,,ii #aag? ,,congress #a/ ,session ,s4 #bhge ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,septemb] #bh1 #bjba ,mr4 ,pet]s 7= himself & ,mr4 ,portman7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,a ,,bill ,to am5d ! ,homel& ,security ,act ( #bjjb to e/abli% ! ,cyb] ,incid5t ,review ,(fice 9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,cyb] ,incid5t ,report+ ,act ( #bjba4 #b4 ,def9itions ,9 ?is ,act3 7#a7 ,cov]$ cyb] incid5t2 cov]$ entity2 cyb] incid5t ,! t]ms cov]$ cyb] incid5t1 cov]$ entity1 & cyb] incid5t h ! mean+s giv5 ^? t]ms 9 section #bbcj ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #c7;b7 ( ?is ,act4 7#b7 ,cyb] attack2 ransom paym5t2 ransomw>e attack ,! t]ms cyb] attack1 ransom paym5t1 & ransomw>e attack h ! mean+s giv5 ^? t]ms 9 section #bbja ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea71 z am5d$ by section #c7;a7 ( ?is ,act4 7#c7 ,director ,! t]m ,director means ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#d7 ,in=mation sy/em2 security vuln]ability ,! t]ms in=mation sy/em & security vuln]ability h ! mean+s giv5 ^? t]ms 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 #c4 ,cyb] incid5t report+ 7a7 ,def9itions 7#a7 ,9 g5]al ,section #bbja ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea7 is am5d$-- 7,a7 by r$esignat+ p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 & 7#f7 z p>agraphs 7#b71 7#d71 7#e71 7#g71 7#aj71 & 7#aa71 respectively2 7,b7 by ins]t+ be=e p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#a7 ,cl\d s]vice provid] ,! t]m cl\d s]vice provid] means an entity (f]+ products or s]vices relat$ to cl\d comput+1 z def9$ by ! ,national ,in/itutes ( ,/&>ds & ,te*nology 9 ,,ni/ ,special ,publication #hjj-ade & any am5datory or sup]s$+ docum5t relat+ !reto4 2 7,c7 by ins]t+ aft] p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#c7 ,cyb] attack ,! t]m cyb] attack means ! use ( unau?oriz$ or malici\s code on an in=mation sy/em1 or ! use ( ano!r digital me*anism su* z a d5ial ( s]vice attack1 to int]rupt or disrupt ! op]ations ( an in=mation sy/em or compromise ! confid5tiality1 availability1 or integrity ( electronic data /or$ on1 process$ by1 or transit+ an in=mation sy/em4 2 7,d7 by ins]t+ aft] p>agraph 7#e71 z s r$esignat$1 ! foll[+3 7#f7 ,manag$ s]vice provid] ,! t]m manag$ s]vice provid] means an entity t deliv]s s]vices1 su* z network1 application1 infra/ructure1 or security s]vices1 via ongo+ & regul> support & active adm9i/ration on ! premises ( a cu/om]1 9 ! data c5t] ( ! entity 7su* z ho/+71 or 9 a ?ird-p>ty data c5t]4 2 7,e7 by ins]t+ aft] p>agraph 7#g71 z s r$esignat$1 ! foll[+3 7#h7 ,ransom paym5t ,! t]m ransom paym5t means ! transmission ( any money or o!r prop]ty or asset1 includ+ virtual curr5cy1 or any portion !re(1 :i* has at any "t be5 deliv]$ z ransom 9 connection ) a ransomw>e attack4 7#i7 ,ransomw>e attack ,! t]m ransomw>e attack-- 7,a7 means a cyb] attack t includes ! ?reat ( use ( unau?oriz$ or malici\s code on an in=mation sy/em1 or ! ?reat ( use ( ano!r digital me*anism su* z a d5ial ( s]vice attack1 to int]rupt or disrupt ! op]ations ( an in=mation sy/em or compromise ! confid5tiality1 availability1 or integrity ( electronic data /or$ on1 process$ by1 or transit+ an in=mation sy/em to extort a dem& = a ransom paym5t2 & 7,b7 does n include any su* ev5t :]e ! dem& = paym5t is made by a ,f$]al ,gov]nm5t entity1 good-fai? security rese>*1 or 9 response to an invitation by ! own] or op]ator ( ! in=mation sy/em = ?ird p>ties to id5tify vuln]abilities 9 ! in=mation sy/em4 2 & 7,f7 by add+ at ! end ! foll[+3 7#ac7 ,supply *a9 compromise ,! t]m supply *a9 compromise means a cyb] attack t all[s an adv]s>y to utilize implants or o!r vuln]abilities ins]t$ prior to in/allation 9 ord] to infiltrate data1 or manipulate in=mation te*nology h>dw>e1 s(tw>e1 op]at+ sy/ems1 p]iph]als 7su* z in=mation te*nology products71 or s]vices at any po9t dur+ ! life cycle4 7#ad7 ,virtual curr5cy ,! t]m virtual curr5cy means ! digital repres5tation ( value t functions z a m$ium ( ex*ange1 a unit ( acc\nt1 or a /ore ( value4 7#ae7 ,virtual curr5cy address ,! t]m virtual curr5cy address means a unique public cryptographic key id5tify+ ! location to :i* a virtual curr5cy paym5t c be made4 4 7#b7 ,con=m+ am5dm5t ,section #ijjb7;,a77#g7 ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #feb;a7a77#g77 is am5d$ to read z foll[s3 7#g7 ,sector ,risk ,managem5t ,ag5cy ,! t]m ,sector ,risk ,managem5t ,ag5cy has ! mean+ giv5 ! t]m 9 section #bbja ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea74 4 7b7 ,cyb] incid5t report+ ,title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47 is am5d$ by add+ at ! end ! foll[+3 ,c ,cyb] ,incid5t ,report+ #bbcj4 ,def9itions 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! def9itions "u section #bbja %all apply to ?is subtitle4 7b7 ,additional def9itions ,9 ?is subtitle3 7#a7 ,c\ncil ,! t]m ,c\ncil means ! ,cyb] ,incid5t ,report+ ,c\ncil describ$ 9 section #ageb7;c77#a77;,h7 ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h774 7#b7 ,cov]$ cyb] incid5t ,! t]m cov]$ cyb] incid5t means a sub/antial cyb] incid5t exp]i5c$ by a cov]$ entity t satisfies ! def9ition & crit]ia e/abli%$ by ! ,director 9 ! int]im f9al rule & f9al rule issu$ pursuant to section #bbcb4 7#c7 ,cov]$ entity ,! t]m cov]$ entity means an entity t owns or op]ates critical infra/ructure t satisfies ! def9ition e/abli%$ by ! ,director 9 ! int]im f9al rule & f9al rule issu$ pursuant to section #bbcb4 7#d7 ,cyb] incid5t ,! t]m cyb] incid5t has ! mean+ giv5 ! t]m incid5t 9 section #bbji7;a74 7#e7 ,cyb] ?reat ,! t]m cyb] ?reat-- 7,a7 has ! mean+ giv5 ! t]m cyb]security ?reat 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aeja72 & 7,b7 does n include any activity relat$ to good fai? security rese>*1 includ+ p>ticipation 9 a bug-b\nty program or a vuln]ability disclosure program4 7#f7 ,cyb] ?reat indicator2 cyb]security purpose2 def5sive measure2 ,f$]al entity2 in=mation sy/em2 security control2 security vuln]ability ,! t]ms cyb] ?reat indicator1 cyb]security purpose1 def5sive measure1 ,f$]al entity1 in=mation sy/em1 security control1 & security vuln]ability h ! mean+s giv5 ^? t]ms 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 7#g7 ,small bus9ess ,! t]m small bus9ess-- 7,a7 means a bus9ess ) few] ?an #ej employees 7det]m9$ on a full-"t equival5t basis72 & 7,b7 does n include-- 7i7 a bus9ess t is a cov]$ entity2 or 7ii7 a bus9ess t holds a gov]nm5t contract1 unless t contractor is a p>ty only to-- 7,i7 a s]vice contract to provide h\sekeep+ or cu/odial s]vices2 or 7,,ii7 a contract to provide products or s]vices unrelat$ to in=mation te*nology t is bel[ ! micro-pur*ase ?re%old1 z def9$ 9 section #b4aja ( title #dh1 ,code ( ,f$]al ,regulations1 or any successor regulation4 #bbca4 ,cyb] ,incid5t ,review ,(fice 7a7 ,cyb] ,incid5t ,review ,(fice ,!re is e/abli%$ 9 ! ,ag5cy a ,cyb] ,incid5t ,review ,(fice 79 ?is section ref]r$ to z ! ,(fice7 to receive1 aggregate1 & analyze reports relat$ to cov]$ cyb] incid5ts submitt$ by cov]$ entities 9 fur!rance ( ! activities specifi$ 9 subsection 7c7 ( ?is section & sections #bbjb7;e71 #bbjc1 & #bbji7;c7 & any o!r au?oriz$ activity ( ! ,director to enhance ! situational aw>5ess ( cyb] ?reats across critical infra/ructure sectors4 7b7 ,activities ,! ,(fice %all1 9 fur!rance ( ! activities specifi$ 9 sections #bbjb7;e71 #bbjc1 & #bbji7;c7-- 7#a7 receive1 aggregate1 analyze1 & secure1 consi/5t ) ! requirem5ts "u ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja et seq47 reports f cov]$ entities relat$ to a cov]$ cyb] incid5t to assess ! effectiv5ess ( security controls & id5tify tactics1 te*niques1 & proc$ures adv]s>ies use to ov]come ^? controls2 7#b7 receive1 aggregate1 analyze1 & secure reports relat$ to ransom paym5ts to id5tify tactics1 te*niques1 & proc$ures1 includ+ id5tify+ & track+ ransom paym5ts utiliz+ virtual curr5cies1 adv]s>ies use to p]petuate ransomw>e attacks & facilitate ransom paym5ts2 7#c7 lev]age in=mation ga!r$ ab\t cyb]security incid5ts to-- 7,a7 enhance ! quality & effectiv5ess ( in=mation %>+ & coord9ation ef=ts ) appropriate entities1 includ+ ag5cies1 sector coord9at+ c\ncils1 in=mation %>+ & analysis organizations1 te*nology provid]s1 cyb]security & incid5t response firms1 & security rese>*]s2 & 7,b7 provide appropriate entities1 includ+ ag5cies1 sector coord9at+ c\ncils1 in=mation %>+ & analysis organizations1 te*nology provid]s1 cyb]security & incid5t response firms1 & security rese>*]s1 ) timely1 actionable1 & anonymiz$ reports ( cyb] attack campaigns & tr5ds1 includ+1 to ! maximum ext5t practicable1 relat$ contextual in=mation1 cyb] ?reat indicators1 & def5sive measures2 7#d7 e/abli% me*anisms to receive fe$back f /akehold]s on h[ ! ,ag5cy c mo/ effectively receive cov]$ cyb] incid5t reports1 ransom paym5t reports1 & o!r volunt>ily provid$ in=mation2 7#e7 facilitate ! timely %>+1 on a volunt>y basis1 betwe5 relevant critical infra/ructure own]s & op]ators ( in=mation relat+ to cov]$ cyb] incid5ts & ransom paym5ts1 p>ticul>ly ) respect to ongo+ cyb] ?reats or security vuln]abilities & id5tify & dissem9ate ways to prev5t or mitigate simil> incid5ts 9 ! future2 7#f7 = a cov]$ cyb] incid5t1 includ+ a ransomw>e attack1 t also satisfies ! def9ition ( a sub/antial cyb] incid5t1 or is "p ( a gr\p ( relat$ cyb] incid5ts t toge!r satisfy su* def9ition1 conduct a review ( ! details surr\nd+ ! cov]$ cyb] incid5t or gr\p ( ^? incid5ts & id5tify & dissem9ate ways to prev5t or mitigate simil> incid5ts 9 ! future2 7#g7 ) respect to cov]$ cyb] incid5t reports "u subsection 7c7 involv+ an ongo+ cyb] ?reat or security vuln]ability1 imm$iately review ^? reports = cyb] ?reat indicators t c be anonymiz$ & dissem9at$1 ) def5sive measures1 to appropriate /akehold]s1 9 coord9ation ) o!r divisions )9 ! ,ag5cy1 z appropriate2 7#h7 publi% qu>t]ly unclassifi$1 public reports t may be bas$ on ! unclassifi$ in=mation conta9$ 9 ! reports requir$ "u subsection 7c72 7#i7 proactively id5tify opportunities & p]=m analyses1 consi/5t ) ! protections 9 section #bbce1 to lev]age & utilize data on ransom attacks to support law en=cem5t op]ations to id5tify1 track1 & seize ransom paym5ts utiliz+ virtual curr5cies1 to ! greate/ ext5t practicable2 7#aj7 proactively id5tify opportunities1 consi/5t ) ! protections 9 section #bbce1 to lev]age & utilize data on cyb] incid5ts 9 a mann] t enables & /r5g!ns cyb]security rese>* c>ri$ out by academic in/itutions & o!r private sector organizations1 to ! greate/ ext5t practicable2 7#aa7 on a n less frequ5tly ?an annual basis1 analyze public disclosures made pursuant to p>ts #bbi & #bdi ( title #ag1 ,code ( ,f$]al ,regulations1 or any subsequ5t docum5t submitt$ to ! ,securities & ,ex*ange ,commission by entities exp]i5c+ cyb] incid5ts & comp>e su* disclosures to reports receiv$ by ! ,(fice2 & 7#ab7 9 accordance ) section #bbce1 n lat] ?an #bd h\rs aft] receiv+ a cov]$ cyb] incid5t report or ransom paym5t report1 %>e ! report$ in=mation ) appropriate ,sector ,risk ,managem5t ,ag5cies & o!r appropriate ag5cies z det]m9$ by ! ,director ( ,(fice ,managem5t & ,budget1 9 consultation ) ! ,director & ! ,national ,cyb] ,director4 7c7 ,p]iodic report+ ,n lat] ?an #fj days aft] ! effective date ( ! int]im f9al rule requir$ "u section #bbcb7;b77#a71 & on ! fir/ day ( ea* mon? !reaft]1 ! ,director1 9 consultation ) ! ,attorney ,g5]al & ! ,director ( ,national ,intellig5ce1 %all submit to ! ,national ,cyb] ,director1 ! majority lead] ( ! ,s5ate1 ! m9ority lead] ( ! ,s5ate1 ! ,speak] ( ! ,h\se ( ,repres5tatives1 ! m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t *>act]izes ! cyb] ?reat fac+ ,f$]al ag5cies & cov]$ entities1 includ+ applicable intellig5ce & law en=cem5t in=mation1 cov]$ cyb] incid5ts1 & ransomw>e attacks1 z ( ! date ( ! report1 :i* %all-- 7#a7 include ! total numb] ( reports submitt$ "u sections #bbcb & #bbcc dur+ ! prec$+ mon?1 includ+ a breakd[n ( requir$ & volunt>y reports2 7#b7 include any id5tifi$ tr5ds 9 cov]$ cyb] incid5ts & ransomw>e attacks ov] ! c\rse ( ! prec$+ mon? & z comp>$ to previ\s reports1 includ+ any tr5ds relat$ to ! in=mation collect$ 9 ! reports submitt$ "u sections #bbcb & #bbcc1 includ+-- 7,a7 ! infra/ructure1 tactics1 & te*niques malici\s cyb] actors commonly use2 & 7,b7 intellig5ce gaps t h1 or curr5tly are1 imp$+ ! ability to c\nt] cov]$ cyb] incid5ts & ransomw>e ?reats2 7#c7 include a summ>y ( ! kn[n uses ( ! in=mation 9 reports submitt$ "u sections #bbcb & #bbcc2 & 7#d7 be unclassifi$1 b may include a classifi$ annex4 7d7 ,organization ,! ,director may organize ! ,(fice )9 ! ,ag5cy z ! ,director deems appropriate1 includ+ h>moniz+ ! functions ( ! ,(fice ) o!r au?oriz$ activities4 #bbcb4 ,requir$ report+ ( c]ta9 cyb] incid5ts 7a7 ,9 g5]al 7#a7 ,cov]$ cyb] incid5t reports ,a cov]$ entity %all report a cov]$ cyb] incid5t to ! ,director n lat] ?an #gb h\rs aft] ! cov]$ entity reasonably believes t a cov]$ cyb] incid5t has occurr$4 7#b7 ,ransom paym5t reports ,an entity1 includ+ a cov]$ entity & except = an individual or a small bus9ess1 t makes a ransom paym5t z ! result ( a ransomw>e attack aga9/ ! entity %all report ! paym5t to ! ,director n lat] ?an #bd h\rs aft] ! ransom paym5t has be5 made4 7#c7 ,supplem5tal reports ,a cov]$ entity %all promptly submit to ! ,director an update or supplem5t to a previ\sly submitt$ cov]$ cyb] incid5t report if new or diff]5t in=mation becomes available or if ! cov]$ entity makes a ransom paym5t aft] submitt+ a cov]$ cyb] incid5t report requir$ "u p>agraph 7#a74 7#d7 ,pres]vation ( in=mation ,any entity subject to requirem5ts ( p>agraph 7#a71 7#b71 or 7#c7 %all pres]ve data relevant to ! cov]$ cyb] incid5t or ransom paym5t 9 accordance ) proc$ures e/abli%$ 9 ! int]im f9al rule & f9al rule issu$ pursuant to subsection 7b74 7#e7 ,exceptions 7,a7 ,report+ ( cov]$ cyb] incid5t ) ransom paym5t ,if a cov]$ cyb] incid5t includes a ransom paym5t su* t ! report+ requirem5ts "u p>agraphs 7#a7 & 7#b7 apply1 ! cov]$ entity may submit a s+le report to satisfy ! requirem5ts ( bo? p>agraphs 9 accordance ) proc$ures e/abli%$ 9 ! int]im f9al rule & f9al rule issu$ pursuant to subsection 7b74 7,b7 ,sub/antially simil> report$ in=mation ,! requirem5ts "u p>agraphs 7#a71 7#b71 & 7#c7 %all n apply to an entity requir$ by law1 regulation1 or contract to report sub/antially simil> in=mation to ano!r ,f$]al ag5cy )9 a sub/antially simil> timeframe4 7#f7 ,mann]1 tim+1 & =m ( reports ,reports made "u p>agraphs 7#a71 7#b71 & 7#c7 %all be made 9 ! mann] & =m1 & )9 ! "t p]iod 9 ! case ( reports made "u p>agraph 7#c71 prescrib$ accord+ to ! int]im f9al rule & f9al rule issu$ pursuant to subsection 7b74 7#g7 ,effective date ,p>agraphs 7#a7 ?r\gh 7#d7 %all take effect on ! dates prescrib$ 9 ! int]im f9al rule & ! f9al rule issu$ pursuant to subsection 7b71 except t ! requirem5ts ( p>agraph 7#a7 ?r\gh 7#d7 %all n be effective = a p]iod = m ?an #ah mon?s aft] ! effective date ( ! int]im f9al rule if ! ,director has n issu$ a f9al rule pursuant to subsection 7b77#b74 7b7 ,rulemak+ 7#a7 ,int]im f9al rule ,n lat] ?an #bgj days aft] ! date ( enactm5t ( ?is section1 & aft] a #fj-;day consultative p]iod1 foll[$ by a #ij-;day comm5t p]iod ) appropriate /akehold]s1 ! ,director1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies & ! heads ( o!r ,f$]al ag5cies1 %all publi% 9 ! ,f$]al ,regi/] an int]im f9al rule to implem5t subsection 7a74 7#b7 ,f9al rule ,n lat] ?an #a ye> aft] publication ( ! int]im f9al rule "u p>agraph 7#a71 ! ,director %all publi% a f9al rule to implem5t subsection 7a74 7#c7 ,subsequ5t rulemak+s ,any rule to implem5t subsection 7a7 issu$ aft] publication ( ! f9al rule "u p>agraph 7#b71 includ+ a rule to am5d or revise ! f9al rule issu$ "u p>agraph 7#b71 %all comply ) ! requirem5ts "u *apt] #e ( title #e1 ,unit$ ,/ates ,code1 includ+ ! issuance ( a notice ( propos$ rulemak+ "u section #eec ( su* title4 7c7 ,elem5ts ,! int]im f9al rule & f9al rule issu$ pursuant to subsection 7b7 %all be compos$ ( ! foll[+ elem5ts3 7#a7 ,a cle> description ( ! types ( entities t con/itute cov]$ entities1 bas$ on-- 7,a7 ! consequ5ces t disruption to or compromise ( su* an entity c\ld cause to national security1 economic security1 or public heal? & safety2 7,b7 ! likelihood t su* an entity may be t>get$ by a malici\s cyb] actor1 includ+ a =eign c\ntry2 & 7,c7 ! ext5t to :i* damage1 disruption1 or unau?oriz$ access to su* an entity1 includ+ ! access+ ( s5sitive cyb]security vuln]ability in=mation or p5etration te/+ tools or te*niques1 w likely enable ! disruption ( ! reliable op]ation ( critical infra/ructure4 7#b7 ,a cle> description ( ! types ( sub/antial cyb] incid5ts t con/itute cov]$ cyb] incid5ts1 :i* %all-- 7,a7 at a m9imum1 require ! occurr5ce (-- 7i7 ! unau?oriz$ access to an in=mation sy/em or network ) a sub/antial loss ( confid5tiality1 integrity1 or availability ( su* in=mation sy/em or network1 or a s]i\s impact on ! safety & resili5cy ( op]ational sy/ems & processes2 7ii7 a disruption ( bus9ess or indu/rial op]ations due to a cyb] incid5t2 or 7iii7 an occurr5ce describ$ 9 clause 7i7 or 7ii7 due to loss ( s]vice facilitat$ ?r\gh1 or caus$ by1 a compromise ( a cl\d s]vice provid]1 manag$ s]vice provid]1 or o!r ?ird-p>ty data ho/+ provid] or by a supply *a9 compromise2 7,b7 consid]-- 7i7 ! sophi/ication or novelty ( ! tactics us$ to p]petrate su* an incid5t1 z well z ! type1 volume1 & s5sitivity ( ! data at issue2 7ii7 ! numb] ( individuals directly or indirectly affect$ or pot5tially affect$ by su* an incid5t2 & 7iii7 pot5tial impacts on indu/rial control sy/ems1 su* z sup]visory control & data acquisition sy/ems1 di/ribut$ control sy/ems1 & programmable logic controll]s2 & 7,c7 exclude-- 7i7 any ev5t :]e ! cyb] incid5t is p]petuat$ by a ,unit$ ,/ates ,gov]nm5t entity1 good-fai? security rese>*1 or 9 response to an