#aad? ,,congress  #a/ ,session  ,s4 #ged
  ,,an ,,act  ,to improve cyb]security 9
 ! ,unit$ ,/ates ?r\gh enhanc$ %>+ (    
in=mation ab\t cyb]security ?reats1 & = 
o!r purposes4  #a4 ,table ( cont5ts ,!  
table ( cont5ts ( ?is ,act is z foll[s3 
,sec4 #a4 ,table ( cont5ts4,,title      
,i--,cyb]security ,in=mation            
,sharing,sec4 #aja4 ,%ort title4,sec4   
#ajb4 ,def9itions4,sec4 #ajc4 ,%>+ (    
in=mation by ! ,f$]al ,gov]nm5t4,sec4   
#ajd4 ,au?orizations = prev5t+1 detect+1
 analyz+1 & mitigat+ cyb]security       
?reats4,sec4 #aje4 ,%>+ ( cyb] ?reat    
indicators & def5sive measures ) !      
,f$]al ,gov]nm5t4,sec4 #ajf4 ,protection
 f liability4,sec4 #ajg4 ,ov]sight (    
,gov]nm5t activities4,sec4 #ajh4        
,con/ruction & preemption4,sec4 #aji4   
,report on cyb]security ?reats4,sec4    
#aaj4 ,con=m+ am5dm5t4,,title           
,,ii--,f$]al ,cyb]security              
,enhancement,sec4 #bja4 ,%ort           
title4,sec4 #bjb4 ,def9itions4,sec4     
#bjc4 ,improv$ ,f$]al network           

security4,sec4 #bjd4 ,advanc$ int]nal   
def5ses4,sec4 #bje4 ,f$]al cyb]security 
requirem5ts4,sec4 #bjf4 ,assessm5t2     
reports4,sec4 #bjg4 ,t]m9ation4,sec4    
#bjh4 ,id5tification ( in=mation sy/ems 
relat+ to national security4,sec4 #bji4 
,direction to ag5cies4,,title           
,,iii--,f$]al cyb]security work=ce      
assessment,sec4 #cja4 ,%ort title4,sec4 
#cjb4 ,def9itions4,sec4 #cjc4 ,national 
cyb]security work=ce measurem5t         
initiative4,sec4 #cjd4 ,id5tification ( 
cyb]-relat$ roles ( critical ne$4,sec4  
#cje4 ,gov]nm5t ,acc\ntability ,(fice   
/atus reports4,,title ,,iv--,o!r cyb]   
matters,sec4 #dja4 ,/udy on mobile      
device security4,sec4 #djb4 ,dep>tm5t ( 
,/ate int]national cyb]space policy     
/rategy4,sec4 #djc4 ,appreh5sion &      
prosecution ( int]national cyb]         
crim9als4,sec4 #djd4 ,enhancem5t (      
em]g5cy s]vices4,sec4 #dje4 ,improv+    
cyb]security 9 ! heal? c>e indu/ry4,sec4
 #djf4 ,f$]al comput] security4,sec4    
#djg4 ,/rategy to protect critical      

infra/ructure at greate/ risk4,sec4     
#djh4 ,/opp+ ! fraudul5t sale ( f9ancial
 in=mation ( p ( ! ,unit$ ,/ates4,sec4  
#dji4 ,effective p]iod4  ,i             
,cyb]security ,in=mation ,%>+  #aja4    
,%ort title ,?is title may be cit$ z !  
,cyb]security ,in=mation ,%>+ ,act (    
#bjae4  #ajb4 ,def9itions ,9 ?is title3 
7#a7 ,ag5cy ,! t]m ag5cy has ! mean+    
giv5 ! t]m 9 section #cejb ( title #dd1 
,unit$ ,/ates ,code4  7#b7 ,antitru/    
laws ,! t]m antitru/ laws-- 7,a7 has !  
mean+ giv5 ! t]m 9 section #a ( !       
,clayton ,act 7#ae ,u4,s4,c4 #ab72  7,b7
 includes section #e ( ! ,f$]al ,trade  
,commission ,act 7#ae ,u4,s4,c4 #de7 to 
! ext5t t section #e ( t ,act applies to
 unfair me?ods ( competition2 &  7,c7   
includes any ,/ate law t has ! same     
int5t & effect z ! laws "u subp>agraphs 
7,a7 & 7,b74  7#c7 ,appropriate ,f$]al  
entities ,! t]m appropriate ,f$]al      
entities means ! foll[+3 7,a7 ,!        
,dep>tm5t ( ,comm]ce4  7,b7 ,! ,dep>tm5t
 ( ,def5se4  7,c7 ,! ,dep>tm5t ( ,en]gy4

  7,d7 ,! ,dep>tm5t ( ,homel& ,security4
  7,e7 ,! ,dep>tm5t ( ,ju/ice4  7,f7 ,! 
,dep>tm5t ( ! ,treasury4  7,g7 ,! ,(fice
 ( ! ,director ( ,national ,intellig5ce4
  7#d7 ,cyb]security purpose ,! t]m     
cyb]security purpose means ! purpose (  
protect+ an in=mation sy/em or in=mation
 t is /or$ on1 process$ by1 or transit+ 
an in=mation sy/em f a cyb]security     
?reat or security vuln]ability4  7#e7   
,cyb]security ?reat  7,a7 ,9 g5]al      
,except z provid$ 9 subp>agraph 7,b71 ! 
t]m cyb]security ?reat means an action1 
n protect$ by ! ,fir/ ,am5dm5t to !     
,con/itution ( ! ,unit$ ,/ates1 on or   
?r\gh an in=mation sy/em t may result 9 
an unau?oriz$ ef=t to adv]sely impact ! 
security1 availability1 confid5tiality1 
or integrity ( an in=mation sy/em or    
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em4  7,b7      
,exclusion ,! t]m cyb]security ?reat    
does n include any action t solely      
involves a violation ( a consum] t]m (  
s]vice or a consum] lic5s+ agreem5t4    

7#f7 ,cyb] ?reat indicator ,! t]m cyb]  
?reat indicator means in=mation t is    
necess>y to describe or id5tify-- 7,a7  
malici\s reconnaissance1 includ+        
anomal\s patt]ns ( communications t     
appe> to be transmitt$ = ! purpose (    
ga!r+ te*nical in=mation relat$ to a    
cyb]security ?reat or security          
vuln]ability2  7,b7 a me?od ( defeat+ a 
security control or exploitation ( a    
security vuln]ability2  7,c7 a security 
vuln]ability1 includ+ anomal\s activity 
t appe>s to indicate ! exi/5ce ( a      
security vuln]ability2  7,d7 a me?od (  
caus+ a us] ) legitimate access to an   
in=mation sy/em or in=mation t is /or$  
on1 process$ by1 or transit+ an         
in=mation sy/em to unwitt+ly enable !   
defeat ( a security control or          
exploitation ( a security vuln]ability2 
7,e7 malici\s cyb] comm& & control2     
7,f7 ! actual or pot5tial h>m caus$ by  
an incid5t1 includ+ a description ( !   
in=mation exfiltrat$ z a result ( a     
p>ticul> cyb]security ?reat2  7,g7 any  

o!r attribute ( a cyb]security ?reat1 if
 disclosure ( su* attribute is n o!rwise
 prohibit$ by law2 or  7,h7 any         
comb9ation !re(4  7#g7 ,def5sive measure
  7,a7 ,9 g5]al ,except z provid$ 9     
subp>agraph 7,b71 ! t]m def5sive measure
 means an action1 device1 proc$ure1     
signature1 te*nique1 or o!r measure     
appli$ to an in=mation sy/em or         
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em t detects1  
prev5ts1 or mitigates a kn[n or suspect$
 cyb]security ?reat or security         
vuln]ability4  7,b7 ,exclusion ,! t]m   
def5sive measure does n include a       
measure t de/roys1 r5d]s unusable1      
provides unau?oriz$ access to1 or       
sub/antially h>ms an in=mation sy/em or 
data on an in=mation sy/em n belong+    
to--  7i7 ! private entity op]at+ !     
measure2 or  7ii7 ano!r entity or ,f$]al
 entity t is au?oriz$ to provide cons5t 
& has provid$ cons5t to t private entity
 = op]ation ( su* measure4  7#h7 ,entity
  7,a7 ,9 g5]al ,except z o!rwise       

provid$ 9 ?is p>agraph1 ! t]m entity    
means any private entity1 non-,f$]al    
gov]nm5t ag5cy or dep>tm5t1 or ,/ate1   
tribal1 or local gov]nm5t 7includ+ a    
political subdivision1 dep>tm5t1 or     
compon5t !re(74  7,b7 ,inclusions ,! t]m
 entity includes a gov]nm5t ag5cy or    
dep>tm5t ( ! ,di/rict ( ,columbia1 !    
,commonweal? ( ,pu]to ,rico1 ! ,virg9   
,isl&s1 ,guam1 ,am]ican ,samoa1 !       
,nor!rn ,m>iana ,isl&s1 & any o!r       
t]ritory or possession ( ! ,unit$       
,/ates4  7,c7 ,exclusion ,! t]m entity  
does n include a =eign p[] z def9$ 9    
section #aja ( ! ,=eign ,intellig5ce    
,surveillance ,act ( #aigh 7#ej         
,u4,s4,c4 #ahja74  7#i7 ,f$]al entity ,!
 t]m ,f$]al entity means a dep>tm5t or  
ag5cy ( ! ,unit$ ,/ates or any compon5t 
( su* dep>tm5t or ag5cy4  7#aj7         
,in=mation sy/em ,! t]m in=mation       
sy/em-- 7,a7 has ! mean+ giv5 ! t]m 9   
section #cejb ( title #dd1 ,unit$ ,/ates
 ,code2 &  7,b7 includes indu/rial      
control sy/ems1 su* z sup]visory control

 & data acquisition sy/ems1 di/ribut$   
control sy/ems1 & programmable logic    
controll]s4  7#aa7 ,local gov]nm5t ,!   
t]m local gov]nm5t means any bor\gh1    
city1 c\nty1 p>i%1 t[n1 t[n%ip1 village1
 or o!r political subdivision ( a ,/ate4
  7#ab7 ,malici\s cyb] comm& & control  
,! t]m malici\s cyb] comm& & control    
means a me?od = unau?oriz$ remote       
id5tification (1 access to1 or use (1 an
 in=mation sy/em or in=mation t is /or$ 
on1 process$ by1 or transit+ an         
in=mation sy/em4  7#ac7 ,malici\s       
reconnaissance ,! t]m malici\s          
reconnaissance means a me?od = actively 
prob+ or passively monitor+ an in=mation
 sy/em = ! purpose ( disc]n+ security   
vuln]abilities ( ! in=mation sy/em1 if  
su* me?od is associat$ ) a kn[n or      
suspect$ cyb]security ?reat4  7#ad7     
,monitor ,! t]m monitor means to        
acquire1 id5tify1 or scan1 or to        
possess1 in=mation t is /or$ on1        
process$ by1 or transit+ an in=mation   
sy/em4  7#ae7 ,private entity  7,a7 ,9  

g5]al ,except z o!rwise provid$ 9 ?is   
p>agraph1 ! t]m private entity means any
 p]son or private gr\p1 organization1   
proprietor%ip1 p>tn]%ip1 tru/1          
coop]ative1 corporation1 or o!r         
comm]cial or nonpr(it entity1 includ+ an
 (fic]1 employee1 or ag5t !re(4  7,b7   
,inclusion ,! t]m private entity        
includes a ,/ate1 tribal1 or local      
gov]nm5t p]=m+ electric or o!r utility  
s]vices4  7,c7 ,exclusion ,! t]m private
 entity does n include a =eign p[] z    
def9$ 9 section #aja ( ! ,=eign         
,intellig5ce ,surveillance ,act ( #aigh 
7#ej ,u4,s4,c4 #ahja74  7#af7 ,security 
control ,! t]m security control means ! 
managem5t1 op]ational1 & te*nical       
controls us$ to protect aga9/ an        
unau?oriz$ ef=t to adv]sely affect !    
confid5tiality1 integrity1 &            
availability ( an in=mation sy/em or its
 in=mation4  7#ag7 ,security            
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 s(tw>e1 process1 or proc$ure t  

c\ld enable or facilitate ! defeat ( a  
security control4  7#ah7 ,tribal ,! t]m 
tribal has ! mean+ giv5 ! t]m ,indian   
tribe 9 section #d ( ! ,indian          
,self-,det]m9ation & ,education         
,assi/ance ,act 7#be ,u4,s4,c4 #dej;b74 
#ajc4 ,%>+ ( in=mation by ! ,f$]al      
,gov]nm5t  7a7 ,9 g5]al ,consi/5t ) !   
protection ( classifi$ in=mation1       
intellig5ce s\rces & me?ods1 & privacy &
 civil lib]ties1 ! ,director ( ,national
 ,intellig5ce1 ! ,secret>y ( ,homel&    
,security1 ! ,secret>y ( ,def5se1 & !   
,attorney ,g5]al1 9 consultation ) !    
heads ( ! appropriate ,f$]al entities1  
%all develop & promulgate proc$ures to  
facilitate & promote--  7#a7 ! timely   
%>+ ( classifi$ cyb] ?reat indicators 9 
! possession ( ! ,f$]al ,gov]nm5t )     
cle>$ repres5tatives ( relevant         
entities2  7#b7 ! timely %>+ ) relevant 
entities ( cyb] ?reat indicators or     
in=mation 9 ! possession ( ! ,f$]al     
,gov]nm5t t may be declassifi$ & %>$ at 
an unclassifi$ level2  7#c7 ! %>+ )     

relevant entities1 or ! public if       
appropriate1 ( unclassifi$1 includ+     
controll$ unclassifi$1 cyb] ?reat       
indicators 9 ! possession ( ! ,f$]al    
,gov]nm5t2  7#d7 ! %>+ ) entities1 if   
appropriate1 ( in=mation 9 ! possession 
( ! ,f$]al ,gov]nm5t ab\t cyb]security  
?reats to su* entities to prev5t or     
mitigate adv]se effects f su*           
cyb]security ?reats2 &  7#e7 ! p]iodic  
%>+1 ?r\gh publication & t>get$ outrea*1
 ( cyb]security be/ practices t are     
develop$ bas$ on ongo+ analysis ( cyb]  
?reat indicators & in=mation 9          
possession ( ! ,f$]al ,gov]nm5t1 )      
att5tion to accessibility &             
implem5tation *all5ges fac$ by small    
bus9ess conc]ns 7z def9$ 9 section #c ( 
! ,small ,bus9ess ,act 7#ae ,u4,s4,c4   
#fcb774  7b7 ,developm5t ( proc$ures    
7#a7 ,9 g5]al ,! proc$ures develop$ &   
promulgat$ "u subsection 7a7 %all-- 7,a7
 ensure ! ,f$]al ,gov]nm5t has & ma9ta9s
 ! capability to %>e cyb] ?reat         
indicators 9 real "t consi/5t ) !       

protection ( classifi$ in=mation2  7,b7 
incorporate1 to ! greate/ ext5t         
practicable1 exi/+ processes & exi/+    
roles & responsibilities ( ,f$]al &     
non-,f$]al entities = in=mation %>+ by !
 ,f$]al ,gov]nm5t1 includ+ sector       
specific in=mation %>+ & analysis c5t]s2
  7,c7 include proc$ures = notify+1 9 a 
timely mann]1 entities t h receiv$ a    
cyb] ?reat indicator f a ,f$]al entity  
"u ?is title t is kn[n or det]m9$ to be 
9 error or 9 contrav5tion ( !           
requirem5ts ( ?is title or ano!r        
provision ( ,f$]al law or policy ( su*  
error or contrav5tion2  7,d7 include    
requirem5ts = ,f$]al entities %>+ cyb]  
?reat indicators or def5sive measures to
 implem5t & utilize security controls to
 protect aga9/ unau?oriz$ access to or  
acquisition ( su* cyb] ?reat indicators 
or def5sive measures2  7,e7 include     
proc$ures t require a ,f$]al entity1    
prior to ! %>+ ( a cyb] ?reat           
indicator-- 7i7 to review su* cyb] ?reat
 indicator to assess :e!r su* cyb] ?reat

 indicator conta9s any in=mation t su*  
,f$]al entity kn[s at ! "t ( %>+ to be  
p]sonal in=mation or in=mation t        
id5tifies a specific p]son n directly   
relat$ to a cyb]security ?reat & remove 
su* in=mation2 or  7ii7 to implem5t &   
utilize a te*nical capability configur$ 
to remove any p]sonal in=mation or      
in=mation t id5tifies a specific p]son n
 directly relat$ to a cyb]security      
?reat2 &  7,f7 include proc$ures =      
notify+1 9 a timely mann]1 any ,unit$   
,/ates p]son ^: p]sonal in=mation is    
kn[n or det]m9$ to h be5 %>$ by a ,f$]al
 entity 9 violation ( ?is ,act4  7#b7   
,coord9ation ,9 develop+ ! proc$ures    
requir$ "u ?is section1 ! ,director (   
,national ,intellig5ce1 ! ,secret>y (   
,homel& ,security1 ! ,secret>y (        
,def5se1 & ! ,attorney ,g5]al %all      
coord9ate ) appropriate ,f$]al entities1
 includ+ ! ,small ,bus9ess ,adm9i/ration
 & ! ,national ,laboratories 7z def9$ 9 
section #b ( ! ,en]gy ,policy ,act (    
#bjje 7#db ,u4,s4,c4 #aehja771 to ensure

 t effective protocols are implem5t$ t w
 facilitate & promote ! %>+ ( cyb] ?reat
 indicators by ! ,f$]al ,gov]nm5t 9 a   
timely mann]4  7c7 ,submittal to        
,congress ,n lat] ?an #fj days aft] !   
date ( ! enactm5t ( ?is ,act1 !         
,director ( ,national ,intellig5ce1 9   
consultation ) ! heads ( ! appropriate  
,f$]al entities1 %all submit to         
,congress ! proc$ures requir$ by        
subsection 7a74  #ajd4 ,au?orizations = 
prev5t+1 detect+1 analyz+1 & mitigat+   
cyb]security ?reats  7a7 ,au?orization =
 monitor+  7#a7 ,9 g5]al ,not)/&+ any   
o!r provision ( law1 a private entity   
may1 = cyb]security purposes1 monitor-- 
7,a7 an in=mation sy/em ( su* private   
entity2  7,b7 an in=mation sy/em ( ano!r
 entity1 ^u ! au?orization & writt5     
cons5t ( su* o!r entity2  7,c7 an       
in=mation sy/em ( a ,f$]al entity1 ^u ! 
au?orization & writt5 cons5t ( an       
au?oriz$ repres5tative ( ! ,f$]al       
entity2 &  7,d7 in=mation t is /or$ on1 
process$ by1 or transit+ an in=mation   

sy/em monitor$ by ! private entity "u   
?is p>agraph4  7#b7 ,con/ruction ,no?+ 9
 ?is subsection %all be con/ru$-- 7,a7  
to au?orize ! monitor+ ( an in=mation   
sy/em1 or ! use ( any in=mation obta9$  
?r\gh su* monitor+1 o!r ?an z provid$ 9 
?is title2 or  7,b7 to limit o!rwise    
lawful activity4  7b7 ,au?orization =   
op]ation ( def5sive measures  7#a7 ,9   
g5]al ,not)/&+ any o!r provision ( law1 
a private entity may1 = cyb]security    
purposes1 op]ate a def5sive measure t is
 appli$ to--  7,a7 an in=mation sy/em ( 
su* private entity 9 ord] to protect !  
rights or prop]ty ( ! private entity2   
7,b7 an in=mation sy/em ( ano!r entity  
^u writt5 cons5t ( su* entity = op]ation
 ( su* def5sive measure to protect !    
rights or prop]ty ( su* entity2 &  7,c7 
an in=mation sy/em ( a ,f$]al entity ^u 
writt5 cons5t ( an au?oriz$             
repres5tative ( su* ,f$]al entity =     
op]ation ( su* def5sive measure to      
protect ! rights or prop]ty ( ! ,f$]al  
,gov]nm5t4  7#b7 ,con/ruction ,no?+ 9   

