,,ii ,calendar ,no4 #fgc #aadth         
,,congress  #b;d ,session  ,s4 #ahfi    
,report ,no4 #aad-cgh ,,in ,,the        
,,senate ,,of ,,the ,,united ,,states   
,july #bg1 #bjae,mr4 ,carper 7for       
himself and ,mr4 ,johnson7 introduced   
the following bill2 which was read twice
 and referred to the ,committee on      
,homeland ,security and ,governmental   
,affairs  ,november #ag1 #bjaf,reported 
by ,mr4 ,johnson1 with amendments,omit  
the part struck through and insert the  
part printed in italic  ,a ,,bill  ,to  
improve ,federal network security and   
authorize and enhance an existing       
intrusion detection and prevention      
system for civilian ,federal networks4  
#a4 ,short title ,this ,act may be cited
 as the ,federal ,cybersecurity         
,enhancement ,act of #bjae ,federal     
,cybersecurity ,enhancement ,act of     
#bjaf4  #b4 ,definitions ,in this ,act--
 7#a7 the term agency has the meaning   
given the term in section #cejb of title
 #dd1 ,united ,states ,code2  7#b7 the  

term agency information system has the  
meaning given the term in section #bbh  
of the ,homeland ,security ,act of      
#bjjb1 as added by section #c7;a72  7#c7
 the term appropriate congressional     
committees means-- 7,a7 the ,committee  
on ,homeland ,security and ,governmental
 ,affairs of the ,senate2 and  7,b7 the 
,committee on ,homeland ,security of the
 ,house of ,representatives2  7#d7 the  
terms cybersecurity risk and information
 system have the meanings given those   
terms in section #bbg of the ,homeland  
,security ,act of #bjjb1 as so          
redesignated by section #c7;a72  7#e7   
the term ,director means the ,director  
of the ,office of ,management and       
,budget2  7#f7 the term intelligence    
community has the meaning given the term
 in section #c7d7 of the ,national      
,security ,act of #aidg 7#ej ,u4,s4,c4  
#cjjc7d772 and  7#g7 the term ,secretary
 means the ,secretary of ,homeland      
,security4  #c4 ,improved ,federal      
network security  7a7 ,in general       

,subtitle ,c of title ,,ii of the       
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #ada et seq47 is amended--    
7#a7 by redesignating section #bbh as   
section #bbi2  7#b7 by redesignating    
section #bbg as subsection 7c7 of       
section #bbh1 as added by paragraph     
7#d71 and adjusting the margins         
accordingly2  7#c7 by redesignating the 
second section designated as section    
#bbf 7relating to the national          
cybersecurity and communications        
integration center7 as section #bbg2    
7#d7 by inserting after section #bbg1 as
 so redesignated1 the following3  #bbh4 
,cybersecurity plans  7a7 ,definitions  
,in this section--  7#a7 the term agency
 information system means an information
 system used or operated by an agency1  
by a contractor of an agency1 or by     
another entity on behalf of an agency2  
7#b7 the terms cybersecurity risk and   
information system have the meanings    
given those terms in section #bbg2 and  
7#c7 the term information sharing and   

analysis organization has the meaning   
given the term in section #bab7e72 and  
7#dc7 the term intelligence community   
has the meaning given the term in       
section #c7d7 of the ,national ,security
 ,act of #aidg 7#ej ,u4,s4,c4 #cjjc7d774
  7b7 ,intrusion assessment plan  7#a7  
,requirement ,the ,secretary1 in        
coordination with the ,director of the  
,office of ,management and ,budget1     
shall develop and implement an intrusion
 assessment plan to identify and remove 
intruders in agency information systems4
  7#b7 ,exception ,the intrusion        
assessment plan required under paragraph
 7#a7 shall not apply to the ,department
 of ,defense or an element of the       
intelligence community4  2  7#e7 in     
section #bbh7;c71 as so redesignated1 by
 striking section #bbf and inserting    
section #bbg2 and  7#f7 by inserting    
after section #bbi1 as so redesignated1 
the following3  #bcj4 ,federal intrusion
 detection and prevention system  7a7   
,definitions ,in this section-- 7#a7 the

