,,ib  ,union ,cal5d> ,no4 #dd  #aad?    
,,congress  #a/ ,session  ,h4 ,r4 #aefj 
,report ,no4 #aad-fc  ,,9 ,,! ,,h\se ,,(
 ,,repres5tatives  ,m>* #bd1 #bjae ,mr4 
,nunes 7= himself1 ,mr4 ,s*iff1 ,mr4    
,we/morel&1 & ,mr4 ,himes7 introduc$ !  
foll[+ bill2 :i* 0 ref]r$ to ! ,select  
,committee on ,intellig5ce 7,p]man5t    
,select7  ,april #ac1 #bjae ,additional 
sponsors3 ,mr4 ,k+ ( ,new ,york1 ,mr4   
,lo,biondo1 ,ms4 ,sewell ( ,alabama1    
,mr4 ,quigley1 & ,mr4 ,murphy ( ,florida
  ,april #ac1 #bjae ,report$ ) an       
am5dm5t1 committ$ to ! ,committee ( !   
,:ole ,h\se on ! ,/ate ( ! ,union1 &    
ord]$ to be pr9t$ ,/rike out all aft] ! 
enact+ clause & ins]t ! "p pr9t$ 9      
italic ,= text ( introduc$ bill1 see    
copy ( bill z introduc$ on ,m>* #bd1    
#bjae  ,a ,,bill  ,to improve           
cyb]security 9 ! ,unit$ ,/ates ?r\gh    
enhanc$ %>+ ( in=mation ab\t            
cyb]security ?reats1 & = o!r purposes4  
#a4 ,%ort title2 table ( cont5ts  7a7   
,%ort title ,?is ,act may be cit$ z !   

,protect+ ,cyb] ,networks ,act4  7b7    
,table ( cont5ts ,! table ( cont5ts (   
?is ,act is z foll[s3  ,sec4 #a4 ,%ort  
title2 table ( cont5ts4 ,sec4 #b4 ,%>+ (
 cyb] ?reat indicators & def5sive       
measures by ! ,f$]al ,gov]nm5t )        
non-,f$]al entities4 ,sec4 #c4          
,au?orizations = prev5t+1 detect+1      
analyz+1 & mitigat+ cyb]security ?reats4
 ,sec4 #d4 ,%>+ ( cyb] ?reat indicators 
& def5sive measures ) appropriate ,f$]al
 entities o!r ?an ! ,dep>tm5t ( ,def5se 
or ! ,national ,security ,ag5cy4 ,sec4  
#e4 ,f$]al ,gov]nm5t liability =        
violations ( privacy or civil lib]ties4 
,sec4 #f4 ,protection f liability4 ,sec4
 #g4 ,ov]sight ( ,gov]nm5t activities4  
,sec4 #h4 ,report on cyb]security       
?reats4 ,sec4 #i4 ,con/ruction &        
preemption4 ,sec4 #aj4 ,con=m+ am5dm5ts4
 ,sec4 #aa4 ,def9itions4  #b4 ,%>+ (    
cyb] ?reat indicators & def5sive        
measures by ! ,f$]al ,gov]nm5t )        
non-,f$]al entities  7a7 ,9 g5]al ,title
 ,i ( ! ,national ,security ,act ( #aidg

 7#ej ,u4,s4,c4 #cjba et seq47 is am5d$ 
by ins]t+ aft] section #aaj 7#ej        
,u4,s4,c4 #cjde7 ! foll[+ new section3  
#aaa4 ,%>+ ( cyb] ?reat indicators &    
def5sive measures by ! ,f$]al ,gov]nm5t 
) non-,f$]al entities  7a7 ,%>+ by !    
,f$]al ,gov]nm5t  7#a7 ,9 g5]al         
,consi/5t ) ! protection ( classifi$    
in=mation1 intellig5ce s\rces & me?ods1 
& privacy & civil lib]ties1 ! ,director 
( ,national ,intellig5ce1 9 consultation
 ) ! heads ( ! o!r appropriate ,f$]al   
entities1 %all develop & promulgate     
proc$ures to facilitate & promote--     
7,a7 ! timely %>+ ( classifi$ cyb] ?reat
 indicators 9 ! possession ( ! ,f$]al   
,gov]nm5t ) repres5tatives ( relevant   
non-,f$]al entities ) appropriate       
security cle>ances2  7,b7 ! timely %>+ )
 relevant non-,f$]al entities ( cyb]    
?reat indicators 9 ! possession ( !     
,f$]al ,gov]nm5t t may be declassifi$ & 
%>$ at an unclassifi$ level2 &  7,c7 !  
%>+ ) non-,f$]al entities1 if           
appropriate1 ( in=mation 9 ! possession 

( ! ,f$]al ,gov]nm5t ab\t imm95t or     
ongo+ cyb]security ?reats to su*        
entities to prev5t or mitigate adv]se   
impacts f su* cyb]security ?reats4  7#b7
 ,developm5t ( proc$ures ,! proc$ures   
develop$ & promulgat$ "u p>agraph 7#a7  
%all--  7,a7 ensure ! ,f$]al ,gov]nm5t  
has & ma9ta9s ! capability to %>e cyb]  
?reat indicators 9 real "t consi/5t ) ! 
protection ( classifi$ in=mation2  7,b7 
incorporate1 to ! greate/ ext5t         
practicable1 exi/+ processes & exi/+    
roles & responsibilities ( ,f$]al &     
non-,f$]al entities = in=mation %>+ by !
 ,f$]al ,gov]nm5t1 includ+              
sector-specific in=mation %>+ & analysis
 c5t]s2  7,c7 include proc$ures =       
notify+ non-,f$]al entities t h receiv$ 
a cyb] ?reat indicator f a ,f$]al entity
 9 accordance ) ?is ,act t is kn[n or   
det]m9$ to be 9 error or 9 contrav5tion 
( ! requirem5ts ( ?is section1 !        
,protect+ ,cyb] ,networks ,act1 or !    
am5dm5ts made by su* ,act or ano!r      
provision ( ,f$]al law or policy ( su*  

error or contrav5tion2  7,d7 include    
requirem5ts = ,f$]al entities receiv+ a 
cyb] ?reat indicator or def5sive measure
 to implem5t appropriate security       
controls to protect aga9/ unau?oriz$    
access to1 or acquisition (1 su* cyb]   
?reat indicator or def5sive measure2    
7,e7 include proc$ures t require ,f$]al 
entities1 prior to ! %>+ ( a cyb] ?reat 
indicator1 to-- 7i7 review su* cyb]     
?reat indicator to assess :e!r su* cyb] 
?reat indicator1 9 contrav5tion ( !     
requirem5t "u section #c7;d77#b7 ( !    
,protect+ ,cyb] ,networks ,act1 conta9s 
any in=mation t su* ,f$]al entity kn[s  
at ! "t ( %>+ to be p]sonal in=mation ( 
or in=mation id5tify+ a specific p]son n
 directly relat$ to a cyb]security ?reat
 & remove su* in=mation2 or  7ii7       
implem5t a te*nical capability configur$
 to remove or exclude any p]sonal       
in=mation ( or in=mation id5tify+ a     
specific p]son n directly relat$ to a   
cyb]security ?reat2 &  7,f7 include     
proc$ures to promote ! effici5t grant+ (

 security cle>ances to appropriate      
repres5tatives ( non-,f$]al entities4   
7b7 ,def9itions ,9 ?is section1 ! t]ms  
appropriate ,f$]al entities1 cyb] ?reat 
indicator1 def5sive measure1 ,f$]al     
entity1 & non-,f$]al entity h ! mean+   
giv5 su* t]ms 9 section #aa ( !         
,protect+ ,cyb] ,networks ,act4  4  7b7 
,submittal to ,congress ,n lat] ?an #ij 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ,national           
,intellig5ce1 9 consultation ) ! heads (
 ! o!r appropriate ,f$]al entities1 %all
 submit to ,congress ! proc$ures requir$
 by section #aaa7;a7 ( ! ,national      
,security ,act ( #aidg1 z ins]t$ by     
subsection 7a7 ( ?is section4  7c7      
,table ( cont5ts am5dm5t ,! table (     
cont5ts 9 ! fir/ section ( ! ,national  
,security ,act ( #aidg is am5d$ by      
ins]t+ aft] ! item relat+ to section    
#aaj ! foll[+ new item3  ,sec4 #aaa4    
,%>+ ( cyb] ?reat indicators & def5sive 
measures by ! ,f$]al ,gov]nm5t )        
non-,f$]al entities4  4  #c4            

