,,ii #aagth ,,congress #ast ,session ,s4 #bhge ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bh1 #bjba ,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to establish the ,cyber ,incident ,review ,office in the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cyber ,incident ,reporting ,act of #bjba4 #b4 ,definitions ,in this ,act3 7#a7 ,covered cyber incident2 covered entity2 cyber incident ,the terms covered cyber incident1 covered entity1 and cyber incident have the meanings given those terms in section #bbcj of the ,homeland ,security ,act of #bjjb1 as added by section #c7;b7 of this ,act4 7#b7 ,cyber attack2 ransom payment2 ransomware attack ,the terms cyber attack1 ransom payment1 and ransomware attack have the meanings given those terms in section #bbja of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea71 as amended by section #c7;a7 of this ,act4 7#c7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,information system2 security vulnerability ,the terms information system and security vulnerability have the meanings given those terms in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 #c4 ,cyber incident reporting 7a7 ,definitions 7#a7 ,in general ,section #bbja of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea7 is amended-- 7,a7 by redesignating paragraphs 7#a71 7#b71 7#c71 7#d71 7#e71 and 7#f7 as paragraphs 7#b71 7#d71 7#e71 7#g71 7#aj71 and 7#aa71 respectively2 7,b7 by inserting before paragraph 7#b71 as so redesignated1 the following3 7#a7 ,cloud service provider ,the term cloud service provider means an entity offering products or services related to cloud computing1 as defined by the ,national ,institutes of ,standards and ,technology in ,,nist ,special ,publication #hjj-ade and any amendatory or superseding document relating thereto4 2 7,c7 by inserting after paragraph 7#b71 as so redesignated1 the following3 7#c7 ,cyber attack ,the term cyber attack means the use of unauthorized or malicious code on an information system1 or the use of another digital mechanism such as a denial of service attack1 to interrupt or disrupt the operations of an information system or compromise the confidentiality1 availability1 or integrity of electronic data stored on1 processed by1 or transiting an information system4 2 7,d7 by inserting after paragraph 7#e71 as so redesignated1 the following3 7#f7 ,managed service provider ,the term managed service provider means an entity that delivers services1 such as network1 application1 infrastructure1 or security services1 via ongoing and regular support and active administration on the premises of a customer1 in the data center of the entity 7such as hosting71 or in a third-party data center4 2 7,e7 by inserting after paragraph 7#g71 as so redesignated1 the following3 7#h7 ,ransom payment ,the term ransom payment means the transmission of any money or other property or asset1 including virtual currency1 or any portion thereof1 which has at any time been delivered as ransom in connection with a ransomware attack4 7#i7 ,ransomware attack ,the term ransomware attack-- 7,a7 means a cyber attack that includes the threat of use of unauthorized or malicious code on an information system1 or the threat of use of another digital mechanism such as a denial of service attack1 to interrupt or disrupt the operations of an information system or compromise the confidentiality1 availability1 or integrity of electronic data stored on1 processed by1 or transiting an information system to extort a demand for a ransom payment2 and 7,b7 does not include any such event where the demand for payment is made by a ,federal ,government entity1 good-faith security research1 or in response to an invitation by the owner or operator of the information system for third parties to identify vulnerabilities in the information system4 2 and 7,f7 by adding at the end the following3 7#ac7 ,supply chain compromise ,the term supply chain compromise means a cyber attack that allows an adversary to utilize implants or other vulnerabilities inserted prior to installation in order to infiltrate data1 or manipulate information technology hardware1 software1 operating systems1 peripherals 7such as information technology products71 or services at any point during the life cycle4 7#ad7 ,virtual currency ,the term virtual currency means the digital representation of value that functions as a medium of exchange1 a unit of account1 or a store of value4 7#ae7 ,virtual currency address ,the term virtual currency address means a unique public cryptographic key identifying the location to which a virtual currency payment can be made4 4 7#b7 ,conforming amendment ,section #ijjb7;,a77#g7 of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #feb;a7a77#g77 is amended to read as follows3 7#g7 ,sector ,risk ,management ,agency ,the term ,sector ,risk ,management ,agency has the meaning given the term in section #bbja of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea74 4 7b7 ,cyber incident reporting ,title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 ,c ,cyber ,incident ,reporting #bbcj4 ,definitions 7a7 ,in general ,except as provided in subsection 7b71 the definitions under section #bbja shall apply to this subtitle4 7b7 ,additional definitions ,in this subtitle3 7#a7 ,council ,the term ,council means the ,cyber ,incident ,reporting ,council described in section #ageb7;c77#a77;,h7 of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h774 7#b7 ,covered cyber incident ,the term covered cyber incident means a substantial cyber incident experienced by a covered entity that satisfies the definition and criteria established by the ,director in the interim final rule and final rule issued pursuant to section #bbcb4 7#c7 ,covered entity ,the term covered entity means an entity that owns or operates critical infrastructure that satisfies the definition established by the ,director in the interim final rule and final rule issued pursuant to section #bbcb4 7#d7 ,cyber incident ,the term cyber incident has the meaning given the term incident in section #bbji7;a74 7#e7 ,cyber threat ,the term cyber threat-- 7,a7 has the meaning given the term cybersecurity threat in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja72 and 7,b7 does not include any activity related to good faith security research1 including participation in a bug-bounty program or a vulnerability disclosure program4 7#f7 ,cyber threat indicator2 cybersecurity purpose2 defensive measure2 ,federal entity2 information system2 security control2 security vulnerability ,the terms cyber threat indicator1 cybersecurity purpose1 defensive measure1 ,federal entity1 information system1 security control1 and security vulnerability have