,,ii #aagth ,,congress #ast ,session ,s4 #bdia ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #bg1 #bjba ,mr4 ,king 7for himself1 ,mr4 ,rounds1 and ,mr4 ,sasse7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to establish the ,national ,cyber ,resilience ,assistance ,fund1 to improve the ability of the ,federal ,government to assist in enhancing critical infrastructure cyber resilience1 to improve security in the national cyber ecosystem1 to address ,systemically ,important ,critical ,infrastructure1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,defense of ,united ,states ,infrastructure ,act of #bjba4 7b7 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,,title ,i--,investing in cyber resiliency in critical infrastructure ,sec4 #aja4 ,establishment of the ,national ,cyber ,resilience ,assistance ,fund4 ,,title ,,ii--,improving the ability of the ,federal ,government to assist in enhancing critical infrastructure cyber resilience ,sec4 #bja4 ,institute a #e-year term for the cybersecurity and infrastructure security director4 ,sec4 #bjb4 ,create a joint collaborative environment4 ,sec4 #bjc4 ,designate three critical technology security centers4 ,,title ,,iii--,improving security in the national cyber ecosystem ,sec4 #cja4 ,establish a ,national ,cybersecurity ,certification and ,labeling ,authority4 ,sec4 #cjb4 ,establish the ,bureau of ,cybersecurity ,statistics4 ,sec4 #cjc4 ,secure foundational internet protocols4 ,,title ,,iv--,systemically ,important ,critical ,infrastructure ,sec4 #dja4 ,definitions4 ,sec4 #djb4 ,systemically ,important ,critical ,infrastructure4 ,sec4 #djc4 ,plan for enhancement of ,systemically ,important ,critical ,infrastructure methodology and capability4 ,,title ,v--,enabling the ,national ,cyber ,director ,sec4 #eja4 ,establishment of hiring authorities for the ,office of the ,national ,cyber ,director4 ,i ,investing in cyber resiliency in critical infrastructure #aja4 ,establishment of the ,national ,cyber ,resilience ,assistance ,fund 7a7 ,sense of congress ,it is the sense of ,congress that-- 7#a7 the ,united ,states now operates in a cyber landscape that requires a level of data security1 resilience1 and trustworthiness that neither the ,united ,states ,government nor the private sector alone is currently equipped to provide2 7#b7 the ,united ,states must deny benefits to adversaries who have long exploited cyberspace to their advantage1 to the disadvantage of the ,united ,states1 and at little cost to themselves2 7#c7 this new approach requires securing critical networks in collaboration with the private sector to promote national resilience and increase the security of the cyber ecosystem2 7#d7 reducing the vulnerabilities adversaries can target denies them opportunities to attack the interests of the ,united ,states through cyberspace2 7#e7 the public and private sectors struggle to coordinate cyber defenses1 leaving gaps that decrease national resilience and create systemic risk2 7#f7 new technology continues to emerge that further compounds these challenges2 7#g7 while the ,homeland ,security ,grant ,program and resourcing for national preparedness under the ,federal ,emergency ,management ,agency are well-established1 the ,united ,states ,government has no equivalent for cybersecurity preparation or prevention2 7#h7 the lack of a consistent1 resourced fund for investing in resilience in key areas inhibits the ,united ,states ,government from conveying its understanding of risk into strategy1 planning1 and action in furtherance of core objectives for the security and resilience of critical infrastructure2 7#i7 ,congress has worked diligently to establish the ,cybersecurity and ,infrastructure ,security ,agency1 creating a new agency that can leverage broad authorities to receive and share information1 provide technical assistance to operators1 and partner with stakeholders across the executive branch1 ,state and local communities1 and the private sector2 7#aj7 the ,cybersecurity and ,infrastructure ,security ,agency requires strengthening in its mission to ensure the national resilience of critical infrastructure1 promote a more secure cyber ecosystem1 and serve as the central coordinating element to support and integrate ,federal1 ,state1 local1 and private-sector cybersecurity efforts2 and 7#aa7 the ,cybersecurity and ,infrastructure ,security ,agency requires further resource investment and clear authorities to realize its full potential4 7b7 ,amendments ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7#a7 in section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7,a7 in paragraph 7#aa71 by striking and at the end2 7,b7 in the first paragraph designated as paragraph 7#ab71 relating to the ,cybersecurity ,state ,coordinator-- 7i7 by striking section #bbae and inserting section #bbag2 and 7ii7 by striking and at the end2 and 7,c7 by redesignating the second and third paragraphs designated as paragraph 7#ab7 as paragraphs 7#ac7 and 7#ad71 respectively2 7#b7 by redesignating section #bbag 7#f ,u4,s4,c4 #ffe;f7 as section #bbbj2 7#c7 by redesignating section #bbaf 7#f ,u4,s4,c4 #ffe;e7 as section #bbai2 7#d7 by redesignating the fourth section #bbae 7relating to ,sector ,risk ,management ,agencies7 7#f ,u4,s4,c4 #ffe;d7 as section #bbah2 7#e7 by redesignating the third section #bbae 7relating to the ,cybersecurity ,state ,coordinator7 7#f ,u4,s4,c4 #ffe;c7 as section #bbag2 7#f7 by redesignating the second section #bbae 7relating to the ,joint ,cyber ,planning ,office7 7#f ,u4,s4,c4 #ffe;b7 as section #bbaf2 and 7#g7 by adding at the end the following3 #bbbj;,a4 ,national ,cyber ,resilience ,assistance ,fund 7a7 ,definitions ,in this section3 7#a7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given that term in section #bbji4 7#b7 ,eligible entity ,the term eligible entity means an entity that meets the guidelines and requirements for eligible entities established by the ,secretary under subsection 7d77#d74 7#c7 ,fund ,the term ,fund means the ,national ,cyber ,resilience ,assistance ,fund established under subsection 7c74 7#d7 ,national critical functions ,the term national critical functions means the functions of government and the private sector so vital to the ,united ,states that their disruption1 corruption1 or dysfunction would have a debilitating effect on security1 national economic security1 national public health or safety1 or any combination thereof4 7b7 ,creation of a critical infrastructure resilience strategy and a national risk management cycle 7#a7 ,initial risk identification and assessment 7,a7 ,in general ,the ,secretary1 acting through the ,director1 shall establish a process by which to identify1 assess1 and prioritize risks to critical infrastructure1 considering both cyber and physical threats1 vulnerabilities1 and consequences4 7,b7 ,consultation ,in establishing the process required under subparagraph 7,a71 the ,secretary shall consult with ,sector ,risk ,management ,agencies1 critical infrastructure owners and operators1 and the ,national ,cyber ,director4 7,c7 ,publication ,not later than #ahj days after the date of enactment of this section1 the ,secretary shall publish in the ,federal ,register procedures for the process established under subparagraph 7,a74 7,d7 ,report ,not later than #a year after the date of enactment of this section1 the ,secretary shall submit to the ,president1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the risks identified by the process established under subparagraph 7,a74 7#b7 ,initial national critical infrastructure resilience strategy 7,a7 ,in general ,not later than #a year after the date on which the ,secretary delivers the report required under paragraph 7#a77;,d71 the ,president shall deliver to majority and minority leaders of the ,senate1 the ,speaker and minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committee on ,homeland ,security of the ,house of ,representatives a national critical infrastructure resilience strategy designed to address the risks identified by the ,secretary4 7,b7 ,elements ,in the strategy delivered under subparagraph 7,a71 the ,president shall-- 7i7 identify1 assess1 and prioritize areas of risk to critical infrastructure that would compromise1 disrupt1 or impede the ability of the critical infrastructure to support the national critical functions of national security1 economic security1 or public health and safety2 7ii7 identify and outline current and proposed national-level actions1 programs1 and efforts to be taken to address the risks identified2 7iii7 identify the ,federal departments or agencies responsible for leading each national-level action1 program1 or effort and the relevant critical infrastructure sectors for each2 7iv7 outline the budget plan required to provide sufficient resources to successfully execute the full range of activities proposed or described by the strategy2 and 7v7 request any additional authorities or resources necessary to successfully execute the strategy4 7,c7 ,form ,the strategy delivered under subparagraph 7,a7 shall be unclassified1 but may contain a classified annex4 7#c7 ,congressional briefing ,not later than #a year after the date on which the ,president delivers the strategy under subparagraph 7,a71 and every year thereafter1 the ,secretary1 in coordination with ,sector ,risk ,management ,agencies1 shall brief the appropriate congressional committees on the national risk management cycle activities undertaken pursuant to the strategy4 7#d7 ,five