,,ii  #aad? ,,congress  #a/ ,session    
,s4 #ahbh  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #bb1 #bjae ,ms4  
,coll9s 7= h]self1 ,mr4 ,w>n]1 ,ms4     
,mikulski1 ,mr4 ,coats1 ,ms4 ,ayotte1 & 
,mrs4 ,mc,caskill7 introduc$ ! foll[+   
bill2 :i* 0 read twice & ref]r$ to !    
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
/r5g!n ! ability ( ! ,secret>y ( ,homel&
 ,security to detect & prev5t intrusions
 aga9/1 & to use c\nt]measures to       
protect1 ,gov]nm5t ag5cy in=mation      
sy/ems1 & = o!r purposes4  #a4 ,%ort    
title  ,?is ,act may be cit$ z ! ,f$]al 
,in=mation ,security ,managem5t ,re=m   
,act ( #bjae4  #b4 ,duties ( ! ,secret>y
 ( ,homel& ,security relat$ to in=mation
 security ,section #ceec7;b77#f7 ( title
 #dd1 ,unit$ ,/ates ,code1 is am5d$ by  
/rik+ subp>agraphs 7,b71 7,c71 & 7,d7 & 
ins]t+ ! foll[+3  7,b7 op]at+           
consolidat$ intrusion detection1        
prev5tion1 or o!r protective            
capabilities & use ( associat$          

c\nt]measures = ! purpose ( protect+    
ag5cy in=mation & in=mation sy/ems f    
in=mation security ?reats2  7,c7 provid+
 incid5t detection1 analysis1           
mitigation1 & response in=mation &      
remote or onsite te*nical assi/ance to !
 head ( an ag5cy2  7,d7 compil+ &       
analyz+ data on ag5cy in=mation         
security2  7,e7 develop+ & conduct+     
t>get$ risk assessm5ts & op]ational     
evaluations = ag5cy in=mation &         
in=mation sy/ems 9 consultation ) !     
heads ( o!r ag5cies or gov]nm5tal &     
private entities t own & op]ate su*     
sy/ems1 t may include ?reat1            
vuln]ability1 & impact assessm5ts2  7,f7
 9 conjunction ) o!r ag5cies & ! private
 sector1 assess+ & fo/]+ ! developm5t ( 
in=mation security te*nologies &        
capabilities = use across multiple      
ag5cies2 &  7,g7 coord9at+ ) appropriate
 ag5cies & (ficials to ensure1 to !     
maximum ext5t feasible1 t policies &    
directives issu$ "u p>agraph 7#b7 are   
complem5t>y )--  7i7 /&>ds & guidel9es  

develop$ = national security sy/ems2 &  
7ii7 policies & directives issu$ by !   
,secret>y ( ,def5se & ! ,director (     
,national ,intellig5ce "u subsection    
7e77#a72 &  4  #c4 ,communications &    
sy/em traffic & direction to ag5cies    
,section #ceec ( title #dd1 ,unit$      
,/ates ,code1 is am5d$ by add+ at ! end 
! foll[+3  7h7 ,communications & sy/ems 
traffic  7#a7 ,9 g5]al  7,a7            
,acquisition by ! ,secret>y ,not)/&+ any
 o!r provision ( law & subject to       
subp>agraph 7,b71 9 c>ry+ out !         
responsibilities "u subp>agraphs 7,b71  
7,c71 & 7,e7 ( subsection 7b77#f71 if ! 
,secret>y makes a c]tification describ$ 
9 p>agraph 7#b71 ! ,secret>y may        
acquire1 int]cept1 reta91 use1 &        
disclose communications & o!r sy/em     
traffic t are transit+ to or f or /or$  
on ag5cy in=mation sy/ems & deploy      
c\nt]measures ) reg>d to !              
communications & sy/em traffic4  7,b7   
,exception ,! au?orities ( ! ,secret>y  
"u ?is subsection %all n apply to a     

