,,ii #aagth ,,congress #ast ,session ,s4 #bdjg ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ba1 #bjba ,mr4 ,warner 7for himself1 ,mr4 ,rubio1 ,ms4 ,collins1 ,mr4 ,heinrich1 ,mr4 ,tester1 ,mr4 ,king1 ,mr4 ,burr1 ,mr4 ,blunt1 ,mr4 ,bennet1 ,mr4 ,casey1 ,mr4 ,sasse1 ,mrs4 ,gillibrand1 ,mrs4 ,feinstein1 ,mr4 ,risch1 and ,mr4 ,manchin7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to ensure timely ,federal ,government awareness of cyber intrusions that pose a threat to national security1 enable the development of a common operating picture of national-level cyber threats1 and to make appropriate1 actionable cyber threat information available to the relevant government and private sector entities1 as well as the public1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,incident ,notification ,act of #bjba4 #b4 ,cybersecurity ,intrusion ,reporting ,capabilities 7a7 ,in general ,title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 ,c ,cybersecurity ,intrusion ,reporting ,capabilities #bbca4 ,definitions ,in this subtitle3 7#a7 ,definitions from section #bbja ,the definitions in section #bbja shall apply to this subtitle1 except as otherwise provided4 7#b7 ,agency ,the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency4 7#c7 ,appropriate congressional committees ,in this section1 the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,select ,committee on ,intelligence of the ,senate2 7,c7 the ,committee on the ,judiciary of the ,senate2 7,d7 the ,committee on ,armed ,services of the ,senate2 7,e7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,f7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives2 7,g7 the ,committee on the ,judiciary of the ,house of ,representatives2 and 7,h7 the ,committee on ,armed ,services of the ,house of ,representatives4 7#d7 ,covered entity ,the term covered entity has the meaning given the term under the rules required to be promulgated under section #bbcc7;d74 7#e7 ,critical infrastructure ,the term critical infrastructure has the meaning given the term in section #ajaf7;e7 of the ,critical ,infrastructure ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#f7 ,cyber ,intrusion ,reporting ,capabilities ,the term ,cyber ,intrusion ,reporting ,capabilities means the cybersecurity intrusion reporting capabilities established under section #bbcb4 7#g7 ,cybersecurity notification ,the term cybersecurity notification means a notification of a cybersecurity intrusion1 as defined in accordance with section #bbcc4 7#h7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#i7 ,federal agency ,the term ,federal agency has the meaning given the term agency in section #cejb of title #dd1 ,united ,states ,code4 7#aj7 ,federal contractor ,the term ,federal contractor-- 7,a7 means a contractor or subcontractor 7at any tier7 of the ,united ,states ,government2 and 7,b7 does not include a contractor or subcontractor that holds only-- 7i7 service contracts to provide housekeeping or custodial services2 or 7ii7 contracts to provide products or services unrelated to information technology below the micro-purchase threshold 7as defined in section #b4aja of title #dh1 ,code of ,federal ,regulations1 or any successor thereto74 7#aa7 ,information technology ,the term information technology has the meaning given the term in section #aaaja of title #dj1 ,united ,states ,code4 7#ab7 ,ransomware ,the term ransomware means any type of malicious software that prevents the legitimate owner or operator of an information system or network from accessing computer files1 systems1 or networks and demands the payment of a ransom for the return of such access4 #bbcb4 ,establishment of cybersecurity intrusion reporting capabilities 7a7 ,designation ,the ,agency shall be the designated agency within the ,federal ,government to receive cybersecurity notifications from other ,federal agencies and covered entities in accordance with this subtitle4 7b7 ,establishment ,not later than #bdj days after the date of enactment of this subtitle1 the ,director shall establish ,cyber ,intrusion ,reporting ,capabilities to facilitate the submission of timely1 secure1 and confidential cybersecurity notifications from ,federal agencies and covered entities to the ,agency4 7c7 ,re-,evaluation of security ,the ,director shall re-evaluate the security of the ,cyber ,intrusion ,reporting ,capabilities not less frequently than once every #b years4 7d7 ,requirements ,the ,cyber ,intrusion ,reporting ,capabilities shall allow the ,agency-- 7#a7 to accept classified submissions and notifications2 and 7#b7 to accept a cybersecurity notification from any entity1 regardless of whether the entity is a covered entity4 7e7 ,limitations on use of information ,any cybersecurity notification submitted to the ,agency through the ,cyber ,intrusion ,reporting ,capabilities established under this section-- 7#a7 shall be exempt from disclosure under section #eeb of title #e1 ,united ,states ,code 7commonly referred to as the 8,freedom of ,information ,act071 in accordance with subsection 7b77#c77;,b7 of such section #eeb1 and any ,state1 ,tribal1 or local provision of law requiring disclosure of information or records2 and 7#b7 may not be-- 7,a7 admitted as evidence in any civil or criminal action brought against the victim of the cybersecurity incident1 except for actions brought by