,au?orizations = prev5t+1 detect+1      
analyz+1 & mitigat+ cyb]security ?reats 
7a7 ,au?orization = private-sector      
def5sive monitor+  7#a7 ,9 g5]al        
,not)/&+ any o!r provision ( law1 a     
private entity may1 = a cyb]security    
purpose1 monitor--  7,a7 an in=mation   
sy/em ( su* private entity2  7,b7 an    
in=mation sy/em ( a non-,f$]al entity or
 a ,f$]al entity1 ^u ! writt5           
au?orization ( su* non-,f$]al entity or 
su* ,f$]al entity2 &  7,c7 in=mation t  
is /or$ on1 process$ by1 or transit+ an 
in=mation sy/em monitor$ by ! private   
entity "u ?is p>agraph4  7#b7           
,con/ruction ,no?+ 9 ?is subsection %all
 be con/ru$ to--  7,a7 au?orize !       
monitor+ ( an in=mation sy/em1 or ! use 
( any in=mation obta9$ ?r\gh su*        
monitor+1 o!r ?an z provid$ 9 ?is ,act2 
7,b7 au?orize ! ,f$]al ,gov]nm5t to     
conduct surveillance ( any p]son2 or    
7,c7 limit o!rwise lawful activity4  7b7
 ,au?orization = op]ation ( def5sive    
measures  7#a7 ,9 g5]al ,except z       

provid$ 9 p>agraph 7#b7 & not)/&+ any   
o!r provision ( law1 a private entity   
may1 = a cyb]security purpose1 op]ate a 
def5sive measure t is op]at$ on & is    
limit$ to--  7,a7 an in=mation sy/em (  
su* private entity to protect ! rights  
or prop]ty ( ! private entity2 &  7,b7  
an in=mation sy/em ( a non-,f$]al entity
 or a ,f$]al entity ^u writt5           
au?orization ( su* non-,f$]al entity or 
su* ,f$]al entity = op]ation ( su*      
def5sive measure to protect ! rights or 
prop]ty ( su* private entity1 su*       
non-,f$]al entity1 or su* ,f$]al entity4
  7#b7 ,limitation ,! au?ority provid$ 9
 p>agraph 7#a7 does n include !         
int5tional or reckless op]ation ( any   
def5sive measure t de/roys1 r5d]s       
unusable or inaccessible 79 :ole or 9   
"p71 sub/antially h>ms1 or initiates a  
new action1 process1 or proc$ure on an  
in=mation sy/em or in=mation /or$ on1   
process$ by1 or transit+ su* in=mation  
sy/em n own$ by-- 7,a7 ! private entity 
op]at+ su* def5sive measure2 or  7,b7 a 

non-,f$]al entity or a ,f$]al entity t  
has provid$ writt5 au?orization to t    
private entity = op]ation ( su* def5sive
 measure on ! in=mation sy/em or        
in=mation ( ! entity 9 accordance ) ?is 
subsection4  7#c7 ,con/ruction ,no?+ 9  
?is subsection %all be con/ru$--  7,a7  
to au?orize ! use ( a def5sive measure  
o!r ?an z provid$ 9 ?is subsection2 or  
7,b7 to limit o!rwise lawful activity4  
7c7 ,au?orization = %>+ or receiv+ cyb] 
?reat indicators or def5sive measures   
7#a7 ,9 g5]al ,except z provid$ 9       
p>agraph 7#b7 & not)/&+ any o!r         
provision ( law1 a non-,f$]al entity    
may1 = a cyb]security purpose & consi/5t
 ) ! requirem5t "u subsection 7d77#b7 to
 remove p]sonal in=mation ( or in=mation
 id5tify+ a specific p]son n directly   
relat$ to a cyb]security ?reat & !      
protection ( classifi$ in=mation-- 7,a7 
%>e a lawfully obta9$ cyb] ?reat        
indicator or def5sive measure ) any o!r 
non-,f$]al entity or an appropriate     
,f$]al entity 7o!r ?an ! ,dep>tm5t (    

,def5se or any compon5t ( ! ,dep>tm5t1  
includ+ ! ,national ,security ,ag5cy72 &
  7,b7 receive a cyb] ?reat indicator or
 def5sive measure f any o!r non-,f$]al  
entity or an appropriate ,f$]al entity4 
7#b7 ,lawful re/riction ,a non-,f$]al   
entity receiv+ a cyb] ?reat indicator or
 def5sive measure f ano!r non-,f$]al    
entity or a ,f$]al entity %all comply ) 
o!rwise lawful re/rictions plac$ on !   
%>+ or use ( su* cyb] ?reat indicator or
 def5sive measure by ! %>+ non-,f$]al   
entity or ,f$]al entity4  7#c7          
,con/ruction ,no?+ 9 ?is subsection %all
 be con/ru$ to-- 7,a7 au?orize ! %>+ or 
receiv+ ( a cyb] ?reat indicator or     
def5sive measure o!r ?an z provid$ 9 ?is
 subsection2  7,b7 au?orize ! %>+ or    
receiv+ ( classifi$ in=mation by or )   
any p]son n au?oriz$ to access su*      
classifi$ in=mation2  7,c7 prohibit any 
,f$]al entity f engag+ 9 =mal or in=mal 
te*nical discussion reg>d+ cyb] ?reat   
indicators or def5sive measures ) a     
non-,f$]al entity or f provid+ te*nical 

assi/ance to address vuln]abilities or  
mitigate ?reats at ! reque/ ( su* an    
entity2  7,d7 limit o!rwise lawful      
activity2  7,e7 prohibit a non-,f$]al   
entity1 if au?oriz$ by applicable law or
 regulation o!r ?an ?is ,act1 f %>+ a   
cyb] ?reat indicator or def5sive measure
 ) ! ,dep>tm5t ( ,def5se or any compon5t
 ( ! ,dep>tm5t1 includ+ ! ,national     
,security ,ag5cy2 or  7,f7 au?orize !   
,f$]al ,gov]nm5t to conduct surveillance
 ( any p]son4  7d7 ,protection & use (  
in=mation  7#a7 ,security ( in=mation ,a
 non-,f$]al entity monitor+ an in=mation
 sy/em1 op]at+ a def5sive measure1 or   
provid+ or receiv+ a cyb] ?reat         
indicator or def5sive measure "u ?is    
section %all implem5t an appropriate    
security control to protect aga9/       
unau?oriz$ access to1 or acquisition (1 
su* cyb] ?reat indicator or def5sive    
measure4  7#b7 ,removal ( c]ta9 p]sonal 
in=mation ,a non-,f$]al entity %>+ a    
cyb] ?reat indicator pursuant to ?is    
,act %all1 prior to su* %>+1 take       

reasonable ef=ts to-- 7,a7 review su*   
cyb] ?reat indicator to assess :e!r su* 
cyb] ?reat indicator conta9s any        
in=mation t ! non-,f$]al entity         
reasonably believes at ! "t ( %>+ to be 
p]sonal in=mation ( or in=mation        
id5tify+ a specific p]son n directly    
relat$ to a cyb]security ?reat & remove 
su* in=mation2 or  7,b7 implem5t a      
te*nical capability configur$ to remove 
any in=mation conta9$ )9 su* indicator t
 ! non-,f$]al entity reasonably believes
 at ! "t ( %>+ to be p]sonal in=mation (
 or in=mation id5tify+ a specific p]son 
n directly relat$ to a cyb]security     
?reat4  7#c7 ,use ( cyb] ?reat          
indicators & def5sive measures by       
non-,f$]al entities ,a non-,f$]al entity
 may1 = a cyb]security purpose--  7,a7  
use a cyb] ?reat indicator or def5sive  
measure %>$ or receiv$ "u ?is section to
 monitor or op]ate a def5sive measure   
on-- 7i7 an in=mation sy/em ( su*       
non-,f$]al entity2 or  7ii7 an in=mation
 sy/em ( ano!r non-,f$]al entity or a   

