,i #aag? ,,congress #a/ ,session ,h4 ,r4 #eddj ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,septemb] #cj1 #bjba ,ms4 ,cl>ke ( ,new ,york 7= h]self1 ,mr4 ,katko1 ,mr4 ,?ompson ( ,mississippi1 & ,mr4 ,g>b>9o7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,homel& ,security ,a ,,bill ,to am5d ! ,homel& ,security ,act ( #bjjb to e/abli% ! ,cyb] ,incid5t ,review ,(fice 9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjba4 #b4 ,cyb] ,incid5t ,review ,(fice 7a7 ,9 g5]al ,subtitle ,a ( title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47 is am5d$ by add+ at ! end ! foll[+ new section3 #bbbj;,a4 ,cyb] ,incid5t ,review ,(fice 7a7 ,def9itions ,9 ?is section3 7#a7 ,cl\d s]vice provid] ,! t]m cl\d s]vice provid] means an entity (f]+ products or s]vices relat$ to cl\d comput+1 z def9$ by ! ,national ,in/itutes ( ,/&>ds & ,te*nology 9 ,,ni/ ,special ,publication #hjj-ade & any am5datory or sup]s$+ docum5t relat+ !reto4 7#b7 ,cov]$ entity ,! t]m cov]$ entity means an entity t owns or op]ates critical infra/ructure t satisfies ! def9ition e/abli%$ by ! ,director 9 ! report+ requirem5ts & proc$ures issu$ pursuant to subsection 7d74 7#c7 ,cov]$ cybsecurity incid5t ,! t]m cov]$ cyb]security incid5t means a cyb]security incid5t exp]i5c$ by a cov]$ entity t satisfies ! def9ition & crit]ia e/abli%$ by ! ,director 9 ! report+ requirem5ts & proc$ures issu$ pursuant to subsection 7d74 7#d7 ,cyb] ?reat indicator ,! t]m cyb] ?reat indicator has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#e7 ,cyb]security purpose ,! t]m cyb]security purpose has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#f7 ,cyb]security ?reat ,! t]m cyb]security ?reat has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#g7 ,def5sive measure ,! t]m def5sive measure has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#h7 ,in=mation ,%>+ & ,analysis ,organization ,! t]m ,in=mation ,%>+ & ,analysis ,organization has ! mean+ giv5 su* t]m 9 section #bbbb7e74 7#i7 ,in=mation sy/em ,! t]m in=mation sy/em has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja7i774 7#aj7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 ! t]m 9 section #c7d7 ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc7d774 7#aa7 ,manag$ s]vice provid] ,! t]m manag$ s]vice provid] means an entity t deliv]s s]vices1 su* z network1 application1 infra/ructure1 or security s]vices1 via ongo+ & regul> support & active adm9i/ration on cu/om]s' premises1 9 ! manag$ s]vice provid]'s data c5t] 7su* z ho/+71 or 9 a ?ird-p>ty data c5t]4 7#ab7 ,security control ,! t]m security control has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#ac7 ,security vuln]ability ,! t]m security vuln]ability has ! mean+ giv5 su* t]m 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeja774 7#ad7 ,significant cyb] incid5t ,! t]m significant cyb] incid5t means a cyb] incid5t1 or a gr\p ( relat$ cyb] incid5ts1 t ! ,director det]m9es is likely to result 9 demon/rable h>m to ! national security int]e/s1 =eign relations1 or economy ( ! ,unit$ ,/ates or to ! public confid5ce1 civil lib]ties1 or public heal? & safety ( ! ,am]ican p4 7#ae7 ,supply *a9 attack ,! t]m supply *a9 attack means an attack t all[s an adv]s>y to utilize implants or o!r vuln]abilities ins]t$ into in=mation te*nology h>dw>e1 s(tw>e1 op]at+ sy/ems1 p]iph]als 7su* z in=mation te*nology products71 or s]vices at any po9t dur+ ! life cycle 9 ord] to infiltrate ! networks ( ?ird p>ties :]e su* products1 s]vices1 or te*nologies are deploy$4 7b7 ,cyb] ,incid5t ,review ,(fice ,!re is e/abli%$ 9 ! ,ag5cy a ,cyb] ,incid5t ,review ,(fice 79 ?is section ref]r$ to z ! ,(fice7 to receive1 