,,ii ,cal5d> ,no4 #ejj #aaf? ,,congress 
#b;d ,session  ,s4 #cjde ,report ,no4   
#aaf-bdb ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,decemb] #ab1 #bjai,mr4       
,johnson 7= himself1 ,ms4 ,hassan1 ,mr4 
,wyd51 & ,mr4 ,k+7 introduc$ ! foll[+   
bill2 :i* 0 read twice & ref]r$ to !    
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs  ,july #bi1        
#bjbj,report$ by ,mr4 ,johnson1 ) an    
amendment,strike out all aft] ! enact+  
clause & ins]t ! "p pr9t$ 9 italic  ,a  
,,bill  ,to am5d ! ,homel& ,security    
,act ( #bjjb to protect ,unit$ ,/ates   
critical infra/ructure by ensur+ t !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy has ! legal tools x ne$s to     
notify private & public sector entities 
put at risk by cyb]security             
vuln]abilities 9 ! networks & sy/ems t  
control critical assets ( ! ,unit$      
,/ates4  #a4 ,%ort title ,?is ,act may  
be cit$ z ! ,cyb]security ,vuln]ability 
,id5tification & ,notification ,act (   
#bjai4  #b4 ,subpo5a au?ority  7a7 ,9   

g5]al ,section #bbji ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#fei7 is am5d$-- 7#a7 9 subsection 7a7--
 7,a7 by r$esignat+ p>agraph 7#f7 z     
p>agraph 7#g72 &  7,b7 by ins]t+ aft]   
p>agraph 7#e7 ! foll[+3  7#f7 ! t]m     
security vuln]ability has ! mean+ giv5 t
 t]m 9 section #ajb7ag7 ( !             
,cyb]security ,in=mation ,%>+ ,act (    
#bjae 7#f ,u4,s4,c4 #aeja7ag772  2  7#b7
 9 subsection 7c7-- 7,a7 9 p>agraph     
7#aj71 by /rik+ & at ! end2  7,b7 9     
p>agraph 7#aa71 by /rik+ ! p]iod at !   
end & ins]t+ 2 &2 &  7,c7 by add+ at !  
end ! foll[+3  7#ab7 detect+1 id5tify+1 
& receiv+ in=mation ab\t security       
vuln]abilities relat+ to critical       
infra/ructure 9 ! in=mation sy/ems &    
devices ( ,f$]al & non-,f$]al entities =
 a cyb]security purpose1 z def9$ 9      
section #ajb ( ! ,cyb]security          
,in=mation ,%>+ ,act ( #bjae 7#f        
,u4,s4,c4 #aeja74  2 &  7#c7 by add+ at 
! end ! foll[+3  7n7 ,subpo5a au?ority  
7#a7 ,def9ition ,9 ?is subsection1 ! t]m

 ent]prise device or sy/em-- 7,a7 means 
a device or sy/em commonly us$ to p]=m  
indu/rial1 comm]cial1 sci5tific1 or     
gov]nm5tal functions or processes t     
relate to critical infra/ructure1       
includ+ op]ational & indu/rial control  
sy/ems1 di/ribut$ control sy/ems1 &     
programmable logic controll]s2 &  7,b7  
does n include p]sonal devices & sy/ems1
 su* z consum] mobile devices1 home     
comput]s1 resid5tial wireless r\t]s1 or 
resid5tial int]net-enabl$ consum]       
devices4  7#b7 ,au?ority  7,a7 ,9 g5]al 
,if ! ,director id5tifies a sy/em       
connect$ to ! int]net ) a specific      
security vuln]ability & has reason to   
believe t ! security vuln]ability       
relates to critical infra/ructure &     
affects an ent]prise device or sy/em    
own$ or op]at$ by a ,f$]al or non-,f$]al
 entity1 & ! ,director is unable to     
id5tify ! entity at risk1 ! ,director   
may issue a subpo5a = ! production (    
in=mation necess>y to id5tify & notify !
 entity at risk1 9 ord] to c>ry out a   

