,,ii #aafth ,,congress #b;d ,session ,s4 #ejjh ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #aj1 #bjbj,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to require notification of incidents at agencies involving sensitive personal information1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,system ,incident ,response ,act of #bjbj4 #b4 ,definitions ,in this ,act3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 and 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#b7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 #c4 ,federal information system incident response 7a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,iv ,federal information system incident response #ceia4 ,definitions 7a7 ,in general ,except as provided under subsection 7b71 the definitions under section #cejb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,appropriate notification entities ,the term appropriate notification entities means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate2 7,c7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7,d7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,e7 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives2 7,f7 the appropriate authorization and appropriations committees of ,congress2 7,g7 the ,director2 7,h7 the ,secretary of ,homeland ,security2 and 7,i7 the ,comptroller ,general of the ,united ,states4 7#b7 ,incident ,the term incident has the meaning given the term in section #ceeb of this title4 7#c7 ,contractor ,the term contractor-- 7,a7 means any person or business that collects or maintains information that includes personally identifiable information or sensitive personal information on behalf of an agency2 and 7,b7 includes any subcontractor of a person or business described in subparagraph 7,a74 7#d7 ,covered incident ,the term covered incident means1 with respect to any information collected or maintained by or on behalf of an agency or information system used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency-- 7,a7 a major incident1 as defined by the ,director pursuant to section #b7;b7 of the ,federal ,information ,security ,modernization ,act of #bjad 7#dd ,u4,s4,c4 #ceed note72 7,b7 any incident determined likely to have a significant impact on national security1 homeland security1 or economic security of the ,united ,states2 7,c7 any incident determined likely to have a significant impact on the operations of the agency or the ,federal ,government2 or 7,d7 any incident that is determined to have involved any sensitive personal information1 regardless of the number of impacted individuals4 7#e7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 7#f7 ,nationwide consumer reporting agency ,the term nationwide consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#g7 ,sensitive personal information ,the term sensitive personal information means1 with respect to an individual-- 7,a7 any combination of data or information that1 if exposed1 could result in substantial harm1 physical harm1 embarrassment1 or unfairness to the individual1 including biometric1 genetic1 or other data2 and 7,b7 any other information as determined by the ,director4 7#h7 ,substantial harm ,the term substantial harm1 with respect to an individual1 means identity theft1 financial fraud1 or other financial harm to the individual4 #ceib4 ,notification to impacted individuals involving sensitive personal information 7a7 ,notification ,as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after an agency has a reasonable basis to conclude that a covered incident described in section #ceia7;b77#d77;,d7 has occurred1 the head of the agency shall provide notice of the incident in accordance with subsection 7b7 in writing to the last known home mailing address of each impacted individual4 7b7 ,contents of notice ,each notice required under subsection 7a7 shall include-- 7#a7 a description of the categories of sensitive personal information that were1 or are reasonably believed to have been1 involved in the covered incident1 including a list of all data elements2 7#b7 a description of the substantial harm1 embarrassment1 inconvenience1 or unfairness to the individual that an individual may reasonably expect to experience based on the information or combination of information involved in the covered incident2 7#c7 contact information for the ,federal ,bureau of ,investigation or other appropriate entity2 7#d7 the contact information of each nationwide consumer reporting agency2 7#e7 the contact information for questions to the agency1 including a telephone number1 e-mail address1 and website2 7#f7 information on any remedy being offered by the agency2 7#g7 consolidated ,federal ,government recommendations on what to do in the event of a covered incident2 and 7#h7 any other appropriate information as determined by the head of the agency4 7c7 ,delay of notification 7#a7 ,in general ,the ,inspector ,general of the agency that experienced the covered incident1 the ,attorney ,general1 the ,director of ,national ,intelligence1 or the ,secretary of ,homeland ,security may impose a delay of a notification required under subsection 7a7 if the notification would disrupt a law enforcement investigation1 endanger national security1 or hamper security remediation actions4 7#b7 ,documentation 7,a7 ,in general ,any delay under paragraph 7#a7 shall be reported in writing to the head of the