,,ii #aag? ,,congress #a/ ,session ,s4 #bdia ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,july #bg1 #bjba ,mr4 ,k+ 7= himself1 ,mr4 ,r\nds1 & ,mr4 ,sasse7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,a ,,bill ,to am5d ! ,homel& ,security ,act ( #bjjb to e/abli% ! ,national ,cyb] ,resili5ce ,assi/ance ,fund1 to improve ! ability ( ! ,f$]al ,gov]nm5t to assi/ 9 enhanc+ critical infra/ructure cyb] resili5ce1 to improve security 9 ! national cyb] ecosy/em1 to address ,sy/emically ,important ,critical ,infra/ructure1 & = o!r purposes4 #a4 ,%ort title2 table ( cont5ts 7a7 ,%ort title ,?is ,act may be cit$ z ! ,def5se ( ,unit$ ,/ates ,infra/ructure ,act ( #bjba4 7b7 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title2 table ( cont5ts4 ,,title ,i--,inve/+ 9 cyb] resili5cy 9 critical infra/ructure ,sec4 #aja4 ,e/abli%m5t ( ! ,national ,cyb] ,resili5ce ,assi/ance ,fund4 ,,title ,,ii--,improv+ ! ability ( ! ,f$]al ,gov]nm5t to assi/ 9 enhanc+ critical infra/ructure cyb] resili5ce ,sec4 #bja4 ,in/itute a #e-ye> t]m = ! cyb]security & infra/ructure security director4 ,sec4 #bjb4 ,create a jo9t collaborative environm5t4 ,sec4 #bjc4 ,designate ?ree critical te*nology security c5t]s4 ,,title ,,iii--,improv+ security 9 ! national cyb] ecosy/em ,sec4 #cja4 ,e/abli% a ,national ,cyb]security ,c]tification & ,label+ ,au?ority4 ,sec4 #cjb4 ,e/abli% ! ,bureau ( ,cyb]security ,/ati/ics4 ,sec4 #cjc4 ,secure f\ndational int]net protocols4 ,,title ,,iv--,sy/emically ,important ,critical ,infra/ructure ,sec4 #dja4 ,def9itions4 ,sec4 #djb4 ,sy/emically ,important ,critical ,infra/ructure4 ,sec4 #djc4 ,plan = enhancem5t ( ,sy/emically ,important ,critical ,infra/ructure me?odology & capability4 ,,title ,v--,enabl+ ! ,national ,cyb] ,director ,sec4 #eja4 ,e/abli%m5t ( hir+ au?orities = ! ,(fice ( ! ,national ,cyb] ,director4 ,i ,inve/+ 9 cyb] resili5cy 9 critical infra/ructure #aja4 ,e/abli%m5t ( ! ,national ,cyb] ,resili5ce ,assi/ance ,fund 7a7 ,s5se ( congress ,x is ! s5se ( ,congress t-- 7#a7 ! ,unit$ ,/ates n[ op]ates 9 a cyb] l&scape t requires a level ( data security1 resili5ce1 & tru/wor?9ess t nei!r ! ,unit$ ,/ates ,gov]nm5t nor ! private sector alone is curr5tly equipp$ to provide2 7#b7 ! ,unit$ ,/ates mu/ d5y b5efits to adv]s>ies :o h long exploit$ cyb]space to _! advantage1 to ! disadvantage ( ! ,unit$ ,/ates1 & at little co/ to !mselves2 7#c7 ?is new approa* requires secur+ critical networks 9 collaboration ) ! private sector to promote national resili5ce & increase ! security ( ! cyb] ecosy/em2 7#d7 r$uc+ ! vuln]abilities adv]s>ies c t>get d5ies !m opportunities to attack ! int]e/s ( ! ,unit$ ,/ates ?r\gh cyb]space2 7#e7 ! public & private sectors /ruggle to coord9ate cyb] def5ses1 leav+ gaps t decrease national resili5ce & create sy/emic risk2 7#f7 new te*nology cont9ues to em]ge t fur!r comp\nds ^! *all5ges2 7#g7 :ile ! ,homel& ,security ,grant ,program & res\rc+ = national prep>$ness "u ! ,f$]al ,em]g5cy ,managem5t ,ag5cy are well-e/abli%$1 ! ,unit$ ,/ates ,gov]nm5t has no equival5t = cyb]security prep>ation or prev5tion2 7#h7 ! lack ( a consi/5t1 res\rc$ fund = inve/+ 9 resili5ce 9 key areas inhibits ! ,unit$ ,/ates ,gov]nm5t f convey+ its und]/&+ ( risk into /rategy1 plann+1 & action 9 fur!rance ( core objectives = ! security & resili5ce ( critical infra/ructure2 7#i7 ,congress has work$ dilig5tly to e/abli% ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 creat+ a new ag5cy t c lev]age broad au?orities to receive & %>e in=mation1 provide te*nical assi/ance to op]ators1 & p>tn] ) /akehold]s across ! executive bran*1 ,/ate & local communities1 & ! private sector2 7#aj7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy requires /r5g!n+ 9 its mission to ensure ! national resili5ce ( critical infra/ructure1 promote a m secure cyb] ecosy/em1 & s]ve z ! c5tral coord9at+ elem5t to support & integrate ,f$]al1 ,/ate1 local1 & private-sector cyb]security ef=ts2 & 7#aa7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy requires fur!r res\rce inve/m5t & cle> au?orities to realize its full pot5tial4 7b7 ,am5dm5ts ,subtitle ,a ( title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47 is am5d$-- 7#a7 9 section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7,a7 9 p>agraph 7#aa71 by /rik+ & at ! end2 7,b7 9 ! fir/ p>agraph designat$ z p>agraph 7#ab71 relat+ to ! ,cyb]security ,/ate ,coord9ator-- 7i7 by /rik+ section #bbae & ins]t+ section #bbag2 & 7ii7 by /rik+ & at ! end2 & 7,c7 by r$esignat+ ! second & ?ird p>agraphs designat$ z p>agraph 7#ab7 z p>agraphs 7#ac7 & 7#ad71 respectively2 7#b7 by r$esignat+ section #bbag 7#f ,u4,s4,c4 #ffe;f7 z section #bbbj2 7#c7 by r$esignat+ section #bbaf 7#f ,u4,s4,c4 #ffe;e7 z section #bbai2 7#d7 by r$esignat+ ! f\r? section #bbae 7relat+ to ,sector ,risk ,managem5t ,ag5cies7 7#f ,u4,s4,c4 #ffe;d7 z section #bbah2 7#e7 by r$esignat+ ! ?ird section #bbae 7relat+ to ! ,cyb]security ,/ate ,coord9ator7 7#f ,u4,s4,c4 #ffe;c7 z section #bbag2 7#f7 by r$esignat+ ! second section #bbae 7relat+ to ! ,jo9t ,cyb] ,plann+ ,(fice7 7#f ,u4,s4,c4 #ffe;b7 z section #bbaf2 & 7#g7 by add+ at ! end ! foll[+3 #bbbj;,a4 ,national ,cyb] ,resili5ce ,assi/ance ,fund 7a7 ,def9itions ,9 ?is section3 7#a7 ,cyb]security risk ,! t]m cyb]security risk has ! mean+ giv5 t t]m 9 section #bbji4 7#b7 ,eligible entity ,! t]m eligible entity means an entity t meets ! guidel9es & requirem5ts = eligible entities e/abli%$ by ! ,secret>y "u subsection 7d77#d74 7#c7 ,fund ,! t]m ,fund means ! ,national ,cyb] ,resili5ce ,assi/ance ,fund e/abli%$ "u subsection 7c74 7#d7 ,national critical functions ,! t]m national critical functions means ! functions ( gov]nm5t & ! private sector s vital to ! ,unit$ ,/ates t _! disruption1 corruption1 or dysfunction w\ld h a debilitat+ effect on security1 national economic security1 national public heal? or safety1 or any comb9ation !re(4 7b7 ,creation ( a critical infra/ructure resili5ce /rategy & a national risk managem5t cycle 7#a7 ,initial risk id5tification & assessm5t 7,a7 ,9 g5]al ,! ,secret>y1 act+ ?r\gh ! ,director1 %all e/abli% a process by :i* to id5tify1 assess1 & prioritize risks to critical infra/ructure1 consid]+ bo? cyb] & physical ?reats1 vuln]abilities1 & consequ5ces4 7,b7 ,consultation ,9 e/abli%+ ! process requir$ "u subp>agraph 7,a71 ! ,secret>y %all consult ) ,sector ,risk ,managem5t ,ag5cies1 critical infra/ructure own]s & op]ators1 & ! ,national ,cyb] ,director4 7,c7 ,publication ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is section1 ! ,secret>y %all publi% 9 ! ,f$]al ,regi/] proc$ures = ! process e/abli%$ "u subp>agraph 7,a74 7,d7 ,report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is section1 ! ,secret>y %all submit to ! ,presid5t1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report on ! risks id5tifi$ by ! process e/abli%$ "u subp>agraph 7,a74 7#b7 ,initial national critical infra/ructure resili5ce /rategy 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date on :i* ! ,secret>y deliv]s ! report requir$ "u p>agraph 7#a77;,d71 ! ,presid5t %all deliv] to majority & m9ority lead]s ( ! ,s5ate1 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a national critical infra/ructure resili5ce /rategy design$ to address ! risks id5tifi$ by ! ,secret>y4 7,b7 ,elem5ts ,9 ! /rategy deliv]$ "u subp>agraph 7,a71 ! ,presid5t %all-- 7i7 id5tify1 assess1 & prioritize areas ( risk to critical infra/ructure t w\ld compromise1 disrupt1 or imp$e ! ability ( ! critical infra/ructure to support ! national critical functions ( national security1 economic security1 or public heal? & safety2 7ii7 id5tify & outl9e curr5t & propos$ national-level actions1 programs1 & ef=ts to be tak5 to address ! risks id5tifi$2 7iii7 id5tify ! ,f$]al dep>tm5ts or ag5cies responsible = lead+ ea* national-level action1 program1 or ef=t & ! relevant critical infra/ructure sectors = ea*2 7iv7 outl9e ! budget plan requir$ to provide suffici5t res\rces to successfully execute ! full range ( activities propos$ or describ$ by ! /rategy2 & 7v7 reque/ any additional au?orities or res\rces necess>y to successfully execute ! /rategy4 7,c7 ,=m ,! /rategy deliv]$ "u subp>agraph 7,a7 %all be unclassifi$1 b may conta9 a classifi$ annex4 7#c7 ,congressional brief+ ,n lat] ?an #a ye> aft] ! date on :i* ! ,presid5t deliv]s ! /rategy "u subp>agraph 