,i  #aag? ,,congress  #b;d ,session  ,h4
 ,r4 #fdig  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,janu>y #be1          
#bjbb,mrs4 ,c>olyn ,b4 ,maloney ( ,new  
,york 7= h]self1 ,mr4 ,com]1 ,mr4       
,connolly1 ,mr4 ,sessions1 ,ms4 ,norton1
 ,mr4 ,kell]1 ,ms4 ,wass]man ,s*ultz1   
,mr4 ,hice ( ,georgia1 ,mr4 ,coop]1 ,mr4
 ,c4 ,scott ,frankl9 ( ,florida1 ,ms4   
,br[n ( ,ohio1 ,mr4 ,gibbs1 ,mr4 ,lyn*1 
& ,mr4 ,rask97 introduc$ ! foll[+ bill2 
:i* 0 ref]r$ to ! ,committee on         
,ov]sight & ,re=m1 & 9 addition to !    
,committee on ,sci5ce1 ,space1 &        
,te*nology1 = a p]iod to be subsequ5tly 
det]m9$ by ! ,speak]1 9 ea* case =      
consid]ation ( su* provisions z fall )9 
! jurisdiction ( ! committee conc]n$  ,a
 ,,bill  ,to mod]nize ,f$]al in=mation  
security managem5t & improve ,f$]al     
cyb]security to combat p]si/+ & em]g+   
?reats1 & = o!r purposes4  #a4 ,%ort    
title ,?is ,act may be cit$ z ! ,f$]al  
,in=mation ,security ,mod]nization ,act 
( #bjbb4  #b4 ,table ( cont5ts ,! table 

( cont5ts = ?is ,act is z foll[s3 ,sec4 
#a4 ,%ort title4,sec4 #b4 ,table (      
cont5ts4,sec4 #c4 ,def9itions4,title    
,i--,,updates ,,to ,f,i,s,m,a,sec4 #aja4
 ,title #dd am5dm5ts4,sec4 #ajb4        
,am5dm5ts to subtitle ,,iii ( title     
#dj4,sec4 #ajc4 ,actions to enhance     
,f$]al incid5t response4,sec4 #ajd4     
,additional guidance to ag5cies on      
,,fisma updates4,sec4 #aje4 ,ag5cy      
requirem5ts to notify private sector    
entities impact$ by incid5ts4,title     
,,ii--,,improv+ ,,f$]al                 
,c,y,b,e,r,s,e,c,u,r,i,t,y,sec4 #bja4   
,mobile security /&>ds4,sec4 #bjb4 ,data
 & logg+ ret5tion = incid5t             
response4,sec4 #bjc4 ,f$]al p5etration  
te/+ policy4,sec4 #bjd4 ,ongo+ ?reat    
hunt+ program4,sec4 #bje4 ,codify+      
vuln]ability disclosure programs4,sec4  
#bjf4 ,implem5t+ z]o tru/               
ar*itecture4,sec4 #bjg4 ,,gao automation
 report4,sec4 #bjh4 ,ext5sion ( ,f$]al  
,acquisition ,security ,c\ncil4,sec4    
#bji4 ,f$]al *ief in=mation security    

(fic]4,sec4 #baj4 ,ext5sion ( ,*ief     
,data ,(fic] ,c\ncil4,sec4 #baa4 ,c\ncil
 ( ! inspectors g5]al on integrity &    
effici5cy da%bo>d4,sec4 #bab4           
,quantitative cyb]security              
metrics4,title ,,iii--,,pilot ,,programs
 ,,to ,,enhance ,,f$]al                 
,c,y,b,e,r,s,e,c,u,r,i,t,y,sec4 #cja4   
,risk-bas$ budget pilot4,sec4 #cjb4     
,active cyb] def5sive /udy4,sec4 #cjc4  
,security op]ations c5t] z a s]vice     
pilot4,sec4 #cjd4 ,endpo9t detection &  
response z a s]vice pilot4  #c4         
,def9itions ,9 ?is ,act1 unless o!rwise 
specifi$3 7#a7 ,additional cyb]security 
proc$ure ,! t]m additional cyb]security 
proc$ure has ! mean+ giv5 ! t]m 9       
section #ceeb7;b7 ( title #dd1 ,unit$   
,/ates ,code1 z am5d$ by ?is ,act4  7#b7
 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! 
t]m 9 section #cejb ( title #dd1 ,unit$ 
,/ates ,code4  7#c7 ,appropriate        
congressional committees ,! t]m         
appropriate congressional committees    
means-- 7,a7 ! ,committee on ,homel&    

,security & ,gov]nm5tal ,affairs ( !    
,s5ate2  7,b7 ! ,committee on ,ov]sight 
& ,re=m ( ! ,h\se ( ,repres5tatives2 &  
7,c7 ! ,committee on ,homel& ,security (
 ! ,h\se ( ,repres5tatives4  7#d7       
,director ,! t]m ,director means !      
,director ( ! ,(fice ( ,managem5t &     
,budget4  7#e7 ,incid5t ,! t]m incid5t  
has ! mean+ giv5 ! t]m 9 section        
#ceeb7;b7 ( title #dd1 ,unit$ ,/ates    
,code4  7#f7 ,national security sy/em ,!
 t]m national security sy/em has ! mean+
 giv5 ! t]m 9 section #ceeb7;b7 ( title 
#dd1 ,unit$ ,/ates ,code4  7#g7         
,p5etration te/ ,! t]m p5etration te/   
has ! mean+ giv5 ! t]m 9 section        
#ceeb7;b7 ( title #dd1 ,unit$ ,/ates    
,code1 z am5d$ by ?is ,act4  7#h7 ,?reat
 hunt+ ,! t]m ?reat hunt+ means         
it]atively se>*+ sy/ems = ?reats t evade
 detection by automat$ ?reat detection  
sy/ems4  7#i7 ,z]o tru/ ar*itecture ,!  
t]m z]o tru/ ar*itecture means a        
security model1 a set ( sy/em design    
pr9ciples1 & a coord9at$ cyb]security & 

sy/em managem5t /rategy t employs       
cont9u\s monitor+1 risk-bas$ access     
controls1 or sy/em security automation  
te*niques to address ! cyb]security     
pr9ciple t ?reats exi/ bo? inside &     
outside traditional network b\nd>ies )  
an assumption t a brea* is inevitable or
 has likely already occurr$1 & !re=e    
employs lea/-privileg$ access = network 
or sy/em us]s :ile monitor+ = anomal\s  
or malici\s activity4  ,i ,,updates ,,to
 ,,fisma  #aja4 ,title #dd am5dm5ts  7a7
 ,sub*apt] ,i am5dm5ts ,sub*apt] ,i (   
*apt] #ce ( title #dd1 ,unit$ ,/ates    
,code1 is am5d$-- 7#a7 9 subsection     
7a77#a77;,b7 ( section #cejd-- 7,a7 by  
/rik+ clause 7v7 & ins]t+ ! foll[+3  7v7
 confid5tiality1 privacy1 disclosure1 & 
%>+ ( in=mation2  2  7,b7 by r$esignat+ 
clause 7vi7 z clause 7vii72 &  7,c7 by  
ins]t+ aft] clause 7v7 ! foll[+3  7vi7 9
 consultation ) ! ,national ,cyb]       
,director1 confid5tiality & security (  
in=mation2 &  2  7#b7 9 section #ceje-- 
7,a7 9 p>agraph 7#b7 ( ! fir/ subsection

 designat$ z subsection 7c7 by add+     
discov]y ( int]net-accessible in=mation 
sy/ems & assets1 z well z aft] an       
inv5tory "u ?is subsection %all include2
  7,b7 9 p>agraph 7#c7 ( ! fir/         
subsection designat$ z subsection 7c7-- 
7i7 9 subp>agraph 7,b7-- 7,i7 by ins]t+ 
! ,secret>y ( ,homel& ,security act+    
?r\gh ! ,director ( ! ,cyb]security &   
,infra/ructure ,security ,ag5cy1 !      
,national ,cyb] ,director1 & be=e !     
,comptroll] ,g5]al2 &  7,,ii7 by /rik+ &
 at ! end2  7ii7 9 subp>agraph 7,c77v71 
by /rik+ ! p]iod at ! end & ins]t+ 2 &2 
&  7iii7 by add+ at ! end ! foll[+3     
7,d7 ma9ta9$ on a cont9ual basis ?r\gh !
 use ( automation1 ma*9e-readable data1 
& scann+ :]ev] practicable4  2 &  7,c7  
by /rik+ ! second subsection designat$ z
 subsection 7c72  7#c7 9 section #cejf--
 7,a7 9 subsection 7a77#c71 by ins]t+ ,9
 c>ry+ out ^! duties1 ! ,*ief ,in=mation
 ,(fic] %all coord9ate1 z appropriate1 )
 ! ,*ief ,data ,(fic] 9 accordance ) !  
designat$ functions "u section          

#cebj7;c74 aft] r$uction ( in=mation    
collection burd5s on ! public42 &  7,b7 
9 subsection 7b77#a77;,c71 by ins]t+ 1  
availability aft] integrity2 &  7#d7 9  
section #ceac-- 7,a7 by r$esignat+      
subsection 7c7 z subsection 7d72 &  7,b7
 by ins]t+ aft] subsection 7b7 ! foll[+3
  7c7 ,ea* ag5cy provid+ a writt5 plan  
"u subsection 7b7 %all provide any      
portion ( ! writt5 plan address+        
in=mation security to ! ,national ,cyb] 
,director4  4  7b7 ,sub*apt] ,,ii       
def9itions  7#a7 ,9 g5]al ,section      
#ceeb7;b7 ( title #dd1 ,unit$ ,/ates    
,code1 is am5d$-- 7,a7 by r$esignat+    
p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 
7#f71 & 7#g7 z p>agraphs 7#b71 7#d71    
7#e71 7#f71 7#g71 7#i71 & 7#aa71        
respectively2  7,b7 by ins]t+ be=e      
p>agraph 7#b71 z s r$esignat$1 ! foll[+3
  7#a7 ,! t]m additional cyb]security   
proc$ure means a process1 proc$ure1 or  
o!r activity t is e/abli%$ 9 excess ( ! 
in=mation security /&>ds promulgat$ "u  
section #aacca7;b7 ( title #dj to       

increase ! security & r$uce !           
cyb]security risk ( ag5cy sy/ems4  2    
7,c7 by ins]t+ aft] p>agraph 7#b71 z s  
r$esignat$1 ! foll[+3  7#c7 ,! t]m high 
value asset means in=mation or an       
in=mation sy/em t ! head ( an ag5cy     
det]m9es1 us+ policies1 pr9ciples1      
/&>ds1 or guidel9es issu$ by ! ,director
 "u section #ceec7;a71 to be s critical 
to ! ag5cy t ! loss or corruption ( !   
in=mation or ! loss ( access to !       
in=mation sy/em w\ld h a s]i\s impact on
 ! ability ( ! ag5cy to p]=m ! mission (
 ! ag5cy or conduct bus9ess4  2  7,d7 by
 ins]t+ aft] p>agraph 7#g71 z s         
r$esignat$1 ! foll[+3  7#h7 ,! t]m major
 incid5t has ! mean+ giv5 ! t]m 9       
guidance issu$ by ! ,director "u section
 #ceih7;a74  2  7,e7 by ins]t+ aft]     
p>agraph 7#i71 z s r$esignat$1 ! foll[+3
  7#aj7 ,! t]m p5etration te/ has !     
mean+ giv5 ! t]m 9 guidance issu$ by !  
,director4  2 &  7,f7 by ins]t+ aft]    
p>agraph 7#aa71 z s r$esignat$1 !       
foll[+3  7#ab7 ,! t]m %>$ s]vice means a

 c5traliz$ bus9ess or mission capability
 t is provid$ to multiple organizations 
)9 an ag5cy or to multiple ag5cies4  4  
7#b7 ,con=m+ am5dm5ts  7,a7 ,homel&     
security act ( #bjjb ,section           
#ajja7;c77#a77;,a7 ( ! ,homel& ,security
 ,act ( #bjjb 7#f ,u4,s4,c4             
#eaa7a77;,a77 is am5d$ by /rik+ section 
#ceeb7;b77#e7 & ins]t+ section          
#ceeb7;b74  7,b7 ,title #aj  7i7        
,section #bbbb ,section #bbbb7;i77#h7 ( 
title #aj1 ,unit$ ,/ates ,code1 is am5d$
 by /rik+ section #ceeb7;b77#f77;,a7 &  
ins]t+ section #ceeb7;b77#i77;,a74  7ii7
 ,section #bbbc ,section #bbbc7;c77#c7 (
 title #aj1 ,unit$ ,/ates ,code1 is     
am5d$ by /rik+ section #ceeb7;b77#f7 &  
ins]t+ section #ceeb7;b74  7iii7        
,section #bcae ,section #bcae ( title   
#aj1 ,unit$ ,/ates ,code1 is am5d$ by   
/rik+ section #ceeb7;b77#f7 & ins]t+    
section #ceeb7;b74  7iv7 ,section       
#bcci;a ,section #bcci;a7e77#e7 ( title 
#aj1 ,unit$ ,/ates ,code1 is am5d$ by   
/rik+ section #ceeb7;b77#f7 & ins]t+    

section #ceeb7;b74  7,c7 ,high-p]=mance 
comput+ act ( #aiia ,section #bjg7;a7 ( 
! ,high-,p]=mance ,comput+ ,act ( #aiia 
7#ae ,u4,s4,c4 #eebg7;a77 is am5d$ by   
/rik+ section #ceeb7;b77#f77;,a77i7 &   
ins]t+ section #ceeb7;b77#i77;,a77i74   
7,d7 ,int]net ( ?+s cyb]security        
improvem5t act ( #bjbj ,section #c7e7 ( 
! ,int]net ( ,?+s ,cyb]security         
,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 
#bgh;g-#c;a7 is am5d$ by /rik+ section  
#ceeb7;b77#f7 & ins]t+ section          
#ceeb7;b74  7,e7 ,national def5se       
au?orization act = fiscal ye> #bjac     
,section #icc7;e77#a77;,b7 ( ! ,national
 ,def5se ,au?orization ,act = ,fiscal   
,ye> #bjac 7#aj ,u4,s4,c4 #bbbd note7 is
 am5d$ by /rik+ section #cedb7;b77#b7 & 
ins]t+ section #ceeb7;b74  7,f7 ,ike    
skelton national def5se au?orization act
 = fiscal ye> #bjaa ,! ,ike ,skelton    
,national ,def5se ,au?orization ,act =  
,fiscal ,ye> #bjaa 7,public ,law        
#aaa-chc7 is am5d$-- 7i7 9 section      
#hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71

 by /rik+ section #cedb7;b7 & ins]t+    
section #ceeb7;b72  7ii7 9 section      
#ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71
 by /rik+ section #cedb7;b77#b7 & ins]t+
 section #ceeb7;b72 &  7iii7 9 section  
#icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71
 by /rik+ section #cedb7;b77#b7 & ins]t+
 section #ceeb7;b74  7,g7 ,e-gov]nm5t   
act ( #bjjb ,section #cja7;c77#a77;,a7 (
 ! ,e-,gov]nm5t ,act ( #bjjb 7#dd       
,u4,s4,c4 #ceja note7 is am5d$ by /rik+ 
section #cedb7;b77#b7 & ins]t+ section  
#ceeb7;b74  7,h7 ,national in/itute (   
/&>ds & te*nology act ,section #bj ( !  
,national ,in/itute ( ,/&>ds &          
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c7 is am5d$-- 7i7 9 subsection  
7a77#b71 by /rik+ section #ceeb7;b77#e7 
& ins]t+ section #ceeb7;b72 &  7ii7 9   
subsection 7f7-- 7,i7 9 p>agraph 7#c71  
by /rik+ section #cecb7a7 & ins]t+      
section #ceeb7;b72 &  7,,ii7 9 p>agraph 
7#e71 by /rik+ section #cecb7;b77#b7 &  
ins]t+ section #ceeb7;b74  7c7 ,sub*apt]
 ,,ii am5dm5ts ,sub*apt] ,,ii ( *apt]   

#ce ( title #dd1 ,unit$ ,/ates ,code1 is
 am5d$-- 7#a7 9 section #ceea-- 7,a7 9  
p>agraph 7#d71 by /rik+ diagnose &      
improve & ins]t+ integrate1 deliv]1     
diagnose1 & improve2  7,b7 9 p>agraph   
7#e71 by /rik+ & at ! end2  7,c7 9      
p>agraph 7#f71 by /rik+ ! p]iod at ! end
 & ins]t+ a semicolon2 &  7,d7 by add+  
at ! end ! foll[+3  7#g7 recognize t ea*
 ag5cy has specific mission requirem5ts 
&1 at times1 unique cyb]security        
requirem5ts to meet ! mission ( ! ag5cy2
  7#h7 recognize t ea* ag5cy does n h ! 
same res\rces to secure ag5cy sy/ems1 & 
an ag5cy %\ld n be expect$ to h !       
capability to secure ! sy/ems ( ! ag5cy 
f advanc$ adv]s>ies alone2 &  7#i7      
recognize t a holi/ic ,f$]al            
cyb]security model is necess>y to acc\nt
 = diff]5ces betwe5 ! missions &        
capabilities ( ag5cies4  2  7#b7 9      
section #ceec-- 7,a7 9 subsection 7a7-- 
7i7 9 p>agraph 7#e71 by /rik+ & at !    
end2  7ii7 9 p>agraph 7#f71 by /rik+ !  
p]iod at ! end & ins]t+ 2 &2 &  7iii7 by

 add+ at ! end ! foll[+3  7#g7 promot+1 
9 consultation ) ! ,director ( !        
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 ! ,national ,cyb] ,director1 & 
! ,director ( ! ,national ,in/itute (   
,/&>ds & ,te*nology-- 7,a7 ! use (      
automation to improve ,f$]al            
cyb]security & visibility ) respect to !
 implem5tation ( ,f$]al cyb]security2 & 
7,b7 ! use ( z]o tru/ ar*itecture to    
improve resili5cy & timely response     
actions to incid5ts on ,f$]al sy/ems4  2
  7,b7 9 subsection 7b7-- 7i7 9 ! matt] 
prec$+ p>agraph 7#a71 by /rik+ ,!       
,secret>y1 9 consultation ) ! ,director 
& ins]t+ ,! ,secret>y ( ,homel&         
,security1 act+ ?r\gh ! ,director ( !   
,cyb]security & ,infra/ructure ,security
 ,ag5cy & 9 consultation ) ! ,director &
 ! ,national ,cyb] ,director2  7ii7 9   
p>agraph 7#b77;,a71 by ins]t+ & report+ 
requirem5ts "u sub*apt] ,,iv ( ?is *apt]
 aft] section #ceef2  7iii7 r$esignate  
p>agraphs 7#h7 & 7#i7 z p>agraphs 7#i7 &
 7#aj72 &  7iv7 ins]t a new p>agraph    

