5ts4 7,g7 ,a summ>y ( ! numb] & type ( non-,f$]al entities t receiv$ classifi$ cyb] ?reat indicators f ! ,f$]al ,gov]nm5t "u ?is section or su* ,act & an evaluation ( ! risks & b5efits ( %>+ su* cyb] ?reat indicators4 7,h7 ,an assessm5t ( any p]sonal in=mation ( or in=mation id5tify+ a specific p]son n directly relat$ to a cyb]security ?reat t-- 7i7 0 %>$ by a non-,f$]al entity ) ! ,f$]al ,gov]nm5t "u ?is ,act 9 contrav5tion ( section #c7;d77#b7 ( su* ,act2 or 7ii7 0 %>$ )9 ! ,f$]al ,gov]nm5t "u ?is ,act 9 contrav5tion ( ! guidel9es requir$ by section #d7;b7 ( su* ,act4 7#c7 ,recomm5dations ,ea* report submitt$ "u p>agraph 7#a7 may include su* recomm5dations z ! heads ( ! appropriate ,f$]al entities may h = improvem5ts or modifications to ! au?orities & processes "u ?is section or su* ,act4 7#d7 ,=m ( report ,ea* report requir$ by p>agraph 7#a7 %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7#e7 ,public availability ( reports ,! ,director ( ,national ,intellig5ce %all make publicly available ! unclassifi$ portion ( ea* report requir$ by p>agraph 7#a74 4 7#b7 ,initial report ,! fir/ report requir$ "u subsection 7c7 ( section #aaa ( ! ,national ,security ,act ( #aidg1 z ins]t$ by p>agraph 7#a7 ( ?is subsection1 %all be submitt$ n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is title4 7b7 ,reports on privacy & civil lib]ties 7#a7 ,bi5nial report f ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d 7,a7 ,9 g5]al ,section #ajfa7;e7 ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee7e77 is am5d$ by add+ at ! end ! foll[+ new p>agraph3 7#c7 ,bi5nial report on c]ta9 cyb] activities 7,a7 ,report requir$ ,! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d %all bi5nially submit to ,congress & ! ,presid5t a report conta9+-- 7i7 an assessm5t ( ! privacy & civil lib]ties impact ( ! activities c>ri$ out "u ! ,protect+ ,cyb] ,networks ,act & ! am5dm5ts made by su* ,act2 & 7ii7 an assessm5t ( ! suffici5cy ( ! policies1 proc$ures1 & guidel9es e/abli%$ pursuant to section #d ( ! ,protect+ ,cyb] ,networks ,act & ! am5dm5ts made by su* section #d 9 address+ privacy & civil lib]ties conc]ns4 7,b7 ,recomm5dations ,ea* report submitt$ "u ?is p>agraph may include su* recomm5dations z ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d may h = improvem5ts or modifications to ! au?orities "u ! ,protect+ ,cyb] ,networks ,act or ! am5dm5ts made by su* ,act4 7,c7 ,=m ,ea* report requir$ "u ?is p>agraph %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7,d7 ,public availability ( reports ,! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d %all make publicly available ! unclassifi$ portion ( ea* report requir$ by subp>agraph 7,a74 4 7,b7 ,initial report ,! fir/ report requir$ "u p>agraph 7#c7 ( section #ajfa7;e7 ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee7e771 z add$ by subp>agraph 7,a7 ( ?is p>agraph1 %all be submitt$ n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is title4 7#b7 ,bi5nial report ( ,inspectors g5]al 7,a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is title & n less frequ5tly ?an once e #b ye>s !reaft]1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,homel& ,security1 ! ,inspector ,g5]al ( ! ,intellig5ce ,community1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,ju/ice1 & ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,def5se1 9 consultation ) ! ,c\ncil ( ,inspectors ,g5]al on ,f9ancial ,ov]sight1 %all jo9tly submit to ,congress a report on ! receipt1 use1 & dissem9ation ( cyb] ?reat indicators & def5sive measures t h be5 %>$ ) ,f$]al entities "u ?is title & ! am5dm5ts made by ?is title4 7,b7 ,cont5ts ,ea* report submitt$ "u subp>agraph 7,a7 %all include ! foll[+3 7i7 ,a review ( ! types ( cyb] ?reat indicators %>$ ) ,f$]al entities4 7ii7 ,a review ( ! actions tak5 by ,f$]al entities z a result ( ! receipt ( su* cyb] ?reat indicators4 7iii7 ,a li/ ( ,f$]al entities receiv+ su* cyb] ?reat indicators4 7iv7 ,a review ( ! %>+ ( su* cyb] ?reat indicators among ,f$]al entities to id5tify inappropriate b>ri]s to %>+ in=mation4 7v7 ,a review ( ! curr5t proc$ures p]ta9+ to ! %>+ ( in=mation1 removal proc$ures = p]sonal in=mation or in=mation id5tify+ a specific p]son1 & any incid5ts p]ta9+ to ! improp] treatm5t ( su* in=mation4 7,c7 ,recomm5dations ,ea* report submitt$ "u ?is p>agraph may include su* recomm5dations z ! ,inspectors ,g5]al ref]r$ to 9 subp>agraph 7,a7 may h = improvem5ts or modifications to ! au?orities "u ?is title or ! am5dm5ts made by ?is title4 7,d7 ,=m ,ea* report requir$ "u ?is p>agraph %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7,e7 ,public availability ( reports ,! ,inspector ,g5]al ( ! ,dep>tm5t ( ,homel& ,security1 ! ,inspector ,g5]al ( ! ,intellig5ce ,community1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,ju/ice1 & ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,def5se %all make publicly available ! unclassifi$ portion ( ea* report requir$ "u subp>agraph 7,a74 #ajh4 ,report on cyb]security ?reats 7a7 ,report requir$ ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is title1 ! ,director ( ,national ,intellig5ce1 9 consultation ) ! heads ( o!r appropriate elem5ts ( ! intellig5ce community1 %all submit to ! ,select ,committee on ,intellig5ce ( ! ,s5ate & ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives a report on cyb]security ?reats to ! national security & economy ( ! ,unit$ ,/ates1 includ+ cyb] attacks1 !ft1 & data brea*es4 7b7 ,cont5ts ,! report requir$ by subsection 7a7 %all include ! foll[+3 7#a7 ,an assessm5t (-- 7,a7 ! curr5t intellig5ce %>+ & coop]ation relation%ips ( ! ,unit$ ,/ates ) o!r c\ntries reg>d+ cyb]security ?reats 7includ+ cyb] attacks1 !ft1 & data brea*es7 direct$ aga9/ ! ,unit$ ,/ates t ?reat5 ! ,unit$ ,/ates national security int]e/s1 economy1 & intellectual prop]ty2 & 7,b7 ! relative utility ( su* relation%ips1 :i* elem5ts ( ! intellig5ce community p>ticipate 9 su* relation%ips1 & :e!r & h[ su* relation%ips c\ld be improv$4 7#b7 ,a li/ & an assessm5t ( ! c\ntries & non-/ate actors t are ! prim>y ?reats ( c>ry+ out a cyb]security ?reat 7includ+ a cyb] attack1 !ft1 or data brea*7 aga9/ ! ,unit$ ,/ates & t ?reat5 ! ,unit$ ,/ates national security1 economy1 & intellectual prop]ty4 7#c7 ,a description ( ! ext5t to :i* ! capabilities ( ! ,unit$ ,/ates ,gov]nm5t to respond to or prev5t cyb]security ?reats 7includ+ cyb] attacks1 !ft1 or data brea*es7 direct$ aga9/ ! ,unit$ ,/ates private sector are degrad$ by a delay 9 ! prompt notification by private entities ( su* ?reats or cyb] attacks1 !ft1 & brea*es4 7#d7 ,an assessm5t ( additional te*nologies or capabilities t w\ld enhance ! ability ( ! ,unit$ ,/ates to prev5t & to respond to cyb]security ?reats 7includ+ cyb] attacks1 !ft1 & data brea*es74 7#e7 ,an assessm5t ( any te*nologies or practices utiliz$ by ! private sector t c\ld be rapidly field$ to assi/ ! intellig5ce community 9 prev5t+ & respond+ to cyb]security ?reats4 7c7 ,=m ( report ,! report requir$ by subsection 7a7 %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7d7 ,public availability ( report ,! ,director ( ,national ,intellig5ce %all make publicly available ! unclassifi$ portion ( ! report requir$ by subsection 7a74 7e7 ,intellig5ce community def9$ ,9 ?is section1 ! t]m intellig5ce community has ! mean+ giv5 t t]m 9 section #c ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc74 #aji4 ,con/ruction & preemption 7a7 ,prohibition ( surveillance ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to au?orize ! ,dep>tm5t ( ,def5se or ! ,national ,security ,ag5cy or any o!r elem5t ( ! intellig5ce community to t>get a p]son = surveillance4 7b7 ,o!rwise lawful disclosures ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to limit or prohibit-- 7#a7 o!rwise lawful disclosures ( communications1 records1 or o!r in=mation1 includ+ report+ ( kn[n or suspect$ crim9al activity1 by a non-,f$]al entity to any o!r non-,f$]al entity or ! ,f$]al ,gov]nm5t2 or 7#b7 any o!rwise lawful use ( su* disclosures by any entity ( ! ,f$]al ,gov]nm5t1 )\t reg>d to :e!r su* o!rwise lawful disclosures duplicate or replicate disclosures made "u ?is title4 7c7 ,:i/le bl[] protections ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to prohibit or limit ! disclosure ( in=mation protect$ "u section #bcjb7;b77#h7 ( title #e1 ,unit$ ,/ates ,code 7gov]n+ disclosures ( illegality1 wa/e1 fraud1 abuse1 or public heal? or safety ?reats71 section #gbaa ( title #e1 ,unit$ ,/ates ,code 7gov]n+ disclosures to ,congress71 section #ajcd ( title #aj1 ,unit$ ,/ates ,code 7gov]n+ disclosure to ,congress by memb]s ( ! milit>y71 or any simil> provision ( ,f$]al or ,/ate law4 7d7 ,protection ( s\rces & me?ods ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$-- 7#a7 z creat+ any immunity aga9/1 or o!rwise affect+1 any action br\ght by ! ,f$]al ,gov]nm5t1 or any dep>tm5t or ag5cy !re(1 to en=ce any law1 ,executive ord]1 or proc$ure gov]n+ ! appropriate h&l+1 disclosure1 or use ( classifi$ in=mation2 7#b7 to affect ! conduct ( au?oriz$ law en=cem5t or intellig5ce activities2 or 7#c7 to modify ! au?ority ( ! ,presid5t or a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t to protect & control ! dissem9ation ( classifi$ in=mation1 intellig5ce s\rces & me?ods1 & ! national security ( ! ,unit$ ,/ates4 7e7 ,relation%ip to o!r laws ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to affect any requirem5t "u any o!r provision ( law = a non-,f$]al entity to