7,a71 & e ye> !reaft]1 ! ,secret>y1 9 coord9ation ) ,sector ,risk ,managem5t ,ag5cies1 %all brief ! appropriate congressional committees on ! national risk managem5t cycle activities und]tak5 pursuant to ! /rategy4 7#d7 ,five ye> risk managem5t cycle 7,a7 ,risk id5tification & assessm5t ,"u proc$ures e/abli%$ by ! ,secret>y1 ! ,secret>y %all repeat ! conduct+ & report+ ( ! risk id5tification & assessm5t requir$ "u p>agraph 7#a71 9 accordance ) ! requirem5ts 9 p>agraph 7#a71 e #e ye>s4 7,b7 ,/rategy ,"u proc$ures e/abli%$ by ! ,presid5t1 ! ,presid5t %all repeat ! prep>ation & deliv]y ( ! critical infra/ructure resili5ce /rategy requir$ "u p>agraph 7#b71 9 accordance ) ! requirem5ts 9 p>agraph 7#b71 e #e ye>s1 :i* %all also include assess+ ! implem5tation ( ! previ\s national critical infra/ructure resili5ce /rategy4 7c7 ,e/abli%m5t ( ! ,national ,cyb] ,resili5ce ,assi/ance ,fund ,!re is e/abli%$ 9 ! ,treasury ( ! ,unit$ ,/ates a fund1 to be kn[n z ! ,national ,cyb] ,resili5ce ,assi/ance ,fund1 :i* %all be available = ! co/ ( risk-bas$ grant programs focus$ on sy/ematically increas+ ! resili5ce ( public & private critical infra/ructure aga9/ cyb]security risk1 !reby increas+ ! ov]all resili5ce ( ! ,unit$ ,/ates4 7d7 ,adm9i/ration ( grants f ! ,national ,cyb] ,resili5ce ,assi/ance ,fund 7#a7 ,9 g5]al ,9 accordance ) ?is section1 ! ,secret>y1 act+ ?r\gh ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy & ! ,director1 %all develop & adm9i/] processes to-- 7,a7 e/abli% focus$ grant programs to address id5tifi$ areas ( cyb]security risk to1 & bol/] ! resili5ce (1 critical infra/ructure2 7,b7 accept & evaluate applications = ea* su* grant program2 7,c7 aw>d grants "u ea* su* grant program2 & 7,d7 disburse am\nts f ! ,fund4 7#b7 ,e/abli%m5t ( risk-focus$ grant programs 7,a7 ,e/abli%m5t 7i7 ,9 g5]al ,! ,secret>y1 act+ ?r\gh ! ,director & ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy1 may e/abli% n less ?an #a grant program focus$ on mitigat+ an id5tifi$ category ( cyb]security risk id5tifi$ "u ! national risk managem5t cycle & critical infra/ructure resili5ce /rategy "u subsection 7b7 9 ord] to bol/] ! resili5ce ( critical infra/ructure )9 ! ,unit$ ,/ates4 7ii7 ,selection ( focus area ,be=e select+ a focus area = a grant program pursuant to ?is subp>agraph1 ! ,director %all ensure-- 7,i7 !re is a cle>ly def9$ cyb]security risk id5tifi$ ?r\gh ! national risk managem5t cycle & critical infra/ructure resili5ce /rategy "u subsection 7b7 to be mitigat$2 7,,ii7 m>ket =ces d n provide suffici5t private-sector inc5tives to mitigate ! risk )\t ,gov]nm5t inve/m5t2 & 7,,iii7 !re is cle> ,f$]al ne$1 role1 & responsibility to mitigate ! risk 9 ord] to bol/] ! resili5ce ( critical infra/ructure4 7,b7 ,fund+ 7i7 ,recomm5dation ,beg9n+ 9 ! fir/ fiscal ye> foll[+ ! e/abli%m5t ( ! ,fund & ea* fiscal ye> !reaft]1 ! ,director %all-- 7,i7 assess ! funds available 9 ! ,fund = ! fiscal ye>2 & 7,,ii7 recomm5d to ! ,secret>y ! total am\nt to be made available f ! ,fund "u ea* grant program e/abli%$ "u ?is subsection4 7ii7 ,allocation ,aft] consid]+ ! recomm5dations made by ! ,director "u clause 7i7 = a fiscal ye>1 ! ,director %all allocate am\nts f ! ,fund to ea* active grant program e/abli%$ "u ?is subsection = ! fiscal ye>4 7#c7 ,use ( funds ,am\nts 9 ! ,fund %all be us$ to mitigate risks id5tifi$ ?r\gh ! national risk managem5t cycle & critical infra/ructure resili5ce /rategy "u subsection 7b74 7#d7 ,eligible entities 7,a7 ,guidel9es & requirem5ts 7i7 ,9 g5]al ,9 accordance ) clause 7ii71 ! ,secret>y %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives a set ( guidel9es & requirem5ts = det]m9+ ! entities t are eligible entities4 7ii7 ,deadl9es ,! ,secret>y %all submit ! guidel9es & requirem5ts "u clause 7i7-- 7,i7 n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is section1 & e #b ye>s !reaft]2 & 7,,ii7 n lat] ?an #cj days be=e ! date on :i* ! ,secret>y implem5ts ! guidel9es & requirem5ts4 7,b7 ,consid]ations ,9 develop+ guidel9es & requirem5ts = eligible entities "u subp>agraph 7,a71 ! ,secret>y %all consid]-- 7i7 numb] ( employees2 7ii7 annual rev5ue2 7iii7 exi/+ entity cyb]security sp5d+2 7iv7 curr5t cyb] risk assessm5ts1 includ+ cr$ible ?reats1 vuln]abilities1 & consequ5ces2 & 7v7 entity capacity to inve/ 9 mitigat+ cyb]security risk abs5t assi/ance f ! ,f$]al ,gov]nm5t4 7#e7 ,limitation ,= any fiscal ye>1 an eligible entity may n receive m ?an #a grant f ea* grant program e/abli%$ "u ?is subsection4 7#f7 ,grant processes ,! ,secret>y1 act+ ?r\gh ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy1 %all require ! submission ( su* in=mation z ! ,secret>y det]m9es is necess>y to-- 7,a7 evaluate a grant application aga9/ ! crit]ia e/abli%$ "u ?is section2 7,b7 disburse grant funds2 7,c7 provide ov]sight ( disburs$ grant funds2 & 7,d7 evaluate ! effectiv5ess ( ! fund$ project 9 increas+ ! ov]all resili5ce ( ! ,unit$ ,/ates ) respect to cyb]security risks4 7#g7 ,grant crit]ia ,= ea* grant program e/abli%$ "u ?is subsection1 ! ,director1 9 coord9ation ) ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy1 %all develop & publi% crit]ia = evaluat+ applications = fund+1 :i* %all include-- 7,a7 :e!r ! application id5tifies a cle>ly def9$ cyb]security risk2 7,b7 :e!r ! cyb]security risk id5tifi$ 9 ! grant application poses a sub/antial ?reat to critical infra/ructure2 7,c7 :e!r ! application id5tifies a program or project cle>ly design$ to mitigate a cyb]security risk2 7,d7 ! pot5tial consequ5ces ( leav+ ! id5tifi$ cyb]security risk unmitigat$1 includ+ ! pot5tial impact to ! critical functions & ov]all resili5ce ( ! nation2 & 7,e7 o!r appropriate factors id5tifi$ by ! ,director4 7#h7 ,evaluation ( grants applications 7,a7 ,9 g5]al ,utiliz+ ! crit]ia e/abli%$ "u p>agraph 7#g71 ! ,director1 9 coord9ation ) ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy1 %all evaluate grant applications made "u ea* grant program e/abli%$ "u ?is subsection4 7,b7 ,recomm5dation ,foll[+ ! evaluations requir$ "u subp>agraph 7,a71 ! ,director %all recomm5d to ! ,secret>y applications = approval1 includ+ ! am\nt ( fund+ recomm5d$ = ea* su* approval4 7#i7 ,aw>d ( grant fund+ ,! ,secret>y %all-- 7,a7 review ! recomm5dations ( ! ,director prep>$ pursuant to p>agraph 7#h72 & 7,b7 provide a f9al det]m9ation ( grant aw>ds to ! ,adm9i/rator ( ! ,f$]al ,em]g5cy ,managem5t ,ag5cy to be disburs$ & adm9i/]$ "u ! process e/abli%$ "u p>agraph 7#f74 7e7 ,evaluation ( grant programs utiliz+ ! ,national ,cyb] ,resili5ce ,assi/ance ,fund 7#a7 ,evaluation ,! ,secret>y %all e/abli% a process to evaluate ! effectiv5ess & effici5cy ( grants di/ribut$ "u ?is section & develop appropriate updates1 z ne$$1 to ! grant programs4 7#b7 ,annual report ,n lat] ?an #ahj days aft] ! conclusion ( ! fir/ fiscal ye> 9 :i* grants are aw>d$ "u ?is section1 & e fiscal ye> !reaft]1 ! ,secret>y %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives a report detail+ ! grants aw>d$ f ! ,fund1 ! /atus ( projects und]tak5 ) ! grant funds1 any plann$ *anges to ! disbursem5t me?odology ( ! ,fund1 measurem5ts ( success1 & total outlays f ! ,fund4 7#c7 ,grant program review 7,a7 ,annual assessm5t ,be=e ! />t ( ! second fiscal ye> 9 :i* grants are aw>d$ "u ?is section1 & e fiscal ye> !reaft]1 ! ,director %all assess ! grant programs e/abli%$ "u ?is section & det]m9e-- 7i7 = ! com+ fiscal ye>-- 7,i7 :e!r new grant programs ) additional focus areas %\ld be creat$2 7,,ii7 :e!r any exi/+ grant program %\ld be discont9u$2 & 7,,iii7 :e!r ! scope ( any exi/+ grant program %\ld be modifi$2 & 7ii7 ! success ( ! grant programs 9 ! prior fiscal ye>4 7,b7 ,submission to ,congress ,n lat] ?an #ij days be=e ! />t ( ! second fiscal ye> 9 :i* grants are aw>d$ "u ?is section1 & e fiscal ye> !reaft]1 ! ,secret>y %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives ! assessm5t conduct$ pursuant to subp>agraph 7,a7 & any plann$ alt]ations to ! grant program = ! com+ fiscal ye>4 7f7 ,limitation on use ( grant funds ,funds aw>d$ pursuant to ?is section-- 7#a7 %all supplem5t & n supplant ,/ate or local funds or1 z applicable1 funds suppli$ by ! ,bureau ( ,indian ,affairs2 & 7#b7 may n be us$-- 7,a7 to provide any ,f$]al co/-%>+ contribution on behalf ( a ,/ate or local gov]nm5t2 7,b7 to pay a ransom2 7,c7 by or = a non-,unit$ ,/ates entity2 or 7,d7 = any