,,ii ,cal5d> ,no4 #bh #aad? ,,congress  
#a/ ,session  ,s4 #ged  ,,9 ,,! ,,s5ate 
,,( ,,! ,,unit$ ,,/ates  ,m>* #ag1      
#bjae,mr4 ,burr1 f ! ,select ,committee 
on ,intellig5ce1 report$ ! foll[+       
orig9al bill2 :i* 0 read twice & plac$  
on ! cal5d>  ,a ,,bill  ,to improve     
cyb]security 9 ! ,unit$ ,/ates ?r\gh    
enhanc$ %>+ ( in=mation ab\t            
cyb]security ?reats1 & = o!r purposes4  
#a4 ,%ort title2 table ( cont5ts  7a7   
,%ort title ,?is ,act may be cit$ z !   
,cyb]security ,in=mation ,%>+ ,act (    
#bjae4  7b7 ,table ( cont5ts ,! table ( 
cont5ts ( ?is ,act is z foll[s3 ,sec4   
#a4 ,%ort title2 table ( cont5ts4,sec4  
#b4 ,def9itions4,sec4 #c4 ,%>+ (        
in=mation by ! ,f$]al ,gov]nm5t4,sec4   
#d4 ,au?orizations = prev5t+1 detect+1  
analyz+1 & mitigat+ cyb]security        
?reats4,sec4 #e4 ,%>+ ( cyb] ?reat      
indicators & def5sive measures ) !      
,f$]al ,gov]nm5t4,sec4 #f4 ,protection f
 liability4,sec4 #g4 ,ov]sight (        
,gov]nm5t activities4,sec4 #h4          

,con/ruction & preemption4,sec4 #i4     
,report on cyb]security ?reats4,sec4    
#aj4 ,con=m+ am5dm5ts4  #b4 ,def9itions 
,9 ?is ,act3  7#a7 ,ag5cy ,! t]m ag5cy  
has ! mean+ giv5 ! t]m 9 section #cejb (
 title #dd1 ,unit$ ,/ates ,code4  7#b7  
,antitru/ laws ,! t]m antitru/ laws--   
7,a7 has ! mean+ giv5 ! t]m 9 section #a
 ( ! ,clayton ,act 7#ae ,u4,s4,c4 #ab72 
7,b7 includes section #e ( ! ,f$]al     
,trade ,commission ,act 7#ae ,u4,s4,c4  
#de7 to ! ext5t t section #e ( t ,act   
applies to unfair me?ods ( competition2 
&  7,c7 includes any ,/ate law t has !  
same int5t & effect z ! laws "u         
subp>agraphs 7,a7 & 7,b74  7#c7         
,appropriate ,f$]al entities ,! t]m     
appropriate ,f$]al entities means !     
foll[+3 7,a7 ,! ,dep>tm5t ( ,comm]ce4   
7,b7 ,! ,dep>tm5t ( ,def5se4  7,c7 ,!   
,dep>tm5t ( ,en]gy4  7,d7 ,! ,dep>tm5t (
 ,homel& ,security4  7,e7 ,! ,dep>tm5t (
 ,ju/ice4  7,f7 ,! ,dep>tm5t ( !        
,treasury4  7,g7 ,! ,(fice ( ! ,director
 ( ,national ,intellig5ce4  7#d7        

,cyb]security purpose ,! t]m            
cyb]security purpose means ! purpose (  
protect+ an in=mation sy/em or in=mation
 t is /or$ on1 process$ by1 or transit+ 
an in=mation sy/em f a cyb]security     
?reat or security vuln]ability4  7#e7   
,cyb]security ?reat  7,a7 ,9 g5]al      
,except z provid$ 9 subp>agraph 7,b71 ! 
t]m cyb]security ?reat means an action1 
n protect$ by ! ,fir/ ,am5dm5t to !     
,con/itution ( ! ,unit$ ,/ates1 on or   
?r\gh an in=mation sy/em t may result 9 
an unau?oriz$ ef=t to adv]sely impact ! 
security1 availability1 confid5tiality1 
or integrity ( an in=mation sy/em or    
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em4  7,b7      
,exclusion ,! t]m cyb]security ?reat    
does n include any action t solely      
involves a violation ( a consum] t]m (  
s]vice or a consum] lic5s+ agreem5t4    
7#f7 ,cyb] ?reat indicator ,! t]m cyb]  
?reat indicator means in=mation t is    
necess>y to describe or id5tify-- 7,a7  
malici\s reconnaissance1 includ+        

anomal\s patt]ns ( communications t     
appe> to be transmitt$ = ! purpose (    
ga!r+ te*nical in=mation relat$ to a    
cyb]security ?reat or security          
vuln]ability2  7,b7 a me?od ( defeat+ a 
security control or exploitation ( a    
security vuln]ability2  7,c7 a security 
vuln]ability1 includ+ anomal\s activity 
t appe>s to indicate ! exi/5ce ( a      
security vuln]ability2  7,d7 a me?od (  
caus+ a us] ) legitimate access to an   
in=mation sy/em or in=mation t is /or$  
on1 process$ by1 or transit+ an         
in=mation sy/em to unwitt+ly enable !   
defeat ( a security control or          
exploitation ( a security vuln]ability2 
7,e7 malici\s cyb] comm& & control2     
7,f7 ! actual or pot5tial h>m caus$ by  
an incid5t1 includ+ a description ( !   
in=mation exfiltrat$ z a result ( a     
p>ticul> cyb]security ?reat2  7,g7 any  
o!r attribute ( a cyb]security ?reat1 if
 disclosure ( su* attribute is n o!rwise
 prohibit$ by law2 or  7,h7 any         
comb9ation !re(4  7#g7 ,def5sive measure

  7,a7 ,9 g5]al ,except z provid$ 9     
subp>agraph 7,b71 ! t]m def5sive measure
 means an action1 device1 proc$ure1     
signature1 te*nique1 or o!r measure     
appli$ to an in=mation sy/em or         
in=mation t is /or$ on1 process$ by1 or 
transit+ an in=mation sy/em t detects1  
prev5ts1 or mitigates a kn[n or suspect$
 cyb]security ?reat or security         
vuln]ability4  7,b7 ,exclusion ,! t]m   
def5sive measure does n include a       
measure t de/roys1 r5d]s unusable1 or   
sub/antially h>ms an in=mation sy/em or 
data on an in=mation sy/em n belong+    
to--  7i7 ! private entity op]at+ !     
measure2 or  7ii7 ano!r entity or ,f$]al
 entity t is au?oriz$ to provide cons5t 
& has provid$ cons5t to t private entity
 = op]ation ( su* measure4  7#h7 ,entity
  7,a7 ,9 g5]al ,except z o!rwise       
provid$ 9 ?is p>agraph1 ! t]m entity    
means any private entity1 non-,f$]al    
gov]nm5t ag5cy or dep>tm5t1 or ,/ate1   
tribal1 or local gov]nm5t 7includ+ a    
political subdivision1 dep>tm5t1 or     

compon5t !re(74  7,b7 ,inclusions ,! t]m
 entity includes a gov]nm5t ag5cy or    
dep>tm5t ( ! ,di/rict ( ,columbia1 !    
,commonweal? ( ,pu]to ,rico1 ! ,virg9   
,isl&s1 ,guam1 ,am]ican ,samoa1 !       
,nor!rn ,m>iana ,isl&s1 & any o!r       
t]ritory or possession ( ! ,unit$       
,/ates4  7,c7 ,exclusion ,! t]m entity  
does n include a =eign p[] z def9$ 9    
section #aja ( ! ,=eign ,intellig5ce    
,surveillance ,act ( #aigh 7#ej         
,u4,s4,c4 #ahja74  7#i7 ,f$]al entity ,!
 t]m ,f$]al entity means a dep>tm5t or  
ag5cy ( ! ,unit$ ,/ates or any compon5t 
( su* dep>tm5t or ag5cy4  7#aj7         
,in=mation sy/em ,! t]m in=mation       
sy/em-- 7,a7 has ! mean+ giv5 ! t]m 9   
section #cejb ( title #dd1 ,unit$ ,/ates
 ,code2 &  7,b7 includes indu/rial      
control sy/ems1 su* z sup]visory control
 & data acquisition sy/ems1 di/ribut$   
control sy/ems1 & programmable logic    
controll]s4  7#aa7 ,local gov]nm5t ,!   
t]m local gov]nm5t means any bor\gh1    
city1 c\nty1 p>i%1 t[n1 t[n%ip1 village1