 term agency has the meaning given that 
term in section #cejb of title #dd1     
,united ,states ,code2  7#b7 the term   
agency information means information    
collected or maintained by or on behalf 
of an agency2  7#c7 the term agency     
information system has the meaning given
 the term in section #bbh2 and  7#d7 the
 terms cybersecurity risk and           
information system have the meanings    
given those terms in section #bbg4  7b7 
,requirement  7#a7 ,in general ,not     
later than #a year after the date of    
enactment of this section1 the          
,secretary shall deploy1 operate1 and   
maintain1 to make available for use by  
any agency1 with or without             
reimbursement--  7,a7 a capability to   
detect cybersecurity risks in network   
traffic transiting or traveling to or   
from an agency information system2 and  
7,b7 a capability to prevent network    
traffic associated with such            
cybersecurity risks from transiting or  
traveling to or from an agency          

information system or modify such       
network traffic to remove the           
cybersecurity risk4  7#b7 ,regular      
improvement ,the ,secretary shall       
regularly deploy new technologies and   
modify existing technologies to the     
intrusion detection and prevention      
capabilities described in paragraph 7#a7
 as appropriate to improve the intrusion
 detection and prevention capabilities4 
7c7 ,activities ,in carrying out        
subsection 7b71 the ,secretary-- 7#a7   
may access1 and the head of an agency   
may disclose to the ,secretary or a     
private entity providing assistance to  
the ,secretary under paragraph 7#b71    
information transiting or traveling to  
or from an agency information system1   
regardless of the location from which   
the ,secretary or a private entity      
providing assistance to the ,secretary  
under paragraph 7#b7 accesses such      
information1 notwithstanding any other  
provision of law that would otherwise   
restrict or prevent the head of an      

agency from disclosing such information 
to the ,secretary or a private entity   
providing assistance to the ,secretary  
under paragraph 7#b72  7#b7 may enter   
into contracts or other agreements with1
 or otherwise request and obtain the    
assistance of1 private entities to      
deploy and operate technologies in      
accordance with subsection 7b72  7#c7   
may retain1 use1 and disclose           
information obtained through the conduct
 of activities authorized under this    
section only to protect information and 
information systems from cybersecurity  
risks2  7#d7 shall regularly assess     
through operational test and evaluation 
in real world or simulated environments 
available advanced protective           
technologies to improve detection and   
prevention capabilities1 including      
commercial and non-commercial           
technologies and detection technologies 
beyond signature-based detection1 and   
utilize such technologies when          
appropriate2  7#e7 shall establish a    

pilot to acquire1 test1 and deploy1 as  
rapidly as possible1 technologies       
described in paragraph 7#d72 and  7#f7  
shall periodically update the privacy   
impact assessment required under section
 #bjh7;b7 of the ,e-,government ,act of 
#bjjb 7#dd ,u4,s4,c4 #ceja note742 and  
7#g7 shall ensure that-- 7,a7 activities
 carried out under this section are     
reasonably necessary for the purpose of 
protecting agency information and agency
 information systems from a             
cybersecurity risk2  7,b7 information   
accessed by the ,secretary will be      
retained no longer than reasonably      
necessary for the purpose of protecting 
agency information and agency           
information systems from a cybersecurity
 risk2  7,c7 notice has been provided to
 users of an agency information system  
concerning access to communications of  
users of the agency information system  
for the purpose of protecting agency    
information and the agency information  
system2 and  7,d7 the activities are    