agency1 the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,office of ,inspector ,general of the agency that experienced the covered incident4 7,b7 ,contents ,a statement required under subparagraph 7,a7 shall include a written statement from the entity that delayed the notification explaining the need for the delay4 7,c7 ,form ,the statement required under subparagraph 7,a7 shall be unclassified1 but may include a classified annex4 7#c7 ,renewal ,a delay under paragraph 7#a7 shall be for a period of #b months and may be renewed4 7d7 ,exemption for notification 7#a7 ,in general ,the head of an agency1 in consultation with the ,inspector ,general of the agency1 may request an exemption from the ,director from complying with the notification requirements under subsection 7a7 if-- 7,a7 the information affected by the covered incident is determined by an independent evaluation to be unreadable1 including instances when the information is encrypted or when the encryption key has not been acquired2 or 7,b7 the covered incident has otherwise been determined by an independent evaluation to be of de minimis threat to those individuals whose sensitive personal information was involved in the incident4 7#b7 ,approval ,the ,director shall make a determination for granting an exemption in consultation with-- 7,a7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,b7 the ,attorney ,general4 7#c7 ,documentation ,any exemption granted by the ,director under subparagraph 7,a7 or 7,b7 of paragraph 7#a7 shall be reported in writing to the head of the agency that experienced the covered incident1 the ,office of ,inspector ,general of the agency that experienced the covered incident1 and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7e7 ,update notification ,if an agency determines there is a change in the reasonable basis to conclude that a covered incident occurred1 or that there is a change in the details of the information provided to impacted individuals as described in subsection 7b71 the agency shall as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after such a determination1 notify all such individuals who received a notification pursuant to subsection 7a7 of those changes4 7f7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ,director from issuing guidance regarding notifications or the head of an agency from sending notifications to individuals impacted by incidents not determined to be covered incidents1 as described in section #ceia7;b77#d77;,d72 or 7#b7 the ,director from issuing guidance regarding notifications for covered incidents meeting the criteria in section #ceia7;b77#d77;,d7 or the head of an agency from issuing notifications to individuals impacted by covered incidents meeting the criteria in section #ceia7;b77#d77;,d7 that contain more information than described in subsection 7b74 #ceic4 ,congressional notifications and reports 7a7 ,initial report 7#a7 ,in general ,not later than #g days after the date on which an agency has a reasonable basis to conclude that a covered incident occurred1 the head of the agency shall submit a written notification and1 to the extent practicable1 provide a briefing1 to the appropriate notification entities1 taking into account the information known at the time of the notification1 the sensitivity of the details associated with the covered incident1 and the classification level of the information contained in the notification4 7#b7 ,contents ,a notification required under paragraph 7#a7 shall include-- 7,a7 a summary of the information available about the covered incident1 including how the covered incident occurred1 based on information available to agency officials as of the date which the agency submits the report2 7,b7 if applicable1 an estimate of the number of individuals impacted by the covered incident1 including an assessment of the risk of harm to impacted individuals based on information available to agency officials on the date on which the agency submits the report2 7,c7 if applicable1 a description and any associated documentation of any circumstances necessitating a delay in or exemption to notification granted under subsection 7c7 or 7d7 of section #ceib2 and 7,d7 if applicable1 an assessment of the impacts to the agency1 the ,federal ,government1 or the security of the ,united ,states as identified in section #ceia7;b77#d71 based on information available to agency officials on the date on which the agency submits the report4 7b7 ,supplemental report ,within a reasonable amount of time1 but not later than #de days after the date on which additional information relating to a covered incident for which an agency submitted a written notification under subsection 7a7 is discovered by the agency1 the head of the agency shall submit to the appropriate congressional committees updates to the written notification that include summaries of-- 7#a7 the threats and threat actors1 vulnerabilities1 means by which the covered incident occurred1 and impacts to the agency relating to the covered incident2 7#b7 any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the covered incident occurred2 7#c7 the status of compliance of the affected information system with applicable security requirements at the time of the covered incident2 7#d7 an estimate of the number of individuals affected by the covered incident based on information available to agency officials as of the