function au?oriz$ "u subsection         
7c77#ab74  7,b7 ,limit on in=mation ,a  
subpo5a issu$ "u ! au?ority "u          
subp>agraph 7,a7 may only seek in=mation
 9 ! categories set =? 9 subp>agraphs   
7,a71 7,b71 7,d71 & 7,e7 ( section      
#bgjc7;c77#b7 ( title #ah1 ,unit$ ,/ates
 ,code4  7,c7 ,liability protections =  
disclos+ provid]s ,! provisions (       
section #bgjc7;e7 ( title #ah1 ,unit$   
,/ates ,code1 %all apply to any subpo5a 
issu$ "u ! au?ority "u subp>agraph 7,a74
  7#c7 ,coord9ation  7,a7 ,9 g5]al ,if !
 ,director decides to ex]cise ! subpo5a 
au?ority "u ?is subsection1 & 9 ! int]e/
 ( avoid+ int]f]5ce ) ongo+ law en=cem5t
 inve/igations1 ! ,director %all        
coord9ate ! issuance ( any su* subpo5a )
 ! ,dep>tm5t ( ,ju/ice1 includ+ ! ,f$]al
 ,bureau ( ,inve/igation1 pursuant to   
int]-ag5cy proc$ures :i* ! ,director1 9 
coord9ation ) ! ,attorney ,g5]al1 %all  
develop n lat] ?an #fj days aft] ! date 
( enactm5t ( ?is subsection4  7,b7      
,cont5ts ,! int]-ag5cy proc$ures        

develop$ "u ?is p>agraph %all provide t 
a subpo5a issu$ by ! ,director "u ?is   
subsection %all be-- 7i7 issu$ 9 ord] to
 c>ry out a function describ$ 9         
subsection 7c77#ab72 &  7ii7 subject to 
! limitations "u ?is subsection4  7#d7  
,noncompliance ,if any p]son1 p>tn]%ip1 
corporation1 association1 or entity     
fails to comply ) any duly s]v$ subpo5a 
issu$ "u ?is subsection1 ! ,director may
 reque/ t ! ,attorney ,g5]al seek       
en=cem5t ( ! subpo5a 9 any judicial     
di/rict 9 :i* su* p]son1 p>tn]%ip1      
corporation1 association1 or entity     
resides1 is f\nd1 or transacts bus9ess4 
7#e7 ,notice ,n lat] ?an #g days aft] ! 
date on :i* ! ,director receives        
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 ! ,director %all     
notify ! entity at risk id5tifi$ by     
in=mation obta9$ "u ! subpo5a reg>d+ !  
subpo5a & ! id5tifi$ vuln]ability4  7#f7
 ,au!ntication ,any subpo5a issu$ by !  
,director "u ?is subsection %all be     
au!nticat$ by ! electronic signature (  

an au?oriz$ repres5tative ( ! ,ag5cy or 
o!r comp>able symbol or process id5tify+
 ! ,ag5cy z ! s\rce ( ! subpo5a4  7#g7  
,proc$ures ,n lat] ?an #ij days aft] !  
date ( enactm5t ( ?is subsection1 !     
,director %all e/abli% int]nal proc$ures
 & associat$ tra9+1 applicable to       
employees & op]ations ( ! ,ag5cy1 reg>d+
 subpo5as issu$ "u ?is subsection1 :i*  
%all address-- 7,a7 ! protection ( &    
re/riction on dissem9ation ( nonpublic  
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 includ+ a requirem5t 
t ! ,ag5cy %all n dissem9ate nonpublic  
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection t id5tifies ! p>ty t  
is subject to ! subpo5a or ! entity at  
risk id5tifi$ by in=mation obta9$1      
unless-- 7i7 ! p>ty or entity cons5ts2  
or  7ii7 ! ,ag5cy id5tifies or is       
notifi$ ( a cyb]security incid5t involv+
 ! p>ty or entity1 :i* relates to !     
vuln]ability :i* l$ to ! issuance ( !   
subpo5a2  7,b7 ! re/riction on ! use (  
in=mation obta9$ ?r\gh ! subpo5a = a    