implemented pursuant to policies and    
procedures governing the operation of   
the intrusion detection and prevention  
capabilities4  7d7 ,private entities    
7#a7 ,conditions ,a private entity      
described in subsection 7c77#b7 may     
not-- 7,a7 disclose any network traffic 
transiting or traveling to or from an   
agency information system to any entity 
other than the ,department or the agency
 that disclosed the information under   
subsection 7c77#a72 or  7,b7 use any    
network traffic transiting or traveling 
to or from an agency information system 
to which the private entity gains access
 in accordance with this section for any
 purpose other than to protect agency   
information and agency information      
systems against cybersecurity risks or  
to administer a contract or other       
agreement entered into pursuant to      
subsection 7c77#b7 or as part of another
 contract with the ,secretary4  7#b7    
,limitation on liability ,no cause of   
action shall lie in any court against a 

private entity for assistance provided  
to the ,secretary in accordance with    
this section and any contract or        
agreement entered into pursuant to      
subsection 7c77#b74  7#c7 ,rule of      
construction ,nothing in paragraph 7#b7 
shall be construed to authorize an      
,internet service provider to break a   
user agreement with a customer4  7e7    
,attorney ,general review ,not later    
than #a year after the date of enactment
 of this section1 the ,attorney ,general
 shall review the policies and          
guidelines for the program carried out  
under this section to ensure that the   
policies and guidelines are consistent  
with applicable law governing the       
acquisition1 interception1 retention1   
use1 and disclosure of communications4  
4  7b7 ,prioritizing advanced security  
tools ,the ,director and the ,secretary1
 in consultation with appropriate       
agencies1 shall--  7#a7 review and      
update ,governmentwide policies and     
programs to ensure appropriate          

prioritization and use of network       
security monitoring tools within agency 
networks2 and  7#b7 brief appropriate   
congressional committees on such        
prioritization and use4  7c7 ,agency    
responsibilities  7#a7 ,in general      
,except as provided in paragraph 7#b7-- 
7,a7 not later than #a year after the   
date of enactment of this ,act or #b    
months after the date on which the      
,secretary makes available the intrusion
 detection and prevention capabilities  
under section #bcj7;b77#a7 of the       
,homeland ,security ,act of #bjjb1 as   
added by subsection 7a71 whichever is   
later1 the head of each agency shall    
apply and continue to utilize the       
capabilities to all information         
traveling between an agency information 
system and any information system other 
than an agency information system2 and  
7,b7 not later than #f months after the 
date on which the ,secretary makes      
available improvements to the intrusion 
detection and prevention capabilities   

pursuant to section #bcj7;b77#b7 of the 
,homeland ,security ,act of #bjjb1 as   
added by subsection 7a71 the head of    
each agency shall apply and continue to 
utilize the improved intrusion detection
 and prevention capabilities4  7#b7     
,exception ,the requirements under      
paragraph 7#a7 shall not apply to the   
,department of ,defense or an element of
 the intelligence community4  7d7 ,table
 of contents amendment ,the table of    
contents in section #a7;b7 of the       
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #aja note7 is amended by      
striking the items relating to the first
 section designated as section #bbf1 the
 second section designated as section   
#bbf 7relating to the national          
cybersecurity and communications        
integration center71 section #bbg1 and  
section #bbh and inserting the          
following3  ,sec4 #bbf4 ,cybersecurity  
recruitment and retention4,sec4 #bbg4   
,national cybersecurity and             
communications integration center4,sec4 

#bbh4 ,cybersecurity plans4,sec4 #bbi4  
,clearances4,sec4 #bcj4 ,federal        
intrusion detection and prevention      
system4  4  #d4 ,advanced internal      
defenses  7a7 ,advanced network security
 tools  7#a7 ,in general ,the ,secretary
 shall include in the ,continuous       
,diagnostics and ,mitigation ,program   
advanced network security tools to      
improve visibility of network activity1 
including through the use of commercial 
and free or open source tools1 to detect
 and mitigate intrusions and anomalous  
activity4  7#b7 ,development of plan    
,the ,director shall develop and        
implement a plan to ensure that each    
agency utilizes advanced network        
security tools1 including those         
described in paragraph 7#a71 to detect  
and mitigate intrusions and anomalous   
activity4  7b7 ,improved metrics ,the   
,secretary1 in collaboration with the   
,director1 shall review and update the  
metrics used to measure security under  
section #ceed of title #dd1 ,united     