,f$]al entity ^u ! writt5 au?orization (
 t o!r non-,f$]al entity or t ,f$]al    
entity2 &  7,b7 o!rwise use1 reta91 &   
fur!r %>e su* cyb] ?reat indicator or   
def5sive measure subject to--  7i7 an   
o!rwise lawful re/riction plac$ by ! %>+
 non-,f$]al entity or ,f$]al entity on  
su* cyb] ?reat indicator or def5sive    
measure2 or  7ii7 an o!rwise applicable 
provision ( law4  7#d7 ,use ( cyb] ?reat
 indicators by ,/ate1 tribal1 or local  
gov]nm5t  7,a7 ,law en=cem5t use ,a     
,/ate1 tribal1 or local gov]nm5t may use
 a cyb] ?reat indicator %>$ ) su* ,/ate1
 tribal1 or local gov]nm5t = ! purposes 
describ$ 9 clauses 7i71 7ii71 & 7iii7 ( 
section #d7;d77#e77;,a74  7,b7          
,exemption f disclosure ,a cyb] ?reat   
indicator %>$ ) a ,/ate1 tribal1 or     
local gov]nm5t "u ?is section %all be-- 
7i7 deem$ volunt>ily %>$ in=mation2 &   
7ii7 exempt f disclosure "u any ,/ate1  
tribal1 or local law requir+ disclosure 
( in=mation or records1 except z o!rwise
 requir$ by applicable ,/ate1 tribal1 or

 local law requir+ disclosure 9 any     
crim9al prosecution4  7e7 ,no "r or     
b5efit ,! %>+ ( a cyb] ?reat indicator )
 a non-,f$]al entity "u ?is ,act %all n 
create a "r or b5efit to simil>         
in=mation by su* non-,f$]al entity or   
any o!r non-,f$]al entity4  #d4 ,%>+ (  
cyb] ?reat indicators & def5sive        
measures ) appropriate ,f$]al entities  
o!r ?an ! ,dep>tm5t ( ,def5se or !      
,national ,security ,ag5cy  7a7         
,requirem5t = policies & proc$ures  7#a7
 ,9 g5]al ,section #aaa ( ! ,national   
,security ,act ( #aidg1 z ins]t$ by     
section #b ( ?is ,act1 is am5d$--  7,a7 
by r$esignat+ subsection 7b7 z          
subsection 7c72 &  7,b7 by ins]t+ aft]  
subsection 7a7 ! foll[+ new subsection3 
7b7 ,policies & proc$ures = %>+ ) !     
appropriate ,f$]al entities o!r ?an !   
,dep>tm5t ( ,def5se or ! ,national      
,security ,ag5cy  7#a7 ,e/abli%m5t ,!   
,presid5t %all develop & submit to      
,congress policies & proc$ures relat+ to
 ! receipt ( cyb] ?reat indicators &    

def5sive measures by ! ,f$]al ,gov]nm5t4
  7#b7 ,requirem5ts conc]n+ policies &  
proc$ures ,! policies & proc$ures       
requir$ "u p>agraph 7#a7 %all--  7,a7 be
 develop$ 9 accordance ) ! privacy &    
civil lib]ties guidel9es requir$ "u     
section #d7;b7 ( ! ,protect+ ,cyb]      
,networks ,act2  7,b7 ensure t--  7i7 a 
cyb] ?reat indicator %>$ by a non-,f$]al
 entity ) an appropriate ,f$]al entity  
7o!r ?an ! ,dep>tm5t ( ,def5se or any   
compon5t ( ! ,dep>tm5t1 includ+ !       
,national ,security ,ag5cy7 pursuant to 
section #c ( su* ,act is %>$ 9 real-"t )
 all ( ! appropriate ,f$]al entities    
7includ+ all relevant compon5ts !re(72  
7ii7 ! %>+ ( su* cyb] ?reat indicator ) 
appropriate ,f$]al entities is n subject
 to any delay1 modification1 or any o!r 
action )\t good cause t c\ld imp$e      
receipt by all ( ! appropriate ,f$]al   
entities2 &  7iii7 su* cyb] ?reat       
indicator is provid$ to ea* o!r ,f$]al  
entity to :i* su* cyb] ?reat indicator  
is relevant2 &  7,c7 ensure !re--  7i7  

is an audit capability2 &  7ii7 are     
appropriate sanctions 9 place = (fic]s1 
employees1 or ag5ts ( a ,f$]al entity :o
 kn[+ly & willfully use a cyb] ?reat    
indicator or def5se measure %>$ ) !     
,f$]al ,gov]nm5t by a non-,f$]al entity 
"u ! ,protect+ ,cyb] ,networks ,act o!r 
?an 9 accordance ) ?is section & su*    
,act4  4  7#b7 ,submission ,! ,presid5t 
%all submit to ,congress-- 7,a7 n lat]  
?an #ij days aft] ! date ( ! enactm5t ( 
?is ,act1 int]im policies & proc$ures   
requir$ "u section #aaa7;b77#a7 ( !     
,national ,security ,act ( #aidg1 z     
ins]t$ by p>agraph 7#a7 ( ?is section2 &
  7,b7 n lat] ?an #ahj days aft] su*    
date1 f9al policies & proc$ures requir$ 
"u su* section #aaa7;b77#a74  7b7       
,privacy & civil lib]ties  7#a7         
,guidel9es ( ,attorney ,g5]al ,!        
,attorney ,g5]al1 9 consultation ) !    
heads ( ! o!r appropriate ,f$]al ag5cies
 & ) (fic]s designat$ "u section #ajfb (
 ! ,intellig5ce ,re=m & ,t]rorism       
,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4  

#bjjj;ee-#a71 %all develop & p]iodically
 review guidel9es relat+ to privacy &   
civil lib]ties t gov]n ! receipt1       
ret5tion1 use1 & dissem9ation ( cyb]    
?reat indicators by a ,f$]al entity     
obta9$ 9 accordance ) ?is ,act & !      
am5dm5ts made by ?is ,act4  7#b7 ,cont5t
 ,! guidel9es develop$ & review$ "u     
p>agraph 7#a7 %all1 consi/5t ) ! ne$ to 
protect in=mation sy/ems f cyb]security 
?reats & mitigate cyb]security ?reats-- 
7,a7 limit ! impact on privacy & civil  
lib]ties ( activities by ! ,f$]al       
,gov]nm5t "u ?is ,act1 includ+ guidel9es
 to ensure t p]sonal in=mation ( or     
in=mation id5tify+ specific p]sons is   
prop]ly remov$ f in=mation receiv$1     
reta9$1 us$1 or dissem9at$ by a ,f$]al  
entity 9 accordance ) ?is ,act or !     
am5dm5ts made by ?is ,act2  7,b7 limit !
 receipt1 ret5tion1 use1 & dissem9ation 
( cyb] ?reat indicators conta9+ p]sonal 
in=mation ( or in=mation id5tify+       
specific p]sons1 includ+ by e/abli%+--  
7i7 a process = ! prompt de/ruction (   

su* in=mation t is kn[n n to be directly
 relat$ to a use = a cyb]security       
purpose2  7ii7 specific limitations on !
 l5g? ( any p]iod 9 :i* a cyb] ?reat    
indicator may be reta9$2 &  7iii7 a     
process to in=m recipi5ts t su*         
indicators may only be us$ = a          
cyb]security purpose2  7,c7 include     
requirem5ts to safegu>d cyb] ?reat      
indicators conta9+ p]sonal in=mation (  
or id5tify+ specific p]sons f unau?oriz$
 access or acquisition1 includ+         
appropriate sanctions = activities by   
(fic]s1 employees1 or ag5ts ( ! ,f$]al  
,gov]nm5t 9 contrav5tion ( su*          
guidel9es2  7,d7 include proc$ures =    
notify+ non-,f$]al entities & ,f$]al    
entities if in=mation receiv$ pursuant  
to ?is section is kn[n or det]m9$ by a  
,f$]al entity receiv+ su* in=mation n to
 con/itute a cyb] ?reat indicator2  7,e7
 be consi/5t ) any o!r applicable       
provisions ( law & ! fair in=mation     
practice pr9ciples set =? 9 app5dix ,a (
 ! docum5t entitl$ ,national ,/rategy = 

,tru/$ ,id5tities 9 ,cyb]space & publi%$
 by ! ,presid5t 9 ,april1 #bjaa2 &  7,f7
 include /eps t may be ne$$ s t         
dissem9ation ( cyb] ?reat indicators is 
consi/5t ) ! protection ( classifi$     
in=mation & o!r s5sitive national       
security in=mation4  7#c7 ,submission ,!
 ,attorney ,g5]al %all submit to        
,congress-- 7,a7 n lat] ?an #ij days    
aft] ! date ( ! enactm5t ( ?is ,act1    
int]im guidel9es requir$ "u p>agraph    
7#a72 &  7,b7 n lat] ?an #ahj days aft] 
su* date1 f9al guidel9es requir$ "u su* 
p>agraph4  7c7 ,national ,cyb] ,?reat   
,intellig5ce ,integration ,c5t]  7#a7   
,e/abli%m5t ,title ,i ( ! ,national     
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjba et seq471 z am5d$ by section #b ( 
?is ,act1 is fur!r am5d$--  7,a7 by     
r$esignat+ section #aai;,b z section    
#aai;,c2 &  7,b7 by ins]t+ aft] section 
#aai;,a ! foll[+ new section3  #aai;,b4 
,cyb] ,?reat ,intellig5ce ,integration  
,c5t]  7a7 ,e/abli%m5t ,!re is )9 !     
,(fice ( ! ,director ( ,national        