aggregate1 & analyze reports relat$ to cov]$ cyb]security incid5ts submitt$ by cov]$ entities 9 fur!rance ( ! activities specifi$ 9 subsection 7c7 ( ?is section & sections #bbjb7;e71 #bbji7;c71 & #bbjc to enhance ! situational aw>5ess ( cyb]security ?reats across critical infra/ructure sectors4 7c7 ,activities ,! ,(fice %all1 9 fur!rance ( ! activities specifi$ 9 sections #bbjb7;e71 #bbji7;c71 & #bbjc-- 7#a7 receive1 aggregate1 analyze1 & secure reports f cov]$ entities relat$ to a cov]$ cyb]security incid5t to assess ! effectiv5ess ( security controls & id5tify tactics1 te*niques1 & proc$ures adv]s>ies use to ov]come su* controls2 7#b7 facilitate ! timely %>+ betwe5 relevant critical infra/ructure own]s & op]ators &1 z appropriate1 ! intellig5ce community ( in=mation relat+ to cov]$ cyb]security incid5ts1 p>ticul>ly ) respect to an ongo+ cyb]security ?reat or security vuln]ability2 7#c7 = a cov]$ cyb]security incid5t t also satisfies ! def9ition ( a significant cyb] incid5t1 or are "p ( a gr\p ( relat$ cyb] incid5ts t toge!r satisfy su* def9ition1 conduct a review ( ! details surr\nd+ su* cov]$ cyb]security incid5t or gr\p ( su* incid5ts & id5tify ways to prev5t or mitigate simil> incid5ts 9 ! future2 7#d7 ) respect to cov]$ cyb]security incid5t reports "u subsection 7d7 involv+ an ongo+ cyb]security ?reat or security vuln]ability1 imm$iately review su* reports = cyb] ?reat indicators t c be anonymiz$ & dissem9at$1 ) def5sive measures1 to appropriate /akehold]s1 9 coord9ation ) o!r ,divisions )9 ! ,ag5cy1 z appropriate2 7#e7 publi% qu>t]ly unclassifi$1 public reports t describe aggregat$1 anonymiz$ obs]vations1 f9d+s1 & recomm5dations bas$ on cov]$ cyb]security incid5t reports "u subsection 7d72 7#f7 lev]age in=mation ga!r$ reg>d+ cyb]security incid5ts to enhance ! quality & effectiv5ess ( bi-directional in=mation %>+ & coord9ation ef=ts ) appropriate /akehold]s1 includ+ sector coord9at+ c\ncils1 in=mation %>+ & analysis organizations1 te*nology provid]s1 cyb]security & incid5t response firms1 & security rese>*]s1 includ+ by e/abli%+ me*anisms to receive fe$back f su* /akehold]s reg>d+ h[ ! ,ag5cy c mo/ effectively support private sector cyb]security2 & 7#g7 proactively id5tify opportunities1 9 accordance ) ! protections specifi$ 9 subsections 7e7 & 7f71 to lev]age & utilize data on cyb]security incid5ts 9 a mann] t enables & /r5g!ns cyb]security rese>* c>ri$ out by academic in/itutions & o!r private sector organizations1 to ! greate/ ext5t practicable4 7d7 ,cov]$ cyb]security incid5t report+ requirem5ts & proc$ures 7#a7 ,9 g5]al ,n lat] ?an #bgj days aft] ! date ( ! enactm5t ( ?is section1 ! ,director1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies & ! heads ( o!r ,f$]al dep>tm5ts & ag5cies1 z appropriate1 %all1 aft] a #fj day consultative p]iod1 foll[$ by a #ij day comm5t p]iod ) appropriate /akehold]s1 includ+ sector coord9at+ c\ncils1 publi% 9 ! ,f$]al ,regi/] an int]im f9al rule implem5t+ ?is section4 ,not)/&+ section #eec ( title #e1 ,unit$ ,/ates ,code1 su* rule %all be effective1 on an int]im basis1 imm$iately ^u publication1 b may be subject to *ange & revision aft] public notice & opportunity = comm5t4 ,! ,director %all issue a f9al rule n lat] ?an "o ye> aft] publication ( su* int]im f9al rule4 ,su* int]im f9al rule %all-- 7,a7 require cov]$ entities to submit to ! ,(fice reports conta9+ in=mation relat+ to cov]$ cyb]security incid5ts2 & 7,b7 e/abli% proc$ures t cle>ly describe-- 7i7 ! types ( critical infra/ructure entities det]m9$ to be cov]$ entities2 7ii7 ! types ( cyb]security incid5ts det]m9$ to be cov]$ cyb]security incid5ts2 7iii7 ! me*anisms by :i* cov]$ cyb]security incid5t reports "u subp>agraph 7,a7 are to be submitt$1 includ+-- 7,i7 ! cont5ts1 describ$ 9 p>agraph 7#d71 to be includ$ 9 ea* su* report1 includ+ any supplem5tal report+ requirem5ts2 7,,ii7 ! tim+ relat+ to :5 ea* su* report %\ld be submitt$2 & 7,,iii7 ! =mat ( ea* su* report2 7iv7 describe ! mann] 9 :i* ! ,(fice w c>ry out en=cem5t actions "u subsection 7g71 includ+ ) respect to ! issuance ( subpo5as1 conduct+ exam9ations1 & o!r aspects relat+ to noncompliance2 & 7v7 any o!r responsibilities to be c>ri$ out by cov]$ entities1 or o!r proc$ures necess>y to implem5t ?is section4 7#b7 ,cov]$ entities ,9 det]m9+ :i* types ( critical infra/ructure entities are cov]$ entities = purposes ( ?is section1 ! ,secret>y1 act+ ?r\gh ! ,director1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies & ! heads ( o!r ,f$]al dep>tm5ts & ag5cies1 z appropriate1 %all consid]-- 7,a7 ! consequ5ces t disruption to or compromise ( su* an entity c\ld cause to national security1 economic security1 or public heal? & safety2 7,b7 ! likelihood t su* an entity may be t>get$ by a malici\s cyb] actor1 includ+ a =eign c\ntry2 7,c7 ! ext5t to :i* damage1 disruption1 or unau?oriz$ access to su* & entity w disrupt ! reliable op]ation ( o!r critical infra/ructure assets2 & 7,d7 ! ext5t to :i* an entity or sector is subject to exi/+ regulatory requirem5ts to report cyb]security incid5ts1 & ! possibility ( coord9ation & %>+ ( reports betwe5 ! ,(fice & ! regulatory au?ority to :i* su* entity submits su* o!r reports4 7#c7 ,outrea* to cov]$ entities 7,a7 ,9 g5]al ,! ,director %all conduct an outrea* & education campaign to in=m cov]$ entities ( ! requirem5ts ( ?is section4 7,b7 ,elem5ts ,! outrea* & education campaign "u subp>agraph 7,a7 %all include ! foll[+3 7i7 ,ov]view ( ! int]im f9al rule & f9al rule issu$ pursuant to ?is section4 7ii7 ,ov]view ( report+ requirem5ts & proc$ures issu$ pursuant to p>agraph 7#a74 7iii7 ,ov]view ( me*anisms to submit to ! ,(fice cov]$ cyb]security incid5t reports & in=mation relat+ to ! disclosure1 ret5tion1 & use ( incid5t reports "u ?is section4 7iv7 ,ov]view ( ! protections af=d$ to cov]$ entities = comply+ ) requirem5ts "u subsection 7f74 7v7 ,ov]view ( ! /eps tak5 "u subsection 7g7 :5 a cov]$ entity is n 9 compliance ) ! report+ requirem5ts "u p>agraph 7#a74 7,c7 ,coord9ation ,! ,director may conduct ! outrea* & education campaign "u subp>agraph 7,a7 ?r\gh coord9ation ) ! foll[+3 7i7 ,! ,critical ,infra/ructure ,p>tn]%ip ,advisory ,c\ncil e/abli%$ pursuant to section #hga4 7ii7 ,in=mation ,%>+ & ,analysis ,organizations4 7iii7 ,any o!r means ! ,director det]m9es to be effective to conduct su* campaign4 7#d7 ,cov]$ cyb]security incid5ts 7,a7 ,consid]ations ,9 accordance ) subp>agraph 7,b71 9 det]m9+ :i* types ( incid5ts are cov]$ cyb]security incid5ts = purposes ( ?is section1 ! ,director %all consid]-- 7i7 ! sophi/ication or novelty ( ! tactics us$ to p]petrate su* an incid5t1 z well z ! type1 volume1 & s5sitivity ( ! data at issue2 7ii7 ! numb] ( individuals directly or indirectly affect$ or pot5tially affect$ by su* an incid5t2 & 7iii7 pot5tial impacts on indu/rial control sy/ems1 su* z sup]visory control & data acquisition sy/ems1 di/ribut$ control sy/ems1 & programmable logic controll]s4 7,b7 ,m9imum ?re%olds ,= a cyb]security incid5t to be consid]$ a cov]$ cyb]security incid5t a cyb]security incid5t %all1 at a m9imum1 include at lea/ "o ( ! foll[+3 7i7 ,unau?oriz$ access to an in=mation sy/em or network t leads to loss ( confid5tiality1 integrity1 or availability ( su* in=mation sy/em or network1 or has a s]i\s impact on ! safety & resili5cy ( op]ational sy/ems & processes4 7ii7 ,disruption ( bus9ess or indu/rial op]ations due to a d5ial ( s]vice attack1 a ransomw>e attack1 or exploitation ( a z]o-day vuln]ability1 aga9/-- 7,i7 an in=mation sy/em or network2 or 7,,ii7 an op]ational te*nology sy/em or process4 7iii7 ,unau?oriz$ access or disruption ( bus9ess or indu/rial op]ations due to loss ( s]vice facilitat$ ?r\gh1 or caus$ by a compromise (1 a cl\d s]vice provid]1 manag$ s]vice provid]1 o!r ?ird-p>ty data ho/+ provid]1 or supply *a9 attack4 7#e7 ,reports 7,a7 ,tim+ 7i7 ,9 g5]al ,! ,director1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies & ! heads ( o!r ,f$]al dep>tm5ts & ag5cies1 z appropriate1 %all e/abli% report+ timel9es = cov]$ entities to submit promptly to ! ,(fice cov]$ cyb]security incid5t reports1 z ! ,director det]m9es reasonable & appropriate bas$ on relevant factors1 su* z ! nature1 sev]ity1 & complexity ( ! cov]$ cyb]security incid5t at issue & ! "t requir$ = inve/igation1 b 9 no case may ! ,director require report+ by a cov]$ entity e>li] ?an #gb h\rs aft] confirmation t a cov]$ cyb]security incid5t has occurr$4 7ii7 ,consid]ations ,9 det]m9+ report+ timel9es "u clause 7i71 ! ,director %all-- 7,i7 consid] any exi/+ regulatory report+ requirem5ts1 simil> 9 scope purpose1 & tim+ to ! report+ requirem5ts "u ?is section1 to :i* a cov]$ entity may also be subject1 & make ef=ts to h>monize ! tim+ & cont5ts ( any su* reports to ! maximum ext5t practicable2 & 7,,ii7 balance ! ,ag5cy's ne$ = situational aw>5ess ) a cov]$ entity's ability to conduct incid5t response & inve/igations4 7,b7 ,?ird-p>ty report+ 7i7 ,9 g5]al ,a cov]$ entity may submit a cov]$ cyb]security incid5t report ?r\gh a ?ird-p>ty entity or ,in=mation ,%>+ & ,analysis ,organization4 7ii7 ,duty to ensure compliance ,?ird-p>ty report+ "u ?is subp>agraph does n relieve a cov]$ entity ( ! duty to ensure compliance ) ! requirem5ts ( ?is p>agraph4 7,c7 ,supplem5tal report+ ,a cov]$ entity %all submit promptly to ! ,(fice1 until su* date t su* cov]$ entity notifies ! ,(fice t ! cyb]security incid5t inve/igation at issue has conclud$ & ! associat$ cov]$ cyb]security incid5t has be5 fully mitigat$ & resolv$1 p]iodic updates or supplem5ts to a previ\sly submitt$ cov]$ cyb]security incid5t report if new or diff]5t in=mation becomes available t w\ld o!rwise h be5 requir$ to h be5 includ$ 9 su* previ\sly submitt$ report4 ,9 det]m9+ report+ timel9es1 ! ,director may *oose to e/abli% a flexible1 phas$ report+ timel9e = cov]$ entities to report in=mation 9 a mann] t aligns ) inve/igative timel9es & all[s cov]$ entities to prioritize incid5t response ef=ts ov] compliance4 7,d7 ,cont5ts ,cov]$ cyb]security incid5t reports submitt$ pursuant to ?is section %all conta9 su* in=mation z ! ,director prescribes1 includ+ ! foll[+ in=mation1 to ! ext5t applicable & available1 ) respect to a cov]$ cyb]security incid5t3 7i7 ,a description ( ! cov]$ cyb]security incid5t1 includ+ id5tification ( ! affect$ in=mation sy/ems1 networks1 or devices t 71 or are reasonably believ$ to h be51 affect$ by su* incid5t1 & ! e/imat$ date range ( su* incid5t4 7ii7 ,:]e applicable1 a description ( ! vuln]abilities exploit$ & ! security def5ses t 7 9 place1 z well z ! tactics1 te*niques1 & proc$ures relevant to su* incid5t4 7iii7 ,:]e applicable1 any id5tify+ in=mation relat$ to ! actor reasonably believ$ to be responsible = su* incid5t4 7iv7 ,:]e applicable1 id5tification ( ! category or categories ( in=mation t 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son4 7v7 ,contact in=mation1 su* z telephone numb] or electronic mail address1 t ! ,(fice may use to contact ! cov]$ entity or1 :]e