the ,federal ,government under section #bbcc7;h72 or 7,b7 subject to a subpoena1 unless the subpoena is issued by ,congress and necessary for congressional oversight purposes4 7f7 ,privacy ,the ,agency shall adopt privacy and data protection procedures1 based on the comparable privacy and data protection procedures developed for information received and shared pursuant to the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq471 for information submitted to the ,agency through the ,cyber ,intrusion ,reporting ,capabilities established under subsection 7b7 that is known at the time of sharing to contain personal information of a specific individual or information that identifies a specific individual that is not directly related to a cybersecurity threat4 7g7 ,annual reports 7#a7 ,director reporting requirement ,not later than #a year after the date on which the ,cyber ,intrusion ,reporting ,capabilities are established and once each year thereafter1 the ,director shall submit to the appropriate congressional committees a report1 in classified form if necessary1 on the number of notifications received through the ,cyber ,intrusion ,reporting ,capabilities1 and a description of the associated mitigations taken1 during the #a-year period preceding the report4 7#b7 ,secretary reporting requirement ,not later than #a year after the date on which the ,cyber ,intrusion ,reporting ,capabilities are established1 and once each year thereafter1 the ,secretary shall submit to the appropriate congressional committees a report on-- 7,a7 the categories of covered entities1 noting additions or removals of categories1 that are required to submit cybersecurity notifications2 and 7,b7 the types of cybersecurity intrusions and other information required to be submitted as a cybersecurity notification1 noting any changes from the previous submission4 7#c7 ,form ,the annual reports required under this subsection may be submitted as a single report for each year1 at the discretion of the ,secretary4 #bbcc4 ,required notifications 7a7 ,notifications 7#a7 ,in general ,except as provided in paragraph 7#b71 not later than #bd hours after the confirmation of a cybersecurity intrusion or potential cybersecurity intrusion1 the ,federal agency or covered entity that discovered the cybersecurity intrusion or potential cybersecurity intrusion shall submit a cybersecurity notification to the ,agency through the ,cyber ,intrusion ,reporting ,capabilities4 7#b7 ,exception ,if a ,federal agency or covered entity required to submit a cybersecurity notification under paragraph 7#a7 is subject to another ,federal law1 regulation1 policy1 or government contract requiring notification of a cybersecurity intrusion or potential cybersecurity intrusion to a ,federal agency within less than #bd hours1 the notification deadline required in the applicable law1 regulation1 or policy shall also apply to the notification required under this section4 7b7 ,required updates ,a ,federal agency or covered entity that submits a cybersecurity notification under subsection 7a7 shall1 until the date on which the cybersecurity incident is mitigated or any follow-up investigation is completed1 submit updated cybersecurity threat information to the ,agency through the ,cyber ,intrusion ,reporting ,capabilities not later than #gb hours after the discovery of new information4 7c7 ,required contents ,the notification and required updates submitted under subsections 7a7 and 7b7 shall include1 at minimum1 any information required to be included pursuant to the rules promulgated under subsection 7d74 7d7 ,required rulemaking 7#a7 ,in general ,notwithstanding any provisions set out in this title that may limit or restrict the promulgation of rules1 and not later than #bgj days after the date of enactment of this subtitle1 the ,secretary1 acting through the ,director1 in coordination with the ,director of ,national ,intelligence1 the ,director of the ,office of ,management and ,budget1 the ,secretary of ,defense1 and the ,national ,cyber ,director1 shall promulgate interim final rules1 waiving prior public notice1 and accepting comments after the effective date in order to inform the final rules-- 7,a7 that define covered entity for the purpose of identifying entities subject to the cybersecurity notification requirements of this section and which shall include1 at a minimum1 ,federal contractors1 owners or operators of critical infrastructure1 as determined appropriate by the ,director based on assessment of risks posed by compromise of critical infrastructure operation1 and nongovernmental entities that provide cybersecurity incident response services2 7,b7 that define cybersecurity intrusion and potential cybersecurity intrusion for the purpose of determining when a cybersecurity notification shall be submitted under this section2 7,c7 that define cybersecurity threat information for the purpose of describing the threat information to be included in a cybersecurity notification under this section2 7,d7 that define confirmation of a cybersecurity incident or potential cybersecurity incident for the purpose of determining when a notification obligation is triggered2 7,e7 that address whether a ,federal agency or covered entity shall be required to provide a cybersecurity notification for a cybersecurity intrusion of which the ,federal