,,ii  #aaf? ,,congress  #b;d ,session   
,s4 #ejjh  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,decemb] #aj1 #bjbj,mr4
 ,pet]s 7= himself & ,mr4 ,portman7     
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to require notification ( 
incid5ts at ag5cies involv+ s5sitive    
p]sonal in=mation1 & = o!r purposes4    
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,f$]al ,sy/em ,incid5t ,response ,act 
( #bjbj4  #b4 ,def9itions ,9 ?is ,act3  
7#a7 ,appropriate congressional         
committees ,! t]m appropriate           
congressional committees means-- 7,a7 ! 
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2  7,b7 !
 ,committee on ,ov]sight & ,re=m ( !    
,h\se ( ,repres5tatives2 &  7,c7 !      
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  7#b7 ,director
 ,! t]m ,director means ! ,director ( ! 
,(fice ( ,managem5t & ,budget4  #c4     
,f$]al in=mation sy/em incid5t response 

7a7 ,9 g5]al ,*apt] #ce ( title #dd1    
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+3  ,,iv ,f$]al in=mation 
sy/em incid5t response  #ceia4          
,def9itions  7a7 ,9 g5]al ,except z     
provid$ "u subsection 7b71 ! def9itions 
"u section #cejb %all apply to ?is      
sub*apt]4  7b7 ,additional def9itions ,z
 us$ 9 ?is sub*apt]3 7#a7 ,appropriate  
notification entities ,! t]m appropriate
 notification entities means-- 7,a7 !   
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2  7,b7 !
 ,committee on ,comm]ce1 ,sci5ce1 &     
,transportation ( ! ,s5ate2  7,c7 !     
,committee on ,ov]sight & ,re=m ( !     
,h\se ( ,repres5tatives2  7,d7 !        
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives2  7,e7 !        
,committee on ,sci5ce1 ,space1 &        
,te*nology ( ! ,h\se ( ,repres5tatives2 
7,f7 ! appropriate au?orization &       
appropriations committees ( ,congress2  
7,g7 ! ,director2  7,h7 ! ,secret>y (   
,homel& ,security2 &  7,i7 ! ,comptroll]

 ,g5]al ( ! ,unit$ ,/ates4  7#b7        
,incid5t ,! t]m incid5t has ! mean+ giv5
 ! t]m 9 section #ceeb ( ?is title4     
7#c7 ,contractor ,! t]m contractor--    
7,a7 means any p]son or bus9ess t       
collects or ma9ta9s in=mation t includes
 p]sonally id5tifiable in=mation or     
s5sitive p]sonal in=mation on behalf (  
an ag5cy2 &  7,b7 includes any          
subcontractor ( a p]son or bus9ess      
describ$ 9 subp>agraph 7,a74  7#d7      
,cov]$ incid5t ,! t]m cov]$ incid5t     
means1 ) respect to any in=mation       
collect$ or ma9ta9$ by or on behalf ( an
 ag5cy or in=mation sy/em us$ or op]at$ 
by an ag5cy or by a contractor ( an     
ag5cy or o!r organization on behalf ( an
 ag5cy-- 7,a7 a major incid5t1 z def9$  
by ! ,director pursuant to section      
#b7;b7 ( ! ,f$]al ,in=mation ,security  
,mod]nization ,act ( #bjad 7#dd         
,u4,s4,c4 #ceed note72  7,b7 any incid5t
 det]m9$ likely to h a significant      
impact on national security1 homel&     
security1 or economic security ( !      

,unit$ ,/ates2  7,c7 any incid5t det]m9$
 likely to h a significant impact on !  
op]ations ( ! ag5cy or ! ,f$]al         
,gov]nm5t2 or  7,d7 any incid5t t is    
det]m9$ to h involv$ any s5sitive       
p]sonal in=mation1 reg>dless ( ! numb] (
 impact$ individuals4  7#e7 ,intellig5ce
 community ,! t]m intellig5ce community 
has ! mean+ giv5 ! t]m 9 section #c ( ! 
,national ,security ,act ( #aidg 7#ej   
,u4,s4,c4 #cjjc74  7#f7 ,nationwide     
consum] report+ ag5cy ,! t]m nationwide 
consum] report+ ag5cy means a consum]   
report+ ag5cy describ$ 9 section #fjc7p7
 ( ! ,fair ,cr$it ,report+ ,act 7#ae    
,u4,s4,c4 #afha;a7p774  7#g7 ,s5sitive  
p]sonal in=mation ,! t]m s5sitive       
p]sonal in=mation means1 ) respect to an
 individual-- 7,a7 any comb9ation ( data
 or in=mation t1 if expos$1 c\ld result 
9 sub/antial h>m1 physical h>m1         
emb>rassm5t1 or unfairness to !         
individual1 includ+ biometric1 g5etic1  
or o!r data2 &  7,b7 any o!r in=mation z
 det]m9$ by ! ,director4  7#h7          