,states ,code1 to include measures of   
intrusion and incident detection and    
response times4  7c7 ,transparency and  
accountability ,the ,director1 in       
consultation with the ,secretary1 shall 
increase transparency to the public on  
agency cybersecurity posture1 including 
by increasing the number of metrics     
available on ,federal ,government       
performance websites and1 to the        
greatest extent practicable1 displaying 
metrics for department components1 small
 agencies1 and micro agencies4  7d7     
,maintenance of technologies ,section   
#ceec7;b77#f77;,b7 of title #dd1 ,united
 ,states ,code1 is amended by inserting 
1 operating1 and maintaining after      
deploying4  #e4 ,federal cybersecurity  
best practices  7a7 ,assessment of best 
practices for ,federal cybersecurity    
,the ,secretary1 in consultation with   
the ,director1 shall regularly assess   
and require implementation of best      
practices for securing agency           
information systems against intrusion   

and preventing data exfiltration in the 
event of an intrusion4  7b7             
,cybersecurity requirements at agencies 
7#a7 ,in general ,except as provided in 
paragraph 7#b71 not later than #a year  
after the date of enactment of this     
,act1 the head of each agency shall--   
7,a7 identify sensitive and mission     
critical data stored by the agency      
consistent with the inventory required  
under the first subsection 7c7 7relating
 to the inventory of major information  
systems7 and the second subsection 7c7  
7relating to the inventory of           
information systems7 of section #ceje of
 title #dd1 ,united ,states ,code2  7,b7
 assess access controls to the data     
described in subparagraph 7,a71 the need
 for readily accessible storage of the  
data1 and individuals' need to access   
the data2  7,c7 encrypt the data        
described in subparagraph 7,a7 that is  
stored on or transiting agency          
information systems consistent with     
standards and guidelines promulgated    

under section #aacca of title #dj1      
,united ,states ,code2  7,d7 implement a
 single sign-on trusted identity        
platform for individuals accessing each 
public website of the agency that       
requires user authentication1 as        
developed by the ,administrator of      
,general ,services in collaboration with
 the ,secretary2 and  7,e7 implement    
multi-factor authentication consistent  
with standards and guidelines           
promulgated under section #aacca of     
title #dj1 ,united ,states ,code1 for-- 
7i7 remote access to an agency          
information system2 and  7ii7 each user 
account with elevated privileges on an  
agency information system4  7#b7        
,exception ,the requirements under      
paragraph 7#a7 shall not apply to the   
,department of ,defense or an element of
 the intelligence community4  #f4       
,assessment2 reports  7a7 ,definitions  
,in this section-- 7#a7 the term        
intrusion assessments means actions     
taken under the intrusion assessment    

plan to identify and remove intruders in
 agency information systems2  7#b7 the  
term intrusion assessment plan means the
 plan required under section            
#bbh7;b77#a7 of the ,homeland ,security 
,act of #bjjb1 as added by section      
#c7;a7 of this ,act2 and  7#c7 the term 
intrusion detection and prevention      
capabilities means the capabilities     
required under section #bcj7;b7 of the  
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act4   
7b7 ,third-,party assessment ,not later 
than #c years after the date of         
enactment of this ,act1 the ,government 
,accountability ,office shall conduct a 
study and publish a report on the       
effectiveness of the approach and       
strategy of the ,federal ,government to 
securing agency information systems1    
including the intrusion detection and   
prevention capabilities and the         
intrusion assessment plan4  7c7 ,reports
 to ,congress  7#a7 ,intrusion detection
 and prevention capabilities  7,a7      