cyb]security purpose1 z def9$ 9 section 
#ajb ( ! ,cyb]security ,in=mation ,%>+  
,act ( #bjae 7#f ,u4,s4,c4 #aeja72  7,c7
 ! ret5tion & de/ruction ( nonpublic    
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 includ+-- 7i7        
imm$iate de/ruction ( in=mation obta9$  
?r\gh ! subpo5a t ! ,director det]m9es  
is unrelat$ to critical infra/ructure2 &
  7ii7 de/ruction ( any p]sonally       
id5tifiable in=mation n lat] ?an #f     
mon?s aft] ! date on :i* ! ,director    
receives in=mation obta9$ ?r\gh !       
subpo5a1 unless o!rwise agre$ to by !   
individual id5tifi$ by ! subpo5a        
respond5t2  7,d7 ! processes = provid+  
notice to ea* p>ty t is subject to !    
subpo5a & ea* entity at risk id5tifi$ by
 in=mation obta9$ pursuant to a subpo5a 
issu$ "u ?is subsection2 &  7,e7 !      
processes & crit]ia = conduct+ critical 
infra/ructure security risk assessm5ts  
to det]m9e :e!r a subpo5a is necess>y   
prior to be+ issu$ "u ?is subsection4   
7#h7 ,review ( proc$ures ,n lat] ?an #a 

ye> aft] ! date ( enactm5t ( ?is        
subsection1 ! ,privacy ,(fic] ( ! ,ag5cy
 %all-- 7,a7 review ! proc$ures develop$
 by ! ,director "u p>agraph 7#g7 to     
ensure t-- 7i7 ! proc$ures are consi/5t 
) fair in=mation practices2 &  7ii7 !   
op]ations ( ! ,ag5cy comply ) !         
proc$ures2 &  7,b7 notify ! ,committee  
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate & ! ,committee on   
,homel& ,security ( ! ,h\se (           
,repres5tatives ( ! results ( ! review4 
7#i7 ,publication ( in=mation ,n lat]   
?an #abj days aft] e/abli%+ ! int]nal   
proc$ures "u p>agraph 7#g71 ! ,director 
%all make publicly available in=mation  
reg>d+ ! subpo5a process "u ?is         
subsection1 includ+ reg>d+-- 7,a7 !     
purpose = subpo5as issu$ "u ?is         
subsection2  7,b7 ! subpo5a process2    
7,c7 ! crit]ia = ! critical             
infra/ructure security risk assessm5t   
conduct$ prior to issu+ a subpo5a2  7,d7
 policies & proc$ures on ret5tion & %>+ 
( data obta9$ by subpo5a2  7,e7         

guidel9es on h[ entities contact$ by !  
,director may respond to notice ( a     
subpo5a2 &  7,f7 ! proc$ures & policies 
( ! ,ag5cy develop$ "u p>agraph 7#g74   
7#aj7 ,annual reports ,! ,director %all 
annually submit to ! ,committee on      
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate & ! ,committee on ,homel&   
,security ( ! ,h\se ( ,repres5tatives a 
report 7:i* may include a classifi$     
annex b ) ! presumption (               
declassification7 on ! use ( subpo5as "u
 ?is subsection by ! ,director1 :i* %all
 include-- 7,a7 a discussion (-- 7i7 !  
effectiv5ess ( ! use ( subpo5as to      
mitigate critical infra/ructure security
 vuln]abilities2  7ii7 ! critical       
infra/ructure security risk assessm5t   
process conduct$ = subpo5as issu$ "u ?is
 subsection2  7iii7 ! numb] ( subpo5as  
issu$ "u ?is subsection by ! ,director  
dur+ ! prec$+ ye>2  7iv7 to ! ext5t     
practicable1 ! numb] ( vuln]able        
ent]prise devices or sy/ems mitigat$ "u 
?is subsection by ! ,ag5cy dur+ ! prec$+