invitation by ! own] or op]ator ( ! in=mation sy/em = ?ird p>ties to f9d vuln]abilities 9 ! in=mation sy/em1 su* z ?r\gh a vuln]ability disclosure program or ! use ( au?oriz$ p5etration te/+ s]vices2 & 7ii7 ! ?reat ( disruption z extortion1 z describ$ 9 section #bbja7h77;,b74 7#c7 ,a requirem5t t1 if a cov]$ cyb] incid5t or a ransom paym5t occurs foll[+ an exempt$ ?reat describ$ 9 p>agraph 7#b77;,c77ii71 ! entity %all comply ) ! requirem5ts 9 ?is subtitle 9 report+ ! cov]$ cyb] incid5t or ransom paym5t4 7#d7 ,a cle> description ( ! specific requir$ cont5ts ( a report pursuant to subsection 7a77#a71 :i* %all include ! foll[+ in=mation1 to ! ext5t applicable & available1 ) respect to a cov]$ cyb] incid5t3 7,a7 ,a description ( ! cov]$ cyb] incid5t1 includ+-- 7i7 id5tification & a description ( ! function ( ! affect$ in=mation sy/ems1 networks1 or devices t 71 or are reasonably believ$ to h be51 affect$ by su* incid5t2 7ii7 a description ( ! unau?oriz$ access ) sub/antial loss ( confid5tiality1 integrity1 or availability ( ! affect$ in=mation sy/em or network or disruption ( bus9ess or indu/rial op]ations2 7iii7 ! e/imat$ date range ( su* incid5t2 & 7iv7 ! impact to ! op]ations ( ! cov]$ entity4 7,b7 ,:]e applicable1 a description ( ! vuln]abilities1 tactics1 te*niques1 & proc$ures us$ to p]petuate ! cov]$ cyb] incid5t4 7,c7 ,:]e applicable1 any id5tify+ or contact in=mation relat$ to ea* actor reasonably believ$ to be responsible = su* incid5t4 7,d7 ,:]e applicable1 id5tification ( ! category or categories ( in=mation t 01 or is reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son4 7,e7 ,! "n &1 if applicable1 taxpay] id5tification numb] or o!r unique id5tifi] ( ! entity impact$ by ! cov]$ cyb] incid5t4 7,f7 ,contact in=mation1 su* z telephone numb] or electronic mail address1 t ! ,(fice may use to contact ! cov]$ entity or an au?oriz$ ag5t ( su* cov]$ entity1 or1 :]e applicable1 ! s]vice provid] ( su* cov]$ entity act+ ) ! express p]mission1 & at ! direction1 ( ! cov]$ entity to assi/ ) compliance ) ! requirem5ts ( ?is subtitle4 7#e7 ,a cle> description ( ! specific requir$ cont5ts ( a report pursuant to subsection 7a77#b71 :i* %all be ! foll[+ in=mation1 to ! ext5t applicable & available1 ) respect to a ransom paym5t3 7,a7 ,a description ( ! ransomw>e attack1 includ+ ! e/imat$ date range ( ! attack4 7,b7 ,:]e applicable1 a description ( ! vuln]abilities1 tactics1 te*niques1 & proc$ures us$ to p]petuate ! ransomw>e attack4 7,c7 ,:]e applicable1 any id5tify+ or contact in=mation relat$ to ! actor or actors reasonably believ$ to be responsible = ! ransomw>e attack4 7,d7 ,! "n &1 if applicable1 taxpay] id5tification numb] or o!r unique id5tifi] ( ! entity t made ! ransom paym5t4 7,e7 ,contact in=mation1 su* z telephone numb] or electronic mail address1 t ! ,(fice may use to contact ! entity t made ! ransom paym5t or an au?oriz$ ag5t ( su* cov]$ entity1 or1 :]e applicable1 ! s]vice provid] ( su* cov]$ entity act+ ) ! express p]mission1 & at ! direction (1 t entity to assi/ ) compliance ) ! requirem5ts ( ?is subtitle4 7,f7 ,! date ( ! ransom paym5t4 7,g7 ,! ransom paym5t dem&1 includ+ ! type ( virtual curr5cy or o!r commodity reque/$1 if applicable4 7,h7 ,! ransom paym5t in/ructions1 includ+ in=mation reg>d+ :]e to s5d ! paym5t1 su* z ! virtual curr5cy address or physical address ! funds 7 reque/$ to be s5t to1 if applicable4 7,i7 ,! am\nt ( ! ransom paym5t4 7,j7 ,a summ>y ( ! due dilig5ce review requir$ "u subsection 7e74 7#f7 ,a cle> description ( ! types ( data requir$ to be pres]v$ pursuant to subsection 7a77#d7 & ! p]iod ( "t = :i* ! data is requir$ to be pres]v$4 7#g7 ,deadl9es = submitt+ reports to ! ,director requir$ "u subsection 7a77#c71 :i* %all-- 7,a7 be e/abli%$ by ! ,director 9 consultation ) ! ,c\ncil2 7,b7 consid] any exi/+ regulatory report+ requirem5ts simil> 9 scope1 purpose1 & tim+ to ! report+ requirem5ts to :i* su* a cov]$ entity may also be subject1 & make ef=ts to h>monize ! tim+ & cont5ts ( any su* reports to ! maximum ext5t practicable2 & 7,c7 balance ! ne$ = situational aw>5ess ) ! ability ( ! cov]$ entity to conduct incid5t response & inve/igations4 7#h7 ,proc$ures =-- 7,a7 entities to submit reports requir$ by p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a71 :i* %all include1 at a m9imum1 a concise1 us]-fri5dly web-bas$ =m2 7,b7 ! ,(fice to c>ry out ! en=cem5t provisions ( section #bbcc1 includ+ ) respect to ! issuance ( subpo5as & o!r aspects ( noncompliance2 7,c7 implem5t+ ! exceptions provid$ 9 subp>agraphs 7,a71 7,b71 & 7,d7 ( subsection 7a77#e72 & 7,d7 anonymiz+ & safegu>d+ in=mation receiv$ & disclos$ ?r\gh cov]$ cyb] incid5t reports & ransom paym5t reports t is kn[n to be p]sonal in=mation ( a specific individual or in=mation t id5tifies a specific individual t is n directly relat$ to a cyb]security ?reat4 7d7 ,?ird-,p>ty report submission & ransom paym5t 7#a7 ,report submission ,an entity1 includ+ a cov]$ entity1 t is requir$ to submit a cov]$ cyb] incid5t report or a ransom paym5t report may use a ?ird p>ty1 su* z an incid5t response company1 insurance provid]1 s]vice provid]1 in=mation %>+ & analysis organization1 or law firm1 to submit ! requir$ report "u subsection 7a74 7#b7 ,ransom paym5t ,if an entity impact$ by a ransomw>e attack uses a ?ird p>ty to make a ransom paym5t1 ! ?ird p>ty %all n be requir$ to submit a ransom paym5t report = itself "u subsection 7a77#b74 7#c7 ,duty to report ,?ird-p>ty report+ "u ?is subp>agraph does n relieve a cov]$ entity or an entity t makes a ransom paym5t f ! duty to comply ) ! requirem5ts = cov]$ cyb] incid5t report or ransom paym5t report submission4 7#d7 ,responsibility to advise ,any ?ird p>ty us$ by an entity t kn[+ly makes a ransom paym5t on behalf ( an entity impact$ by a ransomw>e attack %all advise ! impact$ entity ( ! responsibilities ( ! impact$ entity reg>d+ a due dilig5ce review "u subsection 7e7 & report+ ransom paym5ts "u ?is section4 7e7 ,due dilig5ce