,sub/antial h>m ,! t]m sub/antial h>m1 )
 respect to an individual1 means id5tity
 !ft1 f9ancial fraud1 or o!r f9ancial   
h>m to ! individual4  #ceib4            
,notification to impact$ individuals    
involv+ s5sitive p]sonal in=mation  7a7 
,notification ,z exp$iti\sly z          
practicable & )\t unreasonable delay1 & 
9 any case n lat] ?an #cj days aft] an  
ag5cy has a reasonable basis to conclude
 t a cov]$ incid5t describ$ 9 section   
#ceia7;b77#d77;,d7 has occurr$1 ! head (
 ! ag5cy %all provide notice ( ! incid5t
 9 accordance ) subsection 7b7 9 writ+  
to ! la/ kn[n home mail+ address ( ea*  
impact$ individual4  7b7 ,cont5ts (     
notice ,ea* notice requir$ "u subsection
 7a7 %all include-- 7#a7 a description (
 ! categories ( s5sitive p]sonal        
in=mation t 71 or are reasonably believ$
 to h be51 involv$ 9 ! cov]$ incid5t1   
includ+ a li/ ( all data elem5ts2  7#b7 
a description ( ! sub/antial h>m1       
emb>rassm5t1 inconv5i5ce1 or unfairness 
to ! individual t an individual may     

reasonably expect to exp]i5ce bas$ on ! 
in=mation or comb9ation ( in=mation     
involv$ 9 ! cov]$ incid5t2  7#c7 contact
 in=mation = ! ,f$]al ,bureau (         
,inve/igation or o!r appropriate entity2
  7#d7 ! contact in=mation ( ea*        
nationwide consum] report+ ag5cy2  7#e7 
! contact in=mation = que/ions to !     
ag5cy1 includ+ a telephone numb]1 e-mail
 address1 & website2  7#f7 in=mation on 
any rem$y be+ (f]$ by ! ag5cy2  7#g7    
consolidat$ ,f$]al ,gov]nm5t            
recomm5dations on :at to d 9 ! ev5t ( a 
cov]$ incid5t2 &  7#h7 any o!r          
appropriate in=mation z det]m9$ by !    
head ( ! ag5cy4  7c7 ,delay (           
notification  7#a7 ,9 g5]al ,!          
,inspector ,g5]al ( ! ag5cy t exp]i5c$ !
 cov]$ incid5t1 ! ,attorney ,g5]al1 !   
,director ( ,national ,intellig5ce1 or !
 ,secret>y ( ,homel& ,security may      
impose a delay ( a notification requir$ 
"u subsection 7a7 if ! notification w\ld
 disrupt a law en=cem5t inve/igation1   
endang] national security1 or hamp]     

security rem$iation actions4  7#b7      
,docum5tation  7,a7 ,9 g5]al ,any delay 
"u p>agraph 7#a7 %all be report$ 9 writ+
 to ! head ( ! ag5cy1 ! ,director1 !    
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 & !    
,(fice ( ,inspector ,g5]al ( ! ag5cy t  
exp]i5c$ ! cov]$ incid5t4  7,b7 ,cont5ts
 ,a /atem5t requir$ "u subp>agraph 7,a7 
%all include a writt5 /atem5t f ! entity
 t delay$ ! notification expla9+ ! ne$ =
 ! delay4  7,c7 ,=m ,! /atem5t requir$  
"u subp>agraph 7,a7 %all be unclassifi$1
 b may include a classifi$ annex4  7#c7 
,r5ewal ,a delay "u p>agraph 7#a7 %all  
be = a p]iod ( #b mon?s & may be r5ew$4 
7d7 ,exemption = notification  7#a7 ,9  
g5]al ,! head ( an ag5cy1 9 consultation
 ) ! ,inspector ,g5]al ( ! ag5cy1 may   
reque/ an exemption f ! ,director f     
comply+ ) ! notification requirem5ts "u 
subsection 7a7 if-- 7,a7 ! in=mation    
affect$ by ! cov]$ incid5t is det]m9$ by
 an indep5d5t evaluation to be          
unreadable1 includ+ in/ances :5 !       