,intellig5ce a ,cyb] ,?reat ,intellig5ce
 ,integration ,c5t]4  7b7 ,director ,!re
 is a ,director ( ! ,cyb] ,?reat        
,intellig5ce ,integration ,c5t]1 :o %all
 be ! head ( ! ,cyb] ,?reat ,intellig5ce
 ,integration ,c5t]1 & :o %all be       
appo9t$ by ! ,director ( ,national      
,intellig5ce4  7c7 ,prim>y missions ,!  
,cyb] ,?reat ,intellig5ce ,integration  
,c5t] %all-- 7#a7 s]ve z ! prim>y       
organization )9 ! ,f$]al ,gov]nm5t =    
analyz+ & integrat+ all intellig5ce     
possess$ or acquir$ by ! ,unit$ ,/ates  
p]ta9+ to cyb] ?reats2  7#b7 ensure t   
appropriate dep>tm5ts & ag5cies h full  
access to & receive all-s\rce           
intellig5ce support ne$$ to execute !   
cyb] ?reat intellig5ce activities ( su* 
ag5cies & to p]=m indep5d5t1 alt]native 
analyses2  7#c7 dissem9ate cyb] ?reat   
analysis to ! ,presid5t1 ! appropriate  
dep>tm5ts & ag5cies ( ! ,f$]al          
,gov]nm5t1 & ! appropriate committees ( 
,congress2  7#d7 coord9ate cyb] ?reat   
intellig5ce activities ( ! dep>tm5ts &  

ag5cies ( ! ,f$]al ,gov]nm5t2 &  7#e7   
conduct /rategic cyb] ?reat intellig5ce 
plann+ = ! ,f$]al ,gov]nm5t4  7d7       
,limitations ,! ,cyb] ,?reat            
,intellig5ce ,integration ,c5t] %all--  
7#a7 h n m ?an #ej p]man5t positions2   
7#b7 9 c>ry+ out ! prim>y missions ( !  
,c5t] describ$ 9 subsection 7c71 may n  
augm5t /aff+ ?r\gh detailees1 assignees1
 or core contractor p]sonnel or ent]    
into any p]sonal s]vices contracts to   
exce$ ! limitation "u p>agraph 7#a72 &  
7#c7 be locat$ 9 a build+ own$ or op]at$
 by an elem5t ( ! intellig5ce community 
z ( ! date ( ! enactm5t ( ?is section4  
4  7#b7 ,table ( cont5ts am5dm5ts ,!    
table ( cont5ts 9 ! fir/ section ( !    
,national ,security ,act ( #aidg1 z     
am5d$ by section #b ( ?is ,act1 is fur!r
 am5d$ by /rik+ ! item relat+ to section
 #aai;,b & ins]t+ ! foll[+ new items3   
,sec4 #aai;,b4 ,cyb] ,?reat ,intellig5ce
 ,integration ,c5t]4 ,sec4 #aai;,c4     
,national intellig5ce c5t]s4  4  7d7    
,in=mation %>$ ) or provid$ to ! ,f$]al 

,gov]nm5t  7#a7 ,no waiv] ( privilege or
 protection ,! provision ( a cyb] ?reat 
indicator or def5sive measure to !      
,f$]al ,gov]nm5t "u ?is ,act %all n     
con/itute a waiv] ( any applicable      
privilege or protection provid$ by law1 
includ+ trade secret protection4  7#b7  
,propriet>y in=mation ,consi/5t )       
section #c7;c77#b71 a cyb] ?reat        
indicator or def5sive measure provid$ by
 a non-,f$]al entity to ! ,f$]al        
,gov]nm5t "u ?is ,act %all be consid]$ !
 comm]cial1 f9ancial1 & propriet>y      
in=mation ( ! non-,f$]al entity t is !  
orig9ator ( su* cyb] ?reat indicator or 
def5sive measure :5 s designat$ by su*  
non-,f$]al entity or a non-,f$]al entity
 act+ 9 accordance ) ! writt5           
au?orization ( ! non-,f$]al entity t is 
! orig9ator ( su* cyb] ?reat indicator  
or def5sive measure4  7#c7 ,exemption f 
disclosure ,a cyb] ?reat indicator or   
def5sive measure provid$ to ! ,f$]al    
,gov]nm5t "u ?is ,act %all be--  7,a7   
deem$ volunt>ily %>$ in=mation & exempt 

f disclosure "u section #eeb ( title #e1
 ,unit$ ,/ates ,code1 & any ,/ate1      
tribal1 or local law requir+ disclosure 
( in=mation or records2 &  7,b7 )held1  
)\t discretion1 f ! public "u section   
#eeb7;b77#c77;,b7 ( title #e1 ,unit$    
,/ates ,code1 & any ,/ate1 tribal1 or   
local provision ( law requir+ disclosure
 ( in=mation or records1 except z       
o!rwise requir$ by applicable ,f$]al1   
,/ate1 tribal1 or local law requir+     
disclosure 9 any crim9al prosecution4   
7#d7 ,ex p>te communications ,!         
provision ( a cyb] ?reat indicator or   
def5sive measure to ! ,f$]al ,gov]nm5t  
"u ?is ,act %all n be subject to a rule 
( any ,f$]al dep>tm5t or ag5cy or any   
judicial doctr9e reg>d+ ex p>te         
communications ) a decision-mak+        
(ficial4  7#e7 ,disclosure1 ret5tion1 & 
use  7,a7 ,au?oriz$ activities ,a cyb]  
?reat indicator or def5sive measure     
provid$ to ! ,f$]al ,gov]nm5t "u ?is    
,act may be disclos$ to1 reta9$ by1 &   
us$ by1 consi/5t ) o!rwise applicable   

provisions ( ,f$]al law1 any dep>tm5t1  
ag5cy1 compon5t1 (fic]1 employee1 or    
ag5t ( ! ,f$]al ,gov]nm5t solely =--    
7i7 a cyb]security purpose2  7ii7 !     
purpose ( respond+ to1 prosecut+1 or    
o!rwise prev5t+ or mitigat+ a ?reat (   
dea? or s]i\s bodily h>m or an (f5se    
aris+ out ( su* a ?reat2  7iii7 !       
purpose ( respond+ to1 or o!rwise       
prev5t+ or mitigat+1 a s]i\s ?reat to a 
m9or1 includ+ sexual exploitation &     
?reats to physical safety2 or  7iv7 !   
purpose ( prev5t+1 inve/igat+1 disrupt+1
 or prosecut+ any ( ! (f5ses li/$ 9     
sections #ajbh1 #ajbi1 #ajcj1 &         
#ceei7;c77#b77;,f7 & *apt]s #cg & #ij ( 
title #ah1 ,unit$ ,/ates ,code4  7,b7   
,prohibit$ activities ,a cyb] ?reat     
indicator or def5sive measure provid$ to
 ! ,f$]al ,gov]nm5t "u ?is ,act %all n  
be disclos$ to1 reta9$ by1 or us$ by any
 ,f$]al dep>tm5t or ag5cy = any use n   
p]mitt$ "u subp>agraph 7,a74  7,c7      
,privacy & civil lib]ties ,a cyb] ?reat 
indicator or def5sive measure provid$ to

 ! ,f$]al ,gov]nm5t "u ?is ,act %all be 
reta9$1 us$1 & dissem9at$ by ! ,f$]al   
,gov]nm5t 9 accordance )--  7i7 !       
policies & proc$ures relat+ to ! receipt
 ( cyb] ?reat indicators & def5sive     
measures by ! ,f$]al ,gov]nm5t requir$  
by subsection 7b7 ( section #aaa ( !    
,national ,security ,act ( #aidg1 z add$
 by subsection 7a7 ( ?is section2 &     
7ii7 ! privacy & civil lib]ties         
guidel9es requir$ by subsection 7b74    
#e4 ,f$]al ,gov]nm5t liability =        
violations ( privacy or civil lib]ties  
7a7 ,9 g5]al ,if a dep>tm5t or ag5cy ( !
 ,f$]al ,gov]nm5t int5tionally or       
willfully violates ! privacy & civil    
lib]ties guidel9es issu$ by ! ,attorney 
,g5]al "u section #d7;b71 ! ,unit$      
,/ates %all be liable to a p]son injur$ 
by su* violation 9 an am\nt equal to !  
sum (-- 7#a7 ! actual damages su/a9$ by 
! p]son z a result ( ! violation or     
#a1jjj1 :i*ev] is great]2 &  7#b7       
reasonable attorney fees z det]m9$ by ! 
c\rt & o!r litigation co/s reasonably   