?is subsection %all be con/ru$-- 7,a7 to
 au?orize ! use ( a def5sive measure o!r
 ?an z provid$ 9 ?is subsection2 or     
7,b7 to limit o!rwise lawful activity4  
7c7 ,au?orization = %>+ or receiv+ cyb] 
?reat indicators or def5sive measures   
7#a7 ,9 g5]al ,except z provid$ 9       
p>agraph 7#b7 & not)/&+ any o!r         
provision ( law1 an entity may1 = a     
cyb]security purpose & consi/5t ) !     
protection ( classifi$ in=mation1 %>e )1
 or receive f1 any o!r entity or !      
,f$]al ,gov]nm5t a cyb] ?reat indicator 
or def5sive measure4  7#b7 ,lawful      
re/riction ,an entity receiv+ a cyb]    
?reat indicator or def5sive measure f   
ano!r entity or ,f$]al entity %all      
comply ) o!rwise lawful re/rictions     
plac$ on ! %>+ or use ( su* cyb] ?reat  
indicator or def5sive measure by ! %>+  
entity or ,f$]al entity4  7#c7          
,con/ruction ,no?+ 9 ?is subsection %all
 be con/ru$-- 7,a7 to au?orize ! %>+ or 
receiv+ ( a cyb] ?reat indicator or     
def5sive measure o!r ?an z provid$ 9 ?is

 subsection2 or  7,b7 to limit o!rwise  
lawful activity4  7d7 ,protection & use 
( in=mation  7#a7 ,security ( in=mation 
,an entity monitor+ an in=mation sy/em1 
op]at+ a def5sive measure1 or provid+ or
 receiv+ a cyb] ?reat indicator or      
def5sive measure "u ?is section %all    
implem5t & utilize a security control to
 protect aga9/ unau?oriz$ access to or  
acquisition ( su* cyb] ?reat indicator  
or def5sive measure4  7#b7 ,removal (   
c]ta9 p]sonal in=mation ,an entity %>+ a
 cyb] ?reat indicator pursuant to ?is   
title %all1 prior to su* %>+--  7,a7    
review su* cyb] ?reat indicator to      
assess :e!r su* cyb] ?reat indicator    
conta9s any in=mation t ! entity kn[s at
 ! "t ( %>+ to be p]sonal in=mation or  
in=mation t id5tifies a specific p]son n
 directly relat$ to a cyb]security ?reat
 & remove su* in=mation2 or  7,b7       
implem5t & utilize a te*nical capability
 configur$ to remove any in=mation      
conta9$ )9 su* indicator t ! entity kn[s
 at ! "t ( %>+ to be p]sonal in=mation  

or in=mation t id5tifies a specific     
p]son n directly relat$ to a            
cyb]security ?reat4  7#c7 ,use ( cyb]   
?reat indicators & def5sive measures by 
entities  7,a7 ,9 g5]al ,consi/5t ) ?is 
title1 a cyb] ?reat indicator or        
def5sive measure %>$ or receiv$ "u ?is  
section may1 = cyb]security purposes--  
7i7 be us$ by an entity to monitor or   
op]ate a def5sive measure t is appli$   
to-- 7,i7 an in=mation sy/em ( ! entity2
 or  7,,ii7 an in=mation sy/em ( ano!r  
entity or a ,f$]al entity ^u ! writt5   
cons5t ( t o!r entity or t ,f$]al       
entity2 &  7ii7 be o!rwise us$1 reta9$1 
& fur!r %>$ by an entity subject to--   
7,i7 an o!rwise lawful re/riction plac$ 
by ! %>+ entity or ,f$]al entity on su* 
cyb] ?reat indicator or def5sive        
measure2 or  7,,ii7 an o!rwise          
applicable provision ( law4  7,b7       
,con/ruction ,no?+ 9 ?is p>agraph %all  
be con/ru$ to au?orize ! use ( a cyb]   
?reat indicator or def5sive measure o!r 
?an z provid$ 9 ?is section4  7#d7 ,use 

( cyb] ?reat indicators by ,/ate1       
tribal1 or local gov]nm5t  7,a7 ,law    
en=cem5t use  7i7 ,prior writt5 cons5t  
,except z provid$ 9 clause 7ii71 a cyb] 
?reat indicator %>$ ) a ,/ate1 tribal1  
or local gov]nm5t "u ?is section may1 ) 
! prior writt5 cons5t ( ! entity %>+ su*
 indicator1 be us$ by a ,/ate1 tribal1  
or local gov]nm5t = ! purpose ( prev5t+1
 inve/igat+1 or prosecut+ any ( ! (f5ses
 describ$ 9 section                     
#aje7;d77#e77;,a77vi74  7ii7 ,oral      
cons5t ,if exig5t circum/ances prev5t   
obta9+ writt5 cons5t "u clause 7i71 su* 
cons5t may be provid$ orally ) subsequ5t
 docum5tation ( ! cons5t4  7,b7         
,exemption f disclosure ,a cyb] ?reat   
indicator %>$ ) a ,/ate1 tribal1 or     
local gov]nm5t "u ?is section %all be-- 
7i7 deem$ volunt>ily %>$ in=mation2 &   
7ii7 exempt f disclosure "u any ,/ate1  
tribal1 or local law requir+ disclosure 
( in=mation or records4  7,c7 ,/ate1    
tribal1 & local regulatory au?ority  7i7
 ,9 g5]al ,except z provid$ 9 clause    

7ii71 a cyb] ?reat indicator or def5sive
 measure %>$ ) a ,/ate1 tribal1 or local
 gov]nm5t "u ?is title %all n be        
directly us$ by any ,/ate1 tribal1 or   
local gov]nm5t to regulate1 includ+ an  
en=cem5t action1 ! lawful activity ( any
 entity1 includ+ an activity relat+ to  
monitor+1 op]at+ a def5sive measure1 or 
%>+ ( a cyb] ?reat indicator4  7ii7     
,regulatory au?ority specifically relat+
 to prev5tion or mitigation (           
cyb]security ?reats ,a cyb] ?reat       
indicator or def5sive measure %>$ z     
describ$ 9 clause 7i7 may1 consi/5t ) a 
,/ate1 tribal1 or local gov]nm5t        
regulatory au?ority specifically relat+ 
to ! prev5tion or mitigation (          
cyb]security ?reats to in=mation sy/ems1
 in=m ! developm5t or implem5tation ( a 
regulation relat+ to su* in=mation      
sy/ems4  7e7 ,antitru/ exemption  7#a7  
,9 g5]al ,except z provid$ 9 section    
#ajh7;e71 x %all n be consid]$ a        
violation ( any provision ( antitru/    
laws = #b or m private entities to      

ex*ange or provide a cyb] ?reat         
indicator1 or assi/ance relat+ to !     
prev5tion1 inve/igation1 or mitigation (
 a cyb]security ?reat1 = cyb]security   
purposes "u ?is title4  7#b7            
,applicability ,p>agraph 7#a7 %all apply
 only to in=mation t is ex*ang$ or      
assi/ance provid$ 9 ord] to assi/ )--   
7,a7 facilitat+ ! prev5tion1            
inve/igation1 or mitigation ( a         
cyb]security ?reat to an in=mation sy/em
 or in=mation t is /or$ on1 process$ by1
 or transit+ an in=mation sy/em2 or     
7,b7 communicat+ or disclos+ a cyb]     
?reat indicator to help prev5t1         
inve/igate1 or mitigate ! effect ( a    
cyb]security ?reat to an in=mation sy/em
 or in=mation t is /or$ on1 process$ by1
 or transit+ an in=mation sy/em4  7f7   
,no "r or b5efit ,! %>+ ( a cyb] ?reat  
indicator ) an entity "u ?is title %all 
n create a "r or b5efit to simil>       
in=mation by su* entity or any o!r      
entity4  #aje4 ,%>+ ( cyb] ?reat        
indicators & def5sive measures ) !      

,f$]al ,gov]nm5t  7a7 ,requirem5t =     
policies & proc$ures  7#a7 ,int]im      
policies & proc$ures ,n lat] ?an #fj    
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,attorney ,g5]al & ! ,secret>y (
 ,homel& ,security %all1 9 coord9ation )
 ! heads ( ! appropriate ,f$]al         
entities1 develop & submit to ,congress 
int]im policies & proc$ures relat+ to ! 
receipt ( cyb] ?reat indicators &       
def5sive measures by ! ,f$]al ,gov]nm5t4
  7#b7 ,f9al policies & proc$ures ,n    
lat] ?an #ahj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,attorney ,g5]al 
& ! ,secret>y ( ,homel& ,security %all1 
9 coord9ation ) ! heads ( ! appropriate 
,f$]al entities1 promulgate f9al        
policies & proc$ures relat+ to ! receipt
 ( cyb] ?reat indicators & def5sive     
measures by ! ,f$]al ,gov]nm5t4  7#c7   
,requirem5ts conc]n+ policies &         
proc$ures ,consi/5t ) ! guidel9es       
requir$ by subsection 7b71 ! policies & 
proc$ures develop$ & promulgat$ "u ?is  
subsection %all--  7,a7 ensure t cyb]   

?reat indicators %>$ ) ! ,f$]al         
,gov]nm5t by any entity pursuant to     
section #ajd7;c7 ?r\gh ! real-"t process
 describ$ 9 subsection 7c7 ( ?is        
section--  7i7 are %>$ 9 an automat$    
mann] ) all ( ! appropriate ,f$]al      
entities2  7ii7 are only subject to a   
delay1 modification1 or o!r action due  
to controls e/abli%$ = su* real-"t      
process t c\ld imp$e real-"t receipt by 
all ( ! appropriate ,f$]al entities :5 !
 delay1 modification1 or o!r action is  
due to controls--  7,i7 agre$ ^u        
unanim\sly by all ( ! heads ( !         
appropriate ,f$]al entities2  7,,ii7    
c>ri$ out be=e any ( ! appropriate      
,f$]al entities reta9s or uses ! cyb]   
?reat indicators or def5sive measures2 &
  7,,iii7 uni=mly appli$ su* t ea* ( !  
appropriate ,f$]al entities is subject  
to ! same delay1 modification1 or o!r   
action2 &  7iii7 may be provid$ to o!r  
,f$]al entities2  7,b7 ensure t cyb]    
?reat indicators %>$ ) ! ,f$]al         
,gov]nm5t by any entity pursuant to     

section #ajd 9 a mann] o!r ?an ! real "t
 process describ$ 9 subsection 7c7 ( ?is
 section--  7i7 are %>$ z quickly z     
op]ationally practicable ) all ( !      
appropriate ,f$]al entities2  7ii7 are n
 subject to any unnecess>y delay1       
int]f]5ce1 or any o!r action t c\ld     
imp$e receipt by all ( ! appropriate    
,f$]al entities2 &  7iii7 may be provid$
 to o!r ,f$]al entities2  7,c7 consi/5t 
) ?is title1 any o!r applicable         
provisions ( law1 & ! fair in=mation    
practice pr9ciples set =? 9 app5dix ,a (
 ! docum5t entitl$ ,national ,/rategy = 
,tru/$ ,id5tities 9 ,cyb]space & publi%$
 by ! ,presid5t 9 ,april1 #bjaa1 gov]n !
 ret5tion1 use1 & dissem9ation by !     
,f$]al ,gov]nm5t ( cyb] ?reat indicators
 %>$ ) ! ,f$]al ,gov]nm5t "u ?is title1 
includ+ ! ext5t1 if any1 to :i* su* cyb]
 ?reat indicators may be us$ by ! ,f$]al
 ,gov]nm5t2 &  7,d7 ensure !re are-- 7i7
 audit capabilities2 &  7ii7 appropriate
 sanctions 9 place = (fic]s1 employees1 
or ag5ts ( a ,f$]al entity :o kn[+ly &  

willfully conduct activities "u ?is     
title 9 an unau?oriz$ mann]4  7#d7      
,guidel9es = entities %>+ cyb] ?reat    
indicators ) ,f$]al ,gov]nm5t  7,a7 ,9  
g5]al ,n lat] ?an #fj days aft] ! date (
 ! enactm5t ( ?is ,act1 ! ,attorney     
,g5]al & ! ,secret>y ( ,homel& ,security
 %all develop & make publicly available 
guidance to assi/ entities & promote %>+
 ( cyb] ?reat indicators ) ,f$]al       
entities "u ?is title4  7,b7 ,cont5ts ,!
 guidel9es develop$ & made publicly     
available "u subp>agraph 7,a7 %all      
include guidance on ! foll[+3  7i7      
,id5tification ( types ( in=mation t    
w\ld qualify z a cyb] ?reat indicator "u
 ?is title t w\ld be unlikely to include
 p]sonal in=mation or in=mation t       
id5tifies a specific p]son n directly   
relat$ to a cyb] security ?reat4  7ii7  
,id5tification ( types ( in=mation      
protect$ "u o!rwise applicable privacy  
laws t are unlikely to be directly      
relat$ to a cyb]security ?reat4  7iii7  
,su* o!r matt]s z ! ,attorney ,g5]al & !

 ,secret>y ( ,homel& ,security consid]  
appropriate = entities %>+ cyb] ?reat   
indicators ) ,f$]al entities "u ?is     
title4  7b7 ,privacy & civil lib]ties   
7#a7 ,guidel9es ( ,attorney ,g5]al ,n   
lat] ?an #fj days aft] ! date ( !       
enactm5t ( ?is ,act1 ! ,attorney ,g5]al 
%all1 9 coord9ation ) heads ( !         
appropriate ,f$]al entities & 9         
consultation ) (fic]s designat$ "u      
section #ajfb ( ! ,national ,security   
,intellig5ce ,re=m ,act ( #bjjd 7#db    
,u4,s4,c4 #bjjj;ee-#a71 develop1 submit 
to ,congress1 & make available to !     
public int]im guidel9es relat+ to       
privacy & civil lib]ties :i* %all gov]n 
! receipt1 ret5tion1 use1 & dissem9ation
 ( cyb] ?reat indicators by a ,f$]al    
entity obta9$ 9 connection ) activities 
au?oriz$ 9 ?is title4  7#b7 ,f9al       
guidel9es  7,a7 ,9 g5]al ,n lat] ?an    
#ahj days aft] ! date ( ! enactm5t ( ?is
 ,act1 ! ,attorney ,g5]al %all1 9       
coord9ation ) heads ( ! appropriate     
,f$]al entities & 9 consultation )      

(fic]s designat$ "u section #ajfb ( !   
,national ,security ,intellig5ce ,re=m  
,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a7
 & su* private entities ) indu/ry       
exp]tise z ! ,attorney ,g5]al consid]s  
relevant1 promulgate f9al guidel9es     
relat+ to privacy & civil lib]ties :i*  
%all gov]n ! receipt1 ret5tion1 use1 &  
dissem9ation ( cyb] ?reat indicators by 
a ,f$]al entity obta9$ 9 connection )   
activities au?oriz$ 9 ?is title4  7,b7  
,p]iodic review ,! ,attorney ,g5]al     
%all1 9 coord9ation ) heads ( !         
appropriate ,f$]al entities & 9         
consultation ) (fic]s & private entities
 describ$ 9 subp>agraph 7,a71           
p]iodically1 b n less frequ5tly ?an once
 e two ye>s1 review ! guidel9es         
promulgat$ "u subp>agraph 7,a74  7#c7   
,cont5t ,! guidel9es requir$ by         
p>agraphs 7#a7 & 7#b7 %all1 consi/5t ) !
 ne$ to protect in=mation sy/ems f      
cyb]security ?reats & mitigate          
cyb]security ?reats--  7,a7 limit !     
effect on privacy & civil lib]ties (    

activities by ! ,f$]al ,gov]nm5t "u ?is 
title2  7,b7 limit ! receipt1 ret5tion1 
use1 & dissem9ation ( cyb] ?reat        
indicators conta9+ p]sonal in=mation or 
in=mation t id5tifies specific p]sons1  
includ+ by e/abli%+--  7i7 a process = !
 timely de/ruction ( su* in=mation t is 
kn[n n to be directly relat$ to uses    
au?oriz$ "u ?is title2 &  7ii7 specific 
limitations on ! l5g? ( any p]iod 9 :i* 
a cyb] ?reat indicator may be reta9$2   
7,c7 include requirem5ts to safegu>d    
cyb] ?reat indicators conta9+ p]sonal   
in=mation or in=mation t id5tifies      
specific p]sons f unau?oriz$ access or  
acquisition1 includ+ appropriate        
sanctions = activities by (fic]s1       
employees1 or ag5ts ( ! ,f$]al ,gov]nm5t
 9 contrav5tion ( su* guidel9es2  7,d7  
include proc$ures = notify+ entities &  
,f$]al entities if in=mation receiv$    
pursuant to ?is section is kn[n or      
det]m9$ by a ,f$]al entity receiv+ su*  
in=mation n to con/itute a cyb] ?reat   
indicator2  7,e7 protect !              