recreational or social purpose4 7g7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section #ge1jjj1jjj = ea* ( fiscal ye>s #bjbb ?r\gh #bjbf4 7h7 ,transf]s au?oriz$ ,dur+ a fiscal ye>1 ! ,secret>y or ! head ( any compon5t ( ! ,dep>tm5t t adm9i/]s ! ,/ate & ,local ,cyb]security ,grant ,program may transf] n m ?an #e p]c5t ( ! am\nts appropriat$ pursuant to subsection 7g7 or o!r am\nts appropriat$ to c>ry out ! ,national ,cyb] ,resili5ce ,assi/ance ,fund = t fiscal ye> to an acc\nt ( ! ,dep>tm5t = sal>ies1 exp5ses1 & o!r adm9i/rative co/s incurr$ = ! managem5t1 adm9i/ration1 or evaluation ( ?is section4 4 7c7 ,te*nical & con=m+ am5dm5ts 7#a7 ,table ( cont5ts ,! table ( cont5ts 9 section #a7;b7 ( ! ,homel& ,security ,act ( #bjjb 7,public ,law #ajg-bif2 #aaf ,/at4 #bace7 is am5d$ by /rik+ ! item relat+ to section #bbad & all t foll[s ?r\gh ! item relat+ to section #bbag & ins]t+ ! foll[+3 ,sec4 #bbad4 ,national ,asset ,database4 ,sec4 #bbae4 ,duties & au?orities relat+ to 4gov int]net doma94 ,sec4 #bbaf4 ,jo9t ,cyb] ,plann+ ,(fice4 ,sec4 #bbag4 ,cyb]security ,/ate ,coord9ator4 ,sec4 #bbah4 ,sector ,risk ,managem5t ,ag5cies4 ,sec4 #bbai4 ,cyb]security ,advisory ,committee4 ,sec4 #bbbj4 ,cyb]security education & tra9+ programs4 ,sec4 #bbbj;,a4 ,national ,cyb] ,resili5ce ,assi/ance ,fund4 4 7#b7 ,additional te*nical am5dm5t 7,a7 ,am5dm5t ,section #ijd7;b77#a7 ( ! ,,dotgov ,act ( #bjbj 7title ,,ix ( division ,u ( ,public ,law #aaf-bfj7 is am5d$1 9 ! matt] prec$+ subp>agraph 7,a71 by /rik+ ,homel& ,security ,act & ins]t+ ,homel& ,security ,act ( #bjjb4 7,b7 ,effective date ,! am5dm5t made by subp>agraph 7,a7 %all take effect z if enact$ z "p ( ! ,,dotgov ,act ( #bjbj 7title ,,ix ( division ,u ( ,public ,law #aaf-bfj74 ,,ii ,improv+ ! ability ( ! ,f$]al ,gov]nm5t to assi/ 9 enhanc+ critical infra/ructure cyb] resili5ce #bja4 ,in/itute a #e-ye> t]m = ! cyb]security & infra/ructure security director 7a7 ,9 g5]al ,subsection 7b77#a7 ( section #bbjb ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #feb71 is am5d$ by ins]t+ ,! ,director %all be appo9t$ = a t]m ( #e ye>s4 aft] :o %all report to ! ,secret>y44 7b7 ,transition rules ,! am5dm5t made by subsection 7a7 %all take effect on ! e>li] (-- 7#a7 ! fir/ appo9tm5t ( an individual to ! position ( ,director ( ! ,cyb]security & ,infra/ructure ,protection ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 by & ) ! advice & cons5t ( ! ,s5ate1 t is made on or aft] ! date ( enactm5t ( ?is ,act2 or 7#b7 ,janu>y #a1 #bjbb4 #bjb4 ,create a jo9t collaborative environm5t 7a7 ,9 g5]al ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all e/abli% a jo9t1 cl\d-bas$1 in=mation %>+ environm5t to-- 7#a7 integrate ! ,f$]al ,gov]nm5t's unclassifi$ & classifi$ cyb] ?reat in=mation1 malw>e =5sics1 & data relat$ to cyb]security risks 7z def9$ 9 section #bbji ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fei77 t is d]iv$ f network s5sor programs2 7#b7 enable cross-correlation ( ?reat data at ! spe$ & scale necess>y = rapid detection & id5tification2 7#c7 enable qu]y & analysis by appropriate op]ators across ! ,f$]al ,gov]nm5t2 7#d7 facilitate a :ole-(-,gov]nm5t1 compreh5sive und]/&+ ( ! cyb] ?reats to ! resili5ce ( ! ,f$]al ,gov]nm5t & national critical infra/ructure networks2 7#e7 enable & support ! private-public cyb]security collaboration ef=ts ( ! ,f$]al ,gov]nm5t1 ^: successes w be directly dep5d5t on ! accuracy1 compreh5siv5ess1 & timel9ess ( ?reat in=mation collect$ & held by ! ,f$]al ,gov]nm5t2 & 7#f7 enable data curation = artificial intellig5ce models & provide an environm5t to enable ! ,f$]al ,gov]nm5t to curate data & build applications4 7b7 ,developm5t 7#a7 ,initial evaluation ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director %all-- 7,a7 id5tify all ,f$]al s\rces ( classifi$ & unclassifi$ cyb] ?reat in=mation2 7,b7 evaluate all programs1 applications1 or plat=ms ( ! ,f$]al ,gov]nm5t t are int5d$ to detect1 id5tify1 analyze1 or monitor cyb] ?reats aga9/ ! resili5cy ( ! ,f$]al ,gov]nm5t or critical infra/ructure2 & 7,c7 submit a recomm5dation to ! ,presid5t id5tify+ ,f$]al programs to be designat$ & requir$ to p>ticipate 9 ! ,in=mation ,%>+ ,environm5t1 includ+-- 7i7 ,gov]nm5t network-monitor+ & intrusion detection programs2 7ii7 cyb] ?reat indicator-%>+ programs & ,gov]nm5t-sponsor$ network s5sors or network-monitor+ programs = ! private sector or = ,/ate1 local1 tribal1 & t]ritorial gov]nm5ts2 7iii7 incid5t response & cyb]security te*nical assi/ance programs2 & 7iv7 malw>e =5sics & rev]se-eng9e]+ programs4 7#b7 ,designation ( p>ticipat+ programs ,n lat] ?an #fj days aft] completion ( ! evaluation requir$ "u p>agraph 7#a71 ! ,presid5t %all issue a det]m9ation designat+ ! dep>tm5ts1 ag5cies1 ,f$]al programs1 & correspond+ sy/ems & assets t are requir$ to be a "p ( ! ,in=mation ,%>+ ,environm5t4 7#c7 ,design ,n lat] ?an #a ye> aft] completion ( ! evaluation requir$ "u p>agraph 7#a71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all design ! /ructure ( a common plat=m = %>+ & fus+ exi/+ ,gov]nm5t in=mation1 insights1 & data relat$ to cyb] ?reats & ?reat actors1 :i*1 at a m9imum1 %all-- 7,a7 acc\nt = appropriate data /&>ds & int]op]ability requirem5ts2 7,b7 enable integration ( exi/+ applications1 plat=ms1 data1 & in=mation1 to include classifi$ in=mation2 7,c7 ensure access by su* ,f$]al dep>tm5ts & ag5cies z ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es necess>y2 7,d7 acc\nt = pot5tial private sector p>ticipation & p>tn]%ips2 7,e7 enable unclassifi$ data to be integrat$ ) classifi$ data2 7,f7 anticipate ! deploym5t ( analytic tools across classification levels to lev]age all relevant data sets1 z appropriate2 7,g7 id5tify tools & analytical s(tw>e t c be appli$ & %>$ to manipulate1 trans=m1 & display data & o!r id5tifi$ ne$s2 7,h7 anticipate ! integration ( new te*nologies & data /reams1 includ+ data relat$ to cyb]security risks d]iv$ f ,gov]nm5t-sponsor$ volunt>y network s5sors or network-monitor+ programs = ! private sector or = ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts2 & 7,i7 appropriately acc\nt = dep>tm5ts1 ag5cies1 programs1 & sy/ems & assets det]m9$ to be requir$ to p>ticipate by ! ,presid5t "u p>agraph 7#b7 9 ! ,in=mation ,%>+ ,environm5t4 7c7 ,op]ation ,! ,in=mation ,%>+ ,environm5t %all be manag$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7d7 ,po/-,deploym5t assessm5t ,n lat] ?an #a ye> aft] ! date on :i* ! ,in=mation ,%>+ ,environm5t is e/abli%$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,director %all assess ! means by :i* ! ,in=mation ,%>+ ,environm5t may be exp&$ to include ! private sector & critical infra/ructure in=mation %>+ organizations &1 to ! maximum ext5t practicable1 beg9 ! process ( su* expansion4 7e7 ,private sector %>+ in=mation %>+ protections ,to ! ext5t any private entity %>es cyb] ?reat indicators & def5sive measures ?r\gh or ) ! ,in=mation ,%>+ ,environm5t & 9 a mann] t is consi/5t ) all requirem5ts "u section #ageb ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj71 ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja et seq471 & any applicable guidel9es promulgat$ "u subsection 7f71 su* activities %all be consid]$ to be au?oriz$ by & 9 accordance ) section #ageb ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba & ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae4 7f7 ,privacy & civil lib]ties 7#a7 ,guidel9es ( attorney g5]al ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,homel& ,security 7act+ ?r\gh ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy7 & ! ,attorney ,g5]al1 %all jo9tly1 & 9 coord9ation ) heads ( ! appropriate ,f$]al entities & 9 consultation ) (fic]s designat$ "u section #ajfb ( ! ,national ,security ,intellig5ce ,re=m ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a71 develop1 submit to ,congress1 & make available to ! public int]im guidel9es relat+ to privacy & civil lib]ties :i* %all gov]n ! receipt1 ret5tion1 use1 & dissem9ation ( cyb] ?reat indicators by a ,f$]al entity obta9$ 9 connection ) activities au?oriz$ 9 ?is section4 7#b7 ,f9al guidel9es 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y ( ,homel& ,security 7act+ ?r\gh ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy7 & ! ,attorney ,g5]al1 %all jo9tly1 9 coord9ation ) heads ( ! appropriate ,f$]al entities & 9 consultation ) (fic]s designat$ "u section #ajfb ( ! ,national ,security ,intellig5ce ,re=m ,act ( #bjjd 7#db ,u4,s4,c4 #bjjj;ee-#a7 & su* private entities ) indu/ry exp]tise z ! ,secret>y & ! ,attorney ,g5]al consid] relevant1 promulgate f9al guidel9es relat+ to privacy & civil lib]ties :i* %all gov]n ! receipt1 ret5tion1 use1 & dissem9ation ( cyb] ?reat indicators by a ,f$]al entity obta9$ 9 connection ) activities au?oriz$ 9 ?is section4 7,b7 ,p]iodic review ,! ,secret>y ( ,homel& ,security 7act+ ?r\gh ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy7 & ! ,attorney ,g5]al1 %all jo9tly1 9 coord9ation ) heads ( ! appropriate ,f$]al entities & 9 consultation ) (fic]s & private entities describ$ 9 subp>agraph 7,a71 p]iodically1 b n less frequ5tly ?an once e #b ye>s1 review ! guidel9es promulgat$ "u subp>agraph 7,a74 7#c7 ,cont5t ,! guidel9es requir$ by p>agraphs 7#a7 & 7#b7 %all1 consi/5t ) ! ne$ to bol/] ! resili5ce ( in=mation sy/ems & mitigate cyb]security ?reats-- 7,a7 limit ! effect on privacy & civil lib]ties ( activities by ! ,f$]al ,gov]nm5t "u ?is section2 7,b7 limit ! receipt1 ret5tion1 use1 & dissem9ation ( cyb] ?reat indicators conta9+ p]sonal in=mation or in=mation t id5tifies specific p]sons1 includ+ by e/abli%+-- 7i7 a process = ! timely de/ruction ( su* in=mation t is kn[n n to be directly relat$ to uses au?oriz$ "u ?is section2 & 7ii7 specific limitations on ! l5g? ( any p]iod 9 :i* a cyb] ?reat indicator may be reta9$2 7,c7 include requirem5ts to safegu>d cyb] ?reat indicators conta9+ p]sonal in=mation or in=mation t id5tifies specific p]sons f unau?oriz$ access or acquisition1 includ+ appropriate sanctions = activities by (fic]s1 employees1 or ag5ts ( ! ,f$]al ,gov]nm5t 9 contrav5tion ( su* guidel9es2 7,d7 include proc$ures = notify+ entities & ,f$]al entities if in=mation receiv$ pursuant to ?is subsection is kn[n or det]m9$ by a ,f$]al entity receiv+ su* in=mation n to con/itute a cyb] ?reat indicator2 7,e7 protect ! confid5tiality ( cyb] ?reat indicators conta9+ p]sonal in=mation or in=mation t id5tifies specific p]sons to ! greate/ ext5t practicable & require recipi5ts to be in=m$ t su* indicators may only be us$ = purposes au?oriz$ "u ?is section2 & 7,f7 include /eps t may be ne$$ s t dissem9ation ( cyb] ?reat indicators is consi/5t ) ! protection ( classifi$ & o!r s5sitive national security in=mation4 7g7 ,ov]sight ( gov]nm5t activities 7#a7 ,bi5nial report on privacy & civil lib]ties ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & n less frequ5tly ?an once e ye> !reaft]1 ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d %all submit to ,congress & ! ,presid5t a report provid+-- 7,a7 an assessm5t ( ! effect on privacy & civil lib]ties by ! type ( activities c>ri$ out "u ?is section2 & 7,b7 an assessm5t ( ! suffici5cy ( ! guidel9es e/abli%$ pursuant to subsection 7f7 9 address+ conc]ns relat+ to privacy & civil lib]ties4 7#b7 ,bi5nial report by inspectors g5]al 7,a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & n less frequ5tly ?an once e #b ye>s !reaft]1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,homel& ,security1 ! ,inspector ,g5]al ( ! ,intellig5ce ,community1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,ju/ice1 ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,def5se1 & ! ,inspector ,g5]al ( ! ,dep>tm5t ( ,en]gy %all1 9 consultation ) ! ,c\ncil ( ,inspectors ,g5]al on ,integrity & ,effici5cy1 jo9tly submit to ,congress a report on ! receipt1 use1 & dissem9ation ( cyb] ?reat indicators & def5sive measures t h be5 %>$ ) ,f$]al entities "u ?is section4 7,b7 ,cont5ts ,ea* report submitt$ "u subp>agraph 7,a7 %all include ! foll[+3 7i7 ,a review ( ! types ( cyb] ?reat indicators %>$ ) ,f$]al entities4 7ii7 ,a review ( ! actions tak5 by ,f$]al entities z a result ( ! receipt ( su* cyb] ?reat indicators4 7iii7 ,a li/ ( ,f$]al entities receiv+ su* cyb] ?reat indicators4 7iv7 ,a review ( ! %>+ ( su* cyb] ?reat indicators among ,f$]al entities to id5tify inappropriate b>ri]s to %>+ in=mation4 7#c7 ,recomm5dations ,ea* report submitt$ "u ?is subsection may include su* recomm5dations z ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d1 ) respect to a report submitt$ "u p>agraph 7#a71 or ! ,inspectors ,g5]al ref]r$ to 9 p>agraph 7#b77;,a71 ) respect to a report submitt$ "u p>agraph 7#b71 may h = improvem5ts or modifications to ! au?orities "u ?is section4 7#d7 ,=m ,ea* report requir$ "u ?is subsection %all be submitt$ 9 unclassifi$ =m1 b may include a classifi$ annex4 7h7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section #ajj1jjj1jjj = ea* ( fiscal ye>s #bjbb ?r\gh #bjbf4 7i7 ,def9itions ,9 ?is section3 7#a7 ,critical infra/ructure ,! t]m critical infra/ructure has ! mean+ giv5 t t]m 9 section #ajaf7;e7 ( ! ,critical ,infra/ructure ,protection ,act ( #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#b7 ,director ,! t]m ,director means ! ,national ,cyb] ,director4 7#c7 ,in=mation %>+ environm5t ,! t]m ,in=mation ,%>+ ,environm5t means ! in=mation %>+ environm5t e/abli%$ "u subsection 7a74 #bjc4 ,designate ?ree critical te*nology security c5t]s 7a7 ,9 g5]al ,section #cjg7;b77#c7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ahg7;b77#c771 is am5d$-- 7#a7 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ national laboratories1 be=e & univ]sities2 7#b7 9 subp>agraph 7,c71 by /rik+ & at ! end2 7#c7 9 subp>agraph 7,d71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#d7 by add+ at ! end ! foll[+3 7,e7 e/abli% n less ?an #a1 & n m ?an #c1 cyb]security-focus$ critical te*nology security c5t]s1 9 ord] to bol/] ! ov]all resili5ce ( ! networks & critical infra/ructure ( ! ,unit$ ,/ates1 to p]=m-- 7i7 network te*nology security te/+1 to te/ ! security ( cyb]-relat$ h>dw>e & s(tw>e2 7ii7 connect$ indu/rial control sy/em security te/+1 to te/ ! security ( connect$ programmable data logic controll]s1 sup]visory control & data acquisition s]v]s1 & o!r cyb] connect$ indu/rial equipm5t2 & 7iii7 op5 s\rce s(tw>e security te/+1 to te/ & coord9ate ef=ts to fix vuln]abilities 9 op5-s\rce s(tw>e4 4 7b7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ! am5dm5ts made by ?is section #ae1jjj1jjj = ea* ( fiscal ye>s #bjbb ?r\gh #bjbf4 ,,iii ,improv+ security 9 ! national cyb] ecosy/em #cja4 ,e/abli% a ,national ,cyb]security ,c]tification & ,label+ ,au?ority 7a7 ,def9itions ,9 ?is section3 7#a7 ,accr$it$ c]tify+ ag5t ,! t]m accr$it$ c]tify+ ag5t means any p]son :o is accr$it$ by ! ,au?ority z a c]tify+ ag5t = ! purposes ( c]tify+ a specific class ( critical in=mation & communications te*nology4 7#b7 ,au?ority ,! t]m ,au?ority means ! ,national ,cyb]security ,c]tification & ,label+ ,au?ority e/abli%$ "u subsection 7b77#a74 7#c7 ,c]tification ,! t]m c]tification means a seal or symbol provid$ by ! ,au?ority or an accr$it$ c]tify+ ag5t1 t results f passage ( a compreh5sive evaluation ( an in=mation & communications te*nology t e/abli%es ! ext5t to :i* a p>ticul> design & implem5tation meets a set ( specifi$ security /&>ds4 7#d7 ,critical in=mation & communications te*nology ,! t]m critical in=mation & communications te*nology means in=mation & communications te*nology t is 9 use 9 critical infra/ructure sectors & t und]p9s ! resili5ce ( national critical functions1 z det]m9$ by ! ,secret>y4 7#e7 ,critical infra/ructure ,! t]m critical infra/ructure has ! mean+ giv5 t t]m 9 section #ajaf7;e7 ( ! ,critical ,infra/ructure ,protection ,act ( #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#f7 ,label ,! t]m label means a cle>1 visual1 & easy to und]/& symbol or li/ t conveys specific in=mation ab\t a product's security attributes1 *>act]i/ics1 functionality1 compon5ts1 or o!r features4 7#g7 ,program ,! t]m ,program means ! program adm9i/]$ "u subsection 7b77#a74 7#h7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,homel& ,security4 7b7 ,national cyb]security c]tification & label+ au?ority 7#a7 ,e/abli%m5t ,!re is e/abli%$ a ,national ,cyb]security ,c]tification & ,label+ ,au?ority = ! purpose ( e/abli%+ & adm9i/]+ a volunt>y national cyb]security c]tification & label+ program = critical in=mation & communications te*nology 9 ord] to bol/] ! resili5ce ( ! networks & critical infra/ructure ( ! ,unit$ ,/ates4 7#b7 ,programs 7,a7 ,accr$itation ( c]tify+ ag5ts ,z "p ( ! ,program1 ! ,au?ority %all def9e & publi% a process :]eby gov]nm5tal & nongov]nm5tal entities may apply to become accr$it$ c]tify+ ag5ts = ! c]tification ( specific critical in=mation & communications te*nology1 includ+-- 7i7 sm>tphones2 7ii7 tablets2 7iii7 laptop comput]s2 7iv7 op]at+ sy/ems2 7v7 r\t]s2 7vi7 s(tw>e-z-a-s]vice2 7vii7 infra/ructure-z-a-s]vice2 7viii7 plat=m-z-a-s]vice2 7ix7 programmable logic controll]s2 7x7 intellig5t electronic devices2 & 7xi7 programmable automation controll]s4 7,b7 ,id5tification ( /&>ds1 frameworks1 & b5*m>ks ,z "p ( ! ,program1 ! ,au?ority %all "w 9 coord9ation ) accr$it$ c]tify+ ag5ts1 ! ,secret>y1 & subject matt] exp]ts f ! ,f$]al ,gov]nm5t1 academia1 nongov]nm5tal organizations1 & ! private sector to id5tify & h>monize common security /&>ds1 frameworks1 & b5*m>ks aga9/ :i* ! security ( critical in=mation & communications te*nologies may be measur$4 7,c7 ,product c]tification ,z "p ( ! ,program1 ! ,au?ority1 9 consultation ) ! ,secret>y & o!r exp]ts f ! ,f$]al ,gov]nm5t1 academia1 nongov]nm5tal organizations1 & ! private sector1 %all-- 7i7 develop1 & dissem9ate to accr$it$ c]tify+ ag5ts1 guidel9es to /&>dize ! pres5tation ( c]tifications to communicate ! level ( security = critical in=mation & communications te*nologies2 7ii7 develop1 or p]mit accr$it$ c]tify+ ag5ts to develop1 c]tification crit]ia = critical in=mation & communications te*nologies bas$ on id5tifi$ security /&>ds1 frameworks1 & b5*m>ks1 ?r\gh ! "w conduct$ "u subp>agraph 7,b72 7iii7 issue1 or p]mit accr$it$ c]tify+ ag5ts to issue1 c]tifications = critical in=mation & communications te*nology t meet & comply ) security /&>ds1 frameworks1 & b5*m>ks id5tifi$ ?r\gh ! "w conduct$ "u subp>agraph 7,b72 7iv7 p]mit a manufactur] or di/ributor ( critical in=mation & communications te*nology to display a c]tificate reflect+ ! ext5t to :i* ! critical in=mation & communications te*nology meets security /&>ds1 frameworks1 & b5*m>ks id5tifi$ ?r\gh ! "w conduct$ "u subp>agraph 7,b72 7v7 remove ! c]tification ( a critical in=mation & communications te*nology z a critical in=mation & communications te*nology c]tifi$ "u ! ,program if ! manufactur] ( ! c]tifi$ critical in=mation & communications te*nology falls out ( con=mity ) ! b5*m>ks security /&>ds1 frameworks1 or b5*m>ks id5tifi$ ?r\gh ! "w conduct$ "u subp>agraph 7,b7 = ! critical in=mation & communications te*nology2 7vi7 "w to enhance public aw>5ess ( ! c]tification & label+ ef=ts ( ! ,au?ority & accr$it$ c]tify+ ag5ts1 includ+ ?r\gh public outrea*1 education1 rese>* & developm5t1 & o!r means2 & 7vii7 publicly display a li/ ( labels & c]tifi$ critical in=mation & communications te*nology1 along ) _! respective c]tification in=mation4 7,d7 ,c]tifications 7i7 ,9 g5]al ,a c]tification %all rema9 valid = #a ye> f ! date ( issuance4 7ii7 ,classes ( c]tification ,9 develop+ ! guidel9es & crit]ia requir$ "u subp>agraph 7,c77i71 ! ,au?ority %all designate at lea/ #c classes ( c]tifications1 includ+ ! foll[+3 7,i7 ,= critical in=mation & communications te*nology :i* ! product manufactur] or s]vice provid] atte/s meets ! crit]ia = a c]tification1 atte/ation-bas$ c]tification4 7,,ii7 ,= critical in=mation & communications te*nology products & s]vices t h und]gone ?ird-p>ty accr$itation ( crit]ia = c]tification1 accr$itation-bas$ c]tification4 7,,iii7 ,= critical in=mation & communications te*nology t has und]gone a security evaluation & te/+ process by a qualify+ ?ird p>ty1 z det]m9$ by ! ,au?ority1 te/-bas$ c]tification4 7,e7 ,product label+ ,! ,au?ority1 9 consultation ) ! ,secret>y & o!r exp]ts f ! ,f$]al ,gov]nm5t1 academia1 nongov]nm5tal organizations1 & ! private sector1 %all-- 7i7 collaborate ) ! private sector to /&>dize language & def9e a label+ s*ema to provide transp>5t in=mation on ! security *>act]i/ics & con/itu5t compon5ts ( a s(tw>e or h>dw>e product2 & 7ii7 e/abli% a me*anism by :i* product develop]s c provide ?is in=mation = bo? product label+ & public po/+4 7#c7 ,en=cem5t 7,a7 ,9 g5]al ,x %all be unlawful = a product manufactur]1 di/ributor1 or sell] to-- 7i7 falsely atte/ to1 or falsify an audit or te/ =1 a security /&>d1 framework1 or b5*m>k = c]tification2 7ii7 int5tionally mislabel a product2 or 7iii7 fail to ma9ta9 ! security /&>d1 framework1 or b5*m>k to :i* ! manufactur]1 di/ributor1 or sell] atte/$4 7,b7 ,en=cem5t by ,f$]al ,trade ,commission 7i7 ,unfair or deceptive acts or practices ,a violation ( subp>agraph 7,a7 %all be treat$ z an unfair & deceptive act or practice 9 violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7ii7 ,p[]s ( ,commission 7,i7 ,9 g5]al ,! ,f$]al ,trade ,commission %all en=ce ?is p>agraph 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is p>agraph4 7,,ii7 ,privileges & immunities ,any p]son :o violates ?is p>agraph %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7c7 ,selection ( ! au?ority 7#a7 ,selection ,! ,secret>y %all issue a notice ( fund+ opportunity & select1 on a competitive basis1 a nonpr(it1 nongov]nm5tal organization to s]ve z ! ,au?ority = a p]iod ( #e ye>s4 7#b7 ,eligibility = selection ,! ,secret>y may only select an organization to s]ve z ! ,au?ority if su* organization-- 7,a7 is a nongov]nm5tal1 nonpr(it organization t is-- 7i7 exempt f taxation "u section #eja7;a7 ( ! ,int]nal ,rev5ue ,code ( #aihf2 & 7ii7 describ$ 9 sections #eja7;c77#c7 & #agj7;b77#a77;,a77vi7 ( t ,code2 7,b7 has a demon/rable track record ( "w on cyb]security & in=mation security /&>ds1 frameworks1 & b5*m>ks2 & 7,c7 possesses requisite /aff+ & exp]tise1 ) demon/rable prior exp]i5ce 9 te*nology security or safety /&>ds1 frameworks1 & b5*m>ks1 z well z c]tification4 7#c7 ,application ,! ,secret>y %all e/abli% a process by :i* a nonpr(it1 nongov]nm5tal organization t seeks to be select$ z ! ,au?ority may apply = consid]ation4 7#d7 ,program evaluation ,n lat] ?an ! date t is #d ye>s aft] ! initial selection pursuant p>agraph 7#a71 & e #d ye>s !reaft]1 ! ,secret>y %all-- 7,a7 assess ! effectiv5ess ( ! labels & c]tificates produc$ by ! ,au?ority1 includ+-- 7i7 assess+ ! co/s to bus9esses t manufacture critical in=mation & communications te*nology p>ticipat+ 9 ! ,program2 7ii7 evaluat+ ! level ( p>ticipation 9 ! ,program by bus9esses t manufacture critical in=mation & communications te*nology2 & 7iii7 assess+ ! level ( public aw>5ess & consum] aw>5ess ( ! label2 7,b7 audit ! imp>tiality & fairness ( ! ,au?ority's activities conduct$ "u ?is section2 7,c7 issue a public report on ! assessm5t mo/ rec5tly c>ri$ out "u subp>agraph 7,a7 & ! audit mo/ rec5tly c>ri$ out "u subp>agraph 7,b72 & 7,d7 brief ,congress on ! f9d+s ( ! ,secret>y ) respect to ! mo/ rec5t assessm5t "u subp>agraph 7,a7 & ! mo/ rec5t audit "u subp>agraph 7,b74 7#e7 ,r5ewal ,aft] ! initial selection pursuant to p>agraph 7#a71 ! ,secret>y %all1 e #e ye>s-- 7,a7 accept applications f nonpr(it1 nongov]nm5tal organizations seek+ selection z ! ,au?ority2 & 7,b7 foll[+ competitive consid]ation ( all applications-- 7i7 r5ew ! selection ( ! organization s]v+ z ! ,au?ority2 or 7ii7 select ano!r applicant organization to s]ve z ! ,au?ority4 7d7 ,au?orization ( appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section #be1jjj1jjj = ea* ( fiscal ye>s #bjbb ?r\gh #bjbf4 #cjb4 ,e/abli% ! ,bureau ( ,cyb]security ,/ati/ics 7a7 ,def9itions ,9 ?is section3 7#a7 ,bureau ,! t]m ,bureau means ! ,bureau ( ,cyb]security ,/ati/ics e/abli%$ "u subsection 7b74 7#b7 ,cov]$ entity ,! t]m cov]$ entity means any nongov]nm5tal organization1 corporation1 tru/1 p>tn]%ip1 sole proprietor%ip1 un9corporat$ association1 or v5ture 7)\t reg>d to :e!r x is e/abli%$ = pr(it7 t is engag$ 9 or affect+ int]/ate comm]ce & t provides cyb]security incid5t response s]vices or cyb]security insurance products4 7#c7 ,cyb] incid5t ,! t]m cyb] incid5t includes ea* ( ! foll[+3 7,a7 ,unau?oriz$ access to an in=mation sy/em or network t leads to loss ( confid5tiality1 integrity1 or availability ( t in=mation sy/em or network4 7,b7 ,disruption ( bus9ess op]ations due to a di/ribut$ d5ial ( s]vice attack aga9/ an in=mation sy/em or network4 7,c7 ,unau?oriz$ access or disruption ( bus9ess op]ations due to loss ( s]vice facilitat$ ?r\gh1 or caus$ by a cl\d s]vice provid]1 manag$ s]vice provid]1 or o!r data ho/+ provid]4 7,d7 ,fraudul5t or malici\s use ( a cl\d s]vice acc\nt1 data ho/+ acc\nt1 int]net s]vice acc\nt1 or any o!r digital s]vice4 7#d7 ,director ,! t]m ,director means ! ,director ( ! ,bureau4 7#e7 ,/ati/ical purpose ,! t]m /ati/ical purpose-- 7,a7 means ! description1 e/imation1 or analysis ( ! *>act]i/ics ( gr\ps1 )\t id5tify+ ! individuals or organizations t comprise su* gr\ps2 & 7,b7 includes ! developm5t1 implem5tation1 or ma9t5ance ( me?ods1 te*nical or adm9i/rative proc$ures1 or in=mation res\rces t support ! purposes describ$ 9 subsection 7e74 7b7 ,e/abli%m5t ,!re is e/abli%$ )9 ! ,dep>tm5t ( ,homel& ,security a ,bureau ( ,cyb]security ,/ati/ics4 7c7 ,director 7#a7 ,9 g5]al ,! ,bureau %all be head$ by a ,director1 :o %all-- 7,a7 report to ! ,secret>y ( ,homel& ,security2 & 7,b7 be appo9t$ by ! ,presid5t4 7#b7 ,au?ority ,! ,director %all-- 7,a7 h f9al au?ority = all coop]ative agreem5ts & contracts aw>d$ by ! ,bureau2 7,b7 be responsible = ! integrity ( data & /ati/ics collect$ or issu$ by ! ,bureau2 & 7,c7 protect aga9/ improp] or illegal use or disclosure ( in=mation furni%$ = exclusively /ati/ical purposes "u ?is section1 consi/5t ) ! requirem5ts ( subsection 7f74 7#c7 ,qualifications ,! ,director-- 7,a7 %all h exp]i5ce 9 /ati/ical programs2 & 7,b7 %all n-- 7i7 engage 9 any o!r employm5t2 or 7ii7 hold any (fice 91 or act 9 any capacity =1 any organization1 ag5cy1 or in/itution ) :i* ! ,bureau makes any contract or o!r arrangem5t "u ?is section4 7#d7 ,duties & functions ,! ,director %all-- 7,a7 collect & analyze in=mation conc]n+ cyb]security1 includ+ data relat$ to cyb] incid5ts1 cyb] crime1 & any o!r area ! ,director det]m9es appropriate2 7,b7 collect & analyze data t w s]ve z a cont9u\s & comp>able national indication ( ! preval5ce1 incid5ts1 rates1 ext5t1 di/ribution1 & attributes ( all relevant cyb] incid5ts1 z det]m9$ by ! ,director1 9 support ( national policy & decision mak+2 7,c7 compile1 collate1 analyze1 publi%1 & dissem9ate uni=m national cyb] /ati/ics conc]n+ any area t ! ,director det]m9es appropriate2 7,d7 9 coord9ation ) ! ,national ,in/itute ( ,/&>ds & ,te*nology1 recomm5d national /&>ds1 metrics1 & measurem5t crit]ia = cyb] /ati/ics & = ensur+ ! reliability & validity ( /ati/ics collect$ pursuant to ?is subsection2 7,e7 conduct or support rese>* relat+ to me?ods ( ga!r+ or analyz+ cyb] /ati/ics2 7,f7 ent] into coop]ative agreem5ts or contracts ) public ag5cies1 in/itutions ( high] education1 or private organizations = purposes relat$ to ?is subsection2 7,g7 provide appropriate in=mation to ! ,presid5t1 ! ,congress1 ,f$]al ag5cies1 ! private sector1 & ! g5]al public on cyb] /ati/ics2 7,h7 ma9ta9 liaison ) ,/ate & local gov]nm5ts conc]n+ cyb] /ati/ics2 7,i7 conf] & coop]ate ) ,f$]al /ati/ical ag5cies z ne$$ to c>ry out ! purposes ( ?is section1 includ+ by ent]+ into coop]ative data %>+ agreem5ts 9 con=mity ) all laws & regulations applicable to ! disclosure & use ( data2 & 7,j7 reque/ f any p]son or entity in=mation1 data1 & reports z may be requir$ to c>ry out ! purposes ( ?is subsection4 7d7 ,furni%m5t ( in=mation1 data1 or reports by ,f$]al dep>tm5ts & ag5cies ,f$]al dep>tm5ts & ag5cies reque/$ by ! ,director to furni% in=mation1 data1 or reports pursuant to subsection 7c77#d77;,j7 %all provide to ! ,bureau su* in=mation z ! ,director det]m9es necess>y to c>ry out ! purposes ( ?is section4 7e7 ,furni%m5t ( cyb] incid5t in=mation1 data1 or reports to ! bureau by ! private sector 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 & e #ahj days !reaft]1 ea* cov]$ entity %all submit to ! ,bureau a report conta9+ su* data & in=mation z ! ,director det]m9es necess>y to c>ry out ! purposes ( ?is section4 7#b7 ,det]m9ation ( data & in=mation necess>y to c>ry out ! purposes ( ?is section ,n lat] ?an #ij days aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft]1 ! ,director %all publi% a li/ ( data & in=mation det]m9$ necess>y to c>ry out ! purposes ( ?is section1 includ+ individual descriptions ( cyb] incid5ts1 :i* %all include-- 7,a7 id5tification ( ! affect$ databases1 in=mation sy/ems1 or devices t 71 or are reasonably believ$ to h be5 access$ by an unau?oriz$ p]son2 7,b7 :]e applicable1 a description ( ! vuln]abilities1 tactics1 te*niques1 & proc$ures us$2 7,c7 :]e applicable1 any id5tify+ in=mation relat$ to ! malici\s actors :o p]petrat$ ! incid5t2 7,d7 :]e applicable any cyb]security controls implem5t$ by ! victim organization2 & 7,e7 ! indu/rial sectors1 regions1 & size ( affect$ entities 7z det]m9$ by numb] ( employees7 )\t provid+ any in=mation t c reasonably be expect$ to id5tify su* entities4 7#c7 ,/&>ds = submission ( in=mation & data ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all1 9 consultation ) cov]$ entities1 develop /&>diz$ proc$ures = ! submission ( data & in=mation ! ,director det]m9es necess>y to c>ry out ! purposes ( ?is section4 7#d7 ,private sector report+ ,n lat] ?an #ij days aft] ! date on :i* ! ,director develops ! /&>ds requir$ "u p>agraph 7#c71 ! ,director %all-- 7,a7 publi% ! processes = submission ( in=mation1 data1 & reports by cov]$ entities2 & 7,b7 beg9 accept+ report+ requir$ "u p>agraph 7#a74 7#e7 ,regulatory use ,in=mation disclos$ to ! ,bureau "u ?is section t is n o!rwise available1 %all n be us$ by ! ,f$]al ,gov]nm5t or any ,/ate1 local1 tribal1 or t]ritorial gov]nm5t to sanction or o!rwise puni% ! entity disclos+ ! in=mation1 or ! entity 9 :i* ! cyb] incid5t initially occurr$4 7#f7 ,pres]vation ( privilege ,disclosure ( in=mation pursuant to ?is section or by a cov]$ entity to ! ,bureau %all n waive any o!rwise applicable privilege1 immunity1 or protection provid$ by law4 7#g7 ,pres]vation ( exi/+ obligations ,no?+ 9 ?is section %all modify1 prev5t1 or abrogate any notice or notification obligations "u ,f$]al contracts1 en=ceable agreem5ts ) ! gov]nm5t1 or o!r ,f$]al law4 7#h7 ,en=cem5t 7,a7 ,unfair or deceptive acts or practices ,compliance ) ! requirem5ts impos$ "u ?is subsection by cov]$ entities %all be en=c$ by ! ,f$]al ,trade ,commission "u ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 ,= ! purpose ( ! ex]cise by ! ,f$]al ,trade ,commission ( its functions & p[]s "u ! ,f$]al ,trade ,commission ,act1 a violation ( any requirem5t or prohibition impos$ "u ?is subsection %all be treat$ z an unfair & deceptive act or practice 9 violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7,b7 ,p[]s ( ,commission ,subject to subp>agraph 7,c71 ! ,f$]al ,trade ,commission %all en=ce ?is subsection 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is subsection4 7,c7 ,additional entities 7i7 ,9 g5]al ,not)/&+ sections #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd1 #de7;a77#b71 #df7 or any jurisdictional limitation ( ! ,f$]al ,trade ,commission1 ! ,f$]al ,trade ,commission %all also en=ce ?is subsection1 9 ! same mann] provid$ 9 subp>agraph 7,a7 ( ?is p>agraph1 ) respect to-- 7,i7 organizations n organiz$ to c>ry on bus9ess = _! own pr(it or t ( _! memb]s2 & 7,,ii7 common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq474 7ii7 ,coord9ation & notice ,! ,f$]al ,trade ,commission %all-- 7,i7 coord9ate ) ! ,f$]al ,communications ,commission reg>d+ en=cem5t ( ?is subsection ) respect to common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq472 7,,ii7 notify ! ,bureau ( ,consum] ,f9ancial ,protection reg>d+ en=cem5t ( ?is subsection ) respect to in=mation associat$ ) ! provision ( f9ancial products or s]vices by an entity t provides a consum] f9ancial product or s]vice 7z def9$ 9 section #ajjb ( ! ,consum] ,f9ancial ,protection ,act ( #bjaj 7#ab ,u4,s4,c4 #edha772 & 7,,iii7 = en=cem5t ( ?is subsection ) respect to matt]s implicat+ ! jurisdiction or au?orities ( ano!r ,f$]al ag5cy1 notify t ag5cy z appropriate4 7,d7 ,privileges & immunities ,any cov]$ entity t violates ! requirem5ts impos$ "u ?is subsection %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq474 7,e7 ,con/ruction ,no?