the meanings given those terms in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#g7 ,small business ,the term small business-- 7,a7 means a business with fewer than #ej employees 7determined on a full-time equivalent basis72 and 7,b7 does not include-- 7i7 a business that is a covered entity2 or 7ii7 a business that holds a government contract1 unless that contractor is a party only to-- 7,i7 a service contract to provide housekeeping or custodial services2 or 7,,ii7 a contract to provide products or services unrelated to information technology that is below the micro-purchase threshold1 as defined in section #b4aja of title #dh1 ,code of ,federal ,regulations1 or any successor regulation4 #bbca4 ,cyber ,incident ,review ,office 7a7 ,cyber ,incident ,review ,office ,there is established in the ,agency a ,cyber ,incident ,review ,office 7in this section referred to as the ,office7 to receive1 aggregate1 and analyze reports related to covered cyber incidents submitted by covered entities in furtherance of the activities specified in subsection 7c7 of this section and sections #bbjb7;e71 #bbjc1 and #bbji7;c7 and any other authorized activity of the ,director to enhance the situational awareness of cyber threats across critical infrastructure sectors4 7b7 ,activities ,the ,office shall1 in furtherance of the activities specified in sections #bbjb7;e71 #bbjc1 and #bbji7;c7-- 7#a7 receive1 aggregate1 analyze1 and secure1 consistent with the requirements under the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq47 reports from covered entities related to a covered cyber incident to assess the effectiveness of security controls and identify tactics1 techniques1 and procedures adversaries use to overcome those controls2 7#b7 receive1 aggregate1 analyze1 and secure reports related to ransom payments to identify tactics1 techniques1 and procedures1 including identifying and tracking ransom payments utilizing virtual currencies1 adversaries use to perpetuate ransomware attacks and facilitate ransom payments2 7#c7 leverage information gathered about cybersecurity incidents to-- 7,a7 enhance the quality and effectiveness of information sharing and coordination efforts with appropriate entities1 including agencies1 sector coordinating councils1 information sharing and analysis organizations1 technology providers1 cybersecurity and incident response firms1 and security researchers2 and 7,b7 provide appropriate entities1 including agencies1 sector coordinating councils1 information sharing and analysis organizations1 technology providers1 cybersecurity and incident response firms1 and security researchers1 with timely1 actionable1 and anonymized reports of cyber attack campaigns and trends1 including1 to the maximum extent practicable1 related contextual information1 cyber threat indicators1 and defensive measures2 7#d7 establish mechanisms to receive feedback from stakeholders on how the ,agency can most effectively receive covered cyber incident reports1 ransom payment reports1 and other voluntarily provided information2 7#e7 facilitate the timely sharing1 on a voluntary basis1 between relevant critical infrastructure owners and operators of information relating to covered cyber incidents and ransom payments1 particularly with respect to ongoing cyber threats or security vulnerabilities and identify and disseminate ways to prevent or mitigate similar incidents in the future2 7#f7 for a covered cyber incident1 including a ransomware attack1 that also satisfies the definition of a substantial cyber incident1 or is part of a group of related cyber incidents that together satisfy such definition1 conduct a review of the details surrounding the covered cyber incident or group of those incidents and identify and disseminate ways to prevent or mitigate similar incidents in the future2 7#g7 with respect to covered cyber incident reports under subsection 7c7 involving an ongoing cyber threat or security vulnerability1 immediately review those reports for cyber threat indicators that can be anonymized and disseminated1 with defensive measures1 to appropriate stakeholders1 in coordination with other divisions within the ,agency1 as appropriate2 7#h7 publish quarterly unclassified1 public reports that may be based on the unclassified information contained in the reports required under subsection 7c72 7#i7 proactively identify opportunities and perform analyses1 consistent with the protections in section #bbce1 to leverage and utilize data on ransom attacks to support law enforcement operations to identify1 track1 and seize ransom payments utilizing virtual currencies1 to the greatest extent practicable2 7#aj7 proactively identify opportunities1 consistent with the protections in section #bbce1 to leverage and utilize data on cyber incidents in a manner that enables and strengthens cybersecurity research carried out by academic institutions and other private sector organizations1 to the greatest extent practicable2 7#aa7 on a not less frequently than annual basis1 analyze public disclosures made pursuant to parts #bbi and #bdi of title #ag1 ,code of ,federal ,regulations1 or any subsequent document submitted to the ,securities and ,exchange ,commission by entities experiencing cyber incidents and compare such disclosures to reports received by the ,office2 and 7#ab7 in accordance with section #bbce1 not later than #bd hours after receiving a covered cyber incident report or ransom payment report1 share the reported information with appropriate ,sector ,risk ,management ,agencies and other appropriate agencies as determined by the ,director of ,office ,management and ,budget1 in consultation with the ,director and the ,national ,cyber ,director4 7c7 ,periodic reporting ,not later than #fj days after the effective date of the interim final rule required under section #bbcb7;b77#a71 and on the first day of each month thereafter1 the ,director1 in consultation with the ,attorney ,general and the ,director of ,national ,intelligence1 shall submit to the ,national ,cyber ,director1 the majority leader of the ,senate1 the minority leader of the ,senate1 the ,speaker of the ,house of ,representatives1 the minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report that characterizes the cyber threat facing ,federal agencies and covered entities1 including applicable intelligence and law enforcement information1 covered cyber incidents1 and ransomware attacks1 as of the date of the report1 which shall-- 7#a7 include the total number of reports submitted under sections #bbcb and #bbcc during the preceding month1 including a breakdown of required and voluntary reports2 7#b7 include any identified trends in covered cyber incidents and ransomware