 or o!r political subdivision ( a ,/ate4
  7#ab7 ,malici\s cyb] comm& & control  
,! t]m malici\s cyb] comm& & control    
means a me?od = unau?oriz$ remote       
id5tification (1 access to1 or use (1 an
 in=mation sy/em or in=mation t is /or$ 
on1 process$ by1 or transit+ an         
in=mation sy/em4  7#ac7 ,malici\s       
reconnaissance ,! t]m malici\s          
reconnaissance means a me?od = actively 
prob+ or passively monitor+ an in=mation
 sy/em = ! purpose ( disc]n+ security   
vuln]abilities ( ! in=mation sy/em1 if  
su* me?od is associat$ ) a kn[n or      
suspect$ cyb]security ?reat4  7#ad7     
,monitor ,! t]m monitor means to        
acquire1 id5tify1 or scan1 or to        
possess1 in=mation t is /or$ on1        
process$ by1 or transit+ an in=mation   
sy/em4  7#ae7 ,private entity  7,a7 ,9  
g5]al ,except z o!rwise provid$ 9 ?is   
p>agraph1 ! t]m private entity means any
 p]son or private gr\p1 organization1   
proprietor%ip1 p>tn]%ip1 tru/1          
coop]ative1 corporation1 or o!r         

comm]cial or nonpr(it entity1 includ+ an
 (fic]1 employee1 or ag5t !re(4  7,b7   
,inclusion ,! t]m private entity        
includes a ,/ate1 tribal1 or local      
gov]nm5t p]=m+ electric utility s]vices4
  7,c7 ,exclusion ,! t]m private entity 
does n include a =eign p[] z def9$ 9    
section #aja ( ! ,=eign ,intellig5ce    
,surveillance ,act ( #aigh 7#ej         
,u4,s4,c4 #ahja74  7#af7 ,security      
control ,! t]m security control means ! 
managem5t1 op]ational1 & te*nical       
controls us$ to protect aga9/ an        
unau?oriz$ ef=t to adv]sely affect !    
confid5tiality1 integrity1 &            
availability ( an in=mation sy/em or its
 in=mation4  7#ag7 ,security            
vuln]ability ,! t]m security            
vuln]ability means any attribute (      
h>dw>e1 s(tw>e1 process1 or proc$ure t  
c\ld enable or facilitate ! defeat ( a  
security control4  7#ah7 ,tribal ,! t]m 
tribal has ! mean+ giv5 ! t]m ,indian   
tribe 9 section #d ( ! ,indian          
,self-,det]m9ation & ,education         

,assi/ance ,act 7#be ,u4,s4,c4 #dej;b74 
#c4 ,%>+ ( in=mation by ! ,f$]al        
,gov]nm5t  7a7 ,9 g5]al ,consi/5t ) !   
protection ( classifi$ in=mation1       
intellig5ce s\rces & me?ods1 & privacy &
 civil lib]ties1 ! ,director ( ,national
 ,intellig5ce1 ! ,secret>y ( ,homel&    
,security1 ! ,secret>y ( ,def5se1 & !   
,attorney ,g5]al1 9 consultation ) !    
heads ( ! appropriate ,f$]al entities1  
%all develop & promulgate proc$ures to  
facilitate & promote--  7#a7 ! timely   
%>+ ( classifi$ cyb] ?reat indicators 9 
! possession ( ! ,f$]al ,gov]nm5t )     
cle>$ repres5tatives ( relevant         
entities2  7#b7 ! timely %>+ ) relevant 
entities ( cyb] ?reat indicators or     
in=mation 9 ! possession ( ! ,f$]al     
,gov]nm5t t may be declassifi$ & %>$ at 
an unclassifi$ level2  7#c7 ! %>+ )     
relevant entities1 or ! public if       
appropriate1 ( unclassifi$1 includ+     
controll$ unclassifi$1 cyb] ?reat       
indicators 9 ! possession ( ! ,f$]al    
,gov]nm5t2 &  7#d7 ! %>+ ) entities1 if 

appropriate1 ( in=mation 9 ! possession 
( ! ,f$]al ,gov]nm5t ab\t cyb]security  
?reats to su* entities to prev5t or     
mitigate adv]se effects f su*           
cyb]security ?reats4  7b7 ,developm5t ( 
proc$ures  7#a7 ,9 g5]al ,! proc$ures   
develop$ & promulgat$ "u subsection 7a7 
%all-- 7,a7 ensure ! ,f$]al ,gov]nm5t   
has & ma9ta9s ! capability to %>e cyb]  
?reat indicators 9 real "t consi/5t ) ! 
protection ( classifi$ in=mation2  7,b7 
incorporate1 to ! greate/ ext5t         
practicable1 exi/+ processes & exi/+    
roles & responsibilities ( ,f$]al &     
non-,f$]al entities = in=mation %>+ by !
 ,f$]al ,gov]nm5t1 includ+ sector       
specific in=mation %>+ & analysis c5t]s2
  7,c7 include proc$ures = notify+      
entities t h receiv$ a cyb] ?reat       
indicator f a ,f$]al entity "u ?is ,act 
t is kn[n or det]m9$ to be 9 error or 9 
contrav5tion ( ! requirem5ts ( ?is ,act 
or ano!r provision ( ,f$]al law or      
policy ( su* error or contrav5tion2     
7,d7 include requirem5ts = ,f$]al       

entities receiv+ cyb] ?reat indicators  
or def5sive measures to implem5t &      
utilize security controls to protect    
aga9/ unau?oriz$ access to or           
acquisition ( su* cyb] ?reat indicators 
or def5sive measures2 &  7,e7 include   
proc$ures t require a ,f$]al entity1    
prior to ! %>+ ( a cyb] ?reat           
indicator-- 7i7 to review su* cyb] ?reat
 indicator to assess :e!r su* cyb] ?reat
 indicator conta9s any in=mation t su*  
,f$]al entity kn[s at ! "t ( %>+ to be  
p]sonal in=mation ( or id5tify+ a       
specific p]son n directly relat$ to a   
cyb]security ?reat & remove su*         
in=mation2 or  7ii7 to implem5t &       
utilize a te*nical capability configur$ 
to remove any p]sonal in=mation ( or    
id5tify+ a specific p]son n directly    
relat$ to a cyb]security ?reat4  7#b7   
,coord9ation ,9 develop+ ! proc$ures    
requir$ "u ?is section1 ! ,director (   
,national ,intellig5ce1 ! ,secret>y (   
,homel& ,security1 ! ,secret>y (        
,def5se1 & ! ,attorney ,g5]al %all      

coord9ate ) appropriate ,f$]al entities1
 includ+ ! ,national ,laboratories 7z   
def9$ 9 section #b ( ! ,en]gy ,policy   
,act ( #bjje 7#db ,u4,s4,c4 #aehja771 to
 ensure t effective protocols are       
implem5t$ t w facilitate & promote ! %>+
 ( cyb] ?reat indicators by ! ,f$]al    
,gov]nm5t 9 a timely mann]4  7c7        
,submittal to ,congress ,n lat] ?an #fj 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ,national           
,intellig5ce1 9 consultation ) ! heads (
 ! appropriate ,f$]al entities1 %all    
submit to ,congress ! proc$ures requir$ 
by subsection 7a74  #d4 ,au?orizations =
 prev5t+1 detect+1 analyz+1 & mitigat+  
cyb]security ?reats  7a7 ,au?orization =
 monitor+  7#a7 ,9 g5]al ,not)/&+ any   
o!r provision ( law1 a private entity   
may1 = cyb]security purposes1 monitor-- 
7,a7 an in=mation sy/em ( su* private   
entity2  7,b7 an in=mation sy/em ( ano!r
 entity1 ^u ! au?orization & writt5     
cons5t ( su* o!r entity2  7,c7 an       
in=mation sy/em ( a ,f$]al entity1 ^u ! 

