,i  #aag? ,,congress  #b;d ,session  ,h4
 ,r4 #hdjc  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,july #ae1 #bjbb,mr4  
,swalwell introduc$ ! foll[+ bill2 :i* 0
 ref]r$ to ! ,committee on ,ov]sight &  
,re=m1 & 9 addition to ! ,committee on  
,arm$ ,s]vices1 = a p]iod to be         
subsequ5tly det]m9$ by ! ,speak]1 9 ea* 
case = consid]ation ( su* provisions z  
fall )9 ! jurisdiction ( ! committee    
conc]n$  ,a ,,bill  ,to enc\rage &      
improve ,f$]al proactive cyb]security   
initiatives1 & = o!r purposes4  #a4     
,%ort title2 table ( cont5ts  7a7 ,%ort 
title ,?is ,act may be cit$ z !         
,proactive ,cyb] ,initiatives ,act (    
#bjbb4  7b7 ,table ( cont5ts ,! table ( 
cont5ts = ?is ,act is z foll[s3 ,sec4   
#a4 ,%ort title2 table ( cont5ts4,sec4  
#b4 ,def9itions4,sec4 #c4 ,increas+     
proactive cyb]security initiatives4,sec4
 #d4 ,/r5g!n+ ,(fice ( ,national ,cyb]  
,director4,sec4 #e4 ,p5etration te/+    
reports4,sec4 #f4 ,report on active     
def5se te*niques4,sec4 #g4 ,/udy on     

innovative uses ( proactive cyb]security
 initiatives4  #b4 ,def9itions ,9 ?is   
,act3 7#a7 ,active def5se te*nique ,!   
t]m active def5se te*nique means an     
action tak5 on an in=mation sy/em ( an  
ag5cy to increase ! security ( su* sy/em
 aga9/ an attack]1 includ+-- 7,a7 ! use 
( a deception te*nology or o!r          
purposeful fe$+ ( false or mislead+     
in=mation to an attack] access+ su*     
sy/em2 &  7,b7 proportional action tak5 
9 response to an unlawful brea*4  7#b7  
,ag5cy ,! t]m ag5cy means any ,gov]nm5t 
corporation1 ,gov]nm5t-controll$        
corporation1 or o!r e/abli%m5t ( !      
executive bran* ( ! ,gov]nm5t 7includ+ !
 ,executive ,(fice ( ! ,presid5t71 or   
any indep5d5t regulatory ag5cy1 b does n
 include ! foll[+3 7,a7 ,! ,gov]nm5t    
,acc\ntability ,(fice4  7,b7 ,! ,f$]al  
,election ,commission4  7,c7 ,!         
gov]nm5ts ( ! ,di/rict ( ,columbia & ( !
 t]ritories & possessions ( ! ,unit$    
,/ates1 & _! v>i\s subdivisions4  7,d7  
,gov]nm5t-own$ contractor-op]at$        

facilities1 includ+ laboratories engag$ 
9 national def5se rese>* & production   
activities4  7#c7 ,cont9u\s monitor+ ,! 
t]m cont9u\s monitor+ means cont9u\s    
exp]im5tation conduct$ by an ag5cy on an
 in=mation sy/em ( su* ag5cy to evaluate
 ! resili5ce ( su* sy/em aga9/ a        
malici\s attack or condition t c\ld     
compromise su* sy/em = ! purpose (      
improv+ design1 resili5ce1 or incid5t   
response ) respect to su* sy/em4  7#d7  
,deception te*nology ,! t]m deception   
te*nology means an isolat$ digital      
environm5t1 sy/em1 or plat=m conta9+ a  
replication ( an active in=mation sy/em 
) reali/ic data fl[s us$ to attract1    
mislead1 or obs]ve an attack]4  7#e7    
,dep>tm5t ,! t]m dep>tm5t means !       
foll[+3 7,a7 ,! ,dep>tm5t ( ,/ate4  7,b7
 ,! ,dep>tm5t ( ! ,treasury4  7,c7 ,!   
,dep>tm5t ( ,def5se4  7,d7 ,! ,dep>tm5t 
( ,ju/ice4  7,e7 ,! ,dep>tm5t ( !       
,int]ior4  7,f7 ,! ,dep>tm5t (          
,agriculture4  7,g7 ,! ,dep>tm5t (      
,comm]ce4  7,h7 ,! ,dep>tm5t ( ,labor4  