attacks over the course of the preceding month and as compared to previous reports1 including any trends related to the information collected in the reports submitted under sections #bbcb and #bbcc1 including-- 7,a7 the infrastructure1 tactics1 and techniques malicious cyber actors commonly use2 and 7,b7 intelligence gaps that have1 or currently are1 impeding the ability to counter covered cyber incidents and ransomware threats2 7#c7 include a summary of the known uses of the information in reports submitted under sections #bbcb and #bbcc2 and 7#d7 be unclassified1 but may include a classified annex4 7d7 ,organization ,the ,director may organize the ,office within the ,agency as the ,director deems appropriate1 including harmonizing the functions of the ,office with other authorized activities4 #bbcb4 ,required reporting of certain cyber incidents 7a7 ,in general 7#a7 ,covered cyber incident reports ,a covered entity shall report a covered cyber incident to the ,director not later than #gb hours after the covered entity reasonably believes that a covered cyber incident has occurred4 7#b7 ,ransom payment reports ,an entity1 including a covered entity and except for an individual or a small business1 that makes a ransom payment as the result of a ransomware attack against the entity shall report the payment to the ,director not later than #bd hours after the ransom payment has been made4 7#c7 ,supplemental reports ,a covered entity shall promptly submit to the ,director an update or supplement to a previously submitted covered cyber incident report if new or different information becomes available or if the covered entity makes a ransom payment after submitting a covered cyber incident report required under paragraph 7#a74 7#d7 ,preservation of information ,any entity subject to requirements of paragraph 7#a71 7#b71 or 7#c7 shall preserve data relevant to the covered cyber incident or ransom payment in accordance with procedures established in the interim final rule and final rule issued pursuant to subsection 7b74 7#e7 ,exceptions 7,a7 ,reporting of covered cyber incident with ransom payment ,if a covered cyber incident includes a ransom payment such that the reporting requirements under paragraphs 7#a7 and 7#b7 apply1 the covered entity may submit a single report to satisfy the requirements of both paragraphs in accordance with procedures established in the interim final rule and final rule issued pursuant to subsection 7b74 7,b7 ,substantially similar reported information ,the requirements under paragraphs 7#a71 7#b71 and 7#c7 shall not apply to an entity required by law1 regulation1 or contract to report substantially similar information to another ,federal agency within a substantially similar timeframe4 7#f7 ,manner1 timing1 and form of reports ,reports made under paragraphs 7#a71 7#b71 and 7#c7 shall be made in the manner and form1 and within the time period in the case of reports made under paragraph 7#c71 prescribed according to the interim final rule and final rule issued pursuant to subsection 7b74 7#g7 ,effective date ,paragraphs 7#a7 through 7#d7 shall take effect on the dates prescribed in the interim final rule and the final rule issued pursuant to subsection 7b71 except that the requirements of paragraph 7#a7 through 7#d7 shall not be effective for a period for more than #ah months after the effective date of the interim final rule if the ,director has not issued a final rule pursuant to subsection 7b77#b74 7b7 ,rulemaking 7#a7 ,interim final rule ,not later than #bgj days after the date of enactment of this section1 and after a #fj-;day consultative period1 followed by a #ij-;day comment period with appropriate stakeholders1 the ,director1 in consultation with ,sector ,risk ,management ,agencies and the heads of other ,federal agencies1 shall publish in the ,federal ,register an interim final rule to implement subsection 7a74 7#b7 ,final rule ,not later than #a year after publication of the interim final rule under paragraph 7#a71 the ,director shall publish a final rule to implement subsection 7a74 7#c7 ,subsequent rulemakings ,any rule to implement subsection 7a7 issued after publication of the final rule under paragraph 7#b71 including a rule to amend or revise the final rule issued under paragraph 7#b71 shall comply with the requirements under chapter #e of title #e1 ,united ,states ,code1 including the issuance of a notice of proposed rulemaking under section #eec of such title4 7c7 ,elements ,the interim final rule and final rule issued pursuant to subsection 7b7 shall be composed of the following elements3 7#a7 ,a clear description of the types of entities that constitute covered entities1 based on-- 7,a7 the consequences that disruption to or compromise of such an entity could cause to national security1 economic security1 or public health and safety2 7,b7 the likelihood that such an entity may be targeted by a malicious cyber actor1 including a foreign country2 and 7,c7 the extent to which damage1 disruption1 or unauthorized access to such an entity1 including the accessing of sensitive cybersecurity vulnerability information or penetration testing tools or techniques1 will likely enable the disruption of the reliable operation of critical infrastructure4 7#b7 ,a clear description of the types of substantial cyber incidents that constitute covered cyber incidents1 which shall-- 7,a7 at a minimum1 require the occurrence of-- 7i7 the unauthorized access to an information system or network with a substantial loss of confidentiality1 integrity1 or availability of such information system or network1 or a serious impact on the safety and resiliency of operational systems and processes2 7ii7 a disruption of business or industrial operations due to a cyber incident2 or 7iii7 an occurrence described in clause 7i7 or 7ii7 due to loss of service facilitated through1 or caused by1 a compromise of a cloud service provider1 managed service provider1 or other third-party data hosting provider or by a supply chain compromise2 7,b7 consider-- 7i7 the sophistication or novelty of the tactics used to perpetrate such an incident1 as well as the type1 volume1 and sensitivity of the data at issue2 7ii7 the number of individuals directly or indirectly affected or potentially affected by such an incident2 and 7iii7 potential impacts on industrial control systems1 such as supervisory control and data acquisition systems1 distributed control systems1 and programmable logic controllers2 and 7,c7 exclude-- 7i7 any event where the cyber incident is perpetuated by a ,united ,states ,government entity1 good-faith security research1 or in response to an invitation by the owner or operator of the information system for