,,ii ,cal5d> ,no4 #fgc #aag? ,,congress #b;d ,session ,s4 #bijb ,report ,no4 #aag-bgd ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,septemb] #bi1 #bjba,mr4 ,pet]s 7= himself1 ,mr4 ,portman1 & ,mr4 ,c>p]7 introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ,decemb] #ai1 #bjbb,report$ by ,mr4 ,pet]s1 ) an amendment,strike out all aft] ! enact+ clause & ins]t ! "p pr9t$ 9 italic ,a ,,bill ,to mod]nize ,f$]al in=mation security managem5t1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba4 #b4 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title4,sec4 #b4 ,table ( cont5ts4,sec4 #c4 ,def9itions4,,title ,i--,updates to ,f,i,s,m,a,sec4 #aja4 ,title #dd am5dm5ts4,sec4 #ajb4 ,am5dm5ts to subtitle ,,iii ( title #dj4,sec4 #ajc4 ,actions to enhance ,f$]al incid5t response4,sec4 #ajd4 ,additional guidance to ag5cies on ,,fisma updates4,sec4 #aje4 ,ag5cy requirem5ts to notify entities impact$ by incid5ts4,,title ,,ii--,improv+ ,f$]al cybersecurity,sec4 #bja4 ,evaluation ( effectiv5ess ( /&>ds4,sec4 #bjb4 ,mobile security /&>ds4,sec4 #bjc4 ,quantitative cyb]security metrics4,sec4 #bjd4 ,data & logg+ ret5tion = incid5t response4,sec4 #bje4 ,,cisa ag5cy advisors4,sec4 #bjf4 ,f$]al p5etration te/+ policy4,sec4 #bjg4 ,ongo+ ?reat hunt+ program4,sec4 #bjh4 ,codify+ vuln]ability disclosure programs4,sec4 #bji4 ,implem5t+ presumption ( compromise & z]o tru/ ar*itectures4,sec4 #baj4 ,automation reports4,sec4 #baa4 ,ext5sion ( ,f$]al ,acquisition ,security ,c\ncil4,,title ,,iii--,pilot programs to enhance ,f$]al cybersecurity,sec4 #cja4 ,cont9u\s indep5d5t ,,fisma evaluation pilot4,sec4 #cjb4 ,active cyb] def5sive pilot4,sec4 #cjc4 ,security op]ations c5t] z a s]vice pilot4 #c4 ,def9itions ,9 ?is ,act1 unless o!rwise specifi$3 7#a7 ,additional cyb]security proc$ure ,! t]m additional cyb]security proc$ure has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7#b7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#c7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 & 7,c7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives4 7#d7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#e7 ,incid5t ,! t]m incid5t has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#f7 ,p5etration te/ ,! t]m p5etration te/ has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7#g7 ,?reat hunt+ ,! t]m ?reat hunt+ means proactively & it]atively se>*+ = ?reats to sy/ems t evade detection by automat$ ?reat detection sy/ems4 7#h7 ,v]ification specification ,! t]m v]ification specification means a specification develop$ "u section #aacca7;f7 ( title #dj1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 ,i ,updates to ,,fisma #aja4 ,title #dd am5dm5ts 7a7 ,sub*apt] ,i am5dm5ts ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #cejd-- 7,a7 9 subsection 7a77#a77;,b77v71 by /rik+ confid5tiality1 security1 disclosure1 & %>+ ( in=mation & ins]t+ disclosure1 %>+ ( in=mation1 &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 confid5tiality & security2 7,b7 9 subsection 7b77#b77;,b71 by ins]t+ 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] /&>ds = security2 7,c7 9 subsection 7g71 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ) respect to in=mation collect$ or ma9ta9$ by or = ag5cies-- 7,a7 develop & ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on privacy1 disclosure1 & %>+ ( ! in=mation2 & 7,b7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 develop & ov]see policies1 pr9ciples1 /&>ds1 & guidel9es on confid5tiality & security ( ! in=mation2 & 2 & 7,d7 9 subsection 7h77#a7-- 7i7 9 ! matt] prec$+ subp>agraph 7,a7-- 7,i7 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 be=e ! ,director2 & 7,,ii7 by ins]t+ a comma be=e & ! ,adm9i/rator2 & 7ii7 9 subp>agraph 7,a71 by ins]t+ security & aft] in=mation te*nology2 7#b7 9 section #ceje-- 7,a7 9 p>agraph 7#c7 ( ! fir/ subsection designat$ z subsection 7c7-- 7i7 9 subp>agraph 7,b7-- 7,i7 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] ,comptroll] ,g5]al2 & 7,,ii7 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c77v71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 ma9ta9$ on a cont9ual basis ?r\gh ! use ( automation1 ma*9e-readable data1 & scann+4 2 & 7,b7 by /rik+ ! second subsection designat$ z subsection 7c72 7#c7 9 section #cejf-- 7,a7 9 subsection 7b7-- 7i7 9 p>agraph 7#a77;,c71 by ins]t+ 1 availability aft] integrity2 & 7ii7 9 p>agraph 7#d71 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 aft] ,g5]al ,s]vices12 & 7,b7 9 subsection 7h77#c71 by ins]t+ security1 aft] effici5cy12 7#d7 9 section #ceac-- 7,a7 9 subsection 7a71 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 be=e ! ,adm9i/rator ( ,g5]al ,s]vices2 7,b7 by r$esignat+ subsection 7c7 z subsection 7d72 & 7,c7 by ins]t+ aft] subsection 7b7 ! foll[+3 7c7 ,ea* ag5cy provid+ a writt5 plan "u subsection 7b7 %all provide any portion ( ! writt5 plan address+ in=mation security or cyb]security to ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 2 & 7#e7 9 section #cebj;,a7b7-- 7,a7 9 p>agraph 7#a71 by /rik+ 1 protection2 7,b7 by r$esignat+ p>agraphs 7#b71 7#c71 7#d71 & 7#e7 z p>agraphs 7#c71 7#d71 7#e71 & 7#f71 respectively2 & 7,c7 by ins]t+ aft] p>agraph 7#a7 ! foll[+3 7#b7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 e/abli% ,gov]nm5twide be/ practices = ! protection ( data2 4 7b7 ,su*apt] ,,ii def9itions 7#a7 ,9 g5]al ,section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by r$esignat+ p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 & 7#g7 z p>agraphs 7#b71 7#c71 7#d71 7#e71 7#f71 7#i71 & 7#aa71 respectively2 7,b7 by ins]t+ be=e p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#a7 ,! t]m additional cyb]security proc$ure means a process1 proc$ure1 or o!r activity t is e/abli%$ 9 excess ( ! in=mation security /&>ds promulgat$ "u section #aacca7;b7 ( title #dj to increase ! security & r$uce ! cyb]security risk ( ag5cy sy/ems1 su* z cont9u\s ?reat hunt+1 increas$ network segm5tation1 endpo9t detection & response1 or p]si/5t p5etration te/+4 2 7,c7 by ins]t+ aft] p>agraph 7#f71 z s r$esignat$1 ! foll[+3 7#g7 ,! t]m high value asset means in=mation or an in=mation sy/em t ! head ( an ag5cy det]m9es s critical to ! ag5cy t ! loss or corruption ( ! in=mation or ! loss ( access to ! in=mation sy/em w\ld h a s]i\s impact on ! ability ( ! ag5cy to p]=m ! mission ( ! ag5cy or conduct bus9ess4 7#h7 ,! t]m major incid5t has ! mean+ giv5 ! t]m 9 guidance issu$ by ! ,director "u section #ceih7;a74 2 7,d7 by ins]t+ aft] p>agraph 7#i71 z s r$esignat$1 ! foll[+3 7#aj7 ,! t]m p5etration te/ means a specializ$ type ( assessm5t t-- 7,a7 is conduct$ on an in=mation sy/em or a compon5t ( an in=mation sy/em2 & 7,b7 emulates an attack or o!r exploitation capability ( a pot5tial adv]s>y1 typically "u specific con/ra9ts1 9 ord] to id5tify any vuln]abilities ( an in=mation sy/em or a compon5t ( an in=mation sy/em t c\ld be exploit$4 2 & 7,e7 by ins]t+ aft] p>agraph 7#aa71 z s r$esignat$1 ! foll[+3 7#ab7 ,! t]m %>$ s]vice means a bus9ess or mission function t is provid$ = use by multiple organizations )9 or betwe5 ag5cies4 7#ac7 ,! t]m v]ification specification means a specification develop$ "u section #aacca7;f7 ( title #dj4 4 7#b7 ,con=m+ am5dm5ts 7,a7 ,homel& ,security ,act ( #bjjb ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is am5d$ by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f77;,a7 & ins]t+ section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,c7 ,high-,p]=mance ,comput+ ,act ( #aiia ,section #bjg7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is am5d$ by /rik+ section #ceeb7;b77#f77;,a77i7 & ins]t+ section #ceeb7;b77#i77;,a77i74 7,d7 ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj ,section #c7e7 ( ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,e7 ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac ,section #icc7;e77#a77;,b7 ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac 7#aj ,u4,s4,c4 #bbbd note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa ,! ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa 7,public ,law #aaa-chc7 is am5d$-- 7i7 9 section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by /rik+ section #cedb7;b7 & ins]t+ section #ceeb7;b72 7ii7 9 section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b72 & 7iii7 9 section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,g7 ,e-,gov]nm5t ,act ( #bjjb ,section #cja7;c77#a77;,a7 ( ! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceja note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,h7 ,national ,in/itute ( ,/&>ds & ,te*nology ,act ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7i7 9 subsection 7a77#b71 by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b72 & 7ii7 9 subsection 7f7-- 7,i7 9 p>agraph 7#c71 by /rik+ section #cecb7a7 & ins]t+ section #ceeb7;b72 & 7,,ii7 9 p>agraph 7#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b74 7c7 ,sub*apt] ,,ii am5dm5ts ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #ceea-- 7,a7 by r$esignat+ p>agraphs 7#c71 7#d71 7#e71 & 7#f7 z p>agraphs 7#d71 7#e71 7#f71 & 7#g71 respectively2 7,b7 by ins]t+ aft] p>agraph 7#b7 ! foll[+3 7#c7 recognize ! role ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy z ! lead cyb]security entity = op]ational coord9ation across ! ,f$]al ,gov]nm5t2 2 7,c7 9 p>agraph 7#e71 z s r$esignat$1 by /rik+ diagnose & improve & ins]t+ integrate1 deliv]1 diagnose1 & improve2 7,d7 9 p>agraph 7#f71 z s r$esignat$1 by /rik+ & at ! end2 & 7,e7 by add+ at ! end ! foll[+3 7#h7 recognize t ea* ag5cy has specific mission requirem5ts &1 at times1 unique cyb]security requirem5ts to meet ! mission ( ! ag5cy2 7#i7 recognize t ea* ag5cy does n h ! same res\rces to secure ag5cy sy/ems1 & an ag5cy %\ld n be expect$ to h ! capability to secure ! sy/ems ( ! ag5cy f advanc$ adv]s>ies alone2 & 7#aj7 recognize t-- 7,a7 a holi/ic ,f$]al cyb]security model is necess>y to acc\nt = diff]5ces betwe5 ! missions & capabilities ( ag5cies2 & 7,b7 9 acc\nt+ = ! diff]5ces describ$ 9 subp>agraph 7,a7 & ensur+ ov]all ,f$]al cyb]security-- 7i7 ! ,(fice ( ,managem5t & ,budget is ! lead] = policy developm5t & ov]sight ( ,f$]al cyb]security2 7ii7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy is ! lead] = implem5t+ op]ations at ag5cies2 & 7iii7 ! ,national ,cyb] ,director is responsible = develop+ ! ov]all cyb]security /rategy ( ! ,unit$ ,/ates & advis+ ! ,presid5t on matt]s relat+ to cyb]security4 2 7#b7 9 section #ceec1 z am5d$ by section #agje ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7,public ,law #aaf-bhc7-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a7-- 7,i7 by /rik+ develop+ & & ins]t+ 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy12 & 7,,ii7 by ins]t+ & associat$ v]ification specifications be=e promulgat$2 & 7ii7 9 p>agraph 7#e71 by ins]t+ 1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 be=e ag5cy compliance2 7,b7 9 subsection 7b7-- 7i7 by /rik+ ! subsection head+ & ins]t+ ,cyb]security & ,infra/ructure ,security ,ag5cy2 7ii7 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ! ,secret>y & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7iii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ & report+ requirem5ts "u sub*apt] ,,iv ( ?is title aft] section #ceef2 & 7,,ii7 9 subp>agraph 7,d71 by /rik+ ! ,director or ,secret>y & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7iv7 9 p>agraph 7#e71 by /rik+ coord9at+ & ins]t+ lead+ ! coord9ation (2 7v7 9 p>agraph 7#f7-- 7,i7 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ & v]ifications specifications be=e promulgat$ "u2 7,,ii7 9 subp>agraph 7,c71 by /rik+ & at ! end2 7,,iii7 9 subp>agraph 7,d71 by add+ & at ! end2 & 7,,iv7 by add+ at ! end ! foll[+3 7,e7 tak+ any o!r action t ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director-- 7i7 may det]m9e necess>y2 & 7ii7 is au?oriz$ to p]=m2 2 7vi7 9 p>agraph 7#h71 by /rik+ ! ,secret>y's discretion & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy's discretion2 & 7vii7 9 p>agraph 7#i71 by /rik+ z ! ,director or ! ,secret>y1 9 consultation ) ! ,director1 & ins]t+ z ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,c7 9 subsection 7c7-- 7i7 9 p>agraph 7#d71 by /rik+ & at ! end2 7ii7 by r$esignat+ p>agraph 7#e7 z p>agraph 7#g72 & 7iii7 by ins]t+ aft] p>agraph 7#d7 ! foll[+3 7#e7 an assessm5t ( ag5cy use ( automat$ v]ification ( /&>ds = ! /&>ds promulgat$ "u section #aacca ( title #dj us+ v]ification specifications2 7#f7 a summ>y ( ea* assessm5t ( ,f$]al risk po/ure p]=m$ "u subsection 7i72 & 2 7,d7 9 subsection 7f77#b77;,b71 by /rik+ conflict ) & ins]t+ r$uce ! security po/ure ( ag5cies e/abli%$ "u2 7,e7 by r$esignat+ subsections 7i71 7j71 7k71 & 7l7 z subsections 7j71 7k71 7l71 & 7m7 respectively2 7,f7 by ins]t+ aft] subsection 7h7 ! foll[+3 7i7 ,f$]al risk assessm5ts ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director1 %all p]=m1 on an ongo+ & cont9u\s basis1 assessm5ts ( ,f$]al risk po/ure us+ any available in=mation on ! cyb]security po/ure ( ag5cies1 includ+-- 7#a7 ! /atus ( ag5cy cyb]security rem$ial actions describ$ 9 section #ceed7;b77#g72 7#b7 any vuln]ability in=mation relat+ to ! sy/ems ( an ag5cy t is kn[n by ! ag5cy2 7#c7 analysis ( incid5t in=mation "u section #ceig2 7#d7 evaluation ( p5etration te/+ p]=m$ "u section #ceei;,a2 7#e7 evaluation ( vuln]ability disclosure program in=mation "u section #ceei;,b2 7#f7 evaluation ( ag5cy ?reat hunt+ results2 7#g7 evaluation ( ,f$]al & non-,f$]al ?reat intellig5ce2 7#h7 data on compliance ) /&>ds issu$ "u section #aacca ( title #dj t1 :5 appropriate1 uses v]ification specifications2 7#i7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 & 7#aj7 any o!r in=mation ! ,secret>y det]m9es relevant4 2 & 7,g7 9 subsection 7j71 z s r$esignat$-- 7i7 by /rik+ reg>d+ ! specific & ins]t+ 8t includes a summ>y (-- 7#a7 ! specific 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 & & 7iii7 by add+ at ! end ! foll[+3 7#b7 ! tr5ds id5tifi$ 9 ! ,f$]al risk assessm5t p]=m$ "u subsection 7i74 2 7#c7 9 section #ceed-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a7-- 7,i7 by r$esignat+ subp>agraphs 7,a71 7,b71 & 7,c7 z subp>agraphs 7,b71 7,c71 & 7,d71 respectively2 7,,ii7 by ins]t+ be=e subp>agraph 7,b71 z s r$esignat$1 ! foll[+3 7,a7 p]=m+1 n less frequ5tly ?an once e #b ye>s or bas$ on a significant *ange to sy/em ar*itecture or security po/ure1 an ag5cy sy/em risk assessm5t t-- 7i7 id5tifies & docum5ts ! high value assets ( ! ag5cy us+ guidance f ! ,director2 7ii7 evaluates ! data assets inv5tori$ "u section #ceaa ( title #dd = s5sitivity to compromises 9 confid5tiality1 integrity1 & availability2 7iii7 id5tifies ag5cy sy/ems t h access to or hold ! data assets inv5tori$ "u section #ceaa ( title #dd2 7iv7 evaluates ! ?reats fac+ ag5cy sy/ems & data1 includ+ high value assets1 bas$ on ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available2 7v7 evaluates ! vuln]ability ( ag5cy sy/ems & data1 includ+ high value assets1 bas$ on-- 7,i7 ! results ( p5etration te/+ p]=m$ by ! ,dep>tm5t ( ,homel& ,security "u section #ceec7;b77#i72 7,,ii7 ! results ( p5etration te/+ p]=m$ "u section #ceei;,a2 7,,iii7 in=mation provid$ to ! ag5cy ?r\gh ! vuln]ability disclosure program ( ! ag5cy "u section #ceei;,b2 7,,iv7 incid5ts2 & 7,v7 any o!r vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7vi7 assesses ! impacts ( pot5tial ag5cy incid5ts to ag5cy sy/ems1 data1 & op]ations bas$ on ! evaluations describ$ 9 clauses 7ii7 & 7iv7 & ! ag5cy sy/ems id5tifi$ "u clause 7iii72 & 7vii7 assesses ! consequ5ces ( pot5tial incid5ts occurr+ on ag5cy sy/ems t w\ld impact sy/ems at o!r ag5cies1 includ+ due to int]connectivity betwe5 diff]5t ag5cy sy/ems or op]ational reliance on ! op]ations ( ! sy/em or data 9 ! sy/em2 2 7,,iii7 9 subp>agraph 7,b71 z s r$esignat$-- 7aa7 9 ! matt] prec$+ clause 7i71 by /rik+ provid+ in=mation & ins]t+ us+ in=mation f ! assessm5t conduct$ "u subp>agraph 7,a71 provid+1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 in=mation2 7bb7 9 clause 7i71 by /rik+ & at ! end2 7cc7 9 clause 7ii71 by add+ & at ! end2 & 7dd7 by add+ at ! end ! foll[+3 7iii7 9 consultation ) ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 in=mation or in=mation sy/ems us$ by ag5cies ?r\gh %>$ s]vices1 memor&a ( und]/&+1 or o!r agreem5ts2 2 7,,iv7 9 subp>agraph 7,c71 z s r$esignat$-- 7aa7 9 clause 7ii7 by ins]t+ b9d+ be=e op]ational2 & 7bb7 9 clause 7vi71 by /rik+ & at ! end2 & 7,v7 by add+ at ! end ! foll[+3 7,e7 n lat] ?an #cj days aft] ! date on :i* an ag5cy sy/em risk assessm5t is p]=m$ "u subp>agraph 7,a71 provid+ ! assessm5t to-- 7i7 ! ,director2 7ii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7iii7 ! ,national ,cyb] ,director2 7,f7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & n less frequ5tly ?an annually1 p]=m+ an evaluation ( :e!r additional cyb]security proc$ures are appropriate = secur+ a sy/em (1 or "u ! sup]vision (1 ! ag5cy1 :i* %all-- 7i7 be complet$ consid]+ ! ag5cy sy/em risk assessm5t p]=m$ "u subp>agraph 7,a72 & 7ii7 include a specific evaluation = high value assets2 & 7,g7 n lat] ?an #cj days aft] complet+ ! evaluation p]=m$ "u subp>agraph 7,f71 provid+ ! evaluation & an implem5tation plan = us+ additional cyb]security proc$ures det]m9$ to be appropriate to-- 7i7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7ii7 ! ,director2 & 7iii7 ! ,national ,cyb] ,director4 2 7ii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ 9 accordance ) ! ag5cy sy/em risk assessm5t p]=m$ "u p>agraph 7#a77;,a7 aft] in=mation sy/ems2 7,,ii7 9 subp>agraph 7,b7-- 7aa7 by /rik+ 9 accordance ) /&>ds & ins]t+ 89 accordance )-- 7i7 /&>ds 2 & 7bb7 by add+ at ! end ! foll[+3 7ii7 ! evaluation p]=m$ "u p>agraph 7#a77;,f72 & 7iii7 ! implem5tation plan describ$ 9 p>agraph 7#a77;,g72 2 & 7,,iii7 9 subp>agraph 7,d71 by ins]t+ 1 ?r\gh ! use ( p5etration te/+1 ! vuln]ability disclosure program e/abli%$ "u section #ceei;,b1 & o!r means1 aft] p]iodically2 7iii7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,b71 by ins]t+ 1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 aft] ma9ta9+2 7,,ii7 9 subp>agraph 7,d71 by /rik+ & at ! end2 7,,iii7 9 subp>agraph 7,e71 by add+ & at ! end2 & 7,,iv7 by add+ at ! end ! foll[+3 7,f7 implem5t+ me*anisms = us+ v]ification specifications1 or alt]nate v]ification specifications validat$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 to automatically v]ify ! implem5tation ( /&>ds ( ag5cy sy/ems promulgat$ "u section #aacca ( title #dj or any additional cyb]security proc$ures1 z applicable2 2 & 7iv7 9 p>agraph 7#e71 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy be=e on ! effectiv5ess2 7,b7 9 subsection 7b7-- 7i7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 pursuant to subsection 7a77#a77;,a71 p]=m+ an ag5cy sy/em risk assessm5t1 :i* %all include us+ automat$ tools consi/5t ) /&>ds1 v]ification specifications1 & guidel9es promulgat$ "u section #aacca ( title #dj1 z applicable2 2 7ii7 9 p>agraph 7#b77;,d7-- 7,i7 by r$esignat+ clauses 7iii7 & 7iv7 z clauses 7iv7 & 7v71 respectively2 7,,ii7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 b9d+ op]ational directives & em]g5cy directives promulgat$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceec ( title #dd2 2 & 7,,iii7 9 clause 7iv71 z s r$esignat$1 by /rik+ z det]m9$ by ! ag5cy2 & & ins]t+ 8z det]m9$ by ! ag5cy-- 7,i7 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,,ii7 9 consid]ation (-- 7aa7 ! ag5cy risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 & 7bb7 ! det]m9ations ( apply+ m /r+5t /&>ds & additional cyb]security proc$ures pursuant to section #aacca7;c77#a7 ( title #dj2 & 2 7iii7 9 p>agraph 7#e7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ 1 includ+ p5etration te/+1 z appropriate1 aft] %all include te/+2 & 7,,ii7 9 subp>agraph 7,c71 by ins]t+ 1 v]ification specifications1 aft] ) /&>ds2 7iv7 9 p>agraph 7#f71 by /rik+ plann+1 implem5t+1 evaluat+1 & docum5t+ & ins]t+ plann+ & implem5t+ &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 evaluat+ & docum5t+2 7v7 by r$esignat+ p>agraphs 7#g7 & 7#h7 z p>agraphs 7#i7 & 7#aj71 respectively2 7vi7 by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 a process = provid+ ! /atus ( e rem$ial action & kn[n sy/em vuln]ability to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable2 7#h7 a process = provid+ ! v]ification ( ! implem5tation ( /&>ds promulgat$ "u section #aacca ( title #dj us+ v]ification specifications1 automation1 & ma*9e-readable data1 to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 2 & 7vii7 9 p>agraph 7#i77;,c71 z s r$esignat$-- 7,i7 by /rik+ clause 7ii7 & ins]t+ ! foll[+3 7ii7 notify+ & consult+ ) ! ,f$]al in=mation security incid5t c5t] e/abli%$ "u section #ceef pursuant to ! requirem5ts ( section #ceid2 2 7,,ii7 by r$esignat+ clause 7iii7 z clause 7iv72 7,,iii7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 p]=m+ ! notifications & o!r activities requir$ "u sub*apt] ,,iv ( ?is title2 & 2 & 7,,iv7 9 clause 7iv71 z s r$esignat$-- 7aa7 9 subclause 7,i71 by /rik+ & relevant ,(fices ( ,inspector ,g5]al2 7bb7 9 subclause 7,,ii71 by add+ & at ! end2 7cc7 by /rik+ subclause 7,,iii72 & 7dd7 by r$esignat+ subclause 7,,iv7 z subclause 7,,iii72 7,c7 9 subsection 7c7-- 7i7 9 p>agraph 7#a7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 9 ! matt] prec$+ clause 7i71 by /rik+ on ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices1 includ+ & ins]t+ t includes2 & 7bb7 9 clause 7ii71 by ins]t+ unless ! ,director issues a waiv] to ! ag5cy "u subp>agraph 7,b77iii71 be=e ! total numb]2 & 7,,ii7 by /rik+ subp>agraph 7,b7 & ins]t+ ! foll[+3 7,b7 ,incid5t report+ waiv] 7i7 ,c]tification ( ag5cy in=mation %>+ ,if ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 det]m9es t an ag5cy %>es any in=mation relat+ to any incid5t pursuant to section #ceid7;a71 ! ,director %all c]tify t ! ag5cy is 9 compliance ) t section4 7ii7 ,c]tification ( issu+ report ,if ! ,director det]m9es t ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy uses ! in=mation describ$ 9 clause 7i7 ) respect to a p>ticul> ag5cy to submit to ,congress an annex requir$ "u section #ceig7;c77#c7 = t ag5cy1 ! ,director %all c]tify t ! ,cyb]security & ,infra/ructure ,security ,ag5cy is 9 compliance ) t section ) respect to t ag5cy4 7iii7 ,waiv] ,! ,director may waive ! report+ requirem5t ) respect to ! in=mation requir$ to be includ$ 9 ! report "u subp>agraph 7,a77ii7 = a p>ticul> ag5cy if-- 7,i7 ! ,director has issu$ a c]tification = ! ag5cy "u clause 7i72 & 7,,ii7 ! ,director has issu$ a c]tification ) respect to ! annex ( ! ag5cy "u clause 7ii74 7iv7 ,revocation ( waiv] or c]tifications 7,i7 ,waiv] ,if1 at any "t1 ! ,director det]m9es t ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy _c submit to ,congress an annex = a p>ticul> ag5cy "u section #ceig7;c77#c7-- 7aa7 any waiv] previ\sly issu$ "u clause 7iii7 ) respect to t ag5cy %all be consid]$ void2 & 7bb7 ! ,director %all revoke ! c]tification = ! annex ( t ag5cy "u clause 7ii74 7,,ii7 ,c]tifications ,if1 at any "t1 ! ,director det]m9es t an ag5cy has n provid$ to ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy ! totality ( incid5t in=mation requir$ "u section #ceid7;a7-- 7aa7 any waiv] previ\sly issu$ "u clause 7iii7 ) respect to t ag5cy %all be consid]$ void2 & 7bb7 ! ,director %all revoke ! c]tification = t ag5cy "u clause 7i74 7,,iii7 ,reissuance ,if ! ,director revokes a waiv] "u ?is clause1 ! ,director may issue a subsequ5t waiv] if ! ,director issues new c]tifications "u clauses 7i7 & 7ii74 2 7ii7 by r$esignat+ p>agraphs 7#b7 ?r\gh 7#e7 z p>agraphs 7#d7 ?r\gh 7#g71 respectively2 & 7iii7 by ins]t+ aft] p>agraph 7#a7 ! foll[+3 7#b7 ,biannual report ,n lat] ?an #ahj days aft] ! date on :i* an ag5cy completes an ag5cy sy/em risk assessm5t "u subsection 7a77#a77;,a7 & n less frequ5tly ?an e #b ye>s1 ea* ag5cy %all submit to ! ,director1 ! ,secret>y1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 ! appropriate au?orization & appropriations committees ( ,congress1 ! ,national ,cyb] ,director1 & ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates a report t-- 7,a7 summ>izes ! ag5cy sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 7,b7 evaluates ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices ( ! ag5cy to address ! risks id5tifi$ 9 ! sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 & 7,c7 summ>izes ! evaluations & implem5tation plans describ$ 9 subp>agraphs 7,f7 & 7,g7 ( subsection 7a77#a7 & :e!r ^? evaluations & implem5tation plans call = ! use ( additional cyb]security proc$ures det]m9$ to be appropriate by ! ag5cy4 7#c7 ,unclassifi$ reports ,ea* report submitt$ "u p>agraphs 7#a7 & 7#b7-- 7,a7 %all be1 to ! greate/ ext5t practicable1 9 an unclassifi$ & o!rwise uncontroll$ =m2 & 7,b7 may include a classifi$ annex4 2 & 7,d7 9 subsection 7d77#a71 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] ! ,director2 7#d7 9 section #ceee-- 7,a7 9 subsection 7a77#b77;,a71 by ins]t+ 1 includ+ by p5etration te/+ & analyz+ ! vuln]ability disclosure program ( ! ag5cy aft] in=mation sy/ems2 7,b7 by /rik+ subsection 7f7 & ins]t+ ! foll[+3 7f7 ,protection ( in=mation 7#a7 ,ag5cies & evaluators %all take appropriate /eps to ensure ! protection ( in=mation :i*1 if disclos$1 may adv]sely affect in=mation security4 7#b7 ,! protections requir$ "u p>agraph 7#a7 %all be comm5surate ) ! risk & comply ) all applicable laws & regulations4 7#c7 ,) respect to in=mation t is n relat$ to national security sy/ems1 ag5cies & evaluators %all make a summ>y ( ! in=mation unclassifi$ & publicly available1 includ+ in=mation t does n id5tify-- 7,a7 specific in=mation sy/em incid5ts2 or 7,b7 specific in=mation sy/em vuln]abilities4 2 7,c7 9 subsection 7g77#b7-- 7i7 by /rik+ ?is subsection %all & ins]t+ 8?is subsection-- 7,a7 %all 2 7ii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,b7 id5tify any entity t p]=ms an indep5d5t audit "u subsection 7b74 2 & 7,d7 9 subsection 7j71 by /rik+ ! ,secret>y & ins]t+ ! ,director ( ! ,cyb] ,security & ,infra/ructure ,security ,ag5cy2 & 7#e7 9 section #ceef7;a7-- 7,a7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] incid5t c5t]2 & 7,b7 9 p>agraph 7#d71 by /rik+ #ceed7;b7 & ins]t+ #ceed7;a77#a77;,a74 7d7 ,f$]al sy/em incid5t response 7#a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,iv ,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! def9itions "u sections #cejb & #ceeb %all apply to ?is sub*apt]4 7b7 ,additional def9itions ,z us$ 9 ?is sub*apt]3 7#a7 ,appropriate notification entities ,! t]m appropriate notification entities means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 7,c7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7,d7 ! appropriate au?orization & appropriations committees ( ,congress2 7,e7 ! ,director2 7,f7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,g7 ! ,national ,cyb] ,director2 & 7,h7 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates4 7#b7 ,contractor ,! t]m contractor-- 7,a7 means any p]son or bus9ess t collects or ma9ta9s in=mation t includes p]sonally id5tifiable in=mation or s5sitive p]sonal in=mation on behalf ( an ag5cy2 & 7,b7 includes any subcontractor ( a p]son or bus9ess describ$ 9 subp>agraph 7,a74 7#c7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 ! t]m 9 section #c ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc74 7#d7 ,nationwide consum] report+ ag5cy ,! t]m nationwide consum] report+ ag5cy means a consum] report+ ag5cy describ$ 9 section #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#e7 ,vuln]ability disclosure ,! t]m vuln]ability disclosure means a vuln]ability id5tifi$ "u section #ceei;,b4 #ceib4 ,notification ( high risk exposure aft] major incid5t 7a7 ,notification ,z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #cj days aft] an ag5cy has a reasonable basis to conclude t a major incid5t has occurr$ due to a high risk exposure ( p]sonal id5tifiable in=mation1 z describ$ 9 section #ceih7;c77#b71 ! head ( ! ag5cy %all provide notice ( ! major incid5t 9 accordance ) subsection 7b7 9 writ+ to ! la/ kn[n home mail+ address ( ea* individual :om ! major incid5t may h impact$4 7b7 ,cont5ts ( notice ,ea* notice to an individual requir$ "u subsection 7a7 %all include-- 7#a7 a description ( ! rationale = ! det]m9ation t ! major incid5t result$ 9 a high risk ( exposure ( ! p]sonal in=mation ( ! individual2 7#b7 an assessm5t ( ! type ( risk ! individual may face z a result ( an exposure2 7#c7 contact in=mation = ! ,f$]al ,bureau ( ,inve/igation or o!r appropriate entity2 7#d7 ! contact in=mation ( ea* nationwide consum] report+ ag5cy2 7#e7 ! contact in=mation = que/ions to ! ag5cy1 includ+ a telephone numb]1 e-mail address1 & website2 7#f7 in=mation on any rem$y be+ (f]$ by ! ag5cy2 7#g7 consolidat$ ,f$]al ,gov]nm5t recomm5dations on :at to d 9 ! ev5t ( a major incid5t2 & 7#h7 any o!r appropriate in=mation z det]m9$ by ! head ( ! ag5cy4 7c7 ,delay ( notification 7#a7 ,9 g5]al ,! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 or ! ,secret>y ( ,homel& ,security may impose a delay ( a notification requir$ "u subsection 7a7 if ! notification w\ld disrupt a law en=cem5t inve/igation1 endang] national security1 or hamp] security rem$iation actions4 7#b7 ,docum5tation 7,a7 ,9 g5]al ,any delay "u p>agraph 7#a7 %all be report$ 9 writ+ to ! head ( ! ag5cy1 ! ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & ! ,(fice ( ,inspector ,g5]al ( ! ag5cy t exp]i5c$ ! major incid5t4 7,b7 ,cont5ts ,a /atem5t requir$ "u subp>agraph 7,a7 %all include a writt5 /atem5t f ! entity t delay$ ! notification expla9+ ! ne$ = ! delay4 7,c7 ,=m ,! /atem5t requir$ "u subp>agraph 7,a7 %all be unclassifi$1 b may include a classifi$ annex4 7#c7 ,r5ewal ,a delay "u p>agraph 7#a7 %all be = a p]iod ( #b mon?s & may be r5ew$4 7d7 ,update notification ,if an ag5cy det]m9es !re is a *ange 9 ! reasonable basis to conclude t a major incid5t occurr$1 or t !re is a *ange 9 ! details ( ! in=mation provid$ to impact$ individuals z describ$ 9 subsection 7b71 ! ag5cy %all z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #cj days aft] su* a det]m9ation1 notify all su* individuals :o receiv$ a notification pursuant to subsection 7a7 ( ^? *anges4 7e7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ,director f issu+ guidance reg>d+ notifications or ! head ( an ag5cy f s5d+ notifications to individuals impact$ by incid5ts n det]m9$ to be major incid5ts2 or 7#b7 ! ,director f issu+ guidance reg>d+ notifications ( major incid5ts or ! head ( an ag5cy f issu+ notifications to individuals impact$ by major incid5ts t conta9 m in=mation ?an describ$ 9 subsection 7b74 #ceic4 ,congressional notifications & reports 7a7 ,initial report 7#a7 ,9 g5]al ,n lat] ?an #e days aft] ! date on :i* an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy %all submit a writt5 notification &1 to ! ext5t practicable1 provide a brief+1 to ! appropriate notification entities1 tak+ into acc\nt-- 7,a7 ! in=mation kn[n at ! "t ( ! notification2 7,b7 ! s5sitivity ( ! details associat$ ) ! major incid5t2 & 7,c7 ! classification level ( ! in=mation conta9$ 9 ! notification4 7#b7 ,cont5ts ,a notification requir$ "u p>agraph 7#a7 %all include-- 7,a7 a summ>y ( ! in=mation available ab\t ! major incid5t1 includ+ h[ ! major incid5t occurr$1 bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! report2 7,b7 if applicable1 an e/imate ( ! numb] ( individuals impact$ by ! major incid5t1 includ+ an assessm5t ( ! risk level to impact$ individuals bas$ on ! guidance promulgat$ "u section #ceih7;c77#a7 & any in=mation available to ag5cy (ficials on ! date on :i* ! ag5cy submits ! report2 7,c7 if applicable1 a description & any associat$ docum5tation ( any circum/ances necessitat+ a delay 9 or exemption to notification grant$ "u subsection 7c7 or 7d7 ( section #ceib2 & 7,d7 if applicable1 an assessm5t ( ! impacts to ! ag5cy1 ! ,f$]al ,gov]nm5t1 or ! security ( ! ,unit$ ,/ates1 bas$ on in=mation available to ag5cy (ficials on ! date on :i* ! ag5cy submits ! report4 7b7 ,supplem5tal report ,)9 a reasonable am\nt ( "t1 b n lat] ?an #de days aft] ! date on :i* additional in=mation relat+ to a major incid5t = :i* an ag5cy submitt$ a writt5 notification "u subsection 7a7 is discov]$ by ! ag5cy1 ! head ( ! ag5cy %all submit to ! appropriate notification entities updates to ! writt5 notification t include summ>ies (-- 7#a7 ! ?reats & ?reat actors1 vuln]abilities1 means by :i* ! major incid5t occurr$1 & impacts to ! ag5cy relat+ to ! major incid5t2 7#b7 any risk assessm5t & subsequ5t risk-bas$ security implem5tation ( ! affect$ in=mation sy/em be=e ! date on :i* ! major incid5t occurr$2 7#c7 ! /atus ( compliance ( ! affect$ in=mation sy/em ) applicable security requirem5ts at ! "t ( ! major incid5t2 7#d7 an e/imate ( ! numb] ( individuals affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! update2 7#e7 an update to ! assessm5t ( ! risk ( h>m to impact$ individuals affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! update2 7#f7 an update to ! assessm5t ( ! risk to ag5cy op]ations1 or to impacts on o!r ag5cy or non-,f$]al entity op]ations1 affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! update2 & 7#g7 ! detection1 response1 & rem$iation actions ( ! ag5cy1 includ+ any support provid$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceid7;d7 & /atus updates on ! notification process describ$ 9 section #ceib7;a71 includ+ any delay or exemption describ$ 9 subsection 7c7 or 7d71 respectively1 ( section #ceib1 if applicable4 7c7 ,update ,report ,if ! ag5cy det]m9es t !re is any significant *ange 9 ! und]/&+ ( ! ag5cy ( ! scope1 scale1 or consequ5ce ( a major incid5t = :i* an ag5cy submitt$ a writt5 notification "u subsection 7a71 ! ag5cy %all provide an updat$ report to ! appropriate notification entities t includes in=mation relat+ to ! *ange 9 und]/&+4 7d7 ,annual report ,ea* ag5cy %all submit z "p ( ! annual report requir$ "u section #ceed7;c77#a7 ( ?is title a description ( ea* major incid5t t occurr$ dur+ ! #a-ye> p]iod prec$+ ! date on :i* ! report is submitt$4 7e7 ,delay & exemption report ,! ,director %all submit to ! appropriate notification entities an annual report on all notification delays & exemptions grant$ pursuant to subsections 7c7 & 7d7 ( section #ceib4 7f7 ,report deliv]y ,any writt5 notification or report requir$ to be submitt$ "u ?is section may be submitt$ 9 a pap] or electronic =mat4 7g7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ability ( an ag5cy to provide additional reports or brief+s to ,congress2 or 7#b7 ,congress f reque/+ additional in=mation f ag5cies ?r\gh reports1 brief+s1 or o!r means4 7h7 ,b9d+ op]ational directive ,if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy issues a b9d+ op]ational directive or an em]g5cy directive "u section #ceec1 n lat] ?an #b days aft] ! date on :i* ! b9d+ op]ational directive requires an ag5cy to take an action1 ea* ag5cy %all provide to ! appropriate notification entities ! /atus ( ! implem5tation ( ! b9d+ op]ational directive at ! ag5cy4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response 7a7 ,9 g5]al 7#a7 ,incid5t report+ ,! head ( ea* ag5cy %all provide any in=mation relat+ to any incid5t1 :e!r ! in=mation is obta9$ by ! ,f$]al ,gov]nm5t directly or indirectly1 to ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,(fice ( ,managem5t & ,budget4 7#b7 ,cont5ts ,a provision ( in=mation relat+ to an incid5t made by ! head ( an ag5cy "u p>agraph 7#a7 %all-- 7,a7 include detail$ in=mation ab\t ! safegu>ds t 7 9 place :5 ! incid5t occurr$2 7,b7 :e!r ! ag5cy implem5t$ ! safegu>ds describ$ 9 subp>agraph 7,a7 correctly2 & 7,c7 9 ord] to protect aga9/ a simil> incid5t1 id5tify-- 7i7 h[ ! safegu>ds describ$ 9 subp>agraph 7,a7 %\ld be implem5t$ diff]5tly2 & 7ii7 additional necess>y safegu>ds4 7b7 ,compliance ,! in=mation provid$ "u subsection 7a7 %all-- 7#a7 take into acc\nt ! level ( classification ( ! in=mation & any in=mation %>+ limitations relat+ to law en=cem5t2 & 7#b7 be 9 compliance ) ! requirem5ts limit+ ! release ( in=mation "u section #eeb;a ( title #e 7commonly kn[n z ! ,privacy ,act ( #aigd74 7c7 ,respond+ to in=mation reque/s f ag5cies exp]i5c+ incid5ts ,an ag5cy t receives a reque/ f ano!r ag5cy or ,f$]al entity = in=mation specifically int5d$ to assi/ 9 ! rem$iation or notification requirem5ts due to an incid5t %all provide t in=mation to ! greate/ ext5t possible1 9 accordance ) guidance issu$ by ! ,director & tak+ into acc\nt classification1 law en=cem5t1 national security1 & compliance ) section #eeb;a ( title #e 7commonly kn[n z ! ,privacy ,act ( #aigd74 7d7 ,incid5t response ,ea* ag5cy t has a reasonable basis to conclude t a major incid5t occurr$1 reg>dless ( delays f notification grant$ = a major incid5t1 %all consult ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy reg>d+-- 7#a7 incid5t response & recov]y2 & 7#b7 recomm5dations = mitigat+ future incid5ts4 #ceie4 ,responsibilities ( contractors & grant recipi5ts 7a7 ,notification 7#a7 ,9 g5]al ,subject to p>agraph 7#c71 any contractor ( an ag5cy or recipi5t ( a grant f an ag5cy t has a reasonable basis to conclude t an incid5t involv+ ,f$]al in=mation has occurr$ %all imm$iately notify ! ag5cy4 7#b7 ,proc$ures 7,a7 ,major incid5t ,foll[+ notification ( a major incid5t by a contractor or recipi5t ( a grant "u p>agraph 7#a71 an ag5cy1 9 consultation ) ! contractor or grant recipi5t1 z applicable1 %all c>ry out ! requirem5ts "u sections #ceib1 #ceic1 & #ceid ) respect to ! major incid5t4 7,b7 ,incid5t ,foll[+ notification ( an incid5t by a contractor or recipi5t ( a grant "u p>agraph 7#a71 an ag5cy1 9 consultation ) ! contractor or grant recipi5t1 z applicable1 %all c>ry out ! requirem5ts "u section #ceid ) respect to ! incid5t4 7#c7 ,applicability ,?is subsection %all apply to a contractor ( an ag5cy or a recipi5t ( a grant f an ag5cy t-- 7,a7 receives in=mation f ! ag5cy t ! contractor or recipi5t1 z applicable1 is n contractually au?oriz$ to receive2 7,b7 exp]i5ces an incid5t relat+ to ,f$]al in=mation on an in=mation sy/em ( ! contractor or recipi5t1 z applicable2 or 7,c7 id5tifies an incid5t involv+ a ,f$]al in=mation sy/em4 7b7 ,incid5t response ,any contractor ( an ag5cy or recipi5t ( a grant f an ag5cy t has a reasonable basis to conclude t a major incid5t occurr$ %all1 9 coord9ation ) ! ag5cy1 consult ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy reg>d+-- 7#a7 incid5t response assi/ance2 & 7#b7 recomm5dations = mitigat+ future incid5ts at ! ag5cy4 7c7 ,effective date ,?is section %all apply on & aft] ! date t is #a ye> aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba4 #ceif4 ,tra9+ 7a7 ,9 g5]al ,ea* ag5cy %all develop tra9+ = individuals at ! ag5cy ) access to ,f$]al in=mation or in=mation sy/ems on h[ to id5tify & respond to an incid5t1 includ+-- 7#a7 ! int]nal process at ! ag5cy = report+ an incid5t2 & 7#b7 ! obligation ( ! individual to report to ! ag5cy a confirm$ major incid5t & any suspect$ incid5t1 involv+ in=mation 9 any m$ium or =m1 includ+ pap]1 oral1 & electronic4 7b7 ,applicability ,! tra9+ develop$ "u subsection 7a7 %all-- 7#a7 be requir$ = an individual be=e ! individual may access ,f$]al in=mation or in=mation sy/ems2 & 7#b7 apply to individuals ) tempor>y access to ,f$]al in=mation or in=mation sy/ems1 su* z detailees1 contractors1 subcontractors1 grantees1 volunte]s1 & int]ns4 7c7 ,inclusion 9 annual tra9+ ,! tra9+ develop$ "u subsection 7a7 may be includ$ z "p ( an annual privacy or security aw>5ess tra9+ ( ! ag5cy1 z applicable4 #ceig4 ,analysis & report on ,f$]al incid5ts 7a7 ,def9ition ( compromise ,9 ?is section1 ! t]m compromise means-- 7#a7 an incid5t2 7#b7 a result ( a p5etration te/ 9 :i* ! te/] successfully ga9s access to a sy/em )9 ! /&>ds "u section #ceei;,a2 7#c7 a vuln]ability disclosure2 or 7#d7 any o!r ev5t t ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es id5tifies an exploitable vuln]ability 9 an ag5cy sy/em4 7b7 ,analysis ( ,f$]al incid5ts 7#a7 ,9 g5]al ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all p]=m cont9u\s monitor+ ( compromises ( ag5cies4 7#b7 ,quantitative & ,qualitative analyses ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all develop & p]=m cont9u\s monitor+ & quantitative & qualitative analyses ( compromises ( ag5cies1 includ+-- 7,a7 ! causes ( successful compromises1 includ+-- 7i7 attack] tactics1 te*niques1 & proc$ures2 & 7ii7 sy/em vuln]abilities1 includ+ z]o days1 unpat*$ sy/ems1 & in=mation sy/em misconfigurations2 7,b7 ! scope & scale ( compromises ( ag5cies2 7,c7 cross ,f$]al ,gov]nm5t root causes ( compromises ( ag5cies2 7,d7 ag5cy response1 recov]y1 & rem$iation actions & effectiv5ess ( incid5ts1 z applicable2 & 7,e7 lessons le>n$ & recomm5dations 9 respond+1 recov]+1 rem$iat+1 & mitigat+ future incid5ts4 7#c7 ,automat$ analysis ,! analyses develop$ "u p>agraph 7#b7 %all1 to ! greate/ ext5t practicable1 use ma*9e readable data1 automation1 & ma*9e le>n+ processes4 7#d7 ,%>+ ( data & analysis 7,a7 ,9 g5]al ,! ,director %all %>e on an ongo+ basis ! analyses requir$ "u ?is subsection ) ag5cies to-- 7i7 improve ! und]/&+ ( ag5cies ) respect to risk2 & 7ii7 support ! cyb]security improvem5t ef=ts ( ag5cies4 7,b7 ,=mat ,9 c>ry+ out subp>agraph 7,a71 ! ,director %all %>e ! analyses-- 7i7 9 human-readable writt5 products2 & 7ii7 to ! greate/ ext5t practicable1 9 ma*9e-readable =mats 9 ord] to enable automat$ intake & use by ag5cies4 7c7 ,annual report on ,f$]al compromises ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is section1 & n less frequ5tly ?an annually !