au?orization & writt5 cons5t ( an       
au?oriz$ repres5tative ( ! ,f$]al       
entity2 &  7,d7 in=mation t is /or$ on1 
process$ by1 or transit+ an in=mation   
sy/em monitor$ by ! private entity "u   
?is p>agraph4  7#b7 ,con/ruction ,no?+ 9
 ?is subsection %all be con/ru$-- 7,a7  
to au?orize ! monitor+ ( an in=mation   
sy/em1 or ! use ( any in=mation obta9$  
?r\gh su* monitor+1 o!r ?an z provid$ 9 
?is ,act2 or  7,b7 to limit o!rwise     
lawful activity4  7b7 ,au?orization =   
op]ation ( def5sive measures  7#a7 ,9   
g5]al ,not)/&+ any o!r provision ( law1 
a private entity may1 = cyb]security    
purposes1 op]ate a def5sive measure t is
 appli$ to--  7,a7 an in=mation sy/em ( 
su* private entity 9 ord] to protect !  
rights or prop]ty ( ! private entity2   
7,b7 an in=mation sy/em ( ano!r entity  
^u writt5 cons5t ( su* entity = op]ation
 ( su* def5sive measure to protect !    
rights or prop]ty ( su* entity2 &  7,c7 
an in=mation sy/em ( a ,f$]al entity ^u 
writt5 cons5t ( an au?oriz$             

repres5tative ( su* ,f$]al entity =     
op]ation ( su* def5sive measure to      
protect ! rights or prop]ty ( ! ,f$]al  
,gov]nm5t4  7#b7 ,con/ruction ,no?+ 9   
?is subsection %all be con/ru$-- 7,a7 to
 au?orize ! use ( a def5sive measure o!r
 ?an z provid$ 9 ?is subsection2 or     
7,b7 to limit o!rwise lawful activity4  
7c7 ,au?orization = %>+ or receiv+ cyb] 
?reat indicators or def5sive measures   
7#a7 ,9 g5]al ,except z provid$ 9       
p>agraph 7#b7 & not)/&+ any o!r         
provision ( law1 an entity may1 = !     
purposes p]mitt$ "u ?is ,act & consi/5t 
) ! protection ( classifi$ in=mation1   
%>e )1 or receive f1 any o!r entity or !
 ,f$]al ,gov]nm5t a cyb] ?reat indicator
 or def5sive measure4  7#b7 ,lawful     
re/riction ,an entity receiv+ a cyb]    
?reat indicator or def5sive measure f   
ano!r entity or ,f$]al entity %all      
comply ) o!rwise lawful re/rictions     
plac$ on ! %>+ or use ( su* cyb] ?reat  
indicator or def5sive measure by ! %>+  
entity or ,f$]al entity4  7#c7          

,con/ruction ,no?+ 9 ?is subsection %all
 be con/ru$-- 7,a7 to au?orize ! %>+ or 
receiv+ ( a cyb] ?reat indicator or     
def5sive measure o!r ?an z provid$ 9 ?is
 subsection2 or  7,b7 to limit o!rwise  
lawful activity4  7d7 ,protection & use 
( in=mation  7#a7 ,security ( in=mation 
,an entity monitor+ an in=mation sy/em1 
op]at+ a def5sive measure1 or provid+ or
 receiv+ a cyb] ?reat indicator or      
def5sive measure "u ?is section %all    
implem5t & utilize a security control to
 protect aga9/ unau?oriz$ access to or  
acquisition ( su* cyb] ?reat indicator  
or def5sive measure4  7#b7 ,removal (   
c]ta9 p]sonal in=mation ,an entity %>+ a
 cyb] ?reat indicator pursuant to ?is   
,act %all1 prior to su* %>+--  7,a7     
review su* cyb] ?reat indicator to      
assess :e!r su* cyb] ?reat indicator    
conta9s any in=mation t ! entity kn[s at
 ! "t ( %>+ to be p]sonal in=mation ( or
 id5tify+ a specific p]son n directly   
relat$ to a cyb]security ?reat & remove 
su* in=mation2 or  7,b7 implem5t &      

utilize a te*nical capability configur$ 
to remove any in=mation conta9$ )9 su*  
indicator t ! entity kn[s at ! "t ( %>+ 
to be p]sonal in=mation ( or id5tify+ a 
specific p]son n directly relat$ to a   
cyb]security ?reat4  7#c7 ,use ( cyb]   
?reat indicators & def5sive measures by 
entities  7,a7 ,9 g5]al ,consi/5t ) ?is 
,act1 a cyb] ?reat indicator or def5sive
 measure %>$ or receiv$ "u ?is section  
may1 = cyb]security purposes--  7i7 be  
us$ by an entity to monitor or op]ate a 
def5sive measure on-- 7,i7 an in=mation 
sy/em ( ! entity2 or  7,,ii7 an         
in=mation sy/em ( ano!r entity or a     
,f$]al entity ^u ! writt5 cons5t ( t o!r
 entity or t ,f$]al entity2 &  7ii7 be  
o!rwise us$1 reta9$1 & fur!r %>$ by an  
entity subject to-- 7,i7 an o!rwise     
lawful re/riction plac$ by ! %>+ entity 
or ,f$]al entity on su* cyb] ?reat      
indicator or def5sive measure2 or       
7,,ii7 an o!rwise applicable provision (
 law4  7,b7 ,con/ruction ,no?+ 9 ?is    
p>agraph %all be con/ru$ to au?orize !  

use ( a cyb] ?reat indicator or def5sive
 measure o!r ?an z provid$ 9 ?is        
section4  7#d7 ,use ( cyb] ?reat        
indicators by ,/ate1 tribal1 or local   
gov]nm5t  7,a7 ,law en=cem5t use  7i7   
,prior writt5 cons5t ,except z provid$ 9
 clause 7ii71 a cyb] ?reat indicator %>$
 ) a ,/ate1 tribal1 or local gov]nm5t "u
 ?is section may1 ) ! prior writt5      
cons5t ( ! entity %>+ su* indicator1 be 
us$ by a ,/ate1 tribal1 or local        
gov]nm5t = ! purpose ( prev5t+1         
inve/igat+1 or prosecut+ any ( ! (f5ses 
describ$ 9 section #e7;d77#e77;,a77vi74 
7ii7 ,oral cons5t ,if exig5t            
circum/ances prev5t obta9+ writt5 cons5t
 "u clause 7i71 su* cons5t may be       
provid$ orally ) subsequ5t docum5tation 
( ! cons5t4  7,b7 ,exemption f          
disclosure ,a cyb] ?reat indicator %>$ )
 a ,/ate1 tribal1 or local gov]nm5t "u  
?is section %all be--  7i7 deem$        
volunt>ily %>$ in=mation2 &  7ii7 exempt
 f disclosure "u any ,/ate1 tribal1 or  
local law requir+ disclosure ( in=mation

 or records4  7,c7 ,/ate1 tribal1 &     
local regulatory au?ority  7i7 ,9 g5]al 
,except z provid$ 9 clause 7ii71 a cyb] 
?reat indicator or def5sive measure %>$ 
) a ,/ate1 tribal1 or local gov]nm5t "u 
?is ,act %all n be directly us$ by any  
,/ate1 tribal1 or local gov]nm5t to     
regulate1 includ+ an en=cem5t action1 ! 
lawful activity ( any entity1 includ+ an
 activity relat+ to monitor+1 op]at+ a  
def5sive measure1 or %>+ ( a cyb] ?reat 
indicator4  7ii7 ,regulatory au?ority   
specifically relat+ to prev5tion or     
mitigation ( cyb]security ?reats ,a cyb]
 ?reat indicator or def5sive measures   
%>$ z describ$ 9 clause 7i7 may1        
consi/5t ) a ,/ate1 tribal1 or local    
gov]nm5t regulatory au?ority            
specifically relat+ to ! prev5tion or   
mitigation ( cyb]security ?reats to     
in=mation sy/ems1 in=m ! developm5t or  
implem5tation ( a regulation relat+ to  
su* in=mation sy/ems4  7e7 ,antitru/    
exemption  7#a7 ,9 g5]al ,except z      
provid$ 9 section #h7;e71 x %all n be   

consid]$ a violation ( any provision (  
antitru/ laws = #b or m private entities
 to ex*ange or provide a cyb] ?reat     
indicator1 or assi/ance relat+ to !     
prev5tion1 inve/igation1 or mitigation (
 a cyb]security ?reat1 = cyb]security   
purposes "u ?is ,act4  7#b7             
,applicability ,p>agraph 7#a7 %all apply
 only to in=mation t is ex*ang$ or      
assi/ance provid$ 9 ord] to assi/ )--   
7,a7 facilitat+ ! prev5tion1            
inve/igation1 or mitigation ( a         
cyb]security ?reat to an in=mation sy/em
 or in=mation t is /or$ on1 process$ by1
 or transit+ an in=mation sy/em2 or     
7,b7 communicat+ or disclos+ a cyb]     
?reat indicator to help prev5t1         
inve/igate1 or mitigate ! effect ( a    
cyb]security ?reat to an in=mation sy/em
 or in=mation t is /or$ on1 process$ by1
 or transit+ an in=mation sy/em4  7f7   
,no "r or b5efit ,! %>+ ( a cyb] ?reat  
indicator ) an entity "u ?is ,act %all n
 create a "r or b5efit to simil>        
in=mation by su* entity or any o!r      