confid5tiality ( cyb] ?reat indicators  
conta9+ p]sonal in=mation or in=mation t
 id5tifies specific p]sons to ! greate/ 
ext5t practicable & require recipi5ts to
 be in=m$ t su* indicators may only be  
us$ = purposes au?oriz$ "u ?is title2 & 
7,f7 include /eps t may be ne$$ s t     
dissem9ation ( cyb] ?reat indicators is 
consi/5t ) ! protection ( classifi$ &   
o!r s5sitive national security          
in=mation4  7c7 ,capability & process )9
 ! ,dep>tm5t ( ,homel& ,security  7#a7  
,9 g5]al ,n lat] ?an #ij days aft] !    
date ( ! enactm5t ( ?is ,act1 !         
,secret>y ( ,homel& ,security1 9        
coord9ation ) ! heads ( ! appropriate   
,f$]al entities1 %all develop & implem5t
 a capability & process )9 ! ,dep>tm5t (
 ,homel& ,security t--  7,a7 %all accept
 f any entity 9 real "t cyb] ?reat      
indicators & def5sive measures1 pursuant
 to ?is section2  7,b7 %all1 ^u         
submittal ( ! c]tification "u p>agraph  
7#b7 t su* capability & process fully & 
effectively op]ates z describ$ 9 su*    

p>agraph1 be ! process by :i* ! ,f$]al  
,gov]nm5t receives cyb] ?reat indicators
 & def5sive measures "u ?is title t are 
%>$ by a private entity ) ! ,f$]al      
,gov]nm5t ?r\gh electronic mail or m$ia1
 an int]active =m on an ,int]net        
website1 or a real "t1 automat$ process 
betwe5 in=mation sy/ems except--  7i7   
consi/5t ) section #ajd1 communications 
betwe5 a ,f$]al entity & a private      
entity reg>d+ a previ\sly %>$ cyb] ?reat
 indicator to describe ! relevant       
cyb]security ?reat or develop a def5sive
 measure bas$ on su* cyb] ?reat         
indicator2 &  7ii7 communications by a  
regulat$ entity ) su* entity's ,f$]al   
regulatory au?ority reg>d+ a            
cyb]security ?reat2  7,c7 ensures t all 
( ! appropriate ,f$]al entities receive 
9 an automat$ mann] su* cyb] ?reat      
indicators %>$ ?r\gh ! real-"t process  
)9 ! ,dep>tm5t ( ,homel& ,security2     
7,d7 is 9 compliance ) ! policies1      
proc$ures1 & guidel9es requir$ by ?is   
section2 &  7,e7 does n limit or        

prohibit o!rwise lawful disclosures (   
communications1 records1 or o!r         
in=mation1 includ+--  7i7 report+ ( kn[n
 or suspect$ crim9al activity1 by an    
entity to any o!r entity or a ,f$]al    
entity2  7ii7 volunt>y or legally       
compell$ p>ticipation 9 a ,f$]al        
inve/igation2 &  7iii7 provid+ cyb]     
?reat indicators or def5sive measures z 
"p ( a /atutory or au?oriz$ contractual 
requirem5t4  7#b7 ,c]tification ,n lat] 
?an #aj days prior to ! implem5tation ( 
! capability & process requir$ by       
p>agraph 7#a71 ! ,secret>y ( ,homel&    
,security %all1 9 consultation ) ! heads
 ( ! appropriate ,f$]al entities1 c]tify
 to ,congress :e!r su* capability &     
process fully & effectively op]ates--   
7,a7 z ! process by :i* ! ,f$]al        
,gov]nm5t receives f any entity a cyb]  
?reat indicator or def5sive measure "u  
?is title2 &  7,b7 9 accordance ) !     
policies1 proc$ures1 & guidel9es        
develop$ "u ?is section4  7#c7 ,public  
notice & access ,! ,secret>y ( ,homel&  

,security %all ensure !re is public     
notice (1 & access to1 ! capability &   
process develop$ & implem5t$ "u p>agraph
 7#a7 s t--  7,a7 any entity may %>e    
cyb] ?reat indicators & def5sive        
measures ?r\gh su* process ) ! ,f$]al   
,gov]nm5t2 &  7,b7 all ( ! appropriate  
,f$]al entities receive su* cyb] ?reat  
indicators & def5sive measures 9 real "t
 ) receipt ?r\gh ! process )9 !         
,dep>tm5t ( ,homel& ,security4  7#d7    
,o!r ,f$]al entities ,! process develop$
 & implem5t$ "u p>agraph 7#a7 %all      
ensure t o!r ,f$]al entities receive 9 a
 timely mann] any cyb] ?reat indicators 
& def5sive measures %>$ ) ! ,f$]al      
,gov]nm5t ?r\gh su* process4  7#e7      
,report on developm5t & implem5tation   
7,a7 ,9 g5]al ,n lat] ?an #fj days aft] 
! date ( ! enactm5t ( ?is ,act1 !       
,secret>y ( ,homel& ,security %all      
submit to ,congress a report on !       
developm5t & implem5tation ( !          
capability & process requir$ by p>agraph
 7#a71 includ+ a description ( su*      

capability & process & ! public notice  
(1 & access to1 su* process4  7,b7      
,classifi$ annex ,! report requir$ by   
subp>agraph 7,a7 %all be submitt$ 9     
unclassifi$ =m1 b may include a         
classifi$ annex4  7d7 ,in=mation %>$ )  
or provid$ to ! ,f$]al ,gov]nm5t  7#a7  
,no waiv] ( privilege or protection ,!  
provision ( cyb] ?reat indicators &     
def5sive measures to ! ,f$]al ,gov]nm5t 
"u ?is title %all n con/itute a waiv] ( 
any applicable privilege or protection  
provid$ by law1 includ+ trade secret    
protection4  7#b7 ,propriet>y in=mation 
,consi/5t ) section #ajd7;c77#b71 a cyb]
 ?reat indicator or def5sive measure    
provid$ by an entity to ! ,f$]al        
,gov]nm5t "u ?is title %all be consid]$ 
! comm]cial1 f9ancial1 & propriet>y     
in=mation ( su* entity :5 s designat$ by
 ! orig9at+ entity or a ?ird p>ty act+ 9
 accordance ) ! writt5 au?orization ( ! 
orig9at+ entity4  7#c7 ,exemption f     
disclosure ,cyb] ?reat indicators &     
def5sive measures provid$ to ! ,f$]al   

,gov]nm5t "u ?is title %all be--  7,a7  
deem$ volunt>ily %>$ in=mation & exempt 
f disclosure "u section #eeb ( title #e1
 ,unit$ ,/ates ,code1 & any ,/ate1      
tribal1 or local law requir+ disclosure 
( in=mation or records2 &  7,b7 )held1  
)\t discretion1 f ! public "u section   
#eeb7;b77#c77;,b7 ( title #e1 ,unit$    
,/ates ,code1 & any ,/ate1 tribal1 or   
local provision ( law requir+ disclosure
 ( in=mation or records4  7#d7 ,ex p>te 
communications ,! provision ( a cyb]    
?reat indicator or def5sive measure to !
 ,f$]al ,gov]nm5t "u ?is title %all n be
 subject to a rule ( any ,f$]al ag5cy or
 dep>tm5t or any judicial doctr9e reg>d+
 ex p>te communications ) a             
decision-mak+ (ficial4  7#e7            
,disclosure1 ret5tion1 & use  7,a7      
,au?oriz$ activities ,cyb] ?reat        
indicators & def5sive measures provid$  
to ! ,f$]al ,gov]nm5t "u ?is title may  
be disclos$ to1 reta9$ by1 & us$ by1    
consi/5t ) o!rwise applicable provisions
 ( ,f$]al law1 any ,f$]al ag5cy or      

dep>tm5t1 compon5t1 (fic]1 employee1 or 
ag5t ( ! ,f$]al ,gov]nm5t solely =--    
7i7 a cyb]security purpose2  7ii7 !     
purpose ( id5tify+ a cyb]security ?reat1
 includ+ ! s\rce ( su* cyb]security     
?reat1 or a security vuln]ability2      
7iii7 ! purpose ( id5tify+ a            
cyb]security ?reat involv+ ! use ( an   
in=mation sy/em by a =eign adv]s>y or   
t]rori/2  7iv7 ! purpose ( respond+ to1 
or o!rwise prev5t+ or mitigat+1 an      
imm95t ?reat ( dea?1 s]i\s bodily h>m1  
or s]i\s economic h>m1 includ+ a t]rori/
 act or a use ( a weapon ( mass         
de/ruction2  7v7 ! purpose ( respond+   
to1 or o!rwise prev5t+ or mitigat+1 a   
s]i\s ?reat to a m9or1 includ+ sexual   
exploitation & ?reats to physical       
safety2 or  7vi7 ! purpose ( prev5t+1   
inve/igat+1 disrupt+1 or prosecut+ an   
(f5se aris+ out ( a ?reat describ$ 9    
clause 7iv7 or any ( ! (f5ses li/$ 9--  
7,i7 sections #ajbh ?r\gh #ajcj ( title 
#ah1 ,unit$ ,/ates ,code 7relat+ to     
fraud & id5tity !ft72  7,,ii7 *apt] #cg 

( su* title 7relat+ to espionage &      
c5sor%ip72 &  7,,iii7 *apt] #ij ( su*   
title 7relat+ to protection ( trade     
secrets74  7,b7 ,prohibit$ activities   
,cyb] ?reat indicators & def5sive       
measures provid$ to ! ,f$]al ,gov]nm5t  
"u ?is title %all n be disclos$ to1     
reta9$ by1 or us$ by any ,f$]al ag5cy or
 dep>tm5t = any use n p]mitt$ "u        
subp>agraph 7,a74  7,c7 ,privacy & civil
 lib]ties ,cyb] ?reat indicators &      
def5sive measures provid$ to ! ,f$]al   
,gov]nm5t "u ?is title %all be reta9$1  
us$1 & dissem9at$ by ! ,f$]al           
,gov]nm5t--  7i7 9 accordance ) !       
policies1 proc$ures1 & guidel9es requir$
 by subsections 7a7 & 7b72  7ii7 9 a    
mann] t protects f unau?oriz$ use or    
disclosure any cyb] ?reat indicators t  
may conta9 p]sonal in=mation or         
in=mation t id5tifies specific p]sons2 &
  7iii7 9 a mann] t protects !          
confid5tiality ( cyb] ?reat indicators  
conta9+ p]sonal in=mation or in=mation t
 id5tifies a specific p]son4  7,d7      

,f$]al regulatory au?ority  7i7 ,9 g5]al
 ,except z provid$ 9 clause 7ii71 cyb]  
?reat indicators & def5sive measures    
provid$ to ! ,f$]al ,gov]nm5t "u ?is    
title %all n be directly us$ by any     
,f$]al1 ,/ate1 tribal1 or local gov]nm5t
 to regulate1 includ+ an en=cem5t       
action1 ! lawful activities ( any       
entity1 includ+ activities relat+ to    
monitor+1 op]at+ def5sive measures1 or  
%>+ cyb] ?reat indicators4  7ii7        
,exceptions  7,i7 ,regulatory au?ority  
specifically relat+ to prev5tion or     
mitigation ( cyb]security ?reats ,cyb]  
?reat indicators & def5sive measures    
provid$ to ! ,f$]al ,gov]nm5t "u ?is    
title may1 consi/5t ) ,f$]al or ,/ate   
regulatory au?ority specifically relat+ 
to ! prev5tion or mitigation (          
cyb]security ?reats to in=mation sy/ems1
 in=m ! developm5t or implem5tation (   
regulations relat+ to su* in=mation     
sy/ems4  7,,ii7 ,proc$ures develop$ &   
implem5t$ "u ?is title ,clause 7i7 %all 
n apply to proc$ures develop$ &         

implem5t$ "u ?is title4  #ajf4          
,protection f liability  7a7 ,monitor+ (
 in=mation sy/ems ,no cause ( action    
%all lie or be ma9ta9$ 9 any c\rt aga9/ 
any private entity1 & su* action %all be
 promptly dismiss$1 = ! monitor+ (      
in=mation sy/ems & in=mation "u section 
#ajd7;a7 t is conduct$ 9 accordance )   
?is title4  7b7 ,%>+ or receipt ( cyb]  
?reat indicators ,no cause ( action %all
 lie or be ma9ta9$ 9 any c\rt aga9/ any 
entity1 & su* action %all be promptly   
dismiss$1 = ! %>+ or receipt ( cyb]     
?reat indicators or def5sive measures "u
 section #ajd7;c7 if--  7#a7 su* %>+ or 
receipt is conduct$ 9 accordance ) ?is  
title2 &  7#b7 9 a case 9 :i* a cyb]    
?reat indicator or def5sive measure is  
%>$ ) ! ,f$]al ,gov]nm5t1 ! cyb] ?reat  
indicator or def5sive measure is %>$ 9 a
 mann] t is consi/5t ) section          
#aje7;c77#a77;,b7 & ! %>+ or receipt1 z 
! case may be1 occurs aft] ! e>li] (--  
7,a7 ! date on :i* ! int]im policies &  
proc$ures are submitt$ to ,congress "u  

section #aje7;a77#a7 & guidel9es are    
submitt$ to ,congress "u section        
#aje7;b77#a72 or  7,b7 ! date t is #fj  
days aft] ! date ( ! enactm5t ( ?is     
,act4  7c7 ,con/ruction ,no?+ 9 ?is     
section %all be con/ru$--  7#a7 to      
require dismissal ( a cause ( action    
aga9/ an entity t has engag$ 9 gross    
neglig5ce or willful misconduct 9 !     
c\rse ( conduct+ activities au?oriz$ by 
?is title2 or  7#b7 to und]m9e or limit 
! availability ( o!rwise applicable     
common law or /atutory def5ses4  #ajg4  
,ov]sight ( ,gov]nm5t activities  7a7   
,bi5nial report on implem5tation  7#a7  
,9 g5]al ,n lat] ?an #a ye> aft] ! date 
( ! enactm5t ( ?is ,act1 & n less       
frequ5tly ?an once e #b ye>s !reaft]1 ! 
heads ( ! appropriate ,f$]al entities   
%all jo9tly submit & ! ,inspector ,g5]al
 ( ! ,dep>tm5t ( ,homel& ,security1 !   
,inspector ,g5]al ( ! ,intellig5ce      
,community1 ! ,inspector ,g5]al ( !     
,dep>tm5t ( ,ju/ice1 ! ,inspector ,g5]al
 ( ! ,dep>tm5t ( ,def5se1 & ! ,inspector

 ,g5]al ( ! ,dep>tm5t ( ,en]gy1 9       
consultation ) ! ,c\ncil ( ,inspectors  
,g5]al on ,f9ancial ,ov]sight1 %all     
jo9tly submit to ,congress a detail$    
report conc]n+ ! implem5tation ( ?is    
title dur+--  7,a7 9 ! case ( ! fir/    
report submitt$ "u ?is p>agraph1 ! mo/  
rec5t #a-ye> p]iod2 &  7,b7 9 ! case (  
any subsequ5t report submitt$ "u ?is    
p>agraph1 ! mo/ rec5t #b-ye> p]iod4     
7#b7 ,cont5ts ,ea* report submitt$ "u   
p>agraph 7#a7 %all include1 = ! p]iod   
cov]$ by ! report1 ! foll[+3  7,a7 ,an  
assessm5t ( ! suffici5cy ( ! policies1  
proc$ures1 & guidel9es requir$ by       
section #aje 9 ensur+ t cyb] ?reat      
indicators are %>$ effectively &        
responsibly )9 ! ,f$]al ,gov]nm5t4  7,b7
 ,an evaluation ( ! effectiv5ess (      
real-"t in=mation %>+ ?r\gh ! capability
 & process develop$ "u section #aje7;c71
 includ+ any imp$im5ts to su* real-"t   
%>+4  7,c7 ,an assessm5t ( ! suffici5cy 
( ! proc$ures develop$ "u section #ajc 9
 ensur+ t cyb] ?reat indicators 9 !     

possession ( ! ,f$]al ,gov]nm5t are %>$ 
9 a timely & adequate mann] )           
appropriate entities1 or1 if            
appropriate1 are made publicly          
available4  7,d7 ,an assessm5t ( :e!r   
cyb] ?reat indicators h be5 prop]ly     
classifi$ & an acc\nt+ ( ! numb] (      
security cle>ances au?oriz$ by ! ,f$]al 
,gov]nm5t = ! purposes ( ?is title4     
7,e7 ,a review ( ! type ( cyb] ?reat    
indicators %>$ ) ! appropriate ,f$]al   
entities "u ?is title1 includ+ ! foll[+3
  7i7 ,! numb] ( cyb] ?reat indicators  
receiv$ ?r\gh ! capability & process    
develop$ "u section #aje7;c74  7ii7 ,!  
numb] ( times t in=mation %>$ "u ?is    
title 0 us$ by a ,f$]al entity to       
prosecute an (f5se consi/5t ) section   
#aje7;d77#e77;,a74  7iii7 ,! degree to  
:i* su* in=mation may affect ! privacy &
 civil lib]ties ( specific p]sons4  7iv7
 ,a quantitative & qualitative assessm5t
 ( ! effect ( ! %>+ ( su* cyb] ?reat    
indicators ) ! ,f$]al ,gov]nm5t on      
privacy & civil lib]ties ( specific     

p]sons1 includ+ ! numb] ( notices t 7   
issu$ ) respect to a failure to remove  
p]sonal in=mation or in=mation t        
id5tifi$ a specific p]son n directly    
relat$ to a cyb]security ?reat 9        
accordance ) ! proc$ures requir$ by     
section #aje7;b77#c77;,d74  7v7 ,!      
adequacy ( any /eps tak5 by ! ,f$]al    
,gov]nm5t to r$uce su* effect4  7,f7 ,a 
review ( actions tak5 by ! ,f$]al       
,gov]nm5t bas$ on cyb] ?reat indicators 
%>$ ) ! ,f$]al ,gov]nm5t "u ?is title1  
includ+ ! appropriat5ess ( any subsequ5t
 use or dissem9ation ( su* cyb] ?reat   
indicators by a ,f$]al entity "u section
 #aje4  7,g7 ,a description ( any       
significant violations ( ! requirem5ts (
 ?is title by ! ,f$]al ,gov]nm5t4  7,h7 
,a summ>y ( ! numb] & type ( entities t 
receiv$ classifi$ cyb] ?reat indicators 
f ! ,f$]al ,gov]nm5t "u ?is title & an  
evaluation ( ! risks & b5efits ( %>+ su*
 cyb] ?reat indicators4  7#c7           
,recomm5dations ,ea* report submitt$ "u 
p>agraph 7#a7 may include recomm5dations

 = improvem5ts or modifications to !    
au?orities & processes "u ?is title4    
7#d7 ,=m ( report ,ea* report requir$ by
 p>agraph 7#a7 %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  7b7 ,reports on       
privacy & civil lib]ties  7#a7 ,bi5nial 
report f ,privacy & ,civil ,lib]ties    
,ov]sight ,bo>d ,n lat] ?an #b ye>s aft]
 ! date ( ! enactm5t ( ?is ,act & n less
 frequ5tly ?an once e #b ye>s !reaft]1 !
 ,privacy & ,civil ,lib]ties ,ov]sight  
,bo>d %all submit to ,congress & !      
,presid5t a report provid+--  7,a7 an   
assessm5t ( ! effect on privacy & civil 
lib]ties by ! type ( activities c>ri$   
out "u ?is title2 &  7,b7 an assessm5t (
 ! suffici5cy ( ! policies1 proc$ures1 &
 guidel9es e/abli%$ pursuant to section 
#aje 9 address+ conc]ns relat+ to       
privacy & civil lib]ties4  7#b7 ,bi5nial
 report ( ,inspectors g5]al  7,a7 ,9    
g5]al ,n lat] ?an #b ye>s aft] ! date ( 
! enactm5t ( ?is ,act & n less frequ5tly
 ?an once e #b ye>s !reaft]1 !          