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all submit to ! appropriate notification entities a report t includes-- 7#a7 a summ>y ( causes ( compromises f across ! ,f$]al ,gov]nm5t t categorizes ^? compromises by ! items describ$ 9 p>agraphs 7#a7 ?r\gh 7#d7 ( subsection 7a72 7#b7 ! quantitative & qualitative analyses ( compromises develop$ "u subsection 7b77#b7 on an ag5cy-by-ag5cy basis & compreh5sively2 & 7#c7 an annex = ea* ag5cy t includes ! total numb] ( compromises ( ! ag5cy & categorizes ^? compromises by ! items describ$ 9 p>agraphs 7#a7 ?r\gh 7#d7 ( subsection 7a74 7d7 ,publication ,a v]sion ( ea* report submitt$ "u subsection 7c7 %all be made publicly available on ! website ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy dur+ ! ye> 9 :i* ! report is submitt$4 7e7 ,in=mation provid$ by ag5cies ,! analysis requir$ "u subsection 7b7 & ea* report submitt$ "u subsection 7c7 %all utilize in=mation provid$ by ag5cies pursuant to section #ceid7;d74 7f7 ,requirem5t ,to ,anonymize ,in=mation ,9 publi%+ ! public report requir$ "u subsection 7d71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all suffici5tly anonymize & compile in=mation su* t no specific incid5ts ( an ag5cy c be id5tifi$1 except ) ! concurr5ce ( ! ,director ( ! ,(fice ( ,managem5t & ,budget & 9 consultation ) ! impact$ ag5cy4 #ceih4 ,major incid5t guidance 7a7 ,9 g5]al ,n lat] ?an #ij days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,managem5t ,act ( #bjba1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop & promulgate guidance on ! def9ition ( ! t]m major incid5t = ! purposes ( sub*apt] ,,ii & ?is sub*apt]4 7b7 ,requirem5ts ,) respect to ! guidance issu$ "u subsection 7a71 ! def9ition ( ! t]m major incid5t %all-- 7#a7 include1 ) respect to any in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy or an in=mation sy/em us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or ano!r organization on behalf ( an ag5cy-- 7,a7 any incid5t ! head ( ! ag5cy det]m9es is likely to h an impact on ! national security1 homel& security1 or economic security ( ! ,unit$ ,/ates2 7,b7 any incid5t ! head ( ! ag5cy det]m9es is likely to h an impact on ! op]ations ( ! ag5cy1 a compon5t ( ! ag5cy1 or ! ,f$]al ,gov]nm5t1 includ+ an impact on ! effici5cy or effectiv5ess ( ag5cy in=mation sy/ems2 7,c7 any incid5t t ! head ( an ag5cy1 9 consultation ) ! ,*ief ,privacy ,(fic] ( ! ag5cy1 det]m9es involves a high risk incid5t 9 accordance ) ! guidance issu$ "u subsection 7c77#a72 7,d7 any incid5t t involves ! unau?oriz$ disclosure ( p]sonally id5tifiable in=mation ( n less ?an #ejj individuals1 reg>dless ( ! risk level det]m9$ "u ! guidance issu$ "u subsection 7c77#a72 7,e7 any incid5t ! head ( ! ag5cy det]m9es involves a high value asset own$ or op]at$ by ! ag5cy2 & 7,f7 any o!r type ( incid5t det]m9$ appropriate by ! ,director2 7#b7 /ipulate t e ag5cy %all be consid]$ to h exp]i5c$ a major incid5t if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es t an incid5t t occurs at n less ?an #b ag5cies-- 7,a7 is enabl$ by a common te*nical root cause1 su* z a supply *a9 compromise1 a common s(tw>e or h>dw>e vuln]ability2 or 7,b7 is enabl$ by ! relat$ activities ( a common actor2 & 7#c7 /ipulate t1 9 det]m9+ :e!r an incid5t con/itutes a major incid5t because t incid5t-- 7,a7 is any incid5t describ$ 9 p>agraph 7#a71 ! head ( an ag5cy %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,b7 is an incid5t describ$ 9 p>agraph 7#a77;,a71 ! head ( ! ag5cy %all consult ) ! ,national ,cyb] ,director2 & 7,c7 is an incid5t describ$ 9 subp>agraph 7,c7 or 7,d7 ( p>agraph 7#a71 ! head ( ! ag5cy %all consult )-- 7i7 ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d2 & 7ii7 ! ,executive ,director ( ! ,f$]al ,trade ,commission4 7c7 ,guidance on risk to individuals 7#a7 ,9 g5]al ,n lat] ?an #ij days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d1 & ! ,executive ,director ( ! ,f$]al ,trade ,commission1 %all develop & issue guidance to ag5cies t e/abli%es a risk-bas$ framework = det]m9+ ! level ( risk t an incid5t involv+ p]sonally id5tifiable in=mation c\ld result 9 sub/antial h>m1 physical h>m1 emb>rassm5t1 or unfairness to an individual4 7#b7 ,risk levels & consid]ations ,! risk-bas$ framework includ$ 9 ! guidance issu$ "u p>agraph 7#a7 %all-- 7,a7 include a range ( risk levels1 includ+ a high risk level2 & 7,b7 consid]-- 7i7 any p]sonally id5tifiable in=mation t 0 expos$ z a result ( an incid5t2 7ii7 ! circum/ances "u :i* ! exposure ( p]sonally id5tifiable in=mation ( an individual occurr$2 & 7iii7 :e!r an indep5d5t evaluation ( ! in=mation affect$ by an incid5t det]m9es t ! in=mation is unreadable1 includ+1 z appropriate1 in/ances 9 :i* ! in=mation is-- 7,i7 encrypt$2 & 7,,ii7 det]m9$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to be ( suffici5tly l[ risk ( exposure4 7#c7 ,approval 7,a7 ,9 g5]al ,! guidance issu$ "u p>agraph 7#a7 %all include a process by :i* ! ,director1 jo9tly ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,attorney ,g5]al1 may approve ! designation ( an incid5t t w\ld be consid]$ high risk z l[] risk if in=mation expos$ by ! incid5t is unreadable1 z describ$ 9 p>agraph 7#b77;,b77iii74 7,b7 ,docum5tation ,! ,director %all report any approval ( an incid5t grant$ by ! ,director "u subp>agraph 7,a7 to-- 7i7 ! head ( ! ag5cy t exp]i5c$ ! incid5t2 7ii7 ! inspector g5]al ( ! ag5cy t exp]i5c$ ! incid5t2 & 7iii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7d7 ,evaluation & updates ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives an evaluation1 :i* %all include-- 7#a7 an update1 if necess>y1 to ! guidance issu$ "u subsections 7a7 & 7c72 7#b7 ! def9ition ( ! t]m major incid5t includ$ 9 ! guidance issu$ "u subsection 7a72 7#c7 an explanation (1 & ! analysis t l$ to1 ! def9ition describ$ 9 p>agraph 7#b72 & 7#d7 an assessm5t ( any additional datasets or risk evaluation crit]ia t %\ld be includ$ 9 ! risk-bas$ framework includ$ 9 ! guidance issu$ "u subsection 7c77#a74 4 7#b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,sub*apt] ,,iv--,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions4 #ceib4 ,notification ( high risk exposure aft] major incid5t4 #ceic4 ,congressional notifications & reports4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response4 #ceie4 ,responsibilities ( contractors & grant recipi5ts4 #ceif4 ,tra9+4 #ceig4 ,analysis & report on ,f$]al incid5ts4 #ceih4 ,major incid5t guidance4 4 #ajb4 ,am5dm5ts to subtitle ,,iii ( title #dj 7a7 ,in=mation ,te*nology ,mod]nization ,c5t]s ( ,excell5ce ,program ,act ,section #b7;c77#d77;,a77ii7 ( ! ,in=mation ,te*nology ,mod]nization ,c5t]s ( ,excell5ce ,program ,act 7#dj ,u4,s4,c4 #aacja note7 is am5d$ by /rik+ ! p]iod at ! end & ins]t+ 1 :i* %all be provid$ 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy44 7b7 ,mod]niz+ ,gov]nm5t ,te*nology ,subtitle ,g ( title ,x ( ,division ,a ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjah 7#dj ,u4,s4,c4 #aacja note7 is am5d$-- 7#a7 9 section #ajgg7;b7-- 7,a7 9 p>agraph 7#e77;,a71 by ins]t+ improv+ ! cyb]security ( sy/ems & be=e co/ sav+s activities2 & 7,b7 9 p>agraph 7#g7-- 7i7 9 ! p>agraph head+1 by /rik+ cio & ins]t+ ,,cio2 7ii7 by /rik+ ,9 evaluat+ projects & ins]t+ ! foll[+3 7,a7 ,consid]ation ( guidance ,9 evaluat+ projects 2 7iii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ "u section #ajid7;b77#a7 & ins]t+ guidance issu$ by ! ,director2 & 7iv7 by add+ at ! end ! foll[+3 7,b7 ,consultation ,9 us+ funds "u p>agraph 7#c77;,a71 ! ,*ief ,in=mation ,(fic] ( ! cov]$ ag5cy %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 2 & 7#b7 9 section #ajgh-- 7,a7 by /rik+ subsection 7a7 & ins]t+ ! foll[+3 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #eea ( title #e1 ,unit$ ,/ates ,code4 7#b7 ,high value asset ,! t]m high value asset has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 2 7,b7 9 subsection 7b71 by add+ at ! end ! foll[+3 7#h7 ,proposal evaluation ,! ,director %all-- 7,a7 give consid]ation = ! use ( am\nts 9 ! ,fund to improve ! security ( high value assets2 & 7,b7 require t any proposal = ! use ( am\nts 9 ! ,fund includes a cyb]security plan1 includ+ a *a9 risk managem5t plan1 to be review$ by ! memb] ( ! ,te*nology ,mod]nization ,bo>d describ$ 9 subsection 7c77#e77;,c74 2 & 7,c7 9 subsection 7c7-- 7i7 9 p>agraph 7#b77;,a77i71 by ins]t+ 1 includ+ a consid]ation ( ! impact on high value assets aft] op]ational risks2 7ii7 9 p>agraph 7#e7-- 7,i7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7,,ii7 9 subp>agraph 7,b71 by /rik+ ! p]iod at ! end & ins]t+ &2 & 7,,iii7 by add+ at ! end ! foll[+3 7,c7 a s5ior (ficial f ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 appo9t$ by ! ,director4 2 & 7iii7 9 p>agraph 7#f77;,a71 by /rik+ %all be-- & all t foll[s ?r\gh #d employees & ins]t+ %all be #d employees4 7c7 ,sub*apt] ,i ,sub*apt] ,i ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacjb-- 7,a7 9 subsection 7b71 by /rik+ use1 security1 & disposal ( & ins]t+ use1 & disposal1 &1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 promote & improve ! security1 (2 7,b7 9 subsection 7c7-- 7i7 9 p>agraph 7#b71 by ins]t+ 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy be=e 1 & results (2 7ii7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,a71 by /rik+ 1 & p]=mance & ins]t+ security1 & p]=mance2 & 7,,ii7 9 subp>agraph 7,c7-- 7aa7 by /rik+ ,= ea* major & ins]t+ ! foll[+3 7i7 ,9 g5]al ,= ea* major 2 & 7bb7 by add+ at ! end ! foll[+3 7ii7 ,cyb]security ,9 categoriz+ an inve/m5t accord+ to risk "u clause 7i71 ! ,*ief ,in=mation ,(fic] ( ! cov]$ ag5cy %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy on ! cyb]security or supply *a9 risk4 7iii7 ,security risk guidance ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance = ! categorization ( an inve/m5t "u clause 7i7 accord+ to ! cyb]security or supply *a9 risk4 2 & 7iii7 9 p>agraph 7#d7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 9 clause 7ii71 by /rik+ & at ! end2 7bb7 9 clause 7iii71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7cc7 by add+ at ! end ! foll[+3 7iv7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! cyb]security risks ( ! inve/m5t4 2 & 7,,ii7 9 subp>agraph 7,b71 9 ! matt] prec$+ clause 7i71 by ins]t+ n lat] ?an #cj days aft] ! date on :i* ! review "u subp>agraph 7,a7 is complet$1 be=e ! ,adm9i/rator2 7,c7 9 subsection 7f7-- 7i7 by /rik+ heads ( executive ag5cies to develop & ins]t+ 8heads ( executive ag5cies to-- 7#a7 develop 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7#b7 consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = ! developm5t & use ( supply *a9 security be/ practices4 2 & 7,d7 9 subsection 7h71 by ins]t+ 1 includ+ cyb]security p]=mances1 aft] ! p]=mances2 & 7#b7 9 section #aacjc7;b77#b77;,b7-- 7,a7 9 clause 7i71 by /rik+ or at ! end2 7,b7 9 clause 7ii71 by add+ or at ! end2 & 7,c7 by add+ at ! end ! foll[+3 7iii7 :e!r ! function %\ld be p]=m$ by a %>$ s]vice (f]$ by ano!r executive ag5cy2 4 7d7 ,sub*apt] ,,ii ,sub*apt] ,,ii ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacab7;a71 by ins]t+ 1 includ+ security risks aft] manag+ ! risks2 7#b7 9 section #aacac7a71 by /rik+ effici5cy & effectiv5ess & ins]t+ effici5cy1 security1 & effectiv5ess2 7#c7 9 section #aacag1 by ins]t+ security1 be=e or s*$ule2 & 7#d7 9 section #aacai7;b77#a71 9 ! p>agraph head+1 by /rik+ cios & ins]t+ ,*ief ,in=mation ,(fic]s4 7e7 ,sub*apt] ,,iii ,section #aacca ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a71 by /rik+ section #cecb7;b77#a7 & ins]t+ section #ceeb7;b72 7#b7 9 subsection 7b77#a77;,a7-- 7,a7 by /rik+ 9 consultation & ins]t+ 9 coord9ation2 7,b7 by /rik+ ! ,secret>y ( ,homel& ,security & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,c7 by ins]t+ & associat$ v]ification specifications develop$ "u subsection 7g7 be=e p]ta9+ to ,f$]al2 7#c7 by /rik+ subsection 7c7 & ins]t+ ! foll[+3 7c7 ,application ( m /r+5t /&>ds 7#a7 ,9 g5]al ,! head ( an ag5cy %all-- 7,a7 evaluate ! ne$ to employ /&>ds = co/-effective1 risk-bas$ in=mation security = all sy/ems1 op]ations1 & assets )9 or "u ! sup]vision ( ! ag5cy t are m /r+5t ?an ! /&>ds promulgat$ by ! ,director "u ?is section1 if su* /&>ds conta91 at a m9imum1 ! provisions ( ^? applicable /&>ds made compulsory & b9d+ by ! ,director2 & 7,b7 to ! greate/ ext5t practicable & if ! head ( ! ag5cy det]m9es t ! /&>ds describ$ 9 subp>agraph 7,a7 are necess>y1 employ ^? /&>ds4 7#b7 ,evaluation ( m /r+5t /&>ds ,9 evaluat+ ! ne$ to employ m /r+5t /&>ds "u p>agraph 7#a71 ! head ( an ag5cy %all consid] available risk in=mation1 includ+-- 7,a7 ! /atus ( cyb]security rem$ial actions ( ! ag5cy2 7,b7 any vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7,c7 incid5t in=mation ( ! ag5cy2 7,d7 in=mation f-- 7i7 p5etration te/+ p]=m$ "u section #ceei;,a ( title #dd2 & 7ii7 in=mation f ! v]ification disclosure program e/abli%$ "u section #ceei;,b ( title #dd2 7,e7 ag5cy ?reat hunt+ results "u section #bjg ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba2 7,f7 ,f$]al & non-,f$]al ?reat intellig5ce2 7,g7 data on compliance ) /&>ds issu$ "u ?is section1 us+ ! v]ification specifications develop$ "u subsection 7f7 :5 appropriate2 7,h7 ag5cy sy/em risk assessm5ts ( ! ag5cy p]=m$ "u section #ceed7;a77#a77;,a7 ( title #dd2 & 7,i7 any o!r in=mation det]m9$ relevant by ! head ( ! ag5cy4 2 7#d7 9 subsection 7d77#b7-- 7,a7 by /rik+ ! p>agraph head+ & ins]t+ ,consultation1 notice1 & comm5t2 7,b7 by ins]t+ promulgate1 be=e significantly modify2 & 7,c7 by /rik+ %all be made aft] ! public is giv5 an opportunity to comm5t on ! ,director's propos$ decision4 & ins]t+ 8%all be made-- 7,a7 = a decision to significantly modify or n promulgate su* a propos$ /&>d1 aft] ! public is giv5 an opportunity to comm5t on ! ,director's propos$ decision2 7,b7 9 consultation ) ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy2 7,c7 consid]+ ! ,f$]al risk assessm5ts p]=m$ "u section #ceec7;i7 ( title #dd2 & 7,d7 consid]+ ! ext5t to :i* ! propos$ /&>d r$uces risk relative to ! co/ ( implem5tation ( ! /&>d4 2 & 7#e7 by add+ at ! end ! foll[+3 7e7 ,review ( promulgat$ /&>ds 7#a7 ,9 g5]al ,n less frequ5tly ?an once e #b ye>s1 ! ,director ( ! ,(fice ( ,managem5t & ,budget1 9 consultation ) ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy %all review ! efficacy ( ! /&>ds 9 effect promulgat$ "u ?is section 9 r$uc+ cyb]security risks & det]m9e :e!r any *anges to ^? /&>ds are appropriate bas$ on-- 7,a7 ! ,f$]al risk assessm5t develop$ "u section #ceec7;i7 ( title #dd2 7,b7 public comm5t2 & 7,c7 an assessm5t ( ! ext5t to :i* ! propos$ /&>ds r$uce risk relative to ! co/ ( implem5tation ( ! /&>ds4 7#b7 ,updat$ guidance ,n lat] ?an #ij days aft] ! date ( ! completion ( ! review "u p>agraph 7#a71 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all issue guidance to ag5cies to make any necess>y updates to ! /&>ds 9 effect promulgat$ "u ?is section bas$ on ! results ( ! review4 7#c7 ,congressional report ,n lat] ?an #cj days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report t includes-- 7,a7 ! review ( ! /&>ds 9 effect promulgat$ "u ?is section conduct$ "u p>agraph 7#a72 7,b7 ! risk mitigation (f]$ by ea* /&>d describ$ 9 subp>agraph 7,a72 & 7,c7 a summ>y (-- 7i7 ! /&>ds to :i* *anges 7 det]m9$ appropriate dur+ ! review2 & 7ii7 anticipat$ *anges to ! /&>ds "u ?is section 9 guidance issu$ "u p>agraph 7#b74 7f7 ,v]ification specifications ,n lat] ?an #a ye> aft] ! date on :i* ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology issues a propos$ /&>d pursuant to p>agraphs 7#b7 & 7#c7 ( section #bj7;a7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 z practicable1 %all develop te*nical specifications to enable ! automat$ v]ification ( ! implem5tation ( ! controls )9 ! /&>d4 4 #ajc4 ,actions to enhance ,f$]al incid5t response 7a7 ,responsibilities ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy 7#a7 ,recomm5dations ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,*air ( ! ,f$]al ,trade ,commission1 ! ,*air ( ! ,securities & ,ex*ange ,commission1 ! ,secret>y ( ! ,treasury1 ! ,director ( ! ,f$]al ,bureau ( ,inve/igation1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 & ! head ( any o!r appropriate ,f$]al or non-,f$]al entity1 %all consolidate1 ma9ta91 & make publicly available recomm5dations = individuals ^: p]sonal in=mation1 z def9$ 9 section #ceia ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 is inappropriately expos$ z a result ( a high risk incid5t describ$ 9 section #ceih7;c77#b7 ( title #dd1 ,unit$ ,/ates ,code4 7#b7 ,plan = analysis (1 & report on1 ,f$]al incid5ts 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7i7 develop a plan = ! developm5t ( ! analysis requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 & ! report requir$ "u subsection 7c7 ( t section t includes-- 7,i7 a description ( any *all5ges ! ,director anticipates enc\nt]+2 & 7,,ii7 ! use ( automation & ma*9e-readable =mats = collect+1 compil+1 monitor+1 & analyz+ data2 & 7ii7 provide to ! appropriate congressional committees a brief+ on ! plan develop$ "u clause 7i74 7,b7 ,brief+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! appropriate congressional committees a brief+ on-- 7i7 ! execution ( ! plan requir$ "u subp>agraph 7,a72 & 7ii7 ! developm5t ( ! report requir$ "u section #ceig7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7b7 ,responsibilities ( ! ,director ( ! ,(fice ( ,managem5t & ,budget 7#a7 ,,fisma ,section #b ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad 7#dd ,u4,s4,c4 #ceed note7 is am5d$-- 7,a7 by /rik+ subsection 7b72 & 7,b7 by r$esignat+ subsections 7c7 ?r\gh 7f7 z subsections 7b7 ?r\gh 7e71 respectively4 7#b7 ,incid5t data %>+ 7,a7 ,9 g5]al ,! ,director %all develop guidance1 to be updat$ n less frequ5tly ?an once e #b ye>s1 on ! cont5t1 timel9ess1 & =mat ( ! in=mation provid$ by ag5cies "u section #ceid7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,requirem5ts ,! guidance develop$ "u subp>agraph 7,a7 %all-- 7i7 prioritize ! availability ( data necess>y to und]/& & analyze-- 7,i7 ! causes ( incid5ts2 7,,ii7 ! scope & scale ( incid5ts )9 ! ag5cy networks & sy/ems2 7,,iii7 cross ,f$]al ,gov]nm5t root causes ( incid5ts2 7,,iv7 ag5cy response1 recov]y1 & rem$iation actions2 & 7,v7 ! effectiv5ess ( incid5ts2 7ii7 enable ! effici5t developm5t (-- 7,i7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,,ii7 ! report on ,f$]al compromises requir$ "u section #ceig7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act2 7iii7 include requirem5ts = ! timel9ess ( data production2 & 7iv7 include requirem5ts = us+ automation & ma*9e-readable data = data %>+ & availability4 7#c7 ,guidance on respond+ to in=mation reque/s ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all develop guidance = ag5cies to implem5t ! requirem5t "u section #ceid7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 to provide in=mation to o!r ag5cies exp]i5c+ incid5ts4 7#d7 ,/&>d guidance & templates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop guidance & templates1 to be review$ &1 if necess>y1 updat$ n less frequ5tly ?an once e #b ye>s1 = use by ,f$]al ag5cies 9 ! activities requir$ "u sections #ceib1 #ceic1 & #ceif ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#e7 ,contractor & grantee guidance 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 ! ,secret>y ( ,def5se1 ! ,adm9i/rator ( ,g5]al ,s]vices1 & ! heads ( o!r ag5cies det]m9$ appropriate by ! ,director1 %all issue guidance to ,f$]al ag5cies on h[ to deconflict exi/+ regulations1 policies1 & proc$ures relat+ to ! responsibilities ( contractors & grant recipi5ts e/abli%$ "u section #ceie ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,exi/+ processes ,to ! greate/ ext5t practicable1 ! guidance issu$ "u subp>agraph 7,a7 %all all[ contractors & grantees to use exi/+ processes = notify+ ,f$]al ag5cies ( incid5ts involv+ in=mation ( ! ,f$]al ,gov]nm5t4 7#f7 ,updat$ brief+s ,n less frequ5tly ?an once e #b ye>s1 ! ,director %all provide to ! appropriate congressional committees an update on ! guidance & templates develop$ "u p>agraphs 7#b7 ?r\gh 7#d74 7c7 ,update to ! ,privacy ,act ( #aigd ,section #eeb;a7b7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,privacy ,act ( #aigd7 is am5d$-- 7#a7 9 p>agraph 7#aa71 by /rik+ or at ! end2 7#b7 9 p>agraph 7#ab71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#c7 by add+ at ! end ! foll[+3 7#ac7 to ano!r ag5cy 9 fur!rance ( a response to an incid5t 7z def9$ 9 section #ceeb ( title #dd7 & pursuant to ! in=mation %>+ requirem5ts 9 section #ceid ( title #dd if ! head ( ! reque/+ ag5cy has made a writt5 reque/ to ! ag5cy t ma9ta9s ! record specify+ ! p>ticul> portion desir$ & ! activity = :i* ! record is s\ght4 4 #ajd4 ,additional guidance to ag5cies on ,,fisma updates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance = ag5cies on-- 7#a7 complet+ ! ag5cy sy/em risk assessm5t requir$ "u section #ceed7;a77#a77;,a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act2 7#b7 implem5t+ additional cyb]security proc$ures1 :i* %all include res\rces = %>$ s]vices2 7#c7 e/abli%+ a process = provid+ ! /atus ( ea* rem$ial action "u section #ceed7;b77#g7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 to ! ,director & ! ,cyb]security & ,infra/ructure ,security ,ag5cy us+ automation & ma*9e-readable data1 z practicable1 :i* %all include-- 7,a7 specific /&>ds = ! automation & ma*9e-readable data2 & 7,b7 templates = provid+ ! /atus ( ! rem$ial action2 7#d7 int]pret+ ! def9ition ( high value asset 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act2 7#e7 implem5t+ /&>ds 9 ag5cy au?orization processes to enc\rage ! tailor+ ( processes to ag5cy & sy/em risk t are proportionate to ! s5sitivity ( sy/ems1 :i* %all include-- 7,a7 a cl>ification (-- 7i7 ! acceptable use & developm5t ( cu/omization ( /&>ds promulgat$ "u section #aacca ( title #dj1 ,unit$ ,/ates ,code2 & 7ii7 ! acceptable use ( risk-bas$ au?orization proc$ures au?oriz$ on ! date ( enactm5t ( ?is ,act2 & 7,b7 a requirem5t to coord9ate ) ,inspectors ,g5]als ( ag5cies to ensure consi/5t und]/&+ & application ( ag5cy policies = ! purpose ( ,inspector ,g5]al audits2 & 7#f7 requir+1 z practicable & pursuant to section #bjc1 an evaluation ( ag5cy cyb]security us+ metrics t are-- 7,a7 bas$ on outcomes2 & 7,b7 bas$ on "t4 #aje4 ,ag5cy requirem5ts to notify entities impact$ by incid5ts ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue guidance t requires ag5cies to notify entities t are compell$ to %>e s5sitive in=mation ) ! ag5cy ( an incid5t t impacts-- 7#a7 s5sitive in=mation %>$ ) ! ag5cy by ! entity2 or 7#b7 ! sy/ems us$ to ! transmit s5sitive in=mation describ$ 9 p>agraph 7#a7 to ! ag5cy4 ,,ii ,improv+ ,f$]al cyb]security #bja4 ,evaluation ( effectiv5ess ( /&>ds 7a7 ,9 g5]al ,z a compon5t ( ! evaluation & report requir$ "u section #ceee7;h7 ( title #dd1 ,unit$ ,/ates ,code1 & n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all p]=m a /udy t-- 7#a7 assesses ! /&>ds promulgat$ "u section #aacca7;b7 ( title #dj1 ,unit$ ,/ates ,code to det]m9e ! degree to :i* ag5cies use ! au?ority "u section #aacca7;c77#a7 ( title #dj1 ,unit$ ,/ates ,code to cu/omize ! /&>ds relative to ! risks fac+ ea* ag5cy & ag5cy sy/em2 7#b7 assesses ! effectiv5ess ( ! /&>ds describ$ 9 p>agraph 7#a71 includ+ any /&>ds cu/omiz$ by ag5cies "u section #aacca7;c77#a7 ( title #dj1 ,unit$ ,/ates ,code1 at improv+ ag5cy cyb]security2 7#c7 exam9es ! quantification ( cyb]security risk 9 ! private sector = any applicability = use by ! ,f$]al ,gov]nm5t2 7#d7 exam9es cyb]security metrics exi/+ z ( ! date ( enactm5t ( ?is ,act us$ by ! ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & ! heads ( o!r ag5cies to evaluate ! effectiv5ess ( in=mation security policies & practices2 & 7#e7 ) respect to ! /&>ds describ$ 9 p>agraph 7#a71 provides recomm5dations =-- 7,a7 ! addition or removal ( /&>ds2 or 7,b7 ! cu/omization (-- 7i7 ! /&>ds by ag5cies "u section #aacca7;c77#a7 ( title #dj1 ,unit$ ,/ates ,code2 or 7ii7 specific controls )9 ! /&>ds4 7b7 ,incorporation ( /udy ,! ,director %all incorporate ! results ( ! /udy p]=m$ "u subsection 7a7 into ! review ( /&>ds requir$ "u section #aacca7;e7 ( title #dj1 ,unit$ ,/ates ,code4 7c7 ,brief+ ,n lat] ?an #cj days aft] ! date on :i* ! /udy p]=m$ "u subsection 7a7 is complet$1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all provide to ! appropriate congressional committees a brief+ on ! /udy4 #bjb4 ,mobile security /&>ds 7a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all-- 7#a7 evaluate mobile application security /&>ds promulgat$ "u section #aacca7;b7 ( title #dd1 ,unit$ ,/ates ,code2 & 7#b7 issue guidance to implem5t mobile security /&>ds 9 effect on ! date ( enactm5t ( ?is ,act promulgat$ "u section #aacca7;b7 ( title #dj1 ,unit$ ,/ates ,code1 includ+ = mobile applications1 = e ag5cy4 7b7 ,cont5ts ,! guidance issu$ "u subsection 7a77#b7 %all include-- 7#a7 a requirem5t1 pursuant to section #cejf7;b77#d7 ( title #dd1 ,unit$ ,/ates ,code1 = e ag5cy to ma9ta9 a cont9u\s inv5tory ( e-- 7,a7 mobile device op]at$ by or on behalf ( ! ag5cy2 7,b7 mobile application in/all$ on a mobile device describ$ 9 subp>agraph 7,a72 & 7,c7 vuln]ability id5tifi$ by ! ag5cy associat$ ) a mobile device or mobile application describ$ 9 subp>agraphs 7,a7 & 7,b72 & 7#b7 a requirem5t = e ag5cy to p]=m cont9u\s evaluation ( ! vuln]abilities describ$ 9 p>agraph 7#a77;,c7 & o!r risks4 7c7 ,in=mation %>+ ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies = %>+ ! inv5tory ( ! ag5cy requir$ "u subsection 7b77#a7 ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable4 7d7 ,brief+ ,n lat] ?an #fj days aft] ! date on :i* ! ,director issues guidance "u subsection 7a77#b71 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all provide to ! appropriate congressional committees a brief+ on ! guidance4 #bjc4 ,quantitative cyb]security metrics 7a7 ,e/abli%+ "t-,bas$ metrics 7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 update ! metrics us$ to measure security "u section #ceed ( title #dd1 ,unit$ ,/ates ,code1 includ+ any metrics develop$ pursuant to section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c771 to include /&>diz$ metrics to quantitatively evaluate & id5tify tr5ds 9 ag5cy cyb]security p]=mance1 includ+ p]=mance = incid5t response2 & 7,b7 evaluate ! metrics describ$ 9 subp>agraph 7,a74 7#b7 ,qualities ,) respect to ! updat$ metrics requir$ "u p>agraph 7#a7-- 7,a7 n less ?an #b ( ! metrics %all be "t-bas$2 & 7,b7 ! metrics may include o!r measurable outcomes4 7#c7 ,evaluation ,! evaluation requir$ "u p>agraph 7#a77;,b7 %all evaluate-- 7,a7 ! am\nt ( "t x takes = an ag5cy to detect an incid5t2 & 7,b7 ! am\nt ( "t t passes betwe5-- 7i7 ! detection & rem$iation ( an incid5t2 & 7ii7 ! rem$iation ( an incid5t & ! recov]y f ! incid5t4 7b7 ,implem5tation 7#a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all promulgate guidance t requires ! use ( ! updat$ metrics develop$ "u subsection 7a77#a77;,a7 by e ag5cy ov] a #d-ye> p]iod beg9n+ on ! date on :i* ! metrics are develop$ to track tr5ds 9 ! incid5t response capabilities ( ag5cies4 7#b7 ,p5etration te/s ,on n less ?an #b occasions dur+ ! #b-ye> p]iod foll[+ ! date on :i* guidance is promulgat$ "u p>agraph 7#a71 n less ?an #c ag5cies %all be subject$ to sub/antially simil> p5etration te/s 9 ord] to validate ! utility ( ! metrics develop$ "u subsection 7a77#a77;,a74 7#c7 ,database ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop & use a database t-- 7,a7 /ores ag5cy metrics in=mation2 & 7,b7 all[s = ! p]=mance ( cross-ag5cy comp>ison ( ag5cy incid5t response capability tr5ds4 7c7 ,updat$ metrics 7#a7 ,9 g5]al ,! ,director may issue guidance t updates ! metrics develop$ "u subsection 7a77#a77;,a7 if ! updat$ metrics-- 7,a7 h ! qualities describ$ 9 subsection 7a77#b72 & 7,b7 c be evaluat$ "u subsection 7a77#c74 7#b7 ,data %>+ ,! guidance issu$ "u p>agraph 7#a7 %all require ag5cies to %>e ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy data demon/rat+ ! p]=mance ( ! ag5cy ) ! updat$ metrics includ$ 9 t guidance aga9/ ! metrics develop$ "u subsection 7a77#a77;,a74 7d7 ,congressional reports 7#a7 ,updat$ metrics ,n lat] ?an #cj days aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security completes ! evaluation requir$ "u subsection 7a77#a77;,b71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! appropriate congressional committees a report on ! updat$ metrics develop$ "u subsection 7a77#a77;,a74 7#b7 ,program ,n lat] ?an #ahj days aft] ! date on :i* guidance is promulgat$ "u subsection 7b77#a71 ! ,director %all submit to ! appropriate congressional committees a report on ! results ( ! use ( ! updat$ metrics develop$ "u subsection 7a77#a77;,a7 by ag5cies4 #bjd4 ,data & logg+ ret5tion = incid5t response 7a7 ,recomm5dations ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,attorney ,g5]al & ! ,national ,cyb] ,director1 %all submit to ! ,director recomm5dations on requirem5ts = logg+ ev5ts on ag5cy sy/ems & reta9+ o!r relevant data )9 ! sy/ems & networks ( an ag5cy4 7b7 ,cont5ts ,! recomm5dations provid$ "u subsection 7a7 %all include-- 7#a7 ! types ( logs to be ma9ta9$2 7#b7 ! "t p]iods to reta9 ! logs & o!r relevant data2 7#c7 ! "t p]iods = ag5cies to enable recomm5d$ logg+ & security requirem5ts2 7#d7 h[ to ensure ! confid5tiality1 integrity1 & availability ( logs2 7#e7 requirem5ts to ensure t1 ^u reque/1 ag5cies provide logs to-- 7,a7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = a cyb]security purpose2 & 7,b7 ! ,f$]al ,bureau ( ,inve/igation to inve/igate pot5tial crim9al activity2 & 7#f7 ensur+ ! highe/ level security op]ations c5t] ( ea* ag5cy has visibility into all ag5cy logs4 7c7 ,guidance ,n lat] ?an #ij days aft] receiv+ ! recomm5dations submitt$ "u subsection 7a71 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,attorney ,g5]al1 %all promulgate guidance to ag5cies to e/abli% requirem5ts = logg+1 log ret5tion1 log managem5t1 & %>+ ( log data ) o!r appropriate ag5cies4 7d7 ,p]iodic review ,n lat] ?an #b ye>s aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy submits ! recomm5dations requir$ "u subsection 7a71 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,attorney ,g5]al1 %all evaluate ! recomm5dations & provide an update on ! recomm5dations to ! ,director z necess>y4 #bje4 ,,cisa ag5cy advisors 7a7 ,9 g5]al ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all assign n less ?an #a cyb]security pr(essional employ$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy to be ! ,cyb]security & ,infra/ructure ,security ,ag5cy advisor to ! ,*ief ,in=mation ,(fic] ( ea* ag5cy4 7b7 ,qualifications ,ea* advisor assign$ "u subsection 7a7 %all h k (-- 7#a7 cyb]security ?reats fac+ ag5cies1 includ+ any specific ?reats to ! assign$ ag5cy2 7#b7 p]=m+ risk assessm5ts ( ag5cy sy/ems2 & 7#c7 o!r ,f$]al cyb]security initiatives4 7c7 ,duties ,! duties ( ea* advisor assign$ "u subsection 7a7 %all include-- 7#a7 provid+ ongo+ assi/ance & advice1 z reque/$1 to ! ag5cy ,*ief ,in=mation ,(fic]2 7#b7 s]v+ z an incid5t response po9t ( contact betwe5 ! assign$ ag5cy & ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7#c7 famili>iz+ !mselves ) ag5cy sy/ems1 processes1 & proc$ures to bett] facilitate support to ! ag5cy 9 respond+ to incid5ts4 7d7 ,limitation ,an advisor assign$ "u subsection 7a7 %all n be a contractor4 7e7 ,multiple assignm5ts ,"o individual advisor made be assign$ to multiple ag5cy ,*ief ,in=mation ,(fic]s "u subsection 7a74 #bjf4 ,f$]al p5etration te/+ policy 7a7 ,9 g5]al ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+ 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy op]ational plan ,! t]m ag5cy op]ational plan means a plan ( an ag5cy = ! use ( p5etration te/+4 7#b7 ,rules ( engagem5t ,! t]m rules ( engagem5t means a set ( rules e/abli%$ by an ag5cy = ! use ( p5etration te/+4 7b7 ,guidance 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue guidance t-- 7,a7 requires ag5cies to use1 :5 & :]e appropriate1 p5etration te/+ on ag5cy sy/ems2 & 7,b7 requires ag5cies to develop an ag5cy op]ational plan & rules ( engagem5t t meet ! requirem5ts "u subsection 7c74 7#b7 ,p5etration te/+ guidance ,! guidance issu$ "u ?is section %all-- 7,a7 p]mit an ag5cy to use1 = ! purpose ( p]=m+ p5etration te/+-- 7i7 a %>$ s]vice ( ! ag5cy or ano!r ag5cy2 or 7ii7 an ext]nal entity1 su* z a v5dor2 7,b7 include templates & frameworks = report+ ! results ( p5etration te/+1 )\t reg>d to ! /atus ( ! entity t p]=ms ! p5etration te/+2 & 7,c7 require ag5cies to provide ! rules ( engagem5t & results ( p5etration te/+ to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 )\t reg>d to ! /atus ( ! entity t p]=ms ! p5etration te/+4 7c7 ,ag5cy plans & rules ( engagem5t ,! ag5cy op]ational plan & rules ( engagem5t ( an ag5cy %all-- 7#a7 require ! ag5cy to p]=m p5etration te/+ on ! high value assets ( ! ag5cy2 7#b7 e/abli% guidel9es = avoid+1 z a result ( p5etration te/+-- 7,a7 adv]se impacts to ! op]ations ( ! ag5cy2 7,b7 adv]se impacts to op]ational networks & sy/ems ( ! ag5cy2 & 7,c7 inappropriate access to data2 7#c7 require ! results ( p5etration te/+ to include fe$back to improve ! cyb]security ( ! ag5cy2 & 7#d7 include me*anisms = provid+ consi/5tly =matt$1 &1 if applicable1 automat$ & ma*9e-readable1 data to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7d7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 e/abli% a c]tification process = ! p]=mance ( p5etration te/+ by bo? ,f$]al & non-,f$]al entities t e/abli%es m9imum quality controls = p5etration te/+2 7#b7 develop op]ational guidance = in/itut+ p5etration te/+ programs at ag5cies2 7#c7 develop & ma9ta9 a c5traliz$ capability to (f] p5etration te/+ z a s]vice to ,f$]al & non-,f$]al entities2 & 7#d7 provide guidance to ag5cies on ! be/ use ( p5etration te/+ res\rces4 7e7 ,responsibilities ( ,,omb ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all-- 7#a7 n less frequ5tly ?an annually1 inv5tory all ,f$]al p5etration te/+ assets2 & 7#b7 develop & ma9ta9 a ,f$]al /rategy = ! use ( p5etration te/+4 7f7 ,prioritization ( p5etration te/+ res\rces 7#a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop a framework = prioritiz+ ,f$]al p5etration te/+ res\rces among ag5cies4 7#b7 ,consid]ations ,9 develop+ ! framework "u ?is subsection1 ! ,director %all consid]-- 7,a7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 7,b7 ! ,f$]al risk assessm5t p]=m$ "u section #ceec7;i72 7,c7 ! analysis ( ,f$]al incid5t data p]=m$ "u section #ceig2 & 7,d7 any o!r in=mation det]m9$ appropriate by ! ,director or ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 4 7b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+4 4 7c7 ,p5etration te/+ by ! ,secret>y ( ,homel& ,security ,section #ceec7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #agje ( ! ,william ,m4 7,mac7 ,?ornb]ry ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjba 7,public ,law #aaf-bhc7 & section #aja1 is fur!r am5d$-- 7#a7 9 p>agraph 7#h77;,b71 by /rik+ & at ! end2 7#b7 by r$esignat+ p>agraph 7#i7 z p>agraph 7#aj72 & 7#c7 by ins]t+ aft] p>agraph 7#h7 ! foll[+3 7#i7 p]=m+ p5etration te/+ ) or )\t advance notice to1 or au?orization f1 ag5cies1 to id5tify vuln]abilities )9 ,f$]al in=mation sy/ems2 & 4 #bjg4 ,ongo+ ?reat hunt+ program 7a7 ,?reat hunt+ program 7#a7 ,9 g5]al ,n lat] ?an #edj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all e/abli% a program to provide ongo+1 hypo!sis-driv5 ?reat-hunt+ s]vices on ! network ( ea* ag5cy4 7#b7 ,plan ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% ! program requir$ "u p>agraph 7#a7 t describes h[ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy plans to-- 7,a7 det]m9e ! me?od = collect+1 /or+1 access+1 & analyz+ appropriate ag5cy data2 7,b7 provide on-premises support to ag5cies2 7,c7 /aff ?reat hunt+ s]vices2 7,d7 allocate available human & f9ancial res\rces to implem5t ! plan2 & 7,e7 provide input to ! heads ( ag5cies on ! use (-- 7i7 m /r+5t /&>ds "u section #aacca7;c77#a7 ( title #dj1 ,unit$ ,/ates ,code2 & 7ii7 additional cyb]security proc$ures "u section #ceed ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,reports ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! appropriate congressional committees-- 7#a7 n lat] ?an #cj days aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy completes ! plan requir$ "u subsection 7a77#b71 a report on ! plan to provide ?reat hunt+ s]vices to ag5cies2 7#b7 n less ?an #cj days be=e ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices "u ! program1 a report provid+ any updates to ! plan develop$ "u subsection 7a77#b72 & 7#c7 n lat] ?an #a ye> aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices to ag5cies o!r ?an ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 a report describ+ lessons le>n$ f provid+ ^? s]vices4 #bjh4 ,codify+ vuln]ability disclosure programs 7a7 ,9 g5]al ,*apt] #ce ( title #dd ( ,unit$ ,/ates ,code is am5d$ by ins]t+ aft] section #ceei;,a1 z add$ by section #bjf ( ?is ,act1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs 7a7 ,def9itions ,9 ?is section3 7#a7 ,report ,! t]m report means a vuln]ability disclosure made to an ag5cy by a report]4 7#b7 ,report] ,! t]m report] means an individual t submits a vuln]ability report pursuant to ! vuln]ability disclosure process ( an ag5cy4 7b7 ,responsibilities ( ,,omb 7#a7 ,limitation on legal action ,! ,director1 9 consultation ) ! ,attorney ,g5]al1 %all issue guidance to ag5cies to n recomm5d or pursue legal action aga9/ a report] or an individual t conducts a security rese>* activity t ! head ( ! ag5cy det]m9es-- 7,a7 repres5ts a good fai? ef=t to foll[ ! vuln]ability disclosure policy develop$ "u subsection 7d77#b7 ( ! ag5cy2 & 7,b7 is au?oriz$ "u ! vuln]ability disclosure policy develop$ "u subsection 7d77#b7 ( ! ag5cy4 7#b7 ,%>+ in=mation ) ,,cisa ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies on %>+ relevant in=mation 9 a consi/5t1 automat$1 & ma*9e readable mann] ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 includ+-- 7,a7 any valid or cr$ible reports ( newly discov]$ or n publicly kn[n vuln]abilities 7includ+ misconfigurations7 on an ag5cy in=mation sy/em t uses comm]cial s(tw>e or s]vices2 7,b7 in=mation relat+ to vuln]ability disclosure1 coord9ation1 or rem$iation activities ( an ag5cy1 p>ticul>ly z ^? activities relate to outside organizations-- 7i7 ) :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security c assi/2 or 7ii7 ab\t :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security %\ld "k2 & 7,c7 any o!r in=mation ) respect to :i* ! head ( ! ag5cy det]m9es helpful or necess>y to involve ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#c7 ,ag5cy vuln]ability disclosure policies 7,a7 ,9 g5]al ,! ,director %all issue guidance to ag5cies on ! requir$ m9imum scope ( ag5cy sy/ems cov]$ by ! vuln]ability disclosure policy ( an ag5cy requir$ "u subsection 7d77#b74 7,b7 ,deadl9e ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 ! ,director %all update ! guidance issu$ "u subp>agraph 7,a7 to require t e ag5cy sy/em t is connect$ to ! int]net is cov]$ by ! vuln]ability disclosure policy ( ! ag5cy4 7c7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 provide support to ag5cies ) respect to ! implem5tation ( ! requirem5ts ( ?is section2 7#b7 develop tools1 processes1 & o!r me*anisms det]m9$ appropriate to (f] ag5cies capabilities to implem5t ! requirem5ts ( ?is section2 & 7#c7 ^u a reque/ by an ag5cy1 assi/ ! ag5cy 9 ! disclosure to v5dors ( newly id5tifi$ vuln]abilities 9 v5dor products & s]vices4 7d7 ,responsibilities ( ag5cies 7#a7 ,public in=mation ,! head ( ea* ag5cy %all make publicly available1 ) respect to ea* int]net doma9 "u ! control ( ! ag5cy t is n a national security sy/em-- 7,a7 an appropriate security contact2 & 7,b7 ! compon5t ( ! ag5cy t is responsible = ! int]net accessible s]vices (f]$ at ! doma94 7#b7 ,vuln]ability disclosure policy ,! head ( ea* ag5cy %all develop & make publicly available a vuln]ability disclosure policy = ! ag5cy1 :i* %all-- 7,a7 describe-- 7i7 ! scope ( ! sy/ems ( ! ag5cy includ$ 9 ! vuln]ability disclosure policy2 7ii7 ! type ( in=mation sy/em te/+ t is au?oriz$ by ! ag5cy2 7iii7 ! type ( in=mation sy/em te/+ t is n au?oriz$ by ! ag5cy2 & 7iv7 ! disclosure policy ( ! ag5cy = s5sitive in=mation2 7,b7 include a provision t au?orizes ! anonym\s submission ( a vuln]ability by a report]2 7,c7 ) respect to a report to an ag5cy1 describe-- 7i7 h[ ! report] %\ld submit ! report2 & 7ii7 if ! report is n anonym\s "u subp>agraph 7,b71 :5 ! report] %\ld anticipate an ackn[l$gm5t ( receipt ( ! report by ! ag5cy2 & 7,d7 include any o!r relevant in=mation4 7#c7 ,id5tifi$ vuln]abilities ,! head ( ea* ag5cy %all incorporate any vuln]abilities report$ "u p>agraph 7#b7 into ! vuln]ability managem5t process ( ! ag5cy 9 ord] to track & rem$iate ! vuln]ability4 7e7 ,pap]work ,r$uction ,act exemption ,! requirem5ts ( sub*apt] ,i 7commonly kn[n z ! ,pap]work ,r$uction ,act7 %all n apply to a vuln]ability disclosure program e/abli%$ "u ?is section4 7f7 ,congressional report+ ,n lat] ?an #ij days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 & annually !reaft] = a #c-ye> p]iod1 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! /atus ( ! use ( vuln]ability disclosure policies "u ?is section at ag5cies1 includ+1 ) respect to ! guidance issu$ "u subsection 7b77#c71 an id5tification ( ! ag5cies t are compliant & n compliant4 4 7b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei;,a ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs4 4 #bji4 ,implem5t+ presumption ( compromise & z]o tru/ ar*itectures 7a7 ,recomm5dations ,n lat] ?an #fj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all develop recomm5dations to increase ! int]nal def5ses ( ag5cy sy/ems to-- 7#a7 limit ! ability ( entities t cause incid5ts to move lat]ally ?r\gh or betwe5 ag5cy sy/ems2 7#b7 id5tify incid5ts m quickly2 7#c7 isolate & remove unau?oriz$ entities f ag5cy sy/ems m quickly2 7#d7 implem5t z]o tru/ ar*itecture2 & 7#e7 o!rwise increase ! res\rce co/s = entities t cause incid5ts2 & 7b7 ,,omb ,guidance ,n lat] ?an #ahj days aft] ! date on :i* ! recomm5dations "u subsection 7a7 are complet$1 ! ,director %all issue guidance to ag5cies t requires ! implem5tation ( ! recomm5dations4 7c7 ,ag5cy implem5tation plans ,n lat] ?an #fj days aft] ! date on :i* ! ,director issues guidance "u subsection 7b71 ! head ( ea* ag5cy %all submit to ! ,director a plan to implem5t z]o tru/ ar*itecture t includes-- 7#a7 a description ( any /eps ! ag5cy has complet$2 7#b7 an id5tification ( activities t w h ! mo/ imm$iate security impact2 & 7#c7 a s*$ule to implem5t ! plan4 7d7 ,report & brief+ ,n lat] ?an #ij days aft] ! date on :i* ! ,director issues guidance requir$ "u subsection 7b71 ! ,director %all provide a brief+ to ! appropriate congressional committees on ! guidance & ! ag5cy implem5tation plans submitt$ "u subsection 7c74 #baj4 ,automation reports 7a7 ,,omb ,report ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all submit to ! appropriate congressional committees a report on ! use ( automation "u p>agraphs 7#a71 7#e77;,c7 & 7#g77;,b7 ( section #ceed7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,,gao ,report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all p]=m a /udy on ! use ( automation & ma*9e readable data across ! ,f$]al ,gov]nm5t = cyb]security purposes1 includ+ ! automat$ updat+ ( cyb]security tools1 s5sors1 or processes by ag5cies4 #baa4 ,ext5sion ( ,f$]al ,acquisition ,security ,c\ncil ,section #acbh ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! date & all t foll[s & ins]t+ ,decemb] #ca1 #bjbf44 ,,iii ,pilot programs to enhance ,f$]al cyb]security #cja4 ,cont9u\s indep5d5t ,,fisma evaluation pilot 7a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all e/abli% a pilot program to p]=m cont9ual ag5cy audit+ ( ! /&>ds promulgat$ "u section #aacca ( title #dj1 ,unit$ ,/ates ,code4 7b7 ,purpose 7#a7 ,9 g5]al ,! purpose ( ! pilot program e/abli%$ "u subsection 7a7 %all be to develop ! capability to cont9u\sly audit ag5cy cyb]security po/ures1 r ?an p]=m+ an annual audit4 7#b7 ,use ( in=mation ,x is ! s5se ( ,congress t in=mation relat+ to ag5cy cyb]security po/ures %\ld be us$1 on an ongo+ basis1 to increase ag5cy und]/&+ ( cyb]security risk & improve ag5cy cyb]security4 7c7 ,p>ticipat+ ag5cies 7#a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy & 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all id5tify n less ?an #a ag5cy & ! ,inspector ,g5]al ( ea* id5tifi$ ag5cy to p>ticipate 9 ! pilot program e/abli%$ "u subsection 7a74 7#b7 ,capabilities ( ag5cy ,an ag5cy select$ "u p>agraph 7#a7 %all h advanc$ cyb]security capabilities1 includ+ ! capability to implem5t v]ification specifications & o!r automat$ & ma*9e-readable means ( %>+ in=mation4 7#c7 ,capabilities ( ,inspector ,g5]al ,! ,inspector ,g5]al ( an ag5cy select$ "u p>agraph 7#a7 %all h advanc$ cyb]security capabilities1 includ+ ! ability-- 7,a7 to p]=m real-"t or almo/ real-"t & cont9u\s analysis ( ! use ( v]ification