in=mation is encrypt$ or :5 ! encryption
 key has n be5 acquir$2 or  7,b7 ! cov]$
 incid5t has o!rwise be5 det]m9$ by an  
indep5d5t evaluation to be ( de m9imis  
?reat to ^? individuals ^: s5sitive     
p]sonal in=mation 0 involv$ 9 ! incid5t4
  7#b7 ,approval ,! ,director %all make 
a det]m9ation = grant+ an exemption 9   
consultation )-- 7,a7 ! ,director ( !   
,cyb]security & ,infra/ructure ,security
 ,ag5cy2 &  7,b7 ! ,attorney ,g5]al4    
7#c7 ,docum5tation ,any exemption grant$
 by ! ,director "u subp>agraph 7,a7 or  
7,b7 ( p>agraph 7#a7 %all be report$ 9  
writ+ to ! head ( ! ag5cy t exp]i5c$ !  
cov]$ incid5t1 ! ,(fice ( ,inspector    
,g5]al ( ! ag5cy t exp]i5c$ ! cov]$     
incid5t1 & ! ,director ( ! ,cyb]security
 & ,infra/ructure ,security ,ag5cy4  7e7
 ,update notification ,if an ag5cy      
det]m9es !re is a *ange 9 ! reasonable  
basis to conclude t a cov]$ incid5t     
occurr$1 or t !re is a *ange 9 ! details
 ( ! in=mation provid$ to impact$       
individuals z describ$ 9 subsection 7b71

 ! ag5cy %all z exp$iti\sly z           
practicable & )\t unreasonable delay1 & 
9 any case n lat] ?an #cj days aft] su* 
a det]m9ation1 notify all su*           
individuals :o receiv$ a notification   
pursuant to subsection 7a7 ( ^? *anges4 
7f7 ,rule ( con/ruction ,no?+ 9 ?is     
section %all be con/ru$ to limit-- 7#a7 
! ,director f issu+ guidance reg>d+     
notifications or ! head ( an ag5cy f    
s5d+ notifications to individuals       
impact$ by incid5ts n det]m9$ to be     
cov]$ incid5ts1 z describ$ 9 section    
#ceia7;b77#d77;,d72 or  7#b7 ! ,director
 f issu+ guidance reg>d+ notifications =
 cov]$ incid5ts meet+ ! crit]ia 9       
section #ceia7;b77#d77;,d7 or ! head (  
an ag5cy f issu+ notifications to       
individuals impact$ by cov]$ incid5ts   
meet+ ! crit]ia 9 section               
#ceia7;b77#d77;,d7 t conta9 m in=mation 
?an describ$ 9 subsection 7b74  #ceic4  
,congressional notifications & reports  
7a7 ,initial report  7#a7 ,9 g5]al ,n   
lat] ?an #g days aft] ! date on :i* an  

ag5cy has a reasonable basis to conclude
 t a cov]$ incid5t occurr$1 ! head ( !  
ag5cy %all submit a writt5 notification 
&1 to ! ext5t practicable1 provide a    
brief+1 to ! appropriate notification   
entities1 tak+ into acc\nt ! in=mation  
kn[n at ! "t ( ! notification1 !        
s5sitivity ( ! details associat$ ) !    
cov]$ incid5t1 & ! classification level 
( ! in=mation conta9$ 9 ! notification4 
7#b7 ,cont5ts ,a notification requir$ "u
 p>agraph 7#a7 %all include-- 7,a7 a    
summ>y ( ! in=mation available ab\t !   
cov]$ incid5t1 includ+ h[ ! cov]$       
incid5t occurr$1 bas$ on in=mation      
available to ag5cy (ficials z ( ! date  
:i* ! ag5cy submits ! report2  7,b7 if  
applicable1 an e/imate ( ! numb] (      
individuals impact$ by ! cov]$ incid5t1 
includ+ an assessm5t ( ! risk ( h>m to  
impact$ individuals bas$ on in=mation   
available to ag5cy (ficials on ! date on
 :i* ! ag5cy submits ! report2  7,c7 if 
applicable1 a description & any         
associat$ docum5tation ( any            

circum/ances necessitat+ a delay 9 or   
exemption to notification grant$ "u     
subsection 7c7 or 7d7 ( section #ceib2 &
  7,d7 if applicable1 an assessm5t ( !  
impacts to ! ag5cy1 ! ,f$]al ,gov]nm5t1 
or ! security ( ! ,unit$ ,/ates z       
id5tifi$ 9 section #ceia7;b77#d71 bas$  
on in=mation available to ag5cy (ficials
 on ! date on :i* ! ag5cy submits !     
report4  7b7 ,supplem5tal report ,)9 a  
reasonable am\nt ( "t1 b n lat] ?an #de 
days aft] ! date on :i* additional      
in=mation relat+ to a cov]$ incid5t =   
:i* an ag5cy submitt$ a writt5          
notification "u subsection 7a7 is       
discov]$ by ! ag5cy1 ! head ( ! ag5cy   
%all submit to ! appropriate            
congressional committees updates to !   
writt5 notification t include summ>ies  
(-- 7#a7 ! ?reats & ?reat actors1       
vuln]abilities1 means by :i* ! cov]$    
incid5t occurr$1 & impacts to ! ag5cy   
relat+ to ! cov]$ incid5t2  7#b7 any    
risk assessm5t & subsequ5t risk-bas$    
security implem5tation ( ! affect$      