+ 9 ?is p>agraph %all be con/ru$ to limit ! au?ority ( ! ,f$]al ,trade ,commission "u any o!r provision ( law4 7f7 ,protection ( in=mation 7#a7 ,9 g5]al ,no (fic] or employee ( ! ,f$]al ,gov]nm5t or ag5t ( ! ,f$]al ,gov]nm5t may1 )\t ! cons5t ( ! individual1 entity1 ag5cy1 or o!r p]son :o is ! subject ( ! submission or provides ! submission-- 7,a7 use any submission t is furni%$ = exclusively /ati/ical purposes "u ?is section = any purpose o!r ?an ! /ati/ical purposes = :i* ! submission is furni%$2 7,b7 make any publication or m$ia transmittal ( ! data conta9$ 9 a submission describ$ 9 subp>agraph 7,a7 t p]mits in=mation conc]n+ individual entities or individual incid5ts to be reasonably inf]r$ by ei!r direct or indirect means2 or 7,c7 p]mit anyone o!r ?an a sworn (fic]1 employee1 ag5t1 or contractor ( ! ,bureau to exam9e an individual submission describ$ 9 subsection 7e74 7#b7 ,immunity f legal process ,any submission 7includ+ any data d]iv$ f ! submission7 t is collect$ & reta9$ by ! ,bureau1 or an (fic]1 employee1 ag5t1 or contractor ( ! ,bureau1 = exclusively /ati/ical purposes "u ?is section %all be immune f ! legal process & %all n1 )\t ! cons5t ( ! individual1 entity1 ag5cy1 or o!r p]son :o is ! subject ( ! submission or provides ! submission1 be admitt$ z evid5ce or us$ = any purpose 9 any action1 suit1 or o!r judicial or adm9i/rative proce$+4 7#c7 ,rule ( con/ruction ,no?+ 9 ?is subsection %all be con/ru$ to provide immunity f ! legal process = a submission 7includ+ any data d]iv$ f ! submission7 if ! submission is 9 ! possession ( any p]son1 ag5cy1 or entity o!r ?an ! ,bureau or an (fic]s1 employee1 ag5t1 or contractor ( ! ,bureau1 or if ! submission is indep5d5tly collect$1 reta9$1 or produc$ = purposes o!r ?an ! purposes ( ?is section4 7g7 ,au?orization ( appropriation ,!re are au?oriz$ to be appropriat$ su* sums z may be necess>y to c>ry out ?is section4 ,su* funds %all rema9 available until exp5d$4 #cjc4 ,secure f\ndational int]net protocols 7a7 ,def9itions ,9 ?is section3 7#a7 ,bord] gateway protocol ,! t]m bord] gateway protocol means a protocol design$ to optimize r\t+ ( in=mation ex*ang$ ?r\gh ! int]net4 7#b7 ,doma9 "n sy/em ,! t]m doma9 "n sy/em means a sy/em t /ores in=mation associat$ ) doma9 names 9 a di/ribut$ database on networks4 7#c7 ,in=mation & communications te*nology infra/ructure provid]s ,! t]m in=mation & communications te*nology infra/ructure provid]s means all sy/ems t enable connectivity & op]ability ( int]net s]vice1 backbone1 cl\d1 web ho/+1 cont5t deliv]y1 doma9 "n sy/em1 & s(tw>e-def9$ networks & o!r sy/ems & s]vices4 7b7 ,creation ( a /rategy ,to secure f\ndational int]net protocols 7#a7 ,protocol security /rategy ,9 ord] to secure f\ndational int]net protocols1 n lat] ?an ,decemb] #ca1 #bjba1 ! ,national ,telecommunications & ,in=mation ,adm9i/ration & ! ,dep>tm5t ( ,homel& ,security %all submit to ,congress a /rategy to secure ! bord] gateway protocol & ! doma9 "n sy/em4 7#b7 ,/rategy requirem5ts ,! /rategy requir$ "u p>agraph 7#a7 %all-- 7,a7 articulate ! security & privacy b5efits ( implem5t+ security = ! bord] gateway protocol & ! doma9 "n sy/em & ! burd5s ( implem5tation & ! entities on :om ^? burd5s w mo/ likely fall2 7,b7 id5tify key ,unit$ ,/ates & int]national /akehold]s2 7,c7 outl9e id5tifi$ security measures t c\ld be us$ to secure or provide au!ntication = ! bord] gateway protocol & ! doma9 "n sy/em2 7,d7 id5tify any b>ri]s to implem5t+ security = ! bord] gateway protocol & ! doma9 "n sy/em at scale2 7,e7 propose a /rategy to implem5t id5tifi$ security measures at scale1 acc\nt+ = b>ri]s to implem5tation & balanc+ b5efits & burd5s1 :]e feasible2 & 7,f7 provide an initial e/imate ( ! total co/ to ! ,gov]nm5t & implem5t+ entities 9 ! private sector ( implem5t+ security = ! bord] gateway protocol & ! doma9 "n sy/em & propose recomm5dations = defray+ ^! co/s1 if applicable4 7#c7 ,consultation ,9 develop+ ! /rategy requir$ "u p>agraph 7#a7 ! ,national ,telecommunications & ,in=mation ,adm9i/ration & ! ,dep>tm5t ( ,homel& ,security %all consult ) in=mation & communications te*nology infra/ructure provid]s1 civil society organizations1 relevant nonpr(it organizations1 & academic exp]ts4 ,,iv ,sy/emically ,important ,critical ,infra/ructure #dja4 ,def9itions ,9 ?is title3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives4 7#b7 ,critical infra/ructure ,! t]m critical infra/ructure has ! mean+ giv5 t t]m 9 section #ajaf7;e7 ( ! ,critical ,infra/ructure ,protection ,act ( #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7#c7 ,dep>tm5t ,! t]m ,dep>tm5t means ! ,dep>tm5t ( ,homel& ,security4 7#d7 ,entity ,! t]m entity means a non-,f$]al entity & a private entity1 z su* t]ms are def9$ "u section #ajb ( ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 7#e7 ,national critical functions ,! t]m national critical functions means functions ( gov]nm5t & ! private sector s vital to ! ,unit$ ,/ates t _! disruption1 corruption1 or dysfunction w\ld h a debilitat+ effect on security1 national economic security1 national public heal? or safety1 or any comb9ation !re(4 7#f7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,homel& ,security4 7#g7 ,/akehold]s ,! t]m /akehold]s means p]sons or gr\ps ^: consultation may aid ! ,secret>y 9 ex]cis+ ! au?ority ( ! ,secret>y "u ?is title1 includ+-- 7,a7 ,sector ,coord9at+ ,c\ncils )9 ! ,critical ,infra/ructure ,p>tn]%ip ,advisory ,c\ncil1 e/abli%$ "u section #hga ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #dea72 7,b7 ! ,/ate1 ,local1 ,tribal & ,t]ritorial ,gov]nm5t ,coord9at+ ,c\ncil1 )9 ! ,critical ,infra/ructure ,p>tn]%ip ,advisory ,c\ncil1 e/abli%$ "u section #hga ( ! ,homel& ,security ,act ( #bjjb 7#f4,u4,s4,c4 #dea72 7,c7 ! ,cyb]security ,advisory ,committee e/abli%$ "u section #bbai ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffe;e71 z s r$esignat$ by section #aja ( ?is ,act2 7,d7 ! ,national ,security ,telecommunications ,advisory ,committee e/abli%$ pursuant to ,executive ,ord] #abchb 7#dg ,f$4 ,reg4 #djeca72 & 7,e7 ! ,national ,infra/ructure ,advisory ,c\ncil1 e/abli%$ pursuant to ,executive ,ord] #acbca 7#ff ,f$4 ,reg4 #ecjfc74 7#h7 ,sy/emically important critical infra/ructure ,! t]m ,sy/emically ,important ,critical ,infra/ructure means an entity t has be5 designat$ z su* by ! ,secret>y ?r\gh ! process & proc$ures e/abli%$ "u section #djb4 #djb4 ,sy/emically ,important ,critical ,infra/ructure 7a7 ,9 g5]al ,! ,secret>y may designate entities z ,sy/emically ,important ,critical ,infra/ructure4 7b7 ,e/abli%m5t ( me?odology & crit]ia ,prior to designat+ any entities z ,sy/emically ,important ,critical ,infra/ructure1 ! ,secret>y1 9 consultation ) ! ,national ,cyb] ,director1 ,sector ,risk ,managem5t ,ag5cies1 & appropriate /akehold]s %all develop-- 7#a7 a me?odology = id5tify+ ,sy/emically ,important ,critical ,infra/ructure2 & 7#b7 crit]ia = det]m9+ :e!r an entity qualifies z ,sy/emically ,important ,critical ,infra/ructure4 7c7 ,consid]ations ,9 e/abli%+ crit]ia = det]m9+ :e!r an entity qualifies z ,sy/emically ,important ,critical ,infra/ructure1 ! ,secret>y %all consid]-- 7#a7 ! likelihood t disruption to or compromise ( su* an entity c\ld cause a debilitat+ effect on national security1 economic security1 public heal? or safety1 or any comb9ation !re(2 7#b7 ! ext5t to :i* damage1 disruption1 or unau?oriz$ access to su* an entity ei!r sep>ately or collectively1 w disrupt ! reliable op]ation ( o!r critical infra/ructure assets1 or imp$e provision+ ( "o or m national critical functions2 7#c7 ! ext5t to :i* national cyb]security resili5ce w\ld be enhanc$ by deep] risk managem5t integration betwe5 ,sy/emically ,important ,critical ,infra/ructure entities & ! ,f$]al ,gov]nm5t2 & 7#d7 ! ext5t to :i* compromise or unau?oriz$ access ( su* an entity c\ld sep>ately or collectively create widespread compromise ( ! cyb] ecosy/em1 significant portions ( critical infra/ructure1 or multiple critical infra/ructure sectors4 7d7 ,li/ 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all complete an initial li/ ( entities designat$ z ,sy/emically ,important ,critical ,infra/ructure4 7#b7 ,ma9t5ance ( li/ ,! ,secret>y %all ma9ta9 a compreh5sive li/ ( entities designat$ z ,sy/emically ,important ,critical ,infra/ructure1 :i* %all be updat$ )9 #g days ( a *ange 9 :e!r an entity qualifies z ,sy/emically ,important ,critical ,infra/ructure4 7e7 ,entity notifications ,n lat] ?an #ij days aft] designat+ an entity z ,sy/emically ,important ,critical ,infra/ructure or remov+ ! designation ( an entity z ,sy/emically ,important ,critical ,infra/ructure1 ! ,secret>y %all notify ! entity4 7f7 ,congressional notifications ,! ,secret>y %all-- 7#a7 n lat] ?an #cj days aft] ! date ( any addition1 modification1 or removal ( an entity f ! li/ ( ,significantly ,important ,critical ,infra/ructure ma9ta9$ "u subsection 7d71 