7#h73  7#h7 exp$iti\sly seek            
opportunities to r$uce co/s1            
adm9i/rative burd5s1 & o!r b>ri]s to    
in=mation te*nology security &          
mod]nization = ,f$]al ag5cies1 includ+  
?r\gh-- 7,a7 c5tral %>$ s]vices         
contracts = cyb]security capabilities   
id5tifi$ z optimal by ! ,director1 9    
coord9ation ) ! ,secret>y act+ ?r\gh !  
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy & o!r   
ag5cies z appropriate2 &  7,b7 (f]+     
te*nical assi/ance & exp]tise to ag5cies
 on ! selection & successful engagem5t (
 highly adaptive cyb]security s]vice    
contracts & o!r relevant contracts      
provid$ by ! ,u4,s4 ,g5]al ,s]vices     
,adm9i/ration4  2  7,c7 9 subsection    
7c7-- 7i7 9 ! matt] prec$+ p>agraph     
7#a71 by /rik+ ea* ye> & ins]t+ ea* ye> 
dur+ :i* ag5cies are requir$ to submit  
reports "u section #ceed7;c7 & by /rik+ 
prec$+ ye> & ins]t+ prec$+ two ye>s2    
7ii7 by /rik+ p>agraph 7#a72  7iii7 by  
r$esignat+ p>agraphs 7#b71 7#c71 & 7#d7 

z p>agraphs 7#a71 7#b71 & 7#c71         
respectively2  7iv7 9 p>agraph 7#c71 z s
 r$esignat$1 by /rik+ & at ! end2 &  7v7
 by ins]t+ aft] p>agraph 7#c71 z s      
r$esignat$1 ! foll[+3  7#d7 a summ>y (  
ea* assessm5t ( ,f$]al risk po/ure p]=m$
 "u subsection 7i72 &  2  7,d7 by       
r$esignat+ subsections 7i71 7j71 7k71 & 
7l7 z subsections 7j71 7k71 7l71 & 7m7  
respectively2  7,e7 9 subsection 7h7--  
7i7 9 p>agraph 7#b71 subp>agraph 7,a7   
add+ & ! ,national ,cyb] ,director aft] 
9 coord9ation ) ! ,director2  7ii7 9    
p>agraph 7#b71 subp>agraph 7,d7 add+ 1 !
 ,national ,cyb] ,director1 aft] notify 
! ,director2 &  7iii7 9 p>agraph 7#c71  
subp>agraph 7,a71 clause 7iv7 add+ 1 !  
,national ,cyb] ,director1 aft] !       
,secret>y provides prior notice to !    
,director2  7,f7 by ins]t+ aft]         
subsection 7h7 ! foll[+3  7i7 ,f$]al    
risk assessm5ts ,on an ongo+ & cont9u\s 
basis1 ! ,director ( ! ,cyb]security &  
,infra/ructure ,security ,ag5cy %all    
p]=m assessm5ts us+ any available       

in=mation on ! cyb]security po/ure (    
ag5cies1 & brief ! ,director & ,national
 ,cyb] ,director on ! f9d+s ( ^?        
assessm5ts includ+-- 7#a7 ! /atus (     
ag5cy cyb]security rem$ial actions      
describ$ 9 section #ceed7;b77#g72  7#b7 
any vuln]ability in=mation relat+ to !  
sy/ems ( an ag5cy t is kn[n by ! ag5cy2 
7#c7 analysis ( incid5t in=mation "u    
section #ceig2  7#d7 evaluation (       
p5etration te/+ p]=m$ "u section        
#ceei;,a2  7#e7 evaluation (            
vuln]ability disclosure program         
in=mation "u section #ceei;,b2  7#f7    
evaluation ( ag5cy ?reat hunt+ results2 
7#g7 evaluation ( ,f$]al & non-,f$]al   
cyb] ?reat intellig5ce2  7#h7 data on   
ag5cy compliance ) /&>ds issu$ "u       
section #aacca ( title #dj2  7#i7 ag5cy 
sy/em risk assessm5ts p]=m$ "u section  
#ceed7;a77#a77;,a72 &  7#aj7 any o!r    
in=mation ! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy       
det]m9es relevant4  2  7,g7 9 subsection
 7j71 z s r$esignat$-- 7i7 by /rik+ ,n  

lat] ?an & ins]t+3  7#a7 ,9 g5]al ,n    
lat] ?an  2  7ii7 by /rik+ reg>d+ !     
specific & ins]t+ t includes a summ>y   
(-- 7,a7 ! specific  2  7iii7 9 p>agraph
 7#a71 z s designat$1 by /rik+ ! p]iod  
at ! end & ins]t+ 2 &2 &  7iv7 by add+  
at ! end ! foll[+3  7,b7 ! tr5ds        
id5tifi$ 9 ! ,f$]al risk assessm5ts     
p]=m$ "u subsection 7i74  7#b7 ,=m ,!   
report requir$ "u p>agraph 7#a7 %all be 
unclassifi$ b may include a classifi$   
annex4  2 &  7,h7 by add+ at ! end !    
foll[+3  7n7 ,b9d+ op]ational directives
 ,if ! ,director ( ! ,cyb]security &    
,infra/ructure ,security ,ag5cy issues a
 b9d+ op]ational directive or an em]g5cy
 directive "u ?is section1 n lat] ?an #g
 days aft] ! date on :i* ! b9d+         
op]ational directive requires an ag5cy  
to take an action1 ! ,director ( !      
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all provide to ! ,director &   
,national ,cyb] ,director ! /atus ( !   
implem5tation ( ! b9d+ op]ational       
directive at ! ag5cy4  2  7#c7 9 section

 #ceed-- 7,a7 9 subsection 7a7-- 7i7 9  
p>agraph 7#a7-- 7,i7 by r$esignat+      
subp>agraphs 7,a71 7,b71 & 7,c7 z       
subp>agraphs 7,b71 7,c71 & 7,d71        
respectively2  7,,ii7 by ins]t+ be=e    
subp>agraph 7,b71 z s r$esignat$1 !     
foll[+3  7,a7 on an ongo+ & cont9u\s    
basis1 p]=m+ an ag5cy sy/em risk        
assessm5t t-- 7i7 id5tifies & docum5ts !
 high value assets ( ! ag5cy us+        
guidance f ! ,director2  7ii7 evaluates 
! data assets inv5tori$ "u section #ceaa
 = s5sitivity to compromises 9          
confid5tiality1 integrity1 &            
availability2  7iii7 id5tifies ag5cy    
sy/ems t h access to or hold ! data     
assets inv5tori$ "u section #ceaa2  7iv7
 evaluates ! ?reats fac+ ag5cy sy/ems & 
data1 includ+ high value assets1 bas$ on
 ,f$]al & non-,f$]al cyb] ?reat         
intellig5ce products1 :]e available2    
7v7 evaluates ! vuln]ability ( ag5cy    
sy/ems & data1 includ+ high value       
assets1 includ+ by analyz+-- 7,i7 !     
results ( p5etration te/+ p]=m$ by !    

,dep>tm5t ( ,homel& ,security "u section
 #ceec7;b77#i72  7,,ii7 ! results (     
p5etration te/+ p]=m$ "u section        
#ceei;,a2  7,,iii7 in=mation provid$ to 
! ag5cy ?r\gh ! vuln]ability disclosure 
program ( ! ag5cy "u section #ceei;,b2  
7,,iv7 incid5ts2 &  7,v7 any o!r        
vuln]ability in=mation relat+ to ag5cy  
sy/ems t is kn[n to ! ag5cy2  7vi7      
assesses ! impacts ( pot5tial ag5cy     
incid5ts to ag5cy sy/ems1 data1 &       
op]ations bas$ on ! evaluations describ$
 9 clauses 7ii7 & 7iv7 & ! ag5cy sy/ems 
id5tifi$ "u clause 7iii72 &  7vii7      
assesses ! consequ5ces ( pot5tial       
incid5ts occurr+ on ag5cy sy/ems t w\ld 
impact sy/ems at o!r ag5cies1 includ+   
due to int]connectivity betwe5 diff]5t  
ag5cy sy/ems or op]ational reliance on !
 op]ations ( ! sy/em or data 9 ! sy/em2 
2  7,,iii7 9 subp>agraph 7,b71 z s      
r$esignat$1 9 ! matt] prec$+ clause 7i71
 by /rik+ provid+ in=mation & ins]t+ us+
 in=mation f ! assessm5t conduct$ "u    
subp>agraph 7,a71 provid+ in=mation2    

7,,iv7 9 subp>agraph 7,c71 z s          
r$esignat$-- 7aa7 9 clause 7ii7 by      
ins]t+ b9d+ be=e op]ational2 &  7bb7 9  
clause 7vi71 by /rik+ & at ! end2 &     
7,v7 by add+ at ! end ! foll[+3  7,e7   
provid+ an update on ! ongo+ & cont9u\s 
assessm5t p]=m$ "u subp>agraph 7,a7--   
7i7 ^u reque/1 to ! inspector g5]al ( ! 
ag5cy or ! ,comptroll] ,g5]al ( ! ,unit$
 ,/ates2 &  7ii7 on a p]iodic basis1 z  
det]m9$ by guidance issu$ by ! ,director
 b n less frequ5tly ?an e #b ye>s1 to-- 
7,i7 ! ,director2  7,,ii7 ! ,director ( 
! ,cyb]security & ,infra/ructure        
,security ,ag5cy2 &  7,,iii7 ! ,national
 ,cyb] ,director2  7,f7 9 consultation )
 ! ,director ( ! ,cyb]security &        
,infra/ructure ,security ,ag5cy & n less
 frequ5tly ?an once e #c ye>s1 p]=m+ an 
evaluation ( :e!r additional            
cyb]security proc$ures are appropriate =
 secur+ a sy/em (1 or "u ! sup]vision (1
 ! ag5cy1 :i* %all-- 7i7 be complet$    
consid]+ ! ag5cy sy/em risk assessm5t   
p]=m$ "u subp>agraph 7,a72 &  7ii7      

include a specific evaluation = high    
value assets2  7,g7 n lat] ?an #cj days 
aft] complet+ ! evaluation p]=m$ "u     
subp>agraph 7,f71 provid+ ! evaluation &
 an implem5tation plan1 if applicable1 =
 us+ additional cyb]security proc$ures  
det]m9$ to be appropriate to-- 7i7 !    
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy2  7ii7 !
 ,director2 &  7iii7 ! ,national ,cyb]  
,director2 &  7,h7 if ! head ( ! ag5cy  
det]m9es !re is ne$ = additional        
cyb]security proc$ures1 ensur+ t ^?     
additional cyb]security proc$ures are   
reflect$ 9 ! budget reque/ ( ! ag5cy2  2
 &  7ii7 9 p>agraph 7#b7-- 7,i7 9       
subp>agraph 7,a71 by ins]t+ 9 accordance
 ) ! ag5cy sy/em risk assessm5t p]=m$ "u
 p>agraph 7#a77;,a7 aft] in=mation      
sy/ems2  7,,ii7 9 subp>agraph 7,b7--    
7aa7 by /rik+ 9 accordance ) /&>ds &    
ins]t+ 9 accordance )-- 7i7 /&>ds  2 &  
7bb7 by add+ at ! end ! foll[+3  7ii7 ! 
evaluation p]=m$ "u p>agraph 7#a77;,f72 
&  7iii7 ! implem5tation plan describ$ 9

 p>agraph 7#a77;,g72  2 &  7,,iii7 9    
subp>agraph 7,d71 by ins]t+ 1 ?r\gh !   
use ( p5etration te/+1 ! vuln]ability   
disclosure program e/abli%$ "u section  
#ceei;,b1 & o!r means1 aft] p]iodically2
  7,b7 9 subsection 7b7-- 7i7 by /rik+  
p>agraph 7#a7 & ins]t+ ! foll[+3  7#a7  
pursuant to subsection 7a77#a77;,a71    
p]=m+ ongo+ & cont9u\s ag5cy sy/em risk 
assessm5t1 :i* may include us+ automat$ 
tools consi/5t ) /&>ds & guidel9es      
promulgat$ "u section #aacca ( title    
#dj1 z applicable2  2  7ii7 9 p>agraph  
7#b77;,d7-- 7,i7 by r$esignat+ clauses  
7iii7 & 7iv7 z clauses 7iv7 & 7v71      
respectively2  7,,ii7 by ins]t+ aft]    
clause 7ii7 ! foll[+3  7iii7 b9d+       
op]ational directives & em]g5cy         
directives promulgat$ by ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy "u section #ceec2  2 & 
7,,iii7 9 clause 7iv71 z s r$esignat$1  
by /rik+ z det]m9$ by ! ag5cy2 & &      
ins]t+ z det]m9$ by ! ag5cy1 consid]+ ! 
ag5cy risk assessm5t p]=m$ "u subsection

 7a77#a77;,a742  7iii7 9 p>agraph       
7#e77;,a71 by ins]t+ 1 includ+          
p5etration te/+1 z appropriate1 aft]    
%all include te/+2  7iv7 by r$esignat+  
p>agraphs 7#g7 & 7#h7 z p>agraphs 7#h7 &
 7#i71 respectively2  7v7 by ins]t+ aft]
 p>agraph 7#f7 ! foll[+3  7#g7 a process
 = provid+ ! /atus ( e rem$ial action1 z
 well z unrem$iat$ id5tifi$ sy/em       
vuln]abilities1 to ! ,director & !      
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 us+    
automation & ma*9e-readable data to !   
greate/ ext5t practicable2  2 &  7vi7 9 
p>agraph 7#h77;,c71 z s r$esignat$--    
7,i7 by /rik+ clause 7ii7 & ins]t+ !    
foll[+3  7ii7 notify+ & consult+ ) !    
,f$]al in=mation security incid5t c5t]  
e/abli%$ "u section #ceef pursuant to ! 
requirem5ts ( section #ceid2  2  7,,ii7 
by r$esignat+ clause 7iii7 z clause     
7iv72  7,,iii7 by ins]t+ aft] clause    
7ii7 ! foll[+3  7iii7 p]=m+ !           
notifications & o!r activities requir$  
"u sub*apt] ,,iv ( ?is *apt]2 &  2 &    

7,,iv7 9 clause 7iv71 z s r$esignat$--  
7aa7 9 subclause 7,,ii71 by add+ & at ! 
end2  7bb7 by /rik+ subclause 7,,iii72 &
  7cc7 by r$esignat+ subclause 7,,iv7 z 
subclause 7,,iii72 &  7,c7 9 subsection 
7c7-- 7i7 by r$esignat+ p>agraph 7#b7 z 
p>agraph 7#e72  7ii7 by /rik+ p>agraph  
7#a7 & ins]t+ ! foll[+3  7#a7 ,biannual 
report ,n lat] ?an #b ye>s aft] ! date (
 ! enactm5t ( ! ,f$]al ,in=mation       
,security ,mod]nization ,act ( #bjbb & n
 less frequ5tly ?an once e #b ye>s      
!reaft]1 us+ ! cont9u\s & ongo+ ag5cy   
sy/em risk assessm5t "u subsection      
7a77#a77;,a71 ! head ( ea* ag5cy %all   
submit to ! ,director1 ! ,director ( !  
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 ! majority & m9ority lead]s ( !
 ,s5ate1 ! ,speak] & m9ority lead] ( !  
,h\se ( ,repres5tatives1 ! ,committee on
 ,homel& ,security & ,gov]nm5tal        
,affairs ( ! ,s5ate1 ! ,committee on    
,ov]sight & ,re=m ( ! ,h\se (           
,repres5tatives1 ! ,committee on ,homel&
 ,security ( ! ,h\se ( ,repres5tatives1 