applicable1 an au?oriz$ ag5t ( su* cov]$ entity1 or1 :]e applicable1 ! s]vice provid]1 act+ ) ! express p]mission1 & at ! direction1 ( su* cov]$ entity1 to assi/ ) compliance ) ! requirem5ts ( ?is section4 7#f7 ,responsibilities ( cov]$ entities ,cov]$ entities t exp]i5ce a cov]$ cyb]security incid5t %all coord9ate ) ! ,(fice to ! ext5t necess>y to comply ) ?is section1 &1 to ! ext5t practicable1 coop]ate ) ! ,(fice 9 a mann] t supports enhanc+ ! ,ag5cy's situational aw>5ess ( cyb]security ?reats across critical infra/ructure sectors4 7#g7 ,h>moniz+ report+ requirem5ts ,9 e/abli%+ ! report+ requirem5ts & proc$ures "u p>agraph 7#a71 ! ,director %all1 to ! maximum ext5t practicable-- 7,a7 review exi/+ regulatory requirem5ts1 includ+ ! in=mation requir$ 9 su* reports1 to report cyb]security incid5ts t may apply to cov]$ entities1 & ensure t any su* report+ requirem5ts & proc$ures avoid conflict+1 duplicative1 or burd5some requirem5ts2 & 7,b7 coord9ate ) o!r regulatory au?orities t receive reports relat+ to cyb]security incid5ts to id5tify opportunities to /reaml9e report+ processes1 & :]e feasible1 ent] into agreem5ts ) su* au?orities to p]mit ! %>+ ( su* reports ) ! ,(fice1 consi/5t ) applicable law & policy1 )\t impact+ ! ,(fice's ability to ga9 timely situational aw>5ess ( a cov]$ cyb]security incid5t or significant cyb] incid5t4 7e7 ,disclosure1 ret5tion1 & use ( incid5t reports 7#a7 ,au?oriz$ activities ,no in=mation provid$ to ! ,(fice 9 accordance ) subsections 7d7 or 7h7 may be disclos$ to1 reta9$ by1 or us$ by any ,f$]al dep>tm5t or ag5cy1 or any compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t1 except if ! ,director det]m9es su* disclosure1 ret5tion1 or use is necess>y =-- 7,a7 a cyb]security purpose2 7,b7 ! purpose ( id5tify+-- 7i7 a cyb]security ?reat1 includ+ ! s\rce ( su* ?reat2 or 7ii7 a security vuln]ability2 7,c7 ! purpose ( respond+ to1 or o!rwise prev5t+1 or mitigat+ a specific ?reat (-- 7i7 dea?2 7ii7 s]i\s bodily h>m2 or 7iii7 s]i\s economic h>m1 includ+ a t]rori/ act or a use ( a weapon ( mass de/ruction2 7,d7 ! purpose ( respond+ to1 inve/igat+1 prosecut+1 or o!rwise prev5t+ or mitigat+ a s]i\s ?reat to a m9or1 includ+ sexual exploitation or ?reats to physical safety2 or 7,e7 ! purpose ( prev5t+1 inve/igat+1 disrupt+1 or prosecut+ an (f5se relat$ to a ?reat-- 7i7 describ$ 9 subp>agraphs 7,b7 ?r\gh 7,d72 or 7ii7 specifi$ 9 section #aje7;d77#e77;,a77v7 ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aejd7;d77#e77;,a77v7774 7#b7 ,exceptions 7,a7 ,rapid1 confid5tial1 bi-directional %>+ ( cyb] ?reat indicators ,^u receiv+ a cov]$ cyb]security incid5t report submitt$ pursuant to ?is section1 ! ,(fice %all imm$iately review su* report to det]m9e :e!r ! incid5t t is ! subject ( su* report is connect$ to an ongo+ cyb]security ?reat or security vuln]ability & :]e applicable1 use su* report to id5tify1 develop1 & rapidly dissem9ate to appropriate /akehold]s actionable1 anonymiz$ cyb] ?reat indicators & def5sive measures4 7,b7 ,pr9ciples = %>+ security vuln]abilities ,) respect to in=mation 9 a cov]$ cyb]security incid5t report reg>d+ a security vuln]ability ref]r$ to 9 p>agraph 7#a77;,b77ii71 ! ,director %all develop pr9ciples t gov]n ! tim+ & mann] 9 :i* in=mation relat+ to security vuln]abilities may be %>$1 consi/5t ) common indu/ry be/ practices & ,unit$ ,/ates & int]national /&>ds4 7#c7 ,privacy & civil lib]ties ,in=mation conta9$ 9 reports submitt$ to ! ,(fice pursuant to subsections 7d7 & 7h7 %all be reta9$1 us$1 & dissem9at$1 :]e p]missible & appropriate1 by ! ,f$]al ,gov]nm5t 9 a mann] consi/5t ) processes = ! protection ( p]sonal in=mation adopt$ pursuant