provide in=mation to ! ,f$]al ,gov]nm5t4 7f7 ,in=mation %>+ relation%ips ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$-- 7#a7 to limit or modify an exi/+ in=mation-%>+ relation%ip2 7#b7 to prohibit a new in=mation-%>+ relation%ip2 or 7#c7 to require a new in=mation-%>+ relation%ip betwe5 any non-,f$]al entity & ! ,f$]al ,gov]nm5t4 7g7 ,pres]vation ( contractual obligations & rights ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$-- 7#a7 to am5d1 repeal1 or sup]s$e any curr5t or future contractual agreem5t1 t]ms ( s]vice agreem5t1 or o!r contractual relation%ip betwe5 any non-,f$]al entities1 or betwe5 any non-,f$]al entity & a ,f$]al entity2 or 7#b7 to abrogate trade secret or intellectual prop]ty rights ( any non-,f$]al entity or ,f$]al entity4 7h7 ,anti-,task+ re/riction ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to p]mit ! ,f$]al ,gov]nm5t-- 7#a7 to require a non-,f$]al entity to provide in=mation to ! ,f$]al ,gov]nm5t2 7#b7 to condition ! %>+ ( a cyb] ?reat indicator ) a non-,f$]al entity on su* non-,f$]al entity's provision ( a cyb] ?reat indicator to ! ,f$]al ,gov]nm5t2 or 7#c7 to condition ! aw>d ( any ,f$]al grant1 contract1 or pur*ase on ! provision ( a cyb] ?reat indicator to a ,f$]al entity4 7i7 ,no liability = non-,p>ticipation ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to subject any non-,f$]al entity to liability = *oos+ n to engage 9 a volunt>y activity au?oriz$ 9 ?is title & ! am5dm5ts made by ?is title4 7j7 ,use & ret5tion ( in=mation ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to au?orize1 or to modify any exi/+ au?ority (1 a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t to reta9 or use any in=mation %>$ "u ?is title or ! am5dm5ts made by ?is title = any use o!r ?an p]mitt$ 9 ?is title or ! am5dm5ts made by ?is title4 7k7 ,f$]al preemption 7#a7 ,9 g5]al ,?is title & ! am5dm5ts made by ?is title sup]s$e any /atute or o!r provision ( law ( a ,/ate or political subdivision ( a ,/ate t re/ricts or o!rwise expressly regulates an activity au?oriz$ "u ?is title or ! am5dm5ts made by ?is title4 7#b7 ,/ate law en=cem5t ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to sup]s$e any /atute or o!r provision ( law ( a ,/ate or political subdivision ( a ,/ate conc]n+ ! use ( au?oriz$ law en=cem5t practices & proc$ures4 7#c7 ,/ate regulation ( utilities ,except z provid$ by section #ajc7;d77#d77;,b71 no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$ to sup]s$e any /atute1 regulation1 or o!r provision ( law ( a ,/ate or political subdivision ( a ,/ate relat+ to ! regulation ( a private entity p]=m+ utility s]vices1 except to ! ext5t su* /atute1 regulation1 or o!r provision ( law re/ricts activity au?oriz$ "u ?is title or ! am5dm5ts made by ?is title4 7l7 ,regulatory au?ority ,no?+ 9 ?is title or ! am5dm5ts made by ?is title %all be con/ru$-- 7#a7 to au?orize ! promulgation ( any regulations n specifically au?oriz$ by ?is title or ! am5dm5ts made by ?is title2 7#b7 to e/abli% any regulatory au?ority n specifically e/abli%$ "u ?is title or ! am5dm5ts made by ?is title2 or 7#c7 to au?orize regulatory actions t w\ld duplicate or conflict ) regulatory requirem5ts1 m&atory /&>ds1 or relat$ processes "u ano!r provision ( ,f$]al law4 #aaj4 ,def9itions ,9 ?is title3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,appropriate ,f$]al entities ,! t]m appropriate ,f$]al entities means ! foll[+3 7,a7 ,! ,dep>tm5t ( ,comm]ce4 7,b7 ,! ,dep>tm5t ( ,def5se4 7,c7 ,! ,dep>tm5t ( ,en]gy4 7,d7 ,! ,dep>tm5t ( ,homel& ,security4 7,e7 ,! ,dep>tm5t ( ,ju/ice4 7,f7 ,! ,dep>tm5t ( ! ,treasury4 7,g7 ,! ,(fice ( ! ,director ( ,national ,intellig5ce4 7#c7 ,cyb]security purpose ,! t]m cyb]security purpose means ! purpose ( protect+ 7includ+ ?r\gh ! use ( a def5sive measure7 an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em f a cyb]security ?reat or security vuln]ability or id5tify+ ! s\rce ( a cyb]security ?reat4 7#d7 ,cyb]security ?reat 7,a7 ,9 g5]al ,except z provid$ 9 subp>agraph 7,b71 ! t]m cyb]security ?reat means an action1 n protect$ by ! fir/ am5dm5t to ! ,con/itution ( ! ,unit$ ,/ates1 on or ?r\gh an in=mation sy/em t may result 9 an unau?oriz$ ef=t to adv]sely impact ! security1 confid5tiality1 integrity1 or availability ( an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em4 7,b7 ,exclusion ,! t]m cyb]security ?reat does n include any action t solely involves a violation ( a consum] t]m ( s]vice or a consum] lic5s+ agreem5t4 7#e7 ,cyb] ?reat indicator ,! t]m cyb] ?reat indicator means in=mation or a physical object t is necess>y to describe or id5tify-- 7,a7 malici\s reconnaissance1 includ+ anomal\s patt]ns ( communications t appe> to be transmitt$ = ! purpose ( ga!r+ te*nical in=mation relat$ to a cyb]security ?reat or security vuln]ability2 7,b7 a me?od ( defeat+ a security control or exploitation ( a security vuln]ability2 7,c7 a security vuln]ability1 includ+ anomal\s activity t appe>s to indicate ! exi/5ce ( a security vuln]ability2 7,d7 a me?od ( caus+ a us] ) legitimate access to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em to unwitt+ly enable ! defeat ( a security control or exploitation ( a security vuln]ability2 7,e7 malici\s cyb] comm& & control2 7,f7 ! actual or pot5tial h>m caus$ by an incid5t1 includ+ a description ( ! in=mation exfiltrat$ z a result ( a p>ticul> cyb]security ?reat2 or 7,g7 any o!r attribute ( a cyb]security ?reat1 if disclosure ( su* attribute is n o!rwise prohibit$ by law4 7#f7 ,def5sive measure ,! t]m def5sive measure means an action1 device1 proc$ure1 te*nique1 or o!r measure execut$ on an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em t prev5ts or mitigates a kn[n or suspect$ cyb]security ?reat or security vuln]ability4 7#g7 ,f$]al entity ,! t]m ,f$]al entity means a dep>tm5t or ag5cy ( ! ,unit$ ,/ates or any compon5t ( su* dep>tm5t or ag5cy4 7#h7 ,in=mation sy/em ,! t]m in=mation sy/em-- 7,a7 has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 includes indu/rial control sy/ems1 su* z sup]visory control & data acquisition sy/ems1 di/ribut$ control sy/ems1 & programmable logic controll]s4 7#i7 ,local gov]nm5t ,! t]m local gov]nm5t means any bor\gh1 city1 c\nty1 p>i%1 t[n1 t[n%ip1 village1 or o!r political subdivision ( a ,/ate4 7#aj7 ,malici\s cyb] comm& & control ,! t]m malici\s cyb] comm& & control means a me?od = unau?oriz$ remote id5tification (1 access to1 or use (1 an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em4 7#aa7 ,malici\s reconnaissance ,! t]m malici\s reconnaissance means a me?od = actively prob+ or passively monitor+ an in=mation sy/em = ! purpose ( disc]n+ security vuln]abilities ( ! in=mation sy/em1 if su* me?od is associat$ ) a kn[n or suspect$ cyb]security ?reat4 7#ab7 ,monitor ,! t]m monitor means to acquire1 id5tify1 scan1 or o!rwise possess in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em4 7#ac7 ,non-,f$]al entity 7,a7 ,9 g5]al ,except z o!rwise provid$ 9 ?is p>agraph1 ! t]m non-,f$]al entity means any private entity1 non-,f$]al ,gov]nm5t dep>tm5t or ag5cy1 or ,/ate1 tribal1 or local gov]nm5t 7includ+ a political subdivision1 dep>tm5t1 (fic]1 employee1 or ag5t !re(74 7,b7 ,inclusions ,! t]m non-,f$]al entity includes a gov]nm5t dep>tm5t or ag5cy 7includ+ an (fic]1 employee1 or ag5t !re(7 ( ! ,di/rict ( ,columbia1 ! ,commonweal? ( ,pu]to ,rico1 ! ,virg9 ,isl&s1 ,guam1 ,am]ican ,samoa1 ! ,nor!rn ,m>iana ,isl&s1 & any o!r t]ritory or possession ( ! ,unit$ ,/ates4 7,c7 ,exclusion ,! t]m non-,f$]al entity does n include a =eign p[] or kn[n ag5t ( a =eign p[]1 z bo? t]ms are def9$ 9 section #aja ( ! ,=eign ,intellig5ce ,surveillance ,act ( #aigh 7#ej ,u4,s4,c4 #ahja74 7#ad7 ,private entity 7,a7 ,9 g5]al ,except z o!rwise provid$ 9 ?is p>agraph1 ! t]m private entity means any p]son or private gr\p1 organization1 proprietor%ip1 p>tn]%ip1 tru/1 coop]ative1 corporation1 or o!r comm]cial or nonpr(it entity1 includ+ an (fic]1 employee1 or ag5t !re(4 7,b7 ,inclusion ,! t]m private entity includes a compon5t ( a ,/ate1 tribal1 or local gov]nm5t p]=m+ utility s]vices4 7,c7 ,exclusion ,! t]m private entity does n include a =eign p[] z def9$ 9 section #aja ( ! ,=eign ,intellig5ce ,surveillance ,act ( #aigh 7#ej ,u4,s4,c4 #ahja74 7#ae7 ,real "t2 real-"t ,! t]ms real "t & real-"t mean a process by :i* an automat$1 ma*9e-to-ma*9e sy/em processes cyb] ?reat indicators su* t ! "t 9 :i* ! occurr5ce ( an ev5t & ! report+ or record+ ( x are z simultane\s z te*nologically & op]ationally practicable4 7#af7 ,security control ,! t]m security control means ! managem5t1 op]ational1 & te*nical controls us$ to protect aga9/ an unau?oriz$ ef=t to adv]sely impact ! security1 confid5tiality1 integrity1 & availability ( an in=mation sy/em or its in=mation4 7#ag7 ,security vuln]ability ,! t]m security vuln]ability means any attribute ( h>dw>e1 s(tw>e1 process1 or proc$ure t c\ld enable or facilitate ! defeat ( a security control4 7#ah7 ,tribal ,! t]m tribal has ! mean+ giv5 ! t]m ,indian tribe 9 section #d ( ! ,indian ,self-,det]m9ation & ,education ,assi/ance ,act 7#be ,u4,s4,c4 #dej;b74 #aaa4 ,comptroll] ,g5]al report on removal ( p]sonal id5tify+ in=mation 7a7 ,report ,n lat] ?an #c ye>s aft] ! date ( ! enactm5t ( ?is title1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ,congress a report on ! actions tak5 by ! ,f$]al ,gov]nm5t to remove p]sonal in=mation f cyb] ?reat indicators pursuant to section #ajd7;b74 7b7 ,=m ,! report "u subsection 7a7 %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 #aab4 ,sunset ,?is title & ! am5dm5ts made by ?is title %all t]m9ate on ! date t is #g ye>s aft] ! date ( ! enactm5t ( ?is title4 ,,ii ,national ,cyb]security ,protection ,advancem5t ,act #bja4 ,%ort title ,?is title may be cit$ z ! ,national ,cyb]security ,protection ,advancem5t ,act ( #bjae4 #bjb4 ,national ,cyb]security & ,communications ,integration ,c5t] 7a7 ,9 ,g5]al ,subsection 7a7 ( ! second section #bbf ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #adh2 relat+ to ! ,national ,cyb]security & ,communications ,integration ,c5t]7 is am5d$-- 7#a7 by am5d+ p>agraph 7#a7 to read z foll[s3 7#a7 7,a7 except z provid$ 9 subp>agraph 7,b71 ! t]m cyb]security risk means ?reats to & vuln]abilities ( in=mation or in=mation sy/ems & any relat$ consequ5ces caus$ by or result+ f unau?oriz$ access1 use1 disclosure1 degradation1 disruption1 modification1 or de/ruction ( su* in=mation or in=mation sy/ems1 includ+ su* relat$ consequ5ces caus$ by an act ( t]rorism2 7,b7 su* t]m does n include any action t solely involves a violation ( a consum] t]m ( s]vice or a consum] lic5s+ agreem5t2 4 7#b7 by am5d+ p>agraph 7#b7 to read z foll[s3 7#b7 ! t]m incid5t means an occurr5ce t actually or imm95tly jeop>dizes1 )\t lawful au?ority1 ! integrity1 confid5tiality1 or availability ( in=mation on an in=mation sy/em1 or actually or imm95tly jeop>dizes1 )\t lawful au?ority1 an in=mation sy/em2 4 7#c7 9 p>agraph 7#c71 by /rik+ & at ! end2 7#d7 9 p>agraph 7#d71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#e7 by add+ at ! end ! foll[+ new p>agraphs3 7#e7 ! t]m cyb] ?reat indicator means te*nical in=mation t is necess>y to describe or id5tify-- 7,a7 a me?od = prob+1 monitor+1 ma9ta9+1 or e/abli%+ network aw>5ess ( an in=mation sy/em = ! purpose ( disc]n+ te*nical vuln]abilities ( su* in=mation sy/em1 if su* me?od is kn[n or reasonably suspect$ ( be+ associat$ ) a kn[n or suspect$ cyb]security risk1 includ+ communications t reasonably appe> to be transmitt$ = ! purpose ( ga!r+ te*nical in=mation relat$ to a cyb]security risk2 7,b7 a me?od = defeat+ a te*nical or security control ( an in=mation sy/em2 7,c7 a te*nical vuln]ability1 includ+ anomal\s te*nical behavior t may become a vuln]ability2 7,d7 a me?od ( caus+ a us] ) legitimate access to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em to inadv]t5tly enable ! defeat ( a te*nical or op]ational control2 7,e7 a me?od = unau?oriz$ remote id5tification (1 access to1 or use ( an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em t is kn[n or reasonably suspect$ ( be+ associat$ ) a kn[n or suspect$ cyb]security risk2 7,f7 ! actual or pot5tial h>m caus$ by a cyb]security risk1 includ+ a description ( ! in=mation exfiltrat$ z a result ( a p>ticul> cyb]security risk2 7,g7 any o!r attribute ( a cyb]security risk t _c be us$ to id5tify specific p]sons reasonably believ$ to be unrelat$ to su* cyb]security risk1 if disclosure ( su* attribute is n o!rwise prohibit$ by law2 or 7,h7 any comb9ation ( subp>agraphs 7,a7 ?r\gh 7,g72 7#f7 ! t]m cyb]security purpose means ! purpose ( protect+ an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em f a cyb]security risk or incid5t1 or ! purpose ( id5tify+ ! s\rce ( a cyb]security risk or incid5t2 7#g7 7,a7 except z provid$ 9 subp>agraph 7,b71 ! t]m def5sive measure means an action1 device1 proc$ure1 signature1 te*nique1 or o!r measure appli$ to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em t detects1 prev5ts1 or mitigates a kn[n or suspect$ cyb]security risk or incid5t1 or any attribute ( h>dw>e1 s(tw>e1 process1 or proc$ure t c\ld enable or facilitate ! defeat ( a security control2 7,b7 su* t]m does n include a measure t de/roys1 r5d]s unusable1 or sub/antially h>ms an in=mation sy/em or data on an in=mation sy/em n belong+ to-- 7i7 ! non-,f$]al entity1 n includ+ a ,/ate1 local1 or tribal gov]nm5t1 op]at+ su* measure2 or 7ii7 ano!r ,f$]al entity or non-,f$]al entity t is au?oriz$ to provide cons5t & has provid$ su* cons5t to ! non-,f$]al entity ref]r$ to 9 clause 7i72 7#h7 ! t]m network aw>5ess means to scan1 id5tify1 acquire1 monitor1 log1 or analyze in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em2 7#i7 7,a7 ! t]m private entity means a non-,f$]al entity t is an individual or private gr\p1 organization1 proprietor%ip1 p>tn]%ip1 tru/1 coop]ative1 corporation1 or o!r comm]cial or non-pr(it entity1 includ+ an (fic]1 employee1 or ag5t !re(2 7,b7 su* t]m includes a compon5t ( a ,/ate1 local1 or tribal gov]nm5t p]=m+ utility s]vices or an entity p]=m+ utility s]vices2 7#aj7 ! t]m security control means ! managem5t1 op]ational1 & te*nical controls us$ to protect aga9/ an unau?oriz$ ef=t to adv]sely affect ! confid5tially1 integrity1 or availability ( an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em2 & 7#aa7 ! t]m %>+ 7includ+ all conjugations !re(7 means provid+1 receiv+1 & dissem9at+ 7includ+ all conjugations ( ea* ( su* t]ms74 4 7b7 ,am5dm5t ,subp>agraph 7,b7 ( subsection 7d77#a7 ( su* second section #bbf ( ! ,homel& ,security ,act ( #bjjb is am5d$-- 7#a7 9 clause 7i71 by /rik+ & local & ins]t+ 1 local1 & tribal2 7#b7 9 clause 7ii7-- 7,a7 by ins]t+ 1 includ+ in=mation %>+ & analysis c5t]s be=e ! semicolon2 & 7,b7 by /rik+ & at ! end2 7#c7 9 clause 7iii71 by ins]t+ & aft] ! semicolon at ! end2 & 7#d7 by add+ at ! end ! foll[+ new clause3 7iv7 private entities2 4 #bjc4 ,in=mation %>+ /ructure & processes ,! second section #bbf ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #adh2 relat+ to ! ,national ,cyb]security & ,communications ,integration ,c5t]7 is am5d$-- 7#a7 9 subsection 7c7-- 7,a7 9 p>agraph 7#a7-- 7i7 by /rik+ a ,f$]al civilian int]face & ins]t+ ! lead ,f$]al civilian int]face2 & 7ii7 by /rik+ cyb]security risks1 & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 7,b7 9 p>agraph 7#c71 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 7,c7 9 p>agraph 7#e77;,a71 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 7,d7 9 p>agraph 7#f7-- 7i7 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 & 7ii7 by /rik+ & at ! end2 7,e7 9 p>agraph 7#g7-- 7i7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,b71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+ new subp>agraph3 7,c7 %>+ cyb] ?reat indicators & def5sive measures2 2 & 7,f7 by add+ at ! end ! foll[+ new p>agraphs3 7#h7 engag+ ) int]national p>tn]s1 9 consultation ) o!r appropriate ag5cies1 to-- 7,a7 collaborate on cyb] ?reat indicators1 def5sive measures1 & in=mation relat$ to cyb]security risks & incid5ts2 & 7,b7 enhance ! security & resili5ce ( global cyb]security2 7#i7 %>+ cyb] ?reat indicators1 def5sive measures1 & o!r in=mation relat$ to cyb]security risks & incid5ts ) ,f$]al & non-,f$]al entities1 includ+ across sectors ( critical infra/ructure & ) ,/ate & major urban area fusion c5t]s1 z appropriate2 7#aj7 promptly notify+ ! ,secret>y & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate ( any significant violations ( ! policies & proc$ures specifi$ 9 subsection 7i77#f77;,a72 7#aa7 promptly notify+ non-,f$]al entities t h %>$ cyb] ?reat indicators or def5sive measures t are kn[n or det]m9$ to be 9 error or 9 contrav5tion ( ! requirem5ts ( ?is section2 & 7#ab7 p>ticipat+1 z appropriate1 9 ex]cises run by ! ,dep>tm5t's ,national ,ex]cise ,program4 2 7#b7 9 subsection 7d77#a7-- 7,a7 9 subp>agraph 7,d71 by /rik+ & at ! end2 7,b7 by r$esignat+ subp>agraph 7,e7 z subp>agraph 7,j72 & 7,c7 by ins]t+ aft] subp>agraph 7,d7 ! foll[+ new subp>agraphs3 7,e7 an entity t collaborates ) ,/ate & local gov]nm5ts on cyb]security risks & incid5ts1 & has ent]$ into a volunt>y in=mation %>+ relation%ip ) ! ,c5t]2 7,f7 a ,unit$ ,/ates ,comput] ,em]g5cy ,read9ess ,team t coord9ates in=mation relat$ to cyb]security risks & incid5ts1 proactively & collaboratively addresses cyb]security risks & incid5ts to ! ,unit$ ,/ates1 collaboratively responds to cyb]security risks & incid5ts1 provides te*nical assi/ance1 ^u reque/1 to in=mation sy/em own]s & op]ators1 & %>es cyb] ?reat indicators1 def5sive measures1 analysis1 or in=mation relat$ to cyb]security risks & incid5ts 9 a timely mann]2 7,g7 ! ,indu/rial ,control ,sy/em ,cyb] ,em]g5cy ,response ,team t-- 7i7 coord9ates ) indu/rial control sy/ems own]s & op]ators2 7ii7 provides tra9+1 ^u reque/1 to ,f$]al entities & non-,f$]al entities on indu/rial control sy/ems cyb]security2 7iii7 collaboratively addresses cyb]security risks & incid5ts to indu/rial control sy/ems2 7iv7 provides te*nical assi/ance1 ^u reque/1 to ,f$]al entities & non-,f$]al entities relat+ to indu/rial control sy/ems cyb]security2 7v7 %>es cyb] ?reat indicators1 def5sive measures1 or in=mation relat$ to cyb]security risks & incid5ts ( indu/rial control sy/ems 9 a timely fa%ion2 & 7vi7 rema9s curr5t on indu/rial control sy/em innovation2 indu/ry adoption ( new te*nologies1 & indu/ry be/ practices2 7,h7 a ,national ,coord9at+ ,c5t] = ,communications t coord9ates ! protection1 response1 & recov]y ( em]g5cy communications2 7,i7 an entity t coord9ates ) small & m$ium-siz$ bus9esses2 & 2 7#c7 9 subsection 7e7-- 7,a7 9 p>agraph 7#a7-- 7i7 9 subp>agraph 7,a71 by ins]t+ cyb] ?reat indicators1 def5sive measures1 & be=e in=mation2 7ii7 9 subp>agraph 7,b71 by ins]t+ cyb] ?reat indicators1 def5sive measures1 & be=e in=mation ! fir/ place x appe>s2 7iii7 9 subp>agraph 7,f71 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 7iv7 9 subp>agraph 7,f71 