 ye>2 &  7v7 ! numb] ( entities notifi$ 
by ! ,director "u ?is subsection1 & _!  
response1 dur+ ! previ\s ye>2 &  7,b7 = 
ea* subpo5a issu$ "u ?is subsection--   
7i7 ! s\rce ( ! security vuln]ability   
detect$1 id5tifi$1 or receiv$ by !      
,director2  7ii7 ! /eps tak5 to id5tify 
! entity at risk prior to issu+ !       
subpo5a2 &  7iii7 a description ( !     
outcome ( ! subpo5a1 includ+ discussion 
on ! resolution or mitigation ( !       
critical infra/ructure security         
vuln]ability4  7#aa7 ,publication ( !   
annual reports ,! ,director %all make a 
v]sion ( ! annual report requir$ by     
p>agraph 7#aj7 publicly available1 :i*  
%all1 at a m9imum1 include ! f9d+s      
describ$ 9 clause 7iii71 7iv7 & 7v7 (   
subp>agraph 7,a74  4  #a4 ,%ort title   
,?is ,act may be cit$ z ! ,cyb]security 
,vuln]ability ,id5tification &          
,notification ,act ( #bjbj4  #b4        
,subpo5a au?ority  7a7 ,9 g5]al ,section
 #bbji ( ! ,homel& ,security ,act (     
#bjjb 7#f ,u4,s4,c4 #fei7 is am5d$--    

7#a7 9 subsection 7a7-- 7,a7 9 p>agraph 
7#e71 by /rik+ & at ! end2  7,b7 by     
r$esignat+ p>agraph 7#f7 z p>agraph     
7#g72 &  7,c7 by ins]t+ aft] p>agraph   
7#e7 ! foll[+3  7#f7 ! t]m security     
vuln]ability has ! mean+ giv5 t t]m 9   
section #ajb7ag7 ( ! ,cyb]security      
,in=mation ,%>+ ,act ( #bjae 7#f        
,u4,s4,c4 #aeja7ag772 &  2  7#b7 9      
subsection 7c7-- 7,a7 9 p>agraph 7#aj71 
by /rik+ & at ! end2  7,b7 9 p>agraph   
7#aa71 by /rik+ ! p]iod at ! end &      
ins]t+ 2 &2 &  7,c7 by add+ at ! end !  
foll[+3  7#ab7 detect+1 id5tify+1 &     
receiv+ in=mation ab\t security         
vuln]abilities relat+ to critical       
infra/ructure 9 ! in=mation sy/ems &    
devices ( ,f$]al & non-,f$]al entities =
 a cyb]security purpose1 z def9$ 9      
section #ajb ( ! ,cyb]security          
,in=mation ,%>+ ,act ( #bjae 7#f        
,u4,s4,c4 #aeja74  2 &  7#c7 by add+ at 
! end ! foll[+3  7o7 ,subpo5a au?ority  
7#a7 ,def9ition ,9 ?is subsection1 ! t]m
 cov]$ device or sy/em-- 7,a7 means a   

device or sy/em commonly us$ to p]=m    
indu/rial1 comm]cial1 sci5tific1 or     
gov]nm5tal functions or processes t     
relate to critical infra/ructure1       
includ+ op]ational & indu/rial control  
sy/ems1 di/ribut$ control sy/ems1 &     
programmable logic controll]s2 &  7,b7  
does n include p]sonal devices & sy/ems1
 su* z consum] mobile devices1 home     
comput]s1 resid5tial wireless r\t]s1 or 
resid5tial int]net enabl$ consum]       
devices4  7#b7 ,au?ority  7,a7 ,9 g5]al 
,if ! ,director id5tifies a sy/em       
connect$ to ! int]net ) a specific      
security vuln]ability & has reason to   
believe t ! security vuln]ability       
relates to critical infra/ructure &     
affects a cov]$ device or sy/em own$ or 
op]at$ by a ,f$]al or non-,f$]al entity1
 & ! ,director is unable to id5tify !   
entity at risk1 ! ,director may issue a 
subpo5a = ! production ( in=mation      
necess>y to id5tify & notify ! entity at
 risk1 9 ord] to c>ry out a function    
au?oriz$ "u subsection 7c77#ab74  7,b7  