third parties to find vulnerabilities in the information system1 such as through a vulnerability disclosure program or the use of authorized penetration testing services2 and 7ii7 the threat of disruption as extortion1 as described in section #bbja7h77;,b74 7#c7 ,a requirement that1 if a covered cyber incident or a ransom payment occurs following an exempted threat described in paragraph 7#b77;,c77ii71 the entity shall comply with the requirements in this subtitle in reporting the covered cyber incident or ransom payment4 7#d7 ,a clear description of the specific required contents of a report pursuant to subsection 7a77#a71 which shall include the following information1 to the extent applicable and available1 with respect to a covered cyber incident3 7,a7 ,a description of the covered cyber incident1 including-- 7i7 identification and a description of the function of the affected information systems1 networks1 or devices that were1 or are reasonably believed to have been1 affected by such incident2 7ii7 a description of the unauthorized access with substantial loss of confidentiality1 integrity1 or availability of the affected information system or network or disruption of business or industrial operations2 7iii7 the estimated date range of such incident2 and 7iv7 the impact to the operations of the covered entity4 7,b7 ,where applicable1 a description of the vulnerabilities1 tactics1 techniques1 and procedures used to perpetuate the covered cyber incident4 7,c7 ,where applicable1 any identifying or contact information related to each actor reasonably believed to be responsible for such incident4 7,d7 ,where applicable1 identification of the category or categories of information that was1 or is reasonably believed to have been1 accessed or acquired by an unauthorized person4 7,e7 ,the name and1 if applicable1 taxpayer identification number or other unique identifier of the entity impacted by the covered cyber incident4 7,f7 ,contact information1 such as telephone number or electronic mail address1 that the ,office may use to contact the covered entity or an authorized agent of such covered entity1 or1 where applicable1 the service provider of such covered entity acting with the express permission1 and at the direction1 of the covered entity to assist with compliance with the requirements of this subtitle4 7#e7 ,a clear description of the specific required contents of a report pursuant to subsection 7a77#b71 which shall be the following information1 to the extent applicable and available1 with respect to a ransom payment3 7,a7 ,a description of the ransomware attack1 including the estimated date range of the attack4 7,b7 ,where applicable1 a description of the vulnerabilities1 tactics1 techniques1 and procedures used to perpetuate the ransomware attack4 7,c7 ,where applicable1 any identifying or contact information related to the actor or actors reasonably believed to be responsible for the ransomware attack4 7,d7 ,the name and1 if applicable1 taxpayer identification number or other unique identifier of the entity that made the ransom payment4 7,e7 ,contact information1 such as telephone number or electronic mail address1 that the ,office may use to contact the entity that made the ransom payment or an authorized agent of such covered entity1 or1 where applicable1 the service provider of such covered entity acting with the express permission1 and at the direction of1 that entity to assist with compliance with the requirements of this subtitle4 7,f7 ,the date of the ransom payment4 7,g7 ,the ransom payment demand1 including the type of virtual currency or other commodity requested1 if applicable4 7,h7 ,the ransom payment instructions1 including information regarding where to send the payment1 such as the virtual currency address or physical address the funds were requested to be sent to1 if applicable4 7,i7 ,the amount of the ransom payment4 7,j7 ,a summary of the due diligence review required under subsection 7e74 7#f7 ,a clear description of the types of data required to be preserved pursuant to subsection 7a77#d7 and the period of time for which the data is required to be preserved4 7#g7 ,deadlines for submitting reports to the ,director required under subsection 7a77#c71 which shall-- 7,a7 be established by the ,director in consultation with the ,council2 7,b7 consider any existing regulatory reporting requirements similar in scope1 purpose1 and timing to the reporting requirements to which such a covered entity may also be subject1 and make efforts to harmonize the timing and contents of any such reports to the maximum extent practicable2 and 7,c7 balance the need for situational awareness with the ability of the covered entity to conduct incident response and investigations4 7#h7 ,procedures for-- 7,a7 entities to submit reports required by paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a71 which shall include1 at a minimum1 a concise1 user-friendly web-based form2 7,b7 the ,office to carry out the enforcement provisions of section #bbcc1 including with respect to the issuance of subpoenas and other aspects of noncompliance2 7,c7 implementing the exceptions provided in subparagraphs 7,a71 7,b71 and 7,d7 of subsection 7a77#e72 and 7,d7 anonymizing and safeguarding information received and disclosed through covered cyber incident reports and ransom payment reports that is known to be personal information of a specific individual or information that identifies a specific individual that is not directly related to a cybersecurity threat4 7d7 ,third-,party report submission and ransom payment 7#a7 ,report submission ,an entity1 including a covered entity1 that is required to submit a covered cyber incident report or a ransom payment report may use a third party1 such as an incident response company1 insurance provider1 service provider1 information sharing and analysis organization1 or law firm1 to submit the required report under subsection 7a74 7#b7 ,ransom payment ,if an entity impacted by a ransomware attack uses a third party to make a ransom payment1 the third party shall not be required to submit a ransom payment report for itself under subsection 7a77#b74 7#c7 ,duty to report ,third-party reporting under this subparagraph does not relieve a covered entity or an entity that makes a ransom payment from the duty to comply with the requirements for covered cyber incident report or ransom payment report submission4 7#d7 ,responsibility to advise ,any third party used by an entity that knowingly makes a ransom payment on behalf of an entity impacted by a ransomware attack shall advise the impacted entity of the responsibilities of the impacted entity regarding a due diligence review under subsection 7e7 and