! ,committee on ,comm]ce1 ,sci5ce1 &    
,transportation ( ! ,s5ate1 ! ,committee
 on ,sci5ce1 ,space1 & ,te*nology ( !   
,h\se ( ,repres5tatives1 ! appropriate  
au?orization & appropriations committees
 ( ,congress1 ! ,national ,cyb]         
,director1 & ! ,comptroll] ,g5]al ( !   
,unit$ ,/ates a report t-- 7,a7         
summ>izes ! ag5cy sy/em risk assessm5t  
p]=m$ "u subsection 7a77#a77;,a72  7,b7 
evaluates ! adequacy & effectiv5ess (   
in=mation security policies1 proc$ures1 
& practices ( ! ag5cy to address ! risks
 id5tifi$ 9 ! ag5cy sy/em risk assessm5t
 p]=m$ "u subsection 7a77#a77;,a71      
includ+ an analysis ( ! ag5cy's         
cyb]security & incid5t response         
capabilities us+ ! metrics e/abli%$ "u  
section #bbd7;c7 ( ! ,cyb]security ,act 
( #bjae 7#f ,u4,s4,c4 #aebb7;c772  7,c7 
summ>izes ! evaluation & implem5tation  
plans describ$ 9 subp>agraphs 7,f7 &    
7,g7 ( subsection 7a77#a7 & :e!r ^?     
evaluation & implem5tation plans call = 
! use ( additional cyb]security         

proc$ures det]m9$ to be appropriate by !
 ag5cy2 &  7,d7 summ>izes ! /atus (     
rem$ial actions id5tifi$ by inspector   
g5]al ( ! ag5cy1 ! ,comptroll] ,g5]al ( 
! ,unit$ ,/ates1 & any o!r s\rce det]m9$
 appropriate by ! head ( ! ag5cy4  7#b7 
,unclassifi$ reports ,ea* report        
submitt$ "u p>agraph 7#a7-- 7,a7 %all   
be1 to ! greate/ ext5t practicable1 9 an
 unclassifi$ & o!rwise uncontroll$ =m2 &
  7,b7 may include a classifi$ annex4   
7#c7 ,access to in=mation ,! head ( an  
ag5cy %all ensure t1 to ! greate/ ext5t 
practicable1 in=mation is includ$ 9 !   
unclassifi$ =m ( ! report submitt$ by ! 
ag5cy "u p>agraph 7#b77;,a74  7#d7      
,brief+s ,dur+ ea* ye> dur+ :i* a report
 is n requir$ to be submitt$ "u p>agraph
 7#a71 ! ,director %all provide to !    
congressional committees describ$ 9     
p>agraph 7#a7 a brief+ summ>iz+ curr5t  
cyb]security po/ure ( ag5cies4  2 &     
7iii7 9 p>agraph 7#e71 z s r$esignat$1  
by ins]t+ 1 includ+ ! report+ proc$ures 
e/abli%$ "u section #aacae7;d7 ( title  

#dj & subsection 7a77#c77;,a77v7 ( ?is  
section1 aft] policies1 proc$ures1 &    
practices2 &  7#d7 9 section #ceee--    
7,a7 9 ! section head+1 by /rik+ ,annual
 indep5d5t & ins]t+ ,indep5d5t2  7,b7 9 
subsection 7a7-- 7i7 9 p>agraph 7#a71 by
 ins]t+ dur+ :i* a report is requir$ to 
be submitt$ "u section #ceec7;c71 aft]  
,ea* ye>2  7ii7 9 p>agraph 7#b77;,a71 by
 ins]t+ 1 includ+ by p5etration te/+ &  
analyz+ ! vuln]ability disclosure       
program ( ! ag5cy aft] in=mation sy/ems2
 &  7iii7 by add+ at ! end ! foll[+3    
7#c7 ,an evaluation "u ?is section may  
include recomm5dations = improv+ !      
cyb]security po/ure ( ! ag5cy4  2  7,c7 
9 subsection 7b77#a71 by /rik+ annual2  
7,d7 9 subsection 7e77#a71 by ins]t+    
dur+ :i* a report is requir$ to be      
submitt$ "u section #ceec7;c7 aft] ,ea* 
ye>2  7,e7 by /rik+ subsection 7f7 &    
ins]t+ ! foll[+3  7f7 ,protection (     
in=mation  7#a7 ,ag5cies1 evaluators1 & 
o!r recipi5ts ( in=mation t1 if         
disclos$1 may cause grave h>m to ! ef=ts

 ( ,f$]al in=mation security (fic]s1    
%all take appropriate /eps to ensure !  
protection ( t in=mation1 includ+       
safegu>d+ ! in=mation f public          
disclosure4  7#b7 ,! protections requir$
 "u p>agraph 7#a7 %all be comm5surate ) 
! risk & comply ) all applicable laws & 
regulations4  7#c7 ,) respect to        
in=mation t is n relat$ to national     
security sy/ems1 ag5cies & evaluators   
%all make a summ>y ( ! in=mation        
unclassifi$ & publicly available1       
includ+ in=mation t does n id5tify--    
7,a7 specific in=mation sy/em incid5ts2 
or  7,b7 specific in=mation sy/em       
vuln]abilities4  2  7,f7 9 subsection   
7g77#b7-- 7i7 by /rik+ ?is subsection   
%all & ins]t+ ?is subsection-- 7,a7 %all
  2  7ii7 9 subp>agraph 7,a71 z s       
designat$1 by /rik+ ! p]iod at ! end &  
ins]t+ 2 &2 &  7iii7 by add+ at ! end ! 
foll[+3  7,b7 id5tify any entity t p]=ms
 an indep5d5t evaluation "u subsection  
7b74  2 &  7,g7 /rik+ subsection 7j72 & 
7#e7 9 section #ceef7;a77#d7 by /rik+   

#ceed7;b7 & ins]t+ #ceed7;a77#a77;,a74  
7d7 ,con=m+ am5dm5ts  7#a7 ,table (     
sections ,! table ( sections = *apt] #ce
 ( title #dd1 ,unit$ ,/ates ,code1 is   
am5d$-- 7,a7 by /rik+ ! item relat+ to  
section #ceec & ins]t+ ! foll[+3  #ceec4
 ,au?ority & functions ( ! ,director & !
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy4  2  &  
7,b7 by /rik+ ! item relat+ to section  
#ceee & ins]t+ ! foll[+3  #ceee4        
,indep5d5t evaluation4  4  7#b7 ,,omb   
reports ,section #bbf7;c7 ( !           
,cyb]security ,act ( #bjae 7#f ,u4,s4,c4
 #aebd7;c77 is am5d$-- 7,a7 9 p>agraph  
7#a77;,b71 9 ! matt] prec$+ clause 7i71 
by /rik+ annually !reaft] & ins]t+      
!reaft] dur+ ! ye>s dur+ :i* a report is
 requir$ to be submitt$ "u section      
#ceec7;c7 ( title #dd1 ,unit$ ,/ates    
,code2 &  7,b7 9 p>agraph 7#b77;,b71 9 !
 matt] prec$+ clause 7i7-- 7i7 by /rik+ 
annually !reaft] & ins]t+ !reaft] dur+ !
 ye>s dur+ :i* a report is requir$ to be
 submitt$ "u section #ceec7;c7 ( title  

#dd1 ,unit$ ,/ates ,code2 &  7ii7 by    
/rik+ ! report requir$ "u section       
#ceec7;c7 ( title #dd1 ,unit$ ,/ates    
,code & ins]t+ t report4  7#c7 ,,ni/    
responsibilities ,section               
#bj7;d77#c77;,b7 ( ! ,national ,in/itute
 ( ,/&>ds & ,te*nology ,act 7#ae        
,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is    
am5d$ by /rik+ annual4  7e7 ,f$]al sy/em
 incid5t response  7#a7 ,9 g5]al ,*apt] 
#ce ( title #dd1 ,unit$ ,/ates ,code1 is
 am5d$ by add+ at ! end ! foll[+3  ,,iv 
,f$]al ,sy/em ,incid5t ,response  #ceia4
 ,def9itions  7a7 ,9 g5]al ,except z    
provid$ 9 subsection 7b71 ! def9itions  
"u sections #cejb & #ceeb %all apply to 
?is sub*apt]4  7b7 ,additional          
def9itions ,z us$ 9 ?is sub*apt]3 7#a7  
,appropriate report+ entities ,! t]m    
appropriate report+ entities means--    
7,a7 ! majority & m9ority lead]s ( !    
,s5ate2  7,b7 ! ,speak] & m9ority lead] 
( ! ,h\se ( ,repres5tatives2  7,c7 !    
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs ( ! ,s5ate2  7,d7 !

 ,committee on ,ov]sight & ,re=m ( !    
,h\se ( ,repres5tatives2  7,e7 !        
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives2  7,f7 !        
appropriate au?orization &              
appropriations committees ( ,congress2  
7,g7 ! ,director2  7,h7 ! ,director ( ! 
,cyb]security & ,infra/ructure ,security
 ,ag5cy2  7,i7 ! ,national ,cyb]        
,director2  7,j7 ! ,comptroll] ,g5]al ( 
! ,unit$ ,/ates2 &  7,k7 ! inspector    
g5]al ( any impact$ ag5cy4  7#b7 ,aw>dee
 ,! t]m aw>dee-- 7,a7 means a p]son1    
bus9ess1 or o!r entity t receives a     
grant f1 or is a p>ty to a coop]ative   
agreem5t or an o!r transaction agreem5t 
)1 an ag5cy2 &  7,b7 includes any       
subgrantee ( a p]son1 bus9ess1 or o!r   
entity describ$ 9 subp>agraph 7,a74     
7#c7 ,brea* ,! t]m brea* %all be def9$  
by ! ,director4  7#d7 ,contractor ,! t]m
 contractor means a prime contractor (  
an ag5cy or a subcontractor ( a prime   
contractor ( an ag5cy4  7#e7 ,f$]al     
in=mation ,! t]m ,f$]al in=mation means 

in=mation creat$1 collect$1 process$1   
ma9ta9$1 dissem9at$1 disclos$1 or       
dispos$ ( by or = ! ,f$]al ,gov]nm5t 9  
any m$ium or =m4  7#f7 ,f$]al in=mation 
sy/em ,! t]m ,f$]al in=mation sy/em     
means an in=mation sy/em us$ or op]at$  
by an ag5cy1 a contractor1 or ano!r     
organization on behalf ( an ag5cy4  7#g7
 ,intellig5ce community ,! t]m          
intellig5ce community has ! mean+ giv5 !
 t]m 9 section #c ( ! ,national         
,security ,act ( #aidg 7#ej ,u4,s4,c4   
#cjjc74  7#h7 ,nationwide consum]       
report+ ag5cy ,! t]m nationwide consum] 
report+ ag5cy means a consum] report+   
ag5cy describ$ 9 section #fjc7p7 ( !    
,fair ,cr$it ,report+ ,act 7#ae         
,u4,s4,c4 #afha;a7p774  7#i7            
,vuln]ability disclosure ,! t]m         
vuln]ability disclosure means a         
vuln]ability id5tifi$ "u section        
#ceei;,b4  #ceib4 ,notification ( brea* 
7a7 ,notification ,z exp$iti\sly z      
practicable & )\t unreasonable delay1 & 
9 any case n lat] ?an #de days aft] an  

ag5cy has a reasonable basis to conclude
 t a brea* has occurr$1 ! head ( !      
ag5cy1 9 consultation ) ! *ief privacy  
(fic] ( ! ag5cy1 %all-- 7#a7 det]m9e    
:e!r notice to any individual pot5tially
 affect$ by ! brea* is appropriate bas$ 
on an assessm5t ( ! risk ( h>m to !     
individual t consid]s-- 7,a7 ! nature & 
s5sitivity ( ! p]sonally id5tifiable    
in=mation affect$ by ! brea*2  7,b7 !   
likelihood ( access to & use ( !        
p]sonally id5tifiable in=mation affect$ 
by ! brea*2  7,c7 ! type ( brea*2 &     
7,d7 any o!r factors det]m9$ by !       
,director2 &  7#b7 z appropriate1       
provide writt5 notice 9 accordance )    
subsection 7b7 to ea* individual        
pot5tially affect$ by ! brea*-- 7,a7 to 
! la/ kn[n mail+ address ( ! individual2
 or  7,b7 ?r\gh an appropriate          
alt]native me?od ( notification t ! head
 ( ! ag5cy or a designat$ s5ior-level   
individual ( ! ag5cy selects bas$ on    
factors det]m9$ by ! ,director4  7b7    
,cont5ts ( notice ,ea* notice ( a brea* 

provid$ to an individual "u subsection  
7a77#b7 %all include-- 7#a7 a brief     
description ( ! brea*2  7#b7 if         
possible1 a description ( ! types (     
p]sonally id5tifiable in=mation affect$ 
by ! brea*2  7#c7 contact in=mation ( ! 
ag5cy t may be us$ to ask que/ions ( !  
ag5cy1 :i*-- 7,a7 %all include an e-mail
 address or ano!r digital contact       
me*anism2 &  7,b7 may include a         
telephone numb]1 mail+ address1 or a    
website2  7#d7 in=mation on any rem$y   
be+ (f]$ by ! ag5cy2  7#e7 any          
applicable educational mat]ials relat+  
to :at individuals c d 9 response to a  
brea* t pot5tially affects _! p]sonally 
id5tifiable in=mation1 includ+ relevant 
contact in=mation = ,f$]al law en=cem5t 
ag5cies & ea* nationwide consum] report+
 ag5cy2 &  7#f7 any o!r appropriate     
in=mation1 z det]m9$ by ! head ( ! ag5cy
 or e/abli%$ 9 guidance by ! ,director4 
7c7 ,delay ( notification  7#a7 ,9 g5]al
 ,! ,attorney ,g5]al1 ! ,director (     
,national ,intellig5ce1 or ! ,secret>y (

 ,homel& ,security may delay a          
notification requir$ "u subsection 7a7  
if ! notification w\ld-- 7,a7 imp$e a   
crim9al inve/igation or a national      
security activity2  7,b7 reveal s5sitive
 s\rces & me?ods2  7,c7 cause damage to 
national security2 or  7,d7 hamp]       
security rem$iation actions4  7#b7      
,docum5tation  7,a7 ,9 g5]al ,any delay 
"u p>agraph 7#a7 %all be report$ 9 writ+
 to ! ,director1 ! ,attorney ,g5]al1 !  
,director ( ,national ,intellig5ce1 !   
,secret>y ( ,homel& ,security1 !        
,national ,cyb] ,director1 ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy1 & ! head ( ! ag5cy & !
 inspector g5]al ( ! ag5cy t exp]i5c$ ! 
brea*4  7,b7 ,cont5ts ,a report requir$ 
"u subp>agraph 7,a7 %all include a      
writt5 /atem5t f ! entity t delay$ !    
notification expla9+ ! ne$ = ! delay4   
7,c7 ,=m ,! report requir$ "u           
subp>agraph 7,a7 %all be unclassifi$ b  
may include a classifi$ annex4  7#c7    
,r5ewal ,a delay "u p>agraph 7#a7 %all  

be = a p]iod ( #fj days & may be r5ew$4 
7d7 ,update notification ,if an ag5cy   
det]m9es !re is a significant *ange 9 ! 
reasonable basis to conclude t a brea*  
occurr$1 a significant *ange to !       
det]m9ation made "u subsection 7a77#a71 
or t x is necess>y to update ! details (
 ! in=mation provid$ to pot5tially      
affect$ individuals z describ$ 9        
subsection 7b71 ! ag5cy %all z          
exp$iti\sly z practicable & )\t         
unreasonable delay1 & 9 any case n lat] 
?an #cj days aft] su* a det]m9ation1    
notify ea* individual :o receiv$ a      
notification pursuant to subsection 7a7 
( ^? *anges4  7e7 ,rule ( con/ruction   
,no?+ 9 ?is section %all be con/ru$ to  
limit-- 7#a7 ! ,director f issu+        
guidance relat+ to notifications or !   
head ( an ag5cy f notify+ individuals   
pot5tially affect$ by brea*es t are n   
det]m9$ to be major incid5ts2 or  7#b7 !
 ,director f issu+ guidance relat+ to   
notifications ( major incid5ts or ! head
 ( an ag5cy f provid+ m in=mation ?an   

describ$ 9 subsection 7b7 :5 notify+    
individuals pot5tially affect$ by       
brea*es4  #ceic4 ,congressional &       
executive bran* reports  7a7 ,initial   
report  7#a7 ,9 g5]al ,n lat] ?an #gb   
h\rs aft] an ag5cy has a reasonable     
basis to conclude t a major incid5t     
occurr$1 ! head ( ! ag5cy impact$ by !  
major incid5t %all submit to !          
appropriate report+ entities a writt5   
report4 ,)9 #g days ( a major incid5t   
det]m9ation1 ! head ( ! ag5cy impact$   
%all coord9ate ) ! ,national ,cyb]      
,director1 or _! designee1 to provide a 
brief+1 along ) any o!r ,f$]al entity   
det]m9$ appropriate by ! ,national ,cyb]
 ,director1 to ! ,committee on ,homel&  
,security & ,gov]nm5tal ,affairs ( !    
,s5ate1 ! ,committee on ,ov]sight &     
,re=m ( ! ,h\se ( ,repres5tatives1 !    
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives1 & ! appropriate
 au?orization & appropriations          
committees ( ,congress1 9 ! mann]       
reque/$ by ! ,congressional entities1   

tak+ into acc\nt-- 7,a7 ! in=mation kn[n
 at ! "t ( ! report1 includ+ ! ?reat    
hav+ likely caus$ ! major incid5t2  7,b7
 ! s5sitivity ( ! details associat$ ) ! 
major incid5t2 &  7,c7 ! classification 
level ( ! in=mation conta9$ 9 ! report4 
7#b7 ,cont5ts ,a report requir$ "u      
p>agraph 7#a7 %all include1 9 a mann] t 
excludes or o!rwise reasonably protects 
p]sonally id5tifiable in=mation & to !  
ext5t p]mitt$ by applicable law1 includ+
 privacy & /ati/ical laws-- 7,a7 a      
summ>y ( ! in=mation available ab\t !   
major incid5t1 includ+ h[ ! major       
incid5t occurr$ &1 if applicable1       
in=mation relat+ to ! major incid5t z a 
brea*1 bas$ on in=mation available to   
ag5cy (ficials z ( ! date on :i* ! ag5cy
 submits ! report2  7,b7 if applicable1 
:e!r any ransom has be5 dem&$ or paid1  
or plans to be paid1 by any entity      
op]at+ a ,f$]al in=mation sy/em or )    
access to a ,f$]al in=mation sy/em1     
unless disclosure ( su* in=mation may   
disrupt an active ,f$]al law en=cem5t or

