,,ii #aagth ,,congress #ast ,session ,s4 #acaf ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #bb1 #bjba,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to authorize the ,secretary of ,homeland ,security to make a declaration of a significant incident1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,response and ,recovery ,act of #bjba4 #b4 ,declaration of a significant incident 7a7 ,in general ,title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 ,c ,declaration of a significant incident #bbca4 ,definitions ,for the purposes of this subtitle3 7#a7 ,asset response activity ,the term asset response activity means an activity to support an entity impacted by an incident with the response to1 remediation of1 or recovery from1 the incident1 including-- 7,a7 furnishing technical and advisory assistance to the entity to protect the assets of the entity1 mitigate vulnerabilities1 and reduce the related impacts2 7,b7 assessing potential risks to the critical infrastructure sector or geographic region impacted by the incident1 including potential cascading effects of the incident on other critical infrastructure sectors or geographic regions2 7,c7 developing courses of action to mitigate the risks assessed under subparagraph 7,b72 7,d7 facilitating information sharing and operational coordination with entities performing threat response activities2 and 7,e7 providing guidance on how best to use ,federal resources and capabilities in a timely1 effective manner to speed recovery from the incident4 7#b7 ,declaration ,the term declaration means a declaration of the ,secretary under section #bbcb7;a77#a74 7#c7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,federal agency ,the term ,federal agency has the meaning given the term agency in section #cejb of title #dd1 ,united ,states ,code4 7#e7 ,fund ,the term ,fund means the ,cyber ,response and ,recovery ,fund established under section #bbcc7;a74 7#f7 ,incident ,the term incident has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 7#g7 ,renewal ,the term renewal means a renewal of a declaration under section #bbcb7;d74 7#h7 ,significant incident ,the term significant incident-- 7,a7 means an incident or a group of related incidents that results1 or is likely to result1 in demonstrable harm to-- 7i7 the national security interests1 foreign relations1 or economy of the ,united ,states2 or 7ii7 the public confidence1 civil liberties1 or public health and safety of the people of the ,united ,states2 and 7,b7 does not include an incident or a portion of a group of related incidents that occurs on-- 7i7 a national security system 7as defined in section #ceeb of title #dd1 ,united ,states ,code72 or 7ii7 an information system described in paragraph 7#b7 or 7#c7 of section #ceec7;e7 of title #dd1 ,united ,states ,code4 #bbcb4 ,declaration 7a7 ,in general 7#a7 ,declaration ,the ,secretary1 in consultation with the ,national ,cyber ,director1 may make a declaration of a significant incident in accordance with this section if the ,secretary determines that-- 7,a7 a specific significant incident-- 7i7 has occurred2 or 7ii7 is likely to occur imminently2 and 7,b7 otherwise available resources1 other than the ,fund1 are likely insufficient to respond effectively to1 or to mitigate effectively1 the specific significant incident described in subparagraph 7,a74 7#b7 ,prohibition on delegation ,the ,secretary may not delegate the authority provided to the ,secretary under paragraph 7#a74 7b7 ,asset response activities ,upon a declaration1 the ,director shall coordinate-- 7#a7 the asset response activities of each ,federal agency in response to the specific significant incident associated with the declaration2 and 7#b7 with appropriate entities1 which may include-- 7,a7 public and private entities and ,state and local governments with respect to the asset response activities of those entities and governments2 and 7,b7 ,federal1 ,state1 local1 and ,tribal law enforcement agencies with respect to investigations and threat response activities of those law enforcement agencies4 7c7 ,duration ,subject to subsection 7d71 a declaration shall terminate upon the earlier of-- 7#a7 a determination by the ,secretary that the declaration is no longer necessary2 or 7#b7 the expiration of the #abj-;day period beginning on the date on which the ,secretary makes the declaration4 7d7 ,renewal ,the ,secretary1 without delegation1 may renew a declaration as necessary4 7e7 ,publication ,not later than #gb hours after a declaration or a renewal1 the ,secretary shall publish the declaration or renewal in the ,federal ,register4 7f7 ,advance actions ,the ,secretary-- 7#a7 shall assess the resources available to respond to a potential declaration2 and 7#b7 may take actions before and while a declaration is in effect to arrange or procure additional resources for asset response activities or technical assistance the ,secretary determines necessary1 which may include entering into standby contracts with private entities for cybersecurity services or incident responders in the event of a declaration4 #bbcc4 ,cyber response and recovery fund 7a7 ,in general ,there is established a ,cyber ,response and ,recovery ,fund1 which shall be available for-- 7#a7 the coordination of activities described in section #bbcb7;b72 7#b7 response and recovery support for the specific significant incident associated with a declaration to ,federal1 ,state1 local1 and ,tribal1 entities and public and private entities on a reimbursable or non-reimbursable basis1 including through asset response activities and technical assistance1 such as-- 