by /rik+ & at ! end2 7v7 9 subp>agraph 7,g71 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 & 7vi7 by add+ at ! end ! foll[+3 7,h7 ! ,c5t] ensures t x %>es in=mation relat+ to cyb]security risks & incid5ts ) small & m$ium-siz$ bus9esses1 z appropriate1 &1 to ! ext5t practicable1 make self-assessm5t tools available to su* bus9esses to det]m9e _! levels ( prev5tion ( cyb]security risks2 & 7,i7 ! ,c5t] designates an ag5cy contact = non-,f$]al entities2 2 7,b7 9 p>agraph 7#b7-- 7i7 by /rik+ cyb]security risks & ins]t+ cyb] ?reat indicators1 def5sive measures1 cyb]security risks12 & 7ii7 by ins]t+ or disclosure be=e ! semicolon at ! end2 & 7,c7 9 p>agraph 7#c71 by ins]t+ be=e ! p]iod at ! end ! foll[+3 1 includ+ by work+ ) ! ,*ief ,privacy ,(fic] appo9t$ "u section #bbb to ensure t ! ,c5t] foll[s ! policies & proc$ures specifi$ 9 subsection 7i77#f77;,a72 & 7#d7 by add+ at ! end ! foll[+ new subsections3 7g7 ,rapid automat$ %>+ 7#a7 ,9 g5]al ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 9 coord9ation ) indu/ry & o!r /akehold]s1 %all develop capabilities mak+ use ( exi/+ in=mation te*nology indu/ry /&>ds & be/ practices1 z appropriate1 t support & rapidly advance ! developm5t1 adoption1 & implem5tation ( automat$ me*anisms = ! timely %>+ ( cyb] ?reat indicators & def5sive measures to & f ! ,c5t] & ) ea* ,f$]al ag5cy designat$ z ! ,sector ,specific ,ag5cy = ea* critical infra/ructure sector 9 accordance ) subsection 7h74 7#b7 ,biannual report ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a biannual report on ! /atus & progress ( ! developm5t ( ! capability describ$ 9 p>agraph 7#a74 ,su* reports %all be requir$ until su* capability is fully implem5t$4 7h7 ,sector ,specific ,ag5cies ,! ,secret>y1 9 collaboration ) ! relevant critical infra/ructure sector & ! heads ( o!r appropriate ,f$]al ag5cies1 %all recognize ! ,f$]al ag5cy designat$ z ( ,m>* #be1 #bjae1 z ! ,sector ,specific ,ag5cy = ea* critical infra/ructure sector designat$ 9 ! ,dep>tm5t's ,national ,infra/ructure ,protection ,plan4 ,if ! designat$ ,sector ,specific ,ag5cy = a p>ticul> critical infra/ructure sector is ! ,dep>tm5t1 = purposes ( ?is section1 ! ,secret>y is deem$ to be ! head ( su* ,sector ,specific ,ag5cy & %all c>ry out ?is section4 ,! ,secret>y1 9 coord9ation ) ! heads ( ea* su* ,sector ,specific ,ag5cy1 %all-- 7#a7 support ! security & resili5ce actives ( ! relevant critical infra/ructure sector 9 accordance ) ?is section2 7#b7 provide in/itutional k1 specializ$ exp]tise1 & te*nical assi/ance ^u reque/ to ! relevant critical infra/ructure sector2 & 7#c7 support ! timely %>+ ( cyb] ?reat indicators & def5sive measures ) ! relevant critical infra/ructure sector ) ! ,c5t] 9 accordance ) ?is section4 7i7 ,volunt>y in=mation %>+ proc$ures 7#a7 ,proc$ures 7,a7 ,9 g5]al ,! ,c5t] may ent] into a volunt>y in=mation %>+ relation%ip ) any cons5t+ non-,f$]al entity = ! %>+ ( cyb] ?reat indicators & def5sive measures = cyb]security purposes 9 accordance ) ?is section4 ,no?+ 9 ?is section may be con/ru$ to require any non-,f$]al entity to ent] into any su* in=mation %>+ relation%ip ) ! ,c5t] or any o!r entity4 ,! ,c5t] may t]m9ate a volunt>y in=mation %>+ relation%ip "u ?is subsection1 at ! sole & unreviewable discretion ( ! ,secret>y1 act+ ?r\gh ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 if ! ,c5t] det]m9es t ! non-,f$]al entity ) :i* ! ,c5t] has ent]$ into su* a relation%ip has1 aft] repeat$ notice1 repeat$ly violat$ ! t]ms ( ?is subsection4 7,b7 ,national security ,! ,secret>y may decl9e to ent] into a volunt>y in=mation %>+ relation%ip "u ?is subsection1 at ! sole & unreviewable discretion ( ! ,secret>y1 act+ ?r\gh ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 if ! ,secret>y det]m9es t su* is appropriate = national security4 7#b7 ,volunt>y in=mation %>+ relation%ips ,a volunt>y in=mation %>+ relation%ip "u ?is subsection may be *>act]iz$ z an agreem5t describ$ 9 ?is p>agraph4 7,a7 ,/&>d agreem5t ,= ! use ( a non-,f$]al entity1 ! ,c5t] %all make available a /&>d agreem5t1 consi/5t ) ?is section1 on ! ,dep>tm5t's website4 7,b7 ,negotiat$ agreem5t ,at ! reque/ ( a non-,f$]al entity1 & if det]m9$ appropriate by ! ,c5t]1 at ! sole & unreviewable discretion ( ! ,secret>y1 act+ ?r\gh ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 ! ,dep>tm5t %all negotiate a non-/&>d agreem5t1 consi/5t ) ?is section4 7,c7 ,exi/+ agreem5ts ,an agreem5t betwe5 ! ,c5t] & a non-,f$]al entity t is ent]$ into be=e ! date ( ! enactm5t ( ?is section1 or su* an agreem5t t is 9 effect be=e su* date1 %all be deem$ 9 compliance ) ! requirem5ts ( ?is subsection1 not)/&+ any o!r provision or requirem5t ( ?is subsection4 ,an agreem5t "u ?is subsection %all include ! relevant privacy protections z 9 effect "u ! ,coop]ative ,rese>* & ,developm5t ,agreem5t = ,cyb]security ,in=mation ,%>+ & ,collaboration1 z ( ,decemb] #ca1 #bjad4 ,no?+ 9 ?is subsection may be con/ru$ to require a non-,f$]al entity to ent] into ei!r a /&>d or negotiat$ agreem5t to be 9 compliance ) ?is subsection4 7#c7 ,in=mation %>+ au?orization 7,a7 ,9 g5]al ,except z provid$ 9 subp>agraph 7,b71 & not)/&+ any o!r provision ( law1 a non-,f$]al entity may1 = cyb]security purposes1 %>e cyb] ?reat indicators or def5sive measures obta9$ on its own in=mation sy/em1 or on an in=mation sy/em ( ano!r ,f$]al entity or non-,f$]al entity1 ^u writt5 cons5t ( su* o!r ,f$]al entity or non-,f$]al entity or an au?oriz$ repres5tative ( su* o!r ,f$]al entity or non-,f$]al entity 9 accordance ) ?is section )-- 7i7 ano!r non-,f$]al entity2 or 7ii7 ! ,c5t]1 z provid$ 9 ?is section4 7,b7 ,lawful re/riction ,a non-,f$]al entity receiv+ a cyb] ?reat indicator or def5sive measure f ano!r ,f$]al entity or non-,f$]al entity %all comply ) o!rwise lawful re/rictions plac$ on ! %>+ or use ( su* cyb] ?reat indicator or def5sive measure by ! %>+ ,f$]al entity or non-,f$]al entity4 7,c7 ,removal ( in=mation unrelat$ to cyb]security risks or incid5ts ,f$]al entities & non-,f$]al entities %all1 prior to su* %>+1 take reasonable ef=ts to remove or exclude in=mation t c be us$ to id5tify specific p]sons & is reasonably believ$ at ! "t ( %>+ to be unrelat$ to a cyb]security risk or incid5t & to safegu>d in=mation t c be us$ to id5tify specific p]sons f un9t5d$ disclosure or unau?oriz$ access or acquisition4 7,d7 ,rule ( con/ruction ,no?+ 9 ?is p>agraph may be con/ru$ to-- 7i7 limit or modify an exi/+ in=mation %>+ relation%ip2 7ii7 prohibit a new in=mation %>+ relation%ip2 7iii7 require a new in=mation %>+ relation%ip betwe5 any non-,f$]al entity & a ,f$]al entity2 7iv7 limit o!rwise lawful activity2 or 7v7 9 any mann] impact or modify proc$ures 9 exi/5ce z ( ! date ( ! enactm5t ( ?is section = report+ kn[n or suspect$ crim9al activity to appropriate law en=cem5t au?orities or = p>ticipat+ volunt>ily or "u legal requirem5t 9 an inve/igation4 7,e7 ,coord9at$ vuln]ability disclosure ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 9 coord9ation ) indu/ry & o!r /akehold]s1 %all develop1 publi%1 & adh]e to policies & proc$ures = coord9at+ vuln]ability disclosures1 to ! ext5t practicable1 consi/5t ) int]national /&>ds 9 ! in=mation te*nology indu/ry4 7#d7 ,network aw>5ess au?orization 7,a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 a non-,f$]al entity1 n includ+ a ,/ate1 local1 or tribal gov]nm5t1 may1 = cyb]security purposes1 conduct network aw>5ess (-- 7i7 an in=mation sy/em ( su* non-,f$]al entity to protect ! rights or prop]ty ( su* non-,f$]al entity2 7ii7 an in=mation sy/em ( ano!r non-,f$]al entity1 ^u writt5 cons5t ( su* o!r non-,f$]al entity = conduct+ su* network aw>5ess to protect ! rights or prop]ty ( su* o!r non-,f$]al entity2 7iii7 an in=mation sy/em ( a ,f$]al entity1 ^u writt5 cons5t ( an au?oriz$ repres5tative ( su* ,f$]al entity = conduct+ su* network aw>5ess to protect ! rights or prop]ty ( su* ,f$]al entity2 or 7iv7 in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em describ$ 9 ?is subp>agraph4 7,b7 ,rule ( con/ruction ,no?+ 9 ?is p>agraph may be con/ru$ to-- 7i7 au?orize conduct+ network aw>5ess ( an in=mation sy/em1 or ! use ( any in=mation obta9$ ?r\gh su* conduct+ ( network aw>5ess1 o!r ?an z provid$ 9 ?is section2 or 7ii7 limit o!rwise lawful activity4 7#e7 ,def5sive measure au?orization 7,a7 ,9 g5]al ,except z provid$ 9 subp>agraph 7,b7 & not)/&+ any o!r provision ( law1 a non-,f$]al entity1 n includ+ a ,/ate1 local1 or tribal gov]nm5t1 may1 = cyb]security purposes1 op]ate a def5sive measure t is appli$ to-- 7i7 an in=mation sy/em ( su* non-,f$]al entity to protect ! rights or prop]ty ( su* non-,f$]al entity2 7ii7 an in=mation sy/em ( ano!r non-,f$]al entity ^u writt5 cons5t ( su* o!r non-,f$]al entity = op]ation ( su* def5sive measure to protect ! rights or prop]ty ( su* o!r non-,f$]al entity2 7iii7 an in=mation sy/em ( a ,f$]al entity ^u writt5 cons5t ( an au?oriz$ repres5tative ( su* ,f$]al entity = op]ation ( su* def5sive measure to protect ! rights or prop]ty ( su* ,f$]al entity2 or 7iv7 in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em describ$ 9 ?is subp>agraph4 7,b7 ,rule ( con/ruction ,no?