 national security op]ation2  7,c7 if   
applicable1 a description & any         
associat$ docum5tation ( any            
circum/ances necessitat+ a delay 9      
notification to individuals pot5tially  
affect$ by ! major incid5t "u subsection
 7c7 ( section #ceib2 &  7,d7 if        
applicable1 an assessm5t ( ! impacts to 
! ag5cy1 ! ,f$]al ,gov]nm5t1 or !       
security ( ! ,unit$ ,/ates1 bas$ on     
in=mation available to ag5cy (ficials on
 ! date on :i* ! ag5cy submits ! report4
  7#c7 ,compon5ts ( brief+ ,! #g day    
brief+ requir$ "u p>agraph 7#a7-- 7,a7  
%all1 to ! greate/ ext5t practicable1   
include an unclassifi$ compon5t2 &  7,b7
 may include a classifi$ compon5t4  7b7 
,supplem5tal report ,)9 a reasonable    
am\nt ( "t1 b n lat] ?an #cj days aft] !
 date on :i* an ag5cy submits a writt5  
report "u subsection 7a71 ! head ( !    
ag5cy %all provide to ! appropriate     
report+ entities writt5 updates on !    
major incid5t &1 to ! ext5t practicable1
 provide a brief+ to ! congressional    

committees describ$ 9 subsection        
7a77#a71 includ+ summ>ies (-- 7#a7      
vuln]abilities1 means by :i* ! major    
incid5t occurr$1 & impacts to ! ag5cy   
relat+ to ! major incid5t2  7#b7 any    
risk assessm5t & subsequ5t risk-bas$    
security implem5tation ( ! affect$      
in=mation sy/em be=e ! date on :i* !    
major incid5t occurr$2  7#c7 an e/imate 
( ! numb] ( individuals pot5tially      
affect$ by ! major incid5t bas$ on      
in=mation available to ag5cy (ficials z 
( ! date on :i* ! ag5cy provides !      
update2  7#d7 an assessm5t ( ! risk (   
h>m to individuals pot5tially affect$ by
 ! major incid5t bas$ on in=mation      
available to ag5cy (ficials z ( ! date  
on :i* ! ag5cy provides ! update2  7#e7 
an update to ! assessm5t ( ! risk to    
ag5cy op]ations1 or to impacts on o!r   
ag5cy or non-,f$]al entity op]ations1   
affect$ by ! major incid5t bas$ on      
in=mation available to ag5cy (ficials z 
( ! date on :i* ! ag5cy provides !      
update2 &  7#f7 ! detection1 response1 &

 rem$iation actions ( ! ag5cy1 includ+  
any support provid$ by ! ,cyb]security &
 ,infra/ructure ,security ,ag5cy "u     
section #ceid7;d7 & /atus updates on !  
notification process describ$ 9 section 
#ceib7;a71 includ+ any delay describ$ 9 
subsection 7c7 ( section #ceib1 if      
applicable4  7c7 ,update report ,if !   
ag5cy1 or ! ,national ,cyb] ,director1  
det]m9es t !re is any significant *ange 
9 ! und]/&+ ( ! ag5cy ( ! scope1 scale1 
or consequ5ce ( a major incid5t = :i* an
 ag5cy submitt$ a writt5 report "u      
subsection 7a71 ! ag5cy %all provide an 
updat$ report to ! appropriate report+  
entities t includes in=mation relat+ to 
! *ange 9 und]/&+4  7d7 ,biannual report
 ,ea* ag5cy %all submit z "p ( !        
biannual report requir$ "u section      
#ceed7;c77#a7 ( ?is title a description 
( ea* major incid5t t occurr$ dur+ !    
#b-ye> p]iod prec$+ ! date on :i* !     
biannual report is submitt$4  7e7 ,delay
 report  7#a7 ,9 g5]al ,! ,director %all
 submit to ! appropriate report+        

entities an annual report on all        
notification delays grant$ pursuant to  
subsection 7c7 ( section #ceib4  7#b7   
,compon5t ( o!r report ,! ,director may 
submit ! report requir$ "u p>agraph 7#a7
 z a compon5t ( ! annual report submitt$
 "u section #ceig7;b74  7f7 ,report &   
brief+ consi/5cy ,9 c>ry+ out ! duties  
"u ?is section1 & to a*ieve consi/5t &  
und]/&able ag5cy report+ to ,congress1 !
 ,national ,cyb] ,director %all-- 7#a7  
provide to ag5cies =matt+ guidel9es &   
recomm5d$ cont5ts ( in=mation to be     
includ$ 9 ! reports & brief+s requir$ "u
 ?is section1 includ+ recomm5dations = !
 use ( pla9 language t]m9ology &        
consi/5t =mats = pres5t+ any associat$  
metrics2 &  7#b7 ma9ta9 a hi/orical     
ar*ive & major incid5t log ( all reports
 & brief+s provid$ "u ! requirem5ts (   
?is section1 :i* %all include at a      
m9imum an ar*ive ( ! full cont5ts ( any 
writt5 report & associat$ docum5tation1 
! report+ ag5cy1 ! date ( submission1 & 
a li/ ( ! recipi5t ,congressional       

entities1 :i* %all be made available ^u 
reque/ to ! ,congressional entities li/$
 "u subsection 7a77#a7 & may1 to ! ext5t
 practicable1 utilize an int]net        
accessible portal = appropriate         
,congressional /aff to directly access !
 log & ar*iv$ mat]ials requir$ to be    
ma9ta9$ "u ?is p>agraph4  7g7 ,report   
deliv]y ,any writt5 report requir$ to be
 submitt$ "u ?is section may be submitt$
 9 a pap] or electronic =mat4  7h7 ,rule
 ( con/ruction ,no?+ 9 ?is section %all 
be con/ru$ to limit-- 7#a7 ! ability (  
an ag5cy to provide additional reports  
or brief+s to ,congress2 or  7#b7       
,congress f reque/+ additional in=mation
 f ag5cies ?r\gh reports1 brief+s1 or   
o!r means4  #ceid4 ,gov]nm5t in=mation  
%>+ & incid5t response  7a7 ,9 g5]al    
7#a7 ,incid5t report+ ,subject to       
limitations 9 subsection 7b71 ! head (  
ea* ag5cy %all provide ! in=mation      
describ$ 9 p>agraph 7#b7 relat+ to an   
incid5t affect+ ! ag5cy1 :e!r !         
in=mation is obta9$ by ! ,f$]al         

,gov]nm5t directly or indirectly1 to !  
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 ! ,(fice ( ,managem5t &        
,budget1 & ! ,(fice ( ! ,national ,cyb] 
,director 9 a mann] specifi$ by !       
,director "u subsection 7b74  7#b7      
,cont5ts ,a provision ( in=mation relat+
 to an incid5t made by ! head ( an ag5cy
 "u p>agraph 7#a7 %all-- 7,a7 include   
detail$ in=mation ab\t ! safegu>ds t 7 9
 place :5 ! incid5t occurr$2  7,b7 :e!r 
! ag5cy implem5t$ ! safegu>ds describ$ 9
 subp>agraph 7,a7 correctly2  7,c7 9    
ord] to protect aga9/ a simil> incid5t1 
id5tify-- 7i7 h[ ! safegu>ds describ$ 9 
subp>agraph 7,a7 %\ld be implem5t$      
diff]5tly2 &  7ii7 additional necess>y  
safegu>ds2 &  7,d7 include in=mation to 
aid 9 incid5t response1 su* z-- 7i7 a   
description ( ! affect$ sy/ems or       
networks2  7ii7 ! e/imat$ dates ( :5 !  
incid5t occurr$2 &  7iii7 in=mation t   
c\ld reasonably help id5tify ! p>ty t   
conduct$ ! incid5t1 z appropriate4  7#c7
 ,in=mation %>+ ,to ! greate/ ext5t     

practicable1 ! ,director ( !            
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all-- 7,a7 %>e in=mation relat+
 to an incid5t ) any ag5cies t may be   
impact$ by ! incid5t1 or are pot5tially 
susceptible or simil>ly t>get$1 z well z
 ) appropriate ,f$]al law en=cem5t      
ag5cies to facilitate any necess>y ?reat
 response activities z reque/$2 &  7,b7 
coord9ate1 9 consultation ) ! ,national 
,cyb] ,director1 any necess>y in=mation 
%>+ ef=ts relat$ to a major incid5t ) ! 
private sector4  7#d7 ,national security
 sy/ems ,ea* ag5cy op]at+ or ex]cis+    
control ( a national security sy/em %all
 %>e in=mation ab\t incid5ts t occur on 
national security sy/ems ) ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy to ! ext5t consi/5t )  
/&>ds & guidel9es = national security   
sy/ems issu$ 9 accordance ) law & z     
direct$ by ! ,presid5t4  7b7 ,compliance
 ,! in=mation provid$ & me?od ( report+ 
"u subsection 7a7 %all take into acc\nt 
! level ( classification ( ! in=mation &

 any in=mation %>+ limitations &        
protections1 su* z limitations &        
protections relat+ to law en=cem5t1     
national security1 privacy1 /ati/ical   
confid5tiality1 or o!r factors det]m9$  
by ! ,director 9 ord] to implem5t       
subsection 7a77#a7 9 a mann] t enables  
automat$ & consi/5t report+4  7c7       
,incid5t response ,ea* ag5cy t has a    
reasonable basis to conclude t a major  
incid5t occurr$ involv+ ,f$]al in=mation
 9 electronic m$ium or =m1 z def9$ by ! 
,director & n involv+ a national        
security sy/em1 reg>dless ( delays f    
notification grant$ = a major incid5t1  
%all coord9ate ) ! ,cyb]security &      
,infra/ructure ,security ,ag5cy to      
facilitate asset response activities &  
recomm5dations = mitigat+ future        
incid5ts1 & ) appropriate ,f$]al law    
en=cem5t ag5cies to facilitate ?reat    
response activities1 consi/5t ) relevant
 policies1 pr9ciples1 /&>ds1 & guidel9es
 on in=mation security4  #ceie4         
,responsibilities ( contractors &       

aw>dees  7a7 ,report+  7#a7 ,9 g5]al    
,unless o!rwise specifi$ 9 a contract1  
grant1 coop]ative agreem5t1 or any o!r  
transaction agreem5t1 any contractor or 
aw>dee ( an ag5cy %all report to ! ag5cy
 )9 ! same am\nt ( "t su* ag5cy is      
requir$ to report an incid5t to !       
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 if ! contractor or aw>dee has a
 reasonable basis to suspect or conclude
 t-- 7,a7 an incid5t or brea* has       
occurr$ ) respect to ,f$]al in=mation   
collect$1 us$1 or ma9ta9$ by !          
contractor or aw>dee 9 connection ) !   
contract1 grant1 coop]ative agreem5t1 or
 o!r transaction agreem5t ( ! contractor
 or aw>dee2  7,b7 an incid5t or brea*   
has occurr$ ) respect to a ,f$]al       
in=mation sy/em us$ or op]at$ by !      
contractor or aw>dee 9 connection ) !   
contract1 grant1 coop]ative agreem5t1 or
 o!r transaction agreem5t ( ! contractor
 or aw>dee2  7,c7 a compon5t ( any      
,f$]al in=mation sy/em1 or a sy/em able 
to access1 /ore1 or process ,f$]al      

in=mation1 conta9s a security           
vuln]ability1 includ+ a supply *a9      
compromise or an id5tifi$ s(tw>e or     
h>dw>e vuln]ability2 or  7,d7 !         
contractor or aw>dee has receiv$        
in=mation f ! ag5cy t ! contractor or   
aw>dee is n au?oriz$ to receive 9       
connection ) ! contract1 grant1         
coop]ative agreem5t1 or o!r transaction 
agreem5t ( ! contractor or aw>dee4  7#b7
 ,proc$ures  7,a7 ,major incid5t ,foll[+
 a report ( a brea* or major incid5t by 
a contractor or aw>dee "u p>agraph 7#a71
 ! ag5cy1 9 consultation ) ! contractor 
or aw>dee1 %all c>ry out ! requirem5ts  
"u sections #ceib1 #ceic1 & #ceid )     
respect to ! major incid5t4  7,b7       
,incid5t ,foll[+ a report ( an incid5t  
by a contractor or aw>dee "u p>agraph   
7#a71 an ag5cy1 9 consultation ) !      
contractor or aw>dee1 %all c>ry out !   
requirem5ts "u section #ceid ) respect  
to ! incid5t4  7b7 ,effective date ,?is 
section %all apply on & aft] ! date t is
 #a ye> aft] ! date ( ! enactm5t ( !    

,f$]al ,in=mation ,security             
,mod]nization ,act ( #bjbb & %all apply 
) respect to any contract ent]$ into on 
or aft] su* effective date4  #ceif4     
,tra9+  7a7 ,cov]$ individual def9$ ,9  
?is section1 ! t]m cov]$ individual     
means an individual :o obta9s access to 
,f$]al in=mation or ,f$]al in=mation    
sy/ems because ( ! /atus ( ! individual 
z an employee1 contractor1 aw>dee1      
volunte]1 or int]n ( an ag5cy4  7b7     
,requirem5t ,! head ( ea* ag5cy %all    
develop tra9+ = cov]$ individuals on h[ 
to id5tify & respond to an incid5t1     
includ+-- 7#a7 ! int]nal process ( !    
ag5cy = report+ an incid5t2 &  7#b7 !   
obligation ( a cov]$ individual to      
report to ! ag5cy a confirm$ major      
incid5t & any suspect$ incid5t involv+  
in=mation 9 any m$ium or =m1 includ+    
pap]1 oral1 & electronic4  7c7          
,inclusion 9 annual tra9+ ,! tra9+      
develop$ "u subsection 7b7 may be       
includ$ z "p ( an annual privacy or     
security aw>5ess tra9+ ( an ag5cy4      

#ceig4 ,analysis & report on ,f$]al     
incid5ts  7a7 ,analysis ( ,f$]al        
incid5ts  7#a7 ,quantitative &          
qualitative analyses ,! ,director ( !   
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all develop1 9 consultation ) !
 ,director & ! ,national ,cyb]          
,director1 & p]=m cont9u\s monitor+ &   
quantitative & qualitative analyses (   
incid5ts at ag5cies1 includ+ major      
incid5ts1 includ+-- 7,a7 ! causes (     
incid5ts1 includ+-- 7i7 attack] tactics1
 te*niques1 & proc$ures2 &  7ii7 sy/em  
vuln]abilities1 includ+ previ\sly unkn[n
 z]o day exploitations1 unpat*$ sy/ems1 
& in=mation sy/em misconfigurations2    
7,b7 ! scope & scale ( incid5ts at      
ag5cies2  7,c7 common root causes (     
incid5ts across multiple ag5cies2  7,d7 
ag5cy incid5t response1 recov]y1 &      
rem$iation actions & ! effectiv5ess ( ^?
 actions1 z applicable2  7,e7 lessons   
le>n$ & recomm5dations 9 respond+ to1   
recov]+ f1 rem$iat+1 & mitigat+ future  
incid5ts2 &  7,f7 tr5ds across multiple 

,f$]al ag5cies to address intrusion     
detection & incid5t response            
capabilities us+ ! metrics e/abli%$ "u  
section #bbd7;c7 ( ! ,cyb]security ,act 
( #bjae 7#f ,u4,s4,c4 #aebb7;c774  7#b7 
,automat$ analysis ,! analyses develop$ 
"u p>agraph 7#a7 %all1 to ! greate/     
ext5t practicable1 use ma*9e readable   
data1 automation1 & ma*9e le>n+         
processes4  7#c7 ,%>+ ( data & analysis 
7,a7 ,9 g5]al ,! ,director %all %>e on  
an ongo+ basis ! analyses requir$ "u ?is
 subsection ) ag5cies & ! ,national     
,cyb] ,director to-- 7i7 improve !      
und]/&+ ( cyb]security risk ( ag5cies2 &
  7ii7 support ! cyb]security improvem5t
 ef=ts ( ag5cies4  7,b7 ,=mat ,9 c>ry+  
out subp>agraph 7,a71 ! ,director %all  
%>e ! analyses-- 7i7 9 human-readable   
writt5 products2 &  7ii7 to ! greate/   
ext5t practicable1 9 ma*9e-readable     
=mats 9 ord] to enable automat$ intake &
 use by ag5cies4  7b7 ,annual report on 
,f$]al incid5ts ,n lat] ?an #b ye>s aft]
 ! date ( ! enactm5t ( ?is section1 & n 

less frequ5tly ?an annually !reaft]1 !  
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director1 ! ,national 
,cyb] ,director1 & ! heads ( o!r ag5cies
 z appropriate1 %all submit to !        
appropriate report+ entities a report t 
includes-- 7#a7 a summ>y ( causes (     
incid5ts f across ! ,f$]al ,gov]nm5t t  
categorizes ^? incid5ts z incid5ts or   
major incid5ts2  7#b7 ! quantitative &  
qualitative analyses ( incid5ts develop$
 "u subsection 7a77#a7 on an            
ag5cy-by-ag5cy basis & compreh5sively   
across ! ,f$]al ,gov]nm5t1 includ+--    
7,a7 a specific analysis ( brea*es2 &   
7,b7 an analysis ( ! ,f$]al ,gov]nm5t's 
p]=mance aga9/ ! metrics e/abli%$ "u    
section #bbd7;c7 ( ! ,cyb]security ,act 
( #bjae 7#f ,u4,s4,c4 #aebb7;c772 &     
7#c7 an annex = ea* ag5cy t includes--  
7,a7 a description ( ea* major incid5t2 
&  7,b7 an analysis ( ! ag5cy's p]=mance
 aga9/ ! metrics e/abli%$ "u section    
#bbd7;c7 ( ! ,cyb]security ,act ( #bjae 