agency or covered entity is aware1 but does not directly impact the networks or information systems owned or operated by the ,federal agency or covered entity2 and 7,f7 that contain other provisions necessary to implement the requirements of this subtitle4 7#b7 ,requirements for definitions ,at a minimum1 the definitions of cybersecurity intrusion and potential cybersecurity intrusion required to be promulgated under paragraph 7#a77;,b7 shall include a cybersecurity intrusion1 including an intrusion involving ransomware1 that-- 7,a7 involves or is assessed to involve a nation-state2 7,b7 involves or is assessed to involve an advanced persistent threat cyber actor2 7,c7 involves or is assessed to involve a transnational organized crime group 7as defined in section #cf of the ,state ,department ,basic ,authorities ,act of #aief 7#bb ,u4,s4,c4 #bgjh772 7,d7 results1 or has the potential to result1 in demonstrable harm to the national security interests1 foreign relations1 or economy of the ,united ,states or to the public confidence1 civil liberties1 or public health and safety of people in the ,united ,states2 7,e7 is or is likely to be of significant national consequence2 or 7,f7 is identified by covered entities but affects1 or has the potential to affect1 agency systems4 7#c7 ,required information for cybersecurity threat information ,for purposes of the rules required to be promulgated under paragraph 7#a77;,b71 the cybersecurity threat information required to be included in a cybersecurity notification shall include1 at a minimum-- 7,a7 a description of the cybersecurity intrusion1 including identification of the affected systems and networks that were1 or are reasonably believed to have been1 accessed by a cyber actor1 and the estimated dates of when such an intrusion is believed to have occurred2 7,b7 a description of the vulnerabilities leveraged1 and tactics1 techniques1 and procedures used by the cyber actors to conduct the intrusion2 7,c7 any information that could reasonably help identify the cyber actor1 such as internet protocol addresses1 domain name service information1 or samples of malicious software2 and 7,d7 contact information1 such as a telephone number or electronic mail address1 that a ,federal agency may use to contact the covered entity1 either directly or through an authorized agent of the covered entity2 and 7,e7 actions taken to mitigate the intrusion4 7#d7 ,required consultation ,for purposes of the rules required to be promulgated under paragraph 7#a71 the ,secretary1 acting through the ,director1 shall consult with appropriate private sector stakeholders1 as determined by the ,secretary1 in coordination with the ,director of ,national ,intelligence1 the ,director of the ,office of ,management and ,budget1 the ,secretary of ,defense1 and the ,national ,cyber ,director4 7e7 ,required response ,the ,director shall develop and implement a process to respond to a ,federal agency or covered entity that submits a cybersecurity notification under subsection 7a7 not later than #b business days after the date on which the notification is submitted1 which shall notify the entity as to whether the ,director requires further information about the cybersecurity intrusion4 7f7 ,required coordination with ,sector ,risk ,management or other regulatory ,agencies ,the ,secretary of ,homeland ,security1 acting through the ,director1 in coordination with the head of each ,sector ,risk ,management ,agency and other ,federal agencies1 as determined appropriate by the ,director1 shall-- 7#a7 establish a set of reporting criteria for ,sector ,risk ,management ,agencies and other ,federal agencies as identified by the ,director to submit cybersecurity notifications regarding cybersecurity incidents affecting covered entities in their respective sectors or covered entities regulated by such ,federal agencies to the ,agency through the ,cyber ,intrusion ,reporting ,capabilities2 and 7#b7 take steps to harmonize the criteria described in paragraph 7#a7 with the regulatory reporting requirements in effect on the date of enactment of this subtitle4 7g7 ,protection from liability ,no cause of action shall lie or be maintained in any court by any person or entity1 other than the ,federal ,government pursuant to subsection 7h7 or any applicable law1 against any covered entity due to the submission by that person or entity of a cybersecurity notification to the ,agency through the ,cyber ,intrusion ,reporting ,system1 in conformance with this subtitle and the rules promulgated under subsection 7d71 and any such action shall be promptly dismissed4 7h7 ,enforcement 7#a7 ,in general ,if1 on the basis of any information1 the ,director determines that a covered entity has violated1 or is in violation of1 the requirements of this subtitle1 including rules promulgated under this subtitle1 the ,director may assess a civil penalty not to exceed #j4e percent of the entity's gross revenue from the prior year for each day the violation continued or continues4 7#b7 ,determination of amount ,the ,director shall have the authority to reduce or otherwise modify the civil penalties assessed under paragraph 7#a7 and may take into account mitigating or aggravating factors1 including the nature1 circumstances1 extent1 and gravity of the violations and1 with respect to the covered entity1 the