year risk management cycle 7,a7 ,risk identification and assessment ,under procedures established by the ,secretary1 the ,secretary shall repeat the conducting and reporting of the risk identification and assessment required under paragraph 7#a71 in accordance with the requirements in paragraph 7#a71 every #e years4 7,b7 ,strategy ,under procedures established by the ,president1 the ,president shall repeat the preparation and delivery of the critical infrastructure resilience strategy required under paragraph 7#b71 in accordance with the requirements in paragraph 7#b71 every #e years1 which shall also include assessing the implementation of the previous national critical infrastructure resilience strategy4 7c7 ,establishment of the ,national ,cyber ,resilience ,assistance ,fund ,there is established in the ,treasury of the ,united ,states a fund1 to be known as the ,national ,cyber ,resilience ,assistance ,fund1 which shall be available for the cost of risk-based grant programs focused on systematically increasing the resilience of public and private critical infrastructure against cybersecurity risk1 thereby increasing the overall resilience of the ,united ,states4 7d7 ,administration of grants from the ,national ,cyber ,resilience ,assistance ,fund 7#a7 ,in general ,in accordance with this section1 the ,secretary1 acting through the ,administrator of the ,federal ,emergency ,management ,agency and the ,director1 shall develop and administer processes to-- 7,a7 establish focused grant programs to address identified areas of cybersecurity risk to1 and bolster the resilience of1 critical infrastructure2 7,b7 accept and evaluate applications for each such grant program2 7,c7 award grants under each such grant program2 and 7,d7 disburse amounts from the ,fund4 7#b7 ,establishment of risk-focused grant programs 7,a7 ,establishment 7i7 ,in general ,the ,secretary1 acting through the ,director and the ,administrator of the ,federal ,emergency ,management ,agency1 may establish not less than #a grant program focused on mitigating an identified category of cybersecurity risk identified under the national risk management cycle and critical infrastructure resilience strategy under subsection 7b7 in order to bolster the resilience of critical infrastructure within the ,united ,states4 7ii7 ,selection of focus area ,before selecting a focus area for a grant program pursuant to this subparagraph1 the ,director shall ensure-- 7,i7 there is a clearly defined cybersecurity risk identified through the national risk management cycle and critical infrastructure resilience strategy under subsection 7b7 to be mitigated2 7,,ii7 market forces do not provide sufficient private-sector incentives to mitigate the risk without ,government investment2 and 7,,iii7 there is clear ,federal need1 role1 and responsibility to mitigate the risk in order to bolster the resilience of critical infrastructure4 7,b7 ,funding 7i7 ,recommendation ,beginning in the first fiscal year following the establishment of the ,fund and each fiscal year thereafter1 the ,director shall-- 7,i7 assess the funds available in the ,fund for the fiscal year2 and 7,,ii7 recommend to the ,secretary the total amount to be made available from the ,fund under each grant program established under this subsection4 7ii7 ,allocation ,after considering the recommendations made by the ,director under clause 7i7 for a fiscal year1 the ,director shall allocate amounts from the ,fund to each active grant program established under this subsection for the fiscal year4 7#c7 ,use of funds ,amounts in the ,fund shall be used to mitigate risks identified through the national risk management cycle and critical infrastructure resilience strategy under subsection 7b74 7#d7 ,eligible entities 7,a7 ,guidelines and requirements 7i7 ,in general ,in accordance with clause 7ii71 the ,secretary shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,appropriations of the ,house of ,representatives a set of guidelines and requirements for determining the entities that are eligible entities4 7ii7 ,deadlines ,the ,secretary shall submit the guidelines and requirements under clause 7i7-- 7,i7 not later than #ahj days after the date of enactment of this section1 and every #b years thereafter2 and 7,,ii7 not later than #cj days before the date on which the ,secretary implements the guidelines and requirements4 7,b7 ,considerations ,in developing guidelines and requirements for eligible entities under subparagraph 7,a71 the ,secretary shall consider-- 7i7 number of employees2 7ii7 annual revenue2 7iii7 existing entity cybersecurity spending2 7iv7 current cyber risk assessments1 including credible threats1 vulnerabilities1 and consequences2 and 7v7 entity capacity to invest in mitigating cybersecurity risk absent assistance from the ,federal ,government4 7#e7 ,limitation ,for any fiscal year1 an eligible entity may not receive more than #a grant from each grant program established under this subsection4 7#f7 ,grant processes ,the ,secretary1 acting through the ,administrator of the ,federal ,emergency ,management ,agency1 shall require the submission of such information as the ,secretary determines is necessary to-- 7,a7 evaluate a grant application against the criteria established under this section2 7,b7 disburse grant funds2 7,c7 provide oversight of disbursed grant funds2 and 7,d7 evaluate the effectiveness of the funded project in increasing the overall resilience of the ,united ,states with respect to cybersecurity risks4 7#g7 ,grant criteria ,for each grant program established under this subsection1 the ,director1 in coordination with the ,administrator of the ,federal ,emergency ,management ,agency1 shall develop and publish criteria for evaluating applications for funding1 which shall include-- 7,a7 whether the application identifies a clearly defined cybersecurity risk2 7,b7 whether the cybersecurity risk identified in the grant application poses a substantial threat to critical infrastructure2 7,c7 whether the application identifies a program or project clearly designed to mitigate a cybersecurity risk2 7,d7 the potential consequences of leaving the identified cybersecurity risk unmitigated1 including the potential impact to the critical functions and overall resilience of the nation2 and 7,e7 other appropriate factors identified by the ,director4 7#h7 ,evaluation of grants applications 7,a7 ,in general ,utilizing the criteria established under paragraph 7#g71 the ,director1 in coordination with the ,administrator of the ,federal ,emergency ,management ,agency1 shall evaluate grant applications made under each grant program established under this subsection4 7,b7 ,recommendation ,following the evaluations required under subparagraph 7,a71 the ,director shall recommend to the ,secretary applications for approval1 including the amount of funding recommended for each such approval4 7#i7 ,award of grant funding ,the ,secretary shall-- 7,a7 review the recommendations of the ,director prepared pursuant to paragraph 7#h72 and 7,b7 provide a final determination of grant awards to the ,administrator of the ,federal ,emergency ,management ,agency to be disbursed and administered under the process established under paragraph 7#f74 7e7 ,evaluation of grant programs utilizing the ,national ,cyber ,resilience ,assistance ,fund 7#a7 ,evaluation ,the ,secretary shall establish a process to evaluate the effectiveness and efficiency of grants distributed under this section and develop appropriate updates1 as needed1 to the grant programs4 7#b7 ,annual report ,not later than #ahj days after the conclusion of the first fiscal year in which grants are awarded under this section1 and every fiscal year thereafter1 the ,secretary shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,appropriations of the ,house of ,representatives a report detailing the grants awarded from the ,fund1 the status of projects undertaken with the grant funds1 any planned changes to the disbursement methodology of the ,fund1 measurements of success1 and total outlays from the ,fund4 7#c7 ,grant program review 7,a7 ,annual assessment ,before the start of the second fiscal year in which grants are awarded under this section1 and every fiscal year thereafter1 the ,director shall assess the grant programs established under this section and determine-- 7i7 for the coming fiscal year-- 7,i7 whether new grant programs with additional focus areas should be created2 7,,ii7 whether any existing grant program should be discontinued2 and 7,,iii7 whether the scope of any existing grant program should be modified2 and 7ii7 the success of the grant programs in the prior fiscal year4 7,b7 ,submission to ,congress ,not later than #ij days before the start of the second fiscal year in which grants are awarded under this section1 and every fiscal year thereafter1 the ,secretary shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,appropriations of the ,house of ,representatives the assessment conducted pursuant to subparagraph 7,a7 and any planned alterations to the grant program for the coming fiscal year4 7f7 ,limitation on use of grant funds ,funds awarded pursuant to this section-- 7#a7 shall supplement and not supplant ,state or local funds or1 as applicable1 funds supplied by the ,bureau of ,indian ,affairs2 and 7#b7 may not be used-- 7,a7 to provide any ,federal cost-sharing contribution on behalf of a ,state or local government2 7,b7 to pay a ransom2 7,c7 by or for a non-,united ,states entity2 or 7,d7 for