specifications by ! ag5cy to assess compliance ) /&>ds promulgat$ "u section #aacca ( title #dj1 ,unit$ ,/ates ,code2 & 7,b7 to assess ! impact & deploym5t ( additional cyb]security proc$ures4 7d7 ,duties ,! ,director1 9 coord9ation ) ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & ! head ( ea* ag5cy p>ticipat+ 9 ! pilot program "u subsection 7c71 %all develop processes & proc$ures to p]=m a cont9u\s indep5d5t evaluation (-- 7#a7 ! compliance ( ! ag5cy )-- 7,a7 ! /&>ds promulgat$ "u section #aacca ( title #dj1 ,unit$ ,/ates ,code1 us+ v]ification specifications to ! greate/ ext5t practicable2 & 7,b7 any additional cyb]security proc$ures implem5t$ by ! ag5cy z a result ( ! evaluation p]=m$ "u section #ceed7;a77#a77;,f7 ( title #dd1 ,unit$ ,/ates ,code2 & 7#b7 ! ov]all cyb]security po/ure ( ! ag5cy1 :i* may include an evaluation (-- 7,a7 ! /atus ( cyb]security rem$ial actions ( ! ag5cy2 7,b7 any vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7,c7 incid5t in=mation ( ! ag5cy2 7,d7 p5etration te/+ p]=m$ by an ext]nal entity "u section #ceei;,a ( title #dd1 ,unit$ ,/ates ,code2 7,e7 in=mation f ! vuln]ability disclosure program in=mation e/abli%$ "u section #ceei;,b ( title #dd1 ,unit$ ,/ates ,code2 7,f7 ag5cy ?reat hunt+ results2 & 7,g7 any o!r in=mation det]m9$ relevant by ! ,director4 7e7 ,indep5d5t evaluation waiv] ,) respect to an ag5cy t p>ticipates 9 ! pilot program "u subsection 7a7 dur+ any ye> o!r ?an ! fir/ ye> dur+ :i* ! pilot program is conduct$1 ! ,director1 ) ! concurr5ce ( ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 may waive any requirem5t ( ! ag5cy ) respect to ! annual indep5d5t evaluation "u section #ceee ( title #dd1 ,unit$ ,/ates ,code4 7f7 ,duration ,! pilot program e/abli%$ "u ?is section-- 7#a7 %all be p]=m$ ov] a p]iod ( n less ?an #b ye>s at ea* ag5cy t p>ticipates 9 ! pilot program "u subsection 7c71 unless ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 det]m9es t cont9u+ ! pilot program w\ld r$uce ! cyb]security ( ! ag5cy2 & 7#b7 may be ext5d$ by ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 if ! ,director makes ! det]m9ation describ$ 9 p>agraph 7#a74 7g7 ,reports 7#a7 ,pilot program plan ,be=e id5tify+ any ag5cies to p>ticipate 9 ! pilot program "u subsection 7c71 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 %all submit to ! appropriate congressional committees a plan = ! pilot program t outl9es selection crit]ia & prelim9>y plans to implem5t ! pilot program4 7#b7 ,brief+ ,be=e comm5c+ a cont9u\s indep5d5t evaluation ( any ag5cy "u ! pilot program e/abli%$ "u subsection 7a71 ! ,director %all provide to ! appropriate congressional committees a brief+ on-- 7,a7 ! selection ( ag5cies to p>ticipate 9 ! pilot program2 & 7,b7 processes & proc$ures to p]=m a cont9u\s indep5d5t evaluation ( ag5cies4 7#c7 ,pilot results ,n lat] ?an #fj days aft] ! f9al day ( ea* ye> dur+ :i* an ag5cy p>ticipates 9 ! pilot program e/abli%$ "u subsection 7a71 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 %all submit to ! appropriate congressional committees a report on ! results ( ! pilot program = ea* ag5cy t p>ticipates 9 ! pilot program dur+ t ye>4 #cjb4 ,active cyb] def5sive pilot 7a7 ,def9ition ,9 ?is section1 ! t]m active def5se te*nique-- 7#a7 means an action tak5 on ! sy/ems ( an entity to increase ! security ( in=mation on ! network ( an ag5cy by mislead+ an adv]s>y2 & 7#b7 includes a honeypot1 deception1 or purposefully fe$+ false or mislead+ data to an adv]s>y :5 ! adv]s>y is on ! sy/ems ( ! entity4 7b7 ,/udy ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all p]=m a /udy on ! use ( active def5se te*niques to enhance ! security ( ag5cies1 :i* %all include-- 7#a7 a review ( legal re/rictions on ! use ( diff]5t active cyb] def5se te*niques on ,f$]al networks2 7#b7 an evaluation (-- 7,a7 ! efficacy ( a selection ( active def5se te*niques det]m9$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,b7 factors t impact ! efficacy ( ! active def5se te*niques evaluat$ "u subp>agraph 7,a72 & 7#c7 ! developm5t ( a framework = ! use ( diff]5t active def5se te*niques by ag5cies4 7c7 ,pilot program ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all e/abli% a pilot program at n less ?an #b ag5cies to implem5t1 & assess ! effectiv5ess (1 n less ?an #a active cyb] def5se te*nique4 7d7 ,purpose ,! purpose ( ! pilot program e/abli%$ "u subsection 7c7 %all be to-- 7#a7 id5tify any /atutory or policy limitations on us+ active def5se te*niques2 7#b7 und]/& ! efficacy ( us+ active def5se te*niques2 & 7#c7 implem5t ! use ( effective te*niques to improve ag5cy sy/ems4 7e7 ,plan ,n lat] ?an #cfj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director1 %all develop a plan to (f] any active def5se te*nique det]m9$ to be successful dur+ ! pilot program e/abli%$ "u subsection 7c7 z a %>$ s]vice to o!r ag5cies4 7f7 ,reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 provide to ! appropriate congressional committees a brief+ on-- 7,a7 ! results ( ! /udy p]=m$ "u subsection 7b72 & 7,b7 ! ag5cies select$ to p>ticipate 9 ! pilot program e/abli%$ "u subsection 7c72 7#b7 submit to ! appropriate congressional committees a report on ! results ( ! pilot program e/abli%$ "u subsection 7c71 includ+ any recomm5dations develop$ f ! results ( ! pilot program2 & 7#c7 submit to ! appropriate congressional committees a copy ( ! plan develop$ "u subsection 7e74 7g7 ,sunset 7#a7 ,9 g5]al ,! requirem5ts ( ?is section %all t]m9ate on ! date t is #c ye>s aft] ! date ( enactm5t ( ?is ,act4 7#b7 ,au?ority to cont9ue use ( te*niques ,not)/&+ p>agraph 7#a71 aft] ! date describ$ 9 p>agraph 7#a71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy may cont9ue to (f] any active def5se te*nique det]m9$ to be successful dur+ ! pilot program e/abli%$ "u subsection 7c7 z a %>$ s]vice to ag5cies4 #cjc4 ,security op]ations c5t] z a s]vice pilot 7a7 ,purpose ,! purpose ( ?is section is = ! ,cyb]security & ,infra/ructure ,security ,ag5cy to run a security op]ation c5t] on behalf ( ano!r ag5cy1 alleviat+ ! ne$ to duplicate ?is function at e ag5cy1 & emp[]+ a great] c5traliz$ cyb]security capability4 7b7 ,plan ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% a c5traliz$ ,f$]al security op]ations c5t] %>$ s]vice (f]+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,cont5ts ,! plan requir$ "u subsection 7b7 %all include consid]ations =-- 7#a7 collect+1 organiz+1 & analyz+ ag5cy in=mation sy/em data 9 real "t2 7#b7 /aff+ & res\rces2 & 7#c7 appropriate int]ag5cy agreem5ts1 concepts ( op]ations1 & gov]nance plans4 7d7 ,pilot program 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* ! plan requir$ "u subsection 7b7 is develop$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all ent] into a #a-ye> agreem5t ) n less ?an #b ag5cies to (f] a security op]ations c5t] z a %>$ s]vice4 7#b7 ,additional agreem5ts ,aft] ! date on :i* ! brief+ requir$ "u subsection 7e77#a7 is provid$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 may ent] into additional #a-ye> agreem5ts describ$ 9 p>agraph 7#a7 ) ag5cies4 7e7 ,brief+ & report 7#a7 ,brief+ ,n lat] ?an #bfj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! p>amet]s ( any #a-ye> agreem5ts ent]$ into "u subsection 7d77#a74 7#b7 ,report ,n lat] ?an #ij days aft] ! date on :i* ! fir/ #a-ye> agreem5t ent]$ into "u subsection 7d7 expires1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report on-- 7,a7 ! agreem5t2 & 7,b7 any additional agreem5ts ent]$ into ) ag5cies "u subsection 7d74 #a4 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba4 #b4 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title4,sec4 #b4 ,table ( cont5ts4,sec4 #c4 ,def9itions4,,title ,i--,updates to ,f,i,s,m,a,sec4 #aja4 ,title #dd am5dm5ts4,sec4 #ajb4 ,am5dm5ts to subtitle ,,iii ( title #dj4,sec4 #ajc4 ,actions to enhance ,f$]al incid5t response4,sec4 #ajd4 ,additional guidance to ag5cies on ,,fisma updates4,sec4 #aje4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts4,,title ,,ii--,improv+ ,f$]al cybersecurity,sec4 #bja4 ,mobile security /&>ds4,sec4 #bjb4 ,data & logg+ ret5tion = incid5t response4,sec4 #bjc4 ,,cisa ag5cy advisors4,sec4 #bjd4 ,f$]al p5etration te/+ policy4,sec4 #bje4 ,ongo+ ?reat hunt+ program4,sec4 #bjf4 ,codify+ vuln]ability disclosure programs4,sec4 #bjg4 ,implem5t+ presumption ( compromise & lea/ privilege pr9ciples4,sec4 #bjh4 ,automation reports4,sec4 #bji4 ,ext5sion ( ,f$]al acquisition security c\ncil4,sec4 #baj4 ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy da%bo>d4,,title ,,iii--,risk-bas$ budget model,sec4 #cja4 ,def9itions4,sec4 #cjb4 ,e/abli%m5t ( risk-bas$ budget model4,,title ,,iv--,pilot programs to enhance ,f$]al cybersecurity,sec4 #dja4 ,active cyb] def5sive /udy4,sec4 #djb4 ,security op]ations c5t] z a s]vice pilot4 #c4 ,def9itions ,9 ?is ,act1 unless o!rwise specifi$3 7#a7 ,additional cyb]security proc$ure ,! t]m additional cyb]security proc$ure has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7#b7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#c7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 & 7,c7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives4 7#d7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#e7 ,incid5t ,! t]m incid5t has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#f7 ,national security sy/em ,! t]m national security sy/em has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#g7 ,p5etration te/ ,! t]m p5etration te/ has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act4 7#h7 ,?reat hunt+ ,! t]m ?reat hunt+ means proactively & it]atively se>*+ = ?reats to sy/ems t evade detection by automat$ ?reat detection sy/ems4 ,i ,updates to ,,fisma #aja4 ,title #dd am5dm5ts 7a7 ,sub*apt] ,i am5dm5ts ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #cejd-- 7,a7 9 subsection 7a77#a77;,b7-- 7i7 by /rik+ clause 7v7 & ins]t+ ! foll[+3 7v7 confid5tiality1 disclosure1 & %>+ ( in=mation2 2 7ii7 by r$esignat+ clause 7vi7 z clause 7vii72 & 7iii7 by ins]t+ aft] clause 7v7 ! foll[+3 7vi7 9 consultation ) ! ,national ,cyb] ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 security ( in=mation2 & 2 7,b7 9 subsection 7g71 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ) respect to in=mation collect$ or ma9ta9$ by or = ag5cies-- 7,a7 develop & ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on privacy1 confid5tiality1 disclosure1 & %>+ ( ! in=mation2 & 7,b7 9 consultation ) ! ,national ,cyb] ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 develop & ov]see policies1 pr9ciples1 /&>ds1 & guidel9es on security ( ! in=mation2 & 2 & 7,c7 9 subsection 7h77#a7-- 7i7 9 ! matt] prec$+ subp>agraph 7,a7-- 7,i7 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 be=e ! ,director2 & 7,,ii7 by ins]t+ a comma be=e & ! ,adm9i/rator2 & 7ii7 9 subp>agraph 7,a71 by ins]t+ security & aft] in=mation te*nology2 7#b7 9 section #ceje-- 7,a7 9 p>agraph 7#c7 ( ! fir/ subsection designat$ z subsection 7c7-- 7i7 9 subp>agraph 7,b7-- 7,i7 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 & be=e ! ,comptroll] ,g5]al2 & 7,,ii7 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c77v71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 ma9ta9$ on a cont9ual basis ?r\gh ! use ( automation1 ma*9e-readable data1 & scann+4 2 & 7,b7 by /rik+ ! second subsection designat$ z subsection 7c72 7#c7 9 section #cejf-- 7,a7 9 subsection 7b77#a77;,c71 by ins]t+ 1 availability aft] integrity2 & 7,b7 9 subsection 7h77#c71 by ins]t+ security1 aft] effici5cy12 & 7#d7 9 section #ceac-- 7,a7 by r$esignat+ subsection 7c7 z subsection 7d72 & 7,b7 by ins]t+ aft] subsection 7b7 ! foll[+3 7c7 ,ea* ag5cy provid+ a writt5 plan "u subsection 7b7 %all provide any portion ( ! writt5 plan address+ in=mation security or cyb]security to ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 4 7b7 ,sub*apt] ,,ii def9itions 7#a7 ,9 g5]al ,section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by r$esignat+ p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 & 7#g7 z p>agraphs 7#b71 7#c71 7#d71 7#e71 7#f71 7#i71 & 7#aa71 respectively2 7,b7 by ins]t+ be=e p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#a7 ,! t]m additional cyb]security proc$ure means a process1 proc$ure1 or o!r activity t is e/abli%$ 9 excess ( ! in=mation security /&>ds promulgat$ "u section #aacca7;b7 ( title #dj to increase ! security & r$uce ! cyb]security risk ( ag5cy sy/ems4 2 7,c7 by ins]t+ aft] p>agraph 7#f71 z s r$esignat$1 ! foll[+3 7#g7 ,! t]m high value asset means in=mation or an in=mation sy/em t ! head ( an ag5cy det]m9es s critical to ! ag5cy t ! loss or corruption ( ! in=mation or ! loss ( access to ! in=mation sy/em w\ld h a s]i\s impact on ! ability ( ! ag5cy to p]=m ! mission ( ! ag5cy or conduct bus9ess4 7#h7 ,! t]m major incid5t has ! mean+ giv5 ! t]m 9 guidance issu$ by ! ,director "u section #ceih7;a74 2 7,d7 by ins]t+ aft] p>agraph 7#i71 z s r$esignat$1 ! foll[+3 7#aj7 ,! t]m p5etration te/ means a specializ$ type ( assessm5t t-- 7,a7 is conduct$ on an in=mation sy/em or a compon5t ( an in=mation sy/em2 & 7,b7 emulates an attack or o!r exploitation capability ( a pot5tial adv]s>y1 typically "u specific con/ra9ts1 9 ord] to id5tify any vuln]abilities ( an in=mation sy/em or a compon5t ( an in=mation sy/em t c\ld be exploit$4 2 & 7,e7 by ins]t+ aft] p>agraph 7#aa71 z s r$esignat$1 ! foll[+3 7#ab7 ,! t]m %>$ s]vice means a c5traliz$ bus9ess or mission capability t is provid$ to multiple organizations )9 an ag5cy or to multiple ag5cies4 4 7#b7 ,con=m+ am5dm5ts 7,a7 ,homel& ,security ,act ( #bjjb ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is am5d$ by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f77;,a7 & ins]t+ section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,c7 ,high-,p]=mance ,comput+ ,act ( #aiia ,section #bjg7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is am5d$ by /rik+ section #ceeb7;b77#f77;,a77i7 & ins]t+ section #ceeb7;b77#i77;,a77i74 7,d7 ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj ,section #c7e7 ( ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,e7 ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac ,section #icc7;e77#a77;,b7 ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac 7#aj ,u4,s4,c4 #bbbd note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa ,! ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa 7,public ,law #aaa-chc7 is am5d$-- 7i7 9 section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by /rik+ section #cedb7;b7 & ins]t+ section #ceeb7;b72 7ii7 9 section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b72 & 7iii7 9 section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,g7 ,e-,gov]nm5t ,act ( #bjjb ,section #cja7;c77#a77;,a7 ( ! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceja note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,h7 ,national ,in/itute ( ,/&>ds & ,te*nology ,act ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7i7 9 subsection 7a77#b71 by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b72 & 7ii7 9 subsection 7f7-- 7,i7 9 p>agraph 7#c71 by /rik+ section #cecb7a7 & ins]t+ section #ceeb7;b72 & 7,,ii7 9 p>agraph 7#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b74 7c7 ,sub*apt] ,,ii am5dm5ts ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #ceea-- 7,a7 by r$esignat+ p>agraphs 7#c71 7#d71 7#e71 & 7#f7 z p>agraphs 7#d71 7#e71 7#f71 & 7#g71 respectively2 7,b7 by ins]t+ aft] p>agraph 7#b7 ! foll[+3 7#c7 recognize ! role ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy z ! lead entity = op]ational cyb]security coord9ation across ! ,f$]al ,gov]nm5t2 2 7,c7 9 p>agraph 7#e71 z s r$esignat$1 by /rik+ diagnose & improve & ins]t+ integrate1 deliv]1 diagnose1 & improve2 7,d7 9 p>agraph 7#f71 z s r$esignat$1 by /rik+ & at ! end2 7,e7 9 p>agraph 7#g71 z s r$esignat$1 by /rik+ ! p]iod at ! end & ins]t+ a semi colon2 & 7,f7 by add+ at ! end ! foll[+3 7#h7 recognize t ea* ag5cy has specific mission requirem5ts &1 at times1 unique cyb]security requirem5ts to meet ! mission ( ! ag5cy2 7#i7 recognize t ea* ag5cy does n h ! same res\rces to secure ag5cy sy/ems1 & an ag5cy %\ld n be expect$ to h ! capability to secure ! sy/ems ( ! ag5cy f advanc$ adv]s>ies alone2 & 7#aj7 recognize t-- 7,a7 a holi/ic ,f$]al cyb]security model is necess>y to acc\nt = diff]5ces betwe5 ! missions & capabilities ( ag5cies2 & 7,b7 9 acc\nt+ = ! diff]5ces describ$ 9 subp>agraph 7,a7 & ensur+ ov]all ,f$]al cyb]security-- 7i7 ! ,(fice ( ,managem5t & ,budget is ! lead] = policy developm5t & ov]sight ( ,f$]al cyb]security2 7ii7 ! ,cyb]security & ,infra/ructure ,security ,ag5cy is ! lead] = implem5t+ op]ations at ag5cies2 & 7iii7 ! ,national ,cyb] ,director is responsible = develop+ ! ov]all cyb]security /rategy ( ! ,unit$ ,/ates & advis+ ! ,presid5t on matt]s relat+ to cyb]security4 2 7#b7 9 section #ceec-- 7,a7 by /rik+ ! section head+ & ins]t+ ,au?ority & functions ( ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7,b7 9 subsection 7a7-- 7i7 9 p>agraph 7#a71 by ins]t+ 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 be=e develop+ & ov]see+2 7ii7 9 p>agraph 7#e7-- 7,i7 by ins]t+ 1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 be=e ag5cy compliance2 & 7,,ii7 by /rik+ & at ! end2 & 7iii7 by add+ at ! end ! foll[+3 7#h7 promot+1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology-- 7,a7 ! use ( automation to improve ,f$]al cyb]security & visibility ) respect to ! implem5tation ( ,f$]al cyb]security2 & 7,b7 ! use ( presumption ( compromise & lea/ privilege pr9ciples to improve resili5cy & timely response actions to incid5ts on ,f$]al sy/ems4 2 7,c7 9 subsection 7b7-- 7i7 by /rik+ ! subsection head+ & ins]t+ ,cyb]security & ,infra/ructure ,security ,ag5cy2 7ii7 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ,! ,secret>y1 9 consultation ) ! ,director & ins]t+ ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director & ! ,national ,cyb] ,director2 7iii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ & report+ requirem5ts "u sub*apt] ,,iv ( ?is title aft] section #ceef2 & 7,,ii7 9 subp>agraph 7,d71 by /rik+ ! ,director or ,secret>y & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7iv7 9 p>agraph 7#e71 by /rik+ coord9at+ & ins]t+ lead+ ! coord9ation (2 7v7 9 p>agraph 7#h71 by /rik+ ! ,secret>y's discretion & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy's discretion2 & 7vi7 9 p>agraph 7#i71 by /rik+ z ! ,director or ! ,secret>y1 9 consultation ) ! ,director1 & ins]t+ z ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,d7 9 subsection 7c7-- 7i7 9 ! matt] prec$+ p>agraph 7#a71 by /rik+ ea* ye> & ins]t+ ea* ye> dur+ :i* ag5cies are requir$ to submit reports "u section #ceed7;c72 7ii7 by /rik+ p>agraph 7#a72 7iii7 by r$esignat+ p>agraphs 7#b71 7#c71 & 7#d7 z p>agraphs 7#a71 7#b71 & 7#c71 respectively2 7iv7 9 p>agraph 7#c71 z s r$esignat$1 by /rik+ & at ! end2 7v7 by ins]t+ aft] p>agraph 7#c71 z s r$esignat$ ! foll[+3 7#d7 a summ>y ( ea* assessm5t ( ,f$]al risk po/ure p]=m$ "u subsection 7i72 2 & 7vi7 9 p>agraph 7#e71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 7,e7 by r$esignat+ subsections 7i71 7j71 7k71 & 7l7 z subsections 7j71 7k71 7l71 & 7m7 respectively2 7,f7 by ins]t+ aft] subsection 7h7 ! foll[+3 7i7 ,f$]al risk assessm5ts ,on an ongo+ & cont9u\s basis1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all p]=m assessm5ts ( ,f$]al risk po/ure us+ any available in=mation on ! cyb]security po/ure ( ag5cies1 & brief ! ,director & ,national ,cyb] ,director on ! f9d+s ( ^? assessm5ts includ+-- 7#a7 ! /atus ( ag5cy cyb]security rem$ial actions describ$ 9 section #ceed7;b77#g72 7#b7 any vuln]ability in=mation relat+ to ! sy/ems ( an ag5cy t is kn[n by ! ag5cy2 7#c7 analysis ( incid5t in=mation "u section #ceig2 7#d7 evaluation ( p5etration te/+ p]=m$ "u section #ceei;,a2 7#e7 evaluation ( vuln]ability disclosure program in=mation "u section #ceei;,b2 7#f7 evaluation ( ag5cy ?reat hunt+ results2 7#g7 evaluation ( ,f$]al & non-,f$]al ?reat intellig5ce2 7#h7 data on ag5cy compliance ) /&>ds issu$ "u section #aacca ( title #dj2 7#i7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 & 7#aj7 any o!r in=mation ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es relevant4 2 & 7,g7 9 subsection 7j71 z s r$esignat$-- 7i7 by /rik+ reg>d+ ! specific & ins]t+ 8t includes a summ>y (-- 7#a7 ! specific 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 & & 7iii7 by add+ at ! end ! foll[+3 7#b7 ! tr5ds id5tifi$ 9 ! ,f$]al risk assessm5t p]=m$ "u subsection 7i74 2 & 7,h7 by add+ at ! end ! foll[+3 7n7 ,b9d+ op]ational directives ,if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy issues a b9d+ op]ational directive or an em]g5cy directive "u ?is section1 n lat] ?an #b days aft] ! date on :i* ! b9d+ op]ational directive requires an ag5cy to take an action1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! appropriate report+ entities ! /atus ( ! implem5tation ( ! b9d+ op]ational directive at ! ag5cy4 2 7#c7 9 section #ceed-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a7-- 7,i7 by r$esignat+ subp>agraphs 7,a71 7,b71 & 7,c7 z subp>agraphs 7,b71 7,c71 & 7,d71 respectively2 7,,ii7 by ins]t+ be=e subp>agraph 7,b71 z s r$esignat$1 ! foll[+3 7,a7 on an ongo+ & cont9u\s basis1 p]=m+ ag5cy sy/em risk assessm5ts t-- 7i7 id5tify & docum5t ! high value assets ( ! ag5cy us+ guidance f ! ,director2 7ii7 evaluate ! data assets inv5tori$ "u section #ceaa = s5sitivity to compromises 9 confid5tiality1 integrity1 & availability2 7iii7 id5tify ag5cy sy/ems t h access to or hold ! data assets inv5tori$ "u section #ceaa2 7iv7 evaluate ! ?reats fac+ ag5cy sy/ems & data1 includ+ high value assets1 bas$ on ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available2 7v7 evaluate ! vuln]ability ( ag5cy sy/ems & data1 includ+ high value assets1 includ+ by analyz+-- 7,i7 ! results ( p5etration te/+ p]=m$ by ! ,dep>tm5t ( ,homel& ,security "u section #ceec7;b77#i72 7,,ii7 ! results ( p5etration te/+ p]=m$ "u section #ceei;,a2 7,,iii7 in=mation provid$ to ! ag5cy ?r\gh ! vuln]ability disclosure program ( ! ag5cy "u section #ceei;,b2 7,,iv7 incid5ts2 & 7,v7 any o!r vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7vi7 assess ! impacts ( pot5tial ag5cy incid5ts to ag5cy sy/ems1 data1 & op]ations bas$ on ! evaluations describ$ 9 clauses 7ii7 & 7iv7 & ! ag5cy sy/ems id5tifi$ "u clause 7iii72 & 7vii7 assess ! consequ5ces ( pot5tial incid5ts occurr+ on ag5cy sy/ems t w\ld impact sy/ems at o!r ag5cies1 includ+ due to int]connectivity betwe5 diff]5t ag5cy sy/ems or op]ational reliance on ! op]ations ( ! sy/em or data 9 ! sy/em2 2 7,,iii7 9 subp>agraph 7,b71 z s r$esignat$1 9 ! matt] prec$+ clause 7i71 by /rik+ provid+ in=mation & ins]t+ us+ in=mation f ! assessm5t conduct$ "u subp>agraph 7,a71 provid+1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 in=mation2 7,,iv7 9 subp>agraph 7,c71 z s r$esignat$-- 7aa7 9 clause 7ii7 by ins]t+ b9d+ be=e op]ational2 & 7bb7 9 clause 7vi71 by /rik+ & at ! end2 & 7,v7 by add+ at ! end ! foll[+3 7,e7 provid+ an update on ! ongo+ & cont9u\s assessm5t p]=m$ "u subp>agraph 7,a7-- 7i7 ^u reque/1 to ! inspector g5]al ( ! ag5cy or ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7ii7 on a p]iodic basis1 z det]m9$ by guidance issu$ by ! ,director b n less frequ5tly ?an annually1 to-- 7,i7 ! ,director2 7,,ii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,,iii7 ! ,national ,cyb] ,director2 7,f7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & n less frequ5tly ?an once e #c ye>s1 p]=m+ an evaluation ( :e!r additional cyb]security proc$ures are appropriate = secur+ a sy/em (1 or "u ! sup]vision (1 ! ag5cy1 :i* %all-- 7i7 be complet$ consid]+ ! ag5cy sy/em risk assessm5t p]=m$ "u subp>agraph 7,a72 & 7ii7 include a specific evaluation = high value assets2 7,g7 n lat] ?an #cj days aft] complet+ ! evaluation p]=m$ "u subp>agraph 7,f71 provid+ ! evaluation & an implem5tation plan1 if applicable1 = us+ additional cyb]security proc$ures det]m9$ to be appropriate to-- 7i7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7ii7 ! ,director2 & 7iii7 ! ,national ,cyb] ,director2 & 7,h7 if ! head ( ! ag5cy det]m9es !re is ne$ = additional cyb]security proc$ures1 ensur+ t ^? additional cyb]security proc$ures are reflect$ 9 ! budget reque/ ( ! ag5cy 9 accordance ) ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g72 2 7ii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ 9 accordance ) ! ag5cy sy/em risk assessm5t p]=m$ "u p>agraph 7#a77;,a7 aft] in=mation sy/ems2 7,,ii7 9 subp>agraph 7,b7-- 7aa7 by /rik+ 9 accordance ) /&>ds & ins]t+ 89 accordance )-- 7i7 /&>ds 2 & 7bb7 by add+ at ! end ! foll[+3 7ii7 ! evaluation p]=m$ "u p>agraph 7#a77;,f72 & 7iii7 ! implem5tation plan describ$ 9 p>agraph 7#a77;,g72 2 & 7,,iii7 9 subp>agraph 7,d71 by ins]t+ 1 ?r\gh ! use ( p5etration te/+1 ! vuln]ability disclosure program e/abli%$ "u section #ceei;,b1 & o!r means1 aft] p]iodically2 7iii7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 9 clause 7iii71 by /rik+ & at ! end2 7bb7 9 clause 7iv71 by add+ & at ! end2 & 7cc7 by add+ at ! end ! foll[+3 7v7 ensure t-- 7,i7 s5ior ag5cy in=mation security (fic]s ( compon5t ag5cies c>ry out responsibilities "u ?is sub*apt]1 z direct$ by ! s5ior ag5cy in=mation security (fic] ( ! ag5cy or an equival5t (ficial2 & 7,,ii7 s5ior ag5cy in=mation security (fic]s ( compon5t ag5cies report to-- 7aa7 ! s5ior in=mation security (fic] ( ! ag5cy or an equival5t (ficial2 & 7bb7 ! ,*ief ,in=mation ,(fic] ( ! compon5t ag5cy or an equival5t (ficial2 2 & 7iv7 9 p>agraph 7#e71 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy be=e on ! effectiv5ess2 7,b7 9 subsection 7b7-- 7i7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 pursuant to subsection 7a77#a77;,a71 p]=m+ ongo+ & cont9u\s ag5cy sy/em risk assessm5ts1 :i* may include us+ guidel9es & automat$ tools consi/5t ) /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj1 z applicable2 2 7ii7 9 p>agraph 7#b7-- 7,i7 by /rik+ subp>agraph 7,b7 & ins]t+ ! foll[+3 7,b7 comply ) ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g72 2 & 7,,ii7 9 subp>agraph 7,d7-- 7aa7 by r$esignat+ clauses 7iii7 & 7iv7 z clauses 7iv7 & 7v71 respectively2 7bb7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 b9d+ op]ational directives & em]g5cy directives promulgat$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceec2 2 & 7cc7 9 clause 7iv71 z s r$esignat$1 by /rik+ z det]m9$ by ! ag5cy2 & & ins]t+ 8z det]m9$ by ! ag5cy1 consid]+-- 7,i7 ! ag5cy risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 & 7,,ii7 ! det]m9ations ( apply+ m /r+5t /&>ds & additional cyb]security proc$ures pursuant to section #aacca7;c77#a7 ( title #dj2 & 2 7iii7 9 p>agraph 7#e77;,a71 by ins]t+ 1 includ+ p5etration te/+1 z appropriate1 aft] %all include te/+2 7iv7 9 p>agraph 7#f71 by /rik+ plann+1 implem5t+1 evaluat+1 & docum5t+ & ins]t+ plann+ & implem5t+ &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 evaluat+ & docum5t+2 7v7 by r$esignat+ p>agraphs 7#g7 & 7#h7 z p>agraphs 7#h7 & 7#i71 respectively2 7vi7 by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 a process = provid+ ! /atus ( e rem$ial action & kn[n sy/em vuln]ability to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable2 2 & 7vii7 9 p>agraph 7#h77;,c71 z s r$esignat$-- 7,i7 by /rik+ clause 7ii7 & ins]t+ ! foll[+3 7ii7 notify+ & consult+ ) ! ,f$]al in=mation security incid5t c5t] e/abli%$ "u section #ceef pursuant to ! requirem5ts ( section #ceid2 2 7,,ii7 by r$esignat+ clause 7iii7 z clause 7iv72 7,,iii7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 p]=m+ ! notifications & o!r activities requir$ "u sub*apt] ,,iv ( ?is title2 & 2 & 7,,iv7 9 clause 7iv71 z s r$esignat$-- 7aa7 9 subclause 7,i71 by /rik+ & relevant (fices ( inspectors g5]al2 7bb7 9 subclause 7,,ii71 by add+ & at ! end2 7cc7 by /rik+ subclause 7,,iii72 & 7dd7 by r$esignat+ subclause 7,,iv7 z subclause 7,,iii72 7,c7 9 subsection 7c7-- 7i7 by r$esignat+ p>agraph 7#b7 z p>agraph 7#e72 7ii7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ,biannual report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba & n less frequ5tly ?an once e #b ye>s !reaft]1 us+ ! cont9u\s & ongo+ ag5cy sy/em risk assessm5t "u subsection 7a77#a77;,a71 ! head ( ea* ag5cy %all submit to ! ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 ! appropriate au?orization & appropriations committees ( ,congress1 ! ,national ,cyb] ,director1 & ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates a report t-- 7,a7 summ>izes ! ag5cy sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 7,b7 evaluates ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices ( ! ag5cy to address ! risks id5tifi$ 9 ! ag5cy sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 7,c7 summ>izes ! evaluation & implem5tation plans describ$ 9 subp>agraphs 7,f7 & 7,g7 ( subsection 7a77#a7 & :e!r ^? evaluation & implem5tation plans call = ! use ( additional cyb]security proc$ures det]m9$ to be appropriate by ! ag5cy2 & 7,d7 summ>izes ! /atus ( rem$ial actions id5tifi$ by inspector g5]al ( ! ag5cy1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & any o!r s\rce det]m9$ appropriate by ! head ( ! ag5cy4 7#b7 ,unclassifi$ reports ,ea* report submitt$ "u p>agraph 7#a7-- 7,a7 %all be1 to ! greate/ ext5t practicable1 9 an unclassifi$ & o!rwise uncontroll$ =m2 & 7,b7 may include a classifi$ annex4 7#c7 ,access to in=mation ,! head ( an ag5cy %all ensure t1 to ! greate/ ext5t practicable1 in=mation is includ$ 9 ! unclassifi$ =m ( ! report submitt$ by ! ag5cy "u p>agraph 7#b77;,a74 7#d7 ,brief+s ,dur+ ea* ye> dur+ :i* a report is n requir$ to be submitt$ "u p>agraph 7#a71 ! ,director %all provide to ! congressional committees describ$ 9 p>agraph 7#a7 a brief+ summ>iz+ curr5t ag5cy & ,f$]al risk po/ures4 2 & 7iii7 9 p>agraph 7#e71 z s r$esignat$1 by ins]t+ includ+ ! report+ proc$ures e/abli%$ "u section #aacae7;d7 ( title #dj & subsection 7a77#c77;,a77v7 ( ?is section2 & 7,d7 9 subsection 7d77#a71 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] ! ,director2 & 7#d7 9 section #ceee-- 7,a7 9 ! section head+1 by /rik+ ,annual indep5d5t & ins]t+ ,indep5d5t2 7,b7 9 subsection 7a7-- 7i7 9 p>agraph 7#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c71 aft] ,ea* ye>2 7ii7 9 p>agraph 7#b77;,a71 by ins]t+ 1 includ+ by p5etration te/+ & analyz+ ! vuln]ability disclosure program ( ! ag5cy aft] in=mation sy/ems2 & 7iii7 by add+ at ! end ! foll[+3 7#c7 ,an evaluation "u ?is section may include recomm5dations = improv+ ! cyb]security po/ure ( ! ag5cy4 2 7,c7 9 subsection 7b77#a71 by /rik+ annual2 7,d7 9 subsection 7e77#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 aft] ,ea* ye>2 7,e7 by /rik+ subsection 7f7 & ins]t+ ! foll[+3 7f7 ,protection ( in=mation 7#a7 ,ag5cies1 evaluators1 & o!r recipi5ts ( in=mation t1 if disclos$1 may cause grave h>m to ! ef=ts ( ,f$]al in=mation security (fic]s1 includ+ ! appropriate congressional committees1 %all take appropriate /eps to ensure ! protection ( t in=mation1 includ+ safegu>d+ ! in=mation f public disclosure4 7#b7 ,! protections requir$ "u p>agraph 7#a7 %all be comm5surate ) ! risk & comply ) all applicable laws & regulations4 7#c7 ,) respect to in=mation t is n relat$ to national security sy/ems1 ag5cies & evaluators %all make a summ>y ( ! in=mation unclassifi$ & publicly available1 includ+ in=mation t does n id5tify-- 7,a7 specific in=mation sy/em incid5ts2 or 7,b7 specific in=mation sy/em vuln]abilities4 2 7,f7 9 subsection 7g77#b7-- 7i7 by /rik+ ?is subsection %all & ins]t+ 8?is subsection-- 7,a7 %all 2 7ii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,b7 id5tify any entity t p]=ms an indep5d5t evaluation "u subsection 7b74 2 & 7,g7 by /rik+ subsection 7j7 & ins]t+ ! foll[+3 7j7 ,guidance 7#a7 ,9 g5]al ,! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 & o!r int]e/$ p>ties z appropriate1 %all ensure ! developm5t ( guidance = evaluat+ ! effectiv5ess ( an in=mation security program & practices 7#b7 ,priorities ,! guidance develop$ "u p>agraph 7#a7 %all prioritize ! id5tification (-- 7,a7 ! mo/ common ?reat patt]ns exp]i5c$ by ea* ag5cy2 7,b7 ! security controls t address ! ?reat patt]ns describ$ 9 subp>agraph 7,a72 & 7,c7 any o!r security risks unique to ! networks ( ea* ag5cy4 2 & 7#e7 9 section #ceef7;a7-- 7,a7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] incid5t c5t]2 & 7,b7 9 p>agraph 7#d71 by /rik+ #ceed7;b7 & ins]t+ #ceed7;a77#a77;,a74 7d7 ,con=m+ am5dm5ts 7#a7 ,table ( sections ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by /rik+ ! item relat+ to section #ceec & ins]t+ ! foll[+3 #ceec4 ,au?ority & functions ( ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 2 & 7,b7 by /rik+ ! item relat+ to section #ceee & ins]t+ ! foll[+3 #ceee4 ,indep5d5t evaluation4 4 7#b7 ,,omb reports ,section #bbf7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebd7;c77 is am5d$-- 7,a7 9 p>agraph 7#a77;,b71 9 ! matt] prec$+ clause 7i71 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 9 p>agraph 7#b77;,b71 9 ! matt] prec$+ clause 7i7-- 7i7 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7ii7 by /rik+ ! report requir$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code & ins]t+ t report4 7#c7 ,,ni/ responsibilities ,section #bj7;d77#c77;,b7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is am5d$ by /rik+ annual4 7e7 ,f$]al sy/em incid5t response 7#a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,iv ,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! def9itions "u sections #cejb & #ceeb %all apply to ?is sub*apt]4 7b7 ,additional def9itions ,z us$ 9 ?is sub*apt]3 7#a7 ,appropriate report+ entities ,! t]m appropriate report+ entities means-- 7,a7 ! majority & m9ority lead]s ( ! ,s5ate2 7,b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7,c7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,d7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 7,e7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7,f7 ! appropriate au?orization & appropriations committees ( ,congress2 7,g7 ! ,director2 7,h7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,i7 ! ,national ,cyb] ,director2 7,j7 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7,k7 ! inspector g5]al ( any impact$ ag5cy4 7#b7 ,aw>dee ,! t]m aw>dee-- 7,a7 means a p]son1 bus9ess1 or o!r entity t receives a grant f1 or is a p>ty to a coop]ative agreem5t )1 an ag5cy2 & 7,b7 includes any subgrantee ( a p]son1 bus9ess1 or o!r entity describ$ 9 subp>agraph 7,a74 7#c7 ,brea* ,! t]m brea* means-- 7,a7 a compromise ( ! security1 confid5tiality1 or integrity ( data 9 electronic =m t results 9 unau?oriz$ access to1 or an acquisition (1 p]sonal in=mation2 or 7,b7 a loss ( data 9 electronic =m t results 9 unau?oriz$ access to1 or an acquisition (1 p]sonal in=mation4 7#d7 ,contractor ,! t]m contractor means-- 7,a7 a prime contractor ( an ag5cy or a subcontractor ( a prime contractor ( an ag5cy2 & 7,b7 any p]son or bus9ess t collects or ma9ta9s in=mation1 includ+ p]sonally id5tifiable in=mation1 on behalf ( an ag5cy4 7#e7 ,f$]al in=mation ,! t]m ,f$]al in=mation means in=mation creat$1 collect$1 process$1 ma9ta9$1 dissem9at$1 disclos$1 or dispos$ ( by or = ! ,f$]al ,gov]nm5t 9 any m$ium or =m4 7#f7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em means an in=mation sy/em us$ or op]at$ by an ag5cy1 a contractor1 or ano!r organization on behalf ( an ag5cy4 7#g7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 ! t]m 9 section #c ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consum] report+ ag5cy ,! t]m nationwide consum] report+ ag5cy means a consum] report+ ag5cy describ$ 9 section #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vuln]ability disclosure ,! t]m vuln]ability disclosure means a vuln]ability id5tifi$ "u section #ceei;,b4 #ceib4 ,notification ( brea* 7a7 ,notification ,z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #de days aft] an ag5cy has a reasonable basis to conclude t a brea* has occurr$1 ! head ( ! ag5cy1 9 consultation ) a s5ior privacy (fic] ( ! ag5cy1 %all-- 7#a7 det]m9e :e!r notice to any individual pot5tially affect$ by ! brea* is appropriate bas$ on an assessm5t ( ! risk ( h>m to ! individual t consid]s-- 7,a7 ! nature & s5sitivity ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,b7 ! likelihood ( access to & use ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,c7 ! type ( brea*2 & 7,d7 any o!r factors det]m9$ by ! ,director2 & 7#b7 z appropriate1 provide writt5 notice 9 accordance ) subsection 7b7 to ea* individual pot5tially affect$ by ! brea*-- 7,a7 to ! la/ kn[n mail+ address ( ! individual2 or 7,b7 ?r\gh an appropriate alt]native me?od ( notification t ! head ( ! ag5cy or a designat$ s5ior-level individual ( ! ag5cy selects bas$ on factors det]m9$ by ! ,director4 7b7 ,cont5ts ( notice ,ea* notice ( a brea* provid$ to an individual "u subsection 7a77#b7 %all include-- 7#a7 a brief description ( ! rationale = ! det]m9ation t notice %\ld be provid$ "u subsection 7a72 7#b7 if possible1 a description ( ! types ( p]sonally id5tifiable in=mation affect$ by ! brea*2 7#c7 contact in=mation ( ! ag5cy t may be us$ to ask que/ions ( ! ag5cy1 :i*-- 7,a7 %all include an e-mail address or ano!r digital contact me*anism2 & 7,b7 may include a telephone numb] or a website2 7#d7 in=mation on any rem$y be+ (f]$ by ! ag5cy2 7#e7 any applicable educational mat]ials relat+ to :at individuals c d 9 response to a brea* t pot5tially affects _! p]sonally id5tifiable in=mation1 includ+ relevant in=mation to contact ,f$]al law en=cem5t ag5cies & ea* nationwide consum] report+ ag5cy2 & 7#f7 any o!r appropriate in=mation1 z det]m9$ by ! head ( ! ag5cy or e/abli%$ 9 guidance by ! ,director4 7c7 ,delay ( notification 7#a7 ,9 g5]al ,! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 or ! ,secret>y ( ,homel& ,security may delay a notification requir$ "u subsection 7a7 if ! notification w\ld-- 7,a7 imp$e a crim9al inve/igation or a national security activity2 7,b7 reveal s5sitive s\rces & me?ods2 7,c7 cause damage to national security2 or 7,d7 hamp] security rem$iation actions4 7#b7 ,docum5tation 7,a7 ,9 g5]al ,any delay "u p>agraph 7#a7 %all be report$ 9 writ+ to ! ,director1 ! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 ! ,secret>y ( ,homel& ,security1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & ! head ( ! ag5cy & ! inspector g5]al ( ! ag5cy t exp]i5c$ ! brea*4 7,b7 ,cont5ts ,a report requir$ "u subp>agraph 7,a7 %all include a writt5 /atem5t f ! entity t delay$ ! notification expla9+ ! ne$ = ! delay4 7,c7 ,=m ,! report requir$ "u subp>agraph 7,a7 %all be unclassifi$ b may include a classifi$ annex4 7#c7 ,r5ewal ,a delay "u p>agraph 7#a7 %all be = a p]iod ( #fj days & may be r5ew$4 7d7 ,update notification ,if an ag5cy det]m9es !re is a significant *ange 9 ! reasonable basis to conclude t a brea* occurr$1 a significant *ange to ! det]m9ation made "u subsection 7a77#a71 or t x is necess>y to update ! details ( ! in=mation provid$ to impact$ individuals z describ$ 9 subsection 7b71 ! ag5cy %all z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #cj days aft] su* a det]m9ation1 notify ea* individual :o receiv$ a notification pursuant to subsection 7a7 ( ^? *anges4 7e7 ,exemption f notification 7#a7 ,9 g5]al ,! head ( an ag5cy1 9 consultation ) ! inspector g5]al ( ! ag5cy1 may reque/ an exemption f ! ,director f comply+ ) ! notification requirem5ts "u subsection 7a7 if ! in=mation affect$ by ! brea* is det]m9$ by an indep5d5t evaluation to be unreadable1 includ+1 z appropriate1 in/ances 9 :i* ! in=mation is-- 7,a7 encrypt$2 & 7,b7 det]m9$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to be ( suffici5tly l[ risk ( exposure4 7#b7 ,approval ,! ,director %all det]m9e :e!r to grant an exemption reque/$ "u p>agraph 7#a7 9 consultation )-- 7,a7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,b7 ! ,attorney ,g5]al4 7#c7 ,docum5tation ,any exemption grant$ by ! ,director "u p>agraph 7#a7 %all be report$ 9 writ+ to ! head ( ! ag5cy & ! inspector g5]al ( ! ag5cy t exp]i5c$ ! brea* & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7f7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ,director f issu+ guidance relat+ to notifications or ! head ( an ag5cy f notify+ individuals pot5tially affect$ by brea*es t are n det]m9$ to be major incid5ts2 or 7#b7 ! ,director f issu+ guidance relat+ to notifications ( major incid5ts or ! head ( an ag5cy f provid+ m in=mation ?an describ$ 9 subsection 7b7 :5 notify+ individuals pot5tially affect$ by brea*es4 #ceic4 ,congressional & ,executive ,bran* reports 7a7 ,initial report 7#a7 ,9 g5]al ,n lat] ?an #gb h\rs aft] an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy impact$ by ! major incid5t %all submit to ! appropriate report+ entities a writt5 report &1 to ! ext5t practicable1 provide a brief+ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 & ! appropriate au?orization & appropriations committees ( ,congress1 tak+ into acc\nt-- 7,a7 ! in=mation kn[n at ! "t ( ! report2 7,b7 ! s5sitivity ( ! details associat$ ) ! major incid5t2 & 7,c7 ! classification level ( ! in=mation conta9$ 9 ! report4 7#b7 ,cont5ts ,a report requir$ "u p>agraph 7#a7 %all include1 9 a mann] t excludes or o!rwise reasonably protects p]sonally id5tifiable in=mation & to ! ext5t p]mitt$ by applicable law1 includ+ privacy & /ati/ical laws-- 7,a7 a summ>y ( ! in=mation available ab\t ! major incid5t1 includ+ h[ ! major incid5t occurr$1 in=mation indicat+ t ! major incid5t may be a brea*1 & in=mation relat+ to ! major incid5t z a brea*1 bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! report2 7,b7 if applicable1 a description & any associat$ docum5tation ( any circum/ances necessitat+ a delay 9 or exemption to notification to individuals pot5tially affect$ by ! major incid5t "u subsection 7c7 or 7e7 ( section #ceib2 & 7,c7 if applicable1 an assessm5t ( ! impacts to ! ag5cy1 ! ,f$]al ,gov]nm5t1 or ! security ( ! ,unit$ ,/ates1 bas$ on in=mation available to ag5cy (ficials on ! date on :i* ! ag5cy submits ! report4 7b7 ,supplem5tal report ,)9 a reasonable am\nt ( "t1 b n lat] ?an #cj days aft] ! date on :i* an ag5cy submits a writt5 report "u subsection 7a71 ! head ( ! ag5cy %all provide to ! appropriate report+ entities writt5 updates on ! major incid5t &1 to ! ext5t practicable1 provide a brief+ to ! congressional committees describ$ 9 subsection 7a77#a71 includ+ summ>ies (-- 7#a7 vuln]abilities1 means by :i* ! major incid5t occurr$1 & impacts to ! ag5cy relat+ to ! major incid5t2 7#b7 any risk assessm5t & subsequ5t risk-bas$ security implem5tation ( ! affect$ in=mation sy/em be=e ! date on :i* ! major incid5t occurr$2 7#c7 ! /atus ( compliance ( ! affect$ in=mation sy/em ) applicable security requirem5ts at ! "t ( ! major incid5t2 7#d7 an e/imate ( ! numb] ( individuals pot5tially affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 7#e7 an assessm5t ( ! risk ( h>m to individuals pot5tially affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 7#f7 an update to ! assessm5t ( ! risk to ag5cy op]ations1 or to impacts on o!r ag5cy or non-,f$]al entity op]ations1 affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 & 7#g7 ! detection1 response1 & rem$iation actions ( ! ag5cy1 includ+ any support provid$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceid7;d7 & /atus updates on ! notification process