incurr$ 9 any case "u ?is subsection 9  
:i* ! compla9ant has sub/antially       
prevail$4  7b7 ,v5ue ,an action to en=ce
 liability creat$ "u ?is section may be 
br\ght 9 ! di/rict c\rt ( ! ,unit$      
,/ates 9--  7#a7 ! di/rict 9 :i* !      
compla9ant resides2  7#b7 ! di/rict 9   
:i* ! pr9cipal place ( bus9ess ( !      
compla9ant is locat$2  7#c7 ! di/rict 9 
:i* ! dep>tm5t or ag5cy ( ! ,f$]al      
,gov]nm5t t violat$ su* privacy & civil 
lib]ties guidel9es is locat$2 or  7#d7 !
 ,di/rict ( ,columbia4  7c7 ,/atute (   
limitations ,no action %all lie "u ?is  
subsection unless su* action is comm5c$ 
n lat] ?an two ye>s aft] ! date ( !     
violation ( ! privacy & civil lib]ties  
guidel9es issu$ by ! ,attorney ,g5]al "u
 section #d7;b7 t is ! basis = ! action4
  7d7 ,exclusive cause ( action ,a cause
 ( action "u ?is subsection %all be !   
exclusive means available to a          
compla9ant seek+ a rem$y = a violation  
by a dep>tm5t or ag5cy ( ! ,f$]al       
,gov]nm5t "u ?is ,act4  #f4 ,protection 

f liability  7a7 ,monitor+ ( in=mation  
sy/ems ,no cause ( action %all lie or be
 ma9ta9$ 9 any c\rt aga9/ any private   
entity1 & su* action %all be promptly   
dismiss$1 = ! monitor+ ( an in=mation   
sy/em & in=mation "u section #c7;a7 t is
 conduct$ 9 good fai? 9 accordance ) ?is
 ,act & ! am5dm5ts made by ?is ,act4    
7b7 ,%>+ or receipt ( cyb] ?reat        
indicators ,no cause ( action %all lie  
or be ma9ta9$ 9 any c\rt aga9/ any      
non-,f$]al entity1 & su* action %all be 
promptly dismiss$1 = ! %>+ or receipt ( 
a cyb] ?reat indicator or def5sive      
measure "u section #c7;c71 or a good    
fai? failure to act bas$ on su* %>+ or  
receipt1 if su* %>+ or receipt is       
conduct$ 9 good fai? 9 accordance ) ?is 
,act & ! am5dm5ts made by ?is ,act4  7c7
 ,willful misconduct  7#a7 ,rule (      
con/ruction ,no?+ 9 ?is section %all be 
con/ru$-- 7,a7 to require dismissal ( a 
cause ( action aga9/ a non-,f$]al entity
 7includ+ a private entity7 t has engag$
 9 willful misconduct 9 ! c\rse (       

conduct+ activities au?oriz$ by ?is ,act
 or ! am5dm5ts made by ?is ,act2 or     
7,b7 to und]m9e or limit ! availability 
( o!rwise applicable common law or      
/atutory def5ses4  7#b7 ,pro( ( willful 
misconduct ,9 any action claim+ t       
subsection 7a7 or 7b7 does n apply due  
to willful misconduct describ$ 9        
p>agraph 7#a71 ! pla9tiff %all h ! burd5
 ( prov+ by cle> & conv9c+ evid5ce !    
willful misconduct by ea* non-,f$]al    
entity subject to su* claim & t su*     
willful misconduct proximately caus$    
injury to ! pla9tiff4  7#c7 ,willful    
misconduct def9$ ,9 ?is subsection1 !   
t]m willful misconduct means an act or  
omission t is tak5-- 7,a7 int5tionally  
to a*ieve a wrongful purpose2  7,b7     
kn[+ly )\t legal or factual             
ju/ification2 &  7,c7 9 disreg>d ( a    
kn[n or obvi\s risk t is s great z to   
make x highly probable t ! h>m w        
outweigh ! b5efit4  #g4 ,ov]sight (     
,gov]nm5t activities  7a7 ,bi5nial      
report on implem5tation  7#a7 ,9 g5]al  

,section #aaa ( ! ,national ,security   
,act ( #aidg1 z add$ by section #b7;a7 &
 am5d$ by section #d7;a7 ( ?is ,act1 is 
fur!r am5d$-- 7,a7 by r$esignat+        
subsection 7c7 7z r$esignat$ by su*     
section #d7;a77 z subsection 7d72 &     
7,b7 by ins]t+ aft] subsection 7b7 7z   
ins]t$ by su* section #d7;a77 ! foll[+  
new subsection3  7c7 ,bi5nial report on 
implem5tation  7#a7 ,9 g5]al ,n less    
frequ5tly ?an once e two ye>s1 !        
,director ( ,national ,intellig5ce1 9   
consultation ) ! heads ( ! o!r          
appropriate ,f$]al entities1 %all submit
 to ,congress a report conc]n+ !        
implem5tation ( ?is section & !         
,protect+ ,cyb] ,networks ,act4  7#b7   
,cont5ts ,ea* report submitt$ "u        
p>agraph 7#a7 %all include ! foll[+3    
7,a7 ,an assessm5t ( ! suffici5cy ( !   
policies1 proc$ures1 & guidel9es requir$
 by ?is section & section #d ( !        
,protect+ ,cyb] ,networks ,act 9 ensur+ 
t cyb] ?reat indicators are %>$         
effectively & responsibly )9 ! ,f$]al   

,gov]nm5t4  7,b7 ,an assessm5t ( :e!r ! 
proc$ures develop$ "u section #c ( su*  
,act comply ) ! goals describ$ 9        
subp>agraphs 7,a71 7,b71 & 7,c7 (       
subsection 7a77#a74  7,c7 ,an assessm5t 
( :e!r cyb] ?reat indicators h be5      
prop]ly classifi$ & an acc\nt+ ( ! numb]
 ( security cle>ances au?oriz$ by !     
,f$]al ,gov]nm5t = ! purposes ( ?is     
section & su* ,act4  7,d7 ,a review ( ! 
type ( cyb] ?reat indicators %>$ ) !    
,f$]al ,gov]nm5t "u ?is section & su*   
,act1 includ+ ! foll[+3 7i7 ,! degree to
 :i* su* in=mation may impact ! privacy 
& civil lib]ties ( specific p]sons4     
7ii7 ,a quantitative & qualitative      
assessm5t ( ! impact ( ! %>+ ( su* cyb] 
?reat indicators ) ! ,f$]al ,gov]nm5t on
 privacy & civil lib]ties ( specific    
p]sons4  7iii7 ,! adequacy ( any /eps   
tak5 by ! ,f$]al ,gov]nm5t to r$uce su* 
impact4  7,e7 ,a review ( actions tak5  
by ! ,f$]al ,gov]nm5t bas$ on cyb] ?reat
 indicators %>$ ) ! ,f$]al ,gov]nm5t "u 
?is section or su* ,act1 includ+ !      

appropriat5ess ( any subsequ5t use or   
dissem9ation ( su* cyb] ?reat indicators
 by a ,f$]al entity "u ?is section or   
section #d ( su* ,act4  7,f7 ,a         
description ( any significant violations
 ( ! requirem5ts ( ?is section or su*   
,act by ! ,f$]al ,gov]nm5t--  7i7 an    
assessm5t ( all reports ( (fic]s1       
employees1 & ag5ts ( ! ,f$]al ,gov]nm5t 
misus+ in=mation provid$ to ! ,f$]al    
,gov]nm5t "u ! ,protect+ ,cyb] ,networks
 ,act or ?is section1 )\t reg>d to :e!r 
! misuse 0 kn[+ or wilful2 &  7ii7 an   
assessm5t ( all discipl9>y actions tak5 
aga9/ su* (fic]s1 employees1 & ag5ts4   
7,g7 ,a summ>y ( ! numb] & type (       
non-,f$]al entities t receiv$ classifi$ 
cyb] ?reat indicators f ! ,f$]al        
,gov]nm5t "u ?is section or su* ,act &  
an evaluation ( ! risks & b5efits ( %>+ 
su* cyb] ?reat indicators4  7,h7 ,an    
assessm5t ( any p]sonal in=mation ( or  
in=mation id5tify+ a specific p]son n   
directly relat$ to a cyb]security ?reat 
t--  7i7 0 %>$ by a non-,f$]al entity ) 