,limit on in=mation ,a subpo5a issu$ "u 
! au?ority "u subp>agraph 7,a7 may seek 
in=mation-- 7i7 only 9 ! categories set 
=? 9 subp>agraphs 7,a71 7,b71 7,d71 &   
7,e7 ( section #bgjc7;c77#b7 ( title    
#ah1 ,unit$ ,/ates ,code2 &  7ii7 = n m 
?an #bj cov]$ devices or sy/ems4  7,c7  
,liability protections = disclos+       
provid]s ,! provisions ( section        
#bgjc7;e7 ( title #ah1 ,unit$ ,/ates    
,code1 %all apply to any subpo5a issu$  
"u ! au?ority "u subp>agraph 7,a74  7#c7
 ,coord9ation  7,a7 ,9 g5]al ,if !      
,director decides to ex]cise ! subpo5a  
au?ority "u ?is subsection1 & 9 ! int]e/
 ( avoid+ int]f]5ce ) ongo+ law en=cem5t
 inve/igations1 ! ,director %all        
coord9ate ! issuance ( any su* subpo5a )
 ! ,dep>tm5t ( ,ju/ice1 includ+ ! ,f$]al
 ,bureau ( ,inve/igation1 pursuant to   
int]-ag5cy proc$ures :i* ! ,director1 9 
coord9ation ) ! ,attorney ,g5]al1 %all  
develop n lat] ?an #fj days aft] ! date 
( enactm5t ( ?is subsection4  7,b7      
,cont5ts ,! int]-ag5cy proc$ures        

develop$ "u ?is p>agraph %all provide t 
a subpo5a issu$ by ! ,director "u ?is   
subsection %all be-- 7i7 issu$ 9 ord] to
 c>ry out a function describ$ 9         
subsection 7c77#ab72 &  7ii7 subject to 
! limitations "u ?is subsection4  7#d7  
,noncompliance ,if any p]son1 p>tn]%ip1 
corporation1 association1 or entity     
fails to comply ) any duly s]v$ subpo5a 
issu$ "u ?is subsection1 ! ,director may
 reque/ t ! ,attorney ,g5]al seek       
en=cem5t ( ! subpo5a 9 any judicial     
di/rict 9 :i* su* p]son1 p>tn]%ip1      
corporation1 association1 or entity     
resides1 is f\nd1 or transacts bus9ess4 
7#e7 ,notice ,n lat] ?an #g days aft] ! 
date on :i* ! ,director receives        
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 ! ,director %all     
notify any entity id5tifi$ by in=mation 
obta9$ "u ! subpo5a reg>d+ ! subpo5a & !
 id5tifi$ vuln]ability4  7#f7           
,au!ntication  7,a7 ,9 g5]al ,any       
subpo5a issu$ by ! ,director "u ?is     
subsection %all be au!nticat$ ) a       

cryptographic digital signature ( an    
au?oriz$ repres5tative ( ! ,ag5cy1 or   
o!r comp>able successor te*nology1 t    
all[s ! recipi5t ( ! subpo5a to det]m9e 
t ! subpo5a 0 issu$ by ! ,ag5cy & has n 
be5 alt]$ or modifi$ s9ce x 0 issu$ by !
 ,ag5cy4  7,b7 ,invalid if n au!nticat$ 
,any subpo5a issu$ by ! ,director "u ?is
 subsection t is n au!nticat$ 9         
accordance ) subp>agraph 7,a7 %all n be 
consid]$ to be valid by ! recipi5t ( !  
subpo5a4  7#g7 ,proc$ures ,n lat] ?an   
#ij days aft] ! date ( enactm5t ( ?is   
subsection1 ! ,director %all e/abli%    
int]nal proc$ures & associat$ tra9+1    
applicable to employees & op]ations ( ! 
,ag5cy1 reg>d+ subpo5as issu$ "u ?is    
subsection1 :i* %all address-- 7,a7 !   
protection ( & re/riction on            
dissem9ation ( nonpublic in=mation      
obta9$ ?r\gh a subpo5a issu$ "u ?is     
subsection1 includ+ a requirem5t t !    
,ag5cy %all n dissem9ate nonpublic      
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection t id5tifies ! p>ty t  