date on which the agency submits the update2 7#e7 an update to the assessment of the risk of harm to impacted individuals affected by the covered incident based on information available to agency officials as of the date on which the agency submits the update2 7#f7 an update to the assessment of the risk to agency operations1 or to impacts on other agency or non-,federal entity operations1 affected by the covered incident based on information available to agency officials as of the date on which the agency submits the update2 and 7#g7 the detection1 response1 and remediation actions of the agency1 including any support provided by the ,cybersecurity and ,infrastructure ,security ,agency under section #ceid7;d7 and status updates on the notification process described in section #ceib7;a71 including any delay or exemption described in subsection 7c7 or 7d71 respectively1 of section #ceib1 if applicable4 7c7 ,update ,report ,if the agency determines that there is any significant change in the scope1 scale1 or consequence of the covered incident1 or a change in the inclusion of the criteria described in section #ceia7;b77#d71 the agency shall provide an updated report to the appropriate congressional committees that includes those changes4 7d7 ,annual report ,each agency shall submit as part of the annual report required under section #ceed7;c77#a7 of this title a description of each covered incident that occurred during the #a-year period preceding the date on which the report is submitted4 7e7 ,delay and exemption report ,the ,director shall submit to the appropriate notification entities an annual report on all notification delays and exemptions granted pursuant to subsections 7c7 and 7d7 of section #ceib4 7f7 ,report delivery ,any written notification or report required to be submitted under this section may be submitted in a paper or electronic format4 7g7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ability of an agency to provide additional reports or briefings to ,congress2 or 7#b7 ,congress from requesting additional information from agencies through reports1 briefings1 or other means4 #ceid4 ,government information sharing and incident response 7a7 ,in general ,the head of each agency shall make available any information relating to an incident1 whether obtained by the ,federal ,government or a private entity contracted by the ,federal ,government1 to the ,cybersecurity and ,infrastructure ,security ,agency1 the ,department of ,defense1 and the ,office of ,management and ,budget to help mitigate future incidents4 7b7 ,compliance ,the information made available under subsection 7a7 shall-- 7#a7 take into account the level of classification of the information and any information sharing limitations relating to law enforcement2 and 7#b7 be in compliance with the requirements limiting the release of information under section #eeb;a of title #e 7commonly known as the ,privacy ,act of #aigd74 7c7 ,responding to information requests from agencies experiencing incidents ,an agency that receives a request from another agency or ,federal entity for information specifically intended to assist in the remediation or notification requirements due to an incident shall provide that information to the greatest extent possible1 in accordance with guidance issued by the ,director and taking into account classification1 law enforcement1 national security1 and compliance with section #eeb;a of title #e 7commonly known as the ,privacy ,act of #aigd74 7d7 ,incident response ,each agency that has a reasonable basis to conclude that a covered incident occurred1 regardless of delays or exemptions from notification granted for a covered incident1 shall consult with the ,cybersecurity and ,infrastructure ,security ,agency regarding-- 7#a7 incident response and recovery2 and 7#b7 recommendations for mitigating future incidents4 #ceie4 ,responsibilities of contractors and grant recipients 7a7 ,notification 7#a7 ,in general ,subject to paragraph 7#c71 any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that an incident involving ,federal information has occurred shall immediately notify the agency4 7#b7 ,procedures 7,a7 ,covered incident ,following notification of a covered incident by a contractor or recipient of a grant under paragraph 7#a71 an agency1 in consultation with the contractor or grant recipient1 as applicable1 shall carry out the requirements under sections #ceib1 #ceic1 and #ceid with respect to the covered incident4 7,b7 ,incident ,following notification of an incident by a contractor or recipient of a grant under paragraph 7#a71 an agency1 in consultation with the contractor or grant recipient1 as applicable1 shall carry out the requirements under section #ceid with respect to the incident4 7#c7 ,applicability ,this subsection shall apply to a contractor of an agency or a recipient of a grant from an agency that-- 7,a7 receives information from the agency that the contractor or recipient1 as applicable1 is not contractually authorized to receive2 7,b7 experiences an incident relating to ,federal information on an information system of the contractor or recipient1 as applicable2 or 7,c7 identifies an incident involving a ,federal information system4 7b7 ,incident response ,any contractor of an agency or recipient of a grant from an agency that has a reasonable basis to conclude that a covered incident occurred shall1 in