review ,be=e ! date on :i* a cov]$ entity1 or an entity t w\ld be requir$ to submit a ransom paym5t report "u ?is section if t entity makes a ransom paym5t1 makes a ransom paym5t relat+ to a ransomw>e attack1 ! cov]$ entity or entity %all conduct a due dilig5ce review ( alt]natives to mak+ ! ransom paym5t1 includ+ an analysis ( :e!r ! cov]$ entity or entity c recov] f ! ransomw>e attack ?r\gh o!r means4 7f7 ,outrea* to cov]$ entities 7#a7 ,9 g5]al ,! ,director %all conduct an outrea* & education campaign to in=m likely cov]$ entities1 entities t (f] or adv]tise z a s]vice to cu/om]s to make or facilitate ransom paym5ts on behalf ( entities impact$ by ransomw>e attacks1 pot5tial ransomw>e attack victims1 & o!r appropriate entities ( ! requirem5ts ( p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a74 7#b7 ,elem5ts ,! outrea* & education campaign "u p>agraph 7#a7 %all include ! foll[+3 7,a7 ,an ov]view ( ! int]im f9al rule & f9al rule issu$ pursuant to subsection 7b74 7,b7 ,an ov]view ( me*anisms to submit to ! ,(fice cov]$ cyb] incid5t reports & in=mation relat+ to ! disclosure1 ret5tion1 & use ( incid5t reports "u ?is section4 7,c7 ,an ov]view ( ! protections af=d$ to cov]$ entities = comply+ ) ! requirem5ts "u p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a74 7,d7 ,an ov]view ( ! /eps tak5 "u section #bbcd :5 a cov]$ entity is n 9 compliance ) ! report+ requirem5ts "u subsection 7a74 7,e7 ,specific outrea* to cyb]security v5dors1 incid5t response provid]s1 cyb]security insurance entities1 & o!r entities t may support cov]$ entities or ransomw>e attack victims4 7,f7 ,an ov]view ( ! privacy & civil lib]ties requirem5ts 9 ?is subtitle4 7#c7 ,coord9ation ,9 conduct+ ! outrea* & education campaign requir$ "u p>agraph 7#a71 ! ,director may coord9ate )-- 7,a7 ! ,critical ,infra/ructure ,p>tn]%ip ,advisory ,c\ncil e/abli%$ "u section #hga2 7,b7 in=mation %>+ & analysis organizations2 7,c7 trade associations2 7,d7 in=mation %>+ & analysis c5t]s2 7,e7 sector coord9at+ c\ncils2 & 7,f7 any o!r entity z det]m9$ appropriate by ! ,director4 7g7 ,evaluation ( /&>ds 7#a7 ,9 g5]al ,be=e issu+ ! f9al rule pursuant to subsection 7b77#b71 ! ,director %all review ! data collect$ by ! ,(fice1 & 9 consultation ) o!r appropriate entities1 assess ! effectiv5ess ( ! rule ) respect to-- 7,a7 ! numb] ( reports receiv$2 7,b7 ! utility ( ! reports receiv$2 7,c7 ! numb] ( supplem5tal reports requir$ to be submitt$2 & 7,d7 any o!r factor det]m9$ appropriate by ! ,director4 7#b7 ,submission to ,congress ,! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives ! results ( ! evaluation describ$ 9 p>agraph 7#a7 & may !reaft]1 9 accordance ) ! requirem5ts "u subsection 7b71 publi% 9 ! ,f$]al ,regi/] a f9al rule implem5t+ ?is section4 7h7 ,organization ( reports ,not)/&+ *apt] #ce ( title #dd1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,pap]work ,r$uction ,act71 ! ,director may reorganize & re=mat ! means by :i* cov]$ cyb] incid5t reports1 ransom paym5t reports1 & any o!r volunt>ily (f]$ in=mation is submitt$ to ! ,(fice4 #bbcc4 ,volunt>y report+ ( o!r cyb] incid5ts 7a7 ,9 g5]al ,entities may volunt>ily report incid5ts or ransom paym5ts to ! ,director t are n requir$ "u p>agraph 7#a71 7#b71 or 7#c7 ( section #bbcb7;a71 b may enhance ! situational aw>5ess ( cyb] ?reats4 7b7 ,volunt>y provision ( additional in=mation 9 requir$ reports ,entities may volunt>ily include 9 reports requir$ "u p>agraph 7#a71 7#b71 or 7#c7 ( section #bbcb7;a7 in=mation t is n requir$ to be includ$1 b may enhance ! situational aw>5ess ( cyb] ?reats4 7c7 ,application ( protections ,! protections "u section #bbce applicable to cov]$ cyb] incid5t reports %all apply 9 ! same mann] & to ! same ext5t to reports & in=mation submitt$ "u subsections 7a7 & 7b74 #bbcd4 ,noncompliance ) requir$ report+ 7a7 ,purpose ,9 ! ev5t t an entity t is requir$ to submit a report "u section #bbcb7;a7 fails to comply ) ! requirem5t to report1 ! ,director may obta9 in=mation ab\t ! incid5t or ransom paym5t by engag+ ! entity directly to reque/ in=mation ab\t ! incid5t or ransom paym5t1 & if ! ,director is unable to obta9 in=mation ?r\gh su* engagem5t1 by issu+ a subpo5a to ! entity1 pursuant to subsection 7c71 to ga!r in=mation suffici5t to det]m9e :e!r a cov]$ cyb] incid5t or ransom paym5t has occurr$1 &1 if s1 :e!r additional action is w>rant$ pursuant to subsection 7d74 7b7 ,initial reque/ = in=mation 7#a7 ,9 g5]al ,if ! ,director has reason to believe1 :e!r ?r\gh public report+ or o!r in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t1 includ+ ?r\gh analysis p]=m$ pursuant to p>agraph 7#a7 or 7#b7 ( section #bbca7;b71 t an entity has exp]i5c$ a cov]$ cyb] incid5t or made a ransom paym5t b fail$ to report su* incid5t or paym5t to ! ,(fice )9 #gb h\rs 9 accordance to section #bbcb7;a71 ! ,director %all reque/ additional in=mation f ! entity to confirm :e!r or n a cov]$ cyb] incid5t or ransom paym5t has occurr$4 7#b7 ,treatm5t ,in=mation provid$ to ! ,(fice 9 response to a reque/ "u p>agraph 7#a7 %all be treat$ z if x 0 submitt$ ?r\gh ! report+ proc$ures e/abli%$ 9 section #bbcb4 7c7 ,au?ority ,to issue subpo5as & deb> 7#a7 ,9 g5]al ,if1 aft] ! date t is #gb h\rs f ! date on :i* ! ,director made ! reque/ = in=mation 9 subsection 7b71 ! ,director has receiv$ no response f ! entity f :i* su* in=mation 0 reque/$1 or receiv$ an inadequate response1 ! ,director may issue to su* entity a subpo5a to compel disclosure ( in=mation ! ,director deems necess>y to det]m9e :e!r a cov]$ cyb] incid5t or ransom paym5t has occurr$4 7#b7 ,civil action 7,a7 ,9 g5]al ,if an entity fails to comply ) a subpo5a1 ! ,director may ref] ! matt] to ! ,attorney ,g5]al to br+ a civil action 9 a di/rict c\rt ( ! ,unit$ ,/ates to en=ce su* subpo5a4 7,b7 ,v5ue ,an action "u ?is p>agraph may be br\ght 9 ! judicial di/rict 9 :i* ! entity aga9/ :i* ! action is br\ght resides1 is f\nd1 or does bus9ess4 7,c7 ,contempt ( c\rt ,a c\rt may