in=mation sy/em be=e ! date on :i* !    
cov]$ incid5t occurr$2  7#c7 ! /atus (  
compliance ( ! affect$ in=mation sy/em )
 applicable security requirem5ts at ! "t
 ( ! cov]$ incid5t2  7#d7 an e/imate ( !
 numb] ( individuals affect$ by ! cov]$ 
incid5t bas$ on in=mation available to  
ag5cy (ficials z ( ! date on :i* ! ag5cy
 submits ! update2  7#e7 an update to ! 
assessm5t ( ! risk ( h>m to impact$     
individuals affect$ by ! cov]$ incid5t  
bas$ on in=mation available to ag5cy    
(ficials z ( ! date on :i* ! ag5cy      
submits ! update2  7#f7 an update to !  
assessm5t ( ! risk to ag5cy op]ations1  
or to impacts on o!r ag5cy or non-,f$]al
 entity op]ations1 affect$ by ! cov]$   
incid5t bas$ on in=mation available to  
ag5cy (ficials z ( ! date on :i* ! ag5cy
 submits ! update2 &  7#g7 ! detection1 
response1 & rem$iation actions ( !      
ag5cy1 includ+ any support provid$ by ! 
,cyb]security & ,infra/ructure ,security
 ,ag5cy "u section #ceid7;d7 & /atus    
updates on ! notification process       

describ$ 9 section #ceib7;a71 includ+   
any delay or exemption describ$ 9       
subsection 7c7 or 7d71 respectively1 (  
section #ceib1 if applicable4  7c7      
,update ,report ,if ! ag5cy det]m9es t  
!re is any significant *ange 9 ! scope1 
scale1 or consequ5ce ( ! cov]$ incid5t1 
or a *ange 9 ! inclusion ( ! crit]ia    
describ$ 9 section #ceia7;b77#d71 !     
ag5cy %all provide an updat$ report to !
 appropriate congressional committees t 
includes ^? *anges4  7d7 ,annual report 
,ea* ag5cy %all submit z "p ( ! annual  
report requir$ "u section #ceed7;c77#a7 
( ?is title a description ( ea* cov]$   
incid5t t occurr$ dur+ ! #a-ye> p]iod   
prec$+ ! date on :i* ! report is        
submitt$4  7e7 ,delay & exemption report
 ,! ,director %all submit to !          
appropriate notification entities an    
annual report on all notification delays
 & exemptions grant$ pursuant to        
subsections 7c7 & 7d7 ( section #ceib4  
7f7 ,report deliv]y ,any writt5         
notification or report requir$ to be    

submitt$ "u ?is section may be submitt$ 
9 a pap] or electronic =mat4  7g7 ,rule 
( con/ruction ,no?+ 9 ?is section %all  
be con/ru$ to limit-- 7#a7 ! ability (  
an ag5cy to provide additional reports  
or brief+s to ,congress2 or  7#b7       
,congress f reque/+ additional in=mation
 f ag5cies ?r\gh reports1 brief+s1 or   
o!r means4  #ceid4 ,gov]nm5t in=mation  
%>+ & incid5t response  7a7 ,9 g5]al ,! 
head ( ea* ag5cy %all make available any
 in=mation relat+ to an incid5t1 :e!r   
obta9$ by ! ,f$]al ,gov]nm5t or a       
private entity contract$ by ! ,f$]al    
,gov]nm5t1 to ! ,cyb]security &         
,infra/ructure ,security ,ag5cy1 !      
,dep>tm5t ( ,def5se1 & ! ,(fice (       
,managem5t & ,budget to help mitigate   
future incid5ts4  7b7 ,compliance ,!    
in=mation made available "u subsection  
7a7 %all-- 7#a7 take into acc\nt ! level
 ( classification ( ! in=mation & any   
in=mation %>+ limitations relat+ to law 
en=cem5t2 &  7#b7 be 9 compliance ) !   
requirem5ts limit+ ! release ( in=mation