any recreational or social purpose4 7g7 ,authorization of appropriations ,there are authorized to be appropriated to carry out this section #ge1jjj1jjj for each of fiscal years #bjbb through #bjbf4 7h7 ,transfers authorized ,during a fiscal year1 the ,secretary or the head of any component of the ,department that administers the ,state and ,local ,cybersecurity ,grant ,program may transfer not more than #e percent of the amounts appropriated pursuant to subsection 7g7 or other amounts appropriated to carry out the ,national ,cyber ,resilience ,assistance ,fund for that fiscal year to an account of the ,department for salaries1 expenses1 and other administrative costs incurred for the management1 administration1 or evaluation of this section4 4 7c7 ,technical and conforming amendments 7#a7 ,table of contents ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended by striking the item relating to section #bbad and all that follows through the item relating to section #bbag and inserting the following3 ,sec4 #bbad4 ,national ,asset ,database4 ,sec4 #bbae4 ,duties and authorities relating to 4gov internet domain4 ,sec4 #bbaf4 ,joint ,cyber ,planning ,office4 ,sec4 #bbag4 ,cybersecurity ,state ,coordinator4 ,sec4 #bbah4 ,sector ,risk ,management ,agencies4 ,sec4 #bbai4 ,cybersecurity ,advisory ,committee4 ,sec4 #bbbj4 ,cybersecurity education and training programs4 ,sec4 #bbbj;,a4 ,national ,cyber ,resilience ,assistance ,fund4 4 7#b7 ,additional technical amendment 7,a7 ,amendment ,section #ijd7;b77#a7 of the ,,dotgov ,act of #bjbj 7title ,,ix of division ,u of ,public ,law #aaf-bfj7 is amended1 in the matter preceding subparagraph 7,a71 by striking ,homeland ,security ,act and inserting ,homeland ,security ,act of #bjjb4 7,b7 ,effective date ,the amendment made by subparagraph 7,a7 shall take effect as if enacted as part of the ,,dotgov ,act of #bjbj 7title ,,ix of division ,u of ,public ,law #aaf-bfj74 ,,ii ,improving the ability of the ,federal ,government to assist in enhancing critical infrastructure cyber resilience #bja4 ,institute a #e-year term for the cybersecurity and infrastructure security director 7a7 ,in general ,subsection 7b77#a7 of section #bbjb of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #feb71 is amended by inserting ,the ,director shall be appointed for a term of #e years4 after who shall report to the ,secretary44 7b7 ,transition rules ,the amendment made by subsection 7a7 shall take effect on the earlier of-- 7#a7 the first appointment of an individual to the position of ,director of the ,cybersecurity and ,infrastructure ,protection ,agency of the ,department of ,homeland ,security1 by and with the advice and consent of the ,senate1 that is made on or after the date of enactment of this ,act2 or 7#b7 ,january #a1 #bjbb4 #bjb4 ,create a joint collaborative environment 7a7 ,in general ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall establish a joint1 cloud-based1 information sharing environment to-- 7#a7 integrate the ,federal ,government's unclassified and classified cyber threat information1 malware forensics1 and data related to cybersecurity risks 7as defined in section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei77 that is derived from network sensor programs2 7#b7 enable cross-correlation of threat data at the speed and scale necessary for rapid detection and identification2 7#c7 enable query and analysis by appropriate operators across the ,federal ,government2 7#d7 facilitate a whole-of-,government1 comprehensive understanding of the cyber threats to the resilience of the ,federal ,government and national critical infrastructure networks2 7#e7 enable and support the private-public cybersecurity collaboration efforts of the ,federal ,government1 whose successes will be directly dependent on the accuracy1 comprehensiveness1 and timeliness of threat information collected and held by the ,federal ,government2 and 7#f7 enable data curation for artificial intelligence models and provide an environment to enable the ,federal ,government to curate data and build applications4 7b7 ,development 7#a7 ,initial evaluation ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director shall-- 7,a7 identify all ,federal sources of classified and unclassified cyber threat information2 7,b7 evaluate all programs1 applications1 or platforms of the ,federal ,government that are intended to detect1 identify1 analyze1 or monitor cyber threats against the resiliency of the ,federal ,government or critical infrastructure2 and 7,c7 submit a recommendation to the ,president identifying ,federal programs to be designated and required to participate in the ,information ,sharing ,environment1 including-- 7i7 ,government network-monitoring and intrusion detection programs2 7ii7 cyber threat indicator-sharing programs and ,government-sponsored network sensors or network-monitoring programs for the private sector or for ,state1 local1 tribal1 and territorial governments2 7iii7 incident response and cybersecurity technical assistance programs2 and 7iv7 malware forensics and reverse-engineering programs4 7#b7 ,designation of participating programs ,not later than #fj days after completion of the evaluation required under paragraph 7#a71 the ,president shall issue a determination designating the departments1 agencies1 ,federal programs1 and corresponding systems and assets that are required to be a part of the ,information ,sharing ,environment4 7#c7 ,design ,not later than #a year after completion of the evaluation required under paragraph 7#a71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall design the structure of a common platform for sharing and fusing existing ,government information1 insights1 and data related to cyber threats and threat actors1 which1 at a minimum1 shall-- 7,a7 account for appropriate data standards and interoperability requirements2 7,b7 enable integration of existing applications1 platforms1 data1 and information1 to include classified information2 7,c7 ensure access by such ,federal departments and agencies as the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines necessary2 7,d7 account for potential private sector participation and partnerships2 7,e7 enable unclassified data to be integrated with classified data2 7,f7 anticipate the deployment of analytic tools across classification levels to leverage all relevant data sets1 as appropriate2 7,g7 identify tools and analytical software that can be applied and shared to manipulate1 transform1 and display data and other identified needs2 7,h7 anticipate the integration of new technologies and data streams1 including data related to cybersecurity risks derived from ,government-sponsored voluntary network sensors or network-monitoring programs for the private sector or for ,state1 local1 ,tribal1 and territorial governments2 and 7,i7 appropriately account for departments1 agencies1 programs1 and systems and assets determined to be required to participate by the ,president under paragraph 7#b7 in the ,information ,sharing ,environment4 7c7 ,operation ,the ,information ,sharing ,environment shall be managed by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7d7 ,post-,deployment assessment ,not later than #a year after the date on which the ,information ,sharing ,environment is established1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,director shall assess the means by which the ,information ,sharing ,environment may be expanded to include the private sector and critical infrastructure information sharing organizations and1 to the maximum extent practicable1 begin the process of such expansion4 7e7 ,private sector sharing information sharing protections ,to the extent any private entity shares cyber threat indicators and defensive measures through or with the ,information ,sharing ,environment and in a manner that is consistent with all requirements under section #ageb of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj71 the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq471 and any applicable guidelines promulgated under subsection 7f71 such activities shall be considered to be authorized by and in accordance with section #ageb of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba and the ,cybersecurity ,information ,sharing ,act of #bjae4 7f7 ,privacy and civil liberties 7#a7 ,guidelines of attorney general ,not later than #fj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security 7acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency7 and the ,attorney ,general1 shall jointly1 and in coordination with heads of the appropriate ,federal entities and in consultation with officers designated under section #ajfb of the ,national ,security ,intelligence ,reform ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a71 develop1 submit to ,congress1 and make available to the public interim guidelines relating to privacy and civil liberties which shall govern the receipt1 retention1 use1 and dissemination of cyber threat indicators by a ,federal entity obtained in connection with activities authorized in this section4 7#b7 ,final guidelines 7,a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,secretary of ,homeland ,security 7acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency7 and the ,attorney ,general1 shall jointly1 in coordination with heads of the appropriate ,federal entities and in consultation with officers designated under section #ajfb of the ,national ,security ,intelligence ,reform ,act of #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a7 and such private entities with industry expertise as the ,secretary and the ,attorney ,general consider relevant1 promulgate final guidelines relating to privacy and civil liberties which shall govern the receipt1 retention1 use1 and dissemination of cyber threat indicators by a ,federal entity obtained in connection with activities authorized in this section4 7,b7 ,periodic review ,the ,secretary of ,homeland ,security 7acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency7 and the ,attorney ,general1 shall jointly1 in coordination with heads of the appropriate ,federal entities and in consultation with officers and private entities described in subparagraph 7,a71 periodically1 but not less frequently than once every #b years1 review the guidelines promulgated under subparagraph 7,a74 7#c7 ,content ,the guidelines required by paragraphs 7#a7 and 7#b7 shall1 consistent with the need to bolster the resilience of information systems and mitigate cybersecurity threats-- 7,a7 limit the effect on privacy and civil liberties of activities by the ,federal ,government under this section2 7,b7 limit the receipt1 retention1 use1 and dissemination of cyber threat indicators containing personal information or information that identifies specific persons1 including by establishing-- 7i7 a process for the timely destruction of such information that is known not to be directly related to uses authorized under this section2 and 7ii7 specific limitations on the length of any period in which a cyber threat indicator may be retained2 7,c7 include requirements to safeguard cyber threat indicators containing personal information or information that identifies specific persons from unauthorized access or acquisition1 including appropriate sanctions for activities by officers1 employees1 or agents of the ,federal ,government in contravention of such guidelines2 7,d7 include procedures for notifying entities and ,federal entities if information received pursuant to this subsection is known or determined by a ,federal entity receiving such information not to constitute a cyber threat indicator2 7,e7 protect the confidentiality of cyber threat indicators containing personal information or information that identifies specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for purposes authorized under this section2 and 7,f7 include steps that may be needed so that dissemination of cyber threat indicators is consistent with the protection of classified and other sensitive national security information4 7g7 ,oversight of government activities 7#a7 ,biennial report on privacy and civil liberties ,not later than #b years after the date of enactment of this ,act1 and not less frequently than once every year thereafter1 the ,privacy and ,civil ,liberties ,oversight ,board shall submit to ,congress and the ,president a report providing-- 7,a7 an assessment of the effect on privacy and civil liberties by the type of activities carried out under this section2 and 7,b7 an assessment of the sufficiency of the guidelines established pursuant to subsection 7f7 in addressing concerns relating to privacy and civil liberties4 7#b7 ,biennial report by inspectors general 7,a7 ,in general ,not later than #b years after the date of enactment of this ,act1 and not less frequently than once every #b years thereafter1 the ,inspector ,general of the ,department of ,homeland ,security1 the ,inspector ,general of the ,intelligence ,community1 the ,inspector ,general of the ,department of ,justice1 the ,inspector ,general of the ,department of ,defense1 and the ,inspector ,general of the ,department of ,energy shall1 in consultation with the ,council of ,inspectors ,general on ,integrity and ,efficiency1 jointly submit to ,congress a report on the receipt1 use1 and dissemination of cyber threat indicators and defensive measures that have been shared with ,federal entities under this section4 7,b7 ,contents ,each report submitted under subparagraph 7,a7 shall include the following3 7i7 ,a review of the types of cyber threat indicators shared with ,federal entities4 7ii7 ,a review of the actions taken by ,federal entities as a result of the receipt of such cyber threat indicators4 7iii7 ,a list of ,federal entities receiving such cyber threat indicators4 7iv7 ,a review of the sharing of such cyber threat indicators among ,federal entities to identify inappropriate barriers to sharing information4 7#c7 ,recommendations ,each report submitted under this subsection may include such recommendations as the ,privacy and ,civil ,liberties ,oversight ,board1 with respect to a report submitted under paragraph 7#a71 or the ,inspectors ,general referred to in paragraph 7#b77;,a71 with respect to a report submitted under paragraph 7#b71 may have for improvements or modifications to the authorities under this section4 7#d7 ,form ,each report required under this subsection shall be submitted in unclassified form1 but may include a classified annex4 7h7 ,authorization of appropriations ,there are authorized to be appropriated to carry out this section #ajj1jjj1jjj for each of fiscal years #bjbb through #bjbf4 7i7 ,definitions ,in this section3 7#a7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #ajaf7;e7 of the ,critical ,infrastructure ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#b7 ,director ,the term ,director means the ,national ,cyber ,director4 7#c7 ,information sharing environment ,the term ,information ,sharing ,environment means the information sharing environment established under subsection 7a74 #bjc4 ,designate three critical technology security centers 7a7 ,in general ,section #cjg7;b77#c7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ahg7;b77#c771 is amended-- 7#a7 in the matter preceding subparagraph 7,a71 by inserting national laboratories1 before and universities2 7#b7 in subparagraph 7,c71 by striking and at the end2 7#c7 in subparagraph 7,d71 by striking the period at the end and inserting 2 and2 and 7#d7 by adding at the end the following3 7,e7 establish not less than #a1 and not more than #c1 cybersecurity-focused critical technology security centers1 in order to bolster the overall resilience of the networks and critical infrastructure of the ,united ,states1 to perform-- 7i7 network technology security testing1 to test the security of cyber-related hardware and software2 7ii7 connected industrial control system security testing1 to test the security of connected programmable data logic controllers1 supervisory control and data acquisition servers1 and other cyber connected industrial equipment2 and 7iii7 open source software security testing1 to test and coordinate efforts to fix vulnerabilities in open-source software4 4 7b7 ,authorization of appropriations ,there are authorized to be appropriated to carry out the amendments made by this section #ae1jjj1jjj for each of fiscal years #bjbb through #bjbf4 ,,iii ,improving security in the national cyber ecosystem #cja4 ,establish a ,national ,cybersecurity ,certification and ,labeling ,authority 7a7 ,definitions ,in this section3 7#a7 ,accredited certifying agent ,the term accredited certifying agent means any person who is accredited by the ,authority as a certifying agent for the purposes of certifying a specific class of critical information and communications technology4 7#b7 ,authority ,the term ,authority means the ,national ,cybersecurity ,certification and ,labeling ,authority established under subsection 7b77#a74 7#c7 ,certification ,the term certification means a seal or symbol provided by the ,authority or an accredited certifying agent1 that results from passage of a comprehensive evaluation of an information and communications technology that establishes the extent to which a particular design and implementation meets a set of specified security standards4 7#d7 ,critical information and communications technology ,the term critical information and communications technology means information and communications technology that is in use in critical infrastructure sectors and that underpins the resilience of national critical functions1 as determined by the ,secretary4 7#e7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #ajaf7;e7 of the ,critical ,infrastructure ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#f7 ,label ,the term label means a clear1 visual1 and easy to understand symbol or list that conveys specific information about a product's security attributes1 characteristics1 functionality1 components1 or other features4 7#g7 ,program ,the term ,program means the program administered under subsection 7b77#a74 7#h7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7b7 ,national cybersecurity certification and labeling authority 7#a7 ,establishment ,there is established a ,national ,cybersecurity ,certification and ,labeling ,authority for the purpose of establishing and administering a voluntary national cybersecurity certification and labeling program for critical information and communications technology in order to bolster the resilience of the networks and critical infrastructure of the ,united ,states4 7#b7 ,programs 7,a7 ,accreditation of certifying agents ,as part of the ,program1 the ,authority shall define and publish a process whereby governmental and nongovernmental entities may apply to become accredited certifying agents for the certification of specific critical information and communications technology1 including-- 7i7 smartphones2 7ii7 tablets2 7iii7 