puni% a failure to comply ) a subpo5a issu$ "u ?is subsection z a contempt ( c\rt4 7#c7 ,non-delegation ,! au?ority ( ! ,director to issue a subpo5a "u ?is subsection may n be delegat$4 7#d7 ,deb>m5t ( ,f$]al contractors ,if a cov]$ entity ) a ,f$]al ,gov]nm5t contract1 grant1 or coop]ative agreem5t fails to comply ) a subpo5a issu$ "u ?is subsection-- 7,a7 ! ,director may ref] ! matt] to ! ,adm9i/rator ( ,g5]al ,s]vices2 & 7,b7 ^u receiv+ a ref]ral f ! ,director1 ! ,adm9i/rator ( ,g5]al ,s]vices may impose additional available p5alties1 includ+ susp5sion or deb>m5t4 7d7 ,provision ( c]ta9 in=mation to ,attorney ,g5]al 7#a7 ,9 g5]al ,not)/&+ section #bbce7;a7 & subsection 7b77#b7 ( ?is section1 if ! ,director det]m9es1 bas$ on ! in=mation provid$ 9 response to ! subpo5a issu$ pursuant to subsection 7c71 t ! facts relat+ to ! cov]$ cyb] incid5t or ransom paym5t at issue may con/itute gr\nds = a regulatory en=cem5t action or crim9al prosecution1 ! ,director may provide t in=mation to ! ,attorney ,g5]al or ! appropriate regulator1 :o may use t in=mation = a regulatory en=cem5t action or crim9al prosecution4 7#b7 ,application to c]ta9 entities & ?ird p>ties ,a cov]$ cyb] incid5t or ransom paym5t report submitt$ to ! ,(fice by an entity t makes a ransom paym5t or ?ird p>ty "u section #bbcb %all n be us$ by any ,f$]al1 ,/ate1 ,tribal1 or local gov]nm5t to inve/igate or take ano!r law en=cem5t action aga9/ ! entity t makes a ransom paym5t or ?ird p>ty4 7#c7 ,rule ( con/ruction ,no?+ 9 ?is subtitle %all be con/ru$ to provide an entity t submits a cov]$ cyb] incid5t report or ransom paym5t report "u section #bbcb any immunity f law en=cem5t action = mak+ a ransom paym5t o!rwise prohibit$ by law4 7e7 ,consid]ations ,:5 det]m9+ :e!r to ex]cise ! au?orities provid$ "u ?is section1 ! ,director %all take into consid]ation-- 7#a7 ! size & complexity ( ! entity2 7#b7 ! complexity 9 det]m9+ if a cov]$ cyb] incid5t has occurr$2 7#c7 prior int]action ) ! ,ag5cy or aw>5ess ( ! entity ( ! policies & proc$ures ( ! ,ag5cy = report+ cov]$ cyb] incid5ts & ransom paym5ts2 & 7#d7 = non-cov]$ entities requir$ to submit a ransom paym5t report1 ! ability ( ! entity to p]=m a due dilig5ce review pursuant to section #bbcb7;e74 7f7 ,exclusions ,?is section %all n apply to a ,/ate1 local1 ,tribal1 or t]ritorial gov]nm5t entity4 7g7 ,report to ,congress ,! ,director %all submit to ,congress an annual report on ! numb] ( times ! ,director-- 7#a7 issu$ an initial reque/ = in=mation pursuant to subsection 7b72 7#b7 issu$ a subpo5a pursuant to subsection 7c72 7#c7 br\ght a civil action pursuant to subsection 7c77#b72 or 7#d7 conduct$ additional actions pursuant to subsection 7d74 #bbce4 ,in=mation %>$ ) or provid$ to ! ,f$]al ,gov]nm5t 7a7 ,disclosure1 ret5tion1 & use 7#a7 ,au?oriz$ activities ,in=mation provid$ to ! ,(fice or ,ag5cy pursuant to section #bbcb may be disclos$ to1 reta9$ by1 & us$ by1 consi/5t ) o!rwise applicable provisions ( ,f$]al law1 any ,f$]al ag5cy or dep>tm5t1 compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t solely =-- 7,a7 a cyb]security purpose2 7,b7 ! purpose ( id5tify+-- 7i7 a cyb] ?reat1 includ+ ! s\rce ( ! cyb] ?reat2 or 7ii7 a security vuln]ability2 7,c7 ! purpose ( respond+ to1 or o!rwise prev5t+ or mitigat+1 a specific ?reat ( dea?1 a specific ?reat ( s]i\s bodily h>m1 or a specific ?reat ( s]i\s economic h>m1 includ+ a t]rori/ act or a use ( a weapon ( mass de/ruction2 7,d7 ! purpose ( respond+ to1 inve/igat+1 prosecut+1 or o!rwise prev5t+ or mitigat+1 a s]i\s ?reat to a m9or1 includ+ sexual exploitation & ?reats to physical safety2 or 7,e7 ! purpose ( prev5t+1 inve/igat+1 disrupt+1 or prosecut+ an (f5se aris+ out ( a cov]$ cyb] incid5t or any ( ! (f5ses li/$ 9 section #aje7;d77#e77;,a77v7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7#b7 ,ag5cy actions aft] receipt 7,a7 ,rapid1 confid5tial %>+ ( cyb] ?reat indicators ,^u receiv+ a cov]$ cyb] incid5t or ransom paym5t report submitt$ pursuant to ?is section1 ! ,(fice %all imm$iately review ! report to det]m9e :e!r ! incid5t t is ! subject ( ! report is connect$ to an ongo+ cyb] ?reat or security vuln]ability & :]e applicable1 use su* report to id5tify1 develop1 & rapidly dissem9ate to appropriate /akehold]s actionable1 anonymiz$ cyb] ?reat indicators & def5sive measures4 7,b7 ,/&>ds = %>+ security vuln]abilities ,) respect to in=mation 9 a cov]$ cyb] incid5t or ransom paym5t report reg>d+ a security vuln]ability ref]r$ to 9 p>agraph 7#a77;,b77ii71 ! ,director %all develop pr9ciples t gov]n ! tim+ & mann] 9 :i* in=mation relat+ to security vuln]abilities may be %>$1 consi/5t ) common indu/ry be/ practices & ,unit$ ,/ates & int]national /&>ds4 7#c7 ,privacy & civil lib]ties ,in=mation conta9$ 9 cov]$ cyb] incid5t & ransom paym5t reports submitt$ to ! ,(fice pursuant to section #bbcb %all be reta9$1 us$1 & dissem9at$1 :]e p]missible & appropriate1 by ! ,f$]al ,gov]nm5t 9 accordance ) processes to be develop$ = ! protection ( p]sonal in=mation adopt$ pursuant to section #aje ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aejd7 & 9 a mann] t protects f unau?oriz$ use or disclosure any in=mation t may conta9-- 7,a7 p]sonal in=mation ( a specific individual2 or 7,b7 in=mation t id5tifies a specific individual t is n directly relat$ to a cyb]security ?reat4 7#d7 ,digital security ,! ,(fice %all ensure t reports submitt$ to ! ,(fice pursuant to section #bbcb1 & any in=mation conta9$ 9 ^? reports1 are collect$1 /or$1 & protect$ at a m9imum 9 accordance ) ! requirem5ts = mod]ate impact ,f$]al in=mation sy/ems1 z describ$ 9 ,f$]al ,in=mation ,process+ ,/&>ds ,publication #aii1 or any successor docum5t4 7#e7 ,prohibition on use ( in=mation 9 regulatory actions ,a ,f$]al1 ,/ate1 local1 or ,tribal gov]nm5t %all n use in=mation ab\t a cov]$ cyb] incid5t or ransom paym5t obta9$ solely ?r\gh report+ directly to ! ,(fice 9 accordance ) ?is subtitle to regulate1 includ+ ?r\gh an en=cem5t action1 ! lawful activities ( any non-,f$]al entity4 7b7 ,no waiv] ( privilege or protection ,! submission ( a report "u section #bbcb to ! ,(fice %all n con/itute a waiv] ( any applicable privilege or protection provid$ by law1 includ+ trade secret protection & attorney-cli5t privilege4 7c7 ,exemption f disclosure ,in=mation conta9$ 9 a report submitt$ to ! ,(fice "u section #bbcb %all be exempt f disclosure "u section #eeb7;b77#c77;,b7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,fre$om ( ,in=mation ,act7 & any ,/ate1 ,tribal1 or local provision ( law requir+ disclosure ( in=mation or records4 7d7 ,ex p>te communications ,! submission ( a report to ! ,ag5cy "u section #bbcb %all n be subject to a rule ( any ,f$]al ag5cy or dep>tm5t or any judicial doctr9e reg>d+ ex p>te communications ) a decision-mak+ (ficial4 7e7 ,liability protections 7#a7 ,9 g5]al ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt by any p]son or entity & any su* action %all be promptly dismiss$ = ! submission ( a report pursuant to section #bbcb7;a7 t is submitt$ 9 con=mance ) ?is subtitle & ! rules promulgat$ "u section #bbcb7;b71 except t ?is subsection %all n apply ) reg>d to an action by ! ,f$]al ,gov]nm5t pursuant to section #bbcd7;c77#b74 7#b7 ,scope ,! liability protections provid$ 9 subsection 7e7 %all only apply to or affect litigation t is solely bas$ on ! submission ( a cov]$ cyb] incid5t report or ransom paym5t report to ! ,(fice1 & no?+ 9 ?is subtitle %all create a def5se to a discov]y reque/1 or o!rwise limit or affect ! discov]y ( in=mation f a cause ( action au?oriz$ "u any ,f$]al1 ,/ate1 local1 or ,tribal law4 7f7 ,%>+ ) ,f$]al & non-,f$]al entities ,! ,ag5cy %all anonymize ! victim :o report$ ! in=mation :5 mak+ in=mation provid$ 9 reports receiv$ "u section #bbcb available to critical infra/ructure own]s & op]ators & ! g5]al public4 7g7 ,propriet>y in=mation ,in=mation conta9$ 9 a report submitt$ to ! ,ag5cy "u section #bbcb %all be consid]$ ! comm]cial1 f9ancial1 & propriet>y in=mation ( ! cov]$ entity :5 s designat$ by ! cov]$ entity4 4 7c7 ,te*nical & con=m+ am5dm5t ,! table ( cont5ts 9 section #a7;b7 ( ! ,homel& ,security ,act ( #bjjb 7,public ,law #ajg-bif2 #aaf ,/at4 #bace7 is am5d$ by ins]t+ aft] ! items relat+ to subtitle ,b ( title ,,xxii ! foll[+3 ,subtitle ,c--,cyb] ,incid5t ,report+ ,sec4 #bbcj4 ,def9itions4 ,sec4 #bbca4 ,cyb] ,incid5t ,review ,(fice4 ,sec4 #bbcb4 ,requir$ report+ ( c]ta9 cyb] incid5ts4 ,sec4 #bbcc4 ,volunt>y report+ ( o!r cyb] incid5ts4 ,sec4 #bbcd4 ,noncompliance ) requir$ report+4 ,sec4 #bbce4 ,in=mation %>$ ) or provid$ to ! ,f$]al ,gov]nm5t4 4 #d4 ,f$]al %>+ ( incid5t reports 7a7 ,cyb] incid5t report+ %>+ ,not)/&+ any o!r provision ( law or regulation1 any ,f$]al ag5cy t receives a report f an entity ( a cyb] attack1 includ+ a ransomw>e attack1 %all provide all su* in=mation to ! ,director ( ! ,cyb]security ,infra/ructure ,security ,ag5cy n lat] ?an #bd h\rs aft] receiv+ ! report1 unless a %ort] p]iod is requir$ by an agreem5t made betwe5 ! ,cyb] ,incid5t ,review ,(fice e/abli%$ "u section #bbca ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #c7;b7 ( ?is ,act1 & ano!r ,f$]al entity4 7b7 ,creation ( ,c\ncil ,section #ageb7;c77#a7 ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77 is am5d$-- 7#a7 9 subp>agraph 7,g71 by /rik+ & at ! end2 7#b7 by r$esignat+ subp>agraph 7,h7 z subp>agraph 7,i72 & 7#c7 by ins]t+ aft] subp>agraph 7,g7 ! foll[+3 7,h7 lead an int]gov]nm5tal ,cyb] ,incid5t ,report+ ,c\ncil1 9 coord9ation ) ! ,director ( ! ,(fice ( ,managem5t & ,budget & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & 9 consultation ) ,sector ,risk ,managem5t ,ag5cies 7z def9$ 9 section #bbja ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea77 & o!r appropriate ,f$]al ag5cies1 to coord9ate1 deconflict1 & h>monize ,f$]al incid5t report+ requirem5ts1 includ+ ^? issu$ ?r\gh regulations1 = cov]$ entities 7z def9$ 9 section #bbcj ( su* ,act7 & entities t make a ransom paym5t 7z def9$ 9 su* section #bbja 7#f ,u4,s4,c4 #fea772 & 4 7c7 ,h>moniz+ report+ requirem5ts ,! ,national ,cyb] ,director %all1 9 consultation ) ! ,director1 ! ,cyb] ,incid5t ,report+ ,c\ncil describ$ 9 section #ageb7;c77#a77;,h7 ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h771 & ! ,director ( ! ,(fice ( ,managem5t & ,budget1 to ! maximum ext5t practicable-- 7#a7 review exi/+ regulatory requirem5ts1 includ+ ! in=mation requir$ 9 su* reports1 to report cyb] incid5ts & ensure t any su* report+ requirem5ts & proc$ures avoid conflict+1 duplicative1 or burd5some requirem5ts2 & 7#b7 coord9ate ) ! ,director & regulatory au?orities t receive reports relat+ to cyb] incid5ts to id5tify opportunities to /reaml9e report+ processes1 & :]e feasible1 facilitate int]ag5cy agreem5ts betwe5 su* au?orities to p]mit ! %>+ ( su* reports1 consi/5t ) applicable law & policy1 )\t impact+ ! ability ( su* ag5cies to ga9 timely situational aw>5ess ( a cov]$ cyb] incid5t or ransom paym5t4 #e4 ,ransomw>e vuln]ability w>n+ pilot program 7a7 ,program ,n less ?an #ij days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all e/abli% a ransomw>e vuln]ability w>n+ program to lev]age exi/+ au?orities & te*nology to specifically develop processes & proc$ures1 & to d$icate res\rces1 to id5tify+ in=mation sy/ems t conta9 security vuln]abilities associat$ ) common ransomw>e attacks1 & to notify ! own]s ( ^? vuln]able sy/ems ( _! security vuln]ability4 7b7 ,id5tification ( vuln]able sy/ems ,! pilot program e/abli%$ "u subsection 7a7 %all-- 7#a7 id5tify ! mo/ common security vuln]abilities utiliz$ 9 ransomw>e attacks & mitigation te*niques2 & 7#b7 utilize exi/+ au?orities to id5tify ,f$]al & o!r relevant in=mation sy/ems t conta9 ! security vuln]abilities id5tifi$ 9 p>agraph 7#a74 7c7 ,entity notification 7#a7 ,id5tification ,if ! ,director is able to id5tify ! entity at risk t owns or op]ates a vuln]able in=mation sy/em id5tifi$ 9 subsection 7b71 ! ,director may notify ! own] ( ! in=mation sy/em4 7#b7 ,no id5tification ,if ! ,director is n able to id5tify ! entity at risk t owns or op]ates a vuln]able in=mation sy/em id5tifi$ 9 subsection 7b71 ! ,director may utilize ! subpo5a au?ority pursuant to section #bbji ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fei7 to id5tify & notify ! entity at risk pursuant to ! proc$ures )9 t section4 7#c7 ,requir$ in=mation ,a notification made "u p>agraph 7#a7 %all include in=mation on ! id5tifi$ security vuln]ability & mitigation te*niques4 7d7 ,prioritization ( notifications ,to ! ext5t practical1 ! ,director %all prioritize cov]$ entities = id5tification & notification activities "u ! pilot program e/abli%$ "u ?is section4 7e7 ,limitation on proc$ures ,no proc$ure1 notification1 or o!r au?orities utiliz$ 9 ! execution ( ! pilot program e/abli%$ "u subsection 7a7 %all require an own] or op]ator ( a vuln]able in=mation sy/em to take any action z a result ( a notice ( a security vuln]ability made pursuant to subsection 7c74 7f7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to provide additional au?orities to ! ,director to id5tify vuln]abilities or vuln]able sy/ems4 #f4 ,ransomw>e ?reat mitigation activities 7a7 ,jo9t ransomw>e task =ce 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is section1 ! ,national ,cyb] ,director %all e/abli% & *air ! ,jo9t ,ransomw>e ,task ,=ce to coord9ate an ongo+1 nationwide campaign aga9/ ransomw>e attacks1 & id5tify & pursue opportunities = int]national coop]ation4 7#b7 ,composition ,! ,jo9t ,ransomw>e ,task ,=ce %all consi/ ( p>ticipants f ,f$]al ag5cies1 z det]m9$ appropriate by ! ,national ,cyb] ,director 9 consultation ) ! ,secret>y ( ,homel& ,security4 7#c7 ,responsibilities ,! ,jo9t ,ransomw>e ,task ,=ce1 utiliz+ only exi/+ au?orities ( ea* p>ticipat+ ag5cy1 %all coord9ate across ! ,f$]al ,gov]nm5t ! foll[+ activities3 7,a7 ,prioritization ( intellig5ce-driv5 op]ations to disrupt specific ransomw>e actors4 7,b7 ,consult ) relevant private sector1 ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts & int]national /akehold]s to id5tify ne$s & e/abli% me*anisms = provid+ input into ! ,task ,=ce4 7,c7 ,id5tify+1 9 consultation ) relevant entities1 a li/ ( highe/ ?reat ransomw>e entities updat$ on an ongo+ basis1 9 ord] to facilitate-- 7i7 prioritization = ,f$]al action by appropriate ,f$]al ag5cies2 & 7ii7 id5tify metrics = success ( said actions4 7,d7 ,disrupt+ ransomw>e crim9al actors1 associat$ infra/ructure1 & _! f9ances4 7,e7 ,facilitat+ coord9ation & collaboration betwe5 ,f$]al entities & relevant entities1 includ+ ! private sector1 to improve ,f$]al actions aga9/ ransomw>e ?reats4 7,f7 ,collection1 %>+1 & analysis ( ransomw>e tr5ds to in=m ,f$]al actions4 7,g7 ,creation ( aft]-action reports & o!r lessons le>n$ f ,f$]al actions t id5tify successes & failures to improve subsequ5t actions4 7,h7 ,any o!r activities det]m9$ appropriate by ! task =ce to mitigate ! ?reat ( ransomw>e attacks aga9/ ,f$]al & non-,f$]al entities4 7b7 ,cl>ify+ private-,sector lawful def5sive measures ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,national ,cyb] ,director1 9 coord9ation ) ! ,secret>y ( ,homel& ,security & ! ,attorney ,g5]al1 %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ! ,judici>y ( ! ,s5ate & ! ,committee on ,homel& ,security1 ! ,committee on ! ,judici>y1 & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report t describes def5sive measures t private-sector actors c take :5 c\nt]+ ransomw>e attacks & :at laws ne$ to be cl>ifi$ to enable t action4 7c7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ z provid+ any additional au?ority to any ,f$]al ag5cy4 #g4 ,congressional report+ 7a7 ,report on /akehold] engagem5t ,n lat] ?an #cj days aft] ! date on :i* ! ,director issues ! int]im f9al rule "u section #bbcb7;b77#a7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #c7;b7 ( ?is ,act1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t describes h[ ! ,director engag$ /akehold]s 9 ! developm5t ( ! int]im f9al rule4 7b7 ,report on opportunities ,to /r5g!n security rese>* ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report describ+ h[ ! ,cyb] ,incid5t ,review ,(fice has c>ri$ out activities "u section #bbca7;b77#i7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #c7;b7 ( ?is ,act1 by proactively id5tify+ opportunities to use cyb] incid5t data to in=m & enabl+ cyb]security rese>* )9 ! academic & private sector4 7c7 ,report on ransomw>e vuln]ability w>n+ pilot program ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] = ! duration ( ! pilot program e/abli%$ "u section #e1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report1 :i* may include a classifi$ annex1 on ! effectiv5ess ( ! pilot program1 :i* %all include a discussion ( ! foll[+3 7#a7 ,! effectiv5ess ( ! notifications "u section #e7;c7 to mitigate security vuln]abilities & ! ?reat ( ransomw>e4 7#b7 ,! id5tification ( mo/ common vuln]abilities utiliz$ 9 ransomw>e4 7#c7 ,! numb] ( notifications issu$ dur+ ! prec$+ ye>4 7#d7 ,to ! ext5t practicable1 ! numb] ( vuln]able devices or sy/ems mitigat$ "u ?is pilot by ! ,ag5cy dur+ ! prec$+ ye>4 7d7 ,report on h>monization ( report+ regulations ,n lat] ?an #ahj days aft] ! date on :i* ! ,national ,cyb] ,director conv5es ! ,c\ncil describ$ 9 section #ageb7;c77#a77;,h7 ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7#f ,u4,s4,c4 #aejj7;c77#a77;,h771 ! ,national ,cyb] ,director %all submit to ! appropriate congressional committees a report t includes-- 7#a7 a li/ ( duplicative ,f$]al cyb] incid5t report+ requirem5ts on cov]$ entities & entities t make a ransom paym5t2 7#b7 any actions ! ,national ,cyb] ,director int5ds to take to h>monize ! duplicative report+ requirem5ts2 & 7#c7 any propos$ legislative *anges necess>y to address ! duplicative report+4 7e7 ,,gao report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report on ! implem5tation ( ?is ,act & ! am5dm5ts made by ?is ,act4