 "u section #eeb;a ( title #e 7commonly 
kn[n z ! ,privacy ,act ( #aigd74  7c7   
,respond+ to in=mation reque/s f ag5cies
 exp]i5c+ incid5ts ,an ag5cy t receives 
a reque/ f ano!r ag5cy or ,f$]al entity 
= in=mation specifically int5d$ to assi/
 9 ! rem$iation or notification         
requirem5ts due to an incid5t %all      
provide t in=mation to ! greate/ ext5t  
possible1 9 accordance ) guidance issu$ 
by ! ,director & tak+ into acc\nt       
classification1 law en=cem5t1 national  
security1 & compliance ) section #eeb;a 
( title #e 7commonly kn[n z ! ,privacy  
,act ( #aigd74  7d7 ,incid5t response   
,ea* ag5cy t has a reasonable basis to  
conclude t a cov]$ incid5t occurr$1     
reg>dless ( delays or exemptions f      
notification grant$ = a cov]$ incid5t1  
%all consult ) ! ,cyb]security &        
,infra/ructure ,security ,ag5cy reg>d+--
 7#a7 incid5t response & recov]y2 &     
7#b7 recomm5dations = mitigat+ future   
incid5ts4  #ceie4 ,responsibilities (   
contractors & grant recipi5ts  7a7      

,notification  7#a7 ,9 g5]al ,subject to
 p>agraph 7#c71 any contractor ( an     
ag5cy or recipi5t ( a grant f an ag5cy t
 has a reasonable basis to conclude t an
 incid5t involv+ ,f$]al in=mation has   
occurr$ %all imm$iately notify ! ag5cy4 
7#b7 ,proc$ures  7,a7 ,cov]$ incid5t    
,foll[+ notification ( a cov]$ incid5t  
by a contractor or recipi5t ( a grant "u
 p>agraph 7#a71 an ag5cy1 9 consultation
 ) ! contractor or grant recipi5t1 z    
applicable1 %all c>ry out ! requirem5ts 
"u sections #ceib1 #ceic1 & #ceid )     
respect to ! cov]$ incid5t4  7,b7       
,incid5t ,foll[+ notification ( an      
incid5t by a contractor or recipi5t ( a 
grant "u p>agraph 7#a71 an ag5cy1 9     
consultation ) ! contractor or grant    
recipi5t1 z applicable1 %all c>ry out ! 
requirem5ts "u section #ceid ) respect  
to ! incid5t4  7#c7 ,applicability ,?is 
subsection %all apply to a contractor ( 
an ag5cy or a recipi5t ( a grant f an   
ag5cy t-- 7,a7 receives in=mation f !   
ag5cy t ! contractor or recipi5t1 z     

applicable1 is n contractually au?oriz$ 
to receive2  7,b7 exp]i5ces an incid5t  
relat+ to ,f$]al in=mation on an        
in=mation sy/em ( ! contractor or       
recipi5t1 z applicable2 or  7,c7        
id5tifies an incid5t involv+ a ,f$]al   
in=mation sy/em4  7b7 ,incid5t response 
,any contractor ( an ag5cy or recipi5t (
 a grant f an ag5cy t has a reasonable  
basis to conclude t a cov]$ incid5t     
occurr$ %all1 9 coord9ation ) ! ag5cy1  
consult ) ! ,cyb]security &             
,infra/ructure ,security ,ag5cy reg>d+--
 7#a7 incid5t response assi/ance2 &     
7#b7 recomm5dations = mitigat+ future   
incid5ts at ! ag5cy4  7c7 ,effective    
date ,?is section %all apply on & aft] !
 date t is #a ye> aft] ! date ( enactm5t
 ( ! ,f$]al ,sy/em ,incid5t ,response   
,act ( #bjbj4  #ceif4 ,tra9+  7a7 ,9    
g5]al ,ea* ag5cy %all develop tra9+ =   
individuals at ! ag5cy ) access to      
,f$]al in=mation or in=mation sy/ems on 
h[ to id5tify & respond to an incid5t1  
includ+-- 7#a7 ! int]nal process at !   

ag5cy = report+ an incid5t2 &  7#b7 !   
obligation ( ! individual to report to !
 ag5cy n only a confirm$ cov]$ incid5t1 
b also a suspect$ incid5t1 involv+      
in=mation 9 any m$ium or =m1 includ+    
pap]1 oral1 & electronic4  7b7          
,applicability ,! tra9+ develop$ "u     
subsection 7a7 %all-- 7#a7 be requir$ = 
an individual be=e ! individual may     
access ,f$]al in=mation or in=mation    
sy/ems2 &  7#b7 apply to individuals )  
tempor>y access to ,f$]al in=mation or  
in=mation sy/ems1 su* z detailees1      
contractors1 subcontractors1 grantees1  
volunte]s1 & int]ns4  7c7 ,inclusion 9  
annual tra9+ ,! tra9+ develop$ "u       
subsection 7a7 may be includ$ z "p ( an 
annual privacy or security aw>5ess tra9+
 ( ! ag5cy1 z applicable4  #ceig4       
,analysis & report on ,f$]al incid5ts   
7a7 ,analysis ( ,f$]al incid5ts  7#a7 ,9
 g5]al ,! ,director ( ! ,cyb]security & 
,infra/ructure ,security ,ag5cy %all    
p]=m cont9u\s monitor+ ( incid5ts (     
,f$]al in=mation sy/ems4  7#b7          

