,,ib  ,union ,cal5d> ,no4 #fa  #aad?    
,,congress  #a/ ,session  ,h4 ,r4 #agca 
,report ,no4 #aad-hc  ,,9 ,,! ,,h\se ,,(
 ,,repres5tatives  ,april #ac1 #bjae    
,mr4 ,mc,caul 7= himself & ,mr4         
,ratcliffe7 introduc$ ! foll[+ bill2 :i*
 0 ref]r$ to ! ,committee on ,homel&    
,security  ,april #ag1 #bjae ,report$ ) 
an am5dm5t1 committ$ to ! ,committee ( !
 ,:ole ,h\se on ! ,/ate ( ! ,union1 &   
ord]$ to be pr9t$ ,/rike out all aft] ! 
enact+ clause & ins]t ! "p pr9t$ 9      
italic ,= text ( introduc$ bill1 see    
copy ( bill z introduc$ on ,april #ac1  
#bjae  ,a ,,bill  ,to am5d ! ,homel&    
,security ,act ( #bjjb to enhance       
multi-directional %>+ ( in=mation relat$
 to cyb]security risks & /r5g!n privacy 
& civil lib]ties protections1 & = o!r   
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,national ,cyb]security    
,protection ,advancem5t ,act ( #bjae4   
#b4 ,national ,cyb]security &           
,communications ,integration ,c5t]  7a7 
,def9itions  7#a7 ,9 g5]al ,subsection  

7a7 ( ! second section #bbf ( ! ,homel& 
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#adh2 relat+ to ! ,national             
,cyb]security & ,communications         
,integration ,c5t]7 is am5d$--  7,a7 9  
p>agraph 7#c71 by /rik+ & at ! end2     
7,b7 9 p>agraph 7#d71 by /rik+ ! p]iod  
at ! end & ins]t+ 2 &2 &  7,c7 by add+  
at ! end ! foll[+ new p>agraphs3  7#e7 !
 t]m cyb] ?reat indicator means te*nical
 in=mation t is necess>y to describe or 
id5tify--  7,a7 a me?od = prob+1        
monitor+1 ma9ta9+1 or e/abli%+ network  
aw>5ess ( an in=mation sy/em = ! purpose
 ( disc]n+ te*nical vuln]abilities ( su*
 in=mation sy/em1 if su* me?od is kn[n  
or reasonably suspect$ ( be+ associat$ )
 a kn[n or suspect$ cyb]security risk1  
includ+ communications t reasonably     
appe> to be transmitt$ = ! purpose (    
ga!r+ te*nical in=mation relat$ to a    
cyb]security risk2  7,b7 a me?od =      
defeat+ a te*nical or security control (
 an in=mation sy/em2  7,c7 a te*nical   
vuln]ability1 includ+ anomal\s te*nical 

behavior t may become a vuln]ability2   
7,d7 a me?od ( caus+ a us] ) legitimate 
access to an in=mation sy/em or         
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em to          
inadv]t5tly enable ! defeat ( a te*nical
 or op]ational control2  7,e7 a me?od = 
unau?oriz$ remote id5tification (1      
access to1 or use ( an in=mation sy/em  
or in=mation t is /or$ on1 process$ by1 
or transit+ an in=mation sy/em t is kn[n
 or reasonably suspect$ ( be+ associat$ 
) a kn[n or suspect$ cyb]security risk2 
7,f7 ! actual or pot5tial h>m caus$ by a
 cyb]security risk1 includ+ a           
description ( ! in=mation exfiltrat$ z a
 result ( a p>ticul> cyb]security risk2 
7,g7 any o!r attribute ( a cyb]security 
risk t _c be us$ to id5tify specific    
p]sons reasonably believ$ to be unrelat$
 to su* cyb]security risk1 if disclosure
 ( su* attribute is n o!rwise prohibit$ 
by law2 or  7,h7 any comb9ation (       
subp>agraphs 7,a7 ?r\gh 7,g72  7#f7 !   
t]m cyb]security purpose means ! purpose

 ( protect+ an in=mation sy/em or       
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em f a         
cyb]security risk or incid5t2  7#g7 7,a7
 except z provid$ 9 subp>agraph 7,b71 ! 
t]m def5sive measure means an action1   
device1 proc$ure1 signature1 te*nique1  
or o!r measure appli$ to an in=mation   
sy/em or in=mation t is /or$ on1        
process$ by1 or transit+ an in=mation   
sy/em t detects1 prev5ts1 or mitigates a
 kn[n or suspect$ cyb]security risk or  
incid5t1 or any attribute ( h>dw>e1     
s(tw>e1 process1 or proc$ure t c\ld     
enable or facilitate ! defeat ( a       
security control2  7,b7 su* t]m does n  
include a measure t de/roys1 r5d]s      
unusable1 or sub/antially h>ms an       
in=mation sy/em or data on an in=mation 
sy/em n belong+ to-- 7i7 ! non-,f$]al   
entity1 n includ+ a ,/ate1 local1 or    
tribal gov]nm5t1 op]at+ su* measure2 or 
7ii7 ano!r ,f$]al entity or non-,f$]al  
entity t is au?oriz$ to provide cons5t &
 has provid$ su* cons5t to ! non-,f$]al 

entity ref]r$ to 9 clause 7i72  7#h7 !  
t]m network aw>5ess means to scan1      
id5tify1 acquire1 monitor1 log1 or      
analyze in=mation t is /or$ on1 process$
 by1 or transit+ an in=mation sy/em2    
7#i7  7,a7 ! t]m private entity means a 
non-,f$]al entity t is an individual or 
private gr\p1 organization1             
proprietor%ip1 p>tn]%ip1 tru/1          
coop]ative1 corporation1 or o!r         
comm]cial or non-pr(it entity1 includ+  
an (fic]1 employee1 or ag5t !re(2  7,b7 
su* t]m includes a compon5t ( a ,/ate1  
local1 or tribal gov]nm5t p]=m+ electric
 utility s]vices2  7#aj7 ! t]m security 
control means ! managem5t1 op]ational1 &
 te*nical controls us$ to protect aga9/ 
an unau?oriz$ ef=t to adv]sely affect ! 
confid5tially1 integrity1 or            
availability ( an in=mation sy/em or    
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em2 &  7#aa7 ! 
t]m %>+ means provid+1 receiv+1 &       
dissem9at+4  4  7b7 ,am5dm5t            
,subp>agraph 7,b7 ( subsection 7d77#a7 (

 su* second section #bbf ( ! ,homel&    
,security ,act ( #bjjb is am5d$-- 7#a7 9
 clause 7i71 by /rik+ & local & ins]t+ 1
 local1 & tribal2  7#b7 9 clause 7ii7-- 
7,a7 by ins]t+ 1 includ+ in=mation %>+ &
 analysis c5t]s be=e ! semicolon2 &     
7,b7 by /rik+ & at ! end2  7#c7 9 clause
 7iii71 by /rik+ ! p]iod at ! end &     
ins]t+ 2 &2 &  7#d7 by add+ at ! end !  
foll[+ new clause3  7iv7 private        
entities4  4  #c4 ,in=mation %>+        
/ructure & processes ,! second section  
#bbf ( ! ,homel& ,security ,act ( #bjjb 
7#f ,u4,s4,c4 #adh2 relat+ to !         
,national ,cyb]security &               
,communications ,integration ,c5t]7 is  
am5d$-- 7#a7 9 subsection 7c7--  7,a7 9 
p>agraph 7#a7-- 7i7 by /rik+ a ,f$]al   
civilian int]face & ins]t+ ! lead ,f$]al
 civilian int]face2 &  7ii7 by /rik+    
cyb]security risks1 & ins]t+ cyb] ?reat 
indicators1 def5sive measures1          
cyb]security risks12  7,b7 9 p>agraph   
7#c71 by /rik+ cyb]security risks &     
ins]t+ cyb] ?reat indicators1 def5sive  

measures1 cyb]security risks12  7,c7 9  
p>agraph 7#e77;,a71 by /rik+            
cyb]security risks & ins]t+ cyb] ?reat  
indicators1 def5sive measures1          
cyb]security risks12  7,d7 9 p>agraph   
7#f7--  7i7 by /rik+ cyb]security risks 
& ins]t+ cyb] ?reat indicators1 def5sive
 measures1 cyb]security risks12 &  7ii7 
by /rik+ & at ! end2  7,e7 9 p>agraph   
7#g7-- 7i7 9 subp>agraph 7,a71 by /rik+ 
& at ! end2  7ii7 9 subp>agraph 7,b71 by
 /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 
7iii7 by add+ at ! end ! foll[+ new     
subp>agraph3  7,c7 %>+ cyb] ?reat       
indicators & def5sive measures2  2 &    
7,f7 by add+ at ! end ! foll[+ new      
p>agraphs  7#h7 engag+ ) int]national   
p>tn]s1 9 consultation ) o!r appropriate
 ag5cies1 to-- 7,a7 collaborate on cyb] 
?reat indicators1 def5sive measures1 &  
in=mation relat$ to cyb]security risks &
 incid5ts2 &  7,b7 enhance ! security & 
resili5ce ( global cyb]security2  7#i7  
%>+ cyb] ?reat indicators1 def5sive     
measures1 & o!r in=mation relat$ to     