coordination with the agency1 consult with the ,cybersecurity and ,infrastructure ,security ,agency regarding-- 7#a7 incident response assistance2 and 7#b7 recommendations for mitigating future incidents at the agency4 7c7 ,effective date ,this section shall apply on and after the date that is #a year after the date of enactment of the ,federal ,system ,incident ,response ,act of #bjbj4 #ceif4 ,training 7a7 ,in general ,each agency shall develop training for individuals at the agency with access to ,federal information or information systems on how to identify and respond to an incident1 including-- 7#a7 the internal process at the agency for reporting an incident2 and 7#b7 the obligation of the individual to report to the agency not only a confirmed covered incident1 but also a suspected incident1 involving information in any medium or form1 including paper1 oral1 and electronic4 7b7 ,applicability ,the training developed under subsection 7a7 shall-- 7#a7 be required for an individual before the individual may access ,federal information or information systems2 and 7#b7 apply to individuals with temporary access to ,federal information or information systems1 such as detailees1 contractors1 subcontractors1 grantees1 volunteers1 and interns4 7c7 ,inclusion in annual training ,the training developed under subsection 7a7 may be included as part of an annual privacy or security awareness training of the agency1 as applicable4 #ceig4 ,analysis and report on ,federal incidents 7a7 ,analysis of ,federal incidents 7#a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform continuous monitoring of incidents of ,federal information systems4 7#b7 ,quantitative and ,qualitative analyses ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall develop and perform quantitative and qualitative analyses of incidents of ,federal information systems1 including-- 7,a7 the causes of incidents1 including-- 7i7 attacker tactics1 techniques1 and procedures2 and 7ii7 system vulnerabilities1 including zero days1 unpatched systems1 and information system misconfigurations2 7,b7 the scope and scale of incidents within the agency networks and systems2 7,c7 cross ,federal ,government root causes of incidents2 7,d7 agency response1 recovery1 and remediation actions and effectiveness of incidents2 and 7,e7 lessons learned and recommendations in responding1 recovering1 remediating1 and mitigating future incidents4 7#c7 ,sharing of analysis ,the ,director shall share on an ongoing basis the analyses required under this subsection with ,federal agencies4 7b7 ,report on ,federal incidents ,not later than #b years after the date of enactment of this section1 and not less frequently than every year thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director and the ,director of the ,federal ,bureau of ,investigation1 shall submit to the appropriate congressional committees a report that includes-- 7#a7 a summary of causes of incidents from across the ,federal ,government2 and 7#b7 the quantitative and qualitative analyses of incidents developed under subsection 7a77#b74 7c7 ,publication ,a version of each report submitted under subsection 7b7 shall be made publicly available on the website of the ,cybersecurity and ,infrastructure ,security ,agency during the year in which the report is submitted4 7d7 ,information provided by agencies ,the analysis required under subsection 7a7 and each report submitted under subsection 7b7 shall utilize information provided by agencies pursuant to section #ceid7;d74 7e7 ,requirement ,to anonymize information ,in sharing the analysis required under subsection 7a7 and preparing each report under subsection 7b71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall sufficiently anonymize and compile information such that no specific incidents of an agency can be identified1 except with the concurrence of the ,director of the ,office of ,management and ,budget4 4 7b7 ,responsibilities of the ,cybersecurity and ,infrastructure ,security ,agency 7#a7 ,recommendations ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director of the ,federal ,trade ,commission1 the ,director of the ,securities and ,exchange ,commission1 the ,secretary of the ,treasury1 the ,director of the ,federal ,bureau of ,investigation1 the ,director of the ,national ,institute of ,standards and ,technology1 and the head of any other appropriate ,federal or non-,federal entity1 shall consolidate1 maintain1 and make publicly available recommendations for individuals whose sensitive personal information1 as defined in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act1 is inappropriately exposed4 7#b7 ,plan for analysis of1 and report on1 ,federal incidents 7,a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7i7 develop a plan for the development of the analysis required under section #ceig7;a7 of title #dd1 ,united ,states ,code1 as added by subsection 7a71 and the report required under subsection 7b7 of that section that includes-- 7,i7 a description of any challenges the ,director anticipates encountering2 and 7,,ii7 the use of automation for collecting1 compiling1 monitoring1 and analyzing data2 and 7ii7 provide to the appropriate congressional committees a briefing on the plan developed under clause 7ii74 7,b7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a briefing on-- 7i7 the execution of the plan required under subparagraph 7,a72 