7#f ,u4,s4,c4 #aebb7;c774  7c7          
,publication ,to ! ext5t t publication  
is consi/5t ) national security int]e/s1
 a v]sion ( ea* report submitt$ "u      
subsection 7b7 %all be made publicly    
available on ! website ( ! ,cyb]security
 & ,infra/ructure ,security ,ag5cy dur+ 
! ye> 9 :i* ! report is submitt$4  7d7  
,in=mation provid$ by ag5cies  7#a7 ,9  
g5]al ,! analysis requir$ "u subsection 
7a7 & ea* report submitt$ "u subsection 
7b7 %all use in=mation provid$ by       
ag5cies "u section #ceid7;a74  7#b7     
,national security sy/em reports  7,a7  
,9 g5]al ,annually1 ! head ( an ag5cy t 
op]ates or ex]cises control ( a national
 security sy/em %all submit a report t  
includes ! in=mation describ$ 9         
subsection 7b7 ) respect to ! ag5cy to !
 ext5t t ! submission is consi/5t )     
/&>ds & guidel9es = national security   
sy/ems issu$ 9 accordance ) law & z     
direct$ by ! ,presid5t to-- 7i7 !       
majority & m9ority lead]s ( ! ,s5ate2   
7ii7 ! ,speak] & m9ority lead] ( ! ,h\se

 ( ,repres5tatives2  7iii7 ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate2  7iv7 ! ,select    
,committee on ,intellig5ce ( ! ,s5ate2  
7v7 ! ,committee on ,arm$ ,s]vices ( !  
,s5ate2  7vi7 ! ,committee on           
,appropriations ( ! ,s5ate2  7vii7 !    
,committee on ,ov]sight & ,re=m ( !     
,h\se ( ,repres5tatives2  7viii7 !      
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives2  7ix7 !        
,p]man5t ,select ,committee on          
,intellig5ce ( ! ,h\se (                
,repres5tatives2  7x7 ! ,committee on   
,arm$ ,s]vices ( ! ,h\se (              
,repres5tatives2 &  7xi7 ! ,committee on
 ,appropriations ( ! ,h\se (            
,repres5tatives4  7,b7 ,classifi$ =m ,a 
report requir$ "u subp>agraph 7,a7 may  
be submitt$ 9 a classifi$ =m4  7e7      
,requirem5t = compil+ in=mation ,9      
publi%+ ! public report requir$ "u      
subsection 7c71 ! ,director ( !         
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all suffici5tly compile        

in=mation su* t no specific incid5t ( an
 ag5cy c be id5tifi$1 except ) !        
concurr5ce ( ! ,director ( ! ,(fice (   
,managem5t & ,budget1 ! ,national ,cyb] 
,director1 & 9 consultation ) ! impact$ 
ag5cy4  #ceih4 ,major incid5t def9ition 
7a7 ,9 g5]al ,n lat] ?an #ahj days aft] 
! date ( ! enactm5t ( ! ,f$]al          
,in=mation ,security ,mod]nization ,act 
( #bjbb1 ! ,director1 9 coord9ation ) ! 
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy & !     
,national ,cyb] ,director1 %all develop 
& promulgate guidance on ! def9ition ( !
 t]m major incid5t = ! purposes (       
sub*apt] ,,ii & ?is sub*apt]4  7b7      
,requirem5ts ,) respect to ! guidance   
issu$ "u subsection 7a71 ! def9ition ( !
 t]m major incid5t %all-- 7#a7 include1 
) respect to any in=mation collect$ or  
ma9ta9$ by or on behalf ( an ag5cy or an
 in=mation sy/em us$ or op]at$ by an    
ag5cy or by a contractor ( an ag5cy or  
ano!r organization on behalf ( an ag5cy1
 any incid5t ! head ( ! ag5cy det]m9es  

is likely to result 9 demon/rable h>m   
to-- 7,a7 ! national security int]e/s1  
=eign relations1 or ! economy ( ! ,unit$
 ,/ates2  7,b7 ! public confid5ce1 civil
 lib]ties1 or public heal? & safety ( ! 
p ( ! ,unit$ ,/ates2  7,c7 ! integrity (
 p]sonally id5tifiable in=mation1       
includ+ ! exfiltration1 modification1 or
 deletion ( su* in=mation2 or  7,d7 any 
o!r type ( incid5t det]m9$ appropriate  
by ! ,director2 &  7#b7 /ipulate t !    
,director1 9 coord9ation ) ! ,national  
,cyb] ,director1 %all decl>e a major    
incid5t at ea* ag5cy impact$ by an      
incid5t if x is det]m9$ t an incid5t--  
7,a7 occurs at n less ?an #b ag5cies2   
7,b7 is enabl$ by-- 7i7 a common        
te*nical root cause1 su* z a supply *a9 
compromise or a common s(tw>e or h>dw>e 
vuln]ability2 or  7ii7 ! relat$         
activities ( a common ?reat actor2 or   
7,c7 has a significant impact on !      
confid5tiality1 integrity1 or           
availability ( a high value asset4  7c7 
,evaluation & updates ,n lat] ?an #b    

ye>s aft] ! date ( ! enactm5t ( ! ,f$]al
 ,in=mation ,security ,mod]nization ,act
 ( #bjbb1 & n less frequ5tly ?an e #b   
ye>s !reaft]1 ! ,director %all submit to
 ! ,committee on ,homel& ,security &    
,gov]nm5tal ,affairs ( ! ,s5ate & !     
,committee on ,ov]sight & ,re=m ( !     
,h\se ( ,repres5tatives an evaluation1  
:i* %all include-- 7#a7 an update1 if   
necess>y1 to ! guidance issu$ "u        
subsection 7a72  7#b7 ! def9ition ( !   
t]m major incid5t includ$ 9 ! guidance  
issu$ "u subsection 7a72 &  7#c7 an     
explanation (1 & ! analysis t l$ to1 !  
def9ition describ$ 9 p>agraph 7#b74  4  
7#b7 ,cl]ical am5dm5t ,! table (        
sections = *apt] #ce ( title #dd1 ,unit$
 ,/ates ,code1 is am5d$ by add+ at ! end
 ! foll[+3  ,sub*apt] ,,iv--,,f$]al     
,,sy/em ,,incid5t ,,response #ceia4     
,def9itions4 #ceib4 ,notification (     
brea*4 #ceic4 ,congressional & executive
 bran* reports4 #ceid4 ,gov]nm5t        
in=mation %>+ & incid5t response4 #ceie4
 ,responsibilities ( contractors &      

aw>dees4 #ceif4 ,tra9+4 #ceig4 ,analysis
 & report on ,f$]al incid5ts4 #ceih4    
,major incid5t def9ition4  4  #ajb4     
,am5dm5ts to subtitle ,,iii ( title #dj 
7a7 ,mod]niz+ gov]nm5t te*nology        
,subtitle ,g ( title ,x ( ,division ,a (
 ! ,national ,def5se ,au?orization ,act 
= ,fiscal ,ye> #bjah 7,public ,law      
#aae-ia2 #dj ,u4,s4,c4 #aacja note7 is  
am5d$ 9 section #ajgh-- 7#a7 by /rik+   
subsection 7a7 & ins]t+ ! foll[+3  7a7  
,def9itions ,9 ?is section3 7#a7 ,ag5cy 
,! t]m ag5cy has ! mean+ giv5 ! t]m 9   
section #eea ( title #e1 ,unit$ ,/ates  
,code4  7#b7 ,high value asset ,! t]m   
high value asset has ! mean+ giv5 ! t]m 
9 section #ceeb ( title #dd1 ,unit$     
,/ates ,code4  2 &  7#b7 9 subsection   
7c7-- 7,a7 9 p>agraph 7#b77;,a77i71 by  
ins]t+ 1 includ+ a consid]ation ( !     
impact on high value assets aft]        
op]ational risks2  7,b7 9 p>agraph      
7#e7-- 7i7 9 subp>agraph 7,a71 by /rik+ 
& at ! end2  7ii7 9 subp>agraph 7,b71 by
 /rik+ ! p]iod at ! end & ins]t+ &2 &   

7iii7 by add+ at ! end ! foll[+3  7,c7 a
 s5ior (ficial f ! ,cyb]security &      
,infra/ructure ,security ,ag5cy ( !     
,dep>tm5t ( ,homel& ,security1 appo9t$  
by ! ,director4  2 &  7,c7 9 p>agraph   
7#f77;,a71 by /rik+ %all be-- & all t   
foll[s ?r\gh #d employees & ins]t+ %all 
be #d employees4  7b7 ,sub*apt] ,i      
,sub*apt] ,i ( *apt] #aac ( subtitle    
,,iii ( title #dj1 ,unit$ ,/ates ,code1 
is am5d$-- 7#a7 9 section #aacjb-- 7,a7 
9 subsection 7b71 by /rik+ use1         
security1 & disposal ( & ins]t+ use1 &  
disposal (1 &1 9 consultation ) !       
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy & !     
,national ,cyb] ,director1 promote &    
improve ! security (12  7,b7 9          
subsection 7c77#c77;,b71 by add+ at !   
end ! foll[+3  7iii7 ,! ,director may   
make available1 ^u reque/1 to !         
,national ,cyb] ,director any           
cyb]security fund+ in=mation provid$ to 
! ,director "u clause 7ii7 ( ?is        
subp>agraph4  2  7,c7 9 subsection 7f71 

by /rik+ ,! ,director %all & ins]t+ ,!  
,director %all-- 7#a7 enc\rage ! heads (
 ! executive ag5cies to develop & use ! 
be/ practices 9 ! acquisition (         
in=mation te*nology1 includ+ supply *a9 
risk managem5t /&>ds1 guidel9es1 &      
practices develop$ by ! ,national       
,in/itute ( ,/&>ds & ,te*nology2 &  7#b7
 consult ) ! ,f$]al ,*ief ,in=mation    
,security ,(fic] appo9t$ by ! ,presid5t 
"u section #cfjg ( title #dd1 = !       
developm5t & use ( risk managem5t /&>ds1
 guidel9es1 & practices develop$ by !   
,national ,in/itute ( ,/&>ds &          
,te*nology4  2 &  7,d7 9 subsection 7h71
 by ins]t+ 1 includ+ cyb]security       
p]=mances1 aft] ! p]=mances2 &  7#b7 9  
section #aacjc7;b71 9 p>agraph          
7#b77;,b7-- 7,a7 9 clause 7i71 by /rik+ 
or at ! end2  7,b7 9 clause 7ii71 by    
add+ or at ! end2 &  7,c7 by add+ at !  
end ! foll[+3  7iii7 :e!r ! function    
%\ld be p]=m$ by a %>$ s]vice (f]$ by   
ano!r executive ag5cy4  4  7c7 ,sub*apt]
 ,,ii ,sub*apt] ,,ii ( *apt] #aac (     

subtitle ,,iii ( title #dj1 ,unit$      
,/ates ,code1 is am5d$-- 7#a7 9 section 
#aacab7;a71 by ins]t+ 1 includ+ security
 risks aft] manag+ ! risks2  7#b7 9     
section #aacac7a71 by /rik+ effici5cy & 
effectiv5ess & ins]t+ effici5cy1        
security1 & effectiv5ess2  7#c7 9       
section #aacae1 by add+ at ! end !      
foll[+3  7d7 ,compon5t ag5cy *ief       
in=mation (fic]s ,! ,*ief ,in=mation    
,(fic] or an equival5t (ficial ( a      
compon5t ag5cy %all report to-- 7#a7 !  
,*ief ,in=mation ,(fic] designat$ "u    
section #cejf7;a77#b7 ( title #dd or an 
equival5t (ficial ( ! ag5cy ( :i* !     
compon5t ag5cy is a compon5t2 &  7#b7 ! 
head ( ! compon5t ag5cy4  2  7#d7 9     
section #aacag1 by ins]t+ security1 be=e
 or s*$ule2 &  7#e7 9 section           
#aacai7;b77#a71 9 ! p>agraph head+1 by  
/rik+ ,,cios & ins]t+ ,*ief ,in=mation  
,(fic]s4  7d7 ,sub*apt] ,,iii ,section  
#aacca ( title #dj1 ,unit$ ,/ates ,code1
 is am5d$-- 7#a7 9 subsection 7a71 by   
/rik+ section #cecb7;b77#a7 & ins]t+    

section #ceeb7;b72  7#b7 9 subsection   
7b77#a77;,a71 by /rik+ ! ,secret>y (    
,homel& ,security & ins]t+ ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy2 &  7#c7 by add+ at !  
end ! foll[+3  7e7 ,review ( (fice (    
managem5t & budget guidance & policy    
7#a7 ,conduct ( review  7,a7 ,9 g5]al ,n
 less frequ5tly ?an once e #c ye>s1 !   
,director ( ! ,(fice ( ,managem5t &     
,budget1 9 consultation )1 z available1 
! ,*ief ,in=mation ,(fic]s ,c\ncil1 !   
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 !      
,national ,cyb] ,director1 ! ,comptroll]
 ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil (
 ! ,inspectors ,g5]al on ,integrity &   
,effici5cy1 %all review ! efficacy ( !  
guidance & policy promulgat$ by !       
,director 9 r$uc+ cyb]security risks1   
includ+ an assessm5t ( ! requirem5ts =  
ag5cies to report in=mation to !        
,director1 & det]m9e :e!r any *anges to 
t guidance or policy is appropriate4    
7,b7 ,f$]al risk assessm5ts ,9 conduct+ 

! review describ$ 9 subp>agraph 7,a71 ! 
,director %all consid] ! ,f$]al risk    
assessm5ts p]=m$ "u section #ceec7;i7 ( 
title #dd4  7,c7 ,requirem5ts burd5     
r$uction & cl>ity ,9 conduct+ ! review  
describ$ 9 subp>agraph 7,a71 ! ,director
 %all consid] ! cumulative report+ &    
compliance burd5 to ag5cies z well z !  
cl>ity ( ! requirem5ts & deadl9es       
conta9$ 9 guidance & policy docum5ts4   
7#b7 ,updat$ guidance ,n lat] ?an #ij   
days aft] ! date on :i* a review is     
complet$ "u p>agraph 7#a71 ! ,director (
 ! ,(fice ( ,managem5t & ,budget %all   
issue updat$ guidance or policy to      
ag5cies det]m9$ appropriate by !        
,director1 bas$ on ! results ( ! review4
  7#c7 ,congressional brief+ ,n lat] ?an
 #fj days aft] ! date on :i* a review is
 complet$ "u p>agraph 7#a71 ! ,director 
is expect$ to provide to ! ,committee on
 ,homel& ,security & ,gov]nm5tal        
,affairs ( ! ,s5ate & ! ,committee on   
,ov]sight & ,re=m ( ! ,h\se (           
,repres5tatives a brief+ on ! review &  

any newly issu$ guidance or policy1 :i* 
%all include-- 7,a7 an ov]view ( !      
guidance & policy promulgat$ "u ?is     
section t is curr5tly 9 effect2  7,b7 ! 
cyb]security risk mitigation1 or o!r    
cyb]security b5efit1 (f]$ by ea*        
guidance or policy docum5t describ$ 9   
subp>agraph 7,a72 &  7,c7 a summ>y ( !  
guidance or policy to :i* *anges 7      
det]m9$ appropriate dur+ ! review & :at 
! *anges include4  7f7 ,automat$ /&>d   
implem5tation v]ification ,:5 !         
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology issues a propos$    
/&>d pursuant to p>agraphs 7#b7 & 7#c7 (
 section #bj7;a7 ( ! ,national ,in/itute
 ( ,/&>ds & ,te*nology ,act 7#ae        
,u4,s4,c4 #bgh;g-#c7;a771 ! ,director ( 
! ,national ,in/itute ( ,/&>ds &        
,te*nology %all consid] develop+ &1 if  
appropriate & practical1 develop1 9     
consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 specifications to enable !     
automat$ v]ification ( ! implem5tation (

 controls4  4  #ajc4 ,actions to enhance
 ,f$]al incid5t response  7a7           
,responsibilities ( ! cyb]security &    
infra/ructure security ag5cy  7#a7 ,9   
g5]al ,n lat] ?an #ahj days aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy %all-- 7,a7 develop a  
plan = ! developm5t ( ! analysis requir$
 "u section #ceig7;a7 ( title #dd1      
,unit$ ,/ates ,code1 z add$ by ?is ,act1
 & ! report requir$ "u subsection 7b7 ( 
t section t includes-- 7i7 a description
 ( any *all5ges ! ,director anticipates 
enc\nt]+2 &  7ii7 ! use ( automation &  
ma*9e-readable =mats = collect+1        
compil+1 monitor+1 & analyz+ data2 &    
7,b7 provide to ! appropriate           
congressional committees a brief+ on !  
plan develop$ "u subp>agraph 7,a74  7#b7
 ,brief+ ,n lat] ?an #a ye> aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy %all provide to !      
appropriate congressional committees a  

brief+ on-- 7,a7 ! execution ( ! plan   
requir$ "u p>agraph 7#a77;,a72 &  7,b7 !
 developm5t ( ! report requir$ "u       
section #ceig7;b7 ( title #dd1 ,unit$   
,/ates ,code1 z add$ by ?is ,act4  7b7  
,responsibilities ( ! director ( ! (fice
 ( managem5t & budget  7#a7 ,,fisma     
,section #b ( ! ,f$]al ,in=mation       
,security ,mod]nization ,act ( #bjad    
7,public ,law #aac-bhc2 #dd ,u4,s4,c4   
#ceed note7 is am5d$-- 7,a7 by /rik+    
subsection 7b72 &  7,b7 by r$esignat+   
subsections 7c7 ?r\gh 7f7 z subsections 
7b7 ?r\gh 7e71 respectively4  7#b7 ,9   
g5]al ,! ,director %all develop         
guidance1 to be updat$ n less frequ5tly 
?an once e #b ye>s1 on ! cont5t1        
timel9ess1 & =mat ( ! in=mation provid$ 
by ag5cies "u section #ceid7;a7 ( title 
#dd1 ,unit$ ,/ates ,code1 z add$ by ?is 
,act4  7#c7 ,guidance on respond+ to    
in=mation reque/s ,n lat] ?an #a ye>    
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,director %all develop guidance =       
ag5cies to implem5t ! requirem5t "u     