communication or o!r sy/em traffic t is 
transit+ to or f or /or$ on a sy/em     
describ$ 9 p>agraph 7#b7 or 7#c7 (      
subsection 7e74  7,c7 ,disclosure by    
,f$]al ag5cy heads ,! head ( a ,f$]al   
ag5cy or dep>tm5t is au?oriz$ to        
disclose to ! ,secret>y or a private    
entity provid+ assi/ance to ! ,secret>y 
"u p>agraph 7,a71 in=mation travel+ to  
or f or /or$ on an ag5cy in=mation      
sy/em1 not)/&+ any o!r law t w\ld       
o!rwise re/rict or prev5t ag5cy heads f 
disclos+ su* in=mation to ! ,secret>y4  
7#b7 ,c]tification ,a c]tification      
describ$ 9 ?is p>agraph is a            
c]tification by ! ,secret>y t-- 7,a7 !  
acquisitions1 int]ceptions1 & o!r       
c\nt]measures are reasonably necess>y = 
! purpose ( protect+ ag5cy in=mation    
sy/ems f in=mation security ?reats2     
7,b7 ! cont5t ( communications w be     
reta9$ only if ! communication is       
associat$ ) a kn[n or reasonably        
suspect$ in=mation security ?reat1 &    
communications & sy/em traffic w n be   

subject to ! op]ation ( a c\nt]measure  
unless associat$ ) ! ?reats2  7,c7      
in=mation obta9$ "u activities au?oriz$ 
"u ?is subsection w only be reta9$1 us$1
 or disclos$ to protect ag5cy in=mation 
sy/ems f in=mation security ?reats1     
mitigate aga9/ su* ?reats1 or1 ) !      
approval ( ! ,attorney ,g5]al1 = law    
en=cem5t purposes :5 ! in=mation is     
evid5ce ( a crime :i* has be51 is be+1  
or is ab\t to be committ$2  7,d7 notice 
has be5 provid$ to us]s ( ag5cy         
in=mation sy/ems conc]n+ ! pot5tial =   
acquisition1 int]ception1 ret5tion1 use1
 & disclosure ( communications & o!r    
sy/em traffic2 &  7,e7 ! activities are 
implem5t$ pursuant to policies &        
proc$ures gov]n+ ! acquisition1         
int]ception1 ret5tion1 use1 & disclosure
 ( communications & o!r sy/em traffic t 
h be5 review$ & approv$ by ! ,attorney  
,g5]al4  7#c7 ,private entities ,!      
,secret>y may ent] into contracts or o!r
 agreem5ts1 or o!rwise reque/ & obta9 ! 
assi/ance (1 private entities t provide 

electronic communication or in=mation   
security s]vices to acquire1 int]cept1  
reta91 use1 & disclose communications & 
o!r sy/em traffic 9 accordance ) ?is    
subsection4  7#d7 ,no cause ( action ,no
 cause ( action %all exi/ aga9/ a       
private entity = assi/ance provid$ to ! 
,secret>y 9 accordance ) p>agraph 7#c74 
7i7 ,direction to ag5cies  7#a7         
,au?ority  7,a7 ,9 g5]al ,not)/&+       
section #ceed1 & subject to subp>agraph 
7,b71 9 response to a kn[n or reasonably
 suspect$ in=mation security ?reat1     
vuln]ability1 or incid5t t repres5ts a  
sub/antial ?reat to ! in=mation security
 ( an ag5cy1 ! ,secret>y may issue a    
directive to ! head ( an ag5cy to take  
any lawful action ) respect to !        
op]ation ( ! in=mation sy/em1 includ+   
su* sy/ems own$ or op]at$ by ano!r      
entity on behalf ( an ag5cy1 t collects1
 processes1 /ores1 transmits1           
dissem9ates1 or o!rwise ma9ta9s ag5cy   
in=mation1 = ! purpose ( protect+ !     
in=mation sy/em f1 or mitigat+1 an      