7,i7 ,! ,dep>tm5t ( ,heal? & ,human     
,s]vices4  7,j7 ,! ,dep>tm5t ( ,h\s+ &  
,urban ,developm5t4  7,k7 ,! ,dep>tm5t (
 ,transportation4  7,l7 ,! ,dep>tm5t (  
,en]gy4  7,m7 ,! ,dep>tm5t ( ,education4
  7,n7 ,! ,dep>tm5t ( ,vet]ans ,affairs4
  7,o7 ,! ,dep>tm5t ( ,homel& ,security4
  7#f7 ,director ,! t]m ,director means 
! ,director ( ! ,cyb]security &         
,infra/ructure ,security ,ag5cy ( !     
,dep>tm5t ( ,homel& ,security4  7#g7    
,in=mation sy/em ,! t]m in=mation sy/em 
has ! mean+ giv5 ! t]m 9 section #cejb (
 title #dd1 ,unit$ ,/ates ,code4  7#h7  
,national laboratory ,! t]m national    
laboratory has ! mean+ giv5 ! t]m 9     
section #b ( ! ,en]gy ,policy ,act (    
#bjje 7#db ,u4,s4,c4 #aehja74  7#i7     
,p5etration te/2 p5etration te/+ ,! t]ms
 p5etration te/ & p5etration te/+ mean  
an assessm5t conduct$ on an in=mation   
sy/em ( an ag5cy t emulates an attack or
 o!r exploitation capability to id5tify 
& te/ vuln]abilities t c\ld be exploit$4
  7#aj7 ,rules ( engagem5t ,! t]m rules 

( engagem5t means a set ( rules e/abli%$
 by an ag5cy = use dur+ p5etration te/+4
  #c4 ,increas+ proactive cyb]security  
initiatives  7a7 ,p5etration te/+  7#a7 
,9 g5]al ,! head ( ea* dep>tm5t or ag5cy
 %all c>ry out ! foll[+3 7,a7 ,conduct  
regul> p5etration te/+ on ! in=mation   
sy/ems 7z describ$ 9 p>agraph 7#b77 (   
su* dep>tm5t or ag5cy4  7,b7 ,provide to
 ! ,director1 ! ,national ,cyb]         
,director1 & ! ,director ( ! ,(fice (   
,managem5t & ,budget a report on !      
results ( su* te/+1 includ+-- 7i7 an    
id5tification ( any risks discov]$2 &   
7ii7 a description ( h[ cyb]security at 
su* dep>tm5t or ag5cy may be improv$4   
7#b7 ,in=mation sy/ems describ$ ,=      
purposes ( p>agraph 7#a77;,a71 an       
in=mation sy/em ( an ag5cy to be te/$ is
 "o describ$ z mod]ate- or high-impact 9
 ! docum5t titl$ ,risk ,managem5t       
,framework = ,in=mation ,sy/ems &       
,organizations3 ,a ,sy/em ,life ,cycle  
,approa* = ,security & ,privacy         
7,national ,in/itute ( ,/&>ds &         

,te*nology ,special ,publication        
#hjj-cg1 ,revision #b2 ,decemb] #bjah7  
or 9 a successor docum5t4  7b7 ,guidance
 ,n lat] ?an "o ye> aft] ! date ( !     
enactm5t ( ?is ,act1 ! ,director1 9     
consultation ) ! ,secret>y ( ,def5se1 ! 
,national ,cyb] ,director1 ! ,director (
 ,national ,intellig5ce1 ! ,secret>y (  
,homel& ,security1 & ! head ( any o!r   
dep>tm5t or ag5cy ! ,director det]m9es  
appropriate1 %all issue guidance to     
facilitate ! implem5tation ( subsection 
7a71 :i* %all include ! foll[+3 7#a7    
,in=mation reg>d+ h[ dep>tm5ts & ag5cies
 are to utilize indep5d5t p5etration    
te/+ c>ri$ out by ano!r dep>tm5t or     
ag5cy1 a national laboratory1 or a      
private entity4  7#b7 ,recomm5dations   
reg>d+ h[ be/ to utilize1 )9 ! budget ( 
an ag5cy1 p5etration te/+1 includ+      
indep5d5t p5etration te/+4  7#c7        
,recomm5dations = m9imum rules (        
engagem5t4  7c7 ,report  7#a7 ,9 g5]al  
,n lat] ?an "o ye> aft] ! date ( !      
enactm5t ( ?is ,act1 ! ,director %all   