reporting ransom payments under this section4 7e7 ,due diligence review ,before the date on which a covered entity1 or an entity that would be required to submit a ransom payment report under this section if that entity makes a ransom payment1 makes a ransom payment relating to a ransomware attack1 the covered entity or entity shall conduct a due diligence review of alternatives to making the ransom payment1 including an analysis of whether the covered entity or entity can recover from the ransomware attack through other means4 7f7 ,outreach to covered entities 7#a7 ,in general ,the ,director shall conduct an outreach and education campaign to inform likely covered entities1 entities that offer or advertise as a service to customers to make or facilitate ransom payments on behalf of entities impacted by ransomware attacks1 potential ransomware attack victims1 and other appropriate entities of the requirements of paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a74 7#b7 ,elements ,the outreach and education campaign under paragraph 7#a7 shall include the following3 7,a7 ,an overview of the interim final rule and final rule issued pursuant to subsection 7b74 7,b7 ,an overview of mechanisms to submit to the ,office covered cyber incident reports and information relating to the disclosure1 retention1 and use of incident reports under this section4 7,c7 ,an overview of the protections afforded to covered entities for complying with the requirements under paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a74 7,d7 ,an overview of the steps taken under section #bbcd when a covered entity is not in compliance with the reporting requirements under subsection 7a74 7,e7 ,specific outreach to cybersecurity vendors1 incident response providers1 cybersecurity insurance entities1 and other entities that may support covered entities or ransomware attack victims4 7,f7 ,an overview of the privacy and civil liberties requirements in this subtitle4 7#c7 ,coordination ,in conducting the outreach and education campaign required under paragraph 7#a71 the ,director may coordinate with-- 7,a7 the ,critical ,infrastructure ,partnership ,advisory ,council established under section #hga2 7,b7 information sharing and analysis organizations2 7,c7 trade associations2 7,d7 information sharing and analysis centers2 7,e7 sector coordinating councils2 and 7,f7 any other entity as determined appropriate by the ,director4 7g7 ,evaluation of standards 7#a7 ,in general ,before issuing the final rule pursuant to subsection 7b77#b71 the ,director shall review the data collected by the ,office1 and in consultation with other appropriate entities1 assess the effectiveness of the rule with respect to-- 7,a7 the number of reports received2 7,b7 the utility of the reports received2 7,c7 the number of supplemental reports required to be submitted2 and 7,d7 any other factor determined appropriate by the ,director4 7#b7 ,submission to ,congress ,the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives the results of the evaluation described in paragraph 7#a7 and may thereafter1 in accordance with the requirements under subsection 7b71 publish in the ,federal ,register a final rule implementing this section4 7h7 ,organization of reports ,notwithstanding chapter #ce of title #dd1 ,united ,states ,code 7commonly known as the ,paperwork ,reduction ,act71 the ,director may reorganize and reformat the means by which covered cyber incident reports1 ransom payment reports1 and any other voluntarily offered information is submitted to the ,office4 #bbcc4 ,voluntary reporting of other cyber incidents 7a7 ,in general ,entities may voluntarily report incidents or ransom payments to the ,director that are not required under paragraph 7#a71 7#b71 or 7#c7 of section #bbcb7;a71 but may enhance the situational awareness of cyber threats4 7b7 ,voluntary provision of additional information in required reports ,entities may voluntarily include in reports required under paragraph 7#a71 7#b71 or 7#c7 of section #bbcb7;a7 information that is not required to be included1 but may enhance the situational awareness of cyber threats4 7c7 ,application of protections ,the protections under section #bbce applicable to covered cyber incident reports shall apply in the same manner and to the same extent to reports and information submitted under subsections 7a7 and 7b74 #bbcd4 ,noncompliance with required reporting 7a7 ,purpose ,in the event that an entity that is required to submit a report under section #bbcb7;a7 fails to comply with the requirement to report1 the ,director may obtain information about the incident or ransom payment by engaging the entity directly to request information about the incident or ransom payment1 and if the ,director is unable to obtain information through such engagement1 by issuing a subpoena to the entity1 pursuant to subsection 7c71 to gather information sufficient to determine whether a covered cyber incident or ransom payment has occurred1 and1 if so1 whether additional action is warranted pursuant to subsection 7d74 7b7 ,initial request for information 7#a7 ,in general ,if the ,director has reason to believe1 whether through public reporting or other information in the possession of the ,federal ,government1 including through analysis performed pursuant to paragraph 7#a7 or 7#b7 of section #bbca7;b71 that an entity has experienced a covered cyber incident or made a ransom payment but failed to report such incident or payment to the ,office within #gb hours in accordance to section #bbcb7;a71 the ,director shall request additional information from the entity to confirm whether or not a covered cyber incident or ransom payment has occurred4 7#b7 ,treatment ,information provided to the ,office in response to a request under paragraph 7#a7 shall be treated as if it was submitted through the reporting procedures established in section #bbcb4 7c7 ,authority ,to issue subpoenas and debar 7#a7 ,in general ,if1 after the date that is #gb hours from the date on which the ,director made the request for information in subsection 7b71 the ,director has received no response from the entity from which such information was requested1 or received an inadequate response1 the ,director may issue to such entity a subpoena to compel disclosure of information the ,director deems necessary to determine whether a covered cyber incident or ransom payment has occurred4 7#b7 ,civil action 7,a7 ,in general ,if an entity fails to comply with a subpoena1 the ,director may refer the matter to the ,attorney ,general to bring a civil action in a district court of the ,united ,states to enforce such subpoena4 7,b7 ,venue ,an action under this paragraph may be brought in the judicial