,secretary of ,homeland ,security report
 ,not later than #f months after the    
date of enactment of this ,act1 and     
annually thereafter1 the ,secretary     
shall submit to the appropriate         
congressional committees a report on the
 status of implementation of the        
intrusion detection and prevention      
capabilities1 including--  7i7 a        
description of privacy controls2  7ii7 a
 description of the technologies and    
capabilities utilized to detect         
cybersecurity risks in network traffic1 
including the extent to which those     
technologies and capabilities include   
existing commercial and non-commercial  
technologies2  7iii7 a description of   
the technologies and capabilities       
utilized to prevent network traffic     
associated with cybersecurity risks from
 transiting or traveling to or from     
agency information systems1 including   
the extent to which those technologies  
and capabilities include existing       
commercial and non-commercial           

technologies2  7iv7 a list of the types 
of indicators or other identifiers or   
techniques used to detect cybersecurity 
risks in network traffic transiting or  
traveling to or from agency information 
systems on each iteration of the        
intrusion detection and prevention      
capabilities and the number of each such
 type of indicator1 identifier1 and     
technique2  7v7 the number of instances 
in which the intrusion detection and    
prevention capabilities detected a      
cybersecurity risk in network traffic   
transiting or traveling to or from      
agency information systems and the      
number of times the intrusion detection 
and prevention capabilities blocked     
network traffic associated with         
cybersecurity risk2 and  7vi7 an        
explanation of whether any information  
on individuals1 and to the greatest     
extent practicable1 on ,united ,states  
persons1 whose personally identifiable  
information is not necessary to describe
 a cybersecurity risk has been retained 

incidentally under the intrusion        
detection and prevention capabilities1  
and if such information has been        
retained1 for what purpose and for what 
length of time2 and  7vivii7 a          
description of the pilot established    
under section #bcj7;c77#e7 of the       
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act1   
including the number of new technologies
 tested and the number of participating 
agencies4  7,b7 ,,omb report ,not later 
than #ah months after the date of       
enactment of this ,act1 and annually    
thereafter1 the ,director shall submit  
to ,congress1 as part of the report     
required under section #ceec7;c7 of     
title #dd1 ,united ,states ,code1 an    
analysis of agency application of the   
intrusion detection and prevention      
capabilities1 including--  7i7 a list of
 each agency and the degree to which    
each agency has applied the intrusion   
detection and prevention capabilities to
 an agency information system2 and  7ii7

 a list by agency of-- 7,i7 the number  
of instances in which the intrusion     
detection and prevention capabilities   
detected a cybersecurity risk in network
 traffic transiting or traveling to or  
from an agency information system and   
the types of indicators1 identifiers1   
and techniques used to detect such      
cybersecurity risks2 and  7,,ii7 the    
number of instances in which the        
intrusion detection and prevention      
capabilities prevented network traffic  
associated with a cybersecurity risk    
from transiting or traveling to or from 
an agency information system and the    
types of indicators1 identifiers1 and   
techniques used to detect such agency   
information systems4  7#b7 ,,omb report 
on development and implementation of    
intrusion assessment plan1 advanced     
internal defenses1 and ,federal         
cybersecurity best practices ,the       
,director shall-- 7,a7 not later than #f
 months after the date of enactment of  
this ,act1 and #cj days after any update

 thereto1 submit the intrusion          
assessment plan to the appropriate      
congressional committees2  7,b7 not     
later than #a year after the date of    
enactment of this ,act1 and annually    
thereafter1 submit to ,congress1 as part
 of the report required under section   
#ceec7;c7 of title #dd1 ,united ,states 
,code--  7i7 a description of the       
implementation of the intrusion         
assessment plan2  7ii7 the findings of  
the intrusion assessments conducted     
pursuant to the intrusion assessment    
plan2  7iii7 advanced network security  
tools included in the ,continuous       
,diagnostics and ,mitigation ,program   
pursuant to section #d7;a77#a72  7iv7   
the results of the assessment of the    
,secretary of best practices for        
,federal cybersecurity pursuant to      
section #e7;a72 and  7v7 a list by      
agency of compliance with the           
requirements of section #e7;b72 and     
7,c7 not later than #a year after the   
date of enactment of this ,act1 submit  

to the appropriate congressional        
committees--  7i7 a copy of the plan    
developed pursuant to section           
#d7;a77#b72 and  7ii7 the improved      
metrics developed pursuant to section   
#d7;b74  #g4 ,termination  7a7 ,in      
general ,the authority provided under   
section #bcj of the ,homeland ,security 
,act of #bjjb1 as added by section      
#c7;a7 of this ,act1 and the reporting  
requirements under section #f7;c7 shall 
terminate on the date that is #g years  
after the date of enactment of this     
,act4  7b7 ,rule of construction        
,nothing in subsection 7a7 shall be     
construed to affect the limitation of   
liability of a private entity for       
assistance provided to the ,secretary   
under section #bcj7;d77#b7 of the       
,homeland ,security ,act of #bjjb1 as   
added by section #c7;a7 of this ,act1 if
 such assistance was rendered before the
 termination date under subsection 7a7  
or otherwise during a period in which   
the assistance was authorized4  #h4     

,identification of unclassified         
information systems  7a7 ,in general    
,except as provided in subsection 7c71  
not later than #ahj days after the date 
of enactment of this ,act--  7#a7 the   
,director of ,national ,intelligence1 in
 coordination with the heads of other   
agencies1 shall-- 7,a7 identify all     
unclassified information systems that   
provide access to information that1 when
 combined with other unclassified       
information1 may comprise classified    
information2  7,b7 assess the risks that
 would result from the breach of each   
unclassified information system         
identified in subparagraph 7,a72 and    
7,c7 assess the cost and impact on the  
mission carried out by each agency that 
owns an unclassified information system 
identified in subparagraph 7,a7 if the  
system were to be subsequently          
classified2 and  7#b7 the ,director of  
,national ,intelligence shall submit to 
the appropriate congressional committees
 a report that includes the findings    

under paragraph 7#a74  7b7 ,form ,the   
report submitted under subsection       
7a77#b7 shall be in unclassified form1  
but may include a classified annex4  7c7
 ,exception ,the requirements under     
subsection 7a77#a7 shall not apply to   
the ,department of ,defense or an       
element of the intelligence community4  
#i4 ,,opm data breach damage assessment 
7a7 ,assessment ,the ,secretary and the 
,director of ,national ,intelligence    
shall jointly1 and in coordination with 
the head of each appropriate agency1    
conduct an ongoing damage and risk      
assessment relating to the data breaches
 at the ,office of ,personnel           
,management 7referred to in this section
 as the ,,opm data breach74  7b7        
,reports  7#a7 ,in general ,not later   
than #ahj days after the date of        
enactment of this ,act1 and once not    
later than #ahj days thereafter1 the    
,director of ,national ,intelligence    
shall submit to ,congress a report on   
the assessment conducted under          

subsection 7a74  7#b7 ,contents ,each   
report submitted under this subsection  
shall include-- 7,a7 updates on the     
extent to which ,federal data was       
compromised1 exfiltrated1 or manipulated
 by the same entity that caused the     
,,opm data breach2  7,b7 analysis of the
 impact of the ,,opm data breach on     
national security2 and  7,c7 analysis of
 whether any information accessed       
through the ,,opm data breach has been  
released or deployed1 whether publicly  
or privately4  7#c7 ,unclassified form  
,each report submitted under this       
subsection shall be in unclassified     
form1 but may include a classified      
annex4  #aj4 ,direction to agencies     
,section #ceec of title #dd1 ,united    
,states ,code1 is amended by adding at  
the end the following3  7h7 ,direction  
to agencies  7#a7 ,authority  7,a7 ,in  
general ,notwithstanding section #ceed1 
and subject to subparagraph 7,b71 in    
response to a known or reasonably       
suspected information security threat1  