submit to ! appropriate congressional   
committees a report t includes ! foll[+3
 7,a7 ,an analysis ( :e!r increas$      
engagem5t is ne$$ f national            
laboratories & ! private sector to assi/
 ) ! protection ( ! in=mation sy/ems (  
ag5cies ?r\gh ! use ( ! foll[+3 7i7     
,active def5se te*niques4  7ii7         
,deception te*nologies4  7iii7          
,p5etration te/+4  7,b7 ,an analysis ( !
 feasibility & b5efits ( consolidat+ )9 
! ,cyb]security & ,infra/ructure        
,security ,ag5cy ( ! ,dep>tm5t ( ,homel&
 ,security proactive cyb]security       
initiatives4  7,c7 ,an analysis ( :e!r !
 ,director requires additional          
au?orities or res\rces to c>ry out      
proactive cyb]security initiatives =    
ag5cies4  7#b7 ,appropriate             
congressional committees def9$ ,9 ?is   
subsection1 ! t]m appropriate           
congressional committees means-- 7,a7 ) 
respect to ! ,h\se ( ,repres5tatives--  
7i7 ! ,committee on ,appropriations2    
7ii7 ! ,committee on ,arm$ ,s]vices2    

7iii7 ! ,committee on ,homel& ,security2
  7iv7 ! ,committee on ! ,judici>y2  7v7
 ! ,committee on ,ov]sight & ,re=m2 &   
7vi7 ! ,p]man5t ,select ,committee on   
,intellig5ce2 &  7,b7 ) respect to !    
,s5ate-- 7i7 ! ,committee on            
,appropriations2  7ii7 ! ,committee on  
,arm$ ,s]vices2  7iii7 ! ,committee on  
,homel& ,security & ,gov]nm5tal         
,affairs2  7iv7 ! ,committee on !       
,judici>y2 &  7v7 ! ,select ,committee  
on ,intellig5ce4  #d4 ,/r5g!n+ ! ,(fice 
( ! ,national ,cyb] ,director  7a7      
,deconfliction ,section                 
#ageb7;c77#a77;,d7 ( ! ,william ,m4     
7,mac7 ,?ornb]ry ,national ,def5se      
,au?orization ,act = ,fiscal ,ye> #bjba 
7#f ,u4,s4,c4 #aejj7;c77#a77;,d77 is    
am5d$-- 7#a7 9 clause 7iii71 by /rik+ & 
at ! end2  7#b7 9 clause 7iv71 by ins]t+
 & at ! end2 &  7#c7 by add+ at ! end ! 
foll[+3  7v7 deconflict+ ov]lapp+       
jurisdiction betwe5 ag5cies reg>d+      
cyb]security activities & au?ority to   
mitigate risks2  4  7b7 ,in=mation %>+  

,section #ageb7;c77#a7 ( ! ,william ,m4 
7,mac7 ,?ornb]ry ,national ,def5se      
,au?orization ,act = ,fiscal ,ye> #bjba 
7#f ,u4,s4,c4 #aejj7;c77#a77 is am5d$-- 
7#a7 9 subp>agraph 7,c77vi71 by ins]t+ !
 ,secret>y ( ,homel& ,security1 !       
,director ( ! ,(fice ( ,managem5t &     
,budget1 aft] ! ,assi/ant to ! ,presid5t
 = ,national ,security ,affairs12 &     
7#b7 9 subp>agraph 7,g71 by ins]t+ !    
,secret>y ( ,homel& ,security1 !        
,director ( ! ,(fice ( ,managem5t &     
,budget1 & aft] annually report to4  #e4
 ,p5etration te/+ reports  7a7          
,cyb]security & ,infra/ructure ,security
 ,ag5cy  7#a7 ,aggregation ( p5etration 
te/+ results ,n lat] ?an "o ye> aft] !  
date ( ! enactm5t ( ?is ,act & annually 
!reaft]1 ! ,director %all aggregate &   
review ! results ( ! p5etration te/+    
provid$ to ! ,director "u section       
#c7;a77#a77;,b74  7#b7 ,int]ag5cy       
reports ,n lat] ?an #ahj days aft] ea*  
review "u p>agraph 7#a71 ! ,director1   
bas$ on su* review1 %all provide to ea* 