,inspector ,g5]al ( ! ,dep>tm5t (       
,homel& ,security1 ! ,inspector ,g5]al (
 ! ,intellig5ce ,community1 ! ,inspector
 ,g5]al ( ! ,dep>tm5t ( ,ju/ice1 !      
,inspector ,g5]al ( ! ,dep>tm5t (       
,def5se1 & ! ,inspector ,g5]al ( !      
,dep>tm5t ( ,en]gy %all1 9 consultation 
) ! ,c\ncil ( ,inspectors ,g5]al on     
,f9ancial ,ov]sight1 jo9tly submit to   
,congress a report on ! receipt1 use1 & 
dissem9ation ( cyb] ?reat indicators &  
def5sive measures t h be5 %>$ ) ,f$]al  
entities "u ?is title4  7,b7 ,cont5ts   
,ea* report submitt$ "u subp>agraph 7,a7
 %all include ! foll[+3 7i7 ,a review ( 
! types ( cyb] ?reat indicators %>$ )   
,f$]al entities4  7ii7 ,a review ( !    
actions tak5 by ,f$]al entities z a     
result ( ! receipt ( su* cyb] ?reat     
indicators4  7iii7 ,a li/ ( ,f$]al      
entities receiv+ su* cyb] ?reat         
indicators4  7iv7 ,a review ( ! %>+ (   
su* cyb] ?reat indicators among ,f$]al  
entities to id5tify inappropriate b>ri]s
 to %>+ in=mation4  7#c7 ,recomm5dations

 ,ea* report submitt$ "u ?is subsection 
may include su* recomm5dations z !      
,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d1 ) respect to a report submitt$ "u
 p>agraph 7#a71 or ! ,inspectors ,g5]al 
ref]r$ to 9 p>agraph 7#b77;,a71 )       
respect to a report submitt$ "u p>agraph
 7#b71 may h = improvem5ts or           
modifications to ! au?orities "u ?is    
title4  7#d7 ,=m ,ea* report requir$ "u 
?is subsection %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  #ajh4 ,con/ruction &  
preemption  7a7 ,o!rwise lawful         
disclosures ,no?+ 9 ?is title %all be   
con/ru$-- 7#a7 to limit or prohibit     
o!rwise lawful disclosures (            
communications1 records1 or o!r         
in=mation1 includ+ report+ ( kn[n or    
suspect$ crim9al activity1 by an entity 
to any o!r entity or ! ,f$]al ,gov]nm5t 
"u ?is title2 or  7#b7 to limit or      
prohibit o!rwise lawful use ( su*       
disclosures by any ,f$]al entity1 ev5 :5
 su* o!rwise lawful disclosures         

duplicate or replicate disclosures made 
"u ?is title4  7b7 ,:i/le bl[]          
protections ,no?+ 9 ?is title %all be   
con/ru$ to prohibit or limit !          
disclosure ( in=mation protect$ "u      
section #bcjb7;b77#h7 ( title #e1 ,unit$
 ,/ates ,code 7gov]n+ disclosures (     
illegality1 wa/e1 fraud1 abuse1 or      
public heal? or safety ?reats71 section 
#gbaa ( title #e1 ,unit$ ,/ates ,code   
7gov]n+ disclosures to ,congress71      
section #ajcd ( title #aj1 ,unit$ ,/ates
 ,code 7gov]n+ disclosure to ,congress  
by memb]s ( ! milit>y71 section #aajd ( 
! ,national ,security ,act ( #aidg 7#ej 
,u4,s4,c4 #cbcd7 7gov]n+ disclosure by  
employees ( elem5ts ( ! intellig5ce     
community71 or any simil> provision (   
,f$]al or ,/ate law4  7c7 ,protection ( 
s\rces & me?ods ,no?+ 9 ?is title %all  
be con/ru$-- 7#a7 z creat+ any immunity 
aga9/1 or o!rwise affect+1 any action   
br\ght by ! ,f$]al ,gov]nm5t1 or any    
ag5cy or dep>tm5t !re(1 to en=ce any    
law1 executive ord]1 or proc$ure gov]n+ 

! appropriate h&l+1 disclosure1 or use (
 classifi$ in=mation2  7#b7 to affect ! 
conduct ( au?oriz$ law en=cem5t or      
intellig5ce activities2 or  7#c7 to     
modify ! au?ority ( a dep>tm5t or ag5cy 
( ! ,f$]al ,gov]nm5t to protect         
classifi$ in=mation & s\rces & me?ods & 
! national security ( ! ,unit$ ,/ates4  
7d7 ,relation%ip to o!r laws ,no?+ 9 ?is
 title %all be con/ru$ to affect any    
requirem5t "u any o!r provision ( law = 
an entity to provide in=mation to !     
,f$]al ,gov]nm5t4  7e7 ,prohibit$       
conduct ,no?+ 9 ?is title %all be       
con/ru$ to p]mit price-fix+1 allocat+ a 
m>ket betwe5 competitors1 monopoliz+ or 
attempt+ to monopolize a m>ket1         
boycott+1 or ex*anges ( price or co/    
in=mation1 cu/om] li/s1 or in=mation    
reg>d+ future competitive plann+4  7f7  
,in=mation %>+ relation%ips ,no?+ 9 ?is 
title %all be con/ru$-- 7#a7 to limit or
 modify an exi/+ in=mation %>+          
relation%ip2  7#b7 to prohibit a new    
in=mation %>+ relation%ip2  7#c7 to     

require a new in=mation %>+ relation%ip 
betwe5 any entity & ano!r entity or a   
,f$]al entity2 or  7#d7 to require ! use
 ( ! capability & process )9 ! ,dep>tm5t
 ( ,homel& ,security develop$ "u section
 #aje7;c74  7g7 ,pres]vation (          
contractual obligations & rights ,no?+ 9
 ?is title %all be con/ru$-- 7#a7 to    
am5d1 repeal1 or sup]s$e any curr5t or  
future contractual agreem5t1 t]ms (     
s]vice agreem5t1 or o!r contractual     
relation%ip betwe5 any entities1 or     
betwe5 any entity & a ,f$]al entity2 or 
7#b7 to abrogate trade secret or        
intellectual prop]ty rights ( any entity
 or ,f$]al entity4  7h7 ,anti-task+     
re/riction ,no?+ 9 ?is title %all be    
con/ru$ to p]mit a ,f$]al entity--  7#a7
 to require an entity to provide        
in=mation to a ,f$]al entity or ano!r   
entity2  7#b7 to condition ! %>+ ( cyb] 
?reat indicators ) an entity on su*     
entity's provision ( cyb] ?reat         
indicators to a ,f$]al entity or ano!r  
entity2 or  7#c7 to condition ! aw>d (  

any ,f$]al grant1 contract1 or pur*ase  
on ! provision ( a cyb] ?reat indicator 
to a ,f$]al entity or ano!r entity4  7i7
 ,no liability = non-p>ticipation ,no?+ 
9 ?is title %all be con/ru$ to subject  
any entity to liability = *oos+ n to    
engage 9 ! volunt>y activities au?oriz$ 
9 ?is title4  7j7 ,use & ret5tion (     
in=mation ,no?+ 9 ?is title %all be     
con/ru$ to au?orize1 or to modify any   
exi/+ au?ority (1 a dep>tm5t or ag5cy ( 
! ,f$]al ,gov]nm5t to reta9 or use any  
in=mation %>$ "u ?is title = any use o!r
 ?an p]mitt$ 9 ?is title4  7k7 ,f$]al   
preemption  7#a7 ,9 g5]al ,?is title    
sup]s$es any /atute or o!r provision (  
law ( a ,/ate or political subdivision (
 a ,/ate t re/ricts or o!rwise expressly
 regulates an activity au?oriz$ "u ?is  
title4  7#b7 ,/ate law en=cem5t ,no?+ 9 
?is title %all be con/ru$ to sup]s$e any
 /atute or o!r provision ( law ( a ,/ate
 or political subdivision ( a ,/ate     
conc]n+ ! use ( au?oriz$ law en=cem5t   
practices & proc$ures4  7l7 ,regulatory 

au?ority ,no?+ 9 ?is title %all be      
con/ru$-- 7#a7 to au?orize !            
promulgation ( any regulations n        
specifically au?oriz$ by ?is title2     
7#b7 to e/abli% or limit any regulatory 
au?ority n specifically e/abli%$ or     
limit$ "u ?is title2 or  7#c7 to        
au?orize regulatory actions t w\ld      
duplicate or conflict ) regulatory      
requirem5ts1 m&atory /&>ds1 or relat$   
processes "u ano!r provision ( ,f$]al   
law4  7m7 ,au?ority ( ,secret>y (       
,def5se ,to respond to cyb] attacks     
,no?+ 9 ?is title %all be con/ru$ to    
limit ! au?ority ( ! ,secret>y ( ,def5se
 to develop1 prep>e1 coord9ate1 or1 :5  
au?oriz$ by ! ,presid5t to d s1 conduct 
a milit>y cyb] op]ation 9 response to a 
malici\s cyb] activity c>ri$ out aga9/ !
 ,unit$ ,/ates or a ,unit$ ,/ates p]son 
by a =eign gov]nm5t or an organization  
sponsor$ by a =eign gov]nm5t or a       
t]rori/ organization4  #aji4 ,report on 
cyb]security ?reats  7a7 ,report requir$
 ,n lat] ?an #ahj days aft] ! date ( !  

enactm5t ( ?is ,act1 ! ,director (      
,national ,intellig5ce1 9 coord9ation ) 
! heads ( o!r appropriate elem5ts ( !   
intellig5ce community1 %all submit to ! 
,select ,committee on ,intellig5ce ( !  
,s5ate & ! ,p]man5t ,select ,committee  
on ,intellig5ce ( ! ,h\se (             
,repres5tatives a report on cyb]security
 ?reats1 includ+ cyb] attacks1 !ft1 &   
data brea*es4  7b7 ,cont5ts ,! report   
requir$ by subsection 7a7 %all include !
 foll[+3 7#a7 ,an assessm5t ( ! curr5t  
intellig5ce %>+ & coop]ation            
relation%ips ( ! ,unit$ ,/ates ) o!r    
c\ntries reg>d+ cyb]security ?reats1    
includ+ cyb] attacks1 !ft1 & data       
brea*es1 direct$ aga9/ ! ,unit$ ,/ates &
 :i* ?reat5 ! ,unit$ ,/ates national    
security int]e/s & economy &            
intellectual prop]ty1 specifically      
id5tify+ ! relative utility ( su*       
relation%ips1 :i* elem5ts ( !           
intellig5ce community p>ticipate 9 su*  
relation%ips1 & :e!r & h[ su*           
relation%ips c\ld be improv$4  7#b7 ,a  

li/ & an assessm5t ( ! c\ntries &       
non/ate actors t are ! prim>y ?reats (  
c>ry+ out a cyb]security ?reat1 includ+ 
a cyb] attack1 !ft1 or data brea*1 aga9/
 ! ,unit$ ,/ates & :i* ?reat5 ! ,unit$  
,/ates national security1 economy1 &    
intellectual prop]ty4  7#c7 ,a          
description ( ! ext5t to :i* !          
capabilities ( ! ,unit$ ,/ates ,gov]nm5t
 to respond to or prev5t cyb]security   
?reats1 includ+ cyb] attacks1 !ft1 or   
data brea*es1 direct$ aga9/ ! ,unit$    
,/ates private sector are degrad$ by a  
delay 9 ! prompt notification by private
 entities ( su* ?reats or cyb] attacks1 
!ft1 & brea*es4  7#d7 ,an assessm5t (   
additional te*nologies or capabilities t
 w\ld enhance ! ability ( ! ,unit$      
,/ates to prev5t & to respond to        
cyb]security ?reats1 includ+ cyb]       
attacks1 !ft1 & data brea*es4  7#e7 ,an 
assessm5t ( any te*nologies or practices
 utiliz$ by ! private sector t c\ld be  
rapidly field$ to assi/ ! intellig5ce   
community 9 prev5t+ & respond+ to       

cyb]security ?reats4  7c7 ,additional   
report ,at ! "t ! report requir$ by     
subsection 7a7 is submitt$1 ! ,director 
( ,national ,intellig5ce %all submit to 
! ,committee on ,=eign ,relations ( !   
,s5ate & ! ,committee on ,=eign ,affairs
 ( ! ,h\se ( ,repres5tatives a report   
conta9+ ! in=mation requir$ by          
subsection 7b77#b74  7d7 ,=m ( report ,!
 report requir$ by subsection 7a7 %all  
be made available 9 classifi$ &         
unclassifi$ =ms4  7e7 ,intellig5ce      
community def9$ ,9 ?is section1 ! t]m   
intellig5ce community has ! mean+ giv5 t
 t]m 9 section #c ( ! ,national         
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc74  #aaj4 ,con=m+ am5dm5t ,section 
#ida7;c77#c7 ( ! ,national ,def5se      
,au?orization ,act = ,fiscal ,ye> #bjac 
7,public ,law #aab-bci2 #aj ,u4,s4,c4   
#bbbd note7 is am5d$ by ins]t+ at ! end 
! foll[+3 ,! ,secret>y may %>e su*      
in=mation ) o!r ,f$]al entities if su*  
in=mation consi/s ( cyb] ?reat          
indicators & def5sive measures & su*    

in=mation is %>$ consi/5t ) ! policies &
 proc$ures promulgat$ by ! ,attorney    
,g5]al & ! ,secret>y ( ,homel& ,security
 "u section #aje ( ! ,cyb]security      
,in=mation ,%>+ ,act ( #bjae44  ,,ii    
,f$]al ,cyb]security ,enhancem5t  #bja4 
,%ort title ,?is title may be cit$ z !  
,f$]al ,cyb]security ,enhancem5t ,act ( 
#bjae4  #bjb4 ,def9itions ,9 ?is title--
 7#a7 ! t]m ag5cy has ! mean+ giv5 ! t]m
 9 section #cejb ( title #dd1 ,unit$    
,/ates ,code2  7#b7 ! t]m ag5cy         
in=mation sy/em has ! mean+ giv5 ! t]m 9
 section #bbh ( ! ,homel& ,security ,act
 ( #bjjb1 z add$ by section #bjc7;a72   
7#c7 ! t]m appropriate congressional    
committees means-- 7,a7 ! ,committee on 
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate2 &  7,b7 ! ,committee on    
,homel& ,security ( ! ,h\se (           
,repres5tatives2  7#d7 ! t]ms           
cyb]security risk & in=mation sy/em h ! 
mean+s giv5 ^? t]ms 9 section #bbg ( !  
,homel& ,security ,act ( #bjjb1 z s     
r$esignat$ by section #bjc7;a72  7#e7 ! 

t]m ,director means ! ,director ( !     
,(fice ( ,managem5t & ,budget2  7#f7 !  
t]m intellig5ce community has ! mean+   
giv5 ! t]m 9 section #c7d7 ( ! ,national
 ,security ,act ( #aidg 7#ej ,u4,s4,c4  
#cjjc7d772  7#g7 ! t]m national security
 sy/em has ! mean+ giv5 ! t]m 9 section 
#aaajc ( title #dj1 ,unit$ ,/ates ,code2
 &  7#h7 ! t]m ,secret>y means !        
,secret>y ( ,homel& ,security4  #bjc4   
,improv$ ,f$]al network security  7a7 ,9
 g5]al ,subtitle ,c ( title ,,ii ( !    
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #ada et seq47 is am5d$-- 7#a7 
by r$esignat+ section #bbh z section    
#bbi2  7#b7 by r$esignat+ section #bbg z
 subsection 7c7 ( section #bbh1 z add$  
by p>agraph 7#d71 & adju/+ ! m>g9s      
accord+ly2  7#c7 by r$esignat+ ! second 
section designat$ z section #bbf 7relat+
 to ! national cyb]security &           
communications integration c5t]7 z      
section #bbg2  7#d7 by ins]t+ aft]      
section #bbg1 z s r$esignat$1 ! foll[+3 
#bbh4 ,cyb]security plans  7a7          

,def9itions ,9 ?is section--  7#a7 ! t]m
 ag5cy in=mation sy/em means an         
in=mation sy/em us$ or op]at$ by an     
ag5cy or by ano!r entity on behalf ( an 
ag5cy2  7#b7 ! t]ms cyb]security risk & 
in=mation sy/em h ! mean+s giv5 ^? t]ms 
9 section #bbg2  7#c7 ! t]m intellig5ce 
community has ! mean+ giv5 ! t]m 9      
section #c7d7 ( ! ,national ,security   
,act ( #aidg 7#ej ,u4,s4,c4 #cjjc7d772 &
  7#d7 ! t]m national security sy/em has
 ! mean+ giv5 ! t]m 9 section #aaajc (  
title #dj1 ,unit$ ,/ates ,code4  7b7    
,intrusion assessm5t plan  7#a7         
,requirem5t ,! ,secret>y1 9 coord9ation 
) ! ,director ( ! ,(fice ( ,managem5t & 
,budget1 %all develop & implem5t an     
intrusion assessm5t plan to id5tify &   
remove intrud]s 9 ag5cy in=mation       
sy/ems4  7#b7 ,exception ,! intrusion   
assessm5t plan requir$ "u p>agraph 7#a7 
%all n apply to ! ,dep>tm5t ( ,def5se1 a
 national security sy/em1 or an elem5t (
 ! intellig5ce community4  2  7#e7 9    
section #bbh7;c71 z s r$esignat$1 by    

/rik+ section #bbf & ins]t+ section     
#bbg2 &  7#f7 by ins]t+ aft] section    
#bbi1 z s r$esignat$1 ! foll[+3  #bcj4  
,f$]al intrusion detection & prev5tion  
sy/em  7a7 ,def9itions ,9 ?is section-- 
7#a7 ! t]m ag5cy has ! mean+ giv5 t t]m 
9 section #cejb ( title #dd1 ,unit$     
,/ates ,code2  7#b7 ! t]m ag5cy         
in=mation means in=mation collect$ or   
ma9ta9$ by or on behalf ( an ag5cy2     
7#c7 ! t]m ag5cy in=mation sy/em has !  
mean+ giv5 ! t]m 9 section #bbh2 &  7#d7
 ! t]ms cyb]security risk & in=mation   
sy/em h ! mean+s giv5 ^? t]ms 9 section 
#bbg4  7b7 ,requirem5t  7#a7 ,9 g5]al ,n
 lat] ?an #a ye> aft] ! date ( enactm5t 
( ?is section1 ! ,secret>y %all deploy1 
op]ate1 & ma9ta91 to make available =   
use by any ag5cy1 ) or )\t              
reimbursem5t--  7,a7 a capability to    
detect cyb]security risks 9 network     
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em2 &  7,b7 a        
capability to prev5t network traffic    
associat$ ) su* cyb]security risks f    

transit+ or travel+ to or f an ag5cy    
in=mation sy/em or modify su* network   
traffic to remove ! cyb]security risk4  
7#b7 ,regul> improvem5t ,! ,secret>y    
%all regul>ly deploy new te*nologies &  
modify exi/+ te*nologies to ! intrusion 
detection & prev5tion capabilities      
describ$ 9 p>agraph 7#a7 z appropriate  
to improve ! intrusion detection &      
prev5tion capabilities4  7c7 ,activities
 ,9 c>ry+ out subsection 7b71 !         
,secret>y-- 7#a7 may access1 & ! head ( 
an ag5cy may disclose to ! ,secret>y or 
a private entity provid+ assi/ance to ! 
,secret>y "u p>agraph 7#b71 in=mation   
transit+ or travel+ to or f an ag5cy    
in=mation sy/em1 reg>dless ( ! location 
f :i* ! ,secret>y or a private entity   
provid+ assi/ance to ! ,secret>y "u     
p>agraph 7#b7 accesses su* in=mation1   
not)/&+ any o!r provision ( law t w\ld  
o!rwise re/rict or prev5t ! head ( an   
ag5cy f disclos+ su* in=mation to !     
,secret>y or a private entity provid+   
assi/ance to ! ,secret>y "u p>agraph    

7#b72  7#b7 may ent] into contracts or  
o!r agreem5ts )1 or o!rwise reque/ &    
obta9 ! assi/ance (1 private entities to
 deploy & op]ate te*nologies 9          
accordance ) subsection 7b72  7#c7 may  
reta91 use1 & disclose in=mation obta9$ 
?r\gh ! conduct ( activities au?oriz$ "u
 ?is section only to protect in=mation &
 in=mation sy/ems f cyb]security risks2 
7#d7 %all regul>ly assess ?r\gh         
op]ational te/ & evaluation 9 real _w or
 simulat$ environm5ts available advanc$ 
protective te*nologies to improve       
detection & prev5tion capabilities1     
includ+ comm]cial & non-comm]cial       
te*nologies & detection te*nologies     
beyond signature-bas$ detection1 &      
utilize su* te*nologies :5 appropriate2 
7#e7 %all e/abli% a pilot to acquire1   
te/1 & deploy1 z rapidly z possible1    
te*nologies describ$ 9 p>agraph 7#d72   
7#f7 %all p]iodically update ! privacy  
impact assessm5t requir$ "u section     
#bjh7;b7 ( ! ,e-,gov]nm5t ,act ( #bjjb  
7#dd ,u4,s4,c4 #ceja note72 &  7#g7 %all

 ensure t-- 7,a7 activities c>ri$ out "u
 ?is section are reasonably necess>y = !
 purpose ( protect+ ag5cy in=mation &   
ag5cy in=mation sy/ems f a cyb]security 
risk2  7,b7 in=mation access$ by !      
,secret>y w be reta9$ no long] ?an      
reasonably necess>y = ! purpose (       
protect+ ag5cy in=mation & ag5cy        
in=mation sy/ems f a cyb]security risk2 
7,c7 notice has be5 provid$ to us]s ( an
 ag5cy in=mation sy/em conc]n+ access to
 communications ( us]s ( ! ag5cy        
in=mation sy/em = ! purpose ( protect+  
ag5cy in=mation & ! ag5cy in=mation     
sy/em2 &  7,d7 ! activities are         
implem5t$ pursuant to policies &        
proc$ures gov]n+ ! op]ation ( !         
intrusion detection & prev5tion         
capabilities4  7d7 ,private entities    
7#a7 ,conditions ,a private entity      
describ$ 9 subsection 7c77#b7 may n--   
7,a7 disclose any network traffic       
transit+ or travel+ to or f an ag5cy    
in=mation sy/em to any entity )\t !     
cons5t ( ! ,dep>tm5t or ! ag5cy t       

disclos$ ! in=mation "u subsection      
7c77#a72 or  7,b7 use any network       
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em to :i* ! private  
entity ga9s access 9 accordance ) ?is   
section = any purpose o!r ?an to protect
 ag5cy in=mation & ag5cy in=mation      
sy/ems aga9/ cyb]security risks or to   
adm9i/] a contract or o!r agreem5t ent]$
 into pursuant to subsection 7c77#b7 or 
z "p ( ano!r contract ) ! ,secret>y4    
7#b7 ,limitation on liability ,no cause 
( action %all lie 9 any c\rt aga9/ a    
private entity = assi/ance provid$ to ! 
,secret>y 9 accordance ) ?is section &  
any contract or agreem5t ent]$ into     
pursuant to subsection 7c77#b74  7#c7   
,rule ( con/ruction ,no?+ 9 p>agraph    
7#b7 %all be con/ru$ to au?orize an     
,int]net s]vice provid] to break a us]  
agreem5t ) a cu/om] )\t ! cons5t ( !    
cu/om]4  7e7 ,attorney ,g5]al review ,n 
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is section1 ! ,attorney ,g5]al %all   
review ! policies & guidel9es = !       

program c>ri$ out "u ?is section to     
ensure t ! policies & guidel9es are     
consi/5t ) applicable law gov]n+ !      
acquisition1 int]ception1 ret5tion1 use1
 & disclosure ( communications4  4  7b7 
,prioritiz+ advanc$ security tools ,!   
,director & ! ,secret>y1 9 consultation 
) appropriate ag5cies1 %all--  7#a7     
review & update gov]nm5twide policies & 
programs to ensure appropriate          
prioritization & use ( network security 
monitor+ tools )9 ag5cy networks2 &     
7#b7 brief appropriate congressional    
committees on su* prioritization & use4 
7c7 ,ag5cy responsibilities  7#a7 ,9    
g5]al ,except z provid$ 9 p>agraph      
7#b7--  7,a7 n lat] ?an #a ye> aft] !   
date ( enactm5t ( ?is ,act or #b mon?s  
aft] ! date on :i* ! ,secret>y makes    
available ! intrusion detection &       
prev5tion capabilities "u section       
#bcj7;b77#a7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by subsection 7a71      
:i*ev] is lat]1 ! head ( ea* ag5cy %all 
apply & cont9ue to utilize !            

capabilities to all in=mation travel+   
betwe5 an ag5cy in=mation sy/em & any   
in=mation sy/em o!r ?an an ag5cy        
in=mation sy/em2 &  7,b7 n lat] ?an #f  
mon?s aft] ! date on :i* ! ,secret>y    
makes available improvem5ts to !        
intrusion detection & prev5tion         
capabilities pursuant to section        
#bcj7;b77#b7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by subsection 7a71 !    
head ( ea* ag5cy %all apply & cont9ue to
 utilize ! improv$ intrusion detection &
 prev5tion capabilities4  7#b7          
,exception ,! requirem5ts "u p>agraph   
7#a7 %all n apply to ! ,dep>tm5t (      
,def5se1 a national security sy/em1 or  
an elem5t ( ! intellig5ce community4    
7#c7 ,def9ition ,9 ?is subsection only1 
! t]m ag5cy in=mation sy/em means an    
in=mation sy/em own$ or op]at$ by an    
ag5cy4  7#d7 ,rule ( con/ruction ,no?+ 9
 ?is subsection %all be con/ru$ to limit
 an ag5cy f apply+ ! intrusion detection
 & prev5tion capabilities "u section    
#bcj7;b77#a7 ( ! ,homel& ,security ,act 

( #bjjb1 z add$ by subsection 7a71 at ! 
discretion ( ! head ( ! ag5cy or z      
provid$ 9 relevant policies1 directives1
 & guidel9es4  7d7 ,table ( cont5ts     
am5dm5t ,! table ( cont5ts 9 section    
#a7;b7 ( ! ,homel& ,security ,act (     
#bjjb 7#f ,u4,s4,c4 #aja note7 is am5d$ 
by /rik+ ! items relat+ to ! fir/       
section designat$ z section #bbf1 !     
second section designat$ z section #bbf 
7relat+ to ! national cyb]security &    
communications integration c5t]71       
section #bbg1 & section #bbh & ins]t+ ! 
foll[+3  ,sec4 #bbf4 ,cyb]security      
recruitm5t & ret5tion4,sec4 #bbg4       
,national cyb]security & communications 
integration c5t]4,sec4 #bbh4            
,cyb]security plans4,sec4 #bbi4         
,cle>ances4,sec4 #bcj4 ,f$]al intrusion 
detection & prev5tion sy/em4  4  #bjd4  
,advanc$ int]nal def5ses  7a7 ,advanc$  
network security tools  7#a7 ,9 g5]al ,!
 ,secret>y %all include 9 ! ,cont9u\s   
,diagno/ics & ,mitigation ,program      
advanc$ network security tools to       

improve visibility ( network activity1  
includ+ ?r\gh ! use ( comm]cial & free  
or op5 s\rce tools1 to detect & mitigate
 intrusions & anomal\s activity4  7#b7  
,developm5t ( plan ,! ,director %all    
develop & implem5t a plan to ensure t   
ea* ag5cy utilizes advanc$ network      
security tools1 includ+ ^? describ$ 9   
p>agraph 7#a71 to detect & mitigate     
intrusions & anomal\s activity4  7b7    
,improv$ metrics ,! ,secret>y1 9        
collaboration ) ! ,director1 %all review
 & update ! metrics us$ to measure      
security "u section #ceed ( title #dd1  
,unit$ ,/ates ,code1 to include measures
 ( intrusion & incid5t detection &      
response times4  7c7 ,transp>5cy &      
acc\ntability ,! ,director1 9           
consultation ) ! ,secret>y1 %all        
increase transp>5cy to ! public on ag5cy
 cyb]security po/ure1 includ+ by        
increas+ ! numb] ( metrics available on 
,f$]al ,gov]nm5t p]=mance websites &1 to
 ! greate/ ext5t practicable1 display+  
metrics = dep>tm5t compon5ts1 small     

ag5cies1 & micro ag5cies4  7d7          
,ma9t5ance ( te*nologies ,section       
#ceec7;b77#f77;,b7 ( title #dd1 ,unit$  
,/ates ,code1 is am5d$ by ins]t+ 1      
op]at+1 & ma9ta9+ aft] deploy+4  7e7    
,exception ,! requirem5ts "u ?is section
 %all n apply to ! ,dep>tm5t ( ,def5se1 
a national security sy/em1 or an elem5t 
( ! intellig5ce community4  #bje4 ,f$]al
 cyb]security requirem5ts  7a7          
,implem5tation ( f$]al cyb]security     
/&>ds ,consi/5t ) section #ceec ( title 
#dd1 ,unit$ ,/ates ,code1 ! ,secret>y1 9
 consultation ) ! ,director1 %all       
ex]cise ! au?ority to issue b9d+        
op]ational directives to assi/ !        
,director 9 ensur+ timely ag5cy adoption
 ( & compliance ) policies & /&>ds      
promulgat$ "u section #aacca ( title    
#dj1 ,unit$ ,/ates ,code1 = secur+ ag5cy
 in=mation sy/ems4  7b7 ,cyb]security   
requirem5ts at ag5cies  7#a7 ,9 g5]al   
,consi/5t ) policies1 /&>ds1 guidel9es1 
& directives on in=mation security "u   
sub*apt] ,,ii ( *apt] #ce ( title #dd1  

,unit$ ,/ates ,code1 & ! /&>ds &        
guidel9es promulgat$ "u section #aacca (
 title #dj1 ,unit$ ,/ates ,code1 &      
except z provid$ 9 p>agraph 7#b71 n lat]
 ?an #a ye> aft] ! date ( ! enactm5t (  
?is ,act1 ! head ( ea* ag5cy %all--     
7,a7 id5tify s5sitive & mission critical
 data /or$ by ! ag5cy consi/5t ) !      
inv5tory requir$ "u ! fir/ subsection   
7c7 7relat+ to ! inv5tory ( major       
in=mation sy/ems7 & ! second subsection 
7c7 7relat+ to ! inv5tory ( in=mation   
sy/ems7 ( section #ceje ( title #dd1    
,unit$ ,/ates ,code2  7,b7 assess access
 controls to ! data describ$ 9          
subp>agraph 7,a71 ! ne$ = readily       
accessible /orage ( ! data1 &           
individuals' ne$ to access ! data2  7,c7
 encrypt or o!rwise r5d] indeciph]able  
to unau?oriz$ us]s ! data describ$ 9    
subp>agraph 7,a7 t is /or$ on or        
transit+ ag5cy in=mation sy/ems2  7,d7  
implem5t a s+le sign-on tru/$ id5tity   
plat=m = individuals access+ ea* public 
website ( ! ag5cy t requires us]        

au!ntication1 z develop$ by !           
,adm9i/rator ( ,g5]al ,s]vices 9        
collaboration ) ! ,secret>y2 &  7,e7    
implem5t id5tity managem5t consi/5t )   
section #ejd ( ! ,cyb]security          
,enhancem5t ,act ( #bjad 7,public ,law  
#aac-bgd2 #ae ,u4,s4,c4 #gdfd71 includ+ 
multi-factor au!ntication1 =--  7i7     
remote access to an ag5cy in=mation     
sy/em2 &  7ii7 ea* us] acc\nt ) elevat$ 
privileges on an ag5cy in=mation sy/em4 
7#b7 ,exception ,! requirem5ts "u       
p>agraph 7#a7 %all n apply to an ag5cy  
in=mation sy/em = :i*-- 7,a7 ! head ( ! 
ag5cy has p]sonally c]tifi$ to !        
,director ) p>ticul>ity t--  7i7        
op]ational requirem5ts articulat$ 9 !   
c]tification & relat$ to ! ag5cy        
in=mation sy/em w\ld make x excessively 
burd5some to implem5t ! cyb]security    
requirem5t2  7ii7 ! cyb]security        
requirem5t is n necess>y to secure !    
ag5cy in=mation sy/em or ag5cy in=mation
 /or$ on or transit+ x2 &  7iii7 ! ag5cy
 has tak5 all necess>y /eps to secure ! 

ag5cy in=mation sy/em & ag5cy in=mation 
/or$ on or transit+ x2 &  7,b7 ! head ( 
! ag5cy or ! designee ( ! head ( ! ag5cy
 has submitt$ ! c]tification describ$ 9 
subp>agraph 7,a7 to ! appropriate       
congressional committees & ! ag5cy's    
au?oriz+ committees4  7#c7 ,con/ruction 
,no?+ 9 ?is section %all be con/ru$ to  
alt] ! au?ority ( ! ,secret>y1 !        
,director1 or ! ,director ( ! ,national 
,in/itute ( ,/&>ds & ,te*nology 9       
implem5t+ sub*apt] ,,ii ( *apt] #ce (   
title #dd1 ,unit$ ,/ates ,code4 ,no?+ 9 
?is section %all be con/ru$ to affect ! 
,national ,in/itute ( ,/&>ds &          
,te*nology /&>ds process or ! requirem5t
 "u section #ceec7;a77#d7 ( su* title or
 to disc\rage cont9u$ improvem5ts &     
advancem5ts 9 ! te*nology1 /&>ds1       
policies1 & guidel9es us$ to promote    
,f$]al in=mation security4  7c7         
,exception ,! requirem5ts "u ?is section
 %all n apply to ! ,dep>tm5t ( ,def5se1 
a national security sy/em1 or an elem5t 
( ! intellig5ce community4  #bjf4       

,assessm5t2 reports  7a7 ,def9itions ,9 
?is section-- 7#a7 ! t]m intrusion      
assessm5ts means actions tak5 "u !      
intrusion assessm5t plan to id5tify &   
remove intrud]s 9 ag5cy in=mation       
sy/ems2  7#b7 ! t]m intrusion assessm5t 
plan means ! plan requir$ "u section    
#bbh7;b77#a7 ( ! ,homel& ,security ,act 
( #bjjb1 z add$ by section #bjc7;a7 (   
?is ,act2 &  7#c7 ! t]m intrusion       
detection & prev5tion capabilities means
 ! capabilities requir$ "u section      
#bcj7;b7 ( ! ,homel& ,security ,act (   
#bjjb1 z add$ by section #bjc7;a7 ( ?is 
,act4  7b7 ,?ird p>ty assessm5t ,n lat] 
?an #c ye>s aft] ! date ( enactm5t ( ?is
 ,act1 ! ,gov]nm5t ,acc\ntability ,(fice
 %all conduct a /udy & publi% a report  
on ! effectiv5ess ( ! approa* & /rategy 
( ! ,f$]al ,gov]nm5t to secur+ ag5cy    
in=mation sy/ems1 includ+ ! intrusion   
detection & prev5tion capabilities & !  
intrusion assessm5t plan4  7c7 ,reports 
to ,congress  7#a7 ,intrusion detection 
& prev5tion capabilities  7,a7 ,secret>y

 ( ,homel& ,security report ,n lat] ?an 
#f mon?s aft] ! date ( enactm5t ( ?is   
,act1 & annually !reaft]1 ! ,secret>y   
%all submit to ! appropriate            
congressional committees a report on !  
/atus ( implem5tation ( ! intrusion     
detection & prev5tion capabilities1     
includ+--  7i7 a description ( privacy  
controls2  7ii7 a description ( !       
te*nologies & capabilities utiliz$ to   
detect cyb]security risks 9 network     
traffic1 includ+ ! ext5t to :i* ^?      
te*nologies & capabilities include exi/+
 comm]cial & non-comm]cial te*nologies2 
7iii7 a description ( ! te*nologies &   
capabilities utiliz$ to prev5t network  
traffic associat$ ) cyb]security risks f
 transit+ or travel+ to or f ag5cy      
in=mation sy/ems1 includ+ ! ext5t to :i*
 ^? te*nologies & capabilities include  
exi/+ comm]cial & non-comm]cial         
te*nologies2  7iv7 a li/ ( ! types (    
indicators or o!r id5tifi]s or te*niques
 us$ to detect cyb]security risks 9     
network traffic transit+ or travel+ to  

or f ag5cy in=mation sy/ems on ea*      
it]ation ( ! intrusion detection &      
prev5tion capabilities & ! numb] ( ea*  
su* type ( indicator1 id5tifi]1 &       
te*nique2  7v7 ! numb] ( in/ances 9 :i* 
! intrusion detection & prev5tion       
capabilities detect$ a cyb]security risk
 9 network traffic transit+ or travel+  
to or f ag5cy in=mation sy/ems & ! numb]
 ( times ! intrusion detection &        
prev5tion capabilities block$ network   
traffic associat$ ) cyb]security risk2 &
  7vi7 a description ( ! pilot e/abli%$ 
"u section #bcj7;c77#e7 ( ! ,homel&     
,security ,act ( #bjjb1 z add$ by       
section #bjc7;a7 ( ?is ,act1 includ+ !  
numb] ( new te*nologies te/$ & ! numb] (
 p>ticipat+ ag5cies4  7,b7 ,,omb report 
,n lat] ?an #ah mon?s aft] ! date (     
enactm5t ( ?is ,act1 & annually !reaft]1
 ! ,director %all submit to ,congress1 z
 "p ( ! report requir$ "u section       
#ceec7;c7 ( title #dd1 ,unit$ ,/ates    
,code1 an analysis ( ag5cy application (
 ! intrusion detection & prev5tion      

capabilities1 includ+--  7i7 a li/ ( ea*
 ag5cy & ! degree to :i* ea* ag5cy has  
appli$ ! intrusion detection & prev5tion
 capabilities to an ag5cy in=mation     
sy/em2 &  7ii7 a li/ by ag5cy (-- 7,i7 !
 numb] ( in/ances 9 :i* ! intrusion     
detection & prev5tion capabilities      
detect$ a cyb]security risk 9 network   
traffic transit+ or travel+ to or f an  
ag5cy in=mation sy/em & ! types (       
indicators1 id5tifi]s1 & te*niques us$  
to detect su* cyb]security risks2 &     
7,,ii7 ! numb] ( in/ances 9 :i* !       
intrusion detection & prev5tion         
capabilities prev5t$ network traffic    
associat$ ) a cyb]security risk f       
transit+ or travel+ to or f an ag5cy    
in=mation sy/em & ! types ( indicators1 
id5tifi]s1 & te*niques us$ to detect su*
 ag5cy in=mation sy/ems4  7#b7 ,,omb    
report on developm5t & implem5tation (  
intrusion assessm5t plan1 advanc$       
int]nal def5ses1 & ,f$]al cyb]security  
be/ practices ,! ,director %all-- 7,a7 n
 lat] ?an #f mon?s aft] ! date (        

enactm5t ( ?is ,act1 & #cj days aft] any
 update !reto1 submit ! intrusion       
assessm5t plan to ! appropriate         
congressional committees2  7,b7 n lat]  
?an #a ye> aft] ! date ( enactm5t ( ?is 
,act1 & annually !reaft]1 submit to     
,congress1 z "p ( ! report requir$ "u   
section #ceec7;c7 ( title #dd1 ,unit$   
,/ates ,code--  7i7 a description ( !   
implem5tation ( ! intrusion assessm5t   
plan2  7ii7 ! f9d+s ( ! intrusion       
assessm5ts conduct$ pursuant to !       
intrusion assessm5t plan2  7iii7 advanc$
 network security tools includ$ 9 !     
,cont9u\s ,diagno/ics & ,mitigation     
,program pursuant to section            
#bjd7;a77#a72  7iv7 ! results ( !       
assessm5t ( ! ,secret>y ( be/ practices 
= ,f$]al cyb]security pursuant to       
section #bje7;a72 &  7v7 a li/ by ag5cy 
( compliance ) ! requirem5ts ( section  
#bje7;b72 &  7,c7 n lat] ?an #a ye> aft]
 ! date ( enactm5t ( ?is ,act1 submit to
 ! appropriate congressional            
committees--  7i7 a copy ( ! plan       

develop$ pursuant to section            
#bjd7;a77#b72 &  7ii7 ! improv$ metrics 
develop$ pursuant to section #bjd7;b74  
#bjg4 ,t]m9ation  7a7 ,9 g5]al ,!       
au?ority provid$ "u section #bcj ( !    
,homel& ,security ,act ( #bjjb1 z add$  
by section #bjc7;a7 ( ?is ,act1 & !     
report+ requirem5ts "u section #bjf7;c7 
%all t]m9ate on ! date t is #g ye>s aft]
 ! date ( enactm5t ( ?is ,act4  7b7     
,rule ( con/ruction ,no?+ 9 subsection  
7a7 %all be con/ru$ to affect !         
limitation ( liability ( a private      
entity = assi/ance provid$ to !         
,secret>y "u section #bcj7;d77#b7 ( !   
,homel& ,security ,act ( #bjjb1 z add$  
by section #bjc7;a7 ( ?is ,act1 if su*  
assi/ance 0 r5d]$ be=e ! t]m9ation date 
"u subsection 7a7 or o!rwise dur+ a     
p]iod 9 :i* ! assi/ance 0 au?oriz$4     
#bjh4 ,id5tification ( in=mation sy/ems 
relat+ to national security  7a7 ,9     
g5]al ,except z provid$ 9 subsection    
7c71 n lat] ?an #ahj days aft] ! date ( 
enactm5t ( ?is ,act--  7#a7 ! ,director 

( ,national ,intellig5ce & ! ,director (
 ! ,(fice ( ,managem5t & ,budget1 9     
coord9ation ) ! heads ( o!r ag5cies1    
%all--  7,a7 id5tify all unclassifi$    
in=mation sy/ems t provide access to    
in=mation t may provide an adv]s>y ) !  
ability to d]ive in=mation t w\ld       
o!rwise be consid]$ classifi$2  7,b7    
assess ! risks t w\ld result f ! brea* (
 ea* unclassifi$ in=mation sy/em        
id5tifi$ 9 subp>agraph 7,a72 &  7,c7    
assess ! co/ & impact on ! mission c>ri$
 out by ea* ag5cy t owns an unclassifi$ 
in=mation sy/em id5tifi$ 9 subp>agraph  
7,a7 if ! sy/em 7 to be subsequ5tly     
designat$ z a national security sy/em2 &
  7#b7 ! ,director ( ,national          
,intellig5ce & ! ,director ( ! ,(fice ( 
,managem5t & ,budget %all submit to !   
appropriate congressional committees1 ! 
,select ,committee on ,intellig5ce ( !  
,s5ate1 & ! ,p]man5t ,select ,committee 
on ,intellig5ce ( ! ,h\se (             
,repres5tatives a report t includes !   
f9d+s "u p>agraph 7#a74  7b7 ,=m ,!     

report submitt$ "u subsection 7a77#b7   
%all be 9 unclassifi$ =m1 & %all include
 a classifi$ annex4  7c7 ,exception ,!  
requirem5ts "u subsection 7a77#a7 %all n
 apply to ! ,dep>tm5t ( ,def5se1 a      
national security sy/em1 or an elem5t ( 
! intellig5ce community4  7d7 ,rule (   
con/ruction ,no?+ 9 ?is section %all be 
con/ru$ to designate an in=mation sy/em 
z a national security sy/em4  #bji4     
,direction to ag5cies  7a7 ,9 g5]al     
,section #ceec ( title #dd1 ,unit$      
,/ates ,code1 is am5d$ by add+ at ! end 
! foll[+3  7h7 ,direction to ag5cies    
7#a7 ,au?ority  7,a7 ,9 g5]al ,subject  
to subp>agraph 7,b71 9 response to a    
kn[n or reasonably suspect$ in=mation   
security ?reat1 vuln]ability1 or incid5t
 t repres5ts a sub/antial ?reat to !    
in=mation security ( an ag5cy1 !        
,secret>y may issue an em]g5cy directive
 to ! head ( an ag5cy to take any lawful
 action ) respect to ! op]ation ( !     
in=mation sy/em1 includ+ su* sy/ems us$ 
or op]at$ by ano!r entity on behalf ( an

 ag5cy1 t collects1 processes1 /ores1   
transmits1 dissem9ates1 or o!rwise      
ma9ta9s ag5cy in=mation1 = ! purpose (  
protect+ ! in=mation sy/em f1 or        
mitigat+1 an in=mation security ?reat4  
7,b7 ,exception ,! au?orities ( !       
,secret>y "u ?is subsection %all n apply
 to a sy/em describ$ subsection 7d7 or  
to a sy/em describ$ 9 p>agraph 7#b7 or  
7#c7 ( subsection 7e74  7#b7 ,proc$ures 
= use ( au?ority ,! ,secret>y %all--    
7,a7 9 coord9ation ) ! ,director1       
e/abli% proc$ures gov]n+ ! circum/ances 
"u :i* a directive may be issu$ "u ?is  
subsection1 :i* %all include--  7i7     
?re%olds & o!r crit]ia2  7ii7 privacy & 
civil lib]ties protections2 &  7iii7    
provid+ notice to pot5tially affect$    
?ird p>ties2  7,b7 specify ! reasons = !
 requir$ action & ! duration ( !        
directive2  7,c7 m9imize ! impact ( a   
directive "u ?is subsection by-- 7i7    
adopt+ ! lea/ intrusive means possible  
"u ! circum/ances to secure ! ag5cy     
in=mation sy/ems2 &  7ii7 limit+        

directives to ! %orte/ p]iod            
practicable2  7,d7 notify ! ,director & 
! head ( any affect$ ag5cy imm$iately ^u
 ! issuance ( a directive "u ?is        
subsection2  7,e7 consult ) ! ,director 
( ! ,national ,in/itute ( ,/&>ds &      
,te*nology reg>d+ any directive "u ?is  
subsection t implem5ts /&>ds & guidel9es
 develop$ by ! ,national ,in/itute (    
,/&>ds & ,te*nology2  7,f7 ensure t     
directives issu$ "u ?is subsection d n  
conflict ) ! /&>ds & guidel9es issu$ "u 
section #aacca ( title #dj2  7,g7       
consid] any applicable /&>ds or         
guidel9es develop$ by ! ,national       
,in/itute ( ,/&>ds & issu$ by !         
,secret>y ( ,comm]ce "u section #aacca (
 title #dj2 &  7,h7 n lat] ?an ,febru>y 
#a ( ea* ye>1 submit to ! appropriate   
congressional committees a report reg>d+
 ! specific actions ! ,secret>y has tak5
 pursuant to p>agraph 7#a77;,a74  7#c7  
,imm95t ?reats  7,a7 ,9 g5]al ,not)/&+  
section #ceed1 ! ,secret>y may au?orize 
! intrusion detection & prev5tion       

capabilities "u section #bcj7;b77#a7 ( !
 ,homel& ,security ,act ( #bjjb = !     
purpose ( ensur+ ! security ( ag5cy     
in=mation sy/ems1 if--  7i7 ! ,secret>y 
det]m9es !re is an imm95t ?reat to ag5cy
 in=mation sy/ems2  7ii7 ! ,secret>y    
det]m9es a directive "u subsection      
7b77#b77;,c7 or p>agraph 7#a77;,a7 is n 
reasonably likely to result 9 a timely  
response to ! ?reat2  7iii7 ! ,secret>y 
det]m9es ! risk pos$ by ! imm95t ?reat  
outweighs any adv]se consequ5ces        
reasonably expect$ to result f ! use (  
protective capabilities "u ! control ( !
 ,secret>y2  7iv7 ! ,secret>y provides  
prior notice to ! ,director1 & ! head & 
*ief in=mation (fic] 7or equival5t      
(ficial7 ( ea* ag5cy to :i* specific    
actions w be tak5 pursuant to           
subp>agraph 7,a71 & notifies !          
appropriate congressional committees &  
au?oriz+ committees ( ea* su* ag5cies )9
 sev5 days ( tak+ an action "u ?is      
subsection (--  7,i7 any action tak5 "u 
?is subsection2 &  7,,ii7 ! reasons = & 

duration & nature ( ! action2  7v7 !    
action ( ! ,secret>y is consi/5t )      
applicable law2 &  7vi7 ! ,secret>y     
au?orizes ! use ( protective            
capabilities 9 accordance ) ! advance   
proc$ures e/abli%$ "u subp>agraph 7,c74 
7,b7 ,limitation on delegation ,!       
au?ority "u ?is subsection may n be     
delegat$ by ! ,secret>y4  7,c7 ,advance 
proc$ures ,! ,secret>y %all1 9          
coord9ation ) ! ,director1 & 9          
consultation ) ! heads ( ,f$]al ag5cies1
 e/abli% proc$ures gov]n+ ! circum/ances
 "u :i* ! ,secret>y may au?orize ! use (
 protective capabilities subp>agraph    
7,a74 ,! ,secret>y %all submit !        
proc$ures to ,congress4  7#d7           
,limitation ,! ,secret>y may direct or  
au?orize lawful action or protective    
capability "u ?is subsection only to--  
7,a7 protect ag5cy in=mation f          
unau?oriz$ access1 use1 disclosure1     
disruption1 modification1 or de/ruction2
 or  7,b7 require ! rem$iation ( or     
protect aga9/ id5tifi$ in=mation        

security risks ) respect to--  7i7      
in=mation collect$ or ma9ta9$ by or on  
behalf ( an ag5cy2 or  7ii7 t portion ( 
an in=mation sy/em us$ or op]at$ by an  
ag5cy or by a contractor ( an ag5cy or  
o!r organization on behalf ( an ag5cy4  
7i7 ,annual report to ,congress ,n lat] 
?an ,febru>y #a ( ea* ye>1 ! ,director  
%all submit to ! appropriate            
congressional committees a report reg>d+
 ! specific actions ! ,director has tak5
 pursuant to subsection 7a77#e71 includ+
 any actions tak5 pursuant to section   
#aacjc7;b77#e7 ( title #dj4  7j7        
,appropriate congressional committees   
def9$ ,9 ?is section1 ! t]m appropriate 
congressional committees means-- 7#a7 ! 
,committee on ,appropriations & !       
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2 &  7#b7
 ! ,committee on ,appropriations1 !     
,committee on ,homel& ,security1 !      
,committee on ,ov]sight & ,gov]nm5t     
,re=m1 & ! ,committee on ,sci5ce1       
,space1 & ,te*nology ( ! ,h\se (        

,repres5tatives4  4  7b7 ,con=m+ am5dm5t
 ,section #ceed7;a77#a77;,b7 ( title    
#dd1 ,unit$ ,/ates ,code1 is am5d$--    
7#a7 9 clause 7iii71 by /rik+ & at !    
end2 &  7#b7 by add+ at ! end ! foll[+3 
7v7 em]g5cy directives issu$ by !       
,secret>y "u section #ceec7;h72 &  4    
,,iii ,f$]al cyb]security work=ce       
assessm5t  #cja4 ,%ort title ,?is title 
may be cit$ z ! ,f$]al ,cyb]security    
,work=ce ,assessm5t ,act ( #bjae4  #cjb4
 ,def9itions ,9 ?is title3  7#a7        
,appropriate congressional committees ,!
 t]m appropriate congressional          
committees means-- 7,a7 ! ,committee on 
,arm$ ,s]vices ( ! ,s5ate2  7,b7 !      
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2  7,c7 !
 ,select ,committee on ,intellig5ce ( ! 
,s5ate2  7,d7 ! ,committee on ,comm]ce1 
,sci5ce1 & ,transportation ( ! ,s5ate2  
7,e7 ! ,committee on ,arm$ ,s]vices 9 ! 
,h\se ( ,repres5tatives2  7,f7 !        
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives2  7,g7 !        

,committee on ,ov]sight & ,gov]nm5t     
,re=m ( ! ,h\se ( ,repres5tatives2 &    
7,h7 ! ,p]man5t ,select ,committee on   
,intellig5ce ( ! ,h\se (                
,repres5tatives4  7#b7 ,director ,! t]m 
,director means ! ,director ( ! ,(fice (
 ,p]sonnel ,managem5t4  7#c7 ,roles ,!  
t]m roles has ! mean+ giv5 ! t]m 9 !    
,national ,initiative = ,cyb]security   
,education's ,cyb]security ,work=ce     
,framework4  #cjc4 ,national            
cyb]security work=ce measurem5t         
initiative  7a7 ,9 g5]al ,! head ( ea*  
,f$]al ag5cy %all-- 7#a7 id5tify all    
positions )9 ! ag5cy t require !        
p]=mance ( cyb]security or o!r          
cyb]-relat$ functions2 &  7#b7 assign ! 
correspond+ employm5t code1 :i* %all be 
add$ to ! ,national ,initiative =       
,cyb]security ,education's ,national    
,cyb]security ,work=ce ,framework1 9    
accordance ) subsection 7b74  7b7       
,employm5t codes  7#a7 ,proc$ures  7,a7 
,cod+ /ructure ,n lat] ?an #ahj days    
aft] ! date ( ! enactm5t ( ?is ,act1 !  