in=mation security ?reat4  7,b7         
,exception ,! au?orities ( ! ,secret>y  
"u ?is subsection %all n apply to a     
sy/em describ$ 9 p>agraph 7#b7 or 7#c7 (
 subsection 7e74  7#b7 ,proc$ures = use 
( au?ority ,! ,secret>y %all-- 7,a7 9   
coord9ation ) ! ,director & 9           
consultation ) ,f$]al contractors1 z    
appropriate1 e/abli% proc$ures gov]n+ ! 
circum/ances "u :i* a directive may be  
issu$ "u ?is subsection1 :i* %all       
include--  7i7 ?re%olds & o!r crit]ia2  
7ii7 privacy & civil lib]ties           
protections2 &  7iii7 provid+ notice to 
pot5tially affect$ ?ird p>ties2  7,b7   
specify ! reasons = ! requir$ action & !
 duration ( ! directive2  7,c7 m9imize !
 impact ( a directive "u ?is subsection 
by-- 7i7 adopt+ ! lea/ intrusive means  
possible "u ! circum/ances to secure !  
ag5cy in=mation sy/ems2 &  7ii7 limit+  
directives to ! %orte/ p]iod            
practicable2 &  7,d7 notify ! ,director 
& ! head ( any affect$ ag5cy imm$iately 
^u ! issuance ( a directive "u ?is      

subsection4  7#c7 ,imm95t ?reats  7,a7  
,9 g5]al ,if ! ,secret>y det]m9es t !re 
is an imm95t ?reat to ag5cy in=mation   
sy/ems & a directive "u ?is subsection  
is n reasonably likely to result 9 a    
timely response to ! ?reat1 ! ,secret>y 
may au?orize ! use ( protective         
capabilities "u ! control ( ! ,secret>y 
= communications or o!r sy/em traffic   
transit+ to or f or /or$ on an ag5cy    
in=mation sy/em )\t prior consultation )
 ! affect$ ag5cy = ! purpose ( ensur+ ! 
security ( ! in=mation or in=mation     
sy/em or o!r ag5cy in=mation sy/ems4    
7,b7 ,limitation on delegation ,!       
au?ority "u ?is p>agraph may n be       
delegat$ to an (ficial 9 a position l[] 
?an an ,assi/ant ,secret>y ( ! ,dep>tm5t
 ( ,homel& ,security4  7,c7 ,notice ,!  
,secret>y %all imm$iately notify !      
,director & ! head & *ief in=mation     
(fic] 7or equival5t (ficial7 ( ea*      
affect$ ag5cy (--  7i7 any action tak5  
"u ?is subsection2 &  7ii7 ! reasons = &
 duration & nature ( ! action4  7,d7    

,o!r law ,any action ( ! ,secret>y "u   
?is p>agraph %all be consi/5t )         
applicable law4  7#d7 ,limitation ,!    
,secret>y may direct or au?orize lawful 
action or protective capability "u ?is  
subsection only to--  7,a7 protect ag5cy
 in=mation f unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction2 or  7,b7 require !         
rem$iation ( or protect aga9/ id5tifi$  
in=mation security risks ) respect to-- 
7i7 in=mation collect$ or ma9ta9$ by or 
on behalf ( an ag5cy2 or  7ii7 t portion
 ( an in=mation sy/em us$ or op]at$ by  
an ag5cy or by a contractor ( an ag5cy  
or o!r organization on behalf ( an      
ag5cy4  4  #d4 ,report to ,congress     
reg>d+ (fice ( managem5t & budget       
en=cem5t action ,section #ceec ( title  
#dd1 ,unit$ ,/ates ,code1 z am5d$ by    
section #c1 is fur!r am5d$ by ins]t+ at 
! end ! foll[+ new subsection3  7j7     
,annual report to ,congress  7#a7       
,requirem5t ,n lat] ?an ,febru>y #a ( e 
ye>1 ! ,director %all report to !       

appropriate congressional committee     
reg>d+ ! specific actions ! ,director   
has tak5 pursuant to subsection 7a77#e71
 includ+ any actions tak5 pursuant to   
p>agraph 7#e7 ( title #dj ( section     
#aacjc7;b74  7#b7 ,appropriate          
congressional committee ,9 ?is          
subsection1 ! t]m appropriate           
congressional committee means-- 7,a7 !  
,committee on ,appropriations & !       
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2 &  7,b7
 ! ,committee on ,appropriations & !    
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  4