+ 9 ?is p>agraph may be con/ru$ to-- 7i7 au?orize ! use ( a def5sive measure o!r ?an z provid$ 9 ?is section2 or 7ii7 limit o!rwise lawful activity4 7#f7 ,privacy & civil lib]ties protections 7,a7 ,policies & proc$ures 7i7 ,9 g5]al ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all1 9 coord9ation ) ! ,*ief ,privacy ,(fic] & ! ,*ief ,civil ,rights & ,civil ,lib]ties ,(fic] ( ! ,dep>tm5t1 e/abli% & annually review policies & proc$ures gov]n+ ! receipt1 ret5tion1 use1 & disclosure ( cyb] ?reat indicators1 def5sive measures1 & in=mation relat$ to cyb]security risks & incid5ts %>$ ) ! ,c5t] 9 accordance ) ?is section4 ,su* policies & proc$ures %all apply only to ! ,dep>tm5t1 consi/5t ) ! ne$ to protect in=mation sy/ems f cyb]security risks & incid5ts & mitigate cyb]security risks & incid5ts 9 a timely mann]1 & %all-- 7,i7 be consi/5t ) ! ,dep>tm5t's ,fair ,in=mation ,practice ,pr9ciples develop$ pursuant to section #eeb;a ( title #e1 ,unit$ ,/ates ,code 7commonly ref]r$ to z ! ,privacy ,act ( #aigd or ! ,privacy ,act71 & subject to ! ,secret>y's au?ority "u subsection 7a77#b7 ( section #bbb ( ?is ,act2 7,,ii7 reasonably limit1 to ! greate/ ext5t practicable1 ! receipt1 ret5tion1 use1 & disclosure ( cyb] ?reat indicators & def5sive measures associat$ ) specific p]sons t is n necess>y1 = cyb]security purposes1 to protect a network or in=mation sy/em f cyb]security risks or mitigate cyb]security risks & incid5ts 9 a timely mann]2 7,,iii7 m9imize any impact on privacy & civil lib]ties2 7,,iv7 provide data integrity ?r\gh ! prompt removal & de/ruction ( obsolete or errone\s names & p]sonal in=mation t is unrelat$ to ! cyb]security risk or incid5t in=mation %>$ & reta9$ by ! ,c5t] 9 accordance ) ?is section2 7,v7 include requirem5ts to safegu>d cyb] ?reat indicators & def5sive measures reta9$ by ! ,c5t]1 includ+ in=mation t is propriet>y or bus9ess-s5sitive1 or t may be us$ to id5tify specific p]sons f unau?oriz$ access or acquisition2 7,,vi7 protect ! confid5tiality ( cyb] ?reat indicators & def5sive measures associat$ ) specific p]sons to ! greate/ ext5t practicable2 & 7,,vii7 ensure all relevant con/itutional1 legal1 & privacy protections are obs]v$4 7ii7 ,submission to ,congress ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is section & annually !reaft]1 ! ,*ief ,privacy ,(fic] & ! ,(fic] = ,civil ,rights & ,civil ,lib]ties ( ! ,dep>tm5t1 9 consultation ) ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d 7e/abli%$ pursuant to section #ajfa ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee771 %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate ! policies & proc$ures gov]n+ ! %>+ ( cyb] ?reat indicators1 def5sive measures1 & in=mation relat$ to cyb]security risks & incid5ts describ$ 9 clause 7i7 ( subp>agraph 7,a74 7iii7 ,public notice & access ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 9 consultation ) ! ,*ief ,privacy ,(fic] & ! ,*ief ,civil ,rights & ,civil ,lib]ties ,(fic] ( ! ,dep>tm5t1 & ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d 7e/abli%$ pursuant to section #ajfa ( ! ,intellig5ce ,re=m & ,t]rorism ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee771 %all ensure !re is public notice (1 & access to1 ! policies & proc$ures gov]n+ ! %>+ ( cyb] ?reat indicators1 def5sive measures1 & in=mation relat$ to cyb]security risks & incid5ts4 7iv7 ,consultation ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection :5 e/abli%+ policies & proc$ures to support privacy & civil lib]ties may consult ) ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7,b7 ,implem5tation ,! ,*ief ,privacy ,(fic] ( ! ,dep>tm5t1 on an ongo+ basis1 %all-- 7i7 monitor ! implem5tation ( ! policies & proc$ures gov]n+ ! %>+ ( cyb] ?reat indicators & def5sive measures e/abli%$ pursuant to clause 7i7 ( subp>agraph 7,a72 7ii7 regul>ly review & update privacy impact assessm5ts1 z appropriate1 to ensure all relevant con/itutional1 legal1 & privacy protections are be+ foll[$2 7iii7 "w ) ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection to c>ry out p>agraphs 7#aj7 & 7#aa7 ( subsection 7c72 7iv7 annually submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report t conta9s a review ( ! effectiv5ess ( su* policies & proc$ures to protect privacy & civil lib]ties2 & 7v7 ensure !re are appropriate sanctions 9 place = (fic]s1 employees1 or ag5ts ( ! ,dep>tm5t :o int5tionally or willfully conduct activities "u ?is section 9 an unau?oriz$ mann]4 7,c7 ,inspector ,g5]al report ,! ,inspector ,g5]al ( ! ,dep>tm5t1 9 consultation ) ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d & ! ,inspector ,g5]al ( ea* ,f$]al ag5cy t receives cyb] ?reat indicators or def5sive measures %>$ ) ! ,c5t] "u ?is section1 %all1 n lat] ?an two ye>s aft] ! date ( ! enactm5t ( ?is subsection & p]iodically !reaft] submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report conta9+ a review ( ! use ( cyb]security risk in=mation %>$ ) ! ,c5t]1 includ+ ! foll[+3 7i7 ,a report on ! receipt1 use1 & dissem9ation ( cyb] ?reat indicators & def5sive measures t h be5 %>$ ) ,f$]al entities "u ?is section4 7ii7 ,in=mation on ! use by ! ,c5t] ( su* in=mation = a purpose o!r ?an a cyb]security purpose4 7iii7 ,a review ( ! type ( in=mation %>$ ) ! ,c5t] "u ?is section4 7iv7 ,a review ( ! actions tak5 by ! ,c5t] bas$ on su* in=mation4 7v7 ,! appropriate metrics t exi/ to det]m9e ! impact1 if any1 on privacy & civil lib]ties z a result ( ! %>+ ( su* in=mation ) ! ,c5t]4 7vi7 ,a li/ ( o!r ,f$]al ag5cies receiv+ su* in=mation4 7vii7 ,a review ( ! %>+ ( su* in=mation )9 ! ,f$]al ,gov]nm5t to id5tify inappropriate /ove pip+ ( su* in=mation4 7viii7 ,any recomm5dations ( ! ,inspector ,g5]al ( ! ,dep>tm5t = improvem5ts or modifications to in=mation %>+ "u ?is section4 7,d7 ,privacy & ,civil ,lib]ties ,(fic]s report ,! ,*ief ,privacy ,(fic] & ! ,*ief ,civil ,rights & ,civil ,lib]ties ,(fic] ( ! ,dep>tm5t1 9 consultation ) ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d1 ! ,inspector ,g5]al ( ! ,dep>tm5t1 & ! s5ior privacy & civil lib]ties (fic] ( ea* ,f$]al ag5cy t receives cyb] ?reat indicators & def5sive measures %>$ ) ! ,c5t] "u ?is section1 %all bi5nially submit to ! appropriate congressional committees a report assess+ ! privacy & civil lib]ties impact ( ! activities "u ?is p>agraph4 ,ea* su* report %all include any recomm5dations ! ,*ief ,privacy ,(fic] & ! ,*ief ,civil ,rights & ,civil ,lib]ties ,(fic] ( ! ,dep>tm5t consid] appropriate to m9imize or mitigate ! privacy & civil lib]ties impact ( ! %>+ ( cyb] ?reat indicators & def5sive measures "u ?is section4 7,e7 ,=m ,ea* report requir$ "u subp>agraphs 7,c7 & 7,d7 %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7#g7 ,uses & protection ( in=mation 7,a7 ,non-,f$]al entities ,a non-,f$]al entity1 n includ+ a ,/ate1 local1 or tribal gov]nm5t1 t %>es cyb] ?reat indicators or def5sive measures ?r\gh ! ,c5t] or o!rwise "u ?is section-- 7i7 may use1 reta91 or fur!r disclose su* cyb] ?reat indicators or def5sive measures solely = cyb]security purposes2 7ii7 %all1 prior to su* %>+1 take reasonable ef=ts to remove or exclude in=mation t c be us$ to id5tify specific p]sons & is reasonably believ$ at ! "t ( %>+ to be unrelat$ to a cyb]security risk or incid5t1 & to safegu>d in=mation t c be us$ to id5tify specific p]sons f un9t5d$ disclosure or unau?oriz$ access or acquisition2 7iii7 %all comply ) appropriate re/rictions t a ,f$]al entity or non-,f$]al entity places on ! subsequ5t disclosure or ret5tion ( cyb] ?reat indicators & def5sive measures t x discloses to o!r ,f$]al entities or non-,f$]al entities2 7iv7 %all be deem$ to h volunt>ily %>$ su* cyb] ?reat indicators or def5sive measures2 7v7 %all implem5t & utilize a security control to protect aga9/ unau?oriz$ access to or acquisition ( su* cyb] ?reat indicators or def5sive measures2 & 7vi7 may n use su* in=mation to ga9 an unfair competitive advantage to ! detrim5t ( any non-,f$]al entity4 7,b7 ,f$]al entities 7i7 ,uses ( in=mation ,a ,f$]al entity t receives cyb] ?reat indicators or def5sive measures %>$ ?r\gh ! ,c5t] or o!rwise "u ?is section f ano!r ,f$]al entity or a non-,f$]al entity-- 7,i7 may use1 reta91 or fur!r disclose su* cyb] ?reat indicators or def5sive measures solely = cyb]security purposes2 7,,ii7 %all1 prior to su* %>+1 take reasonable ef=ts to remove or exclude in=mation t c be us$ to id5tify specific p]sons & is reasonably believ$ at ! "t ( %>+ to be unrelat$ to a cyb]security risk or incid5t1 & to safegu>d in=mation t c be us$ to id5tify specific p]sons f un9t5d$ disclosure or unau?oriz$ access or acquisition2 7,,iii7 %all be deem$ to h volunt>ily %>$ su* cyb] ?reat indicators or def5sive measures2 7,,iv7 %all implem5t & utilize a security control to protect aga9/ unau?oriz$ access to or acquisition ( su* cyb] ?reat indicators or def5sive measures2 & 7,v7 may n use su* cyb] ?reat indicators or def5sive measures to engage 9 surveillance or o!r collection activities = ! purpose ( track+ an individual's p]sonally id5tifiable in=mation1 except = purposes au?oriz$ 9 ?is section4 7ii7 ,protections = in=mation ,! cyb] ?reat indicators & def5sive measures ref]r$ to 9 clause 7i7-- 7,i7 are exempt f disclosure "u section #eeb ( title #e1 ,unit$ ,/ates ,code1 & )held1 )\t discretion1 f ! public "u subsection 7b77#c77;,b7 ( su* section2 7,,ii7 may n be us$ by ! ,f$]al ,gov]nm5t = regulatory purposes2 7,,iii7 may n con/itute a waiv] ( any applicable privilege or protection provid$ by law1 includ+ trade secret protection2 7,,iv7 %all be consid]$ ! comm]cial1 f9ancial1 & propriet>y in=mation ( ! non-,f$]al entity ref]r$ to 9 clause 7i7 :5 s designat$ by su* non-,f$]al entity2 & 7,v7 may n be subject to a rule ( any ,f$]al entity or any judicial doctr9e reg>d+ ex p>te communications ) a decisionmak+ (ficial4 7,c7 ,/ate1 local1 or tribal gov]nm5t 7i7 ,uses ( in=mation ,a ,/ate1 local1 or tribal gov]nm5t t receives cyb] ?reat indicators or def5sive measures f ! ,c5t] f a ,f$]al entity or a non-,f$]al entity-- 7,i7 may use1 reta91 or fur!r disclose su* cyb] ?reat indicators or def5sive measures solely = cyb]security purposes2 7,,ii7 %all1 prior to su* %>+1 take reasonable ef=ts to remove or exclude in=mation t c be us$ to id5tify specific p]sons & is reasonably believ$ at ! "t ( %>+ to be unrelat$ to a cyb]security risk or incid5t1 & to safegu>d in=mation t c be us$ to id5tify specific p]sons f un9t5d$ disclosure or unau?oriz$ access or acquisition2 7,,iii7 %all consid] su* in=mation ! comm]cial1 f9ancial1 & propriet>y in=mation ( su* ,f$]al entity or non-,f$]al entity if s designat$ by su* ,f$]al entity or non-,f$]al entity2 7,,iv7 %all be deem$ to h volunt>ily %>$ su* cyb] ?reat indicators or def5sive measures2 & 7,v7 %all implem5t & utilize a security control to protect aga9/ unau?oriz$ access to or acquisition ( su* cyb] ?reat indicators or def5sive measures4 7ii7 ,protections = in=mation ,! cyb] ?reat indicators & def5sive measures ref]r$ to 9 clause 7i7-- 7,i7 %all be exempt f disclosure "u any ,/ate1 local1 or tribal law or regulation t requires public disclosure ( in=mation or records by a public or quasi-public entity2 & 7,,ii7 may n be us$ by any ,/ate1 local1 or tribal gov]nm5t to regulate a lawful activity ( a non-,f$]al entity4 7#h7 ,liability exemptions 7,a7 ,network aw>5ess ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt1 & su* action %all be promptly dismiss$1 aga9/ any non-,f$]al entity t1 = cyb]security purposes1 conducts network aw>5ess "u p>agraph 7#d71 if su* network aw>5ess is conduct$ 9 accordance ) su* p>agraph & ?is section4 7,b7 ,in=mation %>+ ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt1 & su* action %all be promptly dismiss$1 aga9/ any non-,f$]al entity t1 = cyb]security purposes1 %>es cyb] ?reat indicators or def5sive measures "u p>agraph 7#c71 or 9 good fai? fails to act bas$ on su* %>+1 if su* %>+ is conduct$ 9 accordance ) su* p>agraph & ?is section4 7,c7 ,willful misconduct 7i7 ,rule ( con/ruction ,no?+ 9 ?is section may be con/ru$ to-- 7,i7 require dismissal ( a cause ( action aga9/ a non-,f$]al entity t has engag$ 9 willful misconduct 9 ! c\rse ( conduct+ activities au?oriz$ by ?is section2 or 7,,ii7 und]m9e or limit ! availability ( o!rwise applicable common law or /atutory def5ses4 7ii7 ,pro( ( willful misconduct ,9 any action claim+ t subp>agraph 7,a7 or 7,b7 does n apply due to willful misconduct describ$ 9 clause 7i71 ! pla9tiff %all h ! burd5 ( prov+ by cle> & conv9c+ evid5ce ! willful misconduct by ea* non-,f$]al entity subject to su* claim & t su* willful misconduct proximately caus$ injury to ! pla9tiff4 7iii7 ,willful misconduct def9$ ,9 ?is subsection1 ! t]m willful misconduct means an act or omission t is tak5-- 7,i7 int5tionally to a*ieve a wrongful purpose2 7,,ii7 kn[+ly )\t legal or factual ju/ification2 & 7,,iii7 9 disreg>d ( a kn[n or obvi\s risk t is s great z to make x highly probable t ! h>m w outweigh ! b5efit4 7,d7 ,exclusion ,! t]m non-,f$]al entity z us$ 9 ?is p>agraph %all n include a ,/ate1 local1 or tribal gov]nm5t4 7#i7 ,f$]al ,gov]nm5t liability = violations ( re/rictions on ! use & protection ( volunt>ily %>$ in=mation 7,a7 ,9 g5]al ,if a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t int5tionally or willfully violates ! re/rictions specifi$ 9 p>agraph 7#c71 7#f71 or 7#g77;,b7 on ! use & protection ( volunt>ily %>$ cyb] ?reat indicators or def5sive measures1 or any o!r provision ( ?is section1 ! ,f$]al ,gov]nm5t %all be liable to a p]son injur$ by su* violation 9 an am\nt equal to ! sum (-- 7i7 ! actual damages su/a9$ by su* p]son z a result ( su* violation or #a1jjj1 :i*ev] is great]2 & 7ii7 reasonable attorney fees z det]m9$ by ! c\rt & o!r litigation co/s reasonably occurr$ 9 any case "u ?is subsection 9 :i* ! compla9ant has sub/antially prevail$4 7,b7 ,v5ue ,an action to en=ce liability "u ?is subsection may be br\ght 9 ! di/rict c\rt ( ! ,unit$ ,/ates 9-- 7i7 ! di/rict 9 :i* ! compla9ant resides2 7ii7 ! di/rict 9 :i* ! pr9cipal place ( bus9ess ( ! compla9ant is locat$2 7iii7 ! di/rict 9 :i* ! dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t t disclos$ ! in=mation is locat$2 or 7iv7 ! ,di/rict ( ,columbia4 7,c7 ,/atute ( limitations ,no action %all lie "u ?is subsection unless su* action is comm5c$ n lat] ?an two ye>s aft] ! date on :i* ! cause ( action arises4 7,d7 ,exclusive cause ( action ,a cause ( action "u ?is subsection %all be ! exclusive means available to a compla9ant seek+ a rem$y = a violation ( any re/riction specifi$ 9 p>agraph 7#c71 7#f71 or #g7;,b7 or any o!r provision ( ?is section4 7#aj7 ,anti-tru/ exemption 7,a7 ,9 g5]al ,except z provid$ 9 subp>agraph 7,c71 x %all n be consid]$ a violation ( any provision ( antitru/ laws = two or m non-,f$]al entities to %>e a cyb] ?reat indicator or def5sive measure1 or assi/ance relat+ to ! prev5tion1 inve/igation1 or mitigation ( a cyb]security risk or incid5t1 = cyb]security purposes "u ?is ,act4 7,b7 ,applicability ,subp>agraph 7,a7 %all apply only to in=mation t is %>$ or assi/ance t is provid$ 9 ord] to assi/ )-- 7i7 facilitat+ ! prev5tion1 inve/igation1 or mitigation ( a cyb]security risk or incid5t to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em2 or 7ii7 communicat+ or disclos+ a cyb] ?reat indicator or def5sive measure to help prev5t1 inve/igate1 or mitigate ! effect ( a cyb]security risk or incid5t to an in=mation sy/em or in=mation t is /or$ on1 process$ by1 or transit+ an in=mation sy/em4 7#aa7 ,con/ruction & preemption 7,a7 ,o!rwise lawful disclosures ,no?+ 9 ?is section may be con/ru$ to limit or prohibit o!rwise lawful disclosures ( communications1 records1 or o!r in=mation1 includ+ report+ ( kn[n or suspect$ crim9al activity or p>ticipat+ volunt>ily or "u legal requirem5t 9 an inve/igation1 by a non-,f$]al to any o!r non-,f$]al entity or ,f$]al entity "u ?is section4 7,b7 ,:i/le bl[] protections ,no?+ 9 ?is section may be con/ru$ to prohibit or limit ! disclosure ( in=mation protect$ "u section #bcjb7;b77#h7 ( title #e1 ,unit$ ,/ates ,code 7gov]n+ disclosures ( illegality1 wa/e1 fraud1 abuse1 or public heal? or safety ?reats71 section #gbaa ( title #e1 ,unit$ ,/ates ,code 7gov]n+ disclosures to ,congress71 section #ajcd ( title #aj1 ,unit$ ,/ates ,code 7gov]n+ disclosure to ,congress by memb]s ( ! milit>y71 section #aajd ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cbcd7 7gov]n+ disclosure by employees ( elem5ts ( ! intellig5ce community71 or any simil> provision ( ,f$]al or ,/ate law4 7,c7 ,relation%ip to o!r laws ,no?+ 9 ?is section may be con/ru$ to affect any requirem5t "u any o!r provision ( law = a non-,f$]al entity to provide in=mation to a ,f$]al entity4 7,d7 ,pres]vation ( contractual obligations & rights ,no?+ 9 ?is section may be con/ru$ to-- 7i7 am5d1 repeal1 or sup]s$e any curr5t or future contractual agreem5t1 t]ms ( s]vice agreem5t1 or o!r contractual relation%ip betwe5 any non-,f$]al entities1 or betwe5 any non-,f$]al entity & a ,f$]al entity2 or 7ii7 abrogate trade secret or intellectual prop]ty rights ( any non-,f$]al entity or ,f$]al entity4 7,e7 ,anti-task+ re/riction ,no?+ 9 ?is section may be con/ru$ to p]mit a ,f$]al entity to-- 7i7 require a non-,f$]al entity to provide in=mation to a ,f$]al entity2 7ii7 condition ! %>+ ( cyb] ?reat indicators or def5sive measures ) a non-,f$]al entity on su* non-,f$]al entity's provision ( cyb] ?reat indicators or def5sive measures to a ,f$]al entity2 or 7iii7 condition ! aw>d ( any ,f$]al grant1 contract1 or pur*ase on ! %>+ ( cyb] ?reat indicators or def5sive measures ) a ,f$]al entity4 7,f7 ,no liability = non-p>ticipation ,no?+ 9 ?is section may be con/ru$ to subject any non-,f$]al entity to liability = *oos+ to n engage 9 ! volunt>y activities au?oriz$ "u ?is section4 7,g7 ,use & ret5tion ( in=mation ,no?+ 9 ?is section may be con/ru$ to au?orize1 or to modify any exi/+ au?ority (1 a dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t to reta9 or use any in=mation %>$ "u ?is section = any use o!r ?an p]mitt$ 9 ?is section4 7,h7 ,volunt>y %>+ ,no?+ 9 ?is section may be con/ru$ to re/rict or condition a non-,f$]al entity f %>+1 = cyb]security purposes1 cyb] ?reat indicators1 def5sive measures1 or in=mation relat$ to cyb]security risks or incid5ts ) any o!r non-,f$]al entity1 & no?+ 9 ?is section may be con/ru$ z requir+ any non-,f$]al entity to %>e cyb] ?reat indicators1 def5sive measures1 or in=mation relat$ to cyb]security risks or incid5ts ) ! ,c5t]4 7,i7 ,prohibit$ conduct ,no?