section #ceid7;c7 ( title #dd1 ,unit$   
,/ates ,code1 z add$ by ?is ,act1 to    
provide in=mation to o!r ag5cies        
exp]i5c+ incid5ts4  7#d7 ,/&>d guidance 
& templates ,n lat] ?an #a ye> aft] !   
date ( ! enactm5t ( ?is ,act1 !         
,director1 9 consultation ) ! ,director 
( ! ,cyb]security & ,infra/ructure      
,security ,ag5cy1 %all develop guidance 
& templates1 to be review$ &1 if        
necess>y1 updat$ n less frequ5tly ?an   
once e #b ye>s1 = use by ,f$]al ag5cies 
9 ! activities requir$ "u sections      
#ceib1 #ceic1 & #ceif ( title #dd1      
,unit$ ,/ates ,code1 z add$ by ?is ,act4
  7#e7 ,contractor & aw>dee guidance    
7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! 
date ( ! enactm5t ( ?is ,act1 !         
,director1 9 coord9ation ) ! ,secret>y (
 ,homel& ,security1 ! ,secret>y (       
,def5se1 ! ,adm9i/rator ( ,g5]al        
,s]vices1 & ! heads ( o!r ag5cies       
det]m9$ appropriate by ! ,director1 %all
 issue guidance to ,f$]al ag5cies on h[ 
to deconflict1 to ! greate/ ext5t       

practicable1 exi/+ regulations1         
policies1 & proc$ures relat+ to !       
responsibilities ( contractors & aw>dees
 e/abli%$ "u section #ceie ( title #dd1 
,unit$ ,/ates ,code1 z add$ by ?is ,act4
  7,b7 ,exi/+ processes ,to ! greate/   
ext5t practicable1 ! guidance issu$ "u  
subp>agraph 7,a7 %all all[ contractors &
 aw>dees to use exi/+ processes =       
notify+ ,f$]al ag5cies ( incid5ts       
involv+ in=mation ( ! ,f$]al ,gov]nm5t4 
7#f7 ,updat$ brief+s ,n less frequ5tly  
?an once e #b ye>s1 ! ,director %all    
provide to ! appropriate congressional  
committees an update on ! guidance &    
templates develop$ "u p>agraphs 7#b7    
?r\gh 7#d74  7c7 ,update to ! privacy   
act ( #aigd ,section #eeb;a7b7 ( title  
#e1 ,unit$ ,/ates ,code 7commonly kn[n z
 ! ,privacy ,act ( #aigd7 is am5d$--    
7#a7 9 p>agraph 7#aa71 by /rik+ or at ! 
end2  7#b7 9 p>agraph 7#ab71 by /rik+ ! 
p]iod at ! end & ins]t+ 2 or2 &  7#c7 by
 add+ at ! end ! foll[+3  7#ac7 to ano!r
 ag5cy 9 fur!rance ( a response to an   

incid5t 7z def9$ 9 section #ceeb ( title
 #dd7 & pursuant to ! in=mation %>+     
requirem5ts 9 section #ceid ( title #dd1
 if ! head ( ! reque/+ ag5cy has made a 
writt5 reque/ to ! ag5cy t ma9ta9s !    
record specify+ ! p>ticul> portion      
desir$ & ! activity = :i* ! record is   
s\ght4  4  #ajd4 ,additional guidance to
 ag5cies on ,,fisma updates ,n lat] ?an 
#a ye> aft] ! date ( ! enactm5t ( ?is   
,act1 ! ,director %all issue guidance = 
ag5cies on-- 7#a7 p]=m+ ! ongo+ &       
cont9u\s ag5cy sy/em risk assessm5t     
requir$ "u section #ceed7;a77#a77;,a7 ( 
title #dd1 ,unit$ ,/ates ,code1 z am5d$ 
by ?is ,act2  7#b7 implem5t+ additional 
cyb]security proc$ures1 :i* %all include
 res\rces = %>$ s]vices2  7#c7 e/abli%+ 
a process = provid+ ! /atus ( ea*       
rem$ial action "u section #ceed7;b77#g7 
( title #dd1 ,unit$ ,/ates ,code1 z     
am5d$ by ?is ,act1 to ! ,director & !   
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy us+     
automation & ma*9e-readable data1 z     

practicable1 :i* %all include-- 7,a7    
specific guidance = ! use ( automation &
 ma*9e-readable data2 &  7,b7 templates 
= provid+ ! /atus ( ! rem$ial action2   
7#d7 int]pret+ ! def9ition ( high value 
asset "u section #ceeb ( title #dd1     
,unit$ ,/ates ,code1 z am5d$ by ?is     
,act2 &  7#e7 a requirem5t to coord9ate 
) inspectors g5]al ( ag5cies to ensure  
consi/5t und]/&+ & application ( ag5cy  
policies = ! purpose ( evaluations by   
inspectors g5]al4  #aje4 ,ag5cy         
requirem5ts to notify private sector    
entities impact$ by incid5ts  7a7       
,def9itions ,9 ?is section3 7#a7        
,report+ entity ,! t]m report+ entity   
means private organization or gov]nm5tal
 unit t is requir$ by /atute or         
regulation to submit s5sitive in=mation 
to an ag5cy4  7#b7 ,s5sitive in=mation  
,! t]m s5sitive in=mation has ! mean+   
giv5 ! t]m by ! ,director 9 guidance    
issu$ "u subsection 7b74  7b7 ,guidance 
on notification ( report+ entities ,n   
lat] ?an #ahj days aft] ! date ( !      

enactm5t ( ?is ,act1 ! ,director %all   
issue guidance requir+ ! head ( ea*     
ag5cy to notify a report+ entity ( an   
incid5t t is likely to sub/antially     
affect-- 7#a7 ! confid5tiality or       
integrity ( s5sitive in=mation submitt$ 
by ! report+ entity to ! ag5cy pursuant 
to a /atutory or regulatory requirem5t2 
or  7#b7 ! ag5cy in=mation sy/em or     
sy/ems us$ 9 ! transmission or /orage ( 
! s5sitive in=mation describ$ 9 p>agraph
 7#a74  ,,ii ,,improv+ ,,f$]al          
,,cyb]security  #bja4 ,mobile security  
/&>ds  7a7 ,9 g5]al ,n lat] ?an #a ye>  
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,director %all-- 7#a7 evaluate mobile   
application security guidance promulgat$
 by ! ,director2 &  7#b7 issue guidance 
to secure mobile devices1 includ+ =     
mobile applications1 = e ag5cy4  7b7    
,cont5ts ,! guidance issu$ "u subsection
 7a77#b7 %all include-- 7#a7 a          
requirem5t1 pursuant to section         
#cejf7;b77#d7 ( title #dd1 ,unit$ ,/ates
 ,code1 = e ag5cy to ma9ta9 a cont9u\s  

inv5tory ( e-- 7,a7 mobile device op]at$
 by or on behalf ( ! ag5cy2 &  7,b7     
vuln]ability id5tifi$ by ! ag5cy        
associat$ ) a mobile device2 &  7#b7 a  
requirem5t = e ag5cy to p]=m cont9u\s   
evaluation ( ! vuln]abilities describ$ 9
 p>agraph 7#a77;,b7 & o!r risks         
associat$ ) ! use ( applications on     
mobile devices4  7c7 ,in=mation %>+ ,!  
,director1 9 coord9ation ) ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy1 %all issue guidance to
 ag5cies = %>+ ! inv5tory ( ! ag5cy     
requir$ "u subsection 7b77#a7 ) !       
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 us+    
automation & ma*9e-readable data to !   
greate/ ext5t practicable4  7d7 ,brief+ 
,n lat] ?an #fj days aft] ! date on :i* 
! ,director issues guidance "u          
subsection 7a77#b71 ! ,director1 9      
coord9ation ) ! ,director ( !           
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 %all provide to ! appropriate  
congressional committees a brief+ on !  

guidance4  #bjb4 ,data & logg+ ret5tion 
= incid5t response  7a7 ,recomm5dations 
,n lat] ?an #b ye>s aft] ! date ( !     
enactm5t ( ?is ,act1 & n less frequ5tly 
?an e #b ye>s !reaft]1 ! ,director ( !  
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 9 consultation ) ! ,attorney   
,g5]al1 %all submit to ! ,director      
recomm5dations on requirem5ts = logg+   
ev5ts on ag5cy sy/ems & reta9+ o!r      
relevant data )9 ! sy/ems & networks (  
an ag5cy4  7b7 ,cont5ts ,!              
recomm5dations provid$ "u subsection 7a7
 %all include-- 7#a7 ! types ( logs to  
be ma9ta9$2  7#b7 ! duration t logs &   
o!r relevant data %\ld be reta9$2  7#c7 
! "t p]iods = ag5cy implem5tation (     
recomm5d$ logg+ & security requirem5ts2 
7#d7 h[ to ensure ! confid5tiality1     
integrity1 & availability ( logs2  7#e7 
requirem5ts to ensure t1 ^u reque/1 9 a 
mann] t excludes or o!rwise reasonably  
protects p]sonally id5tifiable          
in=mation1 & to ! ext5t p]mitt$ by      
applicable law 7includ+ privacy &       

/ati/ical laws71 ag5cies provide logs   
to-- 7,a7 ! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy = a   
cyb]security purpose2 &  7,b7 !         
,director ( ! ,f$]al ,bureau (          
,inve/igation1 or ! appropriate ,f$]al  
law en=cem5t ag5cy1 to inve/igate       
pot5tial crim9al activity2 &  7#f7      
requirem5ts to ensure t1 subject to     
compliance ) /ati/ical laws & o!r       
relevant data protection requirem5ts1 ! 
highe/ level security op]ations c5t] (  
ea* ag5cy has visibility into all ag5cy 
logs4  7c7 ,guidance ,n lat] ?an #ij    
days aft] receiv+ ! recomm5dations      
submitt$ "u subsection 7a71 ! ,director1
 9 consultation ) ! ,director ( !       
,cyb]security & ,infra/ructure ,security
 ,ag5cy & ! ,attorney ,g5]al1 %all1 z   
det]m9$ to be appropriate by !          
,director1 update guidance to ag5cies   
reg>d+ requirem5ts = logg+1 log         
ret5tion1 log managem5t1 %>+ ( log data 
) o!r appropriate ag5cies1 or any o!r   
logg+ activity det]m9$ to be appropriate

 by ! ,director4  7d7 ,sunset ,?is      
section w cease to be 9 effect on ! date
 t is #aj ye>s aft] ! date ( ! enactm5t 
( ?is ,act4  #bjc4 ,f$]al p5etration    
te/+ policy  7a7 ,9 g5]al ,sub*apt] ,,ii
 ( *apt] #ce ( title #dd1 ,unit$ ,/ates 
,code1 is am5d$ by add+ at ! end !      
foll[+3  #ceei;,a4 ,f$]al p5etration    
te/+  7a7 ,guidance  7#a7 ,9 g5]al ,!   
,director %all1 9 consultation ) !      
,secret>y ( ! ,dep>tm5t ( ,homel&       
,security act+ ?r\gh ! ,director ( !    
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 issue guidance to ag5cies t--  
7,a7 requires ag5cies to use1 :5 & :]e  
appropriate1 p5etration te/+ on ag5cy   
sy/ems by bo? ,f$]al & non-,f$]al       
entities1 ) a focus on high value       
assets2  7,b7 provides policies gov]n+  
ag5cy developm5t ( an op]ational plan1  
rules ( engagem5t = utiliz+ p5etration  
te/+1 & proc$ures to utilize ! results (
 p5etration te/+ to improve !           
cyb]security & risk managem5t ( ! ag5cy2
 &  7,c7 e/abli%es a program "u !       

,cyb]security & ,infra/ructure ,security
 ,ag5cy to ensure t p5etration te/+ is  
be+ p]=m$ appropriately by ag5cies & to 
provide op]ational support or a %>$     
s]vice4  7b7 ,responsibilities ( ,,omb  
,! ,director1 9 coord9ation ) !         
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 %all-- 
7#a7 n less frequ5tly ?an annually1     
inv5tory all ,f$]al p5etration te/+     
assets2 &  7#b7 develop & ma9ta9 a      
/&>diz$ process = ! use ( p5etration    
te/+4  7c7 ,exception = national        
security sy/ems ,! guidance issu$ "u    
subsection 7a7 %all n apply to national 
security sy/ems4  7d7 ,delegation (     
au?ority = c]ta9 sy/ems ,! au?orities ( 
! ,director describ$ 9 subsection 7a7   
%all be delegat$-- 7#a7 to ! ,secret>y (
 ,def5se 9 ! case ( sy/ems describ$ 9   
section #ceec7;e77#b72 &  7#b7 to !     
,director ( ,national ,intellig5ce 9 !  
case ( sy/ems describ$ 9 #ceec7;e77#c74 
4  7b7 ,deadl9e = guidance ,n lat] ?an  
#ahj days aft] ! date ( ! enactm5t ( ?is

 ,act1 ! ,director %all issue ! guidance
 requir$ "u section #ceei;,a7a7 ( title 
#dd1 ,unit$ ,/ates ,code1 z add$ by     
subsection 7a74  7c7 ,sunset ,?is       
section %all sunset on ! date t is #aj  
ye>s aft] ! date ( ! enactm5t ( ?is     
,act4  7d7 ,cl]ical am5dm5t ,! table (  
sections = *apt] #ce ( title #dd1 ,unit$
 ,/ates ,code1 is am5d$ by add+ aft] !  
item relat+ to section #ceei ! foll[+3  
#ceei;,a4 ,f$]al p5etration te/+4  4    
7e7 ,p5etration te/+ by ! secret>y (    
homel& security ,section #ceec7;b7 (    
title #dd1 ,unit$ ,/ates ,code1 z am5d$ 
by section #eaba1 is fur!r am5d$-- 7#a7 
9 p>agraph 7#h77;,b71 by /rik+ & at !   
end2  7#b7 by r$esignat+ p>agraph 7#i7 z
 p>agraph 7#aj72 &  7#c7 by ins]t+ aft] 
p>agraph 7#h7 ! foll[+3  7#i7 p]=m+     
p5etration te/+ to id5tify              
vuln]abilities )9 ,f$]al in=mation      
sy/ems2 &  4  #bjd4 ,ongo+ ?reat hunt+  
program  7a7 ,?reat hunt+ program  7#a7 
,9 g5]al ,n lat] ?an #edj days aft] !   
date ( ! enactm5t ( ?is ,act1 !         

,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy %all1 9 
accordance ) ! au?orities grant$ !      
,secret>y "u sections #ceec7;b77#g7-7h7 
& #ceec7m7 ( title #dd1 ,unit$ ,/ates   
,code 7z r$esignat$ by ?is ,act71       
e/abli% a program to provide ongo+1     
hypo!sis-driv5 ?reat-hunt+ s]vices on ! 
network ( ea* ag5cy4  7#b7 ,plan ,n lat]
 ?an #ahj days aft] ! date ( ! enactm5t 
( ?is ,act1 ! ,director ( !             
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all develop a plan to e/abli% !
 program requir$ "u p>agraph 7#a7 t     
describes h[ ! ,director ( !            
,cyb]security & ,infra/ructure ,security
 ,ag5cy plans to-- 7,a7 det]m9e ! me?od 
= collect+1 /or+1 access+1 analyz+1 &   
safegu>d+ appropriate ag5cy data2  7,b7 
provide on-premises support to ag5cies2 
7,c7 /aff ?reat hunt+ s]vices2  7,d7    
allocate available human & f9ancial     
res\rces to implem5t ! plan2 &  7,e7    
provide input to ! heads ( ag5cies on ! 
use (-- 7i7 m /r+5t /&>ds "u section    