7,a7 vulnerability assessments and mitigation2 7,b7 technical incident mitigation2 7,c7 malware analysis2 7,d7 analytic support2 7,e7 threat detection and hunting2 and 7,f7 network protections2 7#c7 as the ,director determines appropriate1 grants for1 or cooperative agreements with1 ,federal1 ,state1 local1 and ,tribal public and private entities to respond to1 and recover from1 the specific significant incident associated with a declaration1 such as-- 7,a7 hardware or software to replace1 update1 improve1 harden1 or enhance the functionality of existing hardware1 software1 or systems2 and 7,b7 technical contract personnel support2 and 7#d7 advance actions taken by the ,secretary under section #bbcb7;f77#b74 7b7 ,deposits ,money shall be deposited into the ,fund from-- 7#a7 appropriations to the ,fund for activities of the ,fund2 7#b7 reimbursement from ,federal agencies for the activities described in paragraphs 7#a71 7#b71 and 7#d7 of subsection 7a72 and 7#c7 any other income incident to activities of the ,fund4 7c7 ,supplement not supplant ,amounts in the ,fund shall be used to supplement1 not supplant1 other ,federal1 ,state1 local1 or ,tribal funding for activities in response to a declaration4 #bbcd4 ,notification and reporting 7a7 ,notification ,upon a declaration or renewal1 the ,secretary shall immediately notify the ,national ,cyber ,director and appropriate congressional committees and include in the notification-- 7#a7 an estimation of the planned duration of the declaration2 7#b7 with respect to a notification of a declaration1 the reason for the declaration1 including information relating to the specific significant incident or imminent specific significant incident1 including-- 7,a7 the operational or mission impact or anticipated impact of the specific significant incident on ,federal and non-,federal entities2 7,b7 if known1 the perpetrator of the specific significant incident2 and 7,c7 the scope of the ,federal and non-,federal entities impacted or anticipated to be impacted by the specific significant incident2 7#c7 with respect to a notification of a renewal1 the reason for the renewal2 7#d7 justification as to why available resources1 other than the ,fund1 are insufficient to respond to or mitigate the specific significant incident2 and 7#e7 a description of the coordination activities described in section #bbcb7;b7 that the ,secretary anticipates the ,director to perform4 7b7 ,report to ,congress ,not later than #ahj days after the date of a declaration or renewal1 the ,secretary shall submit to the appropriate congressional committees a report that includes-- 7#a7 the reason for the declaration or renewal1 including information and intelligence relating to the specific significant incident that led to the declaration or renewal2 7#b7 the use of any funds from the ,fund for the purpose of responding to the incidents or threat described in paragraph 7#a72 7#c7 a description of the actions1 initiatives1 and projects undertaken by the ,department and ,state and local governments and public and private entities in responding to and recovering from the specific significant incident described in paragraph 7#a72 7#d7 an accounting of the specific obligations and outlays of the ,fund2 and 7#e7 an analysis of-- 7,a7 the impact of the specific significant incident described in paragraph 7#a7 on ,federal and non-,federal entities2 7,b7 the impact of the declaration or renewal on the response to1 and recovery from1 the specific significant incident described in paragraph 7#a72 and 7,c7 the impact of the funds made available from the ,fund as a result of the declaration or renewal on the recovery from1 and response to1 the specific significant incident described in paragraph 7#a74 7c7 ,classification ,each notification made under subsection 7a7 and each report submitted under subsection 7b7-- 7#a7 shall be in an unclassified form2 and 7#b7 may include a classified annex4 7d7 ,consolidated report ,the ,secretary shall not be required to submit multiple reports under subsection 7b7 for multiple declarations or renewals if the ,secretary determines that the declarations or renewals substantively relate to the same specific significant incident4 7e7 ,exemption ,the requirements of subchapter ,i of chapter #ce of title #dd 7commonly known as the ,paperwork ,reduction ,act7 shall not apply to the voluntary collection of information by the ,department during an investigation of1 a response to1 or an immediate post-response review of1 the specific significant incident leading to a declaration or renewal4 #bbce4 ,rule of construction ,nothing in this subtitle shall be construed to impair or limit the ability of the ,director to carry out the authorized activities of the ,cybersecurity and ,infrastructure ,security ,agency4 #bbcf4 ,authorization of appropriations ,there are authorized to be appropriated to the ,fund #bj1jjj1jjj for fiscal year #bjbb1 which shall remain available to be expended until ,september #cj1 #bjbh4 #bbcg4 ,sunset ,the authorities granted to the ,secretary or the ,director under this subtitle shall expire on the date that is #g years after the date of enactment of the ,cyber ,response and ,recovery ,act of #bjba4 4 7b7 ,clerical amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended by adding at the end the following3 ,subtitle ,c--,declaration of a significant incident ,sec4 #bbca4 ,definitions4 ,sec4 #bbcb4 ,declaration4 ,sec4 #bbcc4 ,cyber response and recovery fund4 ,sec4 #bbcd4 ,notification and reporting4 ,sec4 #bbce4 ,rule of construction4 ,sec4 #bbcf4 ,authorization of appropriations4 ,sec4 #bbcg4 ,sunset4 4