+ 9 ?is section may be con/ru$ to p]mit price-fix+1 allocat+ a m>ket betwe5 competitors1 monopoliz+ or attempt+ to monopolize a m>ket1 or ex*anges ( price or co/ in=mation1 cu/om] li/s1 or in=mation reg>d+ future competitive plann+4 7,j7 ,f$]al preemption ,?is section sup]s$es any /atute or o!r provision ( law ( a ,/ate or political subdivision ( a ,/ate t re/ricts or o!rwise expressly regulates an activity au?oriz$ "u ?is section4 7j7 ,direct report+ ,! ,secret>y %all develop policies & proc$ures = direct report+ to ! ,secret>y by ! ,director ( ! ,c5t] reg>d+ significant cyb]security risks & incid5ts4 7k7 ,additional responsibilities ,! ,secret>y %all build ^u exi/+ me*anisms to promote a national aw>5ess ef=t to educate ! g5]al public on ! importance ( secur+ in=mation sy/ems4 7l7 ,reports on int]national coop]ation ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is subsection & p]iodically !reaft]1 ! ,secret>y ( ,homel& ,security %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report on ! range ( ef=ts und]way to bol/] cyb]security collaboration ) relevant int]national p>tn]s 9 accordance ) subsection 7c77#h74 7m7 ,outrea* ,n lat] ?an #fj days aft] ! date ( ! enactm5t ( ?is subsection1 ! ,secret>y1 act+ ?r\gh ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection1 %all-- 7#a7 dissem9ate to ! public in=mation ab\t h[ to volunt>ily %>e cyb] ?reat indicators & def5sive measures ) ! ,c5t]2 & 7#b7 enhance outrea* to critical infra/ructure own]s & op]ators = purposes ( su* %>+4 4 #bjd4 ,in=mation %>+ & analysis organizations ,section #bab ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #aca7 is am5d$-- 7#a7 9 p>agraph 7#e7-- 7,a7 9 subp>agraph 7,a7-- 7i7 by ins]t+ & in=mation relat$ to cyb]security risks & incid5ts & aft] critical infra/ructure in=mation2 & 7ii7 by /rik+ relat$ to critical infra/ructure & ins]t+ relat$ to cyb]security risks1 incid5ts1 critical infra/ructure1 &2 7,b7 9 subp>agraph 7,b7-- 7i7 by /rik+ disclos+ critical infra/ructure in=mation & ins]t+ disclos+ cyb]security risks1 incid5ts1 & critical infra/ructure in=mation2 & 7ii7 by /rik+ relat$ to critical infra/ructure or & ins]t+ relat$ to cyb]security risks1 incid5ts1 critical infra/ructure1 or & 7,c7 9 subp>agraph 7,c71 by /rik+ dissem9at+ critical infra/ructure in=mation & ins]t+ dissem9at+ cyb]security risks1 incid5ts1 & critical infra/ructure in=mation2 & 7#b7 by add+ at ! end ! foll[+ new p>agraph3 7#h7 ,cyb]security risk2 incid5t ,! t]ms cyb]security risk & incid5t h ! mean+s giv5 su* t]ms 9 ! second section #bbf 7relat+ to ! ,national ,cyb]security & ,communications ,integration ,c5t]74 4 #bje4 ,/reaml9+ ( ,dep>tm5t ( ,homel& ,security cyb]security & infra/ructure protection organization 7a7 ,cyb]security & ,infra/ructure ,protection ,! ,national ,protection & ,programs ,directorate ( ! ,dep>tm5t ( ,homel& ,security %all1 aft] ! date ( ! enactm5t ( ?is title1 be kn[n & designat$ z ! ,cyb]security & ,infra/ructure ,protection4 ,any ref]5ce to ! ,national ,protection & ,programs ,directorate ( ! ,dep>tm5t 9 any law1 regulation1 map1 docum5t1 record1 or o!r pap] ( ! ,unit$ ,/ates %all be deem$ to be a ref]5ce to ! ,cyb]security & ,infra/ructure ,protection ( ! ,dep>tm5t4 7b7 ,s5ior lead]%ip ( ,cyb]security & ,infra/ructure ,protection 7#a7 ,9 g5]al ,subsection 7a7 ( section #ajc ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #aac7 is am5d$-- 7,a7 9 p>agraph 7#a7-- 7i7 by am5d+ subp>agraph 7,h7 to read z foll[s3 7,h7 ,an ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection4 2 & 7ii7 by add+ at ! end ! foll[+ new subp>agraphs3 7,k7 ,a ,deputy ,"u ,secret>y = ,cyb]security4 7,l7 ,a ,deputy ,"u ,secret>y = ,infra/ructure ,protection4 2 & 7,b7 by add+ at ! end ! foll[+ new p>agraph3 7#c7 ,deputy ,"u ,secret>ies ,! ,deputy ,"u ,secret>ies ref]r$ to 9 subp>agraphs 7,k7 & 7,l7 ( p>agraph 7#a7 %all be appo9t$ by ! ,presid5t )\t ! advice & cons5t ( ! ,s5ate4 4 7#b7 ,cont9uation 9 (fice ,! individuals :o hold ! positions ref]r$ 9 subp>agraphs 7,h71 7,k71 & 7,l7 ( p>agraph 7#a7 ( section #ajc7;a7 ! ,homel& ,security ,act ( #bjjb 7z am5d$ & add$ by p>agraph 7#a7 ( ?is subsection7 z ( ! date ( ! enactm5t ( ?is title may cont9ue to hold su* positions4 7c7 ,report ,n lat] ?an #ij days aft] ! date ( ! enactm5t ( ?is title1 ! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection ( ! ,dep>tm5t ( ,homel& ,security %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report on ! feasibility ( becom+ an op]ational compon5t1 includ+ an analysis ( alt]natives1 & if a det]m9ation is r5d]$ t becom+ an op]ational compon5t is ! be/ option = a*iev+ ! mission ( ,cyb]security & ,infra/ructure ,protection1 a legislative proposal & implem5tation plan = becom+ su* an op]ational compon5t4 ,su* report %all also include plans to m effectively c>ry out ! cyb]security mission ( ,cyb]security & ,infra/ructure ,protection1 includ+ exp$it+ in=mation %>+ agreem5ts4 #bjf4 ,cyb] incid5t response plans 7a7 ,9 g5]al ,section #bbg ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #adi7 is am5d$-- 7#a7 9 ! head+1 by /rik+ plan & ins]t+ plans2 7#b7 by /rik+ ,! ,"u ,secret>y appo9t$ "u section #ajc7;a77#a77;,h7 %all & ins]t+ ! foll[+3 7a7 ,9 g5]al ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all 2 & 7#c7 by add+ at ! end ! foll[+ new subsection3 7b7 ,updates to ! ,cyb] ,incid5t ,annex to ! ,national ,response ,framework ,! ,secret>y1 9 coord9ation ) ! heads ( o!r appropriate ,f$]al dep>tm5ts & ag5cies1 & 9 accordance ) ! ,national ,cyb]security ,incid5t ,response ,plan requir$ "u subsection 7a71 %all regul>ly update1 ma9ta91 & ex]cise ! ,cyb] ,incid5t ,annex to ! ,national ,response ,framework ( ! ,dep>tm5t4 4 7b7 ,cl]ical am5dm5t ,! table ( cont5ts ( ! ,homel& ,security ,act ( #bjjb is am5d$ by am5d+ ! item relat+ to section #bbg to read z foll[s3 ,sec4 #bbg4 ,cyb] incid5t response plans4 4 #bjg4 ,security & resili5cy ( public safety communications2 ,cyb]security aw>5ess campaign 7a7 ,9 g5]al ,subtitle ,c ( title ,,ii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ada et seq47 is am5d$ by add+ at ! end ! foll[+ new sections3 #bcj4 ,security & resili5cy ( public safety communications ,! ,national ,cyb]security & ,communications ,integration ,c5t]1 9 coord9ation ) ! ,(fice ( ,em]g5cy ,communications ( ! ,dep>tm5t1 %all assess & evaluate consequ5ce1 vuln]ability1 & ?reat in=mation reg>d+ cyb] incid5ts to public safety communications to help facilitate cont9u\s improvem5ts to ! security & resili5cy ( su* communications4 #bca4 ,cyb]security aw>5ess campaign 7a7 ,9 g5]al ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all develop & implem5t an ongo+ & compreh5sive cyb]security aw>5ess campaign reg>d+ cyb]security risks & volunt>y be/ practices = mitigat+ & respond+ to su* risks4 ,su* campaign %all1 at a m9imum1 publi% & dissem9ate1 on an ongo+ basis1 ! foll[+3 7#a7 ,public s]vice ann\ncem5ts t>get$ at improv+ aw>5ess among ,/ate1 local1 & tribal gov]nm5ts1 ! private sector1 academia1 & /akehold]s 9 specific audi5ces1 includ+ ! eld]ly1 /ud5ts1 small bus9esses1 memb]s ( ! ,arm$ ,=ces1 & vet]ans4 7#b7 ,v5dor & te*nology-neutral volunt>y be/ practices in=mation4 7b7 ,consultation ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all consult ) a wide range ( /akehold]s 9 gov]nm5t1 indu/ry1 academia1 & ! non-pr(it community 9 c>ry+ out ?is section4 #bcb4 ,national ,cyb]security ,prep>$ness ,consortium 7a7 ,9 g5]al ,! ,secret>y may e/abli% a consortium to be kn[n z ! ,national ,cyb]security ,prep>$ness ,consortium 79 ?is section ref]r$ to z ! ,consortium74 7b7 ,functions ,! ,consortium may-- 7#a7 provide tra9+ to ,/ate & local fir/ respond]s & (ficials specifically = prep>+ & respond+ to cyb] attacks2 7#b7 develop & update a curriculum utiliz+ ! ,national ,protection & ,programs ,directorate ( ! ,dep>tm5t sponsor$ ,community ,cyb] ,security ,maturity ,model 7,,ccsmm7 = ,/ate & local fir/ respond]s & (ficials2 7#c7 provide te*nical assi/ance s]vices to build & su/a9 capabilities 9 support ( cyb]security prep>$ness & response2 7#d7 conduct cyb]security tra9+ & simulation ex]cises to def5d f & respond to cyb]-attacks2 7#e7 coord9ate ) ! ,national ,cyb]security & ,communications ,integration ,c5t] to help ,/ates & communities develop cyb]security in=mation %>+ programs2 & 7#f7 coord9ate ) ! ,national ,dome/ic ,prep>$ness ,consortium to incorporate cyb]security em]g5cy responses into exi/+ ,/ate & local em]g5cy managem5t functions4 7c7 ,memb]s ,! ,consortium %all consi/ ( academic1 nonpr(it1 & gov]nm5t p>tn]s t develop1 update1 & deliv] cyb]security tra9+ 9 support ( homel& security4 ,memb]s %all h prior exp]i5ce conduct+ cyb]security tra9+ & ex]cises = ,/ate & local entities4 4 7b7 ,cl]ical am5dm5t ,! table ( cont5ts ( ! ,homel& ,security ,act ( #bjjb is am5d$ by ins]t+ aft] ! item relat+ to section #bbf 7relat+ to cyb]security recruitm5t & ret5tion7 ! foll[+ new items3 ,sec4 #bcj4 ,security & resili5cy ( public safety communications4 ,sec4 #bca4 ,cyb]security aw>5ess campaign4 ,sec4 #bcb4 ,national ,cyb]security ,prep>$ness ,consortium4 4 #bjh4 ,critical infra/ructure protection rese>* & developm5t 7a7 ,/rategic plan2 ,public-,private consortiums ,title ,,iii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #aha et seq47 is am5d$ by add+ at ! end ! foll[+ new section3 #cah4 ,rese>* & developm5t /rategy = critical infra/ructure protection 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is section1 ! ,secret>y1 act+ ?r\gh ! ,"u ,secret>y = ,sci5ce & ,te*nology1 %all submit to ,congress a /rategic plan to guide ! ov]all direction ( ,f$]al physical security & cyb]security te*nology rese>* & developm5t ef=ts = protect+ critical infra/ructure1 includ+ aga9/ all ?reats4 ,su* plan %all be updat$ & submitt$ to ,congress e two ye>s4 7b7 ,cont5ts ( plan ,! /rategic plan1 includ+ bi5nial updates1 requir$ "u subsection 7a7 %all include ! foll[+3 7#a7 ,an id5tification ( critical infra/ructure security risks & any associat$ security te*nology gaps1 t are develop$ foll[+3 7,a7 ,consultation ) /akehold]s1 includ+ critical infra/ructure ,sector ,coord9at+ ,c\ncils4 7,b7 ,p]=mance by ! ,dep>tm5t ( a risk & gap analysis t consid]s in=mation receiv$ 9 su* consultations4 