cyb]security risks & incid5ts ) ,f$]al &
 non-,f$]al entities1 includ+ across    
sectors ( critical infra/ructure & )    
,/ate & major urban area fusion c5t]s1 z
 appropriate2  7#aj7 promptly notify+ ! 
,secret>y & ! ,committee on ,homel&     
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate ( any   
significant violations ( ! policies &   
proc$ures specifi$ 9 subsection         
7i77#f77;,a72  7#aa7 promptly notify+   
non-,f$]al entities t h %>$ cyb] ?reat  
indicators or def5sive measures t are   
kn[n or det]m9$ to be 9 error or 9      
contrav5tion ( ! requirem5ts ( ?is      
section2 &  7#ab7 p>ticipat+1 z         
appropriate1 9 ex]cises run by !        
,dep>tm5t's ,national ,ex]cise ,program4
  2  7#b7 9 subsection 7d7--  7,a7 9    
subp>agraph 7,d71 by /rik+ & at ! end2  
7,b7 by r$esignat+ subp>agraph 7,e7 z   
subp>agraph 7,j72 &  7,c7 by ins]t+ aft]
 subp>agraph 7,d7 ! foll[+ new          
subp>agraphs3  7,e7 an entity t         

collaborates ) ,/ate & local gov]nm5ts  
on cyb]security risks & incid5ts1 & has 
ent]$ into a volunt>y in=mation %>+     
relation%ip ) ! ,c5t]2  7,f7 a ,unit$   
,/ates ,comput] ,em]g5cy ,read9ess ,team
 t coord9ates in=mation relat$ to       
cyb]security risks & incid5ts1          
proactively & collaboratively addresses 
cyb]security risks & incid5ts to !      
,unit$ ,/ates1 collaboratively responds 
to cyb]security risks & incid5ts1       
provides te*nical assi/ance1 ^u reque/1 
to in=mation sy/em own]s & op]ators1 &  
%>es cyb] ?reat indicators1 def5sive    
measures1 analysis1 or in=mation relat$ 
to cyb]security risks & incid5ts 9 a    
timely mann]2  7,g7 ! ,indu/rial        
,control ,sy/em ,cyb] ,em]g5cy ,response
 ,team t--  7i7 coord9ates ) indu/rial  
control sy/ems own]s & op]ators2  7ii7  
provides tra9+1 ^u reque/1 to ,f$]al    
entities & non-,f$]al entities on       
indu/rial control sy/ems cyb]security2  
7iii7 collaboratively addresses         
cyb]security risks & incid5ts to        

indu/rial control sy/ems2  7iv7 provides
 te*nical assi/ance1 ^u reque/1 to      
,f$]al entities & non-,f$]al entities   
relat+ to indu/rial control sy/ems      
cyb]security2 &  7v7 %>es cyb] ?reat    
indicators1 def5sive measures1 or       
in=mation relat$ to cyb]security risks &
 incid5ts ( indu/rial control sy/ems 9 a
 timely fa%ion2  7,h7 a ,national       
,coord9at+ ,c5t] = ,communications t    
coord9ates ! protection1 response1 &    
recov]y ( em]g5cy communications2  7,i7 
an entity t coord9ates ) small &        
m$ium-siz$ bus9esses2 &  2  7#c7 9      
subsection 7e7--  7,a7 9 p>agraph 7#a7--
 7i7 9 subp>agraph 7,a71 by ins]t+ cyb] 
?reat indicators1 def5sive measures1 &  
be=e in=mation2  7ii7 9 subp>agraph     
7,b71 by ins]t+ cyb] ?reat indicators1  
def5sive measures1 & be=e in=mation2    
7iii7 9 subp>agraph 7,f71 by /rik+      
cyb]security risks & ins]t+ cyb] ?reat  
indicators1 def5sive measures1          
cyb]security risks12  7iv7 9 subp>agraph
 7,f71 by /rik+ & at ! end2  7v7 9      

subp>agraph 7,g71 by /rik+ cyb]security 
risks & ins]t+ cyb] ?reat indicators1   
def5sive measures1 cyb]security risks12 
&  7vi7 by add+ at ! end ! foll[+3  7,h7
 ! ,c5t] ensures t x %>es in=mation     
relat+ to cyb]security risks & incid5ts 
) small & m$ium-siz$ bus9esses1 z       
appropriate2 &  7,i7 ! ,c5t] designates 
an ag5cy contact = non-,f$]al entities2 
2  7,b7 9 p>agraph 7#b7--  7i7 by /rik+ 
cyb]security risks & ins]t+ cyb] ?reat  
indicators1 def5sive measures1          
cyb]security risks12 &  7ii7 by ins]t+  
or disclosure be=e ! semicolon at ! end2
 &  7,c7 9 p>agraph 7#c71 by ins]t+ be=e
 ! p]iod at ! end ! foll[+3 1 includ+ by
 work+ ) ! ,*ief ,privacy ,(fic] appo9t$
 "u section #bbb to ensure t ! ,c5t]    
foll[s ! policies & proc$ures specifi$ 9
 subsection 7i77#f77;,a72 &  7#d7 by    
add+ at ! end ! foll[+ new subsections3 
7g7 ,rapid automat$ %>+  7#a7 ,9 g5]al  
,! ,"u ,secret>y = ,cyb]security &      
,infra/ructure ,protection1 9           
coord9ation ) indu/ry & o!r /akehold]s1 

%all develop capabilities mak+ use (    
exi/+ in=mation te*nology indu/ry /&>ds 
& be/ practices1 z appropriate1 t       
support & rapidly advance ! developm5t1 
adoption1 & implem5tation ( automat$    
me*anisms = ! timely %>+ ( cyb] ?reat   
indicators & def5sive measures to & f ! 
,c5t] & ) ea* ,f$]al ag5cy designat$ z !
 ,sector ,specific ,ag5cy = ea* critical
 infra/ructure sector 9 accordance )    
subsection 7h74  7#b7 ,biannual report  
,! ,"u ,secret>y = ,cyb]security &      
,infra/ructure ,protection %all submit  
to ! ,committee on ,homel& ,security ( !
 ,h\se ( ,repres5tatives & ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate a biannual report on
 ! /atus & progress ( ! developm5t ( !  
capability describ$ 9 p>agraph 7#a74    
,su* reports %all be requir$ until su*  
capability is fully implem5t$4  7h7     
,sector ,specific ,ag5cies ,! ,secret>y1
 9 collaboration ) ! relevant critical  
infra/ructure sector & ! heads ( o!r    
appropriate ,f$]al ag5cies1 %all        

recognize ! ,f$]al ag5cy designat$ z (  
,m>* #be1 #bjae1 z ! ,sector ,specific  
,ag5cy = ea* critical infra/ructure     
sector designat$ 9 ! ,dep>tm5t's        
,national ,infra/ructure ,protection    
,plan4 ,if ! designat$ ,sector ,specific
 ,ag5cy = a p>ticul> critical           
infra/ructure sector is ! ,dep>tm5t1 =  
purposes ( ?is section1 ! ,secret>y is  
deem$ to be ! head ( su* ,sector        
,specific ,ag5cy & %all c>ry out ?is    
section4 ,! ,secret>y1 9 coord9ation ) !
 heads ( ea* su* ,sector ,specific      
,ag5cy1 %all-- 7#a7 support ! security &
 resili5ce actives ( ! relevant critical
 infra/ructure sector 9 accordance ) ?is
 section2  7#b7 provide in/itutional k1 
specializ$ exp]tise1 & te*nical         
assi/ance ^u reque/ to ! relevant       
critical infra/ructure sector2 &  7#c7  
support ! timely %>+ ( cyb] ?reat       
indicators & def5sive measures ) !      
relevant critical infra/ructure sector )
 ! ,c5t] 9 accordance ) ?is section4    
7i7 ,volunt>y in=mation %>+ proc$ures   

7#a7 ,proc$ures  7,a7 ,9 g5]al ,! ,c5t] 
may ent] into a volunt>y in=mation %>+  
relation%ip ) any cons5t+ non-,f$]al    
entity = ! %>+ ( cyb] ?reat indicators &
 def5sive measures = cyb]security       
purposes 9 accordance ) ?is section4    
,no?+ 9 ?is section may be con/ru$ to   
require any non-,f$]al entity to ent]   
into any su* in=mation %>+ relation%ip )
 ! ,c5t] or any o!r entity4 ,! ,c5t] may
 t]m9ate a volunt>y in=mation %>+       
relation%ip "u ?is subsection if ! ,c5t]
 det]m9es t ! non-,f$]al entity ) :i* ! 
,c5t] has ent]$ into su* a relation%ip  
has1 aft] repeat$ notice1 repeat$ly     
violat$ ! t]ms ( ?is subsection4  7,b7  
,national security ,! ,secret>y may     
decl9e to ent] into a volunt>y in=mation
 %>+ relation%ip "u ?is subsection if ! 
,secret>y det]m9es t su* is appropriate 
= national security4  7#b7 ,volunt>y    
in=mation %>+ relation%ips ,a volunt>y  
in=mation %>+ relation%ip "u ?is        
subsection may be *>act]iz$ z an        
agreem5t describ$ 9 ?is p>agraph4 7,a7  