,quantitative & ,qualitative analyses ,!
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director1 %all develop
 & p]=m quantitative & qualitative      
analyses ( incid5ts ( ,f$]al in=mation  
sy/ems1 includ+-- 7,a7 ! causes (       
incid5ts1 includ+-- 7i7 attack] tactics1
 te*niques1 & proc$ures2 &  7ii7 sy/em  
vuln]abilities1 includ+ z]o days1       
unpat*$ sy/ems1 & in=mation sy/em       
misconfigurations2  7,b7 ! scope & scale
 ( incid5ts )9 ! ag5cy networks &       
sy/ems2  7,c7 cross ,f$]al ,gov]nm5t    
root causes ( incid5ts2  7,d7 ag5cy     
response1 recov]y1 & rem$iation actions 
& effectiv5ess ( incid5ts2 &  7,e7      
lessons le>n$ & recomm5dations 9        
respond+1 recov]+1 rem$iat+1 & mitigat+ 
future incid5ts4  7#c7 ,%>+ ( analysis  
,! ,director %all %>e on an ongo+ basis 
! analyses requir$ "u ?is subsection )  
,f$]al ag5cies4  7b7 ,report on ,f$]al  
incid5ts ,n lat] ?an #b ye>s aft] ! date
 ( enactm5t ( ?is section1 & n less     

frequ5tly ?an e ye> !reaft]1 ! ,director
 ( ! ,cyb]security & ,infra/ructure     
,security ,ag5cy1 9 consultation ) !    
,director & ! ,director ( ! ,f$]al      
,bureau ( ,inve/igation1 %all submit to 
! appropriate congressional committees a
 report t includes-- 7#a7 a summ>y (    
causes ( incid5ts f across ! ,f$]al     
,gov]nm5t2 &  7#b7 ! quantitative &     
qualitative analyses ( incid5ts develop$
 "u subsection 7a77#b74  7c7            
,publication ,a v]sion ( ea* report     
submitt$ "u subsection 7b7 %all be made 
publicly available on ! website ( !     
,cyb]security & ,infra/ructure ,security
 ,ag5cy dur+ ! ye> 9 :i* ! report is    
submitt$4  7d7 ,in=mation provid$ by    
ag5cies ,! analysis requir$ "u          
subsection 7a7 & ea* report submitt$ "u 
subsection 7b7 %all utilize in=mation   
provid$ by ag5cies pursuant to section  
#ceid7;d74  7e7 ,requirem5t ,to         
anonymize in=mation ,9 %>+ ! analysis   
requir$ "u subsection 7a7 & prep>+ ea*  
report "u subsection 7b71 ! ,director ( 

! ,cyb]security & ,infra/ructure        
,security ,ag5cy %all suffici5tly       
anonymize & compile in=mation su* t no  
specific incid5ts ( an ag5cy c be       
id5tifi$1 except ) ! concurr5ce ( !     
,director ( ! ,(fice ( ,managem5t &     
,budget4  4  7b7 ,responsibilities ( !  
,cyb]security & ,infra/ructure ,security
 ,ag5cy  7#a7 ,recomm5dations ,n lat]   
?an #ahj days aft] ! date ( enactm5t (  
?is ,act1 ! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy1 9    
coord9ation ) ! ,director ( ! ,f$]al    
,trade ,commission1 ! ,director ( !     
,securities & ,ex*ange ,commission1 !   
,secret>y ( ! ,treasury1 ! ,director ( !
 ,f$]al ,bureau ( ,inve/igation1 !      
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology1 & ! head ( any o!r 
appropriate ,f$]al or non-,f$]al entity1
 %all consolidate1 ma9ta91 & make       
publicly available recomm5dations =     
individuals ^: s5sitive p]sonal         
in=mation1 z def9$ 9 section #ceia (    
title #dd1 ,unit$ ,/ates ,code1 z add$  