to section #aje ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aejd774 7#d7 ,prohibition on use ( in=mation 9 regulatory actions 7,a7 ,9 g5]al ,in=mation conta9$ 9 reports submitt$ to ! ,(fice pursuant to subsections 7d7 & 7h7 may n be us$ by any ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t to regulate1 includ+ ?r\gh an en=cem5t action1 ! lawful activities ( any non-,f$]al entity4 7,b7 ,exception ,a report submitt$ to ! ,ag5cy pursuant to subsection 7d7 or 7h7 may1 consi/5t ) ,f$]al or ,/ate regulatory au?ority specifically relat+ to ! prev5tion & mitigation ( cyb]security ?reats to in=mation sy/ems1 in=m ! developm5t or implem5tation ( regulations relat+ to su* sy/ems4 7f7 ,protections = report+ entities & in=mation ,reports describ+ cov]$ cyb]security incid5ts submitt$ to ! ,(fice by cov]$ entities 9 accordance ) subsection 7d71 z well z volunt>ily-submitt$ cyb]security incid5t reports submitt$ to ! ,(fice pursuant to subsection 7h71 %all be-- 7#a7 entitl$ to ! protections aga9/ liability describ$ 9 section #ajf ( ! ,cyb]security ,act ( #bjae 7enact$ z division ,n ( ! ,consolidat$ ,appropriations ,act1 #bjaf 7,public ,law #aad-aac2 #f ,u4,s4,c4 #aeje772 7#b7 exempt f disclosure "u section #eeb ( title #e1 ,unit$ ,/ates ,code1 z well z any provision ( ,/ate1 ,tribal1 or local fre$om ( in=mation law1 op5 gov]nm5t law1 op5 meet+s law1 op5 records law1 sun%9e law1 or simil> law requir+ disclosure ( in=mation or records2 & 7#c7 consid]$ ! comm]cial1 f9ancial1 & propriet>y in=mation ( ! cov]$ entity :5 s designat$ by ! cov]$ entity4 7g7 ,noncompliance ) requir$ report+ 7#a7 ,purpose ,9 ! ev5t a cov]$ entity exp]i5ces a cyb]security incid5t b does n comply ) ! report+ requirem5ts "u ?is section1 ! ,director may obta9 in=mation ab\t su* incid5t by engag+ directly su* cov]$ entity 9 accordance ) p>agraph 7#b7 to reque/ in=mation ab\t su* incid5t1 or1 if ! ,director is unable to obta9 su* in=mation ?r\gh su* engagem5t1 by issu+ a subpo5a to su* cov]$ entity1 subject to p>agraph 7#c71 to ga!r in=mation suffici5t to det]m9e :e!r su* incid5t is a cov]$ cyb]security incid5t1 & if s1 :e!r additional action is w>rant$ pursuant to p>agraph 7#d74 7#b7 ,initial reque/ = in=mation 7,a7 ,9 g5]al ,if ! ,director has reason to believe1 :e!r ?r\gh public report+1 intellig5ce ga!r+1 or o!r in=mation 9 ! ,f$]al ,gov]nm5t's possession1 t a cov]$ entity has exp]i5c$ a cyb]security incid5t t may be a cov]$ cyb]security incid5t b did n submit pursuant to subsection 7d7 to ! ,(fice a cov]$ cyb]security incid5t report relat+ !reto1 ! ,director may reque/ in=mation f su* cov]$ entity to confirm :e!r ! cyb]security incid5t at issue is a cov]$ cyb]security incid5t1 & det]m9e :e!r fur!r exam9ation into ! details surr\nd+ su* incid5t are w>rant$ pursuant to p>agraph 7#d74 7,b7 ,treatm5t ,in=mation provid$ to ! ,(fice 9 response to a reque/ "u subp>agraph 7,a7 %all be treat$ z if su* in=mation 0 submitt$ pursuant to ! report+ proc$ures e/abli%$ 9 accordance ) subsection 7d74 7#c7 ,au?ority to issue subpo5as 7,a7 ,9 g5]al ,if1 aft] ! date t is sev5 days f ! date on :i* ! ,director made a reque/ = in=mation 9 p>agraph 7#b71 ! ,director has receiv$ no response f ! entity f :i* su* in=mation 0 reque/$1 or receiv$ an inadequate response1 ! ,director may issue to su* entity a subpo5a to compel disclosure ( in=mation ! ,director consid]s necess>y to det]m9e :e!r a cov]$ cyb]security incid5t has occurr$ & assess pot5tial impacts to national security1 economic security1 or public heal? & safety1 det]m9e :e!r fur!r exam9ation into ! details surr\nd+ su* incid5t are w>rant$ pursuant to p>agraph 7#d71 & if s1 