district in which the entity against which the action is brought resides1 is found1 or does business4 7,c7 ,contempt of court ,a court may punish a failure to comply with a subpoena issued under this subsection as a contempt of court4 7#c7 ,non-delegation ,the authority of the ,director to issue a subpoena under this subsection may not be delegated4 7#d7 ,debarment of ,federal contractors ,if a covered entity with a ,federal ,government contract1 grant1 or cooperative agreement fails to comply with a subpoena issued under this subsection-- 7,a7 the ,director may refer the matter to the ,administrator of ,general ,services2 and 7,b7 upon receiving a referral from the ,director1 the ,administrator of ,general ,services may impose additional available penalties1 including suspension or debarment4 7d7 ,provision of certain information to ,attorney ,general 7#a7 ,in general ,notwithstanding section #bbce7;a7 and subsection 7b77#b7 of this section1 if the ,director determines1 based on the information provided in response to the subpoena issued pursuant to subsection 7c71 that the facts relating to the covered cyber incident or ransom payment at issue may constitute grounds for a regulatory enforcement action or criminal prosecution1 the ,director may provide that information to the ,attorney ,general or the appropriate regulator1 who may use that information for a regulatory enforcement action or criminal prosecution4 7#b7 ,application to certain entities and third parties ,a covered cyber incident or ransom payment report submitted to the ,office by an entity that makes a ransom payment or third party under section #bbcb shall not be used by any ,federal1 ,state1 ,tribal1 or local government to investigate or take another law enforcement action against the entity that makes a ransom payment or third party4 7#c7 ,rule of construction ,nothing in this subtitle shall be construed to provide an entity that submits a covered cyber incident report or ransom payment report under section #bbcb any immunity from law enforcement action for making a ransom payment otherwise prohibited by law4 7e7 ,considerations ,when determining whether to exercise the authorities provided under this section1 the ,director shall take into consideration-- 7#a7 the size and complexity of the entity2 7#b7 the complexity in determining if a covered cyber incident has occurred2 7#c7 prior interaction with the ,agency or awareness of the entity of the policies and procedures of the ,agency for reporting covered cyber incidents and ransom payments2 and 7#d7 for non-covered entities required to submit a ransom payment report1 the ability of the entity to perform a due diligence review pursuant to section #bbcb7;e74 7f7 ,exclusions ,this section shall not apply to a ,state1 local1 ,tribal1 or territorial government entity4 7g7 ,report to ,congress ,the ,director shall submit to ,congress an annual report on the number of times the ,director-- 7#a7 issued an initial request for information pursuant to subsection 7b72 7#b7 issued a subpoena pursuant to subsection 7c72 7#c7 brought a civil action pursuant to subsection 7c77#b72 or 7#d7 conducted additional actions pursuant to subsection 7d74 #bbce4 ,information shared with or provided to the ,federal ,government 7a7 ,disclosure1 retention1 and use 7#a7 ,authorized activities ,information provided to the ,office or ,agency pursuant to section #bbcb may be disclosed to1 retained by1 and used by1 consistent with otherwise applicable provisions of ,federal law1 any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government solely for-- 7,a7 a cybersecurity purpose2 7,b7 the purpose of identifying-- 7i7 a cyber threat1 including the source of the cyber threat2 or 7ii7 a security vulnerability2 7,c7 the purpose of responding to1 or otherwise preventing or mitigating1 a specific threat of death1 a specific threat of serious bodily harm1 or a specific threat of serious economic harm1 including a terrorist act or a use of a weapon of mass destruction2 7,d7 the purpose of responding to1 investigating1 prosecuting1 or otherwise preventing or mitigating1 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7,e7 the purpose of preventing1 investigating1 disrupting1 or prosecuting an offense arising out of a covered cyber incident or any of the offenses listed in section #aje7;d77#e77;,a77v7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7#b7 ,agency actions after receipt 7,a7 ,rapid1 confidential sharing of cyber threat indicators ,upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section1 the ,office shall immediately review the report to determine whether the incident that is the subject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable1 use such report to identify1 develop1 and rapidly disseminate to appropriate stakeholders actionable1 anonymized cyber threat indicators and defensive measures4 7,b7 ,standards for sharing security vulnerabilities ,with respect to information in a covered cyber incident or ransom payment report regarding a security vulnerability referred to in paragraph 7#a77;,b77ii71 the ,director shall develop principles that govern the timing and manner in which information relating to security vulnerabilities may be shared1 consistent with common industry best practices and ,united ,states and international standards4 7#c7 ,privacy and civil liberties ,information contained in covered cyber incident and ransom payment reports submitted to the ,office pursuant to section #bbcb shall be retained1 used1 and disseminated1 where permissible and appropriate1 by the ,federal ,government in accordance with processes to be developed for the protection of personal information adopted pursuant to section #aje of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7 and in a manner that protects from unauthorized use or disclosure any information that may contain-- 7,a7 personal information of a specific individual2 or 7,b7 information that identifies a specific individual that is not directly related to a cybersecurity threat4 7#d7 ,digital security ,the ,office shall ensure that reports submitted to the ,office pursuant to section #bbcb1 and any information contained in those reports1 are collected1 stored1 and protected at a minimum in accordance with the requirements for moderate impact ,federal information systems1 as described in ,federal ,information ,processing ,standards ,publication #aii1 or any successor document4 7#e7 ,prohibition on use of information in regulatory actions ,a ,federal1 ,state1 local1 or ,tribal government shall not use information about a covered cyber incident or ransom payment obtained solely through reporting directly to the ,office in accordance with this