describ$ 9 section #ceib7;a71 includ+ any delay or exemption describ$ 9 subsection 7c7 or 7e71 respectively1 ( section #ceib1 if applicable4 7c7 ,update report ,if ! ag5cy det]m9es t !re is any significant *ange 9 ! und]/&+ ( ! ag5cy ( ! scope1 scale1 or consequ5ce ( a major incid5t = :i* an ag5cy submitt$ a writt5 report "u subsection 7a71 ! ag5cy %all provide an updat$ report to ! appropriate report+ entities t includes in=mation relat+ to ! *ange 9 und]/&+4 7d7 ,annual report ,ea* ag5cy %all submit z "p ( ! annual report requir$ "u section #ceed7;c77#a7 ( ?is title a description ( ea* major incid5t t occurr$ dur+ ! #a-ye> p]iod prec$+ ! date on :i* ! report is submitt$4 7e7 ,delay & exemption report 7#a7 ,9 g5]al ,! ,director %all submit to ! appropriate notification entities an annual report on all notification delays & exemptions grant$ pursuant to subsections 7c7 & 7d7 ( section #ceib4 7#b7 ,compon5t ( o!r report ,! ,director may submit ! report requir$ "u p>agraph 7#a7 z a compon5t ( ! annual report submitt$ "u section #ceig7;b74 7f7 ,report deliv]y ,any writt5 report requir$ to be submitt$ "u ?is section may be submitt$ 9 a pap] or electronic =mat4 7g7 ,?reat brief+ 7#a7 ,9 g5]al ,n lat] ?an #g days aft] ! date on :i* an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy1 jo9tly ) ! ,national ,cyb] ,director & any o!r ,f$]al entity det]m9$ appropriate by ! ,national ,cyb] ,director1 %all provide a brief+ to ! congressional committees describ$ 9 subsection 7a77#a7 on ! ?reat caus+ ! major incid5t4 7#b7 ,compon5ts ,! brief+ requir$ "u p>agraph 7#a7-- 7,a7 %all1 to ! greate/ ext5t practicable1 include an unclassifi$ compon5t2 & 7,b7 may include a classifi$ compon5t4 7h7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ability ( an ag5cy to provide additional reports or brief+s to ,congress2 or 7#b7 ,congress f reque/+ additional in=mation f ag5cies ?r\gh reports1 brief+s1 or o!r means4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response 7a7 ,9 g5]al 7#a7 ,incid5t report+ ,! head ( ea* ag5cy %all provide any in=mation relat+ to any incid5t1 :e!r ! in=mation is obta9$ by ! ,f$]al ,gov]nm5t directly or indirectly1 to ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,(fice ( ,managem5t & ,budget4 7#b7 ,cont5ts ,a provision ( in=mation relat+ to an incid5t made by ! head ( an ag5cy "u p>agraph 7#a7 %all-- 7,a7 include detail$ in=mation ab\t ! safegu>ds t 7 9 place :5 ! incid5t occurr$2 7,b7 :e!r ! ag5cy implem5t$ ! safegu>ds describ$ 9 subp>agraph 7,a7 correctly2 7,c7 9 ord] to protect aga9/ a simil> incid5t1 id5tify-- 7i7 h[ ! safegu>ds describ$ 9 subp>agraph 7,a7 %\ld be implem5t$ diff]5tly2 & 7ii7 additional necess>y safegu>ds2 & 7,d7 include in=mation to aid 9 incid5t response1 su* z-- 7i7 a description ( ! affect$ sy/ems or networks2 7ii7 ! e/imat$ dates ( :5 ! incid5t occurr$2 & 7iii7 in=mation t c\ld reasonably help id5tify ! p>ty t conduct$ ! incid5t4 7#c7 ,in=mation %>+ ,to ! greate/ ext5t practicable1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all %>e in=mation relat+ to an incid5t ) any ag5cies t may be impact$ by ! incid5t4 7#d7 ,national security sy/ems ,ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all %>e in=mation ab\t incid5ts ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to ! ext5t consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t4 7b7 ,compliance ,! in=mation provid$ "u subsection 7a7 %all take into acc\nt ! level ( classification ( ! in=mation & any in=mation %>+ limitations & protections1 su* z limitations & protections relat+ to law en=cem5t1 national security1 privacy1 /ati/ical confid5tiality1 or o!r factors det]m9$ by ! ,director 7c7 ,incid5t response ,ea* ag5cy t has a reasonable basis to conclude t a major incid5t occurr$ involv+ ,f$]al in=mation 9 electronic m$ium or =m1 z def9$ by ! ,director & n involv+ a national security sy/em1 reg>dless ( delays f notification grant$ = a major incid5t1 %all coord9ate ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy reg>d+-- 7#a7 incid5t response & recov]y2 & 7#b7 recomm5dations = mitigat+ future incid5ts4 #ceie4 ,responsibilities ( contractors & aw>dees 7a7 ,notification 7#a7 ,9 g5]al ,unless o!rwise specifi$ 9 a contract1 grant1 or coop]ative agreem5t1 any contractor or aw>dee ( an ag5cy %all report to ! ag5cy )9 ! same am\nt ( "t su* ag5cy is requir$ to report an incid5t to ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 if ! contractor or aw>dee has a reasonable basis to conclude t-- 7,a7 an incid5t or brea* has occurr$ ) respect to ,f$]al in=mation collect$1 us$1 or ma9ta9$ by ! contractor or aw>dee 9 connection ) ! contract1 grant1 or coop]ative agreem5t ( ! contractor or aw>dee2 7,b7 an incid5t or brea* has occurr$ ) respect to a ,f$]al in=mation sy/em us$ or op]at$ by ! contractor or aw>dee 9 connection ) ! contract1 grant1 or coop]ative agreem5t ( ! contractor or aw>dee2 or 7,c7 ! contractor or aw>dee has receiv$ in=mation f ! ag5cy t ! contractor or aw>dee is n au?oriz$ to receive 9 connection ) ! contract1 grant1 or coop]ative agreem5t ( ! contractor or aw>dee4 7#b7 ,proc$ures 7,a7 ,major incid5t ,foll[+ a report ( a brea* or major incid5t by a contractor or aw>dee "u p>agraph 7#a71 ! ag5cy1 9 consultation ) ! contractor or aw>dee1 %all c>ry out ! requirem5ts "u sections #ceib1 #ceic1 & #ceid ) respect to ! major incid5t4 7,b7 ,incid5t ,foll[+ a report ( an incid5t by a contractor or aw>dee "u p>agraph 7#a71 an ag5cy1 9 consultation ) ! contractor or aw>dee1 %all c>ry out ! requirem5ts "u section #ceid ) respect to ! incid5t4 7b7 ,effective date ,?is section %all apply on & aft] ! date t is #a ye> aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba4 #ceif4 ,tra9+ 7a7 ,cov]$ individual def9$ ,9 ?is section1 ! t]m cov]$ individual means an individual :o obta9s access to ,f$]al in=mation or ,f$]al in=mation sy/ems because ( ! /atus ( ! individual z an employee1 contractor1 aw>dee1 volunte]1 or int]n ( an ag5cy4 7b7 ,requirem5t ,! head ( ea* ag5cy %all develop tra9+ = cov]$ individuals on h[ to id5tify & respond to an incid5t1 includ+-- 7#a7 ! int]nal process ( ! ag5cy = report+ an incid5t2 & 7#b7 ! obligation ( a cov]$ individual to report to ! ag5cy a confirm$ major incid5t & any suspect$ incid5t involv+ in=mation 9 any m$ium or =m1 includ+ pap]1 oral1 & electronic4 7c7 ,inclusion 9 annual tra9+ ,! tra9+ develop$ "u subsection 7b7 may be includ$ z "p ( an annual privacy or security aw>5ess tra9+ ( an ag5cy4 #ceig4 ,analysis & report on ,f$]al incid5ts 7a7 ,analysis ( f$]al incid5ts 7#a7 ,quantitative & qualitative analyses ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop1 9 consultation ) ! ,director & ! ,national ,cyb] ,director1 & p]=m cont9u\s monitor+ & quantitative & qualitative analyses ( incid5ts at ag5cies1 includ+ major incid5ts1 includ+-- 7,a7 ! causes ( incid5ts1 includ+-- 7i7 attack] tactics1 te*niques1 & proc$ures2 & 7ii7 sy/em vuln]abilities1 includ+ z]o days1 unpat*$ sy/ems1 & in=mation sy/em misconfigurations2 7,b7 ! scope & scale ( incid5ts at ag5cies2 7,c7 cross ,f$]al ,gov]nm5t root causes ( incid5ts at ag5cies2 7,d7 ag5cy incid5t response1 recov]y1 & rem$iation actions & ! effectiv5ess ( ^? actions1 z applicable2 & 7,e7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts4 7#b7 ,automat$ analysis ,! analyses develop$ "u p>agraph 7#a7 %all1 to ! greate/ ext5t practicable1 use ma*9e readable data1 automation1 & ma*9e le>n+ processes4 7#c7 ,%>+ ( data & analysis 7,a7 ,9 g5]al ,! ,director %all %>e on an ongo+ basis ! analyses requir$ "u ?is subsection ) ag5cies & ! ,national ,cyb] ,director to-- 7i7 improve ! und]/&+ ( cyb]security risk ( ag5cies2 & 7ii7 support ! cyb]security improvem5t ef=ts ( ag5cies4 7,b7 ,=mat ,9 c>ry+ out subp>agraph 7,a71 ! ,director %all %>e ! analyses-- 7i7 9 human-readable writt5 products2 & 7ii7 to ! greate/ ext5t practicable1 9 ma*9e-readable =mats 9 ord] to enable automat$ intake & use by ag5cies4 7b7 ,annual report on ,f$]al incid5ts ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is section1 & n less frequ5tly ?an annually !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director & o!r ,f$]al ag5cies z appropriate1 %all submit to ! appropriate notification entities a report t includes-- 7#a7 a summ>y ( causes ( incid5ts f across ! ,f$]al ,gov]nm5t t categorizes ^? incid5ts z incid5ts or major incid5ts2 7#b7 ! quantitative & qualitative analyses ( incid5ts develop$ "u subsection 7a77#a71 includ+ specific analysis ( brea*es1 on an ag5cy-by-ag5cy basis & compreh5sively across ! ,f$]al ,gov]nm5t2 & 7#c7 an annex = ea* ag5cy t includes-- 7,a7 a description ( ea* major incid5t2 & 7,b7 ! total numb] ( compromises ( ! ag5cy4 7c7 ,publication ,a v]sion ( ea* report submitt$ "u subsection 7b7 %all be made publicly available on ! website ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy dur+ ! ye> 9 :i* ! report is submitt$4 7d7 ,in=mation provid$ by ag5cies 7#a7 ,9 g5]al ,! analysis requir$ "u subsection 7a7 & ea* report submitt$ "u subsection 7b7 %all use in=mation provid$ by ag5cies "u section #ceid7;a74 7#b7 ,noncompliance reports 7,a7 ,9 g5]al ,subject to subp>agraph 7,b71 dur+ any ye> dur+ :i* ! head ( an ag5cy does n provide data = an incid5t to ! ,cyb]security & ,infra/ructure ,security ,ag5cy 9 accordance ) section #ceid7;a71 ! head ( ! ag5cy1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,director1 %all submit to ! appropriate report+ entities a report t includes-- 7i7 data = ! incid5t2 & 7ii7 ! in=mation describ$ 9 subsection 7b7 ) respect to ! ag5cy4 7,b7 ,exception = national security sy/ems ,! head ( an ag5cy t owns or ex]cises control ( a national security sy/em %all n include data = an incid5t t occurs on a national security sy/em 9 any report submitt$ "u subp>agraph 7,a74 7#c7 ,national security sy/em reports 7,a7 ,9 g5]al ,annually1 ! head ( an ag5cy t op]ates or ex]cises control ( a national security sy/em %all submit a report t includes ! in=mation describ$ 9 subsection 7b7 ) respect to ! ag5cy to ! ext5t t ! submission is consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t to-- 7i7 ! ! majority & m9ority lead]s ( ! ,s5ate1 7ii7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7iii7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7iv7 ! ,select ,committee on ,intellig5ce ( ! ,s5ate2 7v7 ! ,committee on ,arm$ ,s]vices ( ! ,s5ate2 7vi7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 7vii7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7viii7 ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives2 & 7ix7 ! ,committee on ,arm$ ,s]vices ( ! ,h\se ( ,repres5tatives4 7,b7 ,classifi$ =m ,a report requir$ "u subp>agraph 7,a7 may be submitt$ 9 a classifi$ =m4 7e7 ,requirem5t = compil+ in=mation ,9 publi%+ ! public report requir$ "u subsection 7c71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all suffici5tly compile in=mation su* t no specific incid5t ( an ag5cy c be id5tifi$1 except ) ! concurr5ce ( ! ,director ( ! ,(fice ( ,managem5t & ,budget & 9 consultation ) ! impact$ ag5cy4 #ceih4 ,major incid5t def9ition 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 %all develop & promulgate guidance on ! def9ition ( ! t]m major incid5t = ! purposes ( sub*apt] ,,ii & ?is sub*apt]4 7b7 ,requirem5ts ,) respect to ! guidance issu$ "u subsection 7a71 ! def9ition ( ! t]m major incid5t %all-- 7#a7 include1 ) respect to any in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy or an in=mation sy/em us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or ano!r organization on behalf ( an ag5cy-- 7,a7 any incid5t ! head ( ! ag5cy det]m9es is likely to h an impact on-- 7i7 ! national security1 homel& security1 or economic security ( ! ,unit$ ,/ates2 or 7ii7 ! civil lib]ties or public heal? & safety ( ! p ( ! ,unit$ ,/ates2 7,b7 any incid5t ! head ( ! ag5cy det]m9es likely to result 9 an inability = ! ag5cy1 a compon5t ( ! ag5cy1 or ! ,f$]al ,gov]nm5t1 to provide #a or m critical s]vices2 7,c7 any incid5t t ! head ( an ag5cy1 9 consultation ) a s5ior privacy (fic] ( ! ag5cy1 det]m9es is likely to h a significant privacy impact on #a or m individual2 7,d7 any incid5t t ! head ( ! ag5cy1 9 consultation ) a s5ior privacy (ficial ( ! ag5cy1 det]m9es is likely to h a sub/antial privacy impact on a significant numb] ( individuals2 7,e7 any incid5t ! head ( ! ag5cy det]m9es impacts ! op]ations ( a high value asset own$ or op]at$ by ! ag5cy2 7,f7 any incid5t involv+ ! exposure ( s5sitive ag5cy in=mation to a =eign entity1 su* z ! communications ( ! head ( ! ag5cy1 ! head ( a compon5t ( ! ag5cy1 or ! direct reports ( ! head ( ! ag5cy or ! head ( a compon5t ( ! ag5cy2 & 7,g7 any o!r type ( incid5t det]m9$ appropriate by ! ,director2 7#b7 /ipulate t ! ,national ,cyb] ,director %all decl>e a major incid5t at ea* ag5cy impact$ by an incid5t if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es t an incid5t-- 7,a7 occurs at n less ?an #b ag5cies2 & 7,b7 is enabl$ by-- 7i7 a common te*nical root cause1 su* z a supply *a9 compromise1 a common s(tw>e or h>dw>e vuln]ability2 or 7ii7 ! relat$ activities ( a common ?reat actor2 & 7#c7 /ipulate t1 9 det]m9+ :e!r an incid5t con/itutes a major incid5t because t incid5t-- 7,a7 is any incid5t describ$ 9 p>agraph 7#a71 ! head ( an ag5cy %all consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,b7 is an incid5t describ$ 9 p>agraph 7#a77;,a71 ! head ( ! ag5cy %all consult ) ! ,national ,cyb] ,director2 & 7,c7 is an incid5t describ$ 9 subp>agraph 7,c7 or 7,d7 ( p>agraph 7#a71 ! head ( ! ag5cy %all consult )-- 7i7 ! ,privacy & ,civil ,lib]ties ,ov]sight ,bo>d2 & 7ii7 ! ,executive ,director ( ! ,f$]al ,trade ,commission4 7c7 ,significant numb] ( individuals ,9 det]m9+ :at con/itutes a significant numb] ( individuals "u subsection 7b77#a77;,d71 ! ,director-- 7#a7 may det]m9e a ?re%old = a m9imum numb] ( individuals t con/itutes a significant am\nt2 & 7#b7 may n det]m9e a ?re%old describ$ 9 p>agraph 7#a7 t exce$s #e1jjj individuals4 7d7 ,evaluation & updates ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives an evaluation1 :i* %all include-- 7#a7 an update1 if necess>y1 to ! guidance issu$ "u subsection 7a72 7#b7 ! def9ition ( ! t]m major incid5t includ$ 9 ! guidance issu$ "u subsection 7a72 & 7#c7 an explanation (1 & ! analysis t l$ to1 ! def9ition describ$ 9 p>agraph 7#b74 4 7#b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,sub*apt] ,,iv--,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions4 #ceib4 ,notification ( brea*4 #ceic4 ,congressional & ,executive ,bran* reports4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response4 #ceie4 ,responsibilities ( contractors & aw>dees4 #ceif4 ,tra9+4 #ceig4 ,analysis & report on ,f$]al incid5ts4 #ceih4 ,major incid5t def9ition4 4 #ajb4 ,am5dm5ts to subtitle ,,iii ( title #dj 7a7 ,in=mation ,te*nology ,mod]nization ,c5t]s ( ,excell5ce ,program ,act ,section #b7;c77#d77;,a77ii7 ( ! ,in=mation ,te*nology ,mod]nization ,c5t]s ( ,excell5ce ,program ,act 7#dj ,u4,s4,c4 #aacja note7 is am5d$ by /rik+ ! p]iod at ! end & ins]t+ 1 :i* %all be provid$ 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy44 7b7 ,mod]niz+ ,gov]nm5t ,te*nology ,subtitle ,g ( title ,x ( ,division ,a ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjah 7#dj ,u4,s4,c4 #aacja note7 is am5d$-- 7#a7 9 section #ajgg7;b7-- 7,a7 9 p>agraph 7#e77;,a71 by ins]t+ improv+ ! cyb]security ( sy/ems & be=e co/ sav+s activities2 & 7,b7 9 p>agraph 7#g7-- 7i7 9 ! p>agraph head+1 by /rik+ cio & ins]t+ ,,cio2 7ii7 by /rik+ ,9 evaluat+ projects & ins]t+ ! foll[+3 7,a7 ,consid]ation ( guidance ,9 evaluat+ projects 2 7iii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ "u section #ajid7;b77#a7 & ins]t+ by ! ,director2 & 7iv7 by add+ at ! end ! foll[+3 7,b7 ,consultation ,9 us+ funds "u p>agraph 7#c77;,a71 ! ,*ief ,in=mation ,(fic] ( ! cov]$ ag5cy %all consult ) ! necess>y /akehold]s to ensure ! project appropriately addresses cyb]security risks1 includ+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 z appropriate4 2 & 7#b7 9 section #ajgh-- 7,a7 by /rik+ subsection 7a7 & ins]t+ ! foll[+3 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #eea ( title #e1 ,unit$ ,/ates ,code4 7#b7 ,high value asset ,! t]m high value asset has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 2 7,b7 9 subsection 7b71 by add+ at ! end ! foll[+3 7#h7 ,proposal evaluation ,! ,director %all-- 7,a7 give consid]ation = ! use ( am\nts 9 ! ,fund to improve ! security ( high value assets2 & 7,b7 require t any proposal = ! use ( am\nts 9 ! ,fund includes a cyb]security plan1 includ+ a supply *a9 risk managem5t plan1 to be review$ by ! memb] ( ! ,te*nology ,mod]nization ,bo>d describ$ 9 subsection 7c77#e77;,c74 2 & 7,c7 9 subsection 7c7-- 7i7 9 p>agraph 7#b77;,a77i71 by ins]t+ 1 includ+ a consid]ation ( ! impact on high value assets aft] op]ational risks2 7ii7 9 p>agraph 7#e7-- 7,i7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7,,ii7 9 subp>agraph 7,b71 by /rik+ ! p]iod at ! end & ins]t+ &2 & 7,,iii7 by add+ at ! end ! foll[+3 7,c7 a s5ior (ficial f ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 appo9t$ by ! ,director4 2 & 7iii7 9 p>agraph 7#f77;,a71 by /rik+ %all be-- & all t foll[s ?r\gh #d employees & ins]t+ %all be #d employees4 7c7 ,sub*apt] ,i ,sub*apt] ,i ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacjb-- 7,a7 9 subsection 7b71 by /rik+ use1 security1 & disposal ( & ins]t+ use1 & disposal (1 &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 promote & improve ! security (12 7,b7 9 subsection 7c7-- 7i7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 by /rik+ includ+ data & ins]t+ :i* %all-- 7i7 include data 2 7bb7 9 clause 7i71 z s designat$1 by /rik+ 1 & p]=mance & ins]t+ security1 & p]=mance2 &2 & 7cc7 by add+ at ! end ! foll[+3 7ii7 specifically d5ote cyb]security fund+ "u ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g7 ( title #dd4 2 & 7,,ii7 9 subp>agraph 7,b71 add+ at ! end ! foll[+3 7iii7 ,! ,director %all provide to ! ,national ,cyb] ,director any cyb]security fund+ in=mation describ$ 9 subp>agraph 7,a77ii7 t is provid$ to ! ,director "u clause 7ii7 ( ?is subp>agraph4 2 & 7ii7 9 p>agraph 7#d77;,b71 9 ! matt] prec$+ clause 7i71 by ins]t+ n lat] ?an #cj days aft] ! date on :i* ! review "u subp>agraph 7,a7 is complet$1 be=e ! ,adm9i/rator2 7,c7 9 subsection 7f7-- 7i7 by /rik+ heads ( executive ag5cies to develop & ins]t+ 8heads ( executive ag5cies to-- 7#a7 develop 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7#b7 consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = ! developm5t & use ( supply *a9 security be/ practices4 2 & 7,d7 9 subsection 7h71 by ins]t+ 1 includ+ cyb]security p]=mances1 aft] ! p]=mances2 & 7#b7 9 section #aacjc7;b7-- 7,a7 9 p>agraph 7#b77;,b7-- 7i7 9 clause 7i71 by /rik+ or at ! end2 7ii7 9 clause 7ii71 by add+ or at ! end2 & 7iii7 by add+ at ! end ! foll[+3 7iii7 :e!r ! function %\ld be p]=m$ by a %>$ s]vice (f]$ by ano!r executive ag5cy2 2 & 7,b7 9 p>agraph 7#e77;,b77i71 by ins]t+ 1 :ile tak+ into acc\nt ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g7 ( title #dd aft] title #ca4 7d7 ,sub*apt] ,,ii ,sub*apt] ,,ii ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacab7;a71 by ins]t+ 1 includ+ security risks aft] manag+ ! risks2 7#b7 9 section #aacac7a71 by /rik+ effici5cy & effectiv5ess & ins]t+ effici5cy1 security1 & effectiv5ess2 7#c7 9 section #aacae1 by add+ at ! end ! foll[+3 7d7 ,compon5t ag5cy *ief in=mation (fic]s ,! ,*ief ,in=mation ,(fic] or an equival5t (ficial ( a compon5t ag5cy %all report to-- 7#a7 ! ,*ief ,in=mation ,(fic] designat$ "u section #cejf7;a77#b7 ( title #dd or an equival5t (ficial ( ! ag5cy ( :i* ! compon5t ag5cy is a compon5t2 & 7#b7 ! head ( ! compon5t ag5cy4 2 7#d7 9 section #aacag1 by ins]t+ security1 be=e or s*$ule2 & 7#e7 9 section #aacai7;b77#a71 9 ! p>agraph head+1 by /rik+ ,,cios & ins]t+ ,*ief ,in=mation ,(fic]s4 7e7 ,sub*apt] ,,iii ,section #aacca ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 subsection 7a71 by /rik+ section #cecb7;b77#a7 & ins]t+ section #ceeb7;b72 7#b7 9 subsection 7b77#a77;,a7-- 7,a7 by /rik+ 9 consultation & ins]t+ 9 coord9ation2 & 7,b7 by /rik+ ! ,secret>y ( ,homel& ,security & ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7#c7 by /rik+ subsection 7c7 & ins]t+ ! foll[+3 7c7 ,application ( m /r+5t /&>ds 7#a7 ,9 g5]al ,! head ( an ag5cy %all-- 7,a7 evaluate1 9 consultation ) ! s5ior ag5cy in=mation security (fic]s1 ! ne$ to employ /&>ds = co/-effective1 risk-bas$ in=mation security = all sy/ems1 op]ations1 & assets )9 or "u ! sup]vision ( ! ag5cy t are m /r+5t ?an ! /&>ds promulgat$ by ! ,director "u ?is section1 if su* /&>ds conta91 at a m9imum1 ! provisions ( ^? applicable /&>ds made compulsory & b9d+ by ! ,director2 & 7,b7 to ! greate/ ext5t practicable & if ! head ( ! ag5cy det]m9es t ! /&>ds describ$ 9 subp>agraph 7,a7 are necess>y1 employ ^? /&>ds4 7#b7 ,evaluation ( m /r+5t /&>ds ,9 evaluat+ ! ne$ to employ m /r+5t /&>ds "u p>agraph 7#a71 ! head ( an ag5cy %all consid] available risk in=mation1 su* z-- 7,a7 ! /atus ( cyb]security rem$ial actions ( ! ag5cy2 7,b7 any vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7,c7 incid5t in=mation ( ! ag5cy2 7,d7 in=mation f-- 7i7 p5etration te/+ p]=m$ "u section #ceei;,a ( title #dd2 & 7ii7 in=mation f ! vuln]ability disclosure program e/abli%$ "u section #ceei;,b ( title #dd2 7,e7 ag5cy ?reat hunt+ results "u section #bje ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba2 7,f7 ,f$]al & non-,f$]al ?reat intellig5ce2 7,g7 data on compliance ) /&>ds issu$ "u ?is section2 7,h7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a7 ( title #dd2 & 7,i7 any o!r in=mation det]m9$ relevant by ! head ( ! ag5cy4 2 7#d7 9 subsection 7d77#b7-- 7,a7 9 ! p>agraph head+1 by /rik+ ,notice & comm5t & ins]t+ ,consultation1 notice1 & comm5t2 7,b7 by ins]t+ promulgate1 be=e significantly modify2 & 7,c7 by /rik+ %all be made aft] ! public is giv5 an opportunity to comm5t on ! ,director's propos$ decision4 & ins]t+ 8%all be made-- 7,a7 = a decision to significantly modify or n promulgate su* a propos$ /&>d1 aft] ! public is giv5 an opportunity to comm5t on ! ,director's propos$ decision2 7,b7 9 consultation ) ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy2 7,c7 consid]+ ! ,f$]al risk assessm5ts p]=m$ "u section #ceec7;i7 ( title #dd2 & 7,d7 consid]+ ! ext5t to :i* ! propos$ /&>d r$uces risk relative to ! co/ ( implem5tation ( ! /&>d4 2 & 7#e7 by add+ at ! end ! foll[+3 7e7 ,review ( (fice ( managem5t & budget guidance & policy 7#a7 ,conduct ( review 7,a7 ,9 g5]al ,n less frequ5tly ?an once e #c ye>s1 ! ,director ( ! ,(fice ( ,managem5t & ,budget1 9 consultation ) ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy %all review ! efficacy ( ! guidance & policy promulgat$ by ! ,director 9 r$uc+ cyb]security risks1 includ+ an assessm5t ( ! requirem5ts = ag5cies to report in=mation to ! ,director1 & det]m9e :e!r any *anges to t guidance or policy is appropriate4 7,b7 ,f$]al risk assessm5ts ,9 conduct+ ! review describ$ 9 subp>agraph 7,a71 ! ,director %all consid] ! ,f$]al risk assessm5ts p]=m$ "u section #ceec7;i7 ( title #dd4 7#b7 ,updat$ guidance ,n lat] ?an #ij days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all issue updat$ guidance or policy to ag5cies det]m9$ appropriate by ! ,director1 bas$ on ! results ( ! review4 7#c7 ,public report ,n lat] ?an #cj days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director ( ! ,(fice ( ,managem5t & ,budget %all make publicly available a report t includes-- 7,a7 an ov]view ( ! guidance & policy promulgat$ "u ?is section t is curr5tly 9 effect2 7,b7 ! cyb]security risk mitigation1 or o!r cyb]security b5efit1 (f]$ by ea* guidance or policy docum5t describ$ 9 subp>agraph 7,a72 & 7,c7 a summ>y ( ! guidance or policy to :i* *anges 7 det]m9$ appropriate dur+ ! review & :at ! *anges are anticipat$ to include4 7#d7 ,congressional brief+ ,n lat] ?an #cj days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! review4 7f7 ,automat$ /&>d implem5tation v]ification ,:5 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology issues a propos$ /&>d pursuant to p>agraphs 7#b7 & 7#c7 ( section #bj7;a7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all consid] develop+ &1 if appropriate & practical1 develop1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 specifications to enable ! automat$ v]ification ( ! implem5tation ( ! controls )9 ! /&>d4 4 #ajc4 ,actions to enhance ,f$]al incid5t response 7a7 ,responsibilities ( ! cyb]security & infra/ructure security ag5cy 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 develop a plan = ! developm5t ( ! analysis requir$ "u section #ceig7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 & ! report requir$ "u subsection 7b7 ( t section t includes-- 7i7 a description ( any *all5ges ! ,director anticipates enc\nt]+2 & 7ii7 ! use ( automation & ma*9e-readable =mats = collect+1 compil+1 monitor+1 & analyz+ data2 & 7,b7 provide to ! appropriate congressional committees a brief+ on ! plan develop$ "u subp>agraph 7,a74 7#b7 ,brief+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! appropriate congressional committees a brief+ on-- 7,a7 ! execution ( ! plan requir$ "u p>agraph 7#a77;,a72 & 7,b7 ! developm5t ( ! report requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7b7 ,responsibilities ( ! director ( ! (fice ( managem5t & budget 7#a7 ,,fisma ,section #b ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad 7#dd ,u4,s4,c4 #ceed note7 is am5d$-- 7,a7 by /rik+ subsection 7b72 & 7,b7 by r$esignat+ subsections 7c7 ?r\gh 7f7 z subsections 7b7 ?r\gh 7e71 respectively4 7#b7 ,incid5t data %>+ 7,a7 ,9 g5]al ,! ,director %all develop guidance1 to be updat$ n less frequ5tly ?an once e #b ye>s1 on ! cont5t1 timel9ess1 & =mat ( ! in=mation provid$ by ag5cies "u section #ceid7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,requirem5ts ,! guidance develop$ "u subp>agraph 7,a7 %all-- 7i7 prioritize ! availability ( data necess>y to und]/& & analyze-- 7,i7 ! causes ( incid5ts2 7,,ii7 ! scope & scale ( incid5ts )9 ! environm5ts & sy/ems ( an ag5cy2 7,,iii7 a root cause analysis ( incid5ts t-- 7aa7 are common across ! ,f$]al ,gov]nm5t2 or 7bb7 h a ,gov]nm5t-wide impact2 7,,iv7 ag5cy response1 recov]y1 & rem$iation actions & ! effectiv5ess ( ^? actions2 & 7,v7 ! impact ( incid5ts2 7ii7 enable ! effici5t developm5t (-- 7,i7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,,ii7 ! report on ,f$]al incid5ts requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act2 7iii7 include requirem5ts = ! timel9ess ( data production2 & 7iv7 include requirem5ts = us+ automation & ma*9e-readable data = data %>+ & availability4 7#c7 ,guidance on respond+ to in=mation reque/s ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all develop guidance = ag5cies to implem5t ! requirem5t "u section #ceid7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act1 to provide in=mation to o!r ag5cies exp]i5c+ incid5ts4 7#d7 ,/&>d guidance & templates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop guidance & templates1 to be review$ &1 if necess>y1 updat$ n less frequ5tly ?an once e #b ye>s1 = use by ,f$]al ag5cies 9 ! activities requir$ "u sections #ceib1 #ceic1 & #ceif ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7#e7 ,contractor & aw>dee guidance 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 ! ,secret>y ( ,def5se1 ! ,adm9i/rator ( ,g5]al ,s]vices1 & ! heads ( o!r ag5cies det]m9$ appropriate by ! ,director1 %all issue guidance to ,f$]al ag5cies on h[ to deconflict1 to ! greate/ ext5t practicable1 exi/+ regulations1 policies1 & proc$ures relat+ to ! responsibilities ( contractors & aw>dees e/abli%$ "u section #ceie ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is ,act4 7,b7 ,exi/+ processes ,to ! greate/ ext5t practicable1 ! guidance issu$ "u subp>agraph 7,a7 %all all[ contractors & aw>dees to use exi/+ processes = notify+ ,f$]al ag5cies ( incid5ts involv+ in=mation ( ! ,f$]al ,gov]nm5t4 7#f7 ,updat$ brief+s ,n less frequ5tly ?an once e #b ye>s1 ! ,director %all provide to ! appropriate congressional committees an update on ! guidance & templates develop$ "u p>agraphs 7#b7 ?r\gh 7#d74 7c7 ,update to ! privacy act ( #aigd ,section #eeb;a7b7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,privacy ,act ( #aigd7 is am5d$-- 7#a7 9 p>agraph 7#aa71 by /rik+ or at ! end2 7#b7 9 p>agraph 7#ab71 by /rik+ ! p]iod at ! end & ins]t+ 2 or2 & 7#c7 by add+ at ! end ! foll[+3 7#ac7 to ano!r ag5cy 9 fur!rance ( a response to an incid5t 7z def9$ 9 section #ceeb ( title #dd7 & pursuant to ! in=mation %>+ requirem5ts 9 section #ceid ( title #dd if ! head ( ! reque/+ ag5cy has made a writt5 reque/ to ! ag5cy t ma9ta9s ! record specify+ ! p>ticul> portion desir$ & ! activity = :i* ! record is s\ght4 4 #ajd4 ,additional guidance to ag5cies on ,,fisma updates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance = ag5cies on-- 7#a7 p]=m+ ! ongo+ & cont9u\s ag5cy sy/em risk assessm5t requir$ "u section #ceed7;a77#a77;,a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act2 7#b7 implem5t+ additional cyb]security proc$ures1 :i* %all include res\rces = %>$ s]vices2 7#c7 e/abli%+ a process = provid+ ! /atus ( ea* rem$ial action "u section #ceed7;b77#g7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act1 to ! ,director & ! ,cyb]security & ,infra/ructure ,security ,ag5cy us+ automation & ma*9e-readable data1 z practicable1 :i* %all include-- 7,a7 specific guidance = ! use ( automation & ma*9e-readable data2 & 7,b7 templates = provid+ ! /atus ( ! rem$ial action2 7#d7 int]pret+ ! def9ition ( high value asset "u section #ceeb ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is ,act2 & 7#e7 a requirem5t to coord9ate ) inspectors g5]al ( ag5cies to ensure consi/5t und]/&+ & application ( ag5cy policies = ! purpose ( evaluations by inspectors g5]al4 #aje4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts 7a7 ,def9itions ,9 ?is section3 7#a7 ,report+ entity ,! t]m report+ entity means private organization or gov]nm5tal unit t is requir$ by /atute or regulation to submit s5sitive in=mation to an ag5cy4 7#b7 ,s5sitive in=mation ,! t]m s5sitive in=mation has ! mean+ giv5 ! t]m by ! ,director 9 guidance issu$ "u subsection 7b74 7b7 ,guidance on notification ( report+ entities ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue guidance requir+ ! head ( ea* ag5cy to notify a report+ entity ( an incid5t t is likely to sub/antially affect-- 7#a7 ! confid5tiality or integrity ( s5sitive in=mation submitt$ by ! report+ entity to ! ag5cy pursuant to a /atutory or regulatory requirem5t2 or 7#b7 ! ag5cy in=mation sy/em or sy/ems us$ 9 ! transmission or /orage ( ! s5sitive in=mation describ$ 9 p>agraph 7#a74 ,,ii ,improv+ ,f$]al cyb]security #bja4 ,mobile security /&>ds 7a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all-- 7#a7 evaluate mobile application security guidance promulgat$ by ! ,director2 & 7#b7 issue guidance to secure mobile devices1 includ+ = mobile applications1 = e ag5cy4 7b7 ,cont5ts ,! guidance issu$ "u subsection 7a77#b7 %all include-- 7#a7 a requirem5t1 pursuant to section #cejf7;b77#d7 ( title #dd1 ,unit$ ,/ates ,code1 = e ag5cy to ma9ta9 a cont9u\s inv5tory ( e-- 7,a7 mobile device op]at$ by or on behalf ( ! ag5cy2 & 7,b7 vuln]ability id5tifi$ by ! ag5cy associat$ ) a mobile device2 & 7#b7 a requirem5t = e ag5cy to p]=m cont9u\s evaluation ( ! vuln]abilities describ$ 9 p>agraph 7#a77;,b7 & o!r risks associat$ ) ! use ( applications on mobile devices4 7c7 ,in=mation %>+ ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies = %>+ ! inv5tory ( ! ag5cy requir$ "u subsection 7b77#a7 ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable4 7d7 ,brief+ ,n lat] ?an #fj days aft] ! date on :i* ! ,director issues guidance "u subsection 7a77#b71 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all provide to ! appropriate congressional committees a brief+ on ! guidance4 #bjb4 ,data & logg+ ret5tion = incid5t response 7a7 ,recomm5dations ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,attorney ,g5]al1 %all submit to ! ,director recomm5dations on requirem5ts = logg+ ev5ts on ag5cy sy/ems & reta9+ o!r relevant data )9 ! sy/ems & networks ( an ag5cy4 7b7 ,cont5ts ,! recomm5dations provid$ "u subsection 7a7 %all include-- 7#a7 ! types ( logs to be ma9ta9$2 7#b7 ! "t p]iods to reta9 ! logs & o!r relevant data2 7#c7 ! "t p]iods = ag5cies to enable recomm5d$ logg+ & security requirem5ts2 7#d7 h[ to ensure ! confid5tiality1 integrity1 & availability ( logs2 7#e7 requirem5ts to ensure t1 ^u reque/1 9 a mann] t excludes or o!rwise reasonably protects p]sonally id5tifiable in=mation1 & to ! ext5t p]mitt$ by applicable law 7includ+ privacy & /ati/ical laws71 ag5cies provide logs to-- 7,a7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = a cyb]security purpose2 & 7,b7 ! ,f$]al ,bureau ( ,inve/igation to inve/igate pot5tial crim9al activity2 & 7#f7 requirem5ts to ensure t1 subject to compliance ) /ati/ical laws & o!r relevant data protection requirem5ts1 ! highe/ level security op]ations c5t] ( ea* ag5cy has visibility into all ag5cy logs4 7c7 ,guidance ,n lat] ?an #ij days aft] receiv+ ! recomm5dations submitt$ "u subsection 7a71 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,attorney ,g5]al1 %all1 z det]m9$ to be appropriate by ! ,director1 update guidance to ag5cies reg>d+ requirem5ts = logg+1 log ret5tion1 log managem5t1 %>+ ( log data ) o!r appropriate ag5cies1 or any o!r logg+ activity det]m9$ to be appropriate by ! ,director4 #bjc4 ,,cisa ag5cy advisors 7a7 ,9 g5]al ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all assign n less ?an #a cyb]security pr(essional employ$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy to be ! ,cyb]security & ,infra/ructure ,security ,ag5cy advisor to ! s5ior ag5cy in=mation security (fic] ( ea* ag5cy4 7b7 ,qualifications ,ea* advisor assign$ "u subsection 7a7 %all h k (-- 7#a7 cyb]security ?reats fac+ ag5cies1 includ+ any specific ?reats to ! assign$ ag5cy2 7#b7 p]=m+ risk assessm5ts ( ag5cy sy/ems2 & 7#c7 o!r ,f$]al cyb]security initiatives4 7c7 ,duties ,! duties ( ea* advisor assign$ "u subsection 7a7 %all include-- 7#a7 provid+ ongo+ assi/ance & advice1 z reque/$1 to ! ag5cy ,*ief ,in=mation ,(fic]2 7#b7 s]v+ z an incid5t response po9t ( contact betwe5 ! assign$ ag5cy & ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7#c7 famili>iz+ !mselves ) ag5cy sy/ems1 processes1 & proc$ures to bett] facilitate support to ! ag5cy 9 respond+ to incid5ts4 7d7 ,limitation ,an advisor assign$ "u subsection 7a7 %all n be a contractor4 7e7 ,multiple assignm5ts ,"o individual advisor may be assign$ to multiple ag5cy ,*ief ,in=mation ,(fic]s "u subsection 7a74 #bjd4 ,f$]al p5etration te/+ policy 7a7 ,9 g5]al ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+ 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy op]ational plan ,! t]m ag5cy op]ational plan means a plan ( an ag5cy = ! use ( p5etration te/+4 7#b7 ,rules ( engagem5t ,! t]m rules ( engagem5t means a set ( rules e/abli%$ by an ag5cy = ! use ( p5etration te/+4 7b7 ,guidance 7#a7 ,9 g5]al ,! ,director %all issue guidance t-- 7,a7 requires ag5cies to use1 :5 & :]e appropriate1 p5etration te/+ on ag5cy sy/ems2 & 7,b7 requires ag5cies to develop an ag5cy op]ational plan & rules ( engagem5t t meet ! requirem5ts "u subsection 7c74 7#b7 ,p5etration te/+ guidance ,! guidance issu$ "u ?is section %all-- 7,a7 p]mit an ag5cy to use1 = ! purpose ( p]=m+ p5etration te/+-- 7i7 a %>$ s]vice ( ! ag5cy or ano!r ag5cy2 or 7ii7 an ext]nal entity1 su* z a v5dor2 & 7,b7 require ag5cies to provide ! rules ( engagem5t & results ( p5etration te/+ to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 )\t reg>d to ! /atus ( ! entity t p]=ms ! p5etration te/+4 7c7 ,ag5cy plans & rules ( engagem5t ,! ag5cy op]ational plan & rules ( engagem5t ( an ag5cy %all-- 7#a7 require ! ag5cy to-- 7,a7 p]=m p5etration te/+ on ! high value assets ( ! ag5cy2 or 7,b7 coord9ate ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to ensure t p5etration te/+ is be+ p]=m$2 7#b7 e/abli% guidel9es = avoid+1 z a result ( p5etration te/+-- 7,a7 adv]se impacts to ! op]ations ( ! ag5cy2 7,b7 adv]se impacts to op]ational environm5ts & sy/ems ( ! ag5cy2 & 7,c7 inappropriate access to data2 7#c7 require ! results ( p5etration te/+ to include fe$back to improve ! cyb]security ( ! ag5cy2 & 7#d7 include me*anisms = provid+ consi/5tly =matt$1 &1 if applicable1 automat$ & ma*9e-readable1 data to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7d7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 e/abli% a process to assess ! p]=mance ( p5etration te/+ by bo? ,f$]al & non-,f$]al entities t e/abli%es m9imum quality controls = p5etration te/+2 7#b7 develop op]ational guidance = in/itut+ p5etration te/+ programs at ag5cies2 7#c7 develop & ma9ta9 a c5traliz$ capability to (f] p5etration te/+ z a s]vice to ,f$]al & non-,f$]al entities2 & 7#d7 provide guidance to ag5cies on ! be/ use ( p5etration te/+ res\rces4 7e7 ,responsibilities ( ,,omb ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all-- 7#a7 n less frequ5tly ?an annually1 inv5tory all ,f$]al p5etration te/+ assets2 & 7#b7 develop & ma9ta9 a /&>diz$ process = ! use ( p5etration te/+4 7f7 ,prioritization ( p5etration te/+ res\rces 7#a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop a framework = prioritiz+ ,f$]al p5etration te/+ res\rces among ag5cies4 7#b7 ,consid]ations ,9 develop+ ! framework "u ?is subsection1 ! ,director %all consid]-- 7,a7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 7,b7 ! ,f$]al risk assessm5t p]=m$ "u section #ceec7;i72 7,c7 ! analysis ( ,f$]al incid5t data p]=m$ "u section #ceig2 & 7,d7 any o!r in=mation det]m9$ appropriate by ! ,director or ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7g7 ,exception = national security sy/ems ,! guidance issu$ "u subsection 7b7 %all n apply to national security sy/ems4 7h7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director describ$ 9 subsection 7b7 %all be delegat$-- 7#a7 to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#b72 & 7#b7 to ! ,director ( ,national ,intellig5ce 9 ! case ( sy/ems describ$ 9 #ceec7;e77#c74 4 7b7 ,deadl9e = guidance ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue ! guidance requir$ "u section #ceei;,a7b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by subsection 7a74 7c7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+4 4 7d7 ,p5etration te/+ by ! ,secret>y ( ,homel& ,security ,section #ceec7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #aja1 is fur!r am5d$-- 7#a7 9 p>agraph 7#h77;,b71 by /rik+ & at ! end2 7#b7 by r$esignat+ p>agraph 7#i7 z p>agraph 7#aj72 & 7#c7 by ins]t+ aft] p>agraph 7#h7 ! foll[+3 7#i7 p]=m+ p5etration te/+ ) or )\t advance notice to1 or au?orization f1 ag5cies1 to id5tify vuln]abilities )9 ,f$]al in=mation sy/ems2 & 4 #bje4 ,ongo+ ?reat hunt+ program 7a7 ,?reat hunt+ program 7#a7 ,9 g5]al ,n lat] ?an #edj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all e/abli% a program to provide ongo+1 hypo!sis-driv5 ?reat-hunt+ s]vices on ! network ( ea* ag5cy4 7#b7 ,plan ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% ! program requir$ "u p>agraph 7#a7 t describes h[ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy plans to-- 7,a7 det]m9e ! me?od = collect+1 /or+1 access+1 & analyz+ appropriate ag5cy data2 7,b7 provide on-premises support to ag5cies2 7,c7 /aff ?reat hunt+ s]vices2 7,d7 allocate available human & f9ancial res\rces to implem5t ! plan2 & 7,e7 provide input to ! heads ( ag5cies on ! use (-- 7i7 m /r+5t /&>ds "u section #aacca7;c77#a7 ( title #dj1 ,unit$ ,/ates ,code2 & 7ii7 additional cyb]security proc$ures "u section #ceed ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,reports ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! appropriate congressional committees-- 7#a7 n lat] ?an #cj days aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy completes ! plan requir$ "u subsection 7a77#b71 a report on ! plan to provide ?reat hunt+ s]vices to ag5cies2 7#b7 n less ?an #cj days be=e ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices "u ! program "u subsection 7a77#a71 a report provid+ any updates to ! plan develop$ "u subsection 7a77#b72 & 7#c7 n lat] ?an #a ye> aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices to ag5cies o!r ?an ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 a report describ+ lessons le>n$ f provid+ ^? s]vices4 #bjf4 ,codify+ vuln]ability disclosure programs 7a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #ceei;,a1 z add$ by section #bjd ( ?is ,act1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs 7a7 ,def9itions ,9 ?is section3 7#a7 ,report ,! t]m report means a vuln]ability disclosure made to an ag5cy by a report]4 7#b7 ,report] ,! t]m report] means an individual t submits a vuln]ability report pursuant to ! vuln]ability disclosure process ( an ag5cy4 7b7 ,responsibilities ( ,,omb 7#a7 ,limitation on legal action ,! ,director1 9 consultation ) ! ,attorney ,g5]al1 %all issue guidance to ag5cies to n recomm5d or pursue legal action aga9/ a report] or an individual t conducts a security rese>* activity t ! head ( ! ag5cy det]m9es-- 7,a7 repres5ts a good fai? ef=t to foll[ ! vuln]ability disclosure policy ( ! ag5cy develop$ "u subsection 7d77#b72 & 7,b7 is au?oriz$ "u ! vuln]ability disclosure policy ( ! ag5cy develop$ "u subsection 7d77#b74 7#b7 ,%>+ in=mation ) ,,cisa ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 %all issue guidance to ag5cies on %>+ relevant in=mation 9 a consi/5t1 automat$1 & ma*9e readable mann] ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 includ+-- 7,a7 any valid or cr$ible reports ( newly discov]$ or n publicly kn[n vuln]abilities 7includ+ misconfigurations7 on ,f$]al in=mation sy/ems t use comm]cial s(tw>e or s]vices2 7,b7 in=mation relat+ to vuln]ability disclosure1 coord9ation1 or rem$iation activities ( an ag5cy1 p>ticul>ly z ^? activities relate to outside organizations-- 7i7 ) :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy c assi/2 or 7ii7 ab\t :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %\ld "k2 & 7,c7 any o!r in=mation ) respect to :i* ! head ( ! ag5cy det]m9es helpful or necess>y to involve ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#c7 ,ag5cy vuln]ability disclosure policies ,! ,director %all issue guidance to ag5cies on ! requir$ m9imum scope ( ag5cy sy/ems cov]$ by ! vuln]ability disclosure policy ( an ag5cy requir$ "u subsection 7d77#b74 7c7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 provide support to ag5cies ) respect to ! implem5tation ( ! requirem5ts ( ?is section2 7#b7 develop tools1 processes1 & o!r me*anisms det]m9$ appropriate to (f] ag5cies capabilities to implem5t ! requirem5ts ( ?is section2 & 7#c7 ^u a reque/ by an ag5cy1 assi/ ! ag5cy 9 ! disclosure to v5dors ( newly id5tifi$ vuln]abilities 9 v5dor products & s]vices4 7d7 ,responsibilities ( ag5cies 7#a7 ,public in=mation ,! head ( ea* ag5cy %all make publicly available1 ) respect to ea* int]net doma9 "u ! control ( ! ag5cy t is n a national security sy/em-- 7,a7 an appropriate security contact2 & 7,b7 ! compon5t ( ! ag5cy t is responsible = ! int]net accessible s]vices (f]$ at ! doma94 7#b7 ,vuln]ability disclosure policy ,! head ( ea* