,,ii ,cal5d> ,no4 #fgc #aad? ,,congress 
#b;d ,session  ,s4 #ahfi ,report ,no4   
#aad-cgh ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,july #bg1 #bjae,mr4 ,c>p] 7= 
himself & ,mr4 ,johnson7 introduc$ !    
foll[+ bill2 :i* 0 read twice & ref]r$  
to ! ,committee on ,homel& ,security &  
,gov]nm5tal ,affairs  ,novemb] #ag1     
#bjaf,report$ by ,mr4 ,johnson1 )       
amendments,omit ! "p /ruck ?r\gh & ins]t
 ! "p pr9t$ 9 italic  ,a ,,bill  ,to    
improve ,f$]al network security &       
au?orize & enhance an exi/+ intrusion   
detection & prev5tion sy/em = civilian  
,f$]al networks4  #a4 ,%ort title ,?is  
,act may be cit$ z ! ,f$]al             
,cyb]security ,enhancem5t ,act ( #bjae  
,f$]al ,cyb]security ,enhancem5t ,act ( 
#bjaf4  #b4 ,def9itions ,9 ?is ,act--   
7#a7 ! t]m ag5cy has ! mean+ giv5 ! t]m 
9 section #cejb ( title #dd1 ,unit$     
,/ates ,code2  7#b7 ! t]m ag5cy         
in=mation sy/em has ! mean+ giv5 ! t]m 9
 section #bbh ( ! ,homel& ,security ,act
 ( #bjjb1 z add$ by section #c7;a72     

7#c7 ! t]m appropriate congressional    
committees means-- 7,a7 ! ,committee on 
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate2 &  7,b7 ! ,committee on    
,homel& ,security ( ! ,h\se (           
,repres5tatives2  7#d7 ! t]ms           
cyb]security risk & in=mation sy/em h ! 
mean+s giv5 ^? t]ms 9 section #bbg ( !  
,homel& ,security ,act ( #bjjb1 z s     
r$esignat$ by section #c7;a72  7#e7 !   
t]m ,director means ! ,director ( !     
,(fice ( ,managem5t & ,budget2  7#f7 !  
t]m intellig5ce community has ! mean+   
giv5 ! t]m 9 section #c7d7 ( ! ,national
 ,security ,act ( #aidg 7#ej ,u4,s4,c4  
#cjjc7d772 &  7#g7 ! t]m ,secret>y means
 ! ,secret>y ( ,homel& ,security4  #c4  
,improv$ ,f$]al network security  7a7 ,9
 g5]al ,subtitle ,c ( title ,,ii ( !    
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #ada et seq47 is am5d$--  7#a7
 by r$esignat+ section #bbh z section   
#bbi2  7#b7 by r$esignat+ section #bbg z
 subsection 7c7 ( section #bbh1 z add$  
by p>agraph 7#d71 & adju/+ ! m>g9s      

accord+ly2  7#c7 by r$esignat+ ! second 
section designat$ z section #bbf 7relat+
 to ! national cyb]security &           
communications integration c5t]7 z      
section #bbg2  7#d7 by ins]t+ aft]      
section #bbg1 z s r$esignat$1 ! foll[+3 
#bbh4 ,cyb]security plans  7a7          
,def9itions ,9 ?is section--  7#a7 ! t]m
 ag5cy in=mation sy/em means an         
in=mation sy/em us$ or op]at$ by an     
ag5cy1 by a contractor ( an ag5cy1 or by
 ano!r entity on behalf ( an ag5cy2     
7#b7 ! t]ms cyb]security risk &         
in=mation sy/em h ! mean+s giv5 ^? t]ms 
9 section #bbg2 &  7#c7 ! t]m in=mation 
%>+ & analysis organization has ! mean+ 
giv5 ! t]m 9 section #bab7e72 &  7#dc7 !
 t]m intellig5ce community has ! mean+  
giv5 ! t]m 9 section #c7d7 ( ! ,national
 ,security ,act ( #aidg 7#ej ,u4,s4,c4  
#cjjc7d774  7b7 ,intrusion assessm5t    
plan  7#a7 ,requirem5t ,! ,secret>y1 9  
coord9ation ) ! ,director ( ! ,(fice (  
,managem5t & ,budget1 %all develop &    
implem5t an intrusion assessm5t plan to 

id5tify & remove intrud]s 9 ag5cy       
in=mation sy/ems4  7#b7 ,exception ,!   
intrusion assessm5t plan requir$ "u     
p>agraph 7#a7 %all n apply to !         
,dep>tm5t ( ,def5se or an elem5t ( !    
intellig5ce community4  2  7#e7 9       
section #bbh7;c71 z s r$esignat$1 by    
/rik+ section #bbf & ins]t+ section     
#bbg2 &  7#f7 by ins]t+ aft] section    
#bbi1 z s r$esignat$1 ! foll[+3  #bcj4  
,f$]al intrusion detection & prev5tion  
sy/em  7a7 ,def9itions ,9 ?is section-- 
7#a7 ! t]m ag5cy has ! mean+ giv5 t t]m 
9 section #cejb ( title #dd1 ,unit$     
,/ates ,code2  7#b7 ! t]m ag5cy         
in=mation means in=mation collect$ or   
ma9ta9$ by or on behalf ( an ag5cy2     
7#c7 ! t]m ag5cy in=mation sy/em has !  
mean+ giv5 ! t]m 9 section #bbh2 &  7#d7
 ! t]ms cyb]security risk & in=mation   
sy/em h ! mean+s giv5 ^? t]ms 9 section 
#bbg4  7b7 ,requirem5t  7#a7 ,9 g5]al ,n
 lat] ?an #a ye> aft] ! date ( enactm5t 
( ?is section1 ! ,secret>y %all deploy1 
op]ate1 & ma9ta91 to make available =   

use by any ag5cy1 ) or )\t              
reimbursem5t--  7,a7 a capability to    
detect cyb]security risks 9 network     
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em2 &  7,b7 a        
capability to prev5t network traffic    
associat$ ) su* cyb]security risks f    
transit+ or travel+ to or f an ag5cy    
in=mation sy/em or modify su* network   
traffic to remove ! cyb]security risk4  
7#b7 ,regul> improvem5t ,! ,secret>y    
%all regul>ly deploy new te*nologies &  
modify exi/+ te*nologies to ! intrusion 
detection & prev5tion capabilities      
describ$ 9 p>agraph 7#a7 z appropriate  
to improve ! intrusion detection &      
prev5tion capabilities4  7c7 ,activities
 ,9 c>ry+ out subsection 7b71 !         
,secret>y-- 7#a7 may access1 & ! head ( 
an ag5cy may disclose to ! ,secret>y or 
a private entity provid+ assi/ance to ! 
,secret>y "u p>agraph 7#b71 in=mation   
transit+ or travel+ to or f an ag5cy    
in=mation sy/em1 reg>dless ( ! location 
f :i* ! ,secret>y or a private entity   

provid+ assi/ance to ! ,secret>y "u     
p>agraph 7#b7 accesses su* in=mation1   
not)/&+ any o!r provision ( law t w\ld  
o!rwise re/rict or prev5t ! head ( an   
ag5cy f disclos+ su* in=mation to !     
,secret>y or a private entity provid+   
assi/ance to ! ,secret>y "u p>agraph    
7#b72  7#b7 may ent] into contracts or  
o!r agreem5ts )1 or o!rwise reque/ &    
obta9 ! assi/ance (1 private entities to
 deploy & op]ate te*nologies 9          
accordance ) subsection 7b72  7#c7 may  
reta91 use1 & disclose in=mation obta9$ 
?r\gh ! conduct ( activities au?oriz$ "u
 ?is section only to protect in=mation &
 in=mation sy/ems f cyb]security risks2 
7#d7 %all regul>ly assess ?r\gh         
op]ational te/ & evaluation 9 real _w or
 simulat$ environm5ts available advanc$ 
protective te*nologies to improve       
detection & prev5tion capabilities1     
includ+ comm]cial & non-comm]cial       
te*nologies & detection te*nologies     
beyond signature-bas$ detection1 &      
utilize su* te*nologies :5 appropriate2 

7#e7 %all e/abli% a pilot to acquire1   
te/1 & deploy1 z rapidly z possible1    
te*nologies describ$ 9 p>agraph 7#d72 & 
7#f7 %all p]iodically update ! privacy  
impact assessm5t requir$ "u section     
#bjh7;b7 ( ! ,e-,gov]nm5t ,act ( #bjjb  
7#dd ,u4,s4,c4 #ceja note742 &  7#g7    
%all ensure t-- 7,a7 activities c>ri$   
out "u ?is section are reasonably       
necess>y = ! purpose ( protect+ ag5cy   
in=mation & ag5cy in=mation sy/ems f a  
cyb]security risk2  7,b7 in=mation      
access$ by ! ,secret>y w be reta9$ no   
long] ?an reasonably necess>y = !       
purpose ( protect+ ag5cy in=mation &    
ag5cy in=mation sy/ems f a cyb]security 
risk2  7,c7 notice has be5 provid$ to   
us]s ( an ag5cy in=mation sy/em conc]n+ 
access to communications ( us]s ( !     
ag5cy in=mation sy/em = ! purpose (     
protect+ ag5cy in=mation & ! ag5cy      
in=mation sy/em2 &  7,d7 ! activities   
are implem5t$ pursuant to policies &    
proc$ures gov]n+ ! op]ation ( !         
intrusion detection & prev5tion         

capabilities4  7d7 ,private entities    
7#a7 ,conditions ,a private entity      
describ$ 9 subsection 7c77#b7 may n--   
7,a7 disclose any network traffic       
transit+ or travel+ to or f an ag5cy    
in=mation sy/em to any entity o!r ?an ! 
,dep>tm5t or ! ag5cy t disclos$ !       
in=mation "u subsection 7c77#a72 or     
7,b7 use any network traffic transit+ or
 travel+ to or f an ag5cy in=mation     
sy/em to :i* ! private entity ga9s      
access 9 accordance ) ?is section = any 
purpose o!r ?an to protect ag5cy        
in=mation & ag5cy in=mation sy/ems aga9/
 cyb]security risks or to adm9i/] a     
contract or o!r agreem5t ent]$ into     
pursuant to subsection 7c77#b7 or z "p (
 ano!r contract ) ! ,secret>y4  7#b7    
,limitation on liability ,no cause (    
action %all lie 9 any c\rt aga9/ a      
private entity = assi/ance provid$ to ! 
,secret>y 9 accordance ) ?is section &  
any contract or agreem5t ent]$ into     
pursuant to subsection 7c77#b74  7#c7   
,rule ( con/ruction ,no?+ 9 p>agraph    

7#b7 %all be con/ru$ to au?orize an     
,int]net s]vice provid] to break a us]  
agreem5t ) a cu/om]4  7e7 ,attorney     
,g5]al review ,n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is section1 !        
,attorney ,g5]al %all review ! policies 
& guidel9es = ! program c>ri$ out "u ?is
 section to ensure t ! policies &       
guidel9es are consi/5t ) applicable law 
gov]n+ ! acquisition1 int]ception1      
ret5tion1 use1 & disclosure (           
communications4  4  7b7 ,prioritiz+     
advanc$ security tools ,! ,director & ! 
,secret>y1 9 consultation ) appropriate 
ag5cies1 %all--  7#a7 review & update   
,gov]nm5twide policies & programs to    
ensure appropriate prioritization & use 
( network security monitor+ tools )9    
ag5cy networks2 &  7#b7 brief           
appropriate congressional committees on 
su* prioritization & use4  7c7 ,ag5cy   
responsibilities  7#a7 ,9 g5]al ,except 
z provid$ 9 p>agraph 7#b7--  7,a7 n lat]
 ?an #a ye> aft] ! date ( enactm5t ( ?is
 ,act or #b mon?s aft] ! date on :i* !  

,secret>y makes available ! intrusion   
detection & prev5tion capabilities "u   
section #bcj7;b77#a7 ( ! ,homel&        
,security ,act ( #bjjb1 z add$ by       
subsection 7a71 :i*ev] is lat]1 ! head (
 ea* ag5cy %all apply & cont9ue to      
utilize ! capabilities to all in=mation 
travel+ betwe5 an ag5cy in=mation sy/em 
& any in=mation sy/em o!r ?an an ag5cy  
in=mation sy/em2 &  7,b7 n lat] ?an #f  
mon?s aft] ! date on :i* ! ,secret>y    
makes available improvem5ts to !        
intrusion detection & prev5tion         
capabilities pursuant to section        
#bcj7;b77#b7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by subsection 7a71 !    
head ( ea* ag5cy %all apply & cont9ue to
 utilize ! improv$ intrusion detection &
 prev5tion capabilities4  7#b7          
,exception ,! requirem5ts "u p>agraph   
7#a7 %all n apply to ! ,dep>tm5t (      
,def5se or an elem5t ( ! intellig5ce    
community4  7d7 ,table ( cont5ts am5dm5t
 ,! table ( cont5ts 9 section #a7;b7 ( !
 ,homel& ,security ,act ( #bjjb 7#f     

,u4,s4,c4 #aja note7 is am5d$ by /rik+ !
 items relat+ to ! fir/ section         
designat$ z section #bbf1 ! second      
section designat$ z section #bbf 7relat+
 to ! national cyb]security &           
communications integration c5t]71       
section #bbg1 & section #bbh & ins]t+ ! 
foll[+3  ,sec4 #bbf4 ,cyb]security      
recruitm5t & ret5tion4,sec4 #bbg4       
,national cyb]security & communications 
integration c5t]4,sec4 #bbh4            
,cyb]security plans4,sec4 #bbi4         
,cle>ances4,sec4 #bcj4 ,f$]al intrusion 
detection & prev5tion sy/em4  4  #d4    
,advanc$ int]nal def5ses  7a7 ,advanc$  
network security tools  7#a7 ,9 g5]al ,!
 ,secret>y %all include 9 ! ,cont9u\s   
,diagno/ics & ,mitigation ,program      
advanc$ network security tools to       
improve visibility ( network activity1  
includ+ ?r\gh ! use ( comm]cial & free  
or op5 s\rce tools1 to detect & mitigate
 intrusions & anomal\s activity4  7#b7  
,developm5t ( plan ,! ,director %all    
develop & implem5t a plan to ensure t   

ea* ag5cy utilizes advanc$ network      
security tools1 includ+ ^? describ$ 9   
p>agraph 7#a71 to detect & mitigate     
intrusions & anomal\s activity4  7b7    
,improv$ metrics ,! ,secret>y1 9        
collaboration ) ! ,director1 %all review
 & update ! metrics us$ to measure      
security "u section #ceed ( title #dd1  
,unit$ ,/ates ,code1 to include measures
 ( intrusion & incid5t detection &      
response times4  7c7 ,transp>5cy &      
acc\ntability ,! ,director1 9           
consultation ) ! ,secret>y1 %all        
increase transp>5cy to ! public on ag5cy
 cyb]security po/ure1 includ+ by        
increas+ ! numb] ( metrics available on 
,f$]al ,gov]nm5t p]=mance websites &1 to
 ! greate/ ext5t practicable1 display+  
metrics = dep>tm5t compon5ts1 small     
ag5cies1 & micro ag5cies4  7d7          
,ma9t5ance ( te*nologies ,section       
#ceec7;b77#f77;,b7 ( title #dd1 ,unit$  
,/ates ,code1 is am5d$ by ins]t+ 1      
op]at+1 & ma9ta9+ aft] deploy+4  #e4    
,f$]al cyb]security be/ practices  7a7  

,assessm5t ( be/ practices = ,f$]al     
cyb]security ,! ,secret>y1 9            
consultation ) ! ,director1 %all        
regul>ly assess & require implem5tation 
( be/ practices = secur+ ag5cy in=mation
 sy/ems aga9/ intrusion & prev5t+ data  
exfiltration 9 ! ev5t ( an intrusion4   
7b7 ,cyb]security requirem5ts at ag5cies
  7#a7 ,9 g5]al ,except z provid$ 9     
p>agraph 7#b71 n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is ,act1 ! head ( ea*
 ag5cy %all--  7,a7 id5tify s5sitive &  
mission critical data /or$ by ! ag5cy   
consi/5t ) ! inv5tory requir$ "u ! fir/ 
subsection 7c7 7relat+ to ! inv5tory (  
major in=mation sy/ems7 & ! second      
subsection 7c7 7relat+ to ! inv5tory (  
in=mation sy/ems7 ( section #ceje (     
title #dd1 ,unit$ ,/ates ,code2  7,b7   
assess access controls to ! data        
describ$ 9 subp>agraph 7,a71 ! ne$ =    
readily accessible /orage ( ! data1 &   
individuals' ne$ to access ! data2  7,c7
 encrypt ! data describ$ 9 subp>agraph  
7,a7 t is /or$ on or transit+ ag5cy     

in=mation sy/ems consi/5t ) /&>ds &     
guidel9es promulgat$ "u section #aacca (
 title #dj1 ,unit$ ,/ates ,code2  7,d7  
implem5t a s+le sign-on tru/$ id5tity   
plat=m = individuals access+ ea* public 
website ( ! ag5cy t requires us]        
au!ntication1 z develop$ by !           
,adm9i/rator ( ,g5]al ,s]vices 9        
collaboration ) ! ,secret>y2 &  7,e7    
implem5t multi-factor au!ntication      
consi/5t ) /&>ds & guidel9es promulgat$ 
"u section #aacca ( title #dj1 ,unit$   
,/ates ,code1 =--  7i7 remote access to 
an ag5cy in=mation sy/em2 &  7ii7 ea*   
us] acc\nt ) elevat$ privileges on an   
ag5cy in=mation sy/em4  7#b7 ,exception 
,! requirem5ts "u p>agraph 7#a7 %all n  
apply to ! ,dep>tm5t ( ,def5se or an    
elem5t ( ! intellig5ce community4  #f4  
,assessm5t2 reports  7a7 ,def9itions ,9 
?is section-- 7#a7 ! t]m intrusion      
assessm5ts means actions tak5 "u !      
intrusion assessm5t plan to id5tify &   
remove intrud]s 9 ag5cy in=mation       
sy/ems2  7#b7 ! t]m intrusion assessm5t 

plan means ! plan requir$ "u section    
#bbh7;b77#a7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by section #c7;a7 ( ?is 
,act2 &  7#c7 ! t]m intrusion detection 
& prev5tion capabilities means !        
capabilities requir$ "u section #bcj7;b7
 ( ! ,homel& ,security ,act ( #bjjb1 z  
add$ by section #c7;a7 ( ?is ,act4  7b7 
,?ird-,p>ty assessm5t ,n lat] ?an #c    
ye>s aft] ! date ( enactm5t ( ?is ,act1 
! ,gov]nm5t ,acc\ntability ,(fice %all  
conduct a /udy & publi% a report on !   
effectiv5ess ( ! approa* & /rategy ( !  
,f$]al ,gov]nm5t to secur+ ag5cy        
in=mation sy/ems1 includ+ ! intrusion   
detection & prev5tion capabilities & !  
intrusion assessm5t plan4  7c7 ,reports 
to ,congress  7#a7 ,intrusion detection 
& prev5tion capabilities  7,a7 ,secret>y
 ( ,homel& ,security report ,n lat] ?an 
#f mon?s aft] ! date ( enactm5t ( ?is   
,act1 & annually !reaft]1 ! ,secret>y   
%all submit to ! appropriate            
congressional committees a report on !  
/atus ( implem5tation ( ! intrusion     

detection & prev5tion capabilities1     
includ+--  7i7 a description ( privacy  
controls2  7ii7 a description ( !       
te*nologies & capabilities utiliz$ to   
detect cyb]security risks 9 network     
traffic1 includ+ ! ext5t to :i* ^?      
te*nologies & capabilities include exi/+
 comm]cial & non-comm]cial te*nologies2 
7iii7 a description ( ! te*nologies &   
capabilities utiliz$ to prev5t network  
traffic associat$ ) cyb]security risks f
 transit+ or travel+ to or f ag5cy      
in=mation sy/ems1 includ+ ! ext5t to :i*
 ^? te*nologies & capabilities include  
exi/+ comm]cial & non-comm]cial         
te*nologies2  7iv7 a li/ ( ! types (    
indicators or o!r id5tifi]s or te*niques
 us$ to detect cyb]security risks 9     
network traffic transit+ or travel+ to  
or f ag5cy in=mation sy/ems on ea*      
it]ation ( ! intrusion detection &      
prev5tion capabilities & ! numb] ( ea*  
su* type ( indicator1 id5tifi]1 &       
te*nique2  7v7 ! numb] ( in/ances 9 :i* 
! intrusion detection & prev5tion       

capabilities detect$ a cyb]security risk
 9 network traffic transit+ or travel+  
to or f ag5cy in=mation sy/ems & ! numb]
 ( times ! intrusion detection &        
prev5tion capabilities block$ network   
traffic associat$ ) cyb]security risk2 &
  7vi7 an explanation ( :e!r any        
in=mation on individuals1 & to ! greate/
 ext5t practicable1 on ,unit$ ,/ates    
p]sons1 ^: p]sonally id5tifiable        
in=mation is n necess>y to describe a   
cyb]security risk has be5 reta9$        
incid5tally "u ! intrusion detection &  
prev5tion capabilities1 & if su*        
in=mation has be5 reta9$1 = :at purpose 
& = :at l5g? ( "t2 &  7vivii7 a         
description ( ! pilot e/abli%$ "u       
section #bcj7;c77#e7 ( ! ,homel&        
,security ,act ( #bjjb1 z add$ by       
section #c7;a7 ( ?is ,act1 includ+ !    
numb] ( new te*nologies te/$ & ! numb] (
 p>ticipat+ ag5cies4  7,b7 ,,omb report 
,n lat] ?an #ah mon?s aft] ! date (     
enactm5t ( ?is ,act1 & annually !reaft]1
 ! ,director %all submit to ,congress1 z

 "p ( ! report requir$ "u section       
#ceec7;c7 ( title #dd1 ,unit$ ,/ates    
,code1 an analysis ( ag5cy application (
 ! intrusion detection & prev5tion      
capabilities1 includ+--  7i7 a li/ ( ea*
 ag5cy & ! degree to :i* ea* ag5cy has  
appli$ ! intrusion detection & prev5tion
 capabilities to an ag5cy in=mation     
sy/em2 &  7ii7 a li/ by ag5cy (-- 7,i7 !
 numb] ( in/ances 9 :i* ! intrusion     
detection & prev5tion capabilities      
detect$ a cyb]security risk 9 network   
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em & ! types (       
indicators1 id5tifi]s1 & te*niques us$  
to detect su* cyb]security risks2 &     
7,,ii7 ! numb] ( in/ances 9 :i* !       
intrusion detection & prev5tion         
capabilities prev5t$ network traffic    
associat$ ) a cyb]security risk f       
transit+ or travel+ to or f an ag5cy    
in=mation sy/em & ! types ( indicators1 
id5tifi]s1 & te*niques us$ to detect su*
 ag5cy in=mation sy/ems4  7#b7 ,,omb    
report on developm5t & implem5tation (  

intrusion assessm5t plan1 advanc$       
int]nal def5ses1 & ,f$]al cyb]security  
be/ practices ,! ,director %all-- 7,a7 n
 lat] ?an #f mon?s aft] ! date (        
enactm5t ( ?is ,act1 & #cj days aft] any
 update !reto1 submit ! intrusion       
assessm5t plan to ! appropriate         
congressional committees2  7,b7 n lat]  
?an #a ye> aft] ! date ( enactm5t ( ?is 
,act1 & annually !reaft]1 submit to     
,congress1 z "p ( ! report requir$ "u   
section #ceec7;c7 ( title #dd1 ,unit$   
,/ates ,code--  7i7 a description ( !   
implem5tation ( ! intrusion assessm5t   
plan2  7ii7 ! f9d+s ( ! intrusion       
assessm5ts conduct$ pursuant to !       
intrusion assessm5t plan2  7iii7 advanc$
 network security tools includ$ 9 !     
,cont9u\s ,diagno/ics & ,mitigation     
,program pursuant to section #d7;a77#a72
  7iv7 ! results ( ! assessm5t ( !      
,secret>y ( be/ practices = ,f$]al      
cyb]security pursuant to section #e7;a72
 &  7v7 a li/ by ag5cy ( compliance ) ! 
requirem5ts ( section #e7;b72 &  7,c7 n 

lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 submit to ! appropriate      
congressional committees--  7i7 a copy (
 ! plan develop$ pursuant to section    
#d7;a77#b72 &  7ii7 ! improv$ metrics   
develop$ pursuant to section #d7;b74    
#g4 ,t]m9ation  7a7 ,9 g5]al ,! au?ority
 provid$ "u section #bcj ( ! ,homel&    
,security ,act ( #bjjb1 z add$ by       
section #c7;a7 ( ?is ,act1 & ! report+  
requirem5ts "u section #f7;c7 %all      
t]m9ate on ! date t is #g ye>s aft] !   
date ( enactm5t ( ?is ,act4  7b7 ,rule (
 con/ruction ,no?+ 9 subsection 7a7 %all
 be con/ru$ to affect ! limitation (    
liability ( a private entity = assi/ance
 provid$ to ! ,secret>y "u section      
#bcj7;d77#b7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by section #c7;a7 ( ?is 
,act1 if su* assi/ance 0 r5d]$ be=e !   
t]m9ation date "u subsection 7a7 or     
o!rwise dur+ a p]iod 9 :i* ! assi/ance 0
 au?oriz$4  #h4 ,id5tification (        
unclassifi$ in=mation sy/ems  7a7 ,9    
g5]al ,except z provid$ 9 subsection    

7c71 n lat] ?an #ahj days aft] ! date ( 
enactm5t ( ?is ,act--  7#a7 ! ,director 
( ,national ,intellig5ce1 9 coord9ation 
) ! heads ( o!r ag5cies1 %all-- 7,a7    
id5tify all unclassifi$ in=mation sy/ems
 t provide access to in=mation t1 :5    
comb9$ ) o!r unclassifi$ in=mation1 may 
comprise classifi$ in=mation2  7,b7     
assess ! risks t w\ld result f ! brea* (
 ea* unclassifi$ in=mation sy/em        
id5tifi$ 9 subp>agraph 7,a72 &  7,c7    
assess ! co/ & impact on ! mission c>ri$
 out by ea* ag5cy t owns an unclassifi$ 
in=mation sy/em id5tifi$ 9 subp>agraph  
7,a7 if ! sy/em 7 to be subsequ5tly     
classifi$2 &  7#b7 ! ,director (        
,national ,intellig5ce %all submit to ! 
appropriate congressional committees a  
report t includes ! f9d+s "u p>agraph   
7#a74  7b7 ,=m ,! report submitt$ "u    
subsection 7a77#b7 %all be 9 unclassifi$
 =m1 b may include a classifi$ annex4   
7c7 ,exception ,! requirem5ts "u        
subsection 7a77#a7 %all n apply to !    
,dep>tm5t ( ,def5se or an elem5t ( !    

intellig5ce community4  #i4 ,,opm data  
brea* damage assessm5t  7a7 ,assessm5t  
,! ,secret>y & ! ,director ( ,national  
,intellig5ce %all jo9tly1 & 9           
coord9ation ) ! head ( ea* appropriate  
ag5cy1 conduct an ongo+ damage & risk   
assessm5t relat+ to ! data brea*es at ! 
,(fice ( ,p]sonnel ,managem5t 7ref]r$ to
 9 ?is section z ! ,,opm data brea*74   
7b7 ,reports  7#a7 ,9 g5]al ,n lat] ?an 
#ahj days aft] ! date ( enactm5t ( ?is  
,act1 & once n lat] ?an #ahj days       
!reaft]1 ! ,director ( ,national        
,intellig5ce %all submit to ,congress a 
report on ! assessm5t conduct$ "u       
subsection 7a74  7#b7 ,cont5ts ,ea*     
report submitt$ "u ?is subsection %all  
include-- 7,a7 updates on ! ext5t to :i*
 ,f$]al data 0 compromis$1 exfiltrat$1  
or manipulat$ by ! same entity t caus$ !
 ,,opm data brea*2  7,b7 analysis ( !   
impact ( ! ,,opm data brea* on national 
security2 &  7,c7 analysis ( :e!r any   
in=mation access$ ?r\gh ! ,,opm data    
brea* has be5 releas$ or deploy$1 :e!r  

publicly or privately4  7#c7            
,unclassifi$ =m ,ea* report submitt$ "u 
?is subsection %all be 9 unclassifi$ =m1
 b may include a classifi$ annex4  #aj4 
,direction to ag5cies ,section #ceec (  
title #dd1 ,unit$ ,/ates ,code1 is am5d$
 by add+ at ! end ! foll[+3  7h7        
,direction to ag5cies  7#a7 ,au?ority   
7,a7 ,9 g5]al ,not)/&+ section #ceed1 & 
subject to subp>agraph 7,b71 9 response 
to a kn[n or reasonably suspect$        
in=mation security ?reat1 vuln]ability1 
or incid5t t repres5ts a sub/antial     
?reat to ! in=mation security ( an      
ag5cy1 ! ,secret>y may issue a directive
 to ! head ( an ag5cy to take any lawful
 action ) respect to ! op]ation ( !     
in=mation sy/em1 includ+ su* sy/ems own$
 or op]at$ by ano!r entity on behalf (  
an ag5cy1 t collects1 processes1 /ores1 
transmits1 dissem9ates1 or o!rwise      
ma9ta9s ag5cy in=mation1 = ! purpose (  
protect+ ! in=mation sy/em f1 or        
mitigat+1 an in=mation security ?reat4  
7,b7 ,exception ,! au?orities ( !       

,secret>y "u ?is subsection %all n apply
 to a sy/em describ$ 9 p>agraph 7#b7 or 
7#c7 ( subsection 7e74  7#b7 ,proc$ures 
= use ( au?ority ,! ,secret>y %all--    
7,a7 9 coord9ation ) ! ,director1       
e/abli% proc$ures gov]n+ ! circum/ances 
"u :i* a directive may be issu$ "u ?is  
subsection1 :i* %all include--  7i7     
?re%olds & o!r crit]ia2  7ii7 privacy & 
civil lib]ties protections2 &  7iii7    
provid+ notice to pot5tially affect$    
?ird p>ties2  7,b7 specify ! reasons = !
 requir$ action & ! duration ( !        
directive2  7,c7 m9imize ! impact ( a   
directive "u ?is subsection by-- 7i7    
adopt+ ! lea/ intrusive means possible  
"u ! circum/ances to secure ! ag5cy     
in=mation sy/ems2 &  7ii7 limit+        
directives to ! %orte/ p]iod            
practicable2  7,d7 notify ! ,director & 
! head ( any affect$ ag5cy imm$iately ^u
 ! issuance ( a directive "u ?is        
subsection2 &  7,e7 n lat] ?an ,febru>y 
#a ( ea* ye>1 submit to ! appropriate   
congressional committees a report reg>d+

 ! specific actions ! ,secret>y has tak5
 pursuant to p>agraph 7#a77;,a74  7#c7  
,imm95t ?reats  7,a7 ,9 g5]al ,if !     
,secret>y det]m9es t !re is an imm95t   
?reat to ag5cy in=mation sy/ems & a     
directive "u ?is subsection is n        
reasonably likely to result 9 a timely  
response to ! ?reat1 ! ,secret>y may    
au?orize ! use ( protective capabilities
 "u ! control ( ! ,secret>y =           
communications or o!r sy/em traffic     
transit+ to or f or /or$ on an ag5cy    
in=mation sy/em )\t prior consultation )
 ! affect$ ag5cy = ! purpose ( ensur+ ! 
security ( ! in=mation or in=mation     
sy/em or o!r ag5cy in=mation sy/ems4    
7,b7 ,notice ,! ,secret>y %all          
imm$iately notify ! ,director1 ! head & 
*ief in=mation (fic] 7or equival5t      
(ficial7 ( ea* ag5cy to :i* specific    
actions 7 tak5 pursuant to subp>agraph  
7,a71 & ! appropriate congressional     
committees & au?oriz+ committees ( ea*  
su* ag5cies (--  7i7 any action tak5 "u 
subp>agraph 7,a72 &  7ii7 ! reasons = & 

duration & nature ( ! action4  7,c7 ,o!r
 law ,any action ( ! ,secret>y "u ?is   
p>agraph %all be consi/5t ) applicable  
law4  7,d7 ,limitation on delegation ,! 
au?ority "u ?is p>agraph may n be       
delegat$ to an (ficial 9 a position l[] 
?an an ,"u ,secret>y ( ! ,dep>tm5t (    
,homel& ,security4  7#d7 ,limitation ,! 
,secret>y may direct or au?orize lawful 
action or protective capability "u ?is  
subsection only to--  7,a7 protect ag5cy
 in=mation f unau?oriz$ access1 use1    
disclosure1 disruption1 modification1 or
 de/ruction2 or  7,b7 require !         
rem$iation ( or protect aga9/ id5tifi$  
in=mation security risks ) respect to-- 
7i7 in=mation collect$ or ma9ta9$ by or 
on behalf ( an ag5cy2 or  7ii7 t portion
 ( an in=mation sy/em us$ or op]at$ by  
an ag5cy or by a contractor ( an ag5cy  
or o!r organization on behalf ( an      
ag5cy4  7i7 ,annual report to ,congress 
,n lat] ?an ,febru>y #a ( ea* ye>1 !    
,director %all submit to ! appropriate  
congressional committees a report reg>d+

 ! specific actions ! ,director has tak5
 pursuant to subsection 7a77#e71 includ+
 any actions tak5 pursuant to section   
#aacjc7;b77#e7 ( title #dj4  7j7        
,appropriate congressional committees ,9
 ?is section1 ! t]m appropriate         
congressional committees means-- 7#a7 ! 
,committee on ,appropriations & !       
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2 &  7#b7
 ! ,committee on ,appropriations & !    
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  4  ,novemb]   
#ag1 #bjaf,report$ ) am5dm5ts