,secret>y ( ,comm]ce1 act+ ?r\gh !      
,national ,in/itute ( ,/&>ds &          
,te*nology1 %all update ! ,national     
,initiative = ,cyb]security ,education's
 ,cyb]security ,work=ce ,framework to   
include a correspond+ cod+ /ructure4    
7,b7 ,id5tification ( civilian cyb]     
p]sonnel ,n lat] ?an #i mon?s aft] !    
date ( enactm5t ( ?is ,act1 ! ,director1
 9 coord9ation ) ! ,director ( !        
,national ,in/itute ( ,/&>ds &          
,te*nology & ! ,director ( ,national    
,intellig5ce1 %all e/abli% proc$ures to 
implem5t ! ,national ,initiative =      
,cyb]security ,education's cod+ /ructure
 to id5tify all ,f$]al civilian         
positions t require ! p]=mance (        
in=mation te*nology1 cyb]security1 or   
o!r cyb]-relat$ functions4  7,c7        
,id5tification ( noncivilian cyb]       
p]sonnel ,n lat] ?an #ah mon?s aft] !   
date ( enactm5t ( ?is ,act1 ! ,secret>y 
( ,def5se %all e/abli% proc$ures to     
implem5t ! ,national ,initiative =      
,cyb]security ,education's cod+ /ructure

 to id5tify all ,f$]al noncivilian      
positions t require ! p]=mance (        
in=mation te*nology1 cyb]security1 or   
o!r cyb]-relat$ functions4  7,d7        
,basel9e assessm5t ( exi/+ cyb]security 
work=ce ,n lat] ?an #c mon?s aft] ! date
 on :i* ! proc$ures are develop$ "u     
subp>agraphs 7,b7 & 7,c71 respectively1 
! head ( ea* ,f$]al ag5cy %all submit to
 ! appropriate congressional committees 
( jurisdiction a report t id5tifies--   
7i7 ! p]c5tage ( p]sonnel ) in=mation   
te*nology1 cyb]security1 or o!r         
cyb]-relat$ job functions :o curr5tly   
hold ! appropriate indu/ry-recogniz$    
c]tifications z id5tifi$ 9 ! ,national  
,initiative = ,cyb]security ,education's
 ,cyb]security ,work=ce ,framework2     
7ii7 ! level ( prep>$ness ( o!r civilian
 & noncivilian cyb] p]sonnel )\t exi/+  
cr$5tials to take c]tification exams2 & 
7iii7 a /rategy = mitigat+ any gaps     
id5tifi$ 9 clause 7i7 or 7ii7 ) !       
appropriate tra9+ & c]tification = exi/+
 p]sonnel4  7,e7 ,proc$ures = assign+   

codes ,n lat] ?an #c mon?s aft] ! date  
on :i* ! proc$ures are develop$ "u      
subp>agraphs 7,b7 & 7,c71 respectively1 
! head ( ea* ,f$]al ag5cy %all e/abli%  
proc$ures--  7i7 to id5tify all encumb]$
 & vacant positions ) in=mation         
te*nology1 cyb]security1 or o!r         
cyb]-relat$ functions 7z def9$ 9 !      
,national ,initiative = ,cyb]security   
,education's cod+ /ructure72 &  7ii7 to 
assign ! appropriate employm5t code to  
ea* su* position1 us+ agre$ /&>ds &     
def9itions4  7#b7 ,code assignm5ts ,n   
lat] ?an #a ye> aft] ! date aft] !      
proc$ures are e/abli%$ "u p>agraph      
7#a77;,e71 ! head ( ea* ,f$]al ag5cy    
%all complete assignm5t ( ! appropriate 
employm5t code to ea* position )9 !     
ag5cy ) in=mation te*nology1            
cyb]security1 or o!r cyb]-relat$        
functions4  7c7 ,progress report ,n lat]
 ?an #ahj days aft] ! date ( enactm5t ( 
?is ,act1 ! ,director %all submit a     
progress report on ! implem5tation ( ?is
 section to ! appropriate congressional 

committees4  #cjd4 ,id5tification (     
cyb]-relat$ roles ( critical ne$  7a7 ,9
 g5]al ,beg9n+ n lat] ?an #a ye> aft] ! 
date on :i* ! employm5t codes are       
assign$ to employees pursuant to section
 #bjc7;b77#b71 & annually ?r\gh #bjbb1 !
 head ( ea* ,f$]al ag5cy1 9 consultation
 ) ! ,director1 ! ,director ( !         
,national ,in/itute ( ,/&>ds &          
,te*nology1 & ! ,secret>y ( ,homel&     
,security1 %all--  7#a7 id5tify         
in=mation te*nology1 cyb]security1 or   
o!r cyb]-relat$ roles ( critical ne$ 9 !
 ag5cy's work=ce2 &  7#b7 submit a      
report to ! ,director t-- 7,a7 describes
 ! in=mation te*nology1 cyb]security1 or
 o!r cyb]-relat$ roles id5tifi$ "u      
p>agraph 7#a72 &  7,b7 sub/antiates !   
critical ne$ designations4  7b7         
,guidance ,! ,director %all provide     
,f$]al ag5cies ) timely guidance =      
id5tify+ in=mation te*nology1           
cyb]security1 or o!r cyb]-relat$ roles (
 critical ne$1 includ+--  7#a7 curr5t   
in=mation te*nology1 cyb]security1 & o!r

 cyb]-relat$ roles ) acute skill        
%ortages2 &  7#b7 in=mation te*nology1  
cyb]security1 or o!r cyb]-relat$ roles )
 em]g+ skill %ortages4  7c7             
,cyb]security ne$s report ,n lat] ?an #b
 ye>s aft] ! date ( ! enactm5t ( ?is    
,act1 ! ,director1 9 consultation ) !   
,secret>y ( ,homel& ,security1 %all--   
7#a7 id5tify critical ne$s = in=mation  
te*nology1 cyb]security1 or o!r         
cyb]-relat$ work=ce across all ,f$]al   
ag5cies2 &  7#b7 submit a progress      
report on ! implem5tation ( ?is section 
to ! appropriate congressional          
committees4  #cje4 ,gov]nm5t            
,acc\ntability ,(fice /atus reports ,!  
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all-- 7#a7 analyze & monitor !         
implem5tation ( sections #cjc & #cjd2 & 
7#b7 n lat] ?an #c ye>s aft] ! date ( ! 
enactm5t ( ?is ,act1 submit a report to 
! appropriate congressional committees t
 describes ! /atus ( su* implem5tation4 
,,iv ,o!r cyb] matt]s  #dja4 ,/udy on   
mobile device security  7a7 ,9 g5]al ,n 

lat] ?an #a ye> aft] ! date ( ! enactm5t
 ( ?is ,act1 ! ,secret>y ( ,homel&      
,security1 9 consultation ) ! ,director 
( ! ,national ,in/itute ( ,/&>ds &      
,te*nology1 %all--  7#a7 complete a /udy
 on ?reats relat+ to ! security ( !     
mobile devices ( ! ,f$]al ,gov]nm5t2 &  
7#b7 submit an unclassifi$ report to    
,congress1 ) a classifi$ annex if       
necess>y1 t conta9s ! f9d+s ( su* /udy1 
! recomm5dations develop$ "u p>agraph   
7#c7 ( subsection 7b71 ! defici5cies1 if
 any1 id5tifi$ "u 7#d7 ( su* subsection1
 & ! plan develop$ "u p>agraph 7#e7 (   
su* subsection4  7b7 ,matt]s /udi$ ,9   
c>ry+ out ! /udy "u subsection 7a77#a71 
! ,secret>y1 9 consultation ) !         
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology1 %all--  7#a7 assess
 ! evolution ( mobile security te*niques
 f a desktop-c5tric approa*1 & :e!r su* 
te*niques are adequate to meet curr5t   
mobile security *all5ges2  7#b7 assess !
 effect su* ?reats may h on !           
cyb]security ( ! in=mation sy/ems &     

networks ( ! ,f$]al ,gov]nm5t 7except = 
national security sy/ems or ! in=mation 
sy/ems & networks ( ! ,dep>tm5t (       
,def5se & ! intellig5ce community72     
7#c7 develop recomm5dations = address+  
su* ?reats bas$ on indu/ry /&>ds & be/  
practices2  7#d7 id5tify any defici5cies
 9 ! curr5t au?orities ( ! ,secret>y t  
may inhibit ! ability ( ! ,secret>y to  
address mobile device security ?r\gh\t !
 ,f$]al ,gov]nm5t 7except = national    
security sy/ems & ! in=mation sy/ems &  
networks ( ! ,dep>tm5t ( ,def5se &      
intellig5ce community72 &  7#e7 develop 
a plan = accel]at$ adoption ( secure    
mobile device te*nology by ! ,dep>tm5t (
 ,homel& ,security4  7c7 ,intellig5ce   
community def9$ ,9 ?is section1 ! t]m   
intellig5ce community has ! mean+ giv5  
su* t]m 9 section #c ( ! ,national      
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc74  #djb4 ,dep>tm5t ( ,/ate        
int]national cyb]space policy /rategy   
7a7 ,9 g5]al ,n lat] ?an #ij days aft] !
 date ( ! enactm5t ( ?is ,act1 !        

,secret>y ( ,/ate %all produce a        
compreh5sive /rategy relat+ to ,unit$   
,/ates int]national policy ) reg>d to   
cyb]space4  7b7 ,elem5ts ,! /rategy     
requir$ by subsection 7a7 %all include !
 foll[+3 7#a7 ,a review ( actions &     
activities und]tak5 by ! ,secret>y (    
,/ate to date to support ! goal ( !     
,presid5t's ,int]national ,/rategy =    
,cyb]space1 releas$ 9 ,may #bjaa1 to "w 
int]nationally to promote an op51       
int]op]able1 secure1 & reliable         
in=mation & communications infra/ructure
 t supports int]national trade &        
comm]ce1 /r5g!ns int]national security1 
& fo/]s free expression & innovation44  
7#b7 ,a plan ( action to guide !        
diplomacy ( ! ,secret>y ( ,/ate1 ) reg>d
 to =eign c\ntries1 includ+ conduct+    
bilat]al & multilat]al activities to    
develop ! norms ( responsible           
int]national behavior 9 cyb]space1 &    
/atus review ( exi/+ discussions 9      
multilat]al =a to obta9 agreem5ts on    
int]national norms 9 cyb]space4  7#c7 ,a

 review ( ! alt]native concepts ) reg>d 
to int]national norms 9 cyb]space (f]$  
by =eign c\ntries t are prom95t actors1 
includ+ ,*9a1 ,russia1 ,brazil1 &       
,india4  7#d7 ,a detail$ description (  
?reats to ,unit$ ,/ates national        
security 9 cyb]space f =eign c\ntries1  
/ate-sponsor$ actors1 & private actors  
to ,f$]al & private sector infra/ructure
 ( ! ,unit$ ,/ates1 intellectual prop]ty
 9 ! ,unit$ ,/ates1 & ! privacy (       
citiz5s ( ! ,unit$ ,/ates4  7#e7 ,a     
review ( policy tools available to !    
,presid5t to det] =eign c\ntries1       
/ate-sponsor$ actors1 & private actors1 
includ+ ^? outl9$ 9 ,executive ,ord]    
#acfid1 releas$ on ,april #a1 #bjae4    
7#f7 ,a review ( res\rces requir$ by !  
,secret>y1 includ+ ! ,(fice ( !         
,coord9ator = ,cyb] ,issues1 to conduct 
activities to build responsible norms ( 
int]national cyb] behavior4  7c7        
,consultation ,9 prep>+ ! /rategy       
requir$ by subsection 7a71 ! ,secret>y (
 ,/ate %all consult1 z appropriate1 )   

o!r ag5cies & dep>tm5ts ( ! ,unit$      
,/ates & ! private sector &             
nongov]nm5tal organizations 9 ! ,unit$  
,/ates ) recogniz$ cr$5tials & exp]tise 
9 =eign policy1 national security1 &    
cyb]security4  7d7 ,=m ( /rategy ,!     
/rategy requir$ by subsection 7a7 %all  
be 9 unclassifi$ =m1 b may include a    
classifi$ annex4  7e7 ,availability (   
in=mation ,! ,secret>y ( ,/ate %all--   
7#a7 make ! /rategy requir$ 9 subsection
 7a7 available ! public2 &  7#b7 brief !
 ,committee on ,=eign ,relations ( !    
,s5ate & ! ,committee on ,=eign ,affairs
 ( ! ,h\se ( ,repres5tatives on !       
/rategy1 includ+ any mat]ial conta9$ 9 a
 classifi$ annex4  #djc4 ,appreh5sion & 
prosecution ( int]national cyb] crim9als
  7a7 ,int]national cyb] crim9al def9$  
,9 ?is section1 ! t]m int]national cyb] 
crim9al means an individual-- 7#a7 :o is
 believ$ to h committ$ a cyb]crime or   
intellectual prop]ty crime aga9/ !      
int]e/s ( ! ,unit$ ,/ates or ! citiz5s (
 ! ,unit$ ,/ates2 &  7#b7 = :om-- 7,a7  

an arre/ w>rant has be5 issu$ by a judge
 9 ! ,unit$ ,/ates2 or  7,b7 an         
int]national want$ notice 7commonly     
ref]r$ to z a ,r$ ,notice7 has be5      
circulat$ by ,int]pol4  7b7             
,consultations = noncoop]ation ,!       
,secret>y ( ,/ate1 or designee1 %all    
consult ) ! appropriate gov]nm5t (ficial
 ( ea* c\ntry f :i* extradition is n    
likely due to ! lack ( an extradition   
treaty ) ! ,unit$ ,/ates or o!r reasons1
 9 :i* "o or m int]national cyb]        
crim9als are physically pres5t1 to      
det]m9e :at actions ! gov]nm5t ( su*    
c\ntry has tak5--  7#a7 to appreh5d &   
prosecute su* crim9als2 &  7#b7 to      
prev5t su* crim9als f c>ry+ out         
cyb]crimes or intellectual prop]ty      
crimes aga9/ ! int]e/s ( ! ,unit$ ,/ates
 or its citiz5s4  7c7 ,annual report    
7#a7 ,9 g5]al ,! ,secret>y ( ,/ate %all 
submit to ! appropriate congressional   
committees an annual report t includes--
  7,a7 ! numb] ( int]national cyb]      
crim9als locat$ 9 o!r c\ntries1         

disaggregat$ by c\ntry1 & indicat+ f :i*
 c\ntries extradition is n likely due to
 ! lack ( an extradition treaty ) !     
,unit$ ,/ates or o!r reasons2  7,b7 !   
nature & numb] ( significant discussions
 by an (ficial ( ! ,dep>tm5t ( ,/ate on 
ways to ?w>t or prosecute int]national  
cyb] crim9als ) an (ficial ( ano!r      
c\ntry1 includ+ ! "n ( ea* su* c\ntry2 &
  7,c7 = ea* int]national cyb] crim9al  
:o 0 extradit$ to ! ,unit$ ,/ates dur+ !
 mo/ rec5tly complet$ cal5d> ye>--  7i7 
8 or h] "n2  7ii7 ! crimes = :i* he or  
%e 0 *>g$2  7iii7 8 or h] previ\s c\ntry
 ( resid5ce2 &  7iv7 ! c\ntry f :i* he  
or %e 0 extradit$ into ! ,unit$ ,/ates4 
7#b7 ,=m ,! report requir$ by ?is       
subsection %all be 9 unclassifi$ =m to !
 maximum ext5t possible1 b may include a
 classifi$ annex4  7#c7 ,appropriate    
congressional committees ,= purposes (  
?is subsection1 ! t]m appropriate       
congressional committees means-- 7,a7 ! 
,committee on ,=eign ,relations1 !      
,committee on ,appropriations1 !        

,committee on ,homel& ,security &       
,gov]nm5tal ,affairs1 ! ,committee on   
,bank+1 ,h\s+1 & ,urban ,affairs1 !     
,select ,committee on ,intellig5ce1 & ! 
,committee on ! ,judici>y ( ! ,s5ate2 & 
7,b7 ! ,committee on ,=eign ,affairs1 ! 
,committee on ,appropriations1 !        
,committee on ,homel& ,security1 !      
,committee on ,f9ancial ,s]vices1 !     
,p]man5t ,select ,committee on          
,intellig5ce1 & ! ,committee on !       
,judici>y ( ! ,h\se ( ,repres5tatives4  
#djd4 ,enhancem5t ( em]g5cy s]vices  7a7
 ,collection ( data ,n lat] ?an #ij days
 aft] ! date ( enactm5t ( ?is ,act1 !   
,secret>y ( ,homel& ,security1 act+     
?r\gh ! ,national ,cyb]security &       
,communications ,integration ,c5t]1 9   
coord9ation ) appropriate ,f$]al        
entities & ! ,director = ,em]g5cy       
,communications1 %all e/abli% a process 
by :i* a ,/atewide ,int]op]ability      
,coord9ator may report data on any      
cyb]security risk or incid5t involv+ any
 in=mation sy/em or network us$ by      

em]g5cy response provid]s 7z def9$ 9    
section #b ( ! ,homel& ,security ,act ( 
#bjjb 7#f ,u4,s4,c4 #aja77 )9 ! ,/ate4  
7b7 ,analysis ( data ,n lat] ?an #a ye> 
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y ( ,homel& ,security1 act+     
?r\gh ! ,director ( ! ,national         
,cyb]security & ,communications         
,integration ,c5t]1 9 coord9ation )     
appropriate entities & ! ,director =    
,em]g5cy ,communications1 & 9           
consultation ) ! ,director ( ! ,national
 ,in/itute ( ,/&>ds & ,te*nology1 %all  
conduct integration & analysis ( ! data 
report$ "u subsection 7a7 to develop    
in=mation & recomm5dations on security &
 resili5ce measures = any in=mation     
sy/em or network us$ by ,/ate em]g5cy   
response provid]s4  7c7 ,be/ practices  
7#a7 ,9 g5]al ,us+ ! results ( !        
integration & analysis conduct$ "u      
subsection 7b71 & any o!r relevant      
in=mation1 ! ,director ( ! ,national    
,in/itute ( ,/&>ds & ,te*nology %all1 on
 an ongo+ basis1 facilitate & support ! 

developm5t ( me?ods = r$uc+ cyb]security
 risks to em]g5cy response provid]s us+ 
! process describ$ 9 section #b7;e7 ( ! 
,national ,in/itute ( ,/&>ds &          
,te*nology ,act 7#ae ,u4,s4,c4          
#bgb7;e774  7#b7 ,report ,! ,director ( 
! ,national ,in/itute ( ,/&>ds &        
,te*nology %all submit a report to      
,congress on ! me?ods develop$ "u       
p>agraph 7#a7 & %all make su* report    
publically available on ! website ( !   
,national ,in/itute ( ,/&>ds &          
,te*nology4  7d7 ,rule ( con/ruction    
,no?+ 9 ?is section %all be con/ru$ to--
 7#a7 require a ,/ate to report data "u 
subsection 7a72 or  7#b7 require an     
entity to-- 7,a7 adopt a recomm5d$      
measure develop$ "u subsection 7b72 or  
7,b7 foll[ ! be/ practices develop$ "u  
subsection 7c74  #dje4 ,improv+         
cyb]security 9 ! heal? c>e indu/ry  7a7 
,def9itions ,9 ?is section3  7#a7       
,bus9ess associate ,! t]m bus9ess       
associate has ! mean+ giv5 su* t]m 9    
section #afj4ajc ( title #de1 ,code (   