is subject to ! subpo5a or ! entity at  
risk id5tifi$ by in=mation obta9$1      
except t ! ,ag5cy may %>e ! nonpublic   
in=mation ( ! entity at risk ) ano!r    
,f$]al ag5cy if-- 7i7 ! ,ag5cy id5tifies
 or is notifi$ ( a cyb]security incid5t 
involv+ ! entity1 :i* relates to !      
vuln]ability :i* l$ to ! issuance ( !   
subpo5a2  7ii7 ! ,director det]m9es t   
%>+ ! nonpublic in=mation ) ano!r ,f$]al
 ag5cy is necess>y to all[ t ,f$]al     
ag5cy to take a law en=cem5t or national
 security action or actions relat$ to   
mitigat+ or o!rwise resolv+ su* incid5t2
  7iii7 ! entity to :i* ! in=mation     
p]ta9s is notifi$ ( ! ,director's       
det]m9ation1 to ! ext5t practicable     
consi/5t ) national security or law     
en=cem5t int]e/s2 &  7iv7 ! entity      
cons5ts1 except t ! entity's cons5t %all
 n be requir$ if ano!r ,f$]al ag5cy     
id5tifies ! entity to ! ,ag5cy 9        
connection ) a suspect$ cyb]security    
incid5t2  7,b7 ! re/riction on ! use (  
in=mation obta9$ ?r\gh ! subpo5a = a    

cyb]security purpose1 z def9$ 9 section 
#ajb ( ! ,cyb]security ,in=mation ,%>+  
,act ( #bjae 7#f ,u4,s4,c4 #aeja72  7,c7
 ! ret5tion & de/ruction ( nonpublic    
in=mation obta9$ ?r\gh a subpo5a issu$  
"u ?is subsection1 includ+-- 7i7        
de/ruction ( in=mation obta9$ ?r\gh !   
subpo5a t ! ,director det]m9es is       
unrelat$ to critical infra/ructure      
imm$iately ^u provid+ notice to ! entity
 pursuant to p>agraph 7#e72 &  7ii7     
de/ruction ( any p]sonally id5tifiable  
in=mation n lat] ?an #f mon?s aft] !    
date on :i* ! ,director receives        
in=mation obta9$ ?r\gh ! subpo5a1 unless
 o!rwise agre$ to by ! individual       
id5tifi$ by ! subpo5a respond5t2  7,d7 !
 processes = provid+ notice to ea* p>ty 
t is subject to ! subpo5a & ea* entity  
id5tifi$ by in=mation obta9$ "u a       
subpo5a issu$ "u ?is subsection2  7,e7 !
 processes & crit]ia = conduct+ critical
 infra/ructure security risk assessm5ts 
to det]m9e :e!r a subpo5a is necess>y   
prior to be+ issu$ "u ?is subsection2 & 

7,f7 ! in=mation to be provid$ to an    
entity at risk at ! "t ( ! notice ( !   
vuln]ability1 :i* %all include-- 7i7 a  
discussion or /atem5t t respond+ to1 or 
subsequ5t engagem5t )1 ! ,ag5cy1 is     
volunt>y2 &  7ii7 to ! ext5t            
practicable1 in=mation reg>d+ ! process 
?r\gh :i* ! ,director id5tifies security
 vuln]abilities4  7#h7 ,review (        
proc$ures ,n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is subsection1 ! ,privacy
 ,(fic] ( ! ,ag5cy %all-- 7,a7 review ! 
proc$ures develop$ by ! ,director "u    
p>agraph 7#g7 to ensure t-- 7i7 !       
proc$ures are consi/5t ) fair in=mation 
practices2 &  7ii7 ! op]ations ( !      
,ag5cy comply ) ! proc$ures2 &  7,b7    
notify ! ,committee on ,homel& ,security
 & ,gov]nm5tal ,affairs ( ! ,s5ate & !  
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives ( ! results ( ! 
review4  7#i7 ,publication ( in=mation  
,n lat] ?an #abj days aft] e/abli%+ !   
int]nal proc$ures "u p>agraph 7#g71 !   
,director %all publi% in=mation on !    