laptop computers2 7iv7 operating systems2 7v7 routers2 7vi7 software-as-a-service2 7vii7 infrastructure-as-a-service2 7viii7 platform-as-a-service2 7ix7 programmable logic controllers2 7x7 intelligent electronic devices2 and 7xi7 programmable automation controllers4 7,b7 ,identification of standards1 frameworks1 and benchmarks ,as part of the ,program1 the ,authority shall work in coordination with accredited certifying agents1 the ,secretary1 and subject matter experts from the ,federal ,government1 academia1 nongovernmental organizations1 and the private sector to identify and harmonize common security standards1 frameworks1 and benchmarks against which the security of critical information and communications technologies may be measured4 7,c7 ,product certification ,as part of the ,program1 the ,authority1 in consultation with the ,secretary and other experts from the ,federal ,government1 academia1 nongovernmental organizations1 and the private sector1 shall-- 7i7 develop1 and disseminate to accredited certifying agents1 guidelines to standardize the presentation of certifications to communicate the level of security for critical information and communications technologies2 7ii7 develop1 or permit accredited certifying agents to develop1 certification criteria for critical information and communications technologies based on identified security standards1 frameworks1 and benchmarks1 through the work conducted under subparagraph 7,b72 7iii7 issue1 or permit accredited certifying agents to issue1 certifications for critical information and communications technology that meet and comply with security standards1 frameworks1 and benchmarks identified through the work conducted under subparagraph 7,b72 7iv7 permit a manufacturer or distributor of critical information and communications technology to display a certificate reflecting the extent to which the critical information and communications technology meets security standards1 frameworks1 and benchmarks identified through the work conducted under subparagraph 7,b72 7v7 remove the certification of a critical information and communications technology as a critical information and communications technology certified under the ,program if the manufacturer of the certified critical information and communications technology falls out of conformity with the benchmarks security standards1 frameworks1 or benchmarks identified through the work conducted under subparagraph 7,b7 for the critical information and communications technology2 7vi7 work to enhance public awareness of the certification and labeling efforts of the ,authority and accredited certifying agents1 including through public outreach1 education1 research and development1 and other means2 and 7vii7 publicly display a list of labels and certified critical information and communications technology1 along with their respective certification information4 7,d7 ,certifications 7i7 ,in general ,a certification shall remain valid for #a year from the date of issuance4 7ii7 ,classes of certification ,in developing the guidelines and criteria required under subparagraph 7,c77i71 the ,authority shall designate at least #c classes of certifications1 including the following3 7,i7 ,for critical information and communications technology which the product manufacturer or service provider attests meets the criteria for a certification1 attestation-based certification4 7,,ii7 ,for critical information and communications technology products and services that have undergone third-party accreditation of criteria for certification1 accreditation-based certification4 7,,iii7 ,for critical information and communications technology that has undergone a security evaluation and testing process by a qualifying third party1 as determined by the ,authority1 test-based certification4 7,e7 ,product labeling ,the ,authority1 in consultation with the ,secretary and other experts from the ,federal ,government1 academia1 nongovernmental organizations1 and the private sector1 shall-- 7i7 collaborate with the private sector to standardize language and define a labeling schema to provide transparent information on the security characteristics and constituent components of a software or hardware product2 and 7ii7 establish a mechanism by which product developers can provide this information for both product labeling and public posting4 7#c7 ,enforcement 7,a7 ,in general ,it shall be unlawful for a product manufacturer1 distributor1 or seller to-- 7i7 falsely attest to1 or falsify an audit or test for1 a security standard1 framework1 or benchmark for certification2 7ii7 intentionally mislabel a product2 or 7iii7 fail to maintain the security standard1 framework1 or benchmark to which the manufacturer1 distributor1 or seller attested4 7,b7 ,enforcement by ,federal ,trade ,commission 7i7 ,unfair or deceptive acts or practices ,a violation of subparagraph 7,a7 shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7ii7 ,powers of ,commission 7,i7 ,in general ,the ,federal ,trade ,commission shall enforce this paragraph in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this paragraph4 7,,ii7 ,privileges and immunities ,any person who violates this paragraph shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7c7 ,selection of the authority 7#a7 ,selection ,the ,secretary shall issue a notice of funding opportunity and select1 on a competitive basis1 a nonprofit1 nongovernmental organization to serve as the ,authority for a period of #e years4 7#b7 ,eligibility for selection ,the ,secretary may only select an organization to serve as the ,authority if such organization-- 7,a7 is a nongovernmental1 nonprofit organization that is-- 7i7 exempt from taxation under section #eja7;a7 of the ,internal ,revenue ,code of #aihf2 and 7ii7 described in sections #eja7;c77#c7 and #agj7;b77#a77;,a77vi7 of that ,code2 7,b7 has a demonstrable track record of work on cybersecurity and information security standards1 frameworks1 and benchmarks2 and 7,c7 possesses requisite staffing and expertise1 with demonstrable prior experience in technology security or safety standards1 frameworks1 and benchmarks1 as well as certification4 7#c7 ,application ,the ,secretary shall establish a process by which a nonprofit1 nongovernmental organization that seeks to be selected as the ,authority may apply for consideration4 7#d7 ,program evaluation ,not later than the date that is #d years after the initial selection pursuant paragraph 7#a71 and every #d years thereafter1 the ,secretary shall-- 7,a7 assess the effectiveness of the labels and certificates produced by the ,authority1 including-- 7i7 assessing the costs to businesses that manufacture critical information and communications technology participating in the ,program2 7ii7 evaluating the level of participation in the ,program by businesses that manufacture critical information and communications technology2 and 7iii7 assessing the level of public awareness and consumer awareness of the label2 7,b7 audit the impartiality and fairness of the ,authority's activities conducted under this section2 7,c7 issue a public report on the assessment most recently carried out under subparagraph 7,a7 and the audit most recently carried out under subparagraph 7,b72 and 7,d7 brief ,congress on the findings of the ,secretary with respect to the most recent assessment under subparagraph 7,a7 and the most recent audit under subparagraph 7,b74 7#e7 ,renewal ,after the initial selection pursuant to paragraph 7#a71 the ,secretary shall1 every #e years-- 7,a7 accept applications from nonprofit1 nongovernmental organizations seeking selection as the ,authority2 and 7,b7 following competitive consideration of all applications-- 7i7 renew the selection of the organization serving as the ,authority2 or 7ii7 select another applicant organization to serve as the ,authority4 7d7 ,authorization of appropriations ,there are authorized to be appropriated to carry out this section #be1jjj1jjj for each of fiscal years #bjbb through #bjbf4 #cjb4 ,establish the ,bureau of ,cybersecurity ,statistics 7a7 ,definitions ,in this section3 7#a7 ,bureau ,the term ,bureau means the ,bureau of ,cybersecurity ,statistics established under subsection 7b74 7#b7 ,covered entity ,the term covered entity means any nongovernmental organization1 corporation1 trust1 partnership1 sole proprietorship1 unincorporated association1 or venture 7without regard to whether it is established for profit7 that is engaged in or affecting interstate commerce and that provides cybersecurity incident response services or cybersecurity insurance products4 7#c7 ,cyber incident ,the term cyber incident includes each of the following3 7,a7 ,unauthorized access to an information system or network that leads to loss of confidentiality1 integrity1 or availability of that information system or network4 7,b7 ,disruption of business operations due to a distributed denial of service attack against an information system or network4 7,c7 ,unauthorized access or disruption of business operations due to loss of service facilitated through1 or caused by a cloud service provider1 managed service provider1 or other data hosting provider4 7,d7 ,fraudulent or malicious use of a cloud service account1 data hosting account1 internet service account1 or any other digital service4 7#d7 ,director ,the term ,director means the ,director of the ,bureau4 7#e7 ,statistical purpose ,the term statistical purpose-- 7,a7 means the description1 estimation1 or analysis of the characteristics