,/&>d agreem5t ,= ! use ( a non-,f$]al  
entity1 ! ,c5t] %all make available a   
/&>d agreem5t1 consi/5t ) ?is section1  
on ! ,dep>tm5t's website4  7,b7         
,negotiat$ agreem5t ,at ! reque/ ( a    
non-,f$]al entity1 & if det]m9$         
appropriate by ! ,c5t]1 ! ,dep>tm5t %all
 negotiate a non-/&>d agreem5t1 consi/5t
 ) ?is section4  7,c7 ,exi/+ agreem5ts  
,an agreem5t betwe5 ! ,c5t] & a         
non-,f$]al entity t is ent]$ into be=e !
 date ( ! enactm5t ( ?is section1 or su*
 an agreem5t t is 9 effect be=e su*     
date1 %all be deem$ 9 compliance ) !    
requirem5ts ( ?is subsection1 not)/&+   
any o!r provision or requirem5t ( ?is   
subsection4 ,an agreem5t "u ?is         
subsection %all include ! relevant      
privacy protections z 9 effect "u !     
,coop]ative ,rese>* & ,developm5t       
,agreem5t = ,cyb]security ,in=mation    
,%>+ & ,collaboration1 z ( ,decemb] #ca1
 #bjad4 ,no?+ 9 ?is subsection may be   
con/ru$ to require a non-,f$]al entity  
to ent] into ei!r a /&>d or negotiat$   

agreem5t to be 9 compliance ) ?is       
subsection4  7#c7 ,in=mation %>+        
au?orization  7,a7 ,9 g5]al ,except z   
provid$ 9 subp>agraph 7,b71 & not)/&+   
any o!r provision ( law1 a non-,f$]al   
entity may1 = cyb]security purposes1 %>e
 cyb] ?reat indicators or def5sive      
measures obta9$ on its own in=mation    
sy/em1 or on an in=mation sy/em ( ano!r 
,f$]al entity or non-,f$]al entity1 ^u  
writt5 cons5t ( su* o!r ,f$]al entity or
 non-,f$]al entity or an au?oriz$       
repres5tative ( su* o!r ,f$]al entity or
 non-,f$]al entity 9 accordance ) ?is   
section )-- 7i7 ano!r non-,f$]al entity2
 or  7ii7 ! ,c5t]1 z provid$ 9 ?is      
section4  7,b7 ,lawful re/riction ,a    
non-,f$]al entity receiv+ a cyb] ?reat  
indicator or def5sive measure f ano!r   
,f$]al entity or non-,f$]al entity %all 
comply ) o!rwise lawful re/rictions     
plac$ on ! %>+ or use ( su* cyb] ?reat  
indicator or def5sive measure by ! %>+  
,f$]al entity or non-,f$]al entity4     
7,c7 ,removal ( in=mation unrelat$ to   

cyb]security risks or incid5ts ,f$]al   
entities & non-,f$]al entities %all1    
prior to su* %>+1 take reasonable ef=ts 
to remove in=mation t c be us$ to       
id5tify specific p]sons & is reasonably 
believ$ at ! "t ( %>+ to be unrelat$ to 
a cyb]security risks or incid5t & to    
safegu>d in=mation t c be us$ to id5tify
 specific p]sons f un9t5d$ disclosure or
 unau?oriz$ access or acquisition4  7,d7
 ,rule ( con/ruction ,no?+ 9 ?is        
p>agraph may be con/ru$ to--  7i7 limit 
or modify an exi/+ in=mation %>+        
relation%ip2  7ii7 prohibit a new       
in=mation %>+ relation%ip2  7iii7       
require a new in=mation %>+ relation%ip 
betwe5 any non-,f$]al entity & a ,f$]al 
entity2  7iv7 limit o!rwise lawful      
activity2 or  7v7 9 any mann] impact or 
modify proc$ures 9 exi/5ce z ( ! date ( 
! enactm5t ( ?is section = report+ kn[n 
or suspect$ crim9al activity to         
appropriate law en=cem5t au?orities or =
 p>ticipat+ volunt>ily or "u legal      
requirem5t 9 an inve/igation4  7,e7     

,coord9at$ vuln]ability disclosure ,!   
,"u ,secret>y = ,cyb]security &         
,infra/ructure ,protection1 9           
coord9ation ) indu/ry & o!r /akehold]s1 
%all develop1 publi%1 & adh]e to        
policies & proc$ures = coord9at+        
vuln]ability disclosures1 to ! ext5t    
practicable1 consi/5t ) int]national    
/&>ds 9 ! in=mation te*nology indu/ry4  
7#d7 ,network aw>5ess au?orization  7,a7
 ,9 g5]al ,not)/&+ any o!r provision (  
law1 a non-,f$]al entity1 n includ+ a   
,/ate1 local1 or tribal gov]nm5t1 may1 =
 cyb]security purposes1 conduct network 
aw>5ess (-- 7i7 an in=mation sy/em ( su*
 non-,f$]al entity to protect ! rights  
or prop]ty ( su* non-,f$]al entity2     
7ii7 an in=mation sy/em ( ano!r         
non-,f$]al entity1 ^u writt5 cons5t (   
su* o!r non-,f$]al entity = conduct+ su*
 network aw>5ess to protect ! rights or 
prop]ty ( su* o!r non-,f$]al entity2    
7iii7 an in=mation sy/em ( a ,f$]al     
entity1 ^u writt5 cons5t ( an au?oriz$  
repres5tative ( su* ,f$]al entity =     

conduct+ su* network aw>5ess to protect 
! rights or prop]ty ( su* ,f$]al entity2
 or  7iv7 in=mation t is /or$ on1       
process$ by1 or transit+ an in=mation   
sy/em describ$ 9 ?is subp>agraph4  7,b7 
,rule ( con/ruction ,no?+ 9 ?is p>agraph
 may be con/ru$ to--  7i7 au?orize      
conduct+ network aw>5ess ( an in=mation 
sy/em1 or ! use ( any in=mation obta9$  
?r\gh su* conduct+ ( network aw>5ess1   
o!r ?an z provid$ 9 ?is section2 or     
7ii7 limit o!rwise lawful activity4     
7#e7 ,def5sive measure au?orization     
7,a7 ,9 g5]al ,except z provid$ 9       
subp>agraph 7,b7 & not)/&+ any o!r      
provision ( law1 a non-,f$]al entity1 n 
includ+ a ,/ate1 local1 or tribal       
gov]nm5t1 may1 = cyb]security purposes1 
op]ate a def5sive measure t is appli$   
to-- 7i7 an in=mation sy/em ( su*       
non-,f$]al entity to protect ! rights or
 prop]ty ( su* non-,f$]al entity2  7ii7 
an in=mation sy/em ( ano!r non-,f$]al   
entity ^u writt5 cons5t ( su* o!r       
non-,f$]al entity = op]ation ( su*      

def5sive measure to protect ! rights or 
prop]ty ( su* o!r non-,f$]al entity2    
7iii7 an in=mation sy/em ( a ,f$]al     
entity ^u writt5 cons5t ( an au?oriz$   
repres5tative ( su* ,f$]al entity =     
op]ation ( su* def5sive measure to      
protect ! rights or prop]ty ( su* ,f$]al
 entity2 or  7iv7 in=mation t is /or$   
on1 process$ by1 or transit+ an         
in=mation sy/em describ$ 9 ?is          
subp>agraph4  7,b7 ,rule ( con/ruction  
,no?+ 9 ?is p>agraph may be con/ru$ to--
  7i7 au?orize ! use ( a def5sive       
measure o!r ?an z provid$ 9 ?is section2
 or  7ii7 limit o!rwise lawful activity4
  7#f7 ,privacy & civil lib]ties        
protections  7,a7 ,policies & proc$ures 
7i7 ,9 g5]al ,! ,"u ,secret>y =         
,cyb]security & ,infra/ructure          
,protection %all1 9 coord9ation ) !     
,*ief ,privacy ,(fic] & ! ,*ief ,civil  
,rights & ,civil ,lib]ties ,(fic] ( !   
,dep>tm5t1 e/abli% & annually review    
policies & proc$ures gov]n+ ! receipt1  
ret5tion1 use1 & disclosure ( cyb] ?reat

 indicators1 def5sive measures1 &       
in=mation relat$ to cyb]security risks &
 incid5ts %>$ ) ! ,c5t] 9 accordance )  
?is section4 ,su* policies & proc$ures  
%all apply only to ! ,dep>tm5t1 consi/5t
 ) ! ne$ to protect in=mation sy/ems f  
cyb]security risks & incid5ts & mitigate
 cyb]security risks & incid5ts 9 a      
timely mann]1 & %all-- 7,i7 be consi/5t 
) ! ,dep>tm5t's ,fair ,in=mation        
,practice ,pr9ciples develop$ pursuant  
to section #eeb;a ( title #e1 ,unit$    
,/ates ,code 7commonly ref]r$ to z !    
,privacy ,act ( #aigd or ! ,privacy     
,act71 & subject to ! ,secret>y's       
au?ority "u subsection 7a77#b7 ( section
 #bbb ( ?is ,act2  7,,ii7 reasonably    
limit1 to ! greate/ ext5t practicable1 !
 receipt1 ret5tion1 use1 & disclosure ( 
cyb] ?reat indicators & def5sive        
measures associat$ ) specific p]sons t  
is n necess>y1 = cyb]security purposes1 
to protect a network or in=mation sy/em 
f cyb]security risks or mitigate        
cyb]security risks & incid5ts 9 a timely

 mann]2  7,,iii7 m9imize any impact on  
privacy & civil lib]ties2  7,,iv7       
provide data integrity ?r\gh ! prompt   
removal & de/ruction ( obsolete or      
errone\s names & p]sonal in=mation t is 
unrelat$ to ! cyb]security risk or      
incid5t in=mation %>$ & reta9$ by !     
,c5t] 9 accordance ) ?is section2  7,v7 
include requirem5ts to safegu>d cyb]    
?reat indicators & def5sive measures    
reta9$ by ! ,c5t]1 includ+ in=mation t  
is propriet>y or bus9ess-s5sitive t may 
be us$ to id5tify specific p]sons f     
unau?oriz$ access or acquisition2       
7,,vi7 protect ! confid5tiality ( cyb]  
?reat indicators & def5sive measures    
associat$ ) specific p]sons to ! greate/
 ext5t practicable2 &  7,,vii7 ensure   
all relevant con/itutional1 legal1 &    
privacy protections are obs]v$4  7ii7   
,submission to ,congress ,n lat] ?an    
#ahj days aft] ! date ( ! enactm5t ( ?is
 section & annually !reaft]1 ! ,*ief    
,privacy ,(fic] & ! ,(fic] = ,civil     
,rights & ,civil ,lib]ties ( !          

,dep>tm5t1 9 consultation ) ! ,privacy &
 ,civil ,lib]ties ,ov]sight ,bo>d       
7e/abli%$ pursuant to section #ajfa ( ! 
,intellig5ce ,re=m & ,t]rorism          
,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4  
#bjjj;ee771 %all submit to ! ,committee 
on ,homel& ,security ( ! ,h\se (        
,repres5tatives & ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate ! policies & proc$ures      
gov]n+ ! %>+ ( cyb] ?reat indicators1   
def5sive measures1 & in=mation relat$ to
 cybs]security risks & incid5ts describ$
 9 clause 7i7 ( subp>agraph 7,a74  7iii7
 ,public notice & access ,! ,"u         
,secret>y = ,cyb]security &             
,infra/ructure ,protection1 9           
consultation ) ! ,*ief ,privacy ,(fic] &
 ! ,*ief ,civil ,rights & ,civil        
,lib]ties ,(fic] ( ! ,dep>tm5t1 & !     
,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d 7e/abli%$ pursuant to section     
#ajfa ( ! ,intellig5ce ,re=m & ,t]rorism
 ,prev5tion ,act ( #bjjd 7#db ,u4,s4,c4 
#bjjj;ee771 %all ensure !re is public   

notice (1 & access to1 ! policies &     
proc$ures gov]n+ ! %>+ ( cyb] ?reat     
indicators1 def5sive measures1 &        
in=mation relat$ to cyb]security risks &
 incid5ts4  7iv7 ,consultation ,! ,"u   
,secret>y = ,cyb]security &             
,infra/ructure ,protection :5 e/abli%+  
policies & proc$ures to support privacy 
& civil lib]ties may consult ) !        
,national ,in/itute ( ,/&>ds &          
,te*nology4  7,b7 ,implem5tation ,!     
,*ief ,privacy ,(fic] ( ! ,dep>tm5t1 on 
an ongo+ basis1 %all--  7i7 monitor !   
implem5tation ( ! policies & proc$ures  
gov]n+ ! %>+ ( cyb] ?reat indicators &  
def5sive measures e/abli%$ pursuant to  
clause 7i7 ( subp>agraph 7,a72  7ii7    
regul>ly review & update privacy impact 
assessm5ts1 z appropriate1 to ensure all
 relevant con/itutional1 legal1 &       
privacy protections are be+ foll[$2     
7iii7 "w ) ! ,"u ,secret>y =            
,cyb]security & ,infra/ructure          
,protection to c>ry out p>agraphs 7#aj7 
& 7#aa7 ( subsection 7c72  7iv7 annually

 submit to ! ,committee on ,homel&      
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate a report
 t conta9s a review ( ! effectiv5ess (  
su* policies & proc$ures to protect     
privacy & civil lib]ties2 &  7v7 ensure 
!re are appropriate sanctions 9 place = 
(fic]s1 employees1 or ag5ts ( !         
,dep>tm5t :o int5tionally or willfully  
conduct activities "u ?is section 9 an  
unau?oriz$ mann]4  7,c7 ,inspector      
,g5]al report ,! ,inspector ,g5]al ( !  
,dep>tm5t1 9 consultation ) ! ,privacy &
 ,civil ,lib]ties ,ov]sight ,bo>d & !   
,inspector ,g5]al ( ea* ,f$]al ag5cy t  
receives cyb] ?reat indicators or       
def5sive measures %>$ ) ! ,c5t] "u ?is  
section1 %all1 n lat] ?an two ye>s aft] 
! date ( ! enactm5t ( ?is subsection &  
p]iodically !reaft] submit to !         
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives & ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate a report conta9+ a  

review ( ! use ( cyb]security risk      
in=mation %>$ ) ! ,c5t]1 includ+ !      
foll[+3  7i7 ,a report on ! receipt1    
use1 & dissem9ation ( cyb] ?reat        
indicators & def5sive measures t h be5  
%>$ ) ,f$]al entities "u ?is section4   
7ii7 ,in=mation on ! use by ! ,c5t] (   
su* in=mation = a purpose o!r ?an a     
cyb]security purpose4  7iii7 ,a review (
 ! type ( in=mation %>$ ) ! ,c5t] "u ?is
 section4  7iv7 ,a review ( ! actions   
tak5 by ! ,c5t] bas$ on su* in=mation4  
7v7 ,! appropriate metrics t exi/ to    
det]m9e ! impact1 if any1 on privacy &  
civil lib]ties z a result ( ! %>+ ( su* 
in=mation ) ! ,c5t]4  7vi7 ,a li/ ( o!r 
,f$]al ag5cies receiv+ su* in=mation4   
7vii7 ,a review ( ! %>+ ( su* in=mation 
)9 ! ,f$]al ,gov]nm5t to id5tify        
inappropriate /ove pip+ ( su* in=mation4
  7viii7 ,any recomm5dations ( !        
,inspector ,g5]al ( ! ,dep>tm5t =       
improvem5ts or modifications to         
in=mation %>+ "u ?is section4  7,d7     
,privacy & ,civil ,lib]ties ,(fic]s     

report ,! ,*ief ,privacy ,(fic] & !     
,*ief ,civil ,rights & ,civil ,lib]ties 
,(fic] ( ! ,dep>tm5t1 9 consultation ) !
 ,privacy & ,civil ,lib]ties ,ov]sight  
,bo>d1 ! ,inspector ,g5]al ( !          
,dep>tm5t1 & ! s5ior privacy & civil    
lib]ties (fic] ( ea* ,f$]al ag5cy t     
receives cyb] ?reat indicators &        
def5sive measures %>$ ) ! ,c5t] "u ?is  
section1 %all bi5nially submit to !     
appropriate congressional committees a  
report assess+ ! privacy & civil        
lib]ties impact ( ! activities "u ?is   
p>agraph4 ,ea* su* report %all include  
any recomm5dations ! ,*ief ,privacy     
,(fic] & ! ,*ief ,civil ,rights & ,civil
 ,lib]ties ,(fic] ( ! ,dep>tm5t consid] 
appropriate to m9imize or mitigate !    
privacy & civil lib]ties impact ( ! %>+ 
( cyb] ?reat indicators & def5sive      
measures "u ?is section4  7,e7 ,=m ,ea* 
report requir$ "u p>agraphs 7,c7 & 7,d7 
%all be submitt$ 9 unclassifi$ =m1 b may
 include a classifi$ annex4  7#g7 ,uses 
& protection ( in=mation  7,a7          

,non-,f$]al entities ,a non-,f$]al      
entity1 n includ+ a ,/ate1 local1 or    
tribal gov]nm5t1 t %>es cyb] ?reat      
indicators or def5sive measures ?r\gh ! 
,c5t] or o!rwise "u ?is section-- 7i7   
may use1 reta91 or fur!r disclose su*   
cyb] ?reat indicators or def5sive       
measures solely = cyb]security purposes2
  7ii7 %all1 prior to su* %>+1 take     
reasonable ef=ts to remove in=mation t c
 be us$ to id5tify specific p]sons & is 
reasonably believ$ at ! "t ( %>+ to be  
unrelat$ to a cyb]security risk or      
incid5t1 & to safegu>d in=mation t c be 
us$ to id5tify specific p]sons f un9t5d$
 disclosure or unau?oriz$ access or     
acquisition2  7iii7 %all comply )       
appropriate re/rictions t a ,f$]al      
entity or non-,f$]al entity places on ! 
subsequ5t disclosure or ret5tion ( cyb] 
?reat indicators & def5sive measures t x
 discloses to o!r ,f$]al entities or    
non-,f$]al entities2  7iv7 %all be deem$
 to h volunt>ily %>$ su* cyb] ?reat     
indicators or def5sive measures2  7v7   

%all implem5t & utilize a security      
control to protect aga9/ unau?oriz$     
access to or acquisition ( su* cyb]     
?reat indicators or def5sive measures2 &
  7vi7 may n use su* in=mation to ga9 an
 unfair competitive advantage to !      
detrim5t ( any non-,f$]al entity4  7,b7 
,f$]al entities  7i7 ,uses ( in=mation  
,a ,f$]al entity t receives cyb] ?reat  
indicators or def5sive measures %>$     
?r\gh ! ,c5t] or o!rwise "u ?is section 
f ano!r ,f$]al entity or a non-,f$]al   
entity--  7,i7 may use1 reta91 or fur!r 
disclose su* cyb] ?reat indicators or   
def5sive measures solely = cyb]security 
purposes2  7,,ii7 %all1 prior to su*    
%>+1 take reasonable ef=ts to remove    
in=mation t c be us$ to id5tify specific
 p]sons & is reasonably believ$ at ! "t 
( %>+ to be unrelat$ to a cyb]security  
risk or incid5t1 & to safegu>d in=mation
 t c be us$ to id5tify specific p]sons f
 un9t5d$ disclosure or unau?oriz$ access
 or acquisition2  7,,iii7 %all be deem$ 
to h volunt>ily %>$ su* cyb] ?reat      

indicators or def5sive measures2  7,,iv7
 %all implem5t & utilize a security     
control to protect aga9/ unau?oriz$     
access to or acquisition ( su* cyb]     
?reat indicators or def5sive measures2 &
  7,v7 may n use su* cyb] ?reat         
indicators or def5sive measures to      
engage 9 surveillance or o!r collection 
activities = ! purpose ( track+ an      
individual's p]sonally id5tifiable      
in=mation4  7ii7 ,protections =         
in=mation ,! cyb] ?reat indicators &    
def5sive measures ref]r$ to 9 clause    
7i7--  7,i7 are exempt f disclosure "u  
section #eeb ( title #e1 ,unit$ ,/ates  
,code1 & )held1 )\t discretion1 f !     
public "u subsection 7b77#c77;,b7 ( su* 
section2  7,,ii7 may n be us$ by !      
,f$]al ,gov]nm5t = regulatory purposes2 
7,,iii7 may n con/itute a waiv] ( any   
applicable privilege or protection      
provid$ by law1 includ+ trade secret    
protection2  7,,iv7 %all be consid]$ !  
comm]cial1 f9ancial1 & propriet>y       
in=mation ( ! non-,f$]al entity ref]r$  

to 9 clause 7i7 :5 s designat$ by su*   
non-,f$]al entity2 &  7,v7 may n be     
subject to a rule ( any ,f$]al entity or
 any judicial doctr9e reg>d+ ex p>te    
communications ) a decisionmak+ (ficial4
  7,c7 ,/ate1 local1 or tribal gov]nm5t 
7i7 ,uses ( in=mation ,a ,/ate1 local1  
or tribal gov]nm5t t receives cyb] ?reat
 indicators or def5sive measures f !    
,c5t] f a ,f$]al entity or a non-,f$]al 
entity--  7,i7 may use1 reta91 or fur!r 
disclose su* cyb] ?reat indicators or   
def5sive measures solely = cyb]security 
purposes2  7,,ii7 %all1 prior to su*    
%>+1 take reasonable ef=ts to remove    
in=mation t c be us$ to id5tify specific
 p]sons & is reasonably believ$ at ! "t 
( %>+ to be unrelat$ to a cyb]security  
risk or incid5t1 & to safegu>d in=mation
 t c be us$ to id5tify specific p]sons f
 un9t5d$ disclosure or unau?oriz$ access
 or acquisition2  7,,iii7 %all consid]  
su* in=mation ! comm]cial1 f9ancial1 &  
propriet>y in=mation ( su* ,f$]al entity
 or non-,f$]al entity if s designat$ by 

su* ,f$]al entity or non-,f$]al entity2 
7,,iv7 %all be deem$ to h volunt>ily %>$
 su* cyb] ?reat indicators or def5sive  
measures2 &  7,v7 %all implem5t &       
utilize a security control to protect   
aga9/ unau?oriz$ access to or           
acquisition ( su* cyb] ?reat indicators 
or def5sive measures4  7ii7 ,protections
 = in=mation ,! cyb] ?reat indicators & 
def5sive measures ref]r$ to 9 clause    
7i7--  7,i7 %all be exempt f disclosure 
"u any ,/ate1 local1 or tribal law or   
regulation t requires public disclosure 
( in=mation or records by a public or   
quasi-public entity2 &  7,,ii7 may n be 
us$ by any ,/ate1 local1 or tribal      
gov]nm5t to regulate a lawful activity (
 a non-,f$]al entity4  7#h7 ,liability  
exemptions  7,a7 ,network aw>5ess ,no   
cause ( action %all lie or be ma9ta9$ 9 
any c\rt1 & su* action %all be promptly 
dismiss$1 aga9/ any non-,f$]al entity t1
 = cyb]security purposes1 conducts      
network aw>5ess "u p>agraph 7#d71 if su*
 network aw>5ess is conduct$ 9          

accordance ) su* p>agraph & ?is section4
  7,b7 ,in=mation %>+ ,no cause ( action
 %all lie or be ma9ta9$ 9 any c\rt1 &   
su* action %all be promptly dismiss$1   
aga9/ any non-,f$]al entity t1 =        
cyb]security purposes1 %>es cyb] ?reat  
indicators or def5sive measures "u      
p>agraph 7#c71 or fails to act bas$ on  
su* %>+1 if su* %>+ is conduct$ 9       
accordance ) su* p>agraph & ?is section4
  7,c7 ,willful misconduct  7i7 ,rule ( 
con/ruction ,no?+ 9 ?is section may be  
con/ru$ to-- 7,i7 require dismissal ( a 
cause ( action aga9/ a non-,f$]al entity
 t has engag$ 9 willful misconduct 9 !  
c\rse ( conduct+ activities au?oriz$ by 
?is section2 or  7,,ii7 und]m9e or limit
 ! availability ( o!rwise applicable    
common law or /atutory def5ses4  7ii7   
,pro( ( willful misconduct ,9 any action
 claim+ t subp>agraph 7,a7 or 7,b7 does 
n apply due to willful misconduct       
describ$ 9 clause 7i71 ! pla9tiff %all h
 ! burd5 ( prov+ by cle> & conv9c+      
evid5ce ! willful misconduct by ea*     

non-,f$]al entity subject to su* claim &
 t su* willful misconduct proximately   
caus$ injury to ! pla9tiff4  7iii7      
,willful misconduct def9$ ,9 ?is        
subsection1 ! t]m willful misconduct    
means an act or omission t is tak5--    
7,i7 int5tionally to a*ieve a wrongful  
purpose2  7,,ii7 kn[+ly )\t legal or    
factual ju/ification2 &  7,,iii7 9      
disreg>d ( a kn[n or obvi\s risk t is s 
great z to make x highly probable t !   
h>m w outweigh ! b5efit4  7,d7          
,exclusion ,! t]m non-,f$]al entity z   
us$ 9 ?is p>agraph %all n include a     
,/ate1 local1 or tribal gov]nm5t4  7#i7 
,f$]al ,gov]nm5t liability = violations 
( re/rictions on ! use & protection (   
volunt>ily %>$ in=mation  7,a7 ,9 g5]al 
,if a dep>tm5t or ag5cy ( ! ,f$]al      
,gov]nm5t int5tionally or willfully     
violates ! re/rictions specifi$ 9       
p>agraph 7#c71 7#f71 or 7#g77;,b7 on !  
use & protection ( volunt>ily %>$ cyb]  
?reat indicators or def5sive measures1  
or any o!r provision ( ?is section1 !   

,f$]al ,gov]nm5t %all be liable to a    
p]son injur$ by su* violation 9 an am\nt
 equal to ! sum (--  7i7 ! actual       
damages su/a9$ by su* p]son z a result (
 su* violation or #a1jjj1 :i*ev] is     
great]2 &  7ii7 reasonable attorney fees
 z det]m9$ by ! c\rt & o!r litigation   
co/s reasonably occurr$ 9 any case "u   
?is subsection 9 :i* ! compla9ant has   
sub/antially prevail$4  7,b7 ,v5ue ,an  
action to en=ce liability "u ?is        
subsection may be br\ght 9 ! di/rict    
c\rt ( ! ,unit$ ,/ates 9-- 7i7 ! di/rict
 9 :i* ! compla9ant resides2  7ii7 !    
di/rict 9 :i* ! pr9cipal place ( bus9ess
 ( ! compla9ant is locat$2  7iii7 !     
di/rict 9 :i* ! dep>tm5t or ag5cy ( !   
,f$]al ,gov]nm5t t disclos$ ! in=mation 
is locat$2 or  7iv7 ! ,di/rict (        
,columbia4  7,c7 ,/atute ( limitations  
,no action %all lie "u ?is subsection   
unless su* action is comm5c$ n lat] ?an 
two ye>s aft] ! date ( ! violation ( any
 re/riction specifi$ 9 p>agraph 7#c71   
7#f71 or #g7;,b71 or any o!r provision (

 ?is section1 t is ! basis = su* action4
  7,d7 ,exclusive cause ( action ,a     
cause ( action "u ?is subsection %all be
 ! exclusive means available to a       
compla9ant seek+ a rem$y = a violation (
 any re/riction specifi$ 9 p>agraph     
7#c71 7#f71 or #g7;,b7 or any o!r       
provision ( ?is section4  7#aj7         
,anti-tru/ exemption  7,a7 ,9 g5]al     
,except z provid$ 9 subp>agraph 7,c71 x 
%all n be consid]$ a violation ( any    
provision ( antitru/ laws = two or m    
non-,f$]al entities to %>e a cyb] ?reat 
indicator or def5sive measure1 or       
assi/ance relat+ to ! prev5tion1        
inve/igation1 or mitigation ( a         
cyb]security risk or incid5t1 =         
cyb]security purposes "u ?is ,act4  7,b7
 ,applicability ,subp>agraph 7,a7 %all  
apply only to in=mation t is %>$ or     
assi/ance t is provid$ 9 ord] to assi/  
)-- 7i7 facilitat+ ! prev5tion1         
inve/igation1 or mitigation ( a         
cyb]security risk or incid5t to an      
in=mation sy/em or in=mation t is /or$  

on1 process$ by1 or transit+ an         
in=mation sy/em2 or  7ii7 communicat+ or
 disclos+ a cyb] ?reat indicator or     
def5sive measure to help prev5t1        
inve/igate1 or mitigate ! effect ( a    
cyb]security risk or incid5t to an      
in=mation sy/em or in=mation t is /or$  
on1 process$ by1 or transit+ an         
in=mation sy/em4  7,c7 ,prohibit$       
conduct ,no?+ 9 ?is section may be      
con/ru$ to p]mit price-fix+1 allocat+ a 
m>ket betwe5 competitors1 monopoliz+ or 
attempt+ to monopolize a m>ket1 or      
ex*anges ( price or co/ in=mation1      
cu/om] li/s1 or in=mation reg>d+ future 
competitive plann+4  7#aa7 ,con/ruction 
& preemption  7,a7 ,o!rwise lawful      
disclosures ,no?+ 9 ?is section may be  
con/ru$ to limit or prohibit o!rwise    
lawful disclosures ( communications1    
records1 or o!r in=mation1 includ+      
report+ ( kn[n or suspect$ crim9al      
activity or p>ticipat+ volunt>ily or "u 
legal requirem5t 9 an inve/igation1 by a
 non-,f$]al to any o!r non-,f$]al entity

 or ,f$]al entity "u ?is section4  7,b7 
,:i/le bl[] protections ,no?+ 9 ?is     
section may be con/ru$ to prohibit or   
limit ! disclosure ( in=mation protect$ 
"u section #bcjb7;b77#h7 ( title #e1    
,unit$ ,/ates ,code 7gov]n+ disclosures 
( illegality1 wa/e1 fraud1 abuse1 or    
public heal? or safety ?reats71 section 
#gbaa ( title #e1 ,unit$ ,/ates ,code   
7gov]n+ disclosures to ,congress71      
section #ajcd ( title #aj1 ,unit$ ,/ates
 ,code 7gov]n+ disclosure to ,congress  
by memb]s ( ! milit>y71 section #aajd ( 
! ,national ,security ,act ( #aidg 7#ej 
,u4,s4,c4 #cbcd7 7gov]n+ disclosure by  
employees ( elem5ts ( ! intellig5ce     
community71 or any simil> provision (   
,f$]al or ,/ate law4  7,c7 ,relation%ip 
to o!r laws ,no?+ 9 ?is section may be  
con/ru$ to affect any requirem5t "u any 
o!r provision ( law = a non-,f$]al      
entity to provide in=mation to a ,f$]al 
entity4  7,d7 ,pres]vation ( contractual
 obligations & rights ,no?+ 9 ?is       
section may be con/ru$ to--  7i7 am5d1  

repeal1 or sup]s$e any curr5t or future 
contractual agreem5t1 t]ms ( s]vice     
agreem5t1 or o!r contractual relation%ip
 betwe5 any non-,f$]al entities1 or     
betwe5 any non-,f$]al entity & a ,f$]al 
entity2 or  7ii7 abrogate trade secret  
or intellectual prop]ty rights ( any    
non-,f$]al entity or ,f$]al entity4     
7,e7 ,anti-task+ re/riction ,no?+ 9 ?is 
section may be con/ru$ to p]mit a ,f$]al
 entity to-- 7i7 require a non-,f$]al   
entity to provide in=mation to a ,f$]al 
entity2  7ii7 condition ! %>+ ( cyb]    
?reat indicators or def5sive measures ) 
a non-,f$]al entity on su* non-,f$]al   
entity's provision ( cyb] ?reat         
indicators or def5sive measures to a    
,f$]al entity2 or  7iii7 condition !    
aw>d ( any ,f$]al grant1 contract1 or   
pur*ase on ! %>+ ( cyb] ?reat indicators
 or def5sive measures ) a ,f$]al entity4
  7,f7 ,no liability = non-p>ticipation 
,no?+ 9 ?is section may be con/ru$ to   
subject any non-,f$]al entity to        
liability = *oos+ to n engage 9 !       

volunt>y activities au?oriz$ "u ?is     
section4  7,g7 ,use & ret5tion (        
in=mation ,no?+ 9 ?is section may be    
con/ru$ to au?orize1 or to modify any   
exi/+ au?ority (1 a dep>tm5t or ag5cy ( 
! ,f$]al ,gov]nm5t to reta9 or use any  
in=mation %>$ "u ?is section = any use  
o!r ?an p]mitt$ 9 ?is section4  7,h7    
,volunt>y %>+ ,no?+ 9 ?is section may be
 con/ru$ to re/rict or condition a      
non-,f$]al entity f %>+1 = cyb]security 
purposes1 cyb] ?reat indicators1        
def5sive measures1 or in=mation relat$  
to cyb]security risks or incid5ts ) any 
o!r non-,f$]al entity1 & no?+ 9 ?is     
section may be con/ru$ z requir+ any    
non-,f$]al entity to %>e cyb] ?reat     
indicators1 def5sive measures1 or       
in=mation relat$ to cyb]security risks  
or incid5ts ) ! ,c5t]4  7,i7 ,f$]al     
preemption ,?is section sup]s$es any    
/atute or o!r provision ( law ( a ,/ate 
or political subdivision ( a ,/ate t    
re/ricts or o!rwise expressly regulates 
an activity au?oriz$ "u ?is section4    

7j7 ,direct report+ ,! ,secret>y %all   
develop policies & proc$ures = direct   
report+ to ! ,secret>y by ! ,director ( 
! ,c5t] reg>d+ significant cyb]security 
risks & incid5ts4  7k7 ,additional      
responsibilities ,! ,secret>y %all build
 ^u exi/+ me*anisms to promote a        
national aw>5ess ef=t to educate ! g5]al
 public on ! importance ( secur+        
in=mation sy/ems4  7l7 ,reports on      
int]national coop]ation ,n lat] ?an #ahj
 days aft] ! date ( ! enactm5t ( ?is    
subsection & p]iodically !reaft]1 !     
,secret>y ( ,homel& ,security %all      
submit to ! ,committee on ,homel&       
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate a report
 on ! range ( ef=ts und]way to bol/]    
cyb]security collaboration ) relevant   
int]national p>tn]s 9 accordance )      
subsection 7c77#h74  7m7 ,outrea* ,n    
lat] ?an #fj days aft] ! date ( !       
enactm5t ( ?is subsection1 ! ,secret>y1 
act+ ?r\gh ! ,"u ,secret>y =            

,cyb]security & ,infra/ructure          
,protection1 %all--  7#a7 dissem9ate to 
! public in=mation ab\t h[ to volunt>ily
 %>e cyb] ?reat indicators & def5sive   
measures ) ! ,c5t]2 &  7#b7 enhance     
outrea* to critical infra/ructure own]s 
& op]ators = purposes ( su* %>+4  4  #d4
 ,in=mation %>+ & analysis organizations
 ,section #bab ( ! ,homel& ,security    
,act ( #bjjb 7#f ,u4,s4,c4 #aca7 is     
am5d$-- 7#a7 9 p>agraph 7#e7--  7,a7 9  
subp>agraph 7,a7-- 7i7 by ins]t+        
in=mation relat$ to cyb]security risks &
 incid5ts & aft] critical infra/ructure 
in=mation2 &  7ii7 by /rik+ relat$ to   
critical infra/ructure & ins]t+ relat$  
to cyb]security risks1 incid5ts1        
critical infra/ructure1 &2  7,b7 9      
subp>agraph 7,b7--  7i7 by /rik+        
disclos+ critical infra/ructure         
in=mation & ins]t+ disclos+ cyb]security
 risks1 incid5ts1 & critical            
infra/ructure in=mation2 &  7ii7 by     
/rik+ relat$ to critical infra/ructure  
or & ins]t+ relat$ to cyb]security      

risks1 incid5ts1 critical infra/ructure1
 or &  7,c7 9 subp>agraph 7,c71 by /rik+
 dissem9at+ critical infra/ructure      
in=mation & ins]t+ dissem9at+           
cyb]security risks1 incid5ts1 & critical
 infra/ructure in=mation2 &  7#b7 by    
add+ at ! end ! foll[+ new p>agraph3    
7#h7 ,cyb]security risk2 incid5t ,! t]ms
 cyb]security risk & incid5t h ! mean+s 
giv5 su* t]ms 9 ! second section #bbf   
7relat+ to ! ,national ,cyb]security &  
,communications ,integration ,c5t]74  4 
#e4 ,/reaml9+ ( ,dep>tm5t ( ,homel&     
,security cyb]security & infra/ructure  
protection organization  7a7            
,cyb]security & ,infra/ructure          
,protection ,! ,national ,protection &  
,programs ,directorate ( ! ,dep>tm5t (  
,homel& ,security %all1 aft] ! date ( ! 
enactm5t ( ?is ,act1 be kn[n & designat$
 z ! ,cyb]security & ,infra/ructure     
,protection4 ,any ref]5ce to ! ,national
 ,protection & ,programs ,directorate ( 
! ,dep>tm5t 9 any law1 regulation1 map1 
docum5t1 record1 or o!r pap] ( ! ,unit$ 

,/ates %all be deem$ to be a ref]5ce to 
! ,cyb]security & ,infra/ructure        
,protection ( ! ,dep>tm5t4  7b7 ,s5ior  
lead]%ip ( ,cyb]security &              
,infra/ructure ,protection  7#a7 ,9     
g5]al ,subsection 7a7 ( section #ajc ( !
 ,homel& ,security ,act ( #bjjb 7#f     
,u4,s4,c4 #aac7 is am5d$-- 7,a7 9       
p>agraph 7#a7--  7i7 by am5d+           
subp>agraph 7,h7 to read z foll[s3  7,h7
 ,an ,"u ,secret>y = ,cyb]security &    
,infra/ructure ,protection4  2 &  7ii7  
by add+ at ! end ! foll[+ new           
subp>agraphs3  7,k7 ,a ,deputy ,"u      
,secret>y = ,cyb]security4  7,l7 ,a     
,deputy ,"u ,secret>y = ,infra/ructure  
,protection4  2 &  7,b7 by add+ at ! end
 ! foll[+ new p>agraph3  7#c7 ,deputy   
,"u ,secret>ies ,! ,deputy ,"u          
,secret>ies ref]r$ to 9 subp>agraphs    
7,k7 & 7,l7 ( p>agraph 7#a7 %all be     
appo9t$ by ! ,presid5t )\t ! advice &   
cons5t ( ! ,s5ate4  4  7#b7 ,cont9uation
 9 (fice ,! individuals :o hold !       
positions ref]r$ 9 subp>agraphs 7,h71   

7,k71 & 7,l7 ( p>agraph 7#a7 ( section  
#ajc7;a7 ! ,homel& ,security ,act (     
#bjjb 7z am5d$ & add$ by p>agraph 7#a7 (
 ?is subsection7 z ( ! date ( ! enactm5t
 ( ?is ,act may cont9ue to hold su*     
positions4  7c7 ,report ,n lat] ?an #ij 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,"u ,secret>y = ,cyb]security & 
,infra/ructure ,protection ( ! ,dep>tm5t
 ( ,homel& ,security %all submit to !   
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives & ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate a report on !       
feasibility ( becom+ an op]ational      
compon5t1 includ+ an analysis (         
alt]natives1 & if a det]m9ation is r5d]$
 t becom+ an op]ational compon5t is !   
be/ option = a*iev+ ! mission (         
,cyb]security & ,infra/ructure          
,protection1 a legislative proposal &   
implem5tation plan = becom+ su* an      
op]ational compon5t4 ,su* report %all   
also include plans to m effectively c>ry
 out ! cyb]security mission (           

,cyb]security & ,infra/ructure          
,protection1 includ+ exp$it+ in=mation  
%>+ agreem5ts4  #f4 ,cyb] incid5t       
response plans  7a7 ,9 g5]al ,section   
#bbg ( ! ,homel& ,security ,act ( #bjjb 
7#f ,u4,s4,c4 #adi7 is am5d$--  7#a7 9 !
 head+1 by /rik+ plan & ins]t+ plans2   
7#b7 by /rik+ ,! ,"u ,secret>y appo9t$  
"u section #ajc7;a77#a77;,h7 %all &     
ins]t+ ! foll[+3  7a7 ,9 g5]al ,! ,"u   
,secret>y = ,cyb]security &             
,infra/ructure ,protection %all  2 &    
7#c7 by add+ at ! end ! foll[+ new      
subsection3  7b7 ,updates to ! ,cyb]    
,incid5t ,annex to ! ,national ,response
 ,framework ,! ,secret>y1 9 coord9ation 
) ! heads ( o!r appropriate ,f$]al      
dep>tm5ts & ag5cies1 & 9 accordance ) ! 
,national ,cyb]security ,incid5t        
,response ,plan requir$ "u subsection   
7a71 %all regul>ly update1 ma9ta91 &    
ex]cise ! ,cyb] ,incid5t ,annex to !    
,national ,response ,framework ( !      
,dep>tm5t4  4  7b7 ,cl]ical am5dm5t ,!  
table ( cont5ts ( ! ,homel& ,security   

,act ( #bjjb is am5d$ by am5d+ ! item   
relat+ to section #bbg to read z foll[s3
  ,sec4 #bbg4 ,cyb] incid5t response    
plans4  4  #g4 ,security & resili5cy (  
public safety communications2           
,cyb]security aw>5ess campaign  7a7 ,9  
g5]al ,subtitle ,c ( title ,,ii ( !     
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #ada et seq47 is am5d$ by add+
 at ! end ! foll[+ new sections3  #bcj4 
,security & resili5cy ( public safety   
communications ,! ,national             
,cyb]security & ,communications         
,integration ,c5t]1 9 coord9ation ) !   
,(fice ( ,em]g5cy ,communications ( !   
,dep>tm5t1 %all assess & evaluate       
consequ5ce1 vuln]ability1 & ?reat       
in=mation reg>d+ cyb] incid5ts to public
 safety communications to help          
facilitate cont9u\s improvem5ts to !    
security & resili5cy ( su*              
communications4  #bca4 ,cyb]security    
aw>5ess campaign  7a7 ,9 g5]al ,! ,"u   
,secret>y = ,cyb]security &             
,infra/ructure ,protection %all develop 

& implem5t an ongo+ & compreh5sive      
cyb]security aw>5ess campaign reg>d+    
cyb]security risks & volunt>y be/       
practices = mitigat+ & respond+ to su*  
risks4 ,su* campaign %all1 at a m9imum1 
publi% & dissem9ate1 on an ongo+ basis1 
! foll[+3 7#a7 ,public s]vice           
ann\ncem5ts t>get$ at improv+ aw>5ess   
among ,/ate1 local1 & tribal gov]nm5ts1 
! private sector1 academia1 & /akehold]s
 9 specific audi5ces1 includ+ ! eld]ly1 
/ud5ts1 small bus9esses1 memb]s ( !     
,arm$ ,=ces1 & vet]ans4  7#b7 ,v5dor &  
te*nology-neutral volunt>y be/ practices
 in=mation4  7b7 ,consultation ,! ,"u   
,secret>y = ,cyb]security &             
,infra/ructure ,protection %all consult 
) a wide range ( /akehold]s 9 gov]nm5t1 
indu/ry1 academia1 & ! non-pr(it        
community 9 c>ry+ out ?is section4  4   
7b7 ,cl]ical am5dm5t ,! table ( cont5ts 
( ! ,homel& ,security ,act ( #bjjb is   
am5d$ by ins]t+ aft] ! item relat+ to   
section #bbf 7relat+ to cyb]security    
recruitm5t & ret5tion7 ! foll[+ new     

items3  ,sec4 #bcj4 ,security &         
resili5cy ( public safety               
communications4 ,sec4 #bca4             
,cyb]security aw>5ess campaign4  4  #h4 
,critical infra/ructure protection      
rese>* & developm5t  7a7 ,/rategic plan2
 ,public-private consortiums ,title     
,,iii ( ! ,homel& ,security ,act ( #bjjb
 7#f ,u4,s4,c4 #aha et seq47 is am5d$ by
 add+ at ! end ! foll[+ new section3    
#cah4 ,rese>* & developm5t /rategy =    
critical infra/ructure protection  7a7  
,9 g5]al ,n lat] ?an #ahj days aft] !   
date ( enactm5t ( ?is section1 !        
,secret>y1 act+ ?r\gh ! ,"u ,secret>y = 
,sci5ce & ,te*nology1 %all submit to    
,congress a /rategic plan to guide !    
ov]all direction ( ,f$]al physical      
security & cyb]security te*nology rese>*
 & developm5t ef=ts = protect+ critical 
infra/ructure1 includ+ aga9/ all ?reats4
 ,su* plan %all be updat$ & submitt$ to 
,congress e two ye>s4  7b7 ,cont5ts (   
plan ,! /rategic plan1 includ+ bi5nial  
updates1 requir$ "u subsection 7a7 %all 

include ! foll[+3  7#a7 ,an             
id5tification ( critical infra/ructure  
security risks & any associat$ security 
te*nology gaps1 t are develop$ foll[+-- 
7,a7 consultation ) /akehold]s1 includ+ 
critical infra/ructure ,sector          
,coord9at+ ,c\ncils2 &  7,b7 p]=mance by
 ! ,dep>tm5t ( a risk & gap analysis t  
consid]s in=mation receiv$ 9 su*        
consultations4  7#b7 ,a set ( critical  
infra/ructure security te*nology ne$s   
t--  7,a7 is prioritiz$ bas$ on ! risks 
& gaps id5tifi$ "u p>agraph 7#a72  7,b7 
emphasizes rese>* & developm5t (        
te*nologies t ne$ to be accel]at$ due to
 rapidly evolv+ ?reats or rapidly       
advanc+ infra/ructure te*nology2 &  7,c7
 includes rese>*1 developm5t1 &         
acquisition roadmaps ) cle>ly def9$     
objectives1 goals1 & measures4  7#c7 ,an
 id5tification ( laboratories1          
facilities1 model+1 & simulation        
capabilities t w be requir$ to support !
 rese>*1 developm5t1 demon/ration1 te/+1
 evaluation1 & acquisition ( ! security 

te*nologies describ$ 9 p>agraph 7#b74   
7#d7 ,an id5tification ( curr5t & plann$
 programmatic initiatives = fo/]+ !     
rapid advancem5t & deploym5t ( security 
te*nologies = critical infra/ructure    
protection1 includ+ a consid]ation (    
opportunities = public-private          
p>tn]%ips1 intragov]nm5t collaboration1 
univ]sity c5t]s ( excell5ce1 & national 
laboratory te*nology transf]4  7#e7 ,a  
description ( progress made ) respect to
 ea* critical infra/ructure security    
risk1 associat$ security te*nology gap1 
& critical infra/ructure te*nology ne$  
id5tifi$ 9 ! prec$+ /rategic plan       
requir$ "u subsection 7a74  7c7         
,coord9ation ,9 c>ry+ out ?is section1 !
 ,"u ,secret>y = ,sci5ce & ,te*nology   
%all coord9ate ) ! ,"u ,secret>y = !    
,national ,protection & ,programs       
,directorate4  7d7 ,consultation ,9     
c>ry+ out ?is section1 ! ,"u ,secret>y =
 ,sci5ce & ,te*nology %all consult )--  
7#a7 critical infra/ructure ,sector     
,coord9at+ ,c\ncils2  7#b7 to ! ext5t   

practicable1 subject matt] exp]ts on    
critical infra/ructure protection f     
univ]sities1 colleges1 national         
laboratories1 & private indu/ry2  7#c7 !
 heads ( o!r relevant ,f$]al dep>tm5ts &
 ag5cies t conduct rese>* & developm5t  
relat+ to critical infra/ructure        
protection2 &  7#d7 ,/ate1 local1 &     
tribal gov]nm5ts1 z appropriate4  4  7b7
 ,cl]ical am5dm5t ,! table ( cont5ts ( !
 ,homel& ,security ,act ( #bjjb is am5d$
 by ins]t+ aft] ! item relat+ to section
 #cag ! foll[+ new item3  ,sec4 #cah4   
,rese>* & developm5t /rategy = critical 
infra/ructure protection4  4  #i4       
,report on r$uc+ cyb]security risks 9   
,,dhs data c5t]s ,n lat] ?an "o ye> aft]
 ! date ( ! enactm5t ( ?is ,act1 !      
,secret>y ( ,homel& ,security %all      
submit to ! ,committee on ,homel&       
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate a report
 on ! feasibility ( ! ,dep>tm5t (       
,homel& ,security creat+ an environm5t =

 ! r$uction 9 cyb]security risks 9      
,dep>tm5t data c5t]s1 includ+ by        
increas+ comp>tm5talization betwe5      
sy/ems1 & provid+ a mix ( security      
controls betwe5 su* comp>tm5ts4  #aj4   
,assessm5t ,n lat] ?an two ye>s aft] !  
date ( ! enactm5t ( ?is ,act1 !         
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all submit to ! ,committee on ,homel&  
,security ( ! ,h\se ( ,repres5tatives & 
! ,committee on ,homel& ,security &     
,gov]nm5tal ,affairs ( ! ,s5ate a report
 t conta9s an assessm5t ( !             
implem5tation by ! ,secret>y ( ,homel&  
,security ( ?is ,act & ! am5dm5ts made  
by ?is ,act &1 to ! ext5t practicable1  
f9d+s reg>d+ increases 9 ! %>+ ( cyb]   
?reat indicators1 def5sive measures1 &  
in=mation relat+ to cyb]security risks &
 incid5ts at ! ,national ,cyb]security &
 ,communications ,integration ,c5t] &   
?r\gh\t ! ,unit$ ,/ates4  #aa4          
,consultation ,! ,"u ,secret>y =        
,cyb]security & ,infra/ructure          
,protection %all produce a report on !  

feasibility ( creat+ a risk-in=m$       
prioritization plan %\ld multiple       
critical infra/ructures exp]i5ce cyb]   
incid5ts simultane\sly4  #ab4 ,te*nical 
assi/ance ,! ,inspector ,g5]al ( !      
,dep>tm5t ( ,homel& ,security %all      
review ! op]ations ( ! ,unit$ ,/ates    
,comput] ,em]g5cy ,read9ess ,team       
7,,u-,,c]t7 & ! ,indu/rial ,control     
,sy/ems ,cyb] ,em]g5cy ,response ,team  
7,,ics-,,c]t7 to assess ! capacity to   
provide te*nical assi/ance to non-,f$]al
 entities & to adequately respond to    
pot5tial increases 9 reque/s = te*nical 
assi/ance4  #ac4 ,prohibition on new    
regulatory au?ority ,no?+ 9 ?is ,act or 
! am5dm5ts made by ?is ,act may be      
con/ru$ to grant ! ,secret>y ( ,homel&  
,security any au?ority to promulgate    
regulations or set /&>ds relat+ to !    
cyb]security ( non-,f$]al entities1 n   
includ+ ,/ate1 local1 & tribal          
gov]nm5ts1 t 0 n 9 effect on ! day be=e 
! date ( ! enactm5t ( ?is ,act4  #ad4   
,sunset ,any requirem5ts = reports      

requir$ by ?is ,act or ! am5dm5ts made  
by ?is ,act %all t]m9ate on ! date t is 
sev5 ye>s aft] ! date ( ! enactm5t ( ?is
 ,act4  #ae4 ,prohibition on new fund+  
,no funds are au?oriz$ to be appropriat$
 to c>ry out ?is ,act & ! am5dm5ts made 
by ?is ,act4 ,?is ,act & su* am5dm5ts   
%all be c>ri$ out us+ am\nts appropriat$
 or o!rwise made available = su*        
purposes4  ,april #ag1 #bjae ,report$ ) 
an am5dm5t1 committ$ to ! ,committee ( !
 ,:ole ,h\se on ! ,/ate ( ! ,union1 &   
ord]$ to be pr9t$