! ,f$]al ,gov]nm5t "u ?is ,act 9        
contrav5tion ( section #c7;d77#b72 or   
7ii7 0 %>$ )9 ! ,f$]al ,gov]nm5t "u ?is 
,act 9 contrav5tion ( ! guidel9es       
requir$ by section #d7;b74  7#c7        
,recomm5dations ,ea* report submitt$ "u 
p>agraph 7#a7 may include su*           
recomm5dations z ! heads ( ! appropriate
 ,f$]al entities may h = improvem5ts or 
modifications to ! au?orities &         
processes "u ?is section or su* ,act4   
7#d7 ,=m ( report ,ea* report requir$ by
 p>agraph 7#a7 %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  7#e7 ,public          
availability ( reports ,! ,director (   
,national ,intellig5ce %all make        
publicly available ! unclassifi$ portion
 ( ea* report requir$ by p>agraph 7#a74 
4  7#b7 ,initial report ,! fir/ report  
requir$ "u subsection 7c7 ( section #aaa
 ( ! ,national ,security ,act ( #aidg1 z
 ins]t$ by p>agraph 7#a7 ( ?is          
subsection1 %all be submitt$ n lat] ?an 
"o ye> aft] ! date ( ! enactm5t ( ?is   

,act4  7b7 ,reports on privacy & civil  
lib]ties  7#a7 ,bi5nial report f        
,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d  7,a7 ,9 g5]al ,section #ajfa7;e7 
( ! ,intellig5ce ,re=m & ,t]rorism      
,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4  
#bjjj;ee7e77 is am5d$ by add+ at ! end !
 foll[+ new p>agraph3  7#c7 ,bi5nial    
report on c]ta9 cyb] activities  7,a7   
,report requir$ ,! ,privacy & ,civil    
,lib]ties ,ov]sight ,bo>d %all bi5nially
 submit to ,congress & ! ,presid5t a    
report conta9+--  7i7 an assessm5t ( !  
privacy & civil lib]ties impact ( !     
activities c>ri$ out "u ! ,protect+     
,cyb] ,networks ,act & ! am5dm5ts made  
by su* ,act2 &  7ii7 an assessm5t ( !   
suffici5cy ( ! policies1 proc$ures1 &   
guidel9es e/abli%$ pursuant to section  
#d ( ! ,protect+ ,cyb] ,networks ,act & 
! am5dm5ts made by su* section #d 9     
address+ privacy & civil lib]ties       
conc]ns4  7,b7 ,recomm5dations ,ea*     
report submitt$ "u ?is p>agraph may     
include su* recomm5dations z ! ,privacy 

& ,civil ,lib]ties ,ov]sight ,bo>d may h
 = improvem5ts or modifications to !    
au?orities "u ! ,protect+ ,cyb]         
,networks ,act or ! am5dm5ts made by su*
 ,act4  7,c7 ,=m ,ea* report requir$ "u 
?is p>agraph %all be submitt$ 9         
unclassifi$ =m1 b may include a         
classifi$ annex4  7,d7 ,public          
availability ( reports ,! ,privacy &    
,civil ,lib]ties ,ov]sight ,bo>d %all   
make publicly available ! unclassifi$   
portion ( ea* report requir$ by         
subp>agraph 7,a74  4  7,b7 ,initial     
report ,! fir/ report requir$ "u        
p>agraph 7#c7 ( section #ajfa7;e7 ( !   
,intellig5ce ,re=m & ,t]rorism          
,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4  
#bjjj;ee7e771 z add$ by subp>agraph 7,a7
 ( ?is p>agraph1 %all be submitt$ n lat]
 ?an #b ye>s aft] ! date ( ! enactm5t ( 
?is ,act4  7#b7 ,bi5nial report (       
,inspectors g5]al  7,a7 ,9 g5]al ,n lat]
 ?an #b ye>s aft] ! date ( ! enactm5t ( 
?is ,act & n less frequ5tly ?an once e  
#b ye>s !reaft]1 ! ,inspector ,g5]al ( !

 ,dep>tm5t ( ,homel& ,security1 !       
,inspector ,g5]al ( ! ,intellig5ce      
,community1 ! ,inspector ,g5]al ( !     
,dep>tm5t ( ,ju/ice1 & ! ,inspector     
,g5]al ( ! ,dep>tm5t ( ,def5se1 9       
consultation ) ! ,c\ncil ( ,inspectors  
,g5]al on ,f9ancial ,ov]sight1 %all     
jo9tly submit to ,congress a report on !
 receipt1 use1 & dissem9ation ( cyb]    
?reat indicators & def5sive measures t h
 be5 %>$ ) ,f$]al entities "u ?is ,act &
 ! am5dm5ts made by ?is ,act4  7,b7     
,cont5ts ,ea* report submitt$ "u        
subp>agraph 7,a7 %all include ! foll[+3 
7i7 ,a review ( ! types ( cyb] ?reat    
indicators %>$ ) ,f$]al entities4  7ii7 
,a review ( ! actions tak5 by ,f$]al    
entities z a result ( ! receipt ( su*   
cyb] ?reat indicators4  7iii7 ,a li/ (  
,f$]al entities receiv+ su* cyb] ?reat  
indicators4  7iv7 ,a review ( ! %>+ (   
su* cyb] ?reat indicators among ,f$]al  
entities to id5tify inappropriate b>ri]s
 to %>+ in=mation4  7,c7 ,recomm5dations
 ,ea* report submitt$ "u ?is p>agraph   

may include su* recomm5dations z !      
,inspectors ,g5]al ref]r$ to 9          
subp>agraph 7,a7 may h = improvem5ts or 
modifications to ! au?orities "u ?is    
,act or ! am5dm5ts made by ?is ,act4    
7,d7 ,=m ,ea* report requir$ "u ?is     
p>agraph %all be submitt$ 9 unclassifi$ 
=m1 b may include a classifi$ annex4    
7,e7 ,public availability ( reports ,!  
,inspector ,g5]al ( ! ,dep>tm5t (       
,homel& ,security1 ! ,inspector ,g5]al (
 ! ,intellig5ce ,community1 ! ,inspector
 ,g5]al ( ! ,dep>tm5t ( ,ju/ice1 & !    
,inspector ,g5]al ( ! ,dep>tm5t (       
,def5se %all make publicly available !  
unclassifi$ portion ( ea* report requir$
 "u subp>agraph 7,a74  #h4 ,report on   
cyb]security ?reats  7a7 ,report requir$
 ,n lat] ?an #ahj days aft] ! date ( !  
enactm5t ( ?is ,act1 ! ,director (      
,national ,intellig5ce1 9 consultation )
 ! heads ( o!r appropriate elem5ts ( !  
intellig5ce community1 %all submit to ! 
,select ,committee on ,intellig5ce ( !  
,s5ate & ! ,p]man5t ,select ,committee  

on ,intellig5ce ( ! ,h\se (             
,repres5tatives a report on cyb]security
 ?reats1 includ+ cyb] attacks1 !ft1 &   
data brea*es4  7b7 ,cont5ts ,! report   
requir$ by subsection 7a7 %all include !
 foll[+3 7#a7 ,an assessm5t (--  7,a7 ! 
curr5t intellig5ce %>+ & coop]ation     
relation%ips ( ! ,unit$ ,/ates ) o!r    
c\ntries reg>d+ cyb]security ?reats     
7includ+ cyb] attacks1 !ft1 & data      
brea*es7 direct$ aga9/ ! ,unit$ ,/ates t
 ?reat5 ! ,unit$ ,/ates national        
security int]e/s1 economy1 &            
intellectual prop]ty2 &  7,b7 ! relative
 utility ( su* relation%ips1 :i* elem5ts
 ( ! intellig5ce community p>ticipate 9 
su* relation%ips1 & :e!r & h[ su*       
relation%ips c\ld be improv$4  7#b7 ,a  
li/ & an assessm5t ( ! c\ntries &       
non-/ate actors t are ! prim>y ?reats ( 
c>ry+ out a cyb]security ?reat 7includ+ 
a cyb] attack1 !ft1 or data brea*7 aga9/
 ! ,unit$ ,/ates & t ?reat5 ! ,unit$    
,/ates national security1 economy1 &    
intellectual prop]ty4  7#c7 ,a          

description ( ! ext5t to :i* !          
capabilities ( ! ,unit$ ,/ates ,gov]nm5t
 to respond to or prev5t cyb]security   
?reats 7includ+ cyb] attacks1 !ft1 or   
data brea*es7 direct$ aga9/ ! ,unit$    
,/ates private sector are degrad$ by a  
delay 9 ! prompt notification by private
 entities ( su* ?reats or cyb] attacks1 
!ft1 & brea*es4  7#d7 ,an assessm5t (   
additional te*nologies or capabilities t
 w\ld enhance ! ability ( ! ,unit$      
,/ates to prev5t & to respond to        
cyb]security ?reats 7includ+ cyb]       
attacks1 !ft1 & data brea*es74  7#e7 ,an
 assessm5t ( any te*nologies or         
practices utiliz$ by ! private sector t 
c\ld be rapidly field$ to assi/ !       
intellig5ce community 9 prev5t+ &       
respond+ to cyb]security ?reats4  7c7   
,=m ( report ,! report requir$ by       
subsection 7a7 %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  7d7 ,public           
availability ( report ,! ,director (    
,national ,intellig5ce %all make        