by ?is ,act1 is inappropriately expos$4 
7#b7 ,plan = analysis (1 & report on1   
,f$]al incid5ts  7,a7 ,9 g5]al ,n lat]  
?an #ahj days aft] ! date ( enactm5t (  
?is ,act1 ! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy %all--
 7i7 develop a plan = ! developm5t ( !  
analysis requir$ "u section #ceig7;a7 ( 
title #dd1 ,unit$ ,/ates ,code1 z add$  
by subsection 7a71 & ! report requir$ "u
 subsection 7b7 ( t section t includes--
 7,i7 a description ( any *all5ges !    
,director anticipates enc\nt]+2 &       
7,,ii7 ! use ( automation = collect+1   
compil+1 monitor+1 & analyz+ data2 &    
7ii7 provide to ! appropriate           
congressional committees a brief+ on !  
plan develop$ "u clause 7ii74  7,b7     
,brief+ ,n lat] ?an #a ye> aft] ! date (
 enactm5t ( ?is ,act1 ! ,director ( !   
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all provide to ! appropriate   
congressional committees a brief+ on--  
7i7 ! execution ( ! plan requir$ "u     
subp>agraph 7,a72 &  7ii7 ! developm5t (

 ! report requir$ "u section #ceig7;b7 (
 title #dd1 ,unit$ ,/ates ,code1 z add$ 
by ?is ,act4  7c7 ,responsibilities ( ! 
,director ( ! ,(fice ( ,managem5t &     
,budget  7#a7 ,,fisma ,section #b7;b7 ( 
! ,f$]al ,in=mation ,security           
,mod]nization ,act ( #bjad 7#dd         
,u4,s4,c4 #ceed note7 is am5d$ to read z
 foll[s3  7b7 ,major incid5t  7#a7 ,9   
g5]al ,! ,director ( ! ,(fice (         
,managem5t & ,budget %all develop       
guidance on :at con/itutes a major      
incid5t = purposes ( section #ceed7;b7 (
 title #dd1 ,unit$ ,/ates ,code1 z add$ 
by subsection 7a74  7#b7 ,evaluation &  
updates ,n lat] ?an #b ye>s aft] ! date 
( enactm5t ( ! ,f$]al ,sy/em ,incid5t   
,response ,act ( #bjbj1 & n less        
frequ5tly ?an e #b ye>s !reaft]1 !      
,director ( ! ,(fice ( ,managem5t &     
,budget %all submit to ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate & ! ,committee on ,ov]sight 
& ,re=m ( ! ,h\se ( ,repres5tatives an  
evaluation1 :i* %all include-- 7,a7 an  

update1 if necess>y1 ! def9ition ( a    
major incid5t1 z def9$ by ! ,director   
pursuant to section #ceed7;b7 ( ?is     
title2  7,b7 ! crit]ia ( an incid5t t   
designates su* an incid5t z a major     
incid5t2  7,c7 an explanation = !       
analysis lead+ to ! crit]ia 9           
subp>agraph 7,b72 &  7,d7 an assessm5t (
 any additional datasets t may be       
consid]$ s5sitive p]sonal in=mation1 z  
def9$ 9 section #ceia ( ?is title4  4   
7#b7 ,incid5t data %>+  7,a7 ,9 g5]al ,!
 ,director %all develop guidance1 to be 
updat$ n less ?an frequ5tly e #b ye>s1  
on ! cont5t & =mat ( ! data to be made  
available by ag5cies pursuant to section
 #ceid7;a7 ( title #dd1 ,unit$ ,/ates   
,code1 z add$ by ?is ,act4  7,b7        
,requirem5ts ,! guidance develop$ "u    
subp>agraph 7,a7 %all-- 7i7 prioritize  
data availability necess>y to und]/& &  
analyze-- 7,i7 ! causes ( incid5ts1 z   
def9$ 9 section #ceia ( title #dd1      
,unit$ ,/ates ,code1 z add$ by ?is ,act2
  7,,ii7 ! scope & scale ( incid5ts )9 !

 ag5cy networks & sy/ems2  7,,iii7 cross
 ,f$]al ,gov]nm5t root causes (         
incid5ts2 &  7,,iv7 ag5cy response1     
recov]y1 & rem$iation actions &         
effectiv5ess ( incid5ts2  7ii7 enable ! 
effici5t developm5t (-- 7,i7 lessons    
le>n$ & recomm5dations 9 respond+1      
recov]+1 rem$iat+1 & mitigat+ future    
incid5ts2 &  7,,ii7 ! report ( ,f$]al   
incid5ts pursuant to section #ceig (    
title #dd1 ,unit$ ,/ates ,code1 z add$  
by ?is ,act2  7iii7 include requirem5ts 
= ! timel9ess ( data availability2 &    
7iv7 include requirem5ts = us+          
automation = data %>+ & availability4   
7#c7 ,def9ition guidance ,n lat] ?an #a 
ye> aft] ! date ( enactm5t ( ?is ,act1 !
 ,director1 9 coord9ation ) ! ,director 
( ! ,cyb]security & ,infra/ructure      
,security ,ag5cy & 9 consultation ) !   
,privacy & ,civil ,lib]ties ,ov]sight   
,bo>d1 %all develop guidance1 to be     
review$ &1 if necess>y1 updat$ n less   
frequ5tly ?an once e #b ye>s1 on !      
int]pretation ( ! t]ms sub/antial h>m1  