compel disclosure ( su* in=mation z is necess>y to c>ry out activities describ$ 9 subsection 7c74 7,b7 ,civil action ,if a cov]$ entity does n comply ) a subpo5a1 ! ,director may br+ a civil action 9 a di/rict c\rt ( ! ,unit$ ,/ates to en=ce su* subpo5a4 ,an action "u ?is p>agraph may be br\ght 9 ! judicial di/rict 9 :i* ! entity aga9/ :i* ! action is br\ght resides1 is f\nd1 or does bus9ess4 ,! c\rt may puni% a failure to obey an ord] ( ! c\rt to comply ) ! subpo5a z a contempt ( c\rt4 7,c7 ,non-applicability ( protections ,! protections describ$ 9 subsection 7f7 d n apply to a cov]$ entity t is ! recipi5t ( a subpo5a "u ?is p>agraph 7#c74 7#d7 ,additional actions 7,a7 ,exam9ation ,if1 bas$ on ! in=mation provid$ 9 response to a subpo5a issu$ pursuant to p>agraph 7#c71 ! ,director det]m9es t ! cyb]security incid5t at issue is a significant cyb] incid5t1 or is "p ( a gr\p ( relat$ cyb]security incid5ts t toge!r satisfy ! def9ition ( a significant cyb] incid5t1 & a m ?or\gh exam9ation ( ! details surr\nd+ su* incid5t is w>rant$ 9 ord] to c>ry out activities describ$ 9 subsection 7c71 ! ,director may direct ! ,(fice to conduct an exam9ation ( su* incid5t 9 ord] to enhance ! ,ag5cy's situational aw>5ess ( cyb]security ?reats across critical infra/ructure sectors1 9 a mann] consi/5t ) privacy & civil lib]ties protections "u applicable law4 7,b7 ,provision ( c]ta9 in=mation to ,attorney ,g5]al ,not)/&+ subsection 7e77#d7 & p>agraph 7#b77;,b71 if ! ,director det]m9es1 bas$ on ! in=mation provid$ 9 response to a subpo5a issu$ pursuant to p>agraph 7#c7 or id5tifi$ 9 ! c\rse ( an exam9ation "u subp>agraph 7,a71 t ! facts relat+ to ! cyb]security incid5t at issue may con/itute gr\nds = a regulatory en=cem5t action or crim9al prosecution1 ! ,director may provide su* in=mation to ! ,attorney ,g5]al or ! appropriate regulator1 :o may use su* in=mation = a regulatory en=cem5t action or crim9al prosecution4 7h7 ,volunt>y report+ ( cyb] incid5ts ,! ,ag5cy %all receive cyb]security incid5t reports submitt$ volunt>ily by entities t are n cov]$ entities1 or conc]n+ cyb]security incid5ts t d n satisfy ! def9ition ( cov]$ cyb]security incid5ts b may nev]!less enhance ! ,ag5cy's situational aw>5ess ( cyb]security ?reats across critical infra/ructure sectors4 ,! protections "u ?is section applicable to cov]$ cyb]security incid5t reports %all apply 9 ! same mann] & to ! same ext5t to volunt>ily-submitt$ cyb]security incid5t reports "u ?is subsection4 7i7 ,notification to impact$ cov]$ entities ,if ! ,director receives in=mation reg>d+ a cyb]security incid5t impact+ a ,f$]al ag5cy relat+ to unau?oriz$ access to data provid$ to su* ,f$]al ag5cy by a cov]$ entity1 & ) respect to :i* su* incid5t is likely to und]m9e ! security ( su* cov]$ entity or cause op]ational or reputational damage to su* cov]$ entity1 ! ,director %all1 to ! ext5t practicable1 notify su* cov]$ entity & provide to su* cov]$ entity su* in=mation reg>d+ su* incid5t z is necess>y to enable su* cov]$ entity to address any su* security risk or op]ational or reputational damage aris+ f su* incid5t4 7j7 ,exemption ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 does n apply to any action to c>ry out ?is section4 7k7 ,sav+ provision ,no?