of groups1 without identifying the individuals or organizations that comprise such groups2 and 7,b7 includes the development1 implementation1 or maintenance of methods1 technical or administrative procedures1 or information resources that support the purposes described in subsection 7e74 7b7 ,establishment ,there is established within the ,department of ,homeland ,security a ,bureau of ,cybersecurity ,statistics4 7c7 ,director 7#a7 ,in general ,the ,bureau shall be headed by a ,director1 who shall-- 7,a7 report to the ,secretary of ,homeland ,security2 and 7,b7 be appointed by the ,president4 7#b7 ,authority ,the ,director shall-- 7,a7 have final authority for all cooperative agreements and contracts awarded by the ,bureau2 7,b7 be responsible for the integrity of data and statistics collected or issued by the ,bureau2 and 7,c7 protect against improper or illegal use or disclosure of information furnished for exclusively statistical purposes under this section1 consistent with the requirements of subsection 7f74 7#c7 ,qualifications ,the ,director-- 7,a7 shall have experience in statistical programs2 and 7,b7 shall not-- 7i7 engage in any other employment2 or 7ii7 hold any office in1 or act in any capacity for1 any organization1 agency1 or institution with which the ,bureau makes any contract or other arrangement under this section4 7#d7 ,duties and functions ,the ,director shall-- 7,a7 collect and analyze information concerning cybersecurity1 including data related to cyber incidents1 cyber crime1 and any other area the ,director determines appropriate2 7,b7 collect and analyze data that will serve as a continuous and comparable national indication of the prevalence1 incidents1 rates1 extent1 distribution1 and attributes of all relevant cyber incidents1 as determined by the ,director1 in support of national policy and decision making2 7,c7 compile1 collate1 analyze1 publish1 and disseminate uniform national cyber statistics concerning any area that the ,director determines appropriate2 7,d7 in coordination with the ,national ,institute of ,standards and ,technology1 recommend national standards1 metrics1 and measurement criteria for cyber statistics and for ensuring the reliability and validity of statistics collected pursuant to this subsection2 7,e7 conduct or support research relating to methods of gathering or analyzing cyber statistics2 7,f7 enter into cooperative agreements or contracts with public agencies1 institutions of higher education1 or private organizations for purposes related to this subsection2 7,g7 provide appropriate information to the ,president1 the ,congress1 ,federal agencies1 the private sector1 and the general public on cyber statistics2 7,h7 maintain liaison with ,state and local governments concerning cyber statistics2 7,i7 confer and cooperate with ,federal statistical agencies as needed to carry out the purposes of this section1 including by entering into cooperative data sharing agreements in conformity with all laws and regulations applicable to the disclosure and use of data2 and 7,j7 request from any person or entity information1 data1 and reports as may be required to carry out the purposes of this subsection4 7d7 ,furnishment of information1 data1 or reports by ,federal departments and agencies ,federal departments and agencies requested by the ,director to furnish information1 data1 or reports pursuant to subsection 7c77#d77;,j7 shall provide to the ,bureau such information as the ,director determines necessary to carry out the purposes of this section4 7e7 ,furnishment of cyber incident information1 data1 or reports to the bureau by the private sector 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 and every #ahj days thereafter1 each covered entity shall submit to the ,bureau a report containing such data and information as the ,director determines necessary to carry out the purposes of this section4 7#b7 ,determination of data and information necessary to carry out the purposes of this section ,not later than #ij days after the date of enactment of this ,act1 and annually thereafter1 the ,director shall publish a list of data and information determined necessary to carry out the purposes of this section1 including individual descriptions of cyber incidents1 which shall include-- 7,a7 identification of the affected databases1 information systems1 or devices that were1 or are reasonably believed to have been accessed by an unauthorized person2 7,b7 where applicable1 a description of the vulnerabilities1 tactics1 techniques1 and procedures used2 7,c7 where applicable1 any identifying information related to the malicious actors who perpetrated the incident2 7,d7 where applicable any cybersecurity controls implemented by the victim organization2 and 7,e7 the industrial sectors1 regions1 and size of affected entities 7as determined by number of employees7 without providing any information that can reasonably be expected to identify such entities4 7#c7 ,standards for submission of information and data ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall1 in consultation with covered entities1 develop standardized procedures for the submission of data and information the ,director determines necessary to carry out the purposes of this section4 7#d7 ,private sector reporting ,not later than #ij days after the date on which the ,director develops the standards required under paragraph 7#c71 the ,director shall-- 7,a7 publish the processes for submission of information1 data1 and reports by covered entities2 and 7,b7 begin accepting reporting required under paragraph 7#a74 7#e7 ,regulatory use ,information disclosed to the ,bureau under this section that is not otherwise available1 shall not be used by the ,federal ,government or any ,state1 local1 tribal1 or territorial government to sanction or otherwise punish the entity disclosing the information1 or the entity in which the cyber incident initially occurred4 7#f7 ,preservation of privilege ,disclosure of information pursuant to this section or by a covered entity to the ,bureau shall not waive any otherwise applicable privilege1 immunity1 or protection provided by law4 7#g7 ,preservation of existing obligations ,nothing in this section shall modify1 prevent1 or abrogate any notice or notification obligations under ,federal contracts1 enforceable agreements with the government1 or other ,federal law4 7#h7 ,enforcement 7,a7 ,unfair or deceptive acts or practices ,compliance with the requirements imposed under this subsection by covered entities shall be enforced by the ,federal ,trade ,commission under the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 ,for the purpose of the exercise by the ,federal ,trade ,commission of its functions and powers under the ,federal ,trade ,commission ,act1 a violation of any requirement or prohibition imposed under this subsection shall be treated as an unfair and deceptive act or practice in violation of a regulation under section #ah7;a77#a77;,b7 of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 regarding unfair or deceptive acts or practices4 7,b7 ,powers of ,commission ,subject to subparagraph 7,c71 the ,federal ,trade ,commission shall enforce this subsection in the same manner1 by the same means1 and with the same jurisdiction1 powers1 and duties as though all applicable terms and provisions of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 were incorporated into and made a part of this subsection4 7,c7 ,additional entities 7i7 ,in general ,notwithstanding sections #d1 #e7;a77#b71 or #f of the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation of the ,federal ,trade ,commission1 the ,federal ,trade ,commission shall also enforce this subsection1 in the same manner provided in subparagraph 7,a7 of this paragraph1 with respect to-- 7,i7 organizations not organized to carry on business for their own profit or that of their members2 and 7,,ii7 common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq474 7ii7 ,coordination and notice ,the ,federal ,trade ,commission shall-- 7,i7 coordinate with the ,federal ,communications ,commission regarding enforcement of this subsection with respect to common carriers subject to the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aea et seq472 7,,ii7 notify the ,bureau of ,consumer ,financial ,protection regarding enforcement of this subsection with respect to information associated with the provision of financial products or services by an entity that provides a consumer financial product or service 7as defined in section #ajjb of the ,consumer ,financial ,protection ,act of #bjaj 7#ab ,u4,s4,c4 #edha772 and 7,,iii7 for enforcement of this subsection with respect to matters implicating the jurisdiction or authorities of another ,federal agency1 notify that agency as appropriate4 7,d7 ,privileges and immunities ,any covered entity that violates the requirements imposed under this subsection shall be subject to the penalties and entitled to the privileges and immunities provided in the ,federal ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,e7 ,construction ,nothing in this paragraph shall be construed to limit the authority of the ,federal ,trade ,commission under any other provision of law4 7f7 ,protection of information 7#a7 ,in general ,no officer or employee of the ,federal ,government or agent of the ,federal ,government may1 without the consent of the individual1 entity1 agency1 or other person who is the subject of the submission or provides the submission-- 