entity4  #e4 ,%>+ ( cyb] ?reat          
indicators & def5sive measures ) !      
,f$]al ,gov]nm5t  7a7 ,requirem5t =     
policies & proc$ures  7#a7 ,int]im      
policies & proc$ures ,n lat] ?an #fj    
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,attorney ,g5]al1 9 coord9ation 
) ! heads ( ! appropriate ,f$]al        
entities1 %all develop & submit to      
,congress int]im policies & proc$ures   
relat+ to ! receipt ( cyb] ?reat        
indicators & def5sive measures by !     
,f$]al ,gov]nm5t4  7#b7 ,f9al policies &
 proc$ures ,n lat] ?an #ahj days aft] ! 
date ( ! enactm5t ( ?is ,act1 !         
,attorney ,g5]al %all1 9 coord9ation ) !
 heads ( ! appropriate ,f$]al entities1 
promulgate f9al policies & proc$ures    
relat+ to ! receipt ( cyb] ?reat        
indicators & def5sive measures by !     
,f$]al ,gov]nm5t4  7#c7 ,requirem5ts    
conc]n+ policies & proc$ures ,consi/5t )
 ! guidel9es requir$ by subsection 7b71 
! policies & proc$ures develop$ &       
promulgat$ "u ?is subsection %all--     

7,a7 ensure t cyb] ?reat indicators are 
%>$ ) ! ,f$]al ,gov]nm5t by any entity  
pursuant to section #d7;c7 ?r\gh !      
real-"t process describ$ 9 subsection   
7c7 ( ?is section--  7i7 are %>$ 9 an   
automat$ mann] ) all ( ! appropriate    
,f$]al entities2  7ii7 are n subject to 
any delay1 modification1 or any o!r     
action t c\ld imp$e real-"t receipt by  
all ( ! appropriate ,f$]al entities2 &  
7iii7 may be provid$ to o!r ,f$]al      
entities2  7,b7 ensure t cyb] ?reat     
indicators %>$ ) ! ,f$]al ,gov]nm5t by  
any entity pursuant to section #d 9 a   
mann] o!r ?an ! real-"t process describ$
 9 subsection 7c7 ( ?is section--  7i7  
are %>$ z quickly z op]ationally        
practicable ) all ( ! appropriate ,f$]al
 entities2  7ii7 are n subject to any   
unnecess>y delay1 int]f]5ce1 or any o!r 
action t c\ld imp$e receipt by all ( !  
appropriate ,f$]al entities2 &  7iii7   
may be provid$ to o!r ,f$]al entities2  
7,c7 consi/5t ) ?is ,act1 any o!r       
applicable provisions ( law1 & ! fair   

in=mation practice pr9ciples set =? 9   
app5dix ,a ( ! docum5t entitl$ ,national
 ,/rategy = ,tru/$ ,id5tities 9         
,cyb]space & publi%$ by ! ,presid5t 9   
,april #bjaa1 gov]n ! ret5tion1 use1 &  
dissem9ation by ! ,f$]al ,gov]nm5t (    
cyb] ?reat indicators %>$ ) ! ,f$]al    
,gov]nm5t "u ?is ,act1 includ+ ! ext5t1 
if any1 to :i* su* cyb] ?reat indicators
 may be us$ by ! ,f$]al ,gov]nm5t2 &    
7,d7 ensure !re is-- 7i7 an audit       
capability2 &  7ii7 appropriate         
sanctions 9 place = (fic]s1 employees1  
or ag5ts ( a ,f$]al entity :o kn[+ly &  
willfully conduct activities "u ?is ,act
 9 an unau?oriz$ mann]4  7#d7 ,guidel9es
 = entities %>+ cyb] ?reat indicators ) 
,f$]al ,gov]nm5t  7,a7 ,9 g5]al ,n lat] 
?an #fj days aft] ! date ( ! enactm5t ( 
?is ,act1 ! ,attorney ,g5]al %all       
develop & make publicly available       
guidance to assi/ entities & promote %>+
 ( cyb] ?reat indicators ) ,f$]al       
entities "u ?is ,act4  7,b7 ,cont5ts ,! 
guidel9es develop$ & made publicly      

available "u subp>agraph 7,a7 %all      
include guidance on ! foll[+3  7i7      
,id5tification ( types ( in=mation t    
w\ld qualify z a cyb] ?reat indicator "u
 ?is ,act t w\ld be unlikely to include 
p]sonal in=mation ( or id5tify+ a       
specific p]son n directly relat$ to a   
cyb] security ?reat4  7ii7              
,id5tification ( types ( in=mation      
protect$ "u o!rwise applicable privacy  
laws t are unlikely to be directly      
relat$ to a cyb]security ?reat4  7iii7  
,su* o!r matt]s z ! ,attorney ,g5]al    
consid]s appropriate = entities %>+ cyb]
 ?reat indicators ) ,f$]al entities "u  
?is ,act4  7b7 ,privacy & civil lib]ties
  7#a7 ,guidel9es ( ,attorney ,g5]al ,n 
lat] ?an #fj days aft] ! date ( !       
enactm5t ( ?is ,act1 ! ,attorney ,g5]al 
%all1 9 coord9ation ) heads ( !         
appropriate ,f$]al entities & 9         
consultation ) (fic]s designat$ "u      
section #ajfb ( ! ,national ,security   
,intellig5ce ,re=m ,act ( #bjjd 7#db    
,u4,s4,c4 #bjjj;ee-#a71 develop1 submit 

to ,congress1 & make available to !     
public int]im guidel9es relat+ to       
privacy & civil lib]ties :i* %all gov]n 
! receipt1 ret5tion1 use1 & dissem9ation
 ( cyb] ?reat indicators by a ,f$]al    
entity obta9$ 9 connection ) activities 
au?oriz$ 9 ?is ,act4  7#b7 ,f9al        
guidel9es  7,a7 ,9 g5]al ,n lat] ?an    
#ahj days aft] ! date ( ! enactm5t ( ?is
 ,act1 ! ,attorney ,g5]al %all1 9       
coord9ation ) heads ( ! appropriate     
,f$]al entities & 9 consultation )      
(fic]s designat$ "u section #ajfb ( !   
,national ,security ,intellig5ce ,re=m  
,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a7
 & su* private entities ) indu/ry       
exp]tise z ! ,attorney ,g5]al consid]s  
relevant1 promulgate f9al guidel9es     
relat+ to privacy & civil lib]ties :i*  
%all gov]n ! receipt1 ret5tion1 use1 &  
dissem9ation ( cyb] ?reat indicators by 
a ,f$]al entity obta9$ 9 connection )   
activities au?oriz$ 9 ?is ,act4  7,b7   
,p]iodic review ,! ,attorney ,g5]al     
%all1 9 coord9ation ) heads ( !         

appropriate ,f$]al entities & 9         
consultation ) (fic]s & private entities
 describ$ 9 subp>agraph 7,a71           
p]iodically review ! guidel9es          
promulgat$ "u subp>agraph 7,a74  7#c7   
,cont5t ,! guidel9es requir$ by         
p>agraphs 7#a7 & 7#b7 %all1 consi/5t ) !
 ne$ to protect in=mation sy/ems f      
cyb]security ?reats & mitigate          
cyb]security ?reats--  7,a7 limit !     
impact on privacy & civil lib]ties (    
activities by ! ,f$]al ,gov]nm5t "u ?is 
,act2  7,b7 limit ! receipt1 ret5tion1  
use1 & dissem9ation ( cyb] ?reat        
indicators conta9+ p]sonal in=mation (  
or id5tify+ specific p]sons1 includ+ by 
e/abli%+--  7i7 a process = ! timely    
de/ruction ( su* in=mation t is kn[n n  
to be directly relat$ to uses au?oriz$  
"u ?is ,act2 &  7ii7 specific           
limitations on ! l5g? ( any p]iod 9 :i* 
a cyb] ?reat indicator may be reta9$2   
7,c7 include requirem5ts to safegu>d    
cyb] ?reat indicators conta9+ p]sonal   
in=mation ( or id5tify+ specific p]sons 

f unau?oriz$ access or acquisition1     
includ+ appropriate sanctions =         
activities by (fic]s1 employees1 or     
ag5ts ( ! ,f$]al ,gov]nm5t 9            
contrav5tion ( su* guidel9es2  7,d7     
include proc$ures = notify+ entities &  
,f$]al entities if in=mation receiv$    
pursuant to ?is section is kn[n or      
det]m9$ by a ,f$]al entity receiv+ su*  
in=mation n to con/itute a cyb] ?reat   
indicator2  7,e7 protect !              
confid5tiality ( cyb] ?reat indicators  
conta9+ p]sonal in=mation ( or id5tify+ 
specific p]sons to ! greate/ ext5t      
practicable & require recipi5ts to be   
in=m$ t su* indicators may only be us$ =
 purposes au?oriz$ "u ?is ,act2 &  7,f7 
include /eps t may be ne$$ s t          
dissem9ation ( cyb] ?reat indicators is 
consi/5t ) ! protection ( classifi$ &   
o!r s5sitive national security          
in=mation4  7c7 ,capability & process )9
 ! ,dep>tm5t ( ,homel& ,security  7#a7  
,9 g5]al ,n lat] ?an #ij days aft] !    
date ( ! enactm5t ( ?is ,act1 !         

,secret>y ( ,homel& ,security1 9        
coord9ation ) ! heads ( ! appropriate   
,f$]al entities1 %all develop & implem5t
 a capability & process )9 ! ,dep>tm5t (
 ,homel& ,security t--  7,a7 %all accept
 f any entity 9 real "t cyb] ?reat      
indicators & def5sive measures1 pursuant
 to ?is section2  7,b7 %all1 ^u         
submittal ( ! c]tification "u p>agraph  
7#b7 t su* capability & process fully & 
effectively op]ates z describ$ 9 su*    
p>agraph1 be ! process by :i* ! ,f$]al  
,gov]nm5t receives cyb] ?reat indicators
 & def5sive measures "u ?is ,act t are  
%>$ by a private entity ) ! ,f$]al      
,gov]nm5t ?r\gh electronic mail or m$ia1
 an int]active =m on an ,int]net        
website1 or a real "t1 automat$ process 
betwe5 in=mation sy/ems except--  7i7   
communications betwe5 a ,f$]al entity & 
a private entity reg>d+ a previ\sly %>$ 
cyb] ?reat indicator2 &  7ii7           
communications by a regulat$ entity )   
su* entity's ,f$]al regulatory au?ority 
reg>d+ a cyb]security ?reat2  7,c7      

ensures t all ( ! appropriate ,f$]al    
entities receive 9 an automat$ mann] su*
 cyb] ?reat indicators %>$ ?r\gh !      
real-"t process )9 ! ,dep>tm5t ( ,homel&
 ,security2  7,d7 is 9 compliance ) !   
policies1 proc$ures1 & guidel9es requir$
 by ?is section2 &  7,e7 does n limit or
 prohibit o!rwise lawful disclosures (  
communications1 records1 or o!r         
in=mation1 includ+--  7i7 report+ ( kn[n
 or suspect$ crim9al activity1 by an    
entity to any o!r entity or a ,f$]al    
entity2  7ii7 volunt>y or legally       
compell$ p>ticipation 9 a ,f$]al        
inve/igation2 &  7iii7 provid+ cyb]     
?reat indicators or def5sive measures z 
"p ( a /atutory or au?oriz$ contractual 
requirem5t4  7#b7 ,c]tification ,n lat] 
?an #aj days prior to ! implem5tation ( 
! capability & process requir$ by       
p>agraph 7#a71 ! ,secret>y ( ,homel&    
,security %all1 9 consultation ) ! heads
 ( ! appropriate ,f$]al entities1 c]tify
 to ,congress :e!r su* capability &     
process fully & effectively op]ates--   

7,a7 z ! process by :i* ! ,f$]al        
,gov]nm5t receives f any entity a cyb]  
?reat indicator or def5sive measure "u  
?is ,act2 &  7,b7 9 accordance ) !      
policies1 proc$ures1 & guidel9es        
develop$ "u ?is section4  7#c7 ,public  
notice & access ,! ,secret>y ( ,homel&  
,security %all ensure !re is public     
notice (1 & access to1 ! capability &   
process develop$ & implem5t$ "u p>agraph
 7#a7 s t--  7,a7 any entity may %>e    
cyb] ?reat indicators & def5sive        
measures ?r\gh su* process ) ! ,f$]al   
,gov]nm5t2 &  7,b7 all ( ! appropriate  
,f$]al entities receive su* cyb] ?reat  
indicators & def5sive measures 9 real "t
 ) receipt ?r\gh ! process )9 !         
,dep>tm5t ( ,homel& ,security4  7#d7    
,o!r ,f$]al entities ,! process develop$
 & implem5t$ "u p>agraph 7#a7 %all      
ensure t o!r ,f$]al entities receive 9 a
 timely mann] any cyb] ?reat indicators 
& def5sive measures %>$ ) ! ,f$]al      
,gov]nm5t ?r\gh su* process4  7#e7      
,report on developm5t & implem5tation   

7,a7 ,9 g5]al ,n lat] ?an #fj days aft] 
! date ( ! enactm5t ( ?is ,act1 !       
,secret>y ( ,homel& ,security %all      
submit to ,congress a report on !       
developm5t & implem5tation ( !          
capability & process requir$ by p>agraph
 7#a71 includ+ a description ( su*      
capability & process & ! public notice  
(1 & access to1 su* process4  7,b7      
,classifi$ annex ,! report requir$ by   
subp>agraph 7,a7 %all be submitt$ 9     
unclassifi$ =m1 b may include a         
classifi$ annex4  7d7 ,in=mation %>$ )  
or provid$ to ! ,f$]al ,gov]nm5t  7#a7  
,no waiv] ( privilege or protection ,!  
provision ( cyb] ?reat indicators &     
def5sive measures to ! ,f$]al ,gov]nm5t 
"u ?is ,act %all n con/itute a waiv] (  
any applicable privilege or protection  
provid$ by law1 includ+ trade secret    
protection4  7#b7 ,propriet>y in=mation 
,consi/5t ) section #d7;c77#b71 a cyb]  
?reat indicator or def5sive measure     
provid$ by an entity to ! ,f$]al        
,gov]nm5t "u ?is ,act %all be consid]$ !

 comm]cial1 f9ancial1 & propriet>y      
in=mation ( su* entity :5 s designat$ by
 ! orig9at+ entity or a ?ird p>ty act+ 9
 accordance ) ! writt5 au?orization ( ! 
orig9at+ entity4  7#c7 ,exemption f     
disclosure ,cyb] ?reat indicators &     
def5sive measures provid$ to ! ,f$]al   
,gov]nm5t "u ?is ,act %all be--  7,a7   
deem$ volunt>ily %>$ in=mation & exempt 
f disclosure "u section #eeb ( title #e1
 ,unit$ ,/ates ,code1 & any ,/ate1      
tribal1 or local law requir+ disclosure 
( in=mation or records2 &  7,b7 )held1  
)\t discretion1 f ! public "u section   
#eeb7;b77#c77;,b7 ( title #e1 ,unit$    
,/ates ,code1 & any ,/ate1 tribal1 or   
local provision ( law requir+ disclosure
 ( in=mation or records4  7#d7 ,ex p>te 
communications ,! provision ( a cyb]    
?reat indicator or def5sive measure to !
 ,f$]al ,gov]nm5t "u ?is ,act %all n be 
subject to a rule ( any ,f$]al ag5cy or 
dep>tm5t or any judicial doctr9e reg>d+ 
ex p>te communications ) a decisionmak+ 
(ficial4  7#e7 ,disclosure1 ret5tion1 & 

use  7,a7 ,au?oriz$ activities ,cyb]    
?reat indicators & def5sive measures    
provid$ to ! ,f$]al ,gov]nm5t "u ?is    
,act may be disclos$ to1 reta9$ by1 &   
us$ by1 consi/5t ) o!rwise applicable   
provisions ( ,f$]al law1 any ,f$]al     
ag5cy or dep>tm5t1 compon5t1 (fic]1     
employee1 or ag5t ( ! ,f$]al ,gov]nm5t  
solely =--  7i7 a cyb]security purpose2 
7ii7 ! purpose ( id5tify+ a cyb]security
 ?reat1 includ+ ! s\rce ( su*           
cyb]security ?reat1 or a security       
vuln]ability2  7iii7 ! purpose (        
id5tify+ a cyb]security ?reat involv+ ! 
use ( an in=mation sy/em by a =eign     
adv]s>y or t]rori/2  7iv7 ! purpose (   
respond+ to1 or o!rwise prev5t+ or      
mitigat+1 an imm95t ?reat ( dea?1 s]i\s 
bodily h>m1 or s]i\s economic h>m1      
includ+ a t]rori/ act or a use ( a      
weapon ( mass de/ruction2  7v7 ! purpose
 ( respond+ to1 or o!rwise prev5t+ or   
mitigat+1 a s]i\s ?reat to a m9or1      
includ+ sexual exploitation & ?reats to 
physical safety2 or  7vi7 ! purpose (   

prev5t+1 inve/igat+1 disrupt+1 or       
prosecut+ an (f5se aris+ out ( a ?reat  
describ$ 9 clause 7iv7 or any ( ! (f5ses
 li/$ 9--  7,i7 section                 
#ceei7;c77#b77;,f7 ( title #ah1 ,unit$  
,/ates ,code 7relat+ to s]i\s viol5t    
felonies72  7,,ii7 sections #ajbh ?r\gh 
#ajcj ( su* title 7relat+ to fraud &    
id5tity !ft72  7,,iii7 *apt] #cg ( su*  
title 7relat+ to espionage & c5sor%ip72 
&  7,,iv7 *apt] #ij ( su* title 7relat+ 
to protection ( trade secrets74  7,b7   
,prohibit$ activities ,cyb] ?reat       
indicators & def5sive measures provid$  
to ! ,f$]al ,gov]nm5t "u ?is ,act %all n
 be disclos$ to1 reta9$ by1 or us$ by   
any ,f$]al ag5cy or dep>tm5t = any use n
 p]mitt$ "u subp>agraph 7,a74  7,c7     
,privacy & civil lib]ties ,cyb] ?reat   
indicators & def5sive measures provid$  
to ! ,f$]al ,gov]nm5t "u ?is ,act %all  
be reta9$1 us$1 & dissem9at$ by ! ,f$]al
 ,gov]nm5t--  7i7 9 accordance ) !      
policies1 proc$ures1 & guidel9es requir$
 by subsections 7a7 & 7b72  7ii7 9 a    

mann] t protects f unau?oriz$ use or    
disclosure any cyb] ?reat indicators t  
may conta9 p]sonal in=mation ( or       
id5tify+ specific p]sons2 &  7iii7 9 a  
mann] t protects ! confid5tiality ( cyb]
 ?reat indicators conta9+ p]sonal       
in=mation ( or id5tify+ a specific      
p]son4  7,d7 ,f$]al regulatory au?ority 
7i7 ,9 g5]al ,except z provid$ 9 clause 
7ii71 cyb] ?reat indicators & def5sive  
measures provid$ to ! ,f$]al ,gov]nm5t  
"u ?is ,act %all n be directly us$ by   
any ,f$]al1 ,/ate1 tribal1 or local     
gov]nm5t to regulate1 includ+ an        
en=cem5t action1 ! lawful activities (  
any entity1 includ+ activities relat+ to
 monitor+1 op]at+ def5sive measures1 or 
%>+ cyb] ?reat indicators4  7ii7        
,exceptions  7,i7 ,regulatory au?ority  
specifically relat+ to prev5tion or     
mitigation ( cyb]security ?reats ,cyb]  
?reat indicators & def5sive measures    
provid$ to ! ,f$]al ,gov]nm5t "u ?is    
,act may1 consi/5t ) ,f$]al or ,/ate    
regulatory au?ority specifically relat+ 

to ! prev5tion or mitigation (          
cyb]security ?reats to in=mation sy/ems1
 in=m ! developm5t or implem5tation (   
regulations relat+ to su* in=mation     
sy/ems4  7,,ii7 ,proc$ures develop$ &   
implem5t$ "u ?is ,act ,clause 7i7 %all n
 apply to proc$ures develop$ & implem5t$
 "u ?is ,act4  #f4 ,protection f        
liability  7a7 ,monitor+ ( in=mation    
sy/ems ,no cause ( action %all lie or be
 ma9ta9$ 9 any c\rt aga9/ any private   
entity1 & su* action %all be promptly   
dismiss$1 = ! monitor+ ( in=mation      
sy/ems & in=mation "u section #d7;a7 t  
is conduct$ 9 accordance ) ?is ,act4    
7b7 ,%>+ or receipt ( cyb] ?reat        
indicators ,no cause ( action %all lie  
or be ma9ta9$ 9 any c\rt aga9/ any      
entity1 & su* action %all be promptly   
dismiss$1 = ! %>+ or receipt ( cyb]     
?reat indicators or def5sive measures "u
 section #d7;c7 if--  7#a7 su* %>+ or   
receipt is conduct$ 9 accordance ) ?is  
,act2 &  7#b7 9 a case 9 :i* a cyb]     
?reat indicator or def5sive measure is  

%>$ ) ! ,f$]al ,gov]nm5t1 ! cyb] ?reat  
indicator or def5sive measure is %>$ 9 a
 mann] t is consi/5t ) section          
#e7;c77#a77;,b7 & ! %>+ or receipt1 z ! 
case may be1 occurs aft] ! e>li] (--    
7,a7 ! date on :i* ! int]im policies &  
proc$ures are submitt$ to ,congress "u  
section #e7;a77#a72 or  7,b7 ! date t is
 #fj days aft] ! date ( ! enactm5t ( ?is
 ,act4  7c7 ,con/ruction ,no?+ 9 ?is    
section %all be con/ru$--  7#a7 to      
require dismissal ( a cause ( action    
aga9/ an entity t has engag$ 9 gross    
neglig5ce or willful misconduct 9 !     
c\rse ( conduct+ activities au?oriz$ by 
?is ,act2 or  7#b7 to und]m9e or limit !
 availability ( o!rwise applicable      
common law or /atutory def5ses4  #g4    
,ov]sight ( ,gov]nm5t activities  7a7   
,bi5nial report on implem5tation  7#a7  
,9 g5]al ,n lat] ?an #a ye> aft] ! date 
( ! enactm5t ( ?is ,act1 & n less       
frequ5tly ?an once e #b ye>s !reaft]1 ! 
heads ( ! appropriate ,f$]al entities   
%all jo9tly submit & ! ,inspector ,g5]al

 ( ! ,dep>tm5t ( ,homel& ,security1 !   
,inspector ,g5]al ( ! ,intellig5ce      
,community1 ! ,inspector ,g5]al ( !     
,dep>tm5t ( ,ju/ice1 ! ,inspector ,g5]al
 ( ! ,dep>tm5t ( ,def5se1 & ! ,inspector
 ,g5]al ( ! ,dep>tm5t ( ,en]gy1 9       
consultation ) ! ,c\ncil ( ,inspectors  
,g5]al on ,f9ancial ,ov]sight1 %all     
jo9tly submit to ,congress a detail$    
report conc]n+ ! implem5tation ( ?is    
,act4  7#b7 ,cont5ts ,ea* report        
submitt$ "u p>agraph 7#a7 %all include !
 foll[+3 7,a7 ,an assessm5t ( !         
suffici5cy ( ! policies1 proc$ures1 &   
guidel9es requir$ by section #e 9 ensur+
 t cyb] ?reat indicators are %>$        
effectively & responsibly )9 ! ,f$]al   
,gov]nm5t4  7,b7 ,an evaluation ( !     
effectiv5ess ( real-"t in=mation %>+    
?r\gh ! capability & process develop$ "u
 section #e7;c71 includ+ any imp$im5ts  
to su* real-"t %>+4  7,c7 ,an assessm5t 
( ! suffici5cy ( ! proc$ures develop$ "u
 section #c 9 ensur+ t cyb] ?reat       
indicators 9 ! possession ( ! ,f$]al    

,gov]nm5t are %>$ 9 a timely & adequate 
mann] ) appropriate entities1 or1 if    
appropriate1 are made publicly          
available4  7,d7 ,an assessm5t ( :e!r   
cyb] ?reat indicators h be5 prop]ly     
classifi$ & an acc\nt+ ( ! numb] (      
security cle>ances au?oriz$ by ! ,f$]al 
,gov]nm5t = ! purposes ( ?is ,act4  7,e7
 ,a review ( ! type ( cyb] ?reat        
indicators %>$ ) ! ,f$]al ,gov]nm5t "u  
?is ,act1 includ+ ! foll[+3  7i7 ,!     
degree to :i* su* in=mation may impact !
 privacy & civil lib]ties ( specific    
p]sons4  7ii7 ,a quantitative &         
qualitative assessm5t ( ! impact ( ! %>+
 ( su* cyb] ?reat indicators ) ! ,f$]al 
,gov]nm5t on privacy & civil lib]ties ( 
specific p]sons4  7iii7 ,! adequacy (   
any /eps tak5 by ! ,f$]al ,gov]nm5t to  
r$uce su* impact4  7,f7 ,a review (     
actions tak5 by ! ,f$]al ,gov]nm5t bas$ 
on cyb] ?reat indicators %>$ ) ! ,f$]al 
,gov]nm5t "u ?is ,act1 includ+ !        
appropriat5ess ( any subsequ5t use or   
dissem9ation ( su* cyb] ?reat indicators

 by a ,f$]al entity "u section #e4  7,g7
 ,a description ( any significant       
violations ( ! requirem5ts ( ?is ,act by
 ! ,f$]al ,gov]nm5t4  7,h7 ,a summ>y ( !
 numb] & type ( entities t receiv$      
classifi$ cyb] ?reat indicators f !     
,f$]al ,gov]nm5t "u ?is ,act & an       
evaluation ( ! risks & b5efits ( %>+ su*
 cyb] ?reat indicators4  7#c7           
,recomm5dations ,ea* report submitt$ "u 
p>agraph 7#a7 may include recomm5dations
 = improvem5ts or modifications to !    
au?orities & processes "u ?is ,act4     
7#d7 ,=m ( report ,ea* report requir$ by
 p>agraph 7#a7 %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  7b7 ,reports on       
privacy & civil lib]ties  7#a7 ,bi5nial 
report f ,privacy & ,civil ,lib]ties    
,ov]sight ,bo>d ,n lat] ?an #b ye>s aft]
 ! date ( ! enactm5t ( ?is ,act & n less
 frequ5tly ?an once e #b ye>s !reaft]1 !
 ,privacy & ,civil ,lib]ties ,ov]sight  
,bo>d %all submit to ,congress & !      
,presid5t a report provid+--  7,a7 an   

assessm5t ( ! effect on privacy & civil 
lib]ties by ! type ( activities c>ri$   
out "u ?is ,act2 &  7,b7 an assessm5t ( 
! suffici5cy ( ! policies1 proc$ures1 & 
guidel9es e/abli%$ pursuant to section  
#e 9 address+ conc]ns relat+ to privacy 
& civil lib]ties4  7#b7 ,bi5nial report 
( ,inspectors g5]al  7,a7 ,9 g5]al ,n   
lat] ?an #b ye>s aft] ! date ( !        
enactm5t ( ?is ,act & n less frequ5tly  
?an once e #b ye>s !reaft]1 ! ,inspector
 ,g5]al ( ! ,dep>tm5t ( ,homel&         
,security1 ! ,inspector ,g5]al ( !      
,intellig5ce ,community1 ! ,inspector   
,g5]al ( ! ,dep>tm5t ( ,ju/ice1 !       
,inspector ,g5]al ( ! ,dep>tm5t (       
,def5se1 & ! ,inspector ,g5]al ( !      
,dep>tm5t ( ,en]gy %all1 9 consultation 
) ! ,c\ncil ( ,inspectors ,g5]al on     
,f9ancial ,ov]sight1 jo9tly submit to   
,congress a report on ! receipt1 use1 & 
dissem9ation ( cyb] ?reat indicators &  
def5sive measures t h be5 %>$ ) ,f$]al  
entities "u ?is ,act4  7,b7 ,cont5ts    
,ea* report submitt$ "u subp>agraph 7,a7

 %all include ! foll[+3 7i7 ,a review ( 
! types ( cyb] ?reat indicators %>$ )   
,f$]al entities4  7ii7 ,a review ( !    
actions tak5 by ,f$]al entities z a     
result ( ! receipt ( su* cyb] ?reat     
indicators4  7iii7 ,a li/ ( ,f$]al      
entities receiv+ su* cyb] ?reat         
indicators4  7iv7 ,a review ( ! %>+ (   
su* cyb] ?reat indicators among ,f$]al  
entities to id5tify inappropriate b>ri]s
 to %>+ in=mation4  7#c7 ,recomm5dations
 ,ea* report submitt$ "u ?is subsection 
may include su* recomm5dations z !      
,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d1 ) respect to a report submitt$ "u
 p>agraph 7#a71 or ! ,inspectors ,g5]al 
ref]r$ to 9 p>agraph 7#b77;,a71 )       
respect to a report submitt$ "u p>agraph
 7#b71 may h = improvem5ts or           
modifications to ! au?orities "u ?is    
,act4  7#d7 ,=m ,ea* report requir$ "u  
?is subsection %all be submitt$ 9       
unclassifi$ =m1 b may include a         
classifi$ annex4  #h4 ,con/ruction &    
preemption  7a7 ,o!rwise lawful         

disclosures ,no?+ 9 ?is ,act %all be    
con/ru$-- 7#a7 to limit or prohibit     
o!rwise lawful disclosures (            
communications1 records1 or o!r         
in=mation1 includ+ report+ ( kn[n or    
suspect$ crim9al activity1 by an entity 
to any o!r entity or ! ,f$]al ,gov]nm5t 
"u ?is ,act2 or  7#b7 to limit or       
prohibit o!rwise lawful use ( su*       
disclosures by any ,f$]al entity1 ev5 :5
 su* o!rwise lawful disclosures         
duplicate or replicate disclosures made 
"u ?is ,act4  7b7 ,:i/le bl[]           
protections ,no?+ 9 ?is ,act %all be    
con/ru$ to prohibit or limit !          
disclosure ( in=mation protect$ "u      
section #bcjb7;b77#h7 ( title #e1 ,unit$
 ,/ates ,code 7gov]n+ disclosures (     
illegality1 wa/e1 fraud1 abuse1 or      
public heal? or safety ?reats71 section 
#gbaa ( title #e1 ,unit$ ,/ates ,code   
7gov]n+ disclosures to ,congress71      
section #ajcd ( title #aj1 ,unit$ ,/ates
 ,code 7gov]n+ disclosure to ,congress  
by memb]s ( ! milit>y71 section #aajd ( 

! ,national ,security ,act ( #aidg 7#ej 
,u4,s4,c4 #cbcd7 7gov]n+ disclosure by  
employees ( elem5ts ( ! intellig5ce     
community71 or any simil> provision (   
,f$]al or ,/ate law4  7c7 ,protection ( 
s\rces & me?ods ,no?+ 9 ?is ,act %all be
 con/ru$-- 7#a7 z creat+ any immunity   
aga9/1 or o!rwise affect+1 any action   
br\ght by ! ,f$]al ,gov]nm5t1 or any    
ag5cy or dep>tm5t !re(1 to en=ce any    
law1 executive ord]1 or proc$ure gov]n+ 
! appropriate h&l+1 disclosure1 or use (
 classifi$ in=mation2  7#b7 to affect ! 
conduct ( au?oriz$ law en=cem5t or      
intellig5ce activities2 or  7#c7 to     
modify ! au?ority ( a dep>tm5t or ag5cy 
( ! ,f$]al ,gov]nm5t to protect         
classifi$ in=mation & s\rces & me?ods & 
! national security ( ! ,unit$ ,/ates4  
7d7 ,relation%ip to o!r laws ,no?+ 9 ?is
 ,act %all be con/ru$ to affect any     
requirem5t "u any o!r provision ( law = 
an entity to provide in=mation to !     
,f$]al ,gov]nm5t4  7e7 ,prohibit$       
conduct ,no?+ 9 ?is ,act %all be con/ru$

 to p]mit price-fix+1 allocat+ a m>ket  
betwe5 competitors1 monopoliz+ or       
attempt+ to monopolize a m>ket1         
boycott+1 or ex*anges ( price or co/    
in=mation1 cu/om] li/s1 or in=mation    
reg>d+ future competitive plann+4  7f7  
,in=mation %>+ relation%ips ,no?+ 9 ?is 
,act %all be con/ru$-- 7#a7 to limit or 
modify an exi/+ in=mation %>+           
relation%ip2  7#b7 to prohibit a new    
in=mation %>+ relation%ip2  7#c7 to     
require a new in=mation %>+ relation%ip 
betwe5 any entity & ! ,f$]al ,gov]nm5t2 
or  7#d7 to require ! use ( ! capability
 & process )9 ! ,dep>tm5t ( ,homel&     
,security develop$ "u section #e7;c74   
7g7 ,pres]vation ( contractual          
obligations & rights ,no?+ 9 ?is ,act   
%all be con/ru$-- 7#a7 to am5d1 repeal1 
or sup]s$e any curr5t or future         
contractual agreem5t1 t]ms ( s]vice     
agreem5t1 or o!r contractual relation%ip
 betwe5 any entities1 or betwe5 any     
entity & a ,f$]al entity2 or  7#b7 to   
abrogate trade secret or intellectual   

prop]ty rights ( any entity or ,f$]al   
entity4  7h7 ,anti-,task+ re/riction    
,no?+ 9 ?is ,act %all be con/ru$ to     
p]mit ! ,f$]al ,gov]nm5t--  7#a7 to     
require an entity to provide in=mation  
to ! ,f$]al ,gov]nm5t2  7#b7 to         
condition ! %>+ ( cyb] ?reat indicators 
) an entity on su* entity's provision ( 
cyb] ?reat indicators to ! ,f$]al       
,gov]nm5t2 or  7#c7 to condition ! aw>d 
( any ,f$]al grant1 contract1 or pur*ase
 on ! provision ( a cyb] ?reat indicator
 to a ,f$]al entity4  7i7 ,no liability 
= non-,p>ticipation ,no?+ 9 ?is ,act    
%all be con/ru$ to subject any entity to
 liability = *oos+ n to engage 9 !      
volunt>y activities au?oriz$ 9 ?is ,act4
  7j7 ,use & ret5tion ( in=mation ,no?+ 
9 ?is ,act %all be con/ru$ to au?orize1 
or to modify any exi/+ au?ority (1 a    
dep>tm5t or ag5cy ( ! ,f$]al ,gov]nm5t  
to reta9 or use any in=mation %>$ "u ?is
 ,act = any use o!r ?an p]mitt$ 9 ?is   
,act4  7k7 ,f$]al preemption  7#a7 ,9   
g5]al ,?is ,act sup]s$es any /atute or  

o!r provision ( law ( a ,/ate or        
political subdivision ( a ,/ate t       
re/ricts or o!rwise expressly regulates 
an activity au?oriz$ "u ?is ,act4  7#b7 
,/ate law en=cem5t ,no?+ 9 ?is ,act %all
 be con/ru$ to sup]s$e any /atute or o!r
 provision ( law ( a ,/ate or political 
subdivision ( a ,/ate conc]n+ ! use (   
au?oriz$ law en=cem5t practices &       
proc$ures4  7l7 ,regulatory au?ority    
,no?+ 9 ?is ,act %all be con/ru$-- 7#a7 
to au?orize ! promulgation ( any        
regulations n specifically au?oriz$ by  
?is ,act2  7#b7 to e/abli% or limit any 
regulatory au?ority n specifically      
e/abli%$ or limit$ "u ?is ,act2 or  7#c7
 to au?orize regulatory actions t w\ld  
duplicate or conflict ) regulatory      
requirem5ts1 m&atory /&>ds1 or relat$   
processes "u ano!r provision ( ,f$]al   
law4  7m7 ,au?ority ( ,secret>y (       
,def5se ,to respond to cyb] attacks     
,no?+ 9 ?is ,act %all be con/ru$ to     
limit ! au?ority ( ! ,secret>y ( ,def5se
 to develop1 prep>e1 coord9ate1 or1 :5  

au?oriz$ by ! ,presid5t to d s1 conduct 
a milit>y cyb] op]ation 9 response to a 
malici\s cyb] activity c>ri$ out aga9/ !
 ,unit$ ,/ates or a ,unit$ ,/ates p]son 
by a =eign gov]nm5t or an organization  
sponsor$ by a =eign gov]nm5t or a       
t]rori/ organization4  #i4 ,report on   
cyb]security ?reats  7a7 ,report requir$
 ,n lat] ?an #ahj days aft] ! date ( !  
enactm5t ( ?is ,act1 ! ,director (      
,national ,intellig5ce1 9 coord9ation ) 
! heads ( o!r appropriate elem5ts ( !   
intellig5ce community1 %all submit to ! 
,select ,committee on ,intellig5ce ( !  
,s5ate & ! ,p]man5t ,select ,committee  
on ,intellig5ce ( ! ,h\se (             
,repres5tatives a report on cyb]security
 ?reats1 includ+ cyb] attacks1 !ft1 &   
data brea*es4  7b7 ,cont5ts ,! report   
requir$ by subsection 7a7 %all include !
 foll[+3 7#a7 ,an assessm5t ( ! curr5t  
intellig5ce %>+ & coop]ation            
relation%ips ( ! ,unit$ ,/ates ) o!r    
c\ntries reg>d+ cyb]security ?reats1    
includ+ cyb] attacks1 !ft1 & data       

brea*es1 direct$ aga9/ ! ,unit$ ,/ates &
 :i* ?reat5 ! ,unit$ ,/ates national    
security int]e/s & economy &            
intellectual prop]ty1 specifically      
id5tify+ ! relative utility ( su*       
relation%ips1 :i* elem5ts ( !           
intellig5ce community p>ticipate 9 su*  
relation%ips1 & :e!r & h[ su*           
relation%ips c\ld be improv$4  7#b7 ,a  
li/ & an assessm5t ( ! c\ntries &       
non/ate actors t are ! prim>y ?reats (  
c>ry+ out a cyb]security ?reat1 includ+ 
a cyb] attack1 !ft1 or data brea*1 aga9/
 ! ,unit$ ,/ates & :i* ?reat5 ! ,unit$  
,/ates national security1 economy1 &    
intellectual prop]ty4  7#c7 ,a          
description ( ! ext5t to :i* !          
capabilities ( ! ,unit$ ,/ates ,gov]nm5t
 to respond to or prev5t cyb]security   
?reats1 includ+ cyb] attacks1 !ft1 or   
data brea*es1 direct$ aga9/ ! ,unit$    
,/ates private sector are degrad$ by a  
delay 9 ! prompt notification by private
 entities ( su* ?reats or cyb] attacks1 
!ft1 & brea*es4  7#d7 ,an assessm5t (   

additional te*nologies or capabilities t
 w\ld enhance ! ability ( ! ,unit$      
,/ates to prev5t & to respond to        
cyb]security ?reats1 includ+ cyb]       
attacks1 !ft1 & data brea*es4  7#e7 ,an 
assessm5t ( any te*nologies or practices
 utiliz$ by ! private sector t c\ld be  
rapidly field$ to assi/ ! intellig5ce   
community 9 prev5t+ & respond+ to       
cyb]security ?reats4  7c7 ,=m ( report  
,! report requir$ by subsection 7a7 %all
 be made available 9 classifi$ &        
unclassifi$ =ms4  7d7 ,intellig5ce      
community def9$ ,9 ?is section1 ! t]m   
intellig5ce community has ! mean+ giv5 t
 t]m 9 section #c ( ! ,national         
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc74  #aj4 ,con=m+ am5dm5ts  7a7     
,public in=mation ,section #eeb7;b7 (   
title #e1 ,unit$ ,/ates ,code1 is       
am5d$-- 7#a7 9 p>agraph 7#h71 by /rik+  
or at ! end2  7#b7 9 p>agraph 7#i71 by  
/rik+ wells4 & ins]t+ wells2 or2 &  7#c7
 by ins]t+ aft] p>agraph 7#i7 ! foll[+3 
7#aj7 in=mation %>$ ) or provid$ to !   

,f$]al ,gov]nm5t pursuant to !          
,cyb]security ,in=mation ,%>+ ,act (    
#bjae4  4  7b7 ,modification (          
limitation on dissem9ation ( c]ta9      
in=mation conc]n+ p5etrations ( def5se  
contractor networks ,section            
#ida7;c77#c7 ( ! ,national ,def5se      
,au?orization ,act = ,fiscal ,ye> #bjac 
7,public ,law #aab-bci2 #aj ,u4,s4,c4   
#bbbd note7 is am5d$ by ins]t+ at ! end 
! foll[+3 ,! ,secret>y may %>e su*      
in=mation ) o!r ,f$]al entities if su*  
in=mation consi/s ( cyb] ?reat          
indicators & def5sive measures & su*    
in=mation is %>$ consi/5t ) ! policies &
 proc$ures promulgat$ by ! ,attorney    
,g5]al "u section #e ( ! ,cyb]security  
,in=mation ,%>+ ,act ( #bjae44  ,m>*    
#ag1 #bjae,read twice & plac$ on !      
cal5d>