vulnerability1 or incident that         
represents a substantial threat to the  
information security of an agency1 the  
,secretary may issue a directive to the 
head of an agency to take any lawful    
action with respect to the operation of 
the information system1 including such  
systems owned or operated by another    
entity on behalf of an agency1 that     
collects1 processes1 stores1 transmits1 
disseminates1 or otherwise maintains    
agency information1 for the purpose of  
protecting the information system from1 
or mitigating1 an information security  
threat4  7,b7 ,exception ,the           
authorities of the ,secretary under this
 subsection shall not apply to a system 
described in paragraph 7#b7 or 7#c7 of  
subsection 7e74  7#b7 ,procedures for   
use of authority ,the ,secretary shall--
 7,a7 in coordination with the          
,director1 establish procedures         
governing the circumstances under which 
a directive may be issued under this    
subsection1 which shall include--  7i7  

thresholds and other criteria2  7ii7    
privacy and civil liberties protections2
 and  7iii7 providing notice to         
potentially affected third parties2     
7,b7 specify the reasons for the        
required action and the duration of the 
directive2  7,c7 minimize the impact of 
a directive under this subsection by--  
7i7 adopting the least intrusive means  
possible under the circumstances to     
secure the agency information systems2  
and  7ii7 limiting directives to the    
shortest period practicable2  7,d7      
notify the ,director and the head of any
 affected agency immediately upon the   
issuance of a directive under this      
subsection2 and  7,e7 not later than    
,february #a of each year1 submit to the
 appropriate congressional committees a 
report regarding the specific actions   
the ,secretary has taken pursuant to    
paragraph 7#a77;,a74  7#c7 ,imminent    
threats  7,a7 ,in general ,if the       
,secretary determines that there is an  
imminent threat to agency information   

systems and a directive under this      
subsection is not reasonably likely to  
result in a timely response to the      
threat1 the ,secretary may authorize the
 use of protective capabilities under   
the control of the ,secretary for       
communications or other system traffic  
transiting to or from or stored on an   
agency information system without prior 
consultation with the affected agency   
for the purpose of ensuring the security
 of the information or information      
system or other agency information      
systems4  7,b7 ,notice ,the ,secretary  
shall immediately notify the ,director1 
the head and chief information officer  
7or equivalent official7 of each agency 
to which specific actions were taken    
pursuant to subparagraph 7,a71 and the  
appropriate congressional committees and
 authorizing committees of each such    
agencies of--  7i7 any action taken     
under subparagraph 7,a72 and  7ii7 the  
reasons for and duration and nature of  
the action4  7,c7 ,other law ,any action

 of the ,secretary under this paragraph 
shall be consistent with applicable law4
  7,d7 ,limitation on delegation ,the   
authority under this paragraph may not  
be delegated to an official in a        
position lower than an ,under ,secretary
 of the ,department of ,homeland        
,security4  7#d7 ,limitation ,the       
,secretary may direct or authorize      
lawful action or protective capability  
under this subsection only to--  7,a7   
protect agency information from         
unauthorized access1 use1 disclosure1   
disruption1 modification1 or            
destruction2 or  7,b7 require the       
remediation of or protect against       
identified information security risks   
with respect to--  7i7 information      
collected or maintained by or on behalf 
of an agency2 or  7ii7 that portion of  
an information system used or operated  
by an agency or by a contractor of an   
agency or other organization on behalf  
of an agency4  7i7 ,annual report to    
,congress  ,not later than ,february #a 

of each year1 the ,director shall submit
 to the appropriate congressional       
committees a report regarding the       
specific actions the ,director has taken
 pursuant to subsection 7a77#e71        
including any actions taken pursuant to 
section #aacjc7;b77#e7 of title #dj4    
7j7 ,appropriate congressional          
committees ,in this section1 the term   
appropriate congressional committees    
means-- 7#a7 the ,committee on          
,appropriations and the ,committee on   
,homeland ,security and ,governmental   
,affairs of the ,senate2 and  7#b7 the  
,committee on ,appropriations and the   
,committee on ,homeland ,security of the
 ,house of ,representatives4  4         
,november #ag1 #bjaf,reported with      
amendments