#aacca7;c77#a7 ( title #dj1 ,unit$      
,/ates ,code2 &  7ii7 additional        
cyb]security proc$ures "u section #ceed 
( title #dd1 ,unit$ ,/ates ,code4  7b7  
,reports ,! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy1 9    
consultation ) ! ,director1 %all submit 
to ! appropriate congressional          
committees-- 7#a7 n lat] ?an #cj days   
aft] ! date on :i* ! ,director ( !      
,cyb]security & ,infra/ructure ,security
 ,ag5cy completes ! plan requir$ "u     
subsection 7a77#b71 a report on ! plan  
to provide ?reat hunt+ s]vices to       
ag5cies2  7#b7 n less ?an #cj days be=e 
! date on :i* ! ,director ( !           
,cyb]security & ,infra/ructure ,security
 ,ag5cy beg9s provid+ ?reat hunt+       
s]vices "u ! program "u subsection      
7a77#a71 a report provid+ any updates to
 ! plan develop$ "u subsection 7a77#b72 
&  7#c7 n lat] ?an #a ye> aft] ! date on
 :i* ! ,director ( ! ,cyb]security &    
,infra/ructure ,security ,ag5cy beg9s   
provid+ ?reat hunt+ s]vices to ag5cies  

o!r ?an ! ,cyb]security & ,infra/ructure
 ,security ,ag5cy1 a report describ+    
lessons le>n$ f provid+ ^? s]vices4     
#bje4 ,codify+ vuln]ability disclosure  
programs  7a7 ,9 g5]al ,sub*apt] ,,ii ( 
,*apt] #ce ( title #dd1 ,unit$ ,/ates   
,code1 is am5d$ by ins]t+ aft] section  
#ceei;,a1 z add$ by section #bjd1 !     
foll[+3  #ceei;,b4 ,f$]al vuln]ability  
disclosure programs  7a7 ,def9itions ,9 
?is section3 7#a7 ,report ,! t]m report 
means a vuln]ability disclosure made to 
an ag5cy by a report]4  7#b7 ,report] ,!
 t]m report] means an individual t      
submits a vuln]ability report pursuant  
to ! vuln]ability disclosure process (  
an ag5cy4  7b7 ,responsibilities ( ,,omb
  7#a7 ,limitation on legal action ,!   
,director ( ! ,(fice ( ,managem5t &     
,budget1 9 consultation ) ! ,attorney   
,g5]al1 %all issue guidance to ag5cies  
to n recomm5d or pursue legal action    
aga9/ a report] or an individual t      
conducts a security rese>* activity t ! 
head ( ! ag5cy det]m9es-- 7,a7 repres5ts

 a good fai? ef=t to foll[ !            
vuln]ability disclosure policy ( ! ag5cy
 develop$ "u subsection 7d77#b72 &  7,b7
 is au?oriz$ "u ! vuln]ability          
disclosure policy ( ! ag5cy develop$ "u 
subsection 7d77#b74  7#b7 ,%>+ in=mation
 ) ,,cisa ,! ,director ( ! ,(fice (     
,managem5t & ,budget1 9 coord9ation ) ! 
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy & 9     
consultation ) ! ,national ,cyb]        
,director1 %all issue guidance to       
ag5cies on %>+ relevant in=mation 9 a   
consi/5t1 automat$1 & ma*9e readable    
mann] ) ! ,director ( ! ,cyb]security & 
,infra/ructure ,security ,ag5cy1        
includ+-- 7,a7 any valid or cr$ible     
reports ( newly discov]$ or n publicly  
kn[n vuln]abilities 7includ+            
misconfigurations7 on ,f$]al in=mation  
sy/ems t use comm]cial s(tw>e or        
s]vices2  7,b7 in=mation relat+ to      
vuln]ability disclosure1 coord9ation1 or
 rem$iation activities ( an ag5cy1      
p>ticul>ly z ^? activities relate to    

outside organizations-- 7i7 ) :i* ! head
 ( ! ag5cy believes ! ,director ( !     
,cyb]security & ,infra/ructure ,security
 ,ag5cy c assi/2 or  7ii7 ab\t :i* !    
head ( ! ag5cy believes ! ,director ( ! 
,cyb]security & ,infra/ructure ,security
 ,ag5cy %\ld "k2 &  7,c7 any o!r        
in=mation ) respect to :i* ! head ( !   
ag5cy det]m9es helpful or necess>y to   
involve ! ,director ( ! ,cyb]security & 
,infra/ructure ,security ,ag5cy4  7#c7  
,ag5cy vuln]ability disclosure policies 
,! ,director %all issue guidance to     
ag5cies on ! requir$ m9imum scope (     
ag5cy sy/ems cov]$ by ! vuln]ability    
disclosure policy ( an ag5cy requir$ "u 
subsection 7d77#b74  7c7                
,responsibilities ( ,,cisa ,! ,director 
( ! ,cyb]security & ,infra/ructure      
,security ,ag5cy %all-- 7#a7 provide    
support to ag5cies ) respect to !       
implem5tation ( ! requirem5ts ( ?is     
section2  7#b7 develop tools1 processes1
 & o!r me*anisms det]m9$ appropriate to 
(f] ag5cies capabilities to implem5t !  

requirem5ts ( ?is section2 &  7#c7 ^u a 
reque/ by an ag5cy1 assi/ ! ag5cy 9 !   
disclosure to v5dors ( newly id5tifi$   
vuln]abilities 9 v5dor products &       
s]vices4  7d7 ,responsibilities (       
ag5cies  7#a7 ,public in=mation ,! head 
( ea* ag5cy %all make publicly          
available1 ) respect to ea* int]net     
doma9 "u ! control ( ! ag5cy t is n a   
national security sy/em-- 7,a7 an       
appropriate security contact2 &  7,b7 ! 
compon5t ( ! ag5cy t is responsible = ! 
int]net accessible s]vices (f]$ at !    
doma94  7#b7 ,vuln]ability disclosure   
policy ,! head ( ea* ag5cy %all develop 
& make publicly available a vuln]ability
 disclosure policy = ! ag5cy1 :i* %all--
 7,a7 describe-- 7i7 ! scope ( ! sy/ems 
( ! ag5cy includ$ 9 ! vuln]ability      
disclosure policy2  7ii7 ! type (       
in=mation sy/em te/+ t is au?oriz$ by ! 
ag5cy2  7iii7 ! type ( in=mation sy/em  
te/+ t is n au?oriz$ by ! ag5cy2 &  7iv7
 ! disclosure policy ( ! ag5cy =        
s5sitive in=mation2  7,b7 ) respect to a

 report to an ag5cy1 describe-- 7i7 h[ !
 report] %\ld submit ! report2 &  7ii7  
if ! report is n anonym\s1 :5 ! report] 
%\ld anticipate an ackn[l$gm5t ( receipt
 ( ! report by ! ag5cy2  7,c7 include   
any o!r relevant in=mation2 &  7,d7 be  
mature 9 scope1 cov]+ all int]net       
accessible ,f$]al in=mation sy/ems us$  
or op]at$ by t ag5cy or on behalf ( t   
ag5cy4  7#c7 ,id5tifi$ vuln]abilities ,!
 head ( ea* ag5cy %all incorporate any  
vuln]abilities report$ "u p>agraph 7#b7 
into ! vuln]ability managem5t process ( 
! ag5cy 9 ord] to track & rem$iate !    
vuln]ability4  7e7 ,congressional       
report+ ,n lat] ?an #ij days aft] ! date
 ( ! enactm5t ( ! ,f$]al ,in=mation     
,security ,mod]nization ,act ( #bjbb1 & 
annually !reaft] = a #c-ye> p]iod1 !    
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director1 %all provide
 to ! ,committee on ,homel& ,security & 
,gov]nm5tal ,affairs ( ! ,s5ate & !     
,committee on ,ov]sight & ,re=m ( !     

,h\se ( ,repres5tatives a brief+ on !   
/atus ( ! use ( vuln]ability disclosure 
policies "u ?is section at ag5cies1     
includ+1 ) respect to ! guidance issu$  
"u subsection 7b77#c71 an id5tification 
( ! ag5cies t are compliant & n         
compliant4  7f7 ,exemptions ,!          
au?orities & functions ( ! ,director &  
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy "u ?is  
section %all n apply to national        
security sy/ems4  7g7 ,delegation (     
au?ority = c]ta9 sy/ems ,! au?orities ( 
! ,director & ! ,director ( !           
,cyb]security & ,infra/ructure ,security
 ,ag5cy describ$ 9 ?is section %all be  
delegat$-- 7#a7 to ! ,secret>y ( ,def5se
 9 ! case ( sy/ems describ$ 9 section   
#ceec7;e77#b72 &  7#b7 to ! ,director ( 
,national ,intellig5ce 9 ! case ( sy/ems
 describ$ 9 section #ceec7;e77#c74  4   
7b7 ,sunset ,?is section %all sunset on 
! date t is #aj ye>s aft] ! date ( !    
enactm5t ( ?is ,act4  7c7 ,cl]ical      
am5dm5t ,! table ( sections = *apt] #ce 

( title #dd1 ,unit$ ,/ates ,code1 is    
am5d$ by add+ aft] ! item relat+ to     
section #ceei;,a1 z add$ by ?is ,act1 ! 
foll[+3  #ceei;,b4 ,f$]al vuln]ability  
disclosure programs4  4  #bjf4          
,implem5t+ z]o tru/ ar*itecture  7a7    
,guidance ,! ,director %all ma9ta9      
guidance on ! adoption ( z]o tru/       
ar*itecture & n lat] ?an #b ye>s aft] ! 
date ( ! enactm5t ( ?is ,act1 provide an
 update to ! appropriate congressional  
committees on progress 9 increas+ !     
int]nal def5ses ( ag5cy sy/ems ?r\gh su*
 adoption across ! gov]nm5t1 includ+--  
7#a7 %ift+ away f tru/$ networks to     
implem5t security controls bas$ on a    
presumption ( compromise2  7#b7         
implem5t+ pr9ciples ( lea/ privilege 9  
adm9i/]+ in=mation security programs2   
7#c7 limit+ ! ability ( entities t cause
 incid5ts to move lat]ally ?r\gh or     
betwe5 ag5cy sy/ems2  7#d7 id5tify+     
incid5ts quickly2  7#e7 isolat+ & remov+
 unau?oriz$ entities f ag5cy sy/ems z   
quickly z practicable1 acc\nt+ =        

intellig5ce or law en=cem5t purposes2   
7#f7 o!rwise increas+ ! res\rce co/s =  
entities t cause incid5ts to be         
successful2 &  7#g7 a summ>y ( ! ag5cy  
progress reports requir$ "u subsection  
7b74  7b7 ,ag5cy progress reports ,n    
lat] ?an #bgj days aft] ! date ( !      
enactm5t ( ?is ,act1 ! head ( ea* ag5cy 
%all submit to ! ,director a progress   
report on implem5t+ an in=mation        
security program bas$ on a z]o tru/     
ar*itecture1 :i* %all include-- 7#a7 a  
description ( any /eps ! ag5cy has      
complet$1 includ+ progress t[>d a*iev+  
any requirem5ts issu$ by ! ,director1   
includ+ ! adoption ( any models or      
ref]5ce ar*itecture2  7#b7 an           
id5tification ( activities t h n yet be5
 complet$ & t w\ld h ! mo/ imm$iate     
security impact2 &  7#c7 a s*$ule to    
implem5t any plann$ activities4  #bjg4  
,,gao automation report ,n lat] ?an #b  
ye>s aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,comptroll] ,g5]al ( ! ,unit$   
,/ates %all p]=m a /udy on ! use (      

automation & ma*9e-readable data across 
! ,f$]al ,gov]nm5t = cyb]security       
purposes1 includ+ ! automat$ updat+ (   
cyb]security tools1 s5sors1 or processes
 employ$ by ag5cies "u p>agraphs 7#a71  
7#e77;,c71 & 7#h77;,b7 ( section        
#ceed7;b7 ( title #dd1 ,unit$ ,/ates    
,code4  #bjh4 ,ext5sion ( ,f$]al        
,acquisition ,security ,c\ncil  7a7     
,ext5sion ,section #acbh ( title #da1   
,unit$ ,/ates ,code1 is am5d$ by /rik+ !
 date t & all t foll[s & ins]t+ ,decemb]
 #ca1 #bjbf4  7b7 ,designation ,section 
#acbb7;c77#a7 ( title #da1 ,unit$ ,/ates
 ,code1 is am5d$ by /rik+ ,n lat] ?an & 
all t foll[s ?r\gh ! end ( ! p>agraph & 
ins]t+ ! foll[+3 ,! ,director ( ,,omb   
%all designate ! ,f$]al ,*ief ,in=mation
 ,security ,(fic] appo9t$ by ! ,presid5t
 "u section #cfjg ( title #dd1 or an    
equival5t s5ior-level (ficial f ! ,(fice
 ( ,managem5t & ,budget if ! position is
 vacant1 to s]ve z ! ,*airp]son ( !     
,c\ncil44  7c7 ,requirem5t ,subsection  
#acbf7;b7 ( title #da1 ,unit$ ,/ates    

,code1 is am5d$-- 7#a7 9 p>agraph 7#e71 
by /rik+ 2 & & ins]t+ a semicolon2  7#b7
 by r$esignat+ p>agraph 7#f7 z p>agraph 
7#g72 &  7#c7 by ins]t+ aft] p>agraph   
7#e7 ! foll[+ new p>agraph3  7#f7       
ma9ta9+ an up-to-date & accurate        
inv5tory ( s(tw>e 9 use by ! ag5cy &1 :5
 available1 ! compon5ts ( su* s(tw>e1   
includ+ any available ,s(tw>e ,bills (  
,mat]ials1 z applicable1 t c be         
communicat$ :5 reque/$ to ! ,f$]al      
,acquisition ,security ,c\ncil1 !       
,national ,cyb]security ,director1 or ! 
,secret>y ( ,homel& ,security act+ ?r\gh
 ! ,director ( ,cyb]security &          
,infra/ructure ,security ,ag5cy4  4     
#bji4 ,f$]al *ief in=mation security    
(fic]  7a7 ,am5dm5t ,*apt] #cf ( title  
#dd1 ,unit$ ,/ates ,code1 is am5d$ by   
ins]t+ at ! end3  #cfjg4 ,f$]al *ief    
in=mation security (fic]  7a7           
,e/abli%m5t ,!re is e/abli%$ 9 ! ,(fice 
( ! ,f$]al ,*ief ,in=mation ,(fic] ( !  
,(fice ( ,managem5t & ,budget a ,f$]al  
,*ief ,in=mation ,security ,(fic]1 :o   

%all be appo9t$ by ! ,presid5t4  7b7    
,duties ,! ,f$]al ,*ief ,in=mation      
,security ,(fic] %all report to ! ,f$]al
 ,*ief ,in=mation ,(fic]1 & assi/ !     
,*ief ,in=mation ,(fic] 9 c>ry+ out--   
7#a7 all functions "u ?is *apt]2  7#b7  
all functions assign$ to ! ,director "u 
title ,,ii ( ! ,e-,gov]nm5t ,act (      
#bjjb2  7#c7 o!r electronic gov]nm5t    
initiatives1 consi/5t ) o!r /atutes2    
7#d7 assi/+ ! ,director ) c>ry+ out     
budget =mation duties "u subtitle ,,ii (
 title #ca z x p]ta9s to ! in=mation    
te*nology1 op]ations1 & work=ce res\rces
 ( ,f$]al ag5cies to fulfill            
cyb]security responsibilities "u section
 #ceed1 & ! duties ( ! ,dep>tm5t (      
,homel& ,security duties designat$ "u   
section #ceec2 &  7#e7 o!r initiatives  
det]m9$ by ! ,*ief ,in=mation ,(fic]4   
7c7 ,additional ,duties ,! ,f$]al ,*ief 
,in=mation ,security ,(fic] %all "w ) ! 
,*ief ,in=mation ,(fic] to ov]see       
implem5tation ( electronic ,gov]nm5t "u 
! ,e-,gov]nm5t ,act ( #bjjb1 & o!r      

relevant /atutes1 9 a mann] consi/5t )  
law1 relat+ to-- 7#a7 cyb]security      
/rategy1 policy1 & op]ations1 includ+ ! 
p]=mance ( ! duties ( ! ,director "u    
sub*apt] ,,ii ( *apt] #ce2  7#b7 !      
developm5t ( ent]prise ar*itectures2    
7#c7 in=mation security2  7#d7 privacy2 
7#e7 access to1 dissem9ation (1 &       
pres]vation ( ,gov]nm5t in=mation2 &    
7#f7 o!r areas ( electronic ,gov]nm5t z 
det]m9$ by ! ,adm9i/rator4  7d7         
,assi/ance ,! ,f$]al ,*ief ,in=mation   
,security ,(fic] %all assi/ !           
,adm9i/rator 9 ! p]=mance ( electronic  
,gov]nm5t functions z describ$ 9 section
 #cfjb7;f74  4  7b7 ,deputy ,national   
,cyb] ,director ,section #ageb ( !      
,william ,m4 7,mac7 ,?ornb]ry ,national 
,def5se ,au?orization ,act = ,fiscal    
,ye> #bjba 7#f ,u4,s4,c4 #aejj2 #acd    
,/at4 #dadd7 is am5d$ by add+ at ! end !
 foll[+ new subsection3  7d7 ,deputy    
,director ,!re %all be a ,deputy        
,national ,cyb] ,director = ,ag5cy      
,/rategy1 ,capabilities1 & ,budget1 :o  

%all be ! ,f$]al ,*ief ,in=mation       
,security ,(fic] appo9t$ by ! ,presid5t 
"u section #cfjg ( title #dd1 ,unit$    
,/ates ,code1 & %all report to !        
,director & assi/ ! (fice 9 c>ry+ out ! 
foll[+ duties z x applies to !          
protection ( ,f$]al in=mation sy/ems by 
! ag5cies-- 7#a7 ! prep>ation & ov]sight
 ov] ! implem5tation ( national cyb]    
policy & /rategy "u subsection          
7c77#a77;,c77i72  7#b7 ! =mation &      
issuance ( recomm5dations to ag5cies on 
res\rce allocations & policies "u       
subsection 7c77#a77;,c77ii72  7#c7      
review+ annual budget proposals & mak+  
relat$ recomm5dations "u subsection     
7c77#a77;,c77iii72  7#d7 ! functions1 z 
det]m9$ necess>y1 ( ! ,national ,cyb]   
,director "u sub*apt] ,,ii ( *apt] #ce (
 title #dd1 ,unit$ ,/ates ,code2 &  7#e7
 o!r initiatives det]m9$ by ! ,director1
 or to be necess>y to coord9ate ) !     
,(fice by ! ,f$]al ,*ief ,in=mation     
,(fic]4  4  7c7 ,cl]ical am5dm5t ,!     
table ( sections = *apt] #cf ( title    

#dd1 ,unit$ ,/ates ,code1 is am5d$ by   
add+ aft] ! item relat+ to section #cfjf
 ! foll[+3  #cfjg4 ,f$]al *ief in=mation
 security (fic]4  4  #baj4 ,ext5sion (  
,*ief ,data ,(fic] ,c\ncil ,section     
#bebj;,a7e77#b7 ( title #dd1 ,unit$     
,/ates ,code1 is am5d$ by /rik+ ^u !    
expiration ( ! #b-ye> p]iod t beg9s on !
 date ! ,comptroll] ,g5]al submits !    
report "u p>agraph 7#a7 to ,congress &  
ins]t+ ,janu>y #ca1 #bjcj4  #baa4       
,c\ncil ( ! inspectors g5]al on         
integrity & effici5cy da%bo>d ,section  
#aa7;e77#b7 ( ! ,inspector ,g5]al ,act (
 #aigh 7#e ,u4,s4,c4 ,app47 is am5d$--  
7#a7 9 subp>agraph 7,a71 by /rik+ & at !
 end2  7#b7 by r$esignat+ subp>agraph   
7,b7 z subp>agraph 7,c72 &  7#c7 by     
ins]t+ aft] subp>agraph 7,a7 ! foll[+3  
7,b7 t %all include a da%bo>d ( op5     
in=mation security recomm5dations       
id5tifi$ 9 ! indep5d5t evaluations      
requir$ by section #ceee7;a7 ( title    
#dd1 ,unit$ ,/ates ,code2 &  4  #bab4   
,quantitative cyb]security metrics  7a7 