,f$]al ,regulations4  7#b7 ,cov]$ entity
 ,! t]m cov]$ entity has ! mean+ giv5   
su* t]m 9 section #afj4ajc ( title #de1 
,code ( ,f$]al ,regulations4  7#c7      
,heal? c>e cle>+h\se2 heal? c>e provid]2
 heal? plan ,! t]ms heal? c>e cle>+h\se1
 heal? c>e provid]1 & heal? plan h !    
mean+s giv5 ! t]ms 9 section #afj4ajc ( 
title #de1 ,code ( ,f$]al ,regulations4 
7#d7 ,heal? c>e indu/ry /akehold] ,! t]m
 heal? c>e indu/ry /akehold] means any--
  7,a7 heal? plan1 heal? c>e cle>+h\se1 
or heal? c>e provid]2  7,b7 pati5t      
advocate2  7,c7 ph>maci/2  7,d7 develop]
 ( heal? in=mation te*nology2  7,e7     
laboratory2  7,f7 ph>maceutical or      
m$ical device manufactur]2 or  7,g7     
additional /akehold] ! ,secret>y        
det]m9es necess>y = purposes (          
subsection 7d77#a71 7d77#c71 or 7e74    
7#e7 ,secret>y ,! t]m ,secret>y means ! 
,secret>y ( ,heal? & ,human ,s]vices4   
7b7 ,report ,n lat] ?an #a ye> aft] !   
date ( enactm5t ( ?is ,act1 ! ,secret>y 
%all submit1 to ! ,committee on ,heal?1 

,education1 ,labor1 & ,p5sions ( !      
,s5ate & ! ,committee on ,en]gy &       
,comm]ce ( ! ,h\se ( ,repres5tatives1 a 
report on ! prep>$ness ( ! heal? c>e    
indu/ry 9 respond+ to cyb]security      
?reats4  7c7 ,cont5ts ( report ,)       
respect to ! int]nal response ( !       
,dep>tm5t ( ,heal? & ,human ,s]vices to 
em]g+ cyb]security ?reats1 ! report %all
 include--  7#a7 a cle> /atem5t ( !     
(ficial )9 ! ,dep>tm5t ( ,heal? & ,human
 ,s]vices to be responsible = lead+ &   
coord9at+ ef=ts ( ! ,dep>tm5t reg>d+    
cyb]security ?reats 9 ! heal? c>e       
indu/ry2 &  7#b7 a plan f ea* relevant  
op]at+ division & subdivision ( !       
,dep>tm5t ( ,heal? & ,human ,s]vices on 
h[ su* division or subdivision w address
 cyb]security ?reats 9 ! heal? c>e      
indu/ry1 includ+ a cle> del9eation ( h[ 
ea* su* division or subdivision w divide
 responsibility among ! p]sonnel ( su*  
division or subdivision & communicate ) 
o!r su* divisions & subdivisions reg>d+ 
ef=ts to address su* ?reats4  7d7 ,heal?

 c>e indu/ry cyb]security task =ce  7#a7
 ,9 g5]al ,n lat] ?an #fj days aft] !   
date ( enactm5t ( ?is ,act1 ! ,secret>y1
 9 consultation ) ! ,director ( !       
,national ,in/itute ( ,/&>ds &          
,te*nology & ! ,secret>y ( ,homel&      
,security1 %all conv5e heal? c>e indu/ry
 /akehold]s1 cyb]security exp]ts1 & any 
,f$]al ag5cies or entities ! ,secret>y  
det]m9es appropriate to e/abli% a task  
=ce to--  7,a7 analyze h[ indu/ries1 o!r
 ?an ! heal? c>e indu/ry1 h implem5t$   
/rategies & safegu>ds = address+        
cyb]security ?reats )9 _! respective    
indu/ries2  7,b7 analyze *all5ges &     
b>ri]s private entities 7not)/&+ section
 #ajb7ae77;,b71 exclud+ any ,/ate1      
tribal1 or local gov]nm5t7 9 ! heal? c>e
 indu/ry face secur+ !mselves aga9/ cyb]
 attacks2  7,c7 review *all5ges t cov]$ 
entities & bus9ess associates face 9    
secur+ network$ m$ical devices & o!r    
s(tw>e or sy/ems t connect to an        
electronic heal? record2  7,d7 provide !
 ,secret>y ) in=mation to dissem9ate to 

heal? c>e indu/ry /akehold]s = purposes 
( improv+ _! prep>$ness =1 & response   
to1 cyb]security ?reats affect+ ! heal? 
c>e indu/ry2  7,e7 e/abli% a plan =     
creat+ a s+le sy/em = ! ,f$]al ,gov]nm5t
 to %>e in=mation on actionable         
intellig5ce reg>d+ cyb]security ?reats  
to ! heal? c>e indu/ry 9 ne> real "t1   
requir+ no fee to ! recipi5ts ( su*     
in=mation1 includ+ :i* ,f$]al ag5cy or  
o!r entity may be be/ suit$ to be !     
c5tral conduit to facilitate ! %>+ ( su*
 in=mation2 &  7,f7 report to ,congress 
on ! f9d+s & recomm5dations ( ! task =ce
 reg>d+ c>ry+ out subp>agraphs 7,a7     
?r\gh 7,e74  7#b7 ,t]m9ation ,! task =ce
 e/abli%$ "u ?is subsection %all t]m9ate
 on ! date t is #a ye> aft] ! date (    
enactm5t ( ?is ,act4  7#c7 ,dissem9ation
 ,n lat] ?an #fj days aft] ! t]m9ation (
 ! task =ce e/abli%$ "u ?is subsection1 
! ,secret>y %all dissem9ate ! in=mation 
describ$ 9 p>agraph 7#a77;,d7 to heal?  
c>e indu/ry /akehold]s 9 accordance )   
su* p>agraph4  7#d7 ,rule ( con/ruction 

,no?+ 9 ?is subsection %all be con/ru$  
to limit ! antitru/ exemption "u section
 #ajd7;e7 or ! protection f liability "u
 section #ajf4  7e7 ,cyb]security       
framework  7#a7 ,9 g5]al ,! ,secret>y   
%all e/abli%1 ?r\gh a collaborative     
process ) ! ,secret>y ( ,homel&         
,security1 heal? c>e indu/ry /akehold]s1
 ! ,national ,in/itute ( ,/&>ds &       
,te*nology1 & any ,f$]al ag5cy or entity
 ! ,secret>y det]m9es appropriate1 a    
s+le1 volunt>y1 national heal?-specific 
cyb]security framework t--  7,a7        
e/abli%es a common set ( volunt>y1      
cons5sus-bas$1 & indu/ry-l$ /&>ds1      
security practices1 guidel9es1          
me?odologies1 proc$ures1 & processes t  
s]ve z a res\rce = co/-effectively r$uc+
 cyb]security risks = a range ( heal?   
c>e organizations2  7,b7 supports       
volunt>y adoption & implem5tation ef=ts 
to improve safegu>ds to address         
cyb]security ?reats2  7,c7 is consi/5t )
 ! security & privacy regulations       
promulgat$ "u section #bfd7;c7 ( !      

,heal? ,insurance ,portability &        
,acc\ntability ,act ( #aiif 7#db        
,u4,s4,c4 #acbj;d-#b note7 & ) ! ,heal? 
,in=mation ,te*nology = ,economic &     
,cl9ical ,heal? ,act 7title ,,xiii (    
division ,a1 & title ,,iv ( division ,b1
 ( ,public ,law #aaa-e71 & ! am5dm5ts   
made by su* ,act2 &  7,d7 is updat$ on a
 regul> basis & applicable to ! range ( 
heal? c>e organizations describ$ 9      
subp>agraph 7,a74  7#b7 ,limitation     
,no?+ 9 ?is subsection %all be int]pret$
 z grant+ ! ,secret>y au?ority to-- 7,a7
 provide = audits to ensure t heal? c>e 
organizations are 9 compliance ) !      
volunt>y framework "u ?is subsection2 or
  7,b7 m&ate1 direct1 or condition !    
aw>d ( any ,f$]al grant1 contract1 or   
pur*ase on compliance ) su* volunt>y    
framework4  7#c7 ,no liability =        
nonp>ticipation ,no?+ 9 ?is title %all  
be con/ru$ to subject a heal? c>e       
organization to liability = *oos+ n to  
engage 9 ! volunt>y activities au?oriz$ 
"u ?is subsection4  #djf4 ,f$]al comput]

 security  7a7 ,def9itions ,9 ?is       
section3 7#a7 ,cov]$ sy/em ,! t]m cov]$ 
sy/em %all mean a national security     
sy/em z def9$ 9 section #aaajc ( title  
#dj1 ,unit$ ,/ates ,code1 or a ,f$]al   
comput] sy/em t provides access to      
p]sonally id5tifiable in=mation4  7#b7  
,cov]$ ag5cy ,! t]m cov]$ ag5cy means an
 ag5cy t op]ates a cov]$ sy/em4  7#c7   
,logical access control ,! t]m logical  
access control means a process ( grant+ 
or d5y+ specific reque/s to obta9 & use 
in=mation & relat$ in=mation process+   
s]vices4  7#d7 ,multi-factor logical    
access controls ,! t]m multi-factor     
logical access controls means a set ( n 
less ?an #b ( ! foll[+ logical access   
controls3 7,a7 ,in=mation t is kn[n to !
 us]1 su* z a password or p]sonal       
id5tification numb]4  7,b7 ,an access   
device t is provid$ to ! us]1 su* z a   
cryptographic id5tification device or   
tok54  7,c7 ,a unique biometric         
*>act]i/ic ( ! us]4  7#e7 ,privileg$ us]
 ,! t]m privileg$ us] means a us] :o1 by

 virtue ( function or s5iority1 has be5 
allocat$ p[]s )9 a cov]$ sy/em1 :i* are 
significantly great] ?an ^? available to
 ! majority ( us]s4  7b7 ,inspector     
,g5]al reports on cov]$ sy/ems  7#a7 ,9 
g5]al ,n lat] ?an #bdj days aft] ! date 
( enactm5t ( ?is ,act1 ! ,inspector     
,g5]al ( ea* cov]$ ag5cy %all submit to 
! appropriate committees ( jurisdiction 
9 ! ,s5ate & ! ,h\se ( ,repres5tatives a
 report1 :i* %all include in=mation     
collect$ f ! cov]$ ag5cy = ! cont5ts    
describ$ 9 p>agraph 7#b7 reg>d+ ! ,f$]al
 comput] sy/ems ( ! cov]$ ag5cy4  7#b7  
,cont5ts ,! report submitt$ by ea*      
,inspector ,g5]al ( a cov]$ ag5cy "u    
p>agraph 7#a7 %all include1 ) respect to
 ! cov]$ ag5cy1 ! foll[+3  7,a7 ,a      
description ( ! logical access /&>ds us$
 by ! cov]$ ag5cy to access a cov]$     
sy/em1 includ+--  7i7 9 aggregate1 a li/
 & description ( logical access controls
 us$ to access su* a cov]$ sy/em2 &     
7ii7 :e!r ! cov]$ ag5cy is us+          
multi-factor logical access controls to 

access su* a cov]$ sy/em4  7,b7 ,a      
description ( ! logical access controls 
us$ by ! cov]$ ag5cy to gov]n access to 
cov]$ sy/ems by privileg$ us]s4  7,c7   
,if ! cov]$ ag5cy does n use logical    
access controls or multi-factor logical 
access controls to access a cov]$ sy/em1
 a description ( ! reasons = n us+ su*  
logical access controls or multi-factor 
logical access controls4  7,d7 ,a       
description ( ! foll[+ data security    
managem5t practices us$ by ! cov]$      
ag5cy3 7i7 ,! policies & proc$ures      
foll[$ to conduct inv5tories ( ! s(tw>e 
pres5t on ! cov]$ sy/ems ( ! cov]$ ag5cy
 & ! lic5ses associat$ ) su* s(tw>e4    
7ii7 ,:at capabilities ! cov]$ ag5cy    
utilizes to monitor & detect            
exfiltration & o!r ?reats1 includ+--    
7,i7 data loss prev5tion capabilities2  
or  7,,ii7 digital rights managem5t     
capabilities4  7iii7 ,a description ( h[
 ! cov]$ ag5cy is us+ ! capabilities    
describ$ 9 clause 7ii74  7iv7 ,if !     
cov]$ ag5cy is n utiliz+ capabilities   

describ$ 9 clause 7ii71 a description ( 
! reasons = n utiliz+ su* capabilities4 
7,e7 ,a description ( ! policies &      
proc$ures ( ! cov]$ ag5cy ) respect to  
ensur+ t entities1 includ+ contractors1 
t provide s]vices to ! cov]$ ag5cy are  
implem5t+ ! data security managem5t     
practices describ$ 9 subp>agraph 7,d74  
7#c7 ,exi/+ review ,! reports requir$ "u
 ?is subsection may be bas$ 9 :ole or 9 
"p on an audit1 evaluation1 or report   
relat+ to programs or practices ( !     
cov]$ ag5cy1 & may be submitt$ z "p (   
ano!r report1 includ+ ! report requir$  
"u section #ceee ( title #dd1 ,unit$    
,/ates ,code4  7#d7 ,classifi$ in=mation
 ,reports submitt$ "u ?is subsection    
%all be 9 unclassifi$ =m1 b may include 
a classifi$ annex4  #djg4 ,/rategy to   
protect critical infra/ructure at       
greate/ risk  7a7 ,def9itions ,9 ?is    
section3 7#a7 ,appropriate ag5cy ,! t]m 
appropriate ag5cy means1 ) respect to a 
cov]$ entity--  7,a7 except z provid$ 9 
subp>agraph 7,b71 ! applicable          

sector-specific ag5cy2 or  7,b7 9 ! case
 ( a cov]$ entity t is regulat$ by a    
,f$]al entity1 su* ,f$]al entity4  7#b7 
,appropriate ag5cy head ,! t]m          
appropriate ag5cy head means1 ) respect 
to a cov]$ entity1 ! head ( !           
appropriate ag5cy4  7#c7 ,cov]$ entity  
,! t]m cov]$ entity means an entity     
id5tifi$ pursuant to section #i7;a7 (   
,executive ,ord] #acfcf ( ,febru>y #ab1 
#bjac 7#gh ,f$4 ,reg4 #aagdb71 relat+ to
 id5tification ( critical infra/ructure 
:]e a cyb]security incid5t c\ld         
reasonably result 9 cata/rophic regional
 or national effects on public heal? or 
safety1 economic security1 or national  
security4  7#d7 ,appropriate            
congressional committees ,! t]m         
appropriate congressional committees    
means-- 7,a7 ! ,select ,committee on    
,intellig5ce ( ! ,s5ate2  7,b7 !        
,p]man5t ,select ,committee on          
,intellig5ce ( ! ,h\se (                
,repres5tatives2  7,c7 ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs

 ( ! ,s5ate2  7,d7 ! ,committee on      
,homel& ,security ( ! ,h\se (           
,repres5tatives2  7,e7 ! ,committee on  
,en]gy & ,natural ,res\rces ( ! ,s5ate2 
7,f7 ! ,committee on ,en]gy & ,comm]ce (
 ! ,h\se ( ,repres5tatives2 &  7,g7 !   
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation ( ! ,s5ate4  7#e7       
,secret>y ,! t]m ,secret>y means !      
,secret>y ( ! ,dep>tm5t ( ,homel&       
,security4  7b7 ,/atus ( exi/+ cyb]     
incid5t report+  7#a7 ,9 g5]al ,no lat] 
?an #abj days aft] ! date ( ! enactm5t (
 ?is ,act1 ! ,secret>y1 9 conjunction ) 
! appropriate ag5cy head 7z ! case may  
be71 %all submit to ! appropriate       
congressional committees describ+ !     
ext5t to :i* ea* cov]$ entity reports   
significant intrusions ( in=mation      
sy/ems ess5tial to ! op]ation ( critical
 infra/ructure to ! ,dep>tm5t ( ,homel& 
,security or ! appropriate ag5cy head 9 
a timely mann]4  7#b7 ,=m ,! report     
submitt$ "u p>agraph 7#a7 may include a 
classifi$ annex4  7c7 ,mitigation       

/rategy requir$ = critical infra/ructure
 at greate/ risk  7#a7 ,9 g5]al ,no lat]
 ?an #ahj days aft] ! date ( ! enactm5t 
( ?is ,act1 ! ,secret>y1 9 conjunction )
 ! appropriate ag5cy head 7z ! case may 
be71 %all conduct an assessm5t & develop
 a /rategy t addresses ea* ( ! cov]$    
entities1 to ensure t1 to ! greate/     
ext5t feasible1 a cyb] security incid5t 
affect+ su* entity w\ld no long]        
reasonably result 9 cata/rophic regional
 or national effects on public heal? or 
safety1 economic security1 or national  
security4  7#b7 ,elem5ts ,! /rategy     
submitt$ by ! ,secret>y ) respect to a  
cov]$ entity %all include ! foll[+3     
7,a7 ,an assessm5t ( :e!r ea* entity    
%\ld be requir$ to report cyb] security 
incid5ts4  7,b7 ,a description ( any    
id5tifi$ security gaps t mu/ be         
address$4  7,c7 ,additional /atutory    
au?ority necess>y to r$uce ! likelihood 
t a cyb] incid5t c\ld cause cata/rophic 
regional or national effects on public  
heal? or safety1 economic security1 or  

national security4  7#c7 ,submittal ,!  
,secret>y %all submit to ! appropriate  
congressional committees ! assessm5t &  
/rategy requir$ by p>agraph 7#a74  7#d7 
,=m ,! assessm5t & /rategy submitt$ "u  
p>agraph 7#c7 may ea* include a         
classifi$ annex4  #djh4 ,/opp+ !        
fraudul5t sale ( f9ancial in=mation ( p 
( ! ,unit$ ,/ates ,section #ajbi7;h7 (  
title #ah1 ,unit$ ,/ates ,code1 is am5d$
 by /rik+ title if-- & all t foll[s     
?r\gh !refrom4 & ins]t+ title if ! (f5se
 involves an access device issu$1 own$1 
manag$1 or controll$ by a f9ancial      
in/itution1 acc\nt issu]1 cr$it c>d     
sy/em memb]1 or o!r entity organiz$ "u !
 laws ( ! ,unit$ ,/ates1 or any ,/ate1 !
 ,di/rict ( ,columbia1 or o!r ,t]ritory 
( ! ,unit$ ,/ates44  #dji4 ,effective   
p]iod  7a7 ,9 g5]al ,except z provid$ 9 
subsection 7b71 ?is ,act & ! am5dm5ts   
made by ?is ,act %all be 9 effect dur+ !
 #aj-ye> p]iod beg9n+ on ! date ( !     
enactm5t ( ?is ,act4  7b7 ,exception ,) 
respect to any action au?oriz$ by ?is   

,act or in=mation obta9$ pursuant to an 
action au?oriz$ by ?is ,act1 :i* occurr$
 be=e ! date on :i* ! provisions ref]r$ 
to 9 subsection 7a7 cease to h effect1 !
 provisions ( ?is ,act %all cont9ue 9   
effect4  ,pass$ ! ,s5ate ,octob] #bg1   
#bjae4,secret>y