7,a7 use any submission that is furnished for exclusively statistical purposes under this section for any purpose other than the statistical purposes for which the submission is furnished2 7,b7 make any publication or media transmittal of the data contained in a submission described in subparagraph 7,a7 that permits information concerning individual entities or individual incidents to be reasonably inferred by either direct or indirect means2 or 7,c7 permit anyone other than a sworn officer1 employee1 agent1 or contractor of the ,bureau to examine an individual submission described in subsection 7e74 7#b7 ,immunity from legal process ,any submission 7including any data derived from the submission7 that is collected and retained by the ,bureau1 or an officer1 employee1 agent1 or contractor of the ,bureau1 for exclusively statistical purposes under this section shall be immune from the legal process and shall not1 without the consent of the individual1 entity1 agency1 or other person who is the subject of the submission or provides the submission1 be admitted as evidence or used for any purpose in any action1 suit1 or other judicial or administrative proceeding4 7#c7 ,rule of construction ,nothing in this subsection shall be construed to provide immunity from the legal process for a submission 7including any data derived from the submission7 if the submission is in the possession of any person1 agency1 or entity other than the ,bureau or an officers1 employee1 agent1 or contractor of the ,bureau1 or if the submission is independently collected1 retained1 or produced for purposes other than the purposes of this section4 7g7 ,authorization of appropriation ,there are authorized to be appropriated such sums as may be necessary to carry out this section4 ,such funds shall remain available until expended4 #cjc4 ,secure foundational internet protocols 7a7 ,definitions ,in this section3 7#a7 ,border gateway protocol ,the term border gateway protocol means a protocol designed to optimize routing of information exchanged through the internet4 7#b7 ,domain name system ,the term domain name system means a system that stores information associated with domain names in a distributed database on networks4 7#c7 ,information and communications technology infrastructure providers ,the term information and communications technology infrastructure providers means all systems that enable connectivity and operability of internet service1 backbone1 cloud1 web hosting1 content delivery1 domain name system1 and software-defined networks and other systems and services4 7b7 ,creation of a strategy ,to secure foundational internet protocols 7#a7 ,protocol security strategy ,in order to secure foundational internet protocols1 not later than ,december #ca1 #bjba1 the ,national ,telecommunications and ,information ,administration and the ,department of ,homeland ,security shall submit to ,congress a strategy to secure the border gateway protocol and the domain name system4 7#b7 ,strategy requirements ,the strategy required under paragraph 7#a7 shall-- 7,a7 articulate the security and privacy benefits of implementing security for the border gateway protocol and the domain name system and the burdens of implementation and the entities on whom those burdens will most likely fall2 7,b7 identify key ,united ,states and international stakeholders2 7,c7 outline identified security measures that could be used to secure or provide authentication for the border gateway protocol and the domain name system2 7,d7 identify any barriers to implementing security for the border gateway protocol and the domain name system at scale2 7,e7 propose a strategy to implement identified security measures at scale1 accounting for barriers to implementation and balancing benefits and burdens1 where feasible2 and 7,f7 provide an initial estimate of the total cost to the ,government and implementing entities in the private sector of implementing security for the border gateway protocol and the domain name system and propose recommendations for defraying these costs1 if applicable4 7#c7 ,consultation ,in developing the strategy required under paragraph 7#a7 the ,national ,telecommunications and ,information ,administration and the ,department of ,homeland ,security shall consult with information and communications technology infrastructure providers1 civil society organizations1 relevant nonprofit organizations1 and academic experts4 ,,iv ,systemically ,important ,critical ,infrastructure #dja4 ,definitions ,in this title3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives4 7#b7 ,critical infrastructure ,the term critical infrastructure has the meaning given that term in section #ajaf7;e7 of the ,critical ,infrastructure ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#c7 ,department ,the term ,department means the ,department of ,homeland ,security4 7#d7 ,entity ,the term entity means a non-,federal entity and a private entity1 as such terms are defined under section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#e7 ,national critical functions ,the term national critical functions means functions of government and the private sector so vital to the ,united ,states that their disruption1 corruption1 or dysfunction would have a debilitating effect on security1 national economic security1 national public health or safety1 or any combination thereof4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 7#g7 ,stakeholders ,the term stakeholders means persons or groups whose consultation may aid the ,secretary in exercising the authority of the ,secretary under this title1 including-- 7,a7 ,sector ,coordinating ,councils within the ,critical ,infrastructure ,partnership ,advisory ,council1 established under section #hga of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #dea72 7,b7 the ,state1 ,local1 ,tribal and ,territorial ,government ,coordinating ,council1 within the ,critical ,infrastructure ,partnership ,advisory ,council1 established under section #hga of the ,homeland ,security ,act of #bjjb 7#f4,u4,s4,c4 #dea72 7,c7 the ,cybersecurity ,advisory ,committee established under section #bbai of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;e71 as so redesignated by section #aja of this ,act2 7,d7 the ,national ,security ,telecommunications ,advisory ,committee established pursuant to ,executive ,order #abchb 7#dg ,fed4 ,reg4 #djeca72 and 7,e7 the ,national ,infrastructure ,advisory ,council1 established pursuant to ,executive ,order #acbca 7#ff ,fed4 ,reg4 #ecjfc74 7#h7 ,systemically important critical infrastructure ,the term ,systemically ,important ,critical ,infrastructure means an entity that has been designated as such by the ,secretary through the process and procedures established under section #djb4 #djb4 ,systemically ,important ,critical ,infrastructure 7a7 ,in general ,the ,secretary may designate entities as ,systemically ,important ,critical ,infrastructure4 7b7 ,establishment of methodology and criteria ,prior to designating any entities as ,systemically ,important ,critical ,infrastructure1 the ,secretary1 in consultation with the ,national ,cyber ,director1 ,sector ,risk ,management ,agencies1 and appropriate stakeholders shall develop-- 7#a7 a methodology for identifying ,systemically ,important ,critical ,infrastructure2 and 7#b7 criteria for determining whether an entity qualifies as ,systemically ,important ,critical ,infrastructure4 7c7 ,considerations ,in establishing criteria for determining whether an entity qualifies as ,systemically ,important ,critical ,infrastructure1 the ,secretary shall consider-- 7#a7 the likelihood that disruption to or compromise of such an entity could cause a debilitating effect on national security1 economic security1 public health or safety1 or any combination thereof2 7#b7 the extent to which damage1 disruption1 or unauthorized access to such an entity either separately or collectively1 will disrupt the reliable operation of other critical infrastructure assets1 or impede provisioning of one or more national critical functions2 7#c7 the extent to which national cybersecurity resilience would be enhanced by deeper risk management integration between ,systemically ,important ,critical ,infrastructure entities and the ,federal ,government2 and 7#d7 the extent to which compromise or unauthorized access of such an entity could separately or collectively create widespread compromise of the cyber ecosystem1 significant portions of critical infrastructure1 or multiple critical infrastructure sectors4 7d7 ,list 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall complete an initial list of entities designated as ,systemically ,important ,critical ,infrastructure4 7#b7 ,maintenance of list ,the ,secretary shall maintain a comprehensive list of entities designated as ,systemically ,important ,critical ,infrastructure1 which shall be updated within #g days of a change in whether an entity qualifies as ,systemically ,important ,critical ,infrastructure4 7e7 ,entity notifications ,not later than #ij days after designating an entity as ,systemically ,important ,critical ,infrastructure or removing the designation of an entity as ,systemically ,important ,critical ,infrastructure1 the ,secretary shall notify the entity4 7f7 ,congressional notifications ,the ,secretary shall-- 7#a7 not later than #cj days after the date of any addition1 modification1 or removal of an entity from the list of ,significantly ,important ,critical ,infrastructure maintained