7#b7 ,a set ( critical infra/ructure security te*nology ne$s t-- 7,a7 is prioritiz$ bas$ on ! risks & gaps id5tifi$ "u p>agraph 7#a72 7,b7 emphasizes rese>* & developm5t ( te*nologies t ne$ to be accel]at$ due to rapidly evolv+ ?reats or rapidly advanc+ infra/ructure te*nology2 & 7,c7 includes rese>*1 developm5t1 & acquisition roadmaps ) cle>ly def9$ objectives1 goals1 & measures4 7#c7 ,an id5tification ( laboratories1 facilities1 model+1 & simulation capabilities t w be requir$ to support ! rese>*1 developm5t1 demon/ration1 te/+1 evaluation1 & acquisition ( ! security te*nologies describ$ 9 p>agraph 7#b74 7#d7 ,an id5tification ( curr5t & plann$ programmatic initiatives = fo/]+ ! rapid advancem5t & deploym5t ( security te*nologies = critical infra/ructure protection1 includ+ a consid]ation ( opportunities = public-private p>tn]%ips1 intragov]nm5t collaboration1 univ]sity c5t]s ( excell5ce1 & national laboratory te*nology transf]4 7#e7 ,a description ( progress made ) respect to ea* critical infra/ructure security risk1 associat$ security te*nology gap1 & critical infra/ructure te*nology ne$ id5tifi$ 9 ! prec$+ /rategic plan requir$ "u subsection 7a74 7c7 ,coord9ation ,9 c>ry+ out ?is section1 ! ,"u ,secret>y = ,sci5ce & ,te*nology %all coord9ate ) ! ,"u ,secret>y = ! ,national ,protection & ,programs ,directorate4 7d7 ,consultation ,9 c>ry+ out ?is section1 ! ,"u ,secret>y = ,sci5ce & ,te*nology %all consult )-- 7#a7 critical infra/ructure ,sector ,coord9at+ ,c\ncils2 7#b7 to ! ext5t practicable1 subject matt] exp]ts on critical infra/ructure protection f univ]sities1 colleges1 national laboratories1 & private indu/ry2 7#c7 ! heads ( o!r relevant ,f$]al dep>tm5ts & ag5cies t conduct rese>* & developm5t relat+ to critical infra/ructure protection2 & 7#d7 ,/ate1 local1 & tribal gov]nm5ts1 z appropriate4 4 7b7 ,cl]ical am5dm5t ,! table ( cont5ts ( ! ,homel& ,security ,act ( #bjjb is am5d$ by ins]t+ aft] ! item relat+ to section #cag ! foll[+ new item3 ,sec4 #cah4 ,rese>* & developm5t /rategy = critical infra/ructure protection4 4 #bji4 ,report on r$uc+ cyb]security risks 9 ,,dhs data c5t]s ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is title1 ! ,secret>y ( ,homel& ,security %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report on ! feasibility ( ! ,dep>tm5t ( ,homel& ,security creat+ an environm5t = ! r$uction 9 cyb]security risks 9 ,dep>tm5t data c5t]s1 includ+ by increas+ comp>tm5talization betwe5 sy/ems1 & provid+ a mix ( security controls betwe5 su* comp>tm5ts4 #baj4 ,assessm5t ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is title1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report t conta9s an assessm5t ( ! implem5tation by ! ,secret>y ( ,homel& ,security ( ?is title & ! am5dm5ts made by ?is title &1 to ! ext5t practicable1 f9d+s reg>d+ increases 9 ! %>+ ( cyb] ?reat indicators1 def5sive measures1 & in=mation relat+ to cyb]security risks & incid5ts at ! ,national ,cyb]security & ,communications ,integration ,c5t] & ?r\gh\t ! ,unit$ ,/ates4 #baa4 ,consultation ,! ,"u ,secret>y = ,cyb]security & ,infra/ructure ,protection %all produce a report on ! feasibility ( creat+ a risk-in=m$ prioritization plan %\ld multiple critical infra/ructures exp]i5ce cyb] incid5ts simultane\sly4 #bab4 ,te*nical assi/ance ,! ,inspector ,g5]al ( ! ,dep>tm5t ( ,homel& ,security %all review ! op]ations ( ! ,unit$ ,/ates ,comput] ,em]g5cy ,read9ess ,team 7,,u-,,c]t7 & ! ,indu/rial ,control ,sy/ems ,cyb] ,em]g5cy ,response ,team 7,,ics-,,c]t7 to assess ! capacity to provide te*nical assi/ance to non-,f$]al entities & to adequately respond to pot5tial increases 9 reque/s = te*nical assi/ance4 #bac4 ,prohibition on new regulatory au?ority ,no?+ 9 ?is title or ! am5dm5ts made by ?is title may be con/ru$ to grant ! ,secret>y ( ,homel& ,security any au?ority to promulgate regulations or set /&>ds relat+ to ! cyb]security ( non-,f$]al entities1 n includ+ ,/ate1 local1 & tribal gov]nm5ts1 t 0 n 9 effect on ! day be=e ! date ( ! enactm5t ( ?is title4 #bad4 ,sunset ,any requirem5ts = reports requir$ by ?is title or ! am5dm5ts made by ?is title %all t]m9ate on ! date t is #g ye>s aft] ! date ( ! entitlem5t ( ?is title4 #bae4 ,prohibition on new fund+ ,no funds are au?oriz$ to be appropriat$ to c>ry out ?is title & ! am5dm5ts made by ?is title4 ,?is title & su* am5dm5ts %all be c>ri$ out us+ am\nts appropriat$ or o!rwise made available = su* purposes4 #baf4 ,protection ( ,f$]al in=mation sy/ems 7a7 ,9 g5]al ,subtitle ,c ( title ,,ii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ada et seq47 is am5d$ by add+ at ! end ! foll[+ new section3 #bcc4 ,available protection ( ,f$]al in=mation sy/ems 7a7 ,9 g5]al ,! ,secret>y %all deploy & op]ate1 to make available = use by any ,f$]al ag5cy1 ) or )\t reimbursem5t1 capabilities to protect ,f$]al ag5cy in=mation & in=mation sy/ems1 includ+ te*nologies to cont9u\sly diagnose1 detect1 prev5t1 & mitigate aga9/ cyb]security risks 7z su* t]m is def9$ 9 ! second section #bbf7 involv+ ,f$]al ag5cy in=mation or in=mation sy/ems4 7b7 ,activities ,9 c>ry+ out ?is section1 ! ,secret>y may-- 7#a7 access1 & ,f$]al ag5cy heads may disclose to ! ,secret>y or a private entity provid+ assi/ance to ! ,secret>y "u p>agraph 7#b71 in=mation travel+ to or f or /or$ on a ,f$]al ag5cy in=mation sy/em1 reg>dless ( f :]e ! ,secret>y or a private entity provid+ assi/ance to ! ,secret>y "u p>agraph 7#b7 accesses su* in=mation1 not)/&+ any o!r provision ( law t w\ld o!rwise re/rict or prev5t ,f$]al ag5cy heads f disclos+ su* in=mation to ! ,secret>y or a private entity provid+ assi/ance to ! ,secret>y "u p>agraph 7#b72 7#b7 ent] into contracts or o!r agreem5ts1 or o!rwise reque/ & obta9 ! assi/ance (1 private entities to deploy & op]ate te*nologies 9 accordance ) subsection 7a72 & 7#c7 reta91 use1 & disclose in=mation obta9$ ?r\gh ! conduct ( activities au?oriz$ "u ?is section only to protect ,f$]al ag5cy in=mation & in=mation sy/ems f cyb]security risks1 or1 ) ! approval ( ! ,attorney ,g5]al & if disclosure ( su* in=mation is n o!rwise prohibit$ by law1 to law en=cem5t only to inve/igate1 prosecute1 disrupt1 or o!rwise respond to-- 7,a7 a violation ( section #ajcj ( title #ah1 ,unit$ ,/ates ,code2 7,b7 an imm95t ?reat ( dea? or s]i\s bodily h>m2 7,c7 a s]i\s ?reat to a m9or1 includ+ sexual exploitation or ?reats to physical safety2 or 7,d7 an attempt1 or conspiracy1 to commit an (f5se describ$ 9 any ( subp>agraphs 7,a7 ?r\gh 7,c74 7c7 ,conditions ,contracts or o!r agreem5ts "u subsection 7b77#b7 %all include appropriate provisions b>r+-- 7#a7 ! disclosure ( in=mation to any entity o!r ?an ! ,dep>tm5t or ! ,f$]al ag5cy disclos+ in=mation 9 accordance ) subsection 7b77#a7 t c be us$ to id5tify specific p]sons & is reasonably believ$ to be unrelat$ to a cyb]security risk2 & 7#b7 ! use ( any in=mation to :i* su* private entity ga9s access 9 accordance ) ?is section = any purpose o!r ?an to protect ,f$]al ag5cy in=mation & in=mation sy/ems aga9/ cyb]security risks or to adm9i/] any su* contract or o!r agreem5t4 7d7 ,limitation ,no cause ( action %all lie aga9/ a private entity = assi/ance provid$ to ! ,secret>y 9 accordance ) ?is section & a contract or agreem5t "u subsection 7b77#b74 4 7b7 ,cl]ical am5dm5t ,! table ( cont5ts ( ! ,homel& ,security ,act ( #bjjb is am5d$ by ins]t+ aft] ! item relat+ to section #bbf 7relat+ to cyb]security recruitm5t & ret5tion7 ! foll[+ new item3 ,sec4 #bcc4 ,available protection ( ,f$]al in=mation sy/ems4 4 #bag4 ,sunset ,?is title & ! am5dm5ts made by ?is title %all t]m9ate on ! date t is #g ye>s aft] ! date ( ! enactm5t ( ?is title4 #bah4 ,report on cyb]security vuln]abilities ( ,unit$ ,/ates ports ,n lat] ?an #ahj days aft] ! date ( ! enactm5t ( ?is title1 ! ,secret>y ( ,homel& ,security %all submit to ! ,committee on ,homel& ,security & ! ,committee on ,transportation & ,infra/ructure ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,comm]ce1 ,sci5ce & ,transportation ( ! ,s5ate a report on cyb]security vuln]abilities = ! t5 ,unit$ ,/ates ports t ! ,secret>y det]m9es are at greate/ risk ( a cyb]security incid5t & provide recomm5dations to mitigate su* vuln]abilities4 #bai4 ,report on cyb]security & critical infra/ructure ,! ,secret>y ( ,homel& ,security may consult ) sector specific ag5cies1 bus9esses1 & /akehold]s to produce & submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report on h[ be/ to align f$]ally fund$ cyb]security rese>* & developm5t activities ) private sector ef=ts to protect privacy & civil lib]ties :ile assur+ security & resili5ce ( ! ,nation's critical infra/ructure1 includ+-- 7#a7 promot+ rese>* & developm5t to enable ! secure & resili5t design & con/ruction ( critical infra/ructure & m secure accompany+ cyb] te*nology2 7#b7 enhanc+ model+ capabilities to det]m9e pot5tial impacts on critical infra/ructure ( incid5ts or ?reat sc5>ios1 & cascad+ effects on o!r sectors2 & 7#c7 facilitat+ initiatives to inc5tivize cyb]security inve/m5ts & ! adoption ( critical infra/ructure design features t /r5g!n cyb]security & resili5ce4 #bbj4 ,,gao report on impact privacy & civil lib]ties ,n lat] ?an #fj mon?s aft] ! date ( ! enactm5t ( ?is title1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate an assessm5t on ! impact on privacy & civil lib]ties limit$ to ! "w ( ! ,national ,cyb]security & ,communications ,integration ,c5t]4 ,pass$ ! ,h\se ( ,repres5tatives ,april #bb1 #bjae4,k>5 ,l4 ,haas1,cl]k