publicly available ! unclassifi$ portion
 ( ! report requir$ by subsection 7a74  
7e7 ,intellig5ce community def9$ ,9 ?is 
section1 ! t]m intellig5ce community has
 ! mean+ giv5 t t]m 9 section #c ( !    
,national ,security ,act ( #aidg 7#ej   
,u4,s4,c4 #cjjc74  #i4 ,con/ruction &   
preemption  7a7 ,prohibition (          
surveillance ,no?+ 9 ?is ,act or !      
am5dm5ts made by ?is ,act %all be       
con/ru$ to au?orize ! ,dep>tm5t (       
,def5se or ! ,national ,security ,ag5cy 
or any o!r elem5t ( ! intellig5ce       
community to t>get a p]son =            
surveillance4  7b7 ,o!rwise lawful      
disclosures ,no?+ 9 ?is ,act or !       
am5dm5ts made by ?is ,act %all be       
con/ru$ to limit or prohibit-- 7#a7     
o!rwise lawful disclosures (            
communications1 records1 or o!r         
in=mation1 includ+ report+ ( kn[n or    
suspect$ crim9al activity1 by a         
non-,f$]al entity to any o!r non-,f$]al 
entity or ! ,f$]al ,gov]nm5t2 or  7#b7  
any o!rwise lawful use ( su* disclosures

 by any entity ( ! ,f$]al gov]nm5t1 )\t 
reg>d to :e!r su* o!rwise lawful        
disclosures duplicate or replicate      
disclosures made "u ?is ,act4  7c7      
,:i/le bl[] protections ,no?+ 9 ?is ,act
 or ! am5dm5ts made by ?is ,act %all be 
con/ru$ to prohibit or limit !          
disclosure ( in=mation protect$ "u      
section #bcjb7;b77#h7 ( title #e1 ,unit$
 ,/ates ,code 7gov]n+ disclosures (     
illegality1 wa/e1 fraud1 abuse1 or      
public heal? or safety ?reats71 section 
#gbaa ( title #e1 ,unit$ ,/ates ,code   
7gov]n+ disclosures to ,congress71      
section #ajcd ( title #aj1 ,unit$ ,/ates
 ,code 7gov]n+ disclosure to ,congress  
by memb]s ( ! milit>y71 or any simil>   
provision ( ,f$]al or ,/ate law44  7d7  
,protection ( s\rces & me?ods ,no?+ 9   
?is ,act or ! am5dm5ts made by ?is ,act 
%all be con/ru$-- 7#a7 z creat+ any     
immunity aga9/1 or o!rwise affect+1 any 
action br\ght by ! ,f$]al ,gov]nm5t1 or 
any dep>tm5t or ag5cy !re(1 to en=ce any
 law1 executive ord]1 or proc$ure gov]n+

 ! appropriate h&l+1 disclosure1 or use 
( classifi$ in=mation2  7#b7 to affect !
 conduct ( au?oriz$ law en=cem5t or     
intellig5ce activities2 or  7#c7 to     
modify ! au?ority ( ! ,presid5t or a    
dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t  
to protect & control ! dissem9ation (   
classifi$ in=mation1 intellig5ce s\rces 
& me?ods1 & ! national security ( !     
,unit$ ,/ates4  7e7 ,relation%ip to o!r 
laws ,no?+ 9 ?is ,act or ! am5dm5ts made
 by ?is ,act %all be con/ru$ to affect  
any requirem5t "u any o!r provision (   
law = a non-,f$]al entity to provide    
in=mation to ! ,f$]al ,gov]nm5t4  7f7   
,in=mation %>+ relation%ips ,no?+ 9 ?is 
,act or ! am5dm5ts made by ?is ,act %all
 be con/ru$--  7#a7 to limit or modify  
an exi/+ in=mation-%>+ relation%ip2     
7#b7 to prohibit a new in=mation-%>+    
relation%ip2 or  7#c7 to require a new  
in=mation-%>+ relation%ip betwe5 any    
non-,f$]al entity & ! ,f$]al ,gov]nm5t4 
7g7 ,pres]vation ( contractual          
obligations & rights ,no?+ 9 ?is ,act or

 ! am5dm5ts made by ?is ,act %all be    
con/ru$--  7#a7 to am5d1 repeal1 or     
sup]s$e any curr5t or future contractual
 agreem5t1 t]ms ( s]vice agreem5t1 or   
o!r contractual relation%ip betwe5 any  
non-,f$]al entities1 or betwe5 any      
non-,f$]al entity & a ,f$]al entity2 or 
7#b7 to abrogate trade secret or        
intellectual prop]ty rights ( any       
non-,f$]al entity or ,f$]al entity4  7h7
 ,anti-task+ re/riction ,no?+ 9 ?is ,act
 or ! am5dm5ts made by ?is ,act %all be 
con/ru$ to p]mit ! ,f$]al ,gov]nm5t--   
7#a7 to require a non-,f$]al entity to  
provide in=mation to ! ,f$]al ,gov]nm5t2
  7#b7 to condition ! %>+ ( a cyb] ?reat
 indicator ) a non-,f$]al entity on su* 
non-,f$]al entity's provision ( a cyb]  
?reat indicator to ! ,f$]al ,gov]nm5t2  
or  7#c7 to condition ! aw>d ( any      
,f$]al grant1 contract1 or pur*ase on ! 
provision ( a cyb] ?reat indicator to a 
,f$]al entity4  7i7 ,no liability =     
non-p>ticipation ,no?+ 9 ?is ,act or !  
am5dm5ts made by ?is ,act %all be       

con/ru$ to subject any non-,f$]al entity
 to liability = *oos+ n to engage 9 a   
volunt>y activiy au?oriz$ 9 ?is ,act & !
 am5dm5ts made by ?is ,act4  7j7 ,use & 
ret5tion ( in=mation ,no?+ 9 ?is ,act or
 ! am5dm5ts made by ?is ,act %all be    
con/ru$ to au?orize1 or to modify any   
exi/+ au?ority (1 a dep>tm5t or ag5cy ( 
! ,f$]al ,gov]nm5t to reta9 or use any  
in=mation %>$ "u ?is ,act or ! am5dm5ts 
made by ?is ,act = any use o!r ?an      
p]mitt$ 9 ?is ,act or ! am5dm5ts made by
 ?is ,act4  7k7 ,f$]al preemption  7#a7 
,9 g5]al ,?is ,act & ! am5dm5ts made by 
?is ,act sup]s$e any /atute or o!r      
provision ( law ( a ,/ate or political  
subdivision ( a ,/ate t re/ricts or     
o!rwise expressly regulates an activity 
au?oriz$ "u ?is ,act or ! am5dm5ts made 
by ?is ,act4  7#b7 ,/ate law en=cem5t   
,no?+ 9 ?is ,act or ! am5dm5ts made by  
?is ,act %all be con/ru$ to sup]s$e any 
/atute or o!r provision ( law ( a ,/ate 
or political subdivision ( a ,/ate      
conc]n+ ! use ( au?oriz$ law en=cem5t   

practices & proc$ures4  7l7 ,regulatory 
au?ority ,no?+ 9 ?is ,act or ! am5dm5ts 
made by ?is ,act %all be con/ru$-- 7#a7 
to au?orize ! promulgation ( any        
regulations n specifically au?oriz$ by  
?is ,act or ! am5dm5ts made by ?is ,act2
  7#b7 to e/abli% any regulatory        
au?ority n specifically e/abli%$ "u ?is 
,act or ! am5dm5ts made by ?is ,act2 or 
7#c7 to au?orize regulatory actions t   
w\ld duplicate or conflict ) regulatory 
requirem5ts1 m&atory /&>ds1 or relat$   
processes "u ano!r provision ( ,f$]al   
law4  #aj4 ,con=m+ am5dm5ts ,section    
#eeb7;b7 ( title #e1 ,unit$ ,/ates      
,code1 is am5d$-- 7#a7 9 p>agraph 7#h71 
by /rik+ or at ! end2  7#b7 9 p>agraph  
7#i71 by /rik+ wells4 & ins]t+ wells2   
or2 &  7#c7 by ins]t+ aft] p>agraph 7#i7
 ! foll[+3  7#aj7 in=mation %>$ ) or    
provid$ to ! ,f$]al ,gov]nm5t pursuant  
to ! ,protect+ ,cyb] ,networks ,act or !
 am5dm5ts made by su* ,act4  4  #aa4    
,def9itions ,9 ?is ,act3  7#a7 ,ag5cy ,!
 t]m ag5cy has ! mean+ giv5 ! t]m 9     