ag5cy a report conta9+ ! foll[+3 7,a7 ,a
 summ>y ( ! results ( su* review1       
includ+ an id5tification ( risks & o!r  
results common across ag5cies4  7,b7 ,an
 assessm5t1 bas$ on ! docum5t entitl$   
,risk ,managem5t ,framework = ,in=mation
 ,sy/ems & ,organizations3 ,a ,sy/em    
,life ,cycle ,approa* = ,security &     
,privacy 7,national ,in/itute ( ,/&>ds &
 ,te*nology ,special ,publication       
#hjj-cg1 ,revision #b2 ,decemb] #bjah7  
or a successor docum5t1 ( ! sev]ity (   
risks id5tifi$ "u subp>agraph 7,a74     
7,c7 ,an analysis ( ! duration ( "t t   
su* risks h exi/$4  7,d7 ,recomm5dations
 = mitigat+ su* risks1 :i* prioritize   
risks assess$ z ! highe/ sev]ity        
pursuant to subp>agraph 7,b74  7#c7     
,congressional report ,n lat] ?an #ahj  
days aft] ea* report provid$ "u p>agraph
 7#b71 ! ,director %all submit to       
,congress a report t conta9s-- 7,a7 a   
summ>y ( ! report provid$ "u su*        
p>agraph2 &  7,b7 recomm5dations =      
legislative action relat+ to ! matt]s   

ref]r$ to 9 su* p>agraph4  7b7 ,gov]nm5t
 ,acc\ntability ,(fice ,n lat] ?an #ahj 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,comptroll] ,g5]al ( ! ,unit$   
,/ates %all submit to ,congress a report
 on p5etration te/+1 :i* %all include ! 
foll[+3 7#a7 ,an id5tification ( :i*    
dep>tm5ts or ag5cies are obligat+ &     
exp5d+ funds on p5etration te/+ & h[ su*
 funds are be+ us$1 includ+ :e!r su*    
funds are be+ us$ on indep5d5t          
p5etration te/+4  7#b7 ,recomm5dations =
 legislative action reg>d+ additional   
au?ority or res\rces ne$$ by dep>tm5ts  
or ag5cies to conduct p5etration te/+ m 
effectively1 includ+ ) respect to       
indep5d5t p5etration te/+4  #f4 ,report 
on active def5se te*niques  7a7 ,report 
,n lat] ?an #ah mon?s aft] ! date ( !   
enactm5t ( ?is ,act1 ! ,director1 9     
consultation ) ! ,national ,cyb]        
,director & repres5tatives ( appropriate
 private sector entities1 %all submit to
 ! appropriate congressional committees 
a report reg>d+ active def5se te*niques4

  7b7 ,cont5ts ,! report describ$ 9     
subsection 7a7 %all include ! foll[+3   
7#a7 ,an assessm5t ( ! effectiv5ess (   
active def5se te*niques to protect !    
in=mation sy/ems ( dep>tm5ts or ag5cies4
  7#b7 ,recomm5dations reg>d+ h[ su*    
te*niques c be bett] utiliz$ to protect 
su* sy/ems1 includ+ be/ practices )     
respect to su* te*niques4  7#c7 ,an     
analysis ( :e!r !re are legislative1    
regulatory1 or res\rce burd5s t prev5t  
su* te*niques f be+ effectively utiliz$1
 includ+ ! res\rces necess>y to implem5t
 su* te*niques4  7#d7 ,an id5tification 
( res\rces necess>y to c>ry out !       
recomm5dations "u p>agraph 7#b74  7#e7  
,an id5tification ( o!r te*niques t %\ld
 be evaluat$ to protect su* sy/ems4  7c7
 ,appropriate congressional committees  
def9$ ,9 ?is subsection1 ! t]m          
appropriate congressional committees    
means-- 7#a7 ) respect to ! ,h\se (     
,repres5tatives-- 7,a7 ! ,committee on  
,appropriations2  7,b7 ! ,committee on  
,arm$ ,s]vices2  7,c7 ! ,committee on   