,def9ition ( cov]$ metrics ,9 ?is       
section1 ! t]m cov]$ metrics means !    
metrics e/abli%$1 review$1 & updat$ "u  
section #bbd7;c7 ( ! ,cyb]security ,act 
( #bjae 7#f ,u4,s4,c4 #aebb7;c774  7b7  
,updat+ & e/abli%+ metrics ,n lat] ?an  
#a ye> aft] ! date ( ! enactm5t ( ?is   
,act1 ! ,director ( ! ,cyb]security &   
,infra/ructure ,security ,ag5cy1 9      
coord9ation ) ! ,director & consult+ ) !
 ,director ( ! ,national ,in/itute (    
,/&>ds & ,te*nology1 %all-- 7#a7        
evaluate any cov]$ metrics e/abli%$ z ( 
! date ( ! enactm5t ( ?is ,act2 &  7#b7 
z appropriate & pursuant to section     
#bbd7;c7 ( ! ,cyb]security ,act ( #bjae 
7#f ,u4,s4,c4 #aebb7;c77-- 7,a7 update !
 cov]$ metrics2 &  7,b7 e/abli% new     
cov]$ metrics4  7c7 ,implem5tation  7#a7
 ,9 g5]al ,n lat] ?an #edj days aft] !  
date ( ! enactm5t ( ?is ,act1 !         
,director1 9 coord9ation ) ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy1 %all promulgate       
guidance t requires ea* ag5cy to use    

cov]$ metrics to track tr5ds 9 !        
cyb]security & incid5t response         
capabilities ( ! ag5cy4  7#b7 ,p]=mance 
demon/ration ,! guidance issu$ "u       
p>agraph 7#a7 & any subsequ5t guidance  
%all require ag5cies to %>e ) !         
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy data    
demon/rat+ ! p]=mance ( ! ag5cy us+ !   
cov]$ metrics includ$ 9 ! guidance4     
7#c7 ,p5etration te/s ,on n less ?an #b 
occasions dur+ ! #b-ye> p]iod foll[+ !  
date on :i* guidance is promulgat$ "u   
p>agraph 7#a71 ! ,director %all ensure t
 n less ?an #c ag5cies are subject$ to  
sub/antially simil> p5etration te/s1 z  
det]m9$ by ! ,director1 9 coord9ation ) 
! ,director ( ! ,cyb]security &         
,infra/ructure ,security ,ag5cy1 9 ord] 
to validate ! utility ( ! cov]$ metrics4
  7#d7 ,analysis capacity ,! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy %all develop a         
capability t all[s = ! analysis ( !     
cov]$ metrics1 includ+ cross-ag5cy      

p]=mance ( ag5cy cyb]security & incid5t 
response capability tr5ds4  7d7         
,congressional reports  7#a7 ,utility ( 
metrics ,n lat] ?an #a ye> aft] ! date (
 ! enactm5t ( ?is ,act1 ! ,director ( ! 
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 9 coord9ation ) ! ,director1   
%all submit to ! appropriate            
congressional committees a report on !  
utility ( ! cov]$ metrics4  7#b7 ,use ( 
metrics ,n lat] ?an #ahj days aft] !    
date on :i* ! ,director promulgates     
guidance "u subsection 7c77#a71 !       
,director %all submit to ! appropriate  
congressional committees a report on !  
results ( ! use ( ! cov]$ metrics by    
ag5cies4  7e7 ,f$]al ,cyb]security      
,enhancem5t ,act ( #bjae updates ,!     
,f$]al ,cyb]security ,enhancem5t ,act ( 
#bjae 7#f ,u4,s4,c4 #aeba et seq47 is   
am5d$-- 7#a7 9 section #bbb7c77;,b71 by 
ins]t+ & ! ,committee on ,ov]sight &    
,re=m be=e ( ! ,h\se ( ,repres5tatives2 
&  7#b7 9 section #bbd-- 7,a7 by am5d+  
subsection 7c7 to read z foll[s3  7c7   

,improv$ metrics ,! ,director ( !       
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 9 coord9ation ) ! ,director1   
%all e/abli%1 review1 & update metrics  
to measure ! cyb]security & incid5t     
response capabilities ( ag5cies 9       
accordance ) ! responsibilities (       
ag5cies "u section #ceed ( title #dd1   
,unit$ ,/ates ,code4  2  7,b7 by /rik+  
subsection 7e72 &  7,c7 by r$esignat+   
subsection 7f7 z subsection 7e74  ,,iii 
,,pilot ,,programs ,,to ,,enhance       
,,f$]al ,,cyb]security  #cja4 ,risk-bas$
 budget pilot  7a7 ,def9itions ,9 ?is   
section3 7#a7 ,appropriate congressional
 committees ,! t]m appropriate          
congressional committees means-- 7,a7 ! 
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs & ! ,committee on  
,appropriations ( ! ,s5ate2 &  7,b7 !   
,committee on ,homel& ,security1 !      
,committee on ,ov]sight & ,re=m1 & !    
,committee on ,appropriations ( ! ,h\se 
( ,repres5tatives4  7#b7 ,in=mation     
te*nology ,! t]m in=mation te*nology--  

7,a7 has ! mean+ giv5 ! t]m 9 section   
#aaaja ( title #dj1 ,unit$ ,/ates ,code2
 &  7,b7 includes ! h>dw>e & s(tw>e     
sy/ems ( a ,f$]al ag5cy t monitor &     
control physical equipm5t & processes ( 
! ,f$]al ag5cy4  7#c7 ,risk-bas$ budget 
,! t]m risk-bas$ budget means a budget--
 7,a7 develop$ by id5tify+ & prioritiz+ 
cyb]security risks & vuln]abilities1    
includ+ impact on ag5cy op]ations 9 !   
case ( a cyb] attack1 ?r\gh analysis (  
cyb] ?reat intellig5ce1 incid5t data1 & 
tactics1 te*niques1 proc$ures1 &        
capabilities ( cyb] ?reats2 &  7,b7 t   
allocates res\rces bas$ on ! risks      
id5tifi$ & prioritiz$ "u subp>agraph    
7,a74  7b7 ,e/abli%m5t ( risk-,bas$     
budget pilot  7#a7 ,9 g5]al  7,a7 ,model
 ,n lat] ?an #a ye> aft] ! fir/         
publication ( ! budget submitt$ by !    
,presid5t "u section #aaje ( title #ca1 
,unit$ ,/ates ,code1 foll[+ ! date ( !  
enactm5t ( ?is ,act1 ! ,director1 9     
consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security

 ,ag5cy & ! ,national ,cyb] ,director & 
9 coord9ation ) ! ,director ( !         
,national ,in/itute ( ,/&>ds &          
,te*nology1 %all conduct a pilot =      
creat+ a risk-bas$ budget = cyb]security
 sp5d+4  7,b7 ,cont5ts ( pilot ,! pilot 
requir$ to be develop$ "u ?is p>agraph  
%all-- 7i7 consid] ,f$]al & non-,f$]al  
cyb] ?reat intellig5ce products1 :]e    
available1 to id5tify ?reats1           
vuln]abilities1 & risks2  7ii7 consid] !
 impact on ag5cy op]ations ( incid5ts1  
includ+ ! int]connectivity to o!r ag5cy 
sy/ems & ! op]ations ( o!r ag5cies2     
7iii7 indicate :]e res\rces %\ld be     
allocat$ to h ! greate/ impact on       
mitigat+ curr5t & future ?reats & curr5t
 & future cyb]security capabilities2    
7iv7 be us$ to in=m acquisition &       
su/a9m5t (-- 7,i7 in=mation te*nology & 
cyb]security tools2  7,,ii7 in=mation   
te*nology & cyb]security ar*itectures2  
7,,iii7 in=mation te*nology &           
cyb]security p]sonnel2 &  7,,iv7        
cyb]security & in=mation te*nology      

concepts ( op]ations2 &  7v7 be us$ to  
evaluate & in=m gov]nm5t-wide           
cyb]security programs ( ! ,dep>tm5t (   
,homel& ,security4  7#b7 ,reports ,n    
lat] ?an #b ye>s aft] ! fir/ publication
 ( ! budget submitt$ by ! ,presid5t "u  
section #aaje ( title #ca1 ,unit$ ,/ates
 ,code1 foll[+ ! date ( ! enactm5t ( ?is
 ,act1 ! ,director %all submit a report 
to ,congress on ! implem5tation ( !     
pilot = risk-bas$ budget+ = cyb]security
 sp5d+1 an assessm5t ( ag5cy            
implem5tation1 & an evaluation ( :e!r ! 
risk-bas$ budget helps to mitigate      
cyb]security vuln]abilities4  7#c7 ,,gao
 report ,n lat] ?an #c ye>s aft] ! date 
on :i* ! fir/ budget ( ! ,presid5t is   
submitt$ to ,congress conta9+ !         
validation requir$ "u section           
#aaje7;a77#ce77;,a77i77,v7 ( title #ca1 
,unit$ ,/ates ,code1 z am5d$ by         
subsection 7c71 ! ,comptroll] ,g5]al ( !
 ,unit$ ,/ates %all submit to !         
appropriate congressional committees a  
report t includes-- 7,a7 an evaluation (

 ! success ( pilot ag5cies 9 implem5t+  
risk-bas$ budgets2  7,b7 an evaluation (
 :e!r ! risk-bas$ budgets develop$ by   
pilot ag5cies are effective at in=m+    
,f$]al ,gov]nm5t-wide cyb]security      
programs2 &  7,c7 any o!r in=mation     
relat+ to risk-bas$ budgets !           
,comptroll] ,g5]al det]m9es appropriate4
  #cjb4 ,active cyb] def5sive /udy  7a7 
,def9ition ,9 ?is section1 ! t]m active 
def5se te*nique has ! mean+ giv5 9      
guidance issu$ by ! ,director1 9        
coord9ation ) ! ,attorney ,g5]al4  7b7  
,/udy ,n lat] ?an #ahj days aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy1 9 coord9ation ) !     
,director & ! ,national ,cyb] ,director1
 %all p]=m a /udy on ! use ( active     
def5se te*niques to enhance ! security (
 ag5cies1 :i* %all include-- 7#a7 a     
review ( legal re/rictions on ! use (   
diff]5t active cyb] def5se te*niques 9  
,f$]al environm5ts1 9 consultation ) !  
,attorney ,g5]al2  7#b7 an evaluation   

(-- 7,a7 ! efficacy ( a selection (     
active def5se te*niques det]m9$ by !    
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy2 &  7,b7
 factors t impact ! efficacy ( ! active 
def5se te*niques evaluat$ "u subp>agraph
 7,a72  7#c7 recomm5dations on safegu>ds
 & proc$ures t %all be e/abli%$ to      
require t active def5se te*niques are   
adequately coord9at$ to ensure t active 
def5se te*niques d n imp$e ag5cy        
op]ations & mission deliv]y1 ?reat      
response ef=ts1 crim9al inve/igations1 &
 national security activities1 includ+  
intellig5ce collection2 &  7#d7 !       
developm5t ( a framework = ! use (      
diff]5t active def5se te*niques by      
ag5cies4  #cjc4 ,security op]ations c5t]
 z a s]vice pilot  7a7 ,purpose ,!      
purpose ( ?is section is = ! ,director (
 ! ,cyb]security & ,infra/ructure       
,security ,ag5cy to run a security      
op]ation c5t] on behalf ( ! head ( ano!r
 ag5cy1 alleviat+ ! ne$ to duplicate ?is
 function at e ag5cy1 & emp[]+ a great] 

c5traliz$ cyb]security capability4  7b7 
,plan ,n lat] ?an #a ye> aft] ! date ( !
 enactm5t ( ?is ,act1 ! ,director ( !   
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all develop a plan to e/abli% a
 c5traliz$ ,f$]al security op]ations    
c5t] %>$ s]vice (f]+ )9 ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy4  7c7 
,cont5ts ,! plan requir$ "u subsection  
7b7 %all include consid]ations =-- 7#a7 
collect+1 organiz+1 & analyz+ ag5cy     
in=mation sy/em data 9 real "t2  7#b7   
/aff+ & res\rces2 &  7#c7 appropriate   
int]ag5cy agreem5ts1 concepts (         
op]ations1 & gov]nance plans4  7d7      
,pilot program  7#a7 ,9 g5]al ,n lat]   
?an #ahj days aft] ! date on :i* ! plan 
requir$ "u subsection 7b7 is develop$1 !
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director ( ! ,(fice ( 
,managem5t & ,budget1 %all ent] into a  
#a-ye> agreem5t ) n less ?an #b ag5cies 
to (f] a security op]ations c5t] z a %>$
 s]vice4  7#b7 ,additional agreem5ts    

,aft] ! date on :i* ! brief+ requir$ "u 
subsection 7e77#a7 is provid$1 !        
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director ( ! ,(fice ( 
,managem5t & ,budget1 may ent] into     
additional #a-ye> agreem5ts describ$ 9  
p>agraph 7#a7 ) ag5cies4  7e7 ,brief+ & 
report  7#a7 ,brief+ ,n lat] ?an #bgj   
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,cyb]security &   
,infra/ructure ,security ,ag5cy %all    
provide to appropriate congressional    
committees a brief+ on ! p>amet]s ( any 
#a-ye> agreem5ts ent]$ into "u          
subsection 7d77#a74  7#b7 ,report ,n    
lat] ?an #ij days aft] ! date on :i* !  
fir/ #a-ye> agreem5t ent]$ into "u      
subsection 7d7 expires1 ! ,director ( ! 
,cyb]security & ,infra/ructure ,security
 ,ag5cy %all submit to appropriate      
congressional committees a report on--  
7,a7 ! agreem5t2 &  7,b7 any additional 
agreem5ts ent]$ into ) ag5cies "u       
subsection 7d74  #cjd4 ,endpo9t         

detection & response z a s]vice pilot   
7a7 ,purpose ,! ,cyb]security &         
,infra/ructure ,security ,ag5cy is      
direct$ to e/abli% & conduct a pilot to 
det]m9e ! feasibility1 value1 & efficacy
 ( provid+ endpo9t detection & response 
capabilities z a %>$ s]vice to ,f$]al   
ag5cies to r$uce co/s1 enhance          
int]op]ability1 & cont9u\sly detect &   
mitigate ?reat activity on ,f$]al       
networks4  7b7 ,plan ,n lat] ?an #ij    
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,cyb]security &   
,infra/ructure ,security ,ag5cy %all    
develop a plan to e/abli% a c5traliz$   
endpo9t detection & response %>$ s]vice 
(f]+ )9 ! ,cyb]security & ,infra/ructure
 ,security ,ag5cy4  7c7 ,cont5ts ,! plan
 requir$ "u subsection 7b7 %all include 
consid]ations =-- 7#a7 und]/&+ & assess+
 ! full ext5t ( endpo9ts across ! ,f$]al
 civilian environm5t2  7#b7 maximiz+ !  
value ( exi/+ ag5cy inve/m5ts 9 endpo9t 
detection & response tools & s]vices2   
7#c7 aggregat+ ! available contract     

vehicles & options t provide ag5cies )  
appropriate capability = _! environm5t &
 ar*itecture2  7#d7 equipp+ all endpo9ts
 & s]vices ( pilot ag5cies ) endpo9t    
detection & response programs2  7#e7    
aggregat+ network1 cl\d1 & endpo9t data 
f bo? )9 ! ag5cy & across ag5cies to    
provide ent]prise-wide monitor+ ( !     
network to detect abnormal network      
behavior & automate def5sive            
capabilities2 &  7#f7 appropriate       
int]ag5cy agreem5ts1 concepts (         
op]ations1 & gov]nance plans4  7d7      
,pilot program  7#a7 ,9 g5]al ,n lat]   
?an #ahj days aft] ! date on :i* ! plan 
requir$ "u subsection 7b7 is develop$1 !
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy1 9      
consultation ) ! ,director1 %all ent]   
into a #a-ye> agreem5t ) n less ?an #b  
ag5cies to (f] endpo9t detection &      
response z a %>$ s]vice4  7#b7          
,additional agreem5ts ,aft] ! date on   
:i* ! brief+ requir$ "u subsection      
7e77#a7 is provid$1 ! ,director ( !     

,cyb]security & ,infra/ructure ,security
 ,ag5cy1 9 consultation ) ! ,director1  
may ent] into additional #a-ye>         
agreem5ts describ$ 9 p>agraph 7#a7 )    
ag5cies4  7e7 ,brief+ & report  7#a7    
,brief+ ,n lat] ?an #bgj days aft] !    
date ( ! enactm5t ( ?is ,act1 !         
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy %all    
provide to ! ,committee on ,homel&      
,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,homel&        
,security & ! ,committee on ,ov]sight & 
,re=m ( ! ,h\se ( ,repres5tatives a     
brief+ on ! p>amet]s ( any #a-ye>       
agreem5ts ent]$ into "u subsection      
7d77#a74  7#b7 ,report ,n lat] ?an #ij  
days aft] ! date on :i* ! fir/ #a-ye>   
agreem5t ent]$ into "u subsection 7d7   
expires1 ! ,director ( ! ,cyb]security &
 ,infra/ructure ,security ,ag5cy %all   
submit to ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,homel&        
,security & ! ,committee on ,ov]sight & 

,re=m ( ! ,h\se ( ,repres5tatives a     
report on-- 7,a7 ! agreem5t2 &  7,b7 any
 additional agreem5ts ent]$ into )      
ag5cies "u subsection 7d74