under subsection 7d71 notify the appropriate ,congressional committees2 and 7#b7 at least every #b years1 submit to the appropriate ,congressional committees an updated comprehensive list of entities designated as ,systemically ,important ,critical ,infrastructure1 in conjunction with each plan required pursuant to section #djc4 #djc4 ,plan for enhancement of ,systemically ,important ,critical ,infrastructure methodology and capability 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 and every #b years thereafter for #aj years1 the ,secretary1 in consultation with ,sector ,risk ,management ,agencies and appropriate stakeholders1 shall develop and submit to the appropriate congressional committees a plan for enhancing the methodology of the ,department for identifying ,systemically ,important ,critical ,infrastructure1 including a discussion of the progress of the ,department as of the date of submission of the plan in implementing the plan4 7b7 ,contents of plan 7#a7 ,in general ,the plan required under subsection 7a7 shall include-- 7,a7 the methodology and criteria used for identifying and determining entities that qualify as ,systemically ,important ,critical ,infrastructure as described in section #djb7;b7 and the analysis used to establish such methodology and criteria2 7,b7 a proposed timeline for enhancing the capabilities of the ,department to expand the list beyond the designated entities to also include facilities1 systems1 assets1 or other relevant units of critical infrastructure that may further enhance the ability to manage risk of ,systemically ,important ,critical ,infrastructure2 7,c7 information regarding the outreach by the ,department to stakeholders and other ,sector ,risk ,management ,agencies on such efforts1 including mechanisms for incorporation of industry feedback2 7,d7 information regarding the efforts of the ,department1 and the associated challenges with such efforts1 to access information from stakeholders and other ,sector ,risk ,management ,agencies to identify ,systemically ,important ,critical ,infrastructure2 7,e7 information regarding other critical infrastructure entity identification programs within the ,department and how they are being incorporated into the overarching process to identify ,systemically ,important ,critical ,infrastructure1 which shall include the efforts of the ,department under section #i of ,executive ,order #acfcf 7#gh ,fed4 ,reg4 #aagci71 the ,national ,infrastructure ,prioritization ,program1 and section #d of ,executive ,order #adjbh 7#hf ,fed4 ,reg4 #bffcc72 7,f7 any identified gaps in authorities or resources required to successfully carry out the process of identifying ,systemically ,important ,critical ,infrastructure1 including facilities1 systems1 assets1 or other relevant units of critical infrastructure1 as well as legislative proposals to address such gaps2 7,g7 an assessment of potential benefits for entities designated as ,systemically ,important ,critical ,infrastructure1 which shall include an assessment of-- 7i7 enhanced intelligence support and information sharing2 7ii7 prioritized ,federal technical assistance2 7iii7 liability protection for entities designated as ,systemically ,important ,critical ,infrastructure that conform to identified security standards for damages or harm directly or indirectly caused by a cyber incident2 7iv7 prioritized emergency planning2 7v7 benefits described in the final report of the ,u4,s4 ,cyberspace ,solarium ,commission1 dated ,march #bjbj2 and 7vi7 additional authorizations or resources necessary to implement the benefits assessed under this subparagraph2 and 7,h7 an assessment of potential mechanisms to improve the security of entities designated as ,systemically ,important ,critical ,infrastructure1 which shall include an assessment of-- 7i7 risk-based cybersecurity performance standards for all ,systemically ,important ,critical ,infrastructure entities1 incorporating1 to the greatest extent possible1 existing industry best practices1 standards1 and guidelines2 7ii7 sector-specific performance standards2 7iii7 additional regulations to enhance the security of ,systemically ,important ,critical ,infrastructure against cyber risks1 including how to prevent duplicative requirements for already regulated sectors2 7iv7 cyber incident reporting requirements for entities designated as ,systemically ,important ,critical ,infrastructure2 and 7v7 additional authorizations or resources necessary to implement the mechanisms to improve the security of ,systemically ,important ,critical ,infrastructure assessed under this subparagraph4 7#b7 ,initial plan ,the initial plan submitted under this section shall include a detailed description of the capabilities of the ,department with respect to identifying ,systemically ,important ,critical ,infrastructure as they were on the date of enactment of this ,act4 7c7 ,classified annex ,the plan shall be in unclassified form1 but may include a classified annex1 as the ,secretary determines necessary4 7d7 ,publication ,not later than #cj days after the date on which the ,secretary submits a plan to ,congress1 the ,secretary shall make the plan available to relevant stakeholders4 7e7 ,restriction ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 shall not apply to any action to implement this section or to any exercise of the authority of the ,secretary pursuant to this section4 ,v ,enabling the ,national ,cyber ,director #eja4 ,establishment of hiring authorities for the ,office of the ,national ,cyber ,director ,section #ageb of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7,public ,law #aaf-bhc7 is amended-- 7#a7 in subsection 7e7-- 7,a7 in paragraph 7#a71 by inserting and in accordance with paragraphs 7#c7 through 7#g7 of this subsection1 after and classification laws12 7,b7 in paragraph 7#b71 by inserting notwithstanding paragraphs 7#c7 through 7#g7 of this subsection1 before employ experts2 7,c7 by redesignating paragraphs 7#c7 through 7#h7 as paragraphs 7#h7 through 7#ac71 respectively2 and 7,d7 by inserting after paragraph 7#b7 the following3 7#c7 establish1 as positions in the excepted service1 such qualified positions in the ,office as the ,director determines necessary to carry out the responsibilities of the ,office1 appoint an individual to a qualified position 7after taking into consideration the availability of preference eligibles for appointment to the position71 and1 subject to the requirements of paragraphs 7#d7 and 7#e71 fix the compensation of an individual for service in a qualified position2 7#d7 fix the rates of basic pay for any qualified position established under paragraph 7#c7 in relation to the rates of pay provided for employees in comparable positions in the ,office1 in which the employee occupying the comparable position performs1 manages1 or supervises functions that execute the mission of the ,office1 and1 subject to the same limitations on maximum rates of pay and consistent with section #ecda of title #e1 ,united ,states ,code1 adopt such provisions of that title to provide for prevailing rate systems of basic pay and apply those provisions to qualified positions for employees in or under which the ,office may employ individuals described by section #ecdb7;a77#b77;,a7 of such title2 7#e7 employ an officer or employee of the ,united ,states or member of the ,armed ,forces detailed to the staff of the ,office on a non-reimbursable basis-- 7,a7 as jointly agreed to by the heads of the receiving and detailing elements1 for a period not to exceed #c years2 7,b7 which shall not be construed to limit any other source of authority for reimbursable or non-reimbursable details2 and 7,c7 which shall not be considered an augmentation of the appropriations of the receiving element of the ,office2 7#f7 provide-- 7,a7 employees in qualified positions compensation 7in addition to basic pay71 including benefits1 incentives1 and allowances1 consistent with1 and not in excess of the level authorized for1 comparable positions authorized by title #e1 ,united ,states ,code2 and 7,b7 employees in a qualified position whose rate of basic pay is fixed under paragraph 7#d7 an allowance under section #eida of title #e1 ,united ,states ,code1 on the same basis and to the same extent as if the employee was an employee covered by such section1 including eligibility conditions1 allowance rates1 and all other terms and conditions in law or regulation2 7#g7 establish a fellowship program to facilitate a talent exchange program between the private sector and the ,office to arrange1 with the agreement of a private sector organization and the consent of the employee1 for the temporary assignment of an employee to the private sector organization1 or from the private sector organization to the ,office2 2 and 7#b7 in subsection 7g7-- 7,a7 by redesignating paragraphs 7#c7 through 7#f7 as paragraphs 7#d7 through 7#g71 respectively2 7,b7 by inserting after paragraph 7#b7 the following3 7#c7 ,the term excepted service has the meaning given that term in section #bajc of title #e1 ,united ,states ,code4 2 and 7#c7 by adding at the end the following3 7#h7 ,the term preference eligible has the meaning given that term in section #bajh7c7 of title #e1 ,united ,states ,code4 7#i7 ,the term qualified position means a position1 designated by the ,director for the purpose of this section1 in which the individual occupying such position performs1 manages1 or supervises functions that execute the responsibilities of the ,office4 4