section #cejb ( title #dd1 ,unit$ ,/ates
 ,code4  7#b7 ,appropriate ,f$]al       
entities ,! t]m appropriate ,f$]al      
entities means ! foll[+3  7,a7 ,!       
,dep>tm5t ( ,comm]ce4  7,b7 ,! ,dep>tm5t
 ( ,def5se4  7,c7 ,! ,dep>tm5t ( ,en]gy4
  7,d7 ,! ,dep>tm5t ( ,homel& ,security4
  7,e7 ,! ,dep>tm5t ( ,ju/ice4  7,f7 ,! 
,dep>tm5t ( ! ,treasury4  7,g7 ,! ,(fice
 ( ! ,director ( ,national ,intellig5ce4
  7#c7 ,cyb]security purpose ,! t]m     
cyb]security purpose means ! purpose (  
protect+ 7includ+ ?r\gh ! use ( a       
def5sive measure7 an in=mation sy/em or 
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em f a         
cyb]security ?reat or security          
vuln]ability or id5tify+ ! s\rce ( a    
cyb]security ?reat4  7#d7 ,cyb]security 
?reat  7,a7 ,9 g5]al ,except z provid$ 9
 subp>agraph 7,b71 ! t]m cyb]security   
?reat means an action1 n protect$ by !  
fir/ am5dm5t to ! ,con/itution ( !      
,unit$ ,/ates1 on or ?r\gh an in=mation 
sy/em t may result 9 an unau?oriz$ ef=t 

to adv]sely impact ! security1          
confid5tiality1 integrity1 or           
availability ( an in=mation sy/em or    
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em4  7,b7      
,exclusion ,! t]m cyb]security ?reat    
does n include any action t solely      
involves a violation ( a consum] t]m (  
s]vice or a consum] lic5s+ agreem5t4    
7#e7 ,cyb] ?reat indicator ,! t]m cyb]  
?reat indicator means in=mation or a    
physical object t is necess>y to        
describe or id5tify-- 7,a7 malici\s     
reconnaissance1 includ+ anomal\s patt]ns
 ( communications t appe> to be         
transmitt$ = ! purpose ( ga!r+ te*nical 
in=mation relat$ to a cyb]security ?reat
 or security vuln]ability2  7,b7 a me?od
 ( defeat+ a security control or        
exploitation ( a security vuln]ability2 
7,c7 a security vuln]ability1 includ+   
anomal\s activity t appe>s to indicate !
 exi/5ce ( a security vuln]ability2     
7,d7 a me?od ( caus+ a us] ) legitimate 
access to an in=mation sy/em or         

in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em to unwitt+ly
 enable ! defeat ( a security control or
 exploitation ( a security vuln]ability2
  7,e7 malici\s cyb] comm& & control2   
7,f7 ! actual or pot5tial h>m caus$ by  
an incid5t1 includ+ a description ( !   
in=mation exfiltrat$ z a result ( a     
p>ticul> cyb]security ?reat2 or  7,g7   
any o!r attribute ( a cyb]security      
?reat1 if disclosure ( su* attribute is 
n o!rwise prohibit$ by law4  7#f7       
,def5sive measure ,! t]m def5sive       
measure means an action1 device1        
proc$ure1 te*nique1 or o!r measure      
execut$ on an in=mation sy/em or        
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em t prev5ts or
 mitigates a kn[n or suspect$           
cyb]security ?reat or security          
vuln]ability4  7#g7 ,f$]al entity ,! t]m
 ,f$]al entity means a dep>tm5t or ag5cy
 ( ! ,unit$ ,/ates or any compon5t ( su*
 dep>tm5t or ag5cy4  7#h7 ,in=mation    
sy/em ,! t]m in=mation sy/em-- 7,a7 has 

! mean+ giv5 ! t]m 9 section #cejb (    
title #dd1 ,unit$ ,/ates ,code2 &  7,b7 
includes indu/rial control sy/ems1 su* z
 sup]visory control & data acquisition  
sy/ems1 di/ribut$ control sy/ems1 &     
programmable logic controll]s4  7#i7    
,local gov]nm5t ,! t]m local gov]nm5t   
means any bor\gh1 city1 c\nty1 p>i%1    
t[n1 t[n%ip1 village1 or o!r political  
subdivision ( a ,/ate4  7#aj7 ,malici\s 
cyb] comm& & control ,! t]m malici\s    
cyb] comm& & control means a me?od =    
unau?oriz$ remote id5tification (1      
access to1 or use (1 an in=mation sy/em 
or in=mation t is /or$ on1 process$ by1 
or transit+ an in=mation sy/em4  7#aa7  
,malici\s reconnaissance ,! t]m malici\s
 reconnaissance means a me?od = actively
 prob+ or passively monitor+ an         
in=mation sy/em = ! purpose ( disc]n+   
security vuln]abilities ( ! in=mation   
sy/em1 if su* me?od is associat$ ) a    
kn[n or suspect$ cyb]security ?reat4    
7#ab7 ,monitor ,! t]m monitor means to  
acquire1 id5tify1 scan1 or o!rwise      

possess in=mation t is /or$ on1 process$
 by1 or transit+ an in=mation sy/em4    
7#ac7 ,non-,f$]al entity  7,a7 ,9 g5]al 
,except z o!rwise provid$ 9 ?is         
p>agraph1 ! t]m non-,f$]al entity means 
any private entity1 non-,f$]al gov]nm5t 
dep>tm5t or ag5cy1 or ,/ate1 tribal1 or 
local gov]nm5t 7includ+ a political     
subdivision1 dep>tm5t1 (fic]1 employee1 
or ag5t !re(74  7,b7 ,inclusions ,! t]m 
non-,f$]al entity includes a gov]nm5t   
dep>tm5t or ag5cy 7includ+ an (fic]1    
employee1 or ag5t !re(7 ( ! ,di/rict (  
,columbia1 ! ,commonweal? ( ,pu]to      
,rico1 ! ,virg9 ,isl&s1 ,guam1 ,am]ican 
,samoa1 ! ,nor!rn ,m>iana ,isl&s1 & any 
o!r t]ritory or possession ( ! ,unit$   
,/ates4  7,c7 ,exclusion ,! t]m         
non-,f$]al entity does n include a =eign
 p[] or kn[n ag5t ( a =eign p[]1 z bo?  
t]ms are def9$ 9 section #aja ( ! ,=eign
 ,intellig5ce ,surveillance ,act ( #aigh
 7#ej ,u4,s4,c4 #ahja74  7#ad7 ,private 
entity  7,a7 ,9 g5]al ,except z o!rwise 
provid$ 9 ?is p>agraph1 ! t]m private   

entity means any p]son or private gr\p1 
organization1 proprietor%ip1 p>tn]%ip1  
tru/1 coop]ative1 corporation1 or o!r   
comm]cial or nonpr(it entity1 includ+ an
 (fic]1 employee1 or ag5t !re(4  7,b7   
,inclusion ,! t]m private entity        
includes a compon5t ( a ,/ate1 tribal1  
or local gov]nm5t p]=m+ electric utility
 s]vices4  7,c7 ,exclusion ,! t]m       
private entity does n include a =eign   
p[] z def9$ 9 section #aja ( ! ,=eign   
,intellig5ce ,surveillance ,act ( #aigh 
7#ej ,u4,s4,c4 #ahja74  7#ae7 ,real "t2 
real-"t ,! t]ms real "t & real-"t mean a
 process by :i* an automat$1            
ma*9e-to-ma*9e sy/em processes cyb]     
?reat indicators su* t ! "t 9 :i* !     
occurr5ce ( an ev5t & ! report+ or      
record+ ( x are z simultane\s z         
te*nologically & op]ationally           
practicable4  7#af7 ,security control ,!
 t]m security control means ! managem5t1
 op]ational1 & te*nical controls us$ to 
protect aga9/ an unau?oriz$ ef=t to     
adv]sely impact ! security1             

confid5tiality1 integrity1 &            
availability ( an in=mation sy/em or its
 in=mation4  7#ag7 ,security            
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 s(tw>e1 process1 or proc$ure t  
c\ld enable or facilitate ! defeat ( a  
security control4  7#ah7 ,tribal ,! t]m 
tribal has ! mean+ giv5 ! t]m ,indian   
tribe 9 section #d ( ! ,indian          
,self-,det]m9ation & ,education         
,assi/ance ,act 7#be ,u4,s4,c4 #dej;b74 
,april #ac1 #bjae ,report$ ) an am5dm5t1
 committ$ to ! ,committee ( ! ,:ole     
,h\se on ! ,/ate ( ! ,union1 & ord]$ to 
be pr9t$