and 7ii7 the development of the report required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7c7 ,responsibilities of the ,director of the ,office of ,management and ,budget 7#a7 ,,fisma ,section #b7;b7 of the ,federal ,information ,security ,modernization ,act of #bjad 7#dd ,u4,s4,c4 #ceed note7 is amended to read as follows3 7b7 ,major incident 7#a7 ,in general ,the ,director of the ,office of ,management and ,budget shall develop guidance on what constitutes a major incident for purposes of section #ceed7;b7 of title #dd1 ,united ,states ,code1 as added by subsection 7a74 7#b7 ,evaluation and updates ,not later than #b years after the date of enactment of the ,federal ,system ,incident ,response ,act of #bjbj1 and not less frequently than every #b years thereafter1 the ,director of the ,office of ,management and ,budget shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives an evaluation1 which shall include-- 7,a7 an update1 if necessary1 the definition of a major incident1 as defined by the ,director pursuant to section #ceed7;b7 of this title2 7,b7 the criteria of an incident that designates such an incident as a major incident2 7,c7 an explanation for the analysis leading to the criteria in subparagraph 7,b72 and 7,d7 an assessment of any additional datasets that may be considered sensitive personal information1 as defined in section #ceia of this title4 4 7#b7 ,incident data sharing 7,a7 ,in general ,the ,director shall develop guidance1 to be updated not less than frequently every #b years1 on the content and format of the data to be made available by agencies pursuant to section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,requirements ,the guidance developed under subparagraph 7,a7 shall-- 7i7 prioritize data availability necessary to understand and analyze-- 7,i7 the causes of incidents1 as defined in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act2 7,,ii7 the scope and scale of incidents within the agency networks and systems2 7,,iii7 cross ,federal ,government root causes of incidents2 and 7,,iv7 agency response1 recovery1 and remediation actions and effectiveness of incidents2 7ii7 enable the efficient development of-- 7,i7 lessons learned and recommendations in responding1 recovering1 remediating1 and mitigating future incidents2 and 7,,ii7 the report of ,federal incidents pursuant to section #ceig of title #dd1 ,united ,states ,code1 as added by this ,act2 7iii7 include requirements for the timeliness of data availability2 and 7iv7 include requirements for using automation for data sharing and availability4 7#c7 ,definition guidance ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with the ,privacy and ,civil ,liberties ,oversight ,board1 shall develop guidance1 to be reviewed and1 if necessary1 updated not less frequently than once every #b years1 on the interpretation of the terms substantial harm1 physical harm1 embarrassment1 or unfairness to an individual1 as used in the definition of the term sensitive personal information in section #ceia of title #dd1 ,united ,states ,code1 as added by this ,act4 7#d7 ,standard guidance and templates ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop guidance and templates1 to be reviewed and1 if necessary1 updated not less frequently than once every #b years1 for use by ,federal agencies in the activities required under sections #ceib1 #ceic1 and #ceif of title #dd1 ,united ,states ,code1 as added by this ,act4 7#e7 ,contractor and grantee guidance 7,a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 the ,administrator of ,general ,services1 and the heads of other agencies determined appropriate by the ,director1 shall issue guidance to ,federal agencies on how to deconflict existing regulations1 policies1 and procedures relating to the responsibilities of contractors and grant recipients established under section #ceie of title #dd1 ,united ,states ,code1 as added by this ,act4 7,b7 ,existing processes ,to the greatest extent practicable1 the guidance issued under subparagraph 7,a7 shall allow contractors and grantees to utilize existing processes for notifying ,federal agencies of incidents involving information of the ,federal ,government4 7#f7 ,updated briefings ,not less frequently than once every #b years1 the ,director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs 7#b71 7#c71 and 7#d74 7d7 ,update to the ,privacy ,act of #aigd ,section #eeb;a7b7 of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd7 is amended-- 7#a7 in paragraph 7#aa71 by striking or at the end2 7#b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 and2 and 7#c7 by adding at the end the following3 7#ac7 to another agency in furtherance of a response to an incident 7as defined in section #ceeb of title #dd7 and pursuant to the information sharing requirements in section #ceid of title #dd if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought4 4 7e7 ,technical and conforming amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,subchapter ,,iv--,federal information system incident response#ceia4 ,definitions4#ceib4 ,notification to impacted individuals involving sensitive personal information4#ceic4 ,congressional notifications and reports4#ceid4 ,government information sharing and incident response4#ceie4 ,responsibilities of contractors and grant recipients4#ceif4 ,training4#ceig4 ,analysis and report on ,federal incidents4 4