website ( ! ,ag5cy reg>d+ ! subpo5a     
process "u ?is subsection1 includ+      
reg>d+-- 7,a7 ! purpose = subpo5as issu$
 "u ?is subsection2  7,b7 ! subpo5a     
process2  7,c7 ! crit]ia = ! critical   
infra/ructure security risk assessm5t   
conduct$ prior to issu+ a subpo5a2  7,d7
 policies & proc$ures on ret5tion & %>+ 
( data obta9$ by subpo5a2  7,e7         
guidel9es on h[ entities contact$ by !  
,director may respond to notice ( a     
subpo5a2 &  7,f7 ! proc$ures & policies 
( ! ,ag5cy develop$ "u p>agraph 7#g74   
7#aj7 ,annual reports ,! ,director %all 
annually submit to ! ,committee on      
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate & ! ,committee on ,homel&   
,security ( ! ,h\se ( ,repres5tatives a 
report 7:i* may include a classifi$     
annex b ) ! presumption (               
declassification7 on ! use ( subpo5as "u
 ?is subsection by ! ,director1 :i* %all
 include-- 7,a7 a discussion (-- 7i7 !  
effectiv5ess ( ! use ( subpo5as to      
mitigate critical infra/ructure security

 vuln]abilities2  7ii7 ! critical       
infra/ructure security risk assessm5t   
process conduct$ = subpo5as issu$ "u ?is
 subsection2  7iii7 ! numb] ( subpo5as  
issu$ "u ?is subsection by ! ,director  
dur+ ! prec$+ ye>2  7iv7 to ! ext5t     
practicable1 ! numb] ( vuln]able cov]$  
devices or sy/ems mitigat$ "u ?is       
subsection by ! ,ag5cy dur+ ! prec$+    
ye>2 &  7v7 ! numb] ( entities notifi$  
by ! ,director "u ?is subsection1 & _!  
response1 dur+ ! previ\s ye>2 &  7,b7 = 
ea* subpo5a issu$ "u ?is subsection--   
7i7 ! s\rce ( ! security vuln]ability   
detect$1 id5tifi$1 or receiv$ by !      
,director2  7ii7 ! /eps tak5 to id5tify 
! entity at risk prior to issu+ !       
subpo5a2 &  7iii7 a description ( !     
outcome ( ! subpo5a1 includ+ discussion 
on ! resolution or mitigation ( !       
critical infra/ructure security         
vuln]ability4  7#aa7 ,publication ( !   
annual reports ,! ,director %all publi% 
a v]sion ( ! annual report requir$ by   
p>agraph 7#aj7 on ! website ( ! ,ag5cy1 

:i* %all1 at a m9imum1 include ! f9d+s  
describ$ 9 clauses 7iii71 7iv7 & 7v7 (  
p>agraph 7#aj77;,a74  7#ab7 ,prohibition
 on use ( in=mation = unau?oriz$        
purposes ,any in=mation obta9$ pursuant 
to a subpo5a issu$ "u ?is subsection    
%all n be provid$ to any o!r ,f$]al     
ag5cy = any purpose o!r ?an a           
cyb]security purpose1 z def9$ 9 section 
#ajb ( ! ,cyb]security ,in=mation ,%>+  
,act ( #bjae 7#f ,u4,s4,c4 #aeja74  4   
7b7 ,rules ( con/ruction  7#a7          
,prohibition on new regulatory au?ority 
,no?+ 9 ?is ,act or ! am5dm5ts made by  
?is ,act %all be con/ru$ to grant !     
,secret>y ( ,homel& ,security 79 ?is    
subsection ref]r$ to z ! ,secret>y71 or 
ano!r ,f$]al ag5cy1 any au?ority to     
promulgate regulations or set /&>ds     
relat+ to ! cyb]security ( private      
sector critical infra/ructure t 0 n 9   
effect on ! day be=e ! date ( enactm5t (
 ?is ,act4  7#b7 ,private entities ,no?+
 9 ?is ,act or ! am5dm5ts made by ?is   
,act %all be con/ru$ to require any     

private entity-- 7,a7 to reque/         
assi/ance f ! ,secret>y2 or  7,b7 t     
reque/$ su* assi/ance f ! ,secret>y to  
implem5t any measure or recomm5dation   
sugge/$ by ! ,secret>y4  ,july #bi1     
#bjbj,report$ ) an am5dm5t