physical h>m1 emb>rassm5t1 or unfairness
 to an individual1 z us$ 9 ! def9ition (
 ! t]m s5sitive p]sonal in=mation 9     
section #ceia ( title #dd1 ,unit$ ,/ates
 ,code1 z add$ by ?is ,act4  7#d7 ,/&>d 
guidance & templates ,n lat] ?an #a ye> 
aft] ! date ( enactm5t ( ?is ,act1 !    
,director1 9 coord9ation ) ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy1 %all develop guidance 
& templates1 to be review$ &1 if        
necess>y1 updat$ n less frequ5tly ?an   
once e #b ye>s1 = use by ,f$]al ag5cies 
9 ! activities requir$ "u sections      
#ceib1 #ceic1 & #ceif ( title #dd1      
,unit$ ,/ates ,code1 z add$ by ?is ,act4
  7#e7 ,contractor & grantee guidance   
7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is ,act1 ! ,director1
 9 coord9ation ) ! ,secret>y ( ,homel&  
,security1 ! ,secret>y ( ,def5se1 !     
,adm9i/rator ( ,g5]al ,s]vices1 & !     
heads ( o!r ag5cies det]m9$ appropriate 
by ! ,director1 %all issue guidance to  
,f$]al ag5cies on h[ to deconflict exi/+

 regulations1 policies1 & proc$ures     
relat+ to ! responsibilities (          
contractors & grant recipi5ts e/abli%$  
"u section #ceie ( title #dd1 ,unit$    
,/ates ,code1 z add$ by ?is ,act4  7,b7 
,exi/+ processes ,to ! greate/ ext5t    
practicable1 ! guidance issu$ "u        
subp>agraph 7,a7 %all all[ contractors &
 grantees to utilize exi/+ processes =  
notify+ ,f$]al ag5cies ( incid5ts       
involv+ in=mation ( ! ,f$]al ,gov]nm5t4 
7#f7 ,updat$ brief+s ,n less frequ5tly  
?an once e #b ye>s1 ! ,director %all    
provide to ! appropriate congressional  
committees an update on ! guidance &    
templates develop$ "u p>agraphs 7#b71   
7#c71 & 7#d74  7d7 ,update to ! ,privacy
 ,act ( #aigd ,section #eeb;a7b7 ( title
 #e1 ,unit$ ,/ates ,code 7commonly kn[n 
z ! ,privacy ,act ( #aigd7 is am5d$--   
7#a7 9 p>agraph 7#aa71 by /rik+ or at ! 
end2  7#b7 9 p>agraph 7#ab71 by /rik+ ! 
p]iod at ! end & ins]t+ 2 &2 &  7#c7 by 
add+ at ! end ! foll[+3  7#ac7 to ano!r 
ag5cy 9 fur!rance ( a response to an    

incid5t 7z def9$ 9 section #ceeb ( title
 #dd7 & pursuant to ! in=mation %>+     
requirem5ts 9 section #ceid ( title #dd 
if ! head ( ! reque/+ ag5cy has made a  
writt5 reque/ to ! ag5cy t ma9ta9s !    
record specify+ ! p>ticul> portion      
desir$ & ! activity = :i* ! record is   
s\ght4  4  7e7 ,te*nical & con=m+       
am5dm5t ,! table ( sections = *apt] #ce 
( title #dd1 ,unit$ ,/ates ,code1 is    
am5d$ by add+ at ! end ! foll[+3        
,,sub*apt] ,,iv--,f$]al in=mation sy/em 
incid5t response#ceia4                  
,def9itions4#ceib4 ,notification to     
impact$ individuals involv+ s5sitive    
p]sonal in=mation4#ceic4 ,congressional 
notifications & reports4#ceid4 ,gov]nm5t
 in=mation %>+ & incid5t response4#ceie4
 ,responsibilities ( contractors & grant
 recipi5ts4#ceif4 ,tra9+4#ceig4         
,analysis & report on ,f$]al incid5ts4  
4