notify ! appropriate ,congressional committees2 & 7#b7 at lea/ e #b ye>s1 submit to ! appropriate ,congressional committees an updat$ compreh5sive li/ ( entities designat$ z ,sy/emically ,important ,critical ,infra/ructure1 9 conjunction ) ea* plan requir$ pursuant to section #djc4 #djc4 ,plan = enhancem5t ( ,sy/emically ,important ,critical ,infra/ructure me?odology & capability 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 & e #b ye>s !reaft] = #aj ye>s1 ! ,secret>y1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies & appropriate /akehold]s1 %all develop & submit to ! appropriate congressional committees a plan = enhanc+ ! me?odology ( ! ,dep>tm5t = id5tify+ ,sy/emically ,important ,critical ,infra/ructure1 includ+ a discussion ( ! progress ( ! ,dep>tm5t z ( ! date ( submission ( ! plan 9 implem5t+ ! plan4 7b7 ,cont5ts ( plan 7#a7 ,9 g5]al ,! plan requir$ "u subsection 7a7 %all include-- 7,a7 ! me?odology & crit]ia us$ = id5tify+ & det]m9+ entities t qualify z ,sy/emically ,important ,critical ,infra/ructure z describ$ 9 section #djb7;b7 & ! analysis us$ to e/abli% su* me?odology & crit]ia2 7,b7 a propos$ timel9e = enhanc+ ! capabilities ( ! ,dep>tm5t to exp& ! li/ beyond ! designat$ entities to also include facilities1 sy/ems1 assets1 or o!r relevant units ( critical infra/ructure t may fur!r enhance ! ability to manage risk ( ,sy/emically ,important ,critical ,infra/ructure2 7,c7 in=mation reg>d+ ! outrea* by ! ,dep>tm5t to /akehold]s & o!r ,sector ,risk ,managem5t ,ag5cies on su* ef=ts1 includ+ me*anisms = incorporation ( indu/ry fe$back2 7,d7 in=mation reg>d+ ! ef=ts ( ! ,dep>tm5t1 & ! associat$ *all5ges ) su* ef=ts1 to access in=mation f /akehold]s & o!r ,sector ,risk ,managem5t ,ag5cies to id5tify ,sy/emically ,important ,critical ,infra/ructure2 7,e7 in=mation reg>d+ o!r critical infra/ructure entity id5tification programs )9 ! ,dep>tm5t & h[ !y are be+ incorporat$ into ! ov]>*+ process to id5tify ,sy/emically ,important ,critical ,infra/ructure1 :i* %all include ! ef=ts ( ! ,dep>tm5t "u section #i ( ,executive ,ord] #acfcf 7#gh ,f$4 ,reg4 #aagci71 ! ,national ,infra/ructure ,prioritization ,program1 & section #d ( ,executive ,ord] #adjbh 7#hf ,f$4 ,reg4 #bffcc72 7,f7 any id5tifi$ gaps 9 au?orities or res\rces requir$ to successfully c>ry out ! process ( id5tify+ ,sy/emically ,important ,critical ,infra/ructure1 includ+ facilities1 sy/ems1 assets1 or o!r relevant units ( critical infra/ructure1 z well z legislative proposals to address su* gaps2 7,g7 an assessm5t ( pot5tial b5efits = entities designat$ z ,sy/emically ,important ,critical ,infra/ructure1 :i* %all include an assessm5t (-- 7i7 enhanc$ intellig5ce support & in=mation %>+2 7ii7 prioritiz$ ,f$]al te*nical assi/ance2 7iii7 liability protection = entities designat$ z ,sy/emically ,important ,critical ,infra/ructure t con=m to id5tifi$ security /&>ds = damages or h>m directly or indirectly caus$ by a cyb] incid5t2 7iv7 prioritiz$ em]g5cy plann+2 7v7 b5efits describ$ 9 ! f9al report ( ! ,u4,s4 ,cyb]space ,sol>ium ,commission1 dat$ ,m>* #bjbj2 & 7vi7 additional au?orizations or res\rces necess>y to implem5t ! b5efits assess$ "u ?is subp>agraph2 & 7,h7 an assessm5t ( pot5tial me*anisms to improve ! security ( entities designat$ z ,sy/emically ,important ,critical ,infra/ructure1 :i* %all include an assessm5t (-- 7i7 risk-bas$ cyb]security p]=mance /&>ds = all ,sy/emically ,important ,critical ,infra/ructure entities1 incorporat+1 to ! greate/ ext5t possible1 exi/+ indu/ry be/ practices1 /&>ds1 & guidel9es2 7ii7 sector-specific p]=mance /&>ds2 7iii7 additional regulations to enhance ! security ( ,sy/emically ,important ,critical ,infra/ructure aga9/ cyb] risks1 includ+ h[ to prev5t duplicative requirem5ts = already regulat$ sectors2 7iv7 cyb] incid5t report+ requirem5ts = entities designat$ z ,sy/emically ,important ,critical ,infra/ructure2 & 7v7 additional au?orizations or res\rces necess>y to implem5t ! me*anisms to improve ! security ( ,sy/emically ,important ,critical ,infra/ructure assess$ "u ?is subp>agraph4 7#b7 ,initial plan ,! initial plan submitt$ "u ?is section %all include a detail$ description ( ! capabilities ( ! ,dep>tm5t ) respect to id5tify+ ,sy/emically ,important ,critical ,infra/ructure z !y 7 on ! date ( enactm5t ( ?is ,act4 7c7 ,classifi$ annex ,! plan %all be 9 unclassifi$ =m1 b may include a classifi$ annex1 z ! ,secret>y det]m9es necess>y4 7d7 ,publication ,n lat] ?an #cj days aft] ! date on :i* ! ,secret>y submits a plan to ,congress1 ! ,secret>y %all make ! plan available to relevant /akehold]s4 7e7 ,re/riction ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 %all n apply to any action to implem5t ?is section or to any ex]cise ( ! au?ority ( ! ,secret>y pursuant to ?is section4 ,v ,enabl+ ! ,national ,cyb] ,director #eja4 ,e/abli%m5t ( hir+ au?orities = ! ,(fice ( ! ,national ,cyb] ,director ,section #ageb ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7,public ,law #aaf-bhc7 is am5d$-- 7#a7 9 subsection 7e7-- 7,a7 9 p>agraph 7#a71 by ins]t+ & 9 accordance ) p>agraphs 7#c7 ?r\gh 7#g7 ( ?is subsection1 aft] & classification laws12 7,b7 9 p>agraph 7#b71 by ins]t+ not)/&+ p>agraphs 7#c7 ?r\gh 7#g7 ( ?is subsection1 be=e employ exp]ts2 7,c7 by r$esignat+ p>agraphs 7#c7 ?r\gh 7#h7 z p>agraphs 7#h7 ?r\gh 7#ac71 respectively2 & 7,d7 by ins]t+ aft] p>agraph 7#b7 ! foll[+3 7#c7 e/abli%1 z positions 9 ! except$ s]vice1 su* qualifi$ positions 9 ! ,(fice z ! ,director det]m9es necess>y to c>ry out ! responsibilities ( ! ,(fice1 appo9t an individual to a qualifi$ position 7aft] tak+ into consid]ation ! availability ( pref]5ce eligibles = appo9tm5t to ! position71 &1 subject to ! requirem5ts ( p>agraphs 7#d7 & 7#e71 fix ! comp5sation ( an individual = s]vice 9 a qualifi$ position2 7#d7 fix ! rates ( basic pay = any qualifi$ position e/abli%$ "u p>agraph 7#c7 9 relation to ! rates ( pay provid$ = employees 9 comp>able positions 9 ! ,(fice1 9 :i* ! employee occupy+ ! comp>able position p]=ms1 manages1 or sup]vises functions t execute ! mission ( ! ,(fice1 &1 subject to ! same limitations on maximum rates ( pay & consi/5t ) section #ecda ( title #e1 ,unit$ ,/ates ,code1 adopt su* provisions ( t title to provide = prevail+ rate sy/ems ( basic pay & apply ^? provisions to qualifi$ positions = employees 9 or "u :i* ! ,(fice may employ individuals describ$ by section #ecdb7;a77#b77;,a7 ( su* title2 7#e7 employ an (fic] or employee ( ! ,unit$ ,/ates or memb] ( ! ,arm$ ,=ces detail$ to ! /aff ( ! ,(fice on a non-reimbursable basis-- 7,a7 z jo9tly agre$ to by ! heads ( ! receiv+ & detail+ elem5ts1 = a p]iod n to exce$ #c ye>s2 7,b7 :i* %all n be con/ru$ to limit any o!r s\rce ( au?ority = reimbursable or non-reimbursable details2 & 7,c7 :i* %all n be consid]$ an augm5tation ( ! appropriations ( ! receiv+ elem5t ( ! ,(fice2 7#f7 provide-- 7,a7 employees 9 qualifi$ positions comp5sation 79 addition to basic pay71 includ+ b5efits1 inc5tives1 & all[ances1 consi/5t )1 & n 9 excess ( ! level au?oriz$ =1 comp>able positions au?oriz$ by title #e1 ,unit$ ,/ates ,code2 & 7,b7 employees 9 a qualifi$ position ^: rate ( basic pay is fix$ "u p>agraph 7#d7 an all[ance "u section #eida ( title #e1 ,unit$ ,/ates ,code1 on ! same basis & to ! same ext5t z if ! employee 0 an employee cov]$ by su* section1 includ+ eligibility conditions1 all[ance rates1 & all o!r t]ms & conditions 9 law or regulation2 7#g7 e/abli% a fell[%ip program to facilitate a tal5t ex*ange program betwe5 ! private sector & ! ,(fice to arrange1 ) ! agreem5t ( a private sector organization & ! cons5t ( ! employee1 = ! tempor>y assignm5t ( an employee to ! private sector organization1 or f ! private sector organization to ! ,(fice2 2 & 7#b7 9 subsection 7g7-- 7,a7 by r$esignat+ p>agraphs 7#c7 ?r\gh 7#f7 z p>agraphs 7#d7 ?r\gh 7#g71 respectively2 7,b7 by ins]t+ aft] p>agraph 7#b7 ! foll[+3 7#c7 ,! t]m except$ s]vice has ! mean+ giv5 t t]m 9 section #bajc ( title #e1 ,unit$ ,/ates ,code4 2 & 7#c7 by add+ at ! end ! foll[+3 7#h7 ,! t]m pref]5ce eligible has ! mean+ giv5 t t]m 9 section #bajh7c7 ( title #e1 ,unit$ ,/ates ,code4 7#i7 ,! t]m qualifi$ position means a position1 designat$ by ! ,director = ! purpose ( ?is section1 9 :i* ! individual occupy+ su* position p]=ms1 manages1 or sup]vises functions t execute ! responsibilities ( ! ,(fice4 4