+ 9 ?is section may be con/ru$ z modify+1 sup]s$+1 or o!rwise affect+ 9 any mann] any regulatory au?ority held by a ,f$]al dep>tm5t or ag5cy1 includ+ ,sector ,risk ,managem5t ,ag5cies1 exi/+ on ! day be=e ! date ( ! enactm5t ( ?is section1 or any exi/+ regulatory requirem5ts or obligations t apply to cov]$ entities4 4 7b7 ,reports 7#a7 ,on /akehold] engagem5t ,n lat] ?an #cj days be=e ! date on :i* t ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security int5ds to issue an int]im f9al rule "u subsection 7d77#a7 ( section #bbbj;,a ( ! ,homel& ,security ,act ( #bjjb 7z add$ by subsection 7a771 ! ,director %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report t describes h[ ! ,director engag$ /akehold]s 9 ! developm5t ( su* int]im f9al rules4 7#b7 ,on opportunities to /r5g!n cyb]security rese>* ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security %all submit to ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report describ+ h[ ! ,cyb] ,incid5t ,review ,(fice ( ! ,dep>tm5t ( ,homel& ,security 7e/abli%$ pursuant to section #bbbj;,a ( ! ,homel& ,security ,act ( #bjjb1 z add$ by subsection 7a77 has c>ri$ out activities "u subsection 7c77#f7 ( su* section #bbbj;,a by proactively id5tify+ opportunities to use cyb]security incid5t data to in=m & enable cyb]security rese>* c>ri$ out by academic in/itutions & o!r private sector organizations4 7c7 ,title ,,xxii te*nical & cl]ical am5dm5ts 7#a7 ,te*nical am5dm5ts 7,a7 ,homel& ,security ,act ( #bjjb ,subtitle ,a ( title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47 is am5d$-- 7i7 9 section #bbjb 7#f ,u4,s4,c4 #feb7-- 7,i7 9 p>agraph 7#aa71 by /rik+ & aft] ! semicolon2 7,,ii7 9 ! fir/ p>agraph 7#ab7 7relat+ to appo9tm5t ( a ,cyb]security ,/ate ,coord9ator7 by /rik+ z describ$ 9 section #bbae2 & & ins]t+ z describ$ 9 section #bbag22 7,,iii7 by r$esignat+ ! second p>agraph 7#ab7 7relat+ to ! 4gov int]net doma97 z p>agraph 7#ac72 & 7,,iv7 by r$esignat+ ! ?ird p>agraph 7#ab7 7relat+ to c>ry+ out su* o!r duties & responsibilities7 z p>agraph 7#ad72 7ii7 9 ! fir/ section #bbae 7#f ,u4,s4,c4 #ffe2 relat+ to ! duties & au?orities relat+ to 4gov int]net doma971 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbae4 ,duties & au?orities relat+ to 4gov int]net doma9 2 7iii7 9 ! second section #bbae 7#f ,u4,s4,c4 #ffe;b2 relat+ to ! jo9t cyb] plann+ (fice71 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbaf4 ,jo9t cyb] plann+ (fice 2 7iv7 9 ! ?ird section #bbae 7#f ,u4,s4,c4 #ffe;c2 relat+ to ! ,cyb]security ,/ate ,coord9ator71 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbag4 ,cyb]security ,/ate ,coord9ator 2 7v7 9 ! f\r? section #bbae 7#f ,u4,s4,c4 #ffe;d2 relat+ to ,sector ,risk ,managem5t ,ag5cies71 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbah4 ,sector ,risk ,managem5t ,ag5cies 2 7vi7 9 section #bbaf 7#f ,u4,s4,c4 #ffe;e2 relat+ to ! ,cyb]security ,advisory ,committee71 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbai4 ,cyb]security ,advisory ,committee 2 & 7vii7 9 section #bbag 7#f ,u4,s4,c4 #ffe;f2 relat+ to ,cyb]security ,education & ,tra9+ ,programs71 by am5d+ ! section enum]ator & head+ to read z foll[s3 #bbbj4 ,cyb]security ,education & ,tra9+ ,programs 4 7,b7 ,consolidat$ ,appropriations ,act1 #bjba ,p>agraph 7#a7 ( section #ijd7;b7 ( division ,u ( ! ,consolidat$ ,appropriations ,act1 #bjba 7,public ,law #aaf-bfj7 is am5d$1 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ ( #bjjb aft] ,homel& ,security ,act4 7#b7 ,cl]ical am5dm5t ,! table ( cont5ts 9 section #a7;b7 ( ! ,homel& ,security ,act ( #bjjb is am5d$ by /rik+ ! items relat+ to sections #bbad ?r\gh #bbag & ins]t+ ! foll[+ new items3 ,sec4 #bbad4 ,national ,asset ,database4 ,sec4 #bbae4 ,duties & au?orities relat+ to 4gov int]net doma94 ,sec4 #bbaf4 ,jo9t cyb] plann+ (fice4 ,sec4 #bbag4 ,cyb]security ,/ate ,coord9ator4 ,sec4 #bbah4 ,sector ,risk ,managem5t ,ag5cies4 ,sec4 #bbai4 ,cyb]security ,advisory ,committee4 ,sec4 #bbbj4 ,cyb]security ,education & ,tra9+ ,programs4 ,sec4 #bbbj;,a4 ,cyb] ,incid5t ,review ,(fice4 4