,homel& ,security2  7,d7 ! ,committee on
 ! ,judici>y2  7,e7 ! ,committee on     
,ov]sight & ,re=m2 &  7,f7 ! ,p]man5t   
,select ,committee on ,intellig5ce2 &   
7#b7 ) respect to ! ,s5ate-- 7,a7 !     
,committee on ,appropriations2  7,b7 !  
,committee on ,arm$ ,s]vices2  7,c7 !   
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs2  7,d7 ! ,committee
 on ! ,judici>y2 &  7,e7 ! ,select      
,committee on ,intellig5ce4  #g4 ,/udy  
on innovative uses ( proactive          
cyb]security initiatives  7a7 ,/udy ,!  
,secret>y ( ,def5se1 9 consultation ) ! 
,director ( ,national ,intellig5ce1 !   
,secret>y ( ,homel& ,security1 !        
,attorney ,g5]al1 & ! head ( any o!r    
dep>tm5t or ag5cy ! ,director det]m9es  
appropriate1 %all conduct a /udy on     
innovative uses ( proactive cyb]security
 initiatives1 includ+ ! foll[+3 7#a7 ,! 
use ( deception te*nologies4  7#b7 ,!   
use ( cont9u\s monitor+ to g5]ate       
evid5ce reg>d+ h[ an in=mation sy/em--  
7,a7 op]ates "u normal or int5d$ use2 & 

7,b7 behaves "u a v>iety ( adv]se       
conditions or sc5>ios4  7#c7 ,!         
feasibility ( dep>tm5t or ag5cy adoption
 ( a set ( cont9u\s monitor+ proc$ures4 
7b7 ,reports  7#a7 ,classifi$ report ,n 
lat] ?an two ye>s aft] ! date ( !       
enactm5t ( ?is ,act1 ! ,secret>y (      
,def5se %all submit to ! ,p]man5t       
,select ,committee on ,intellig5ce ( !  
,h\se ( ,repres5tatives & ! ,select     
,committee on ,intellig5ce ( ! ,s5ate a 
classifi$ report describ+ ! results ( ! 
/udy requir$ "u subsection 7a71 includ+ 
examples ( any successes aga9/ attack]s 
:o unlawfully brea*$ an in=mation sy/em 
( a dep>tm5t or ag5cy4  7#b7            
,unclassifi$ report ,n lat] ?an two ye>s
 aft] ! date ( ! enactm5t ( ?is ,act1 ! 
,secret>y %all submit to ! appropriate  
congressional committees an unclassifi$ 
report describ+ ! results ( ! /udy      
requir$ "u subsection 7a71 includ+      
legislative recomm5dations relat+ !reto4
  7c7 ,appropriate congressional        
committees def9$ ,9 ?is section1 ! t]m  

appropriate congressional committees    
means-- 7#a7 ) respect to ! ,h\se (     
,repres5tatives-- 7,a7 ! ,committee on  
,arm$ ,s]vices2  7,b7 ! ,committee on   
,homel& ,security2  7,c7 ! ,committee on
 ! ,judici>y2  7,d7 ! ,committee on     
,ov]sight & ,re=m2 &  7,e7 ! ,p]man5t   
,select ,committee on ,intellig5ce2 &   
7#b7 ) respect to ! ,s5ate-- 7,a7 !     
,committee on ,arm$ ,s]vices2  7,b7 !   
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs2  7,c7 ! ,committee
 on ! ,judici>y2 &  7,d7 ! ,select      
,committee on ,intellig5ce4