subtitle to regulate1 including through an enforcement action1 the lawful activities of any non-,federal entity4 7b7 ,no waiver of privilege or protection ,the submission of a report under section #bbcb to the ,office shall not constitute a waiver of any applicable privilege or protection provided by law1 including trade secret protection and attorney-client privilege4 7c7 ,exemption from disclosure ,information contained in a report submitted to the ,office under section #bbcb shall be exempt from disclosure under section #eeb7;b77#c77;,b7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act7 and any ,state1 ,tribal1 or local provision of law requiring disclosure of information or records4 7d7 ,ex parte communications ,the submission of a report to the ,agency under section #bbcb shall not be subject to a rule of any ,federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official4 7e7 ,liability protections 7#a7 ,in general ,no cause of action shall lie or be maintained in any court by any person or entity and any such action shall be promptly dismissed for the submission of a report pursuant to section #bbcb7;a7 that is submitted in conformance with this subtitle and the rules promulgated under section #bbcb7;b71 except that this subsection shall not apply with regard to an action by the ,federal ,government pursuant to section #bbcd7;c77#b74 7#b7 ,scope ,the liability protections provided in subsection 7e7 shall only apply to or affect litigation that is solely based on the submission of a covered cyber incident report or ransom payment report to the ,office1 and nothing in this subtitle shall create a defense to a discovery request1 or otherwise limit or affect the discovery of information from a cause of action authorized under any ,federal1 ,state1 local1 or ,tribal law4 7f7 ,sharing with ,federal and non-,federal entities ,the ,agency shall anonymize the victim who reported the information when making information provided in reports received under section #bbcb available to critical infrastructure owners and operators and the general public4 7g7 ,proprietary information ,information contained in a report submitted to the ,agency under section #bbcb shall be considered the commercial1 financial1 and proprietary information of the covered entity when so designated by the covered entity4 4 7c7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended by inserting after the items relating to subtitle ,b of title ,,xxii the following3 ,subtitle ,c--,cyber ,incident ,reporting ,sec4 #bbcj4 ,definitions4 ,sec4 #bbca4 ,cyber ,incident ,review ,office4 ,sec4 #bbcb4 ,required reporting of certain cyber incidents4 ,sec4 #bbcc4 ,voluntary reporting of other cyber incidents4 ,sec4 #bbcd4 ,noncompliance with required reporting4 ,sec4 #bbce4 ,information shared with or provided to the ,federal ,government4 4 #d4 ,federal sharing of incident reports 7a7 ,cyber incident reporting sharing ,notwithstanding any other provision of law or regulation1 any ,federal agency that receives a report from an entity of a cyber attack1 including a ransomware attack1 shall provide all such information to the ,director of the ,cybersecurity ,infrastructure ,security ,agency not later than #bd hours after receiving the report1 unless a shorter period is required by an agreement made between the ,cyber ,incident ,review ,office established under section #bbca of the ,homeland ,security ,act of #bjjb1 as added by section #c7;b7 of this ,act1 and another ,federal entity4 7b7 ,creation of ,council ,section #ageb7;c77#a7 of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77 is amended-- 7#a7 in subparagraph 7,g71 by striking and at the end2 7#b7 by redesignating subparagraph 7,h7 as subparagraph 7,i72 and 7#c7 by inserting after subparagraph 7,g7 the following3 7,h7 lead an intergovernmental ,cyber ,incident ,reporting ,council1 in coordination with the ,director of the ,office of ,management and ,budget and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with ,sector ,risk ,management ,agencies 7as defined in section #bbja of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea77 and other appropriate ,federal agencies1 to coordinate1 deconflict1 and harmonize ,federal incident reporting requirements1 including those issued through regulations1 for covered entities 7as defined in section #bbcj of such ,act7 and entities that make a ransom payment 7as defined in such section #bbja 7#f ,u4,s4,c4 #fea772 and 4 7c7 ,harmonizing reporting requirements ,the ,national ,cyber ,director shall1 in consultation with the ,director1 the ,cyber ,incident ,reporting ,council described in section #ageb7;c77#a77;,h7 of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h771 and the ,director of the ,office of ,management and ,budget1 to the maximum extent practicable-- 7#a7 review existing regulatory requirements1 including the information required in such reports1 to report cyber incidents and ensure that any such reporting requirements and procedures avoid conflicting1 duplicative1 or burdensome requirements2 and 7#b7 coordinate with the ,director and regulatory authorities that receive reports relating to cyber incidents to identify opportunities to streamline reporting processes1 and where feasible1 facilitate interagency agreements between such authorities to permit the sharing of such reports1 consistent with applicable law and policy1 without impacting the ability of such agencies to gain timely situational awareness of a covered cyber incident or ransom payment4 #e4 ,ransomware vulnerability warning pilot program 7a7 ,program ,not less than #ij days after the date of enactment of this ,act1 the ,director shall establish a ransomware vulnerability warning program to leverage existing authorities and technology to specifically develop processes and procedures1 and to dedicate resources1 to identifying information systems that contain security vulnerabilities associated with common ransomware attacks1 and to notify the owners of those vulnerable systems of their security vulnerability4 7b7 ,identification of vulnerable systems ,the pilot program established under subsection 7a7 shall-- 7#a7 identify the most common security vulnerabilities utilized in ransomware attacks and mitigation techniques2 and 7#b7 utilize existing authorities to identify ,federal and other relevant information systems that contain the security vulnerabilities identified in paragraph 7#a74 7c7 ,entity notification 7#a7 ,identification ,if the ,director is able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection 7b71 the ,director may notify the owner of the information system4 7#b7 ,no identification ,if the ,director is not able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection 7b71 the ,director may utilize the subpoena authority pursuant to section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 to identify and notify the entity at risk pursuant to the procedures within that section4 7#c7 ,required information ,a notification made under paragraph 7#a7 shall include information on the identified security vulnerability and mitigation techniques4 7d7 ,prioritization of notifications ,to the extent practical1 the ,director shall prioritize covered entities for identification and notification activities under the pilot program established under this section4 7e7 ,limitation on procedures ,no procedure1 notification1 or other authorities utilized in the execution of the pilot program established under subsection 7a7 shall require an owner or operator of a vulnerable information system to take any action as a result of a notice of a security vulnerability made pursuant to subsection 7c74 7f7 ,rule of construction ,nothing in this section shall be construed to provide additional authorities to the ,director to identify vulnerabilities or vulnerable systems4 #f4 ,ransomware threat mitigation activities 7a7 ,joint ransomware task force 7#a7 ,in general ,not later than #ahj days after the date of enactment of this section1 the ,national ,cyber ,director shall establish and chair the ,joint ,ransomware ,task ,force to coordinate an ongoing1 nationwide campaign against ransomware attacks1 and identify and pursue opportunities for international cooperation4 7#b7 ,composition ,the ,joint ,ransomware ,task ,force shall consist of participants from ,federal agencies1 as determined appropriate by the ,national ,cyber ,director in consultation with the ,secretary of ,homeland ,security4 7#c7 ,responsibilities ,the ,joint ,ransomware ,task ,force1 utilizing only existing authorities of each participating agency1 shall coordinate across the ,federal ,government the following activities3 7,a7 ,prioritization of intelligence-driven operations to disrupt specific ransomware actors4 7,b7 ,consult with relevant private sector1 ,state1 local1 ,tribal1 and territorial governments and international stakeholders to identify needs and establish mechanisms for providing input into the ,task ,force4 7,c7 ,identifying1 in consultation with relevant entities1 a list of highest threat ransomware entities updated on an ongoing basis1 in order to facilitate-- 7i7 prioritization for ,federal action by appropriate ,federal agencies2 and 7ii7 identify metrics for success of said actions4 7,d7 ,disrupting ransomware criminal actors1 associated infrastructure1 and their finances4 7,e7 ,facilitating coordination and collaboration between ,federal entities and relevant entities1 including the private sector1 to improve ,federal actions against ransomware threats4 7,f7 ,collection1 sharing1 and analysis of ransomware trends to inform ,federal actions4 7,g7 ,creation of after-action reports and other lessons learned from ,federal actions that identify successes and failures to improve subsequent actions4 7,h7 ,any other activities determined appropriate by the task force to mitigate the threat of ransomware attacks against ,federal and non-,federal entities4 7b7 ,clarifying private-,sector lawful defensive measures ,not later than #ahj days after the date of enactment of this ,act1 the ,national ,cyber ,director1 in coordination with the ,secretary of ,homeland ,security and the ,attorney ,general1 shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on the ,judiciary of the ,senate and the ,committee on ,homeland ,security1 the ,committee on the ,judiciary1 and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report that describes defensive measures that private-sector actors can take when countering ransomware attacks and what laws need to be clarified to enable that action4 7c7 ,rule of construction ,nothing in this section shall be construed as providing any additional authority to any ,federal agency4 #g4 ,congressional reporting 7a7 ,report on stakeholder engagement ,not later than #cj days after the date on which the ,director issues the interim final rule under section #bbcb7;b77#a7 of the ,homeland ,security ,act of #bjjb1 as added by section #c7;b7 of this ,act1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report that describes how the ,director engaged stakeholders in the development of the interim final rule4 7b7 ,report on opportunities ,to strengthen security research ,not later than #a year after the date of enactment of this ,act1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report describing how the ,cyber ,incident ,review ,office has carried out activities under section #bbca7;b77#i7 of the ,homeland ,security ,act of #bjjb1 as added by section #c7;b7 of this ,act1 by proactively identifying opportunities to use cyber incident data to inform and enabling cybersecurity research within the academic and private sector4 7c7 ,report on ransomware vulnerability warning pilot program ,not later than #a year after the date of enactment of this ,act1 and annually thereafter for the duration of the pilot program established under section #e1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report1 which may include a classified annex1 on the effectiveness of the pilot program1 which shall include a discussion of the following3 7#a7 ,the effectiveness of the notifications under section #e7;c7 to mitigate security vulnerabilities and the threat of ransomware4 7#b7 ,the identification of most common vulnerabilities utilized in ransomware4 7#c7 ,the number of notifications issued during the preceding year4 7#d7 ,to the extent practicable1 the number of vulnerable devices or systems mitigated under this pilot by the ,agency during the preceding year4 7d7 ,report on harmonization of reporting regulations ,not later than #ahj days after the date on which the ,national ,cyber ,director convenes the ,council described in section #ageb7;c77#a77;,h7 of the ,william ,m4 7,mac7 ,thornberry ,national ,defense ,authorization ,act for ,fiscal ,year #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h771 the ,national ,cyber ,director shall submit to the appropriate congressional committees a report that includes-- 7#a7 a list of duplicative ,federal cyber incident reporting requirements on covered entities and entities that make a ransom payment2 7#b7 any actions the ,national ,cyber ,director intends to take to harmonize the duplicative reporting requirements2 and 7#c7 any proposed legislative changes necessary to address the duplicative reporting4 7e7 ,,gao report ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the implementation of this ,act and the amendments made by this ,act4