covered entity's ability to pay1 degree of culpability1 and history of prior violations4 7#c7 ,procedures ,the ,director shall establish procedures for contesting civil penalties imposed under this section4 7#d7 ,covered entities with federal government contracts ,in addition to the penalties authorized under this subsection1 if a covered entity with a ,federal ,government contract violates the requirements of this subtitle1 including rules promulgated under this subtitle1 the ,administrator of the ,general ,services ,administration may assess additional available penalties1 including removal from the ,federal ,contracting ,schedule4 7#e7 ,federal agencies ,if a ,federal agency violates the requirements of this subtitle1 the violation shall be referred to the ,inspector ,general for the agency1 and shall be treated by the ,inspector ,general for the agency as a matter of urgent concern4 7i7 ,exemption ,all information collection activities under sections #bbcb and #bbcc of this subtitle shall be exempt from the requirements of sections #cejf7;c71 #cejg1 #cejh1 and #ceji of title #dd1 ,united ,states ,code 7commonly known as the ,paperwork ,reduction ,act74 7j7 ,rule of construction ,nothing in this subtitle shall be construed to supersede any reporting requirements under subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code4 #bbcd4 ,preservation of information 7a7 ,in general ,not later than #fj days after the date of enactment of this subtitle1 the ,secretary1 acting through the ,director1 in coordination with the ,director of the ,office of ,management and ,budget1 shall promulgate rules for data preservation standards and requirements for ,federal agencies and covered entities to assist with cybersecurity intrusion response and associated investigatory activities4 7b7 ,minimum requirements ,the rules for data preservation promulgated under subsection 7a7 shall require1 at a minimum1 that a ,federal agency or covered entity that submits a cybersecurity notification under this subtitle shall preserve all of the data designated for preservation under such rules4 #bbce4 ,analysis of cybersecurity notifications 7a7 ,analysis 7#a7 ,in general ,the ,secretary1 acting through the ,director1 the ,attorney ,general1 and the ,director of ,national ,intelligence1 shall jointly develop procedures for ensuring any cybersecurity notification submitted to the ,system is promptly and appropriately analyzed to-- 7,a7 determine the impact of the breach or intrusion on the national economy and national security2 7,b7 identify the potential source or sources of the breach or intrusion2 7,c7 recommend actions to mitigate the impact of the breach or intrusion2 and 7,d7 provide information on methods of securing the system or systems against future breaches or intrusions4 7#b7 ,requirement ,the procedures required to be developed under paragraph 7#a7 shall include criteria for when rapid analysis1 notification1 or public dissemination is required4 7#c7 ,authority ,the ,secretary1 acting through the ,director1 the ,attorney ,general1 and the ,director of ,national ,intelligence may each designate employees within each respective agency who may search intelligence and law enforcement information for cyber threat intelligence information with a national security or public safety purpose1 based on cybersecurity notifications received by the ,agency through the ,cyber ,intrusion ,reporting ,capabilities1 and consistent with the procedures developed under paragraph 7#a74 7b7 ,analytic production 7#a7 ,in general ,not less frequently than once every #cj days1 the ,secretary1 acting through the ,director1 the ,attorney ,general1 and the ,director of ,national ,intelligence shall produce a joint cyber threat intelligence report that characterizes the current cyber threat picture facing ,federal agencies and covered entities4 7#b7 ,requirements ,each report required to be produced under paragraph 7#a7-- 7,a7 shall be in a form which may be made publicly available2 7,b7 may include a classified annex1 as necessary2 and 7,c7 shall1 to the maximum extent practical1 anonymize attribution information from cybersecurity notifications received through the ,cyber ,intrusion ,reporting ,capabilities4 7#c7 ,authority to declassify ,the ,director of ,national ,intelligence may declassify any analytic products1 or portions thereof1 produced under this section if such declassification is required to mitigate cyber threats facing the ,united ,states4 4 7b7 ,table of contents ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended by adding at the end the following3 ,subtitle ,c--,cybersecurity ,intrusion ,reporting ,capabilities ,sec4 #bbca4 ,definitions4 ,sec4 #bbcb4 ,establishment of cybersecurity intrusion reporting capabilities4 ,sec4 #bbcc4 ,required notifications4 ,sec4 #bbcd4 ,preservation of information4 ,sec4 #bbce4 ,analysis of cybersecurity notifications4 4 7c7 ,technical and conforming amendments ,section #bbjb7;c7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #feb7;c77 is amended-- 7#a7 by redesignating the second and third paragraphs 7#ab7 as paragraphs 7#ad7 and 7#ae71 respectively2 and 7#b7 by inserting before paragraph 7#ad71 as so redesignated1 the following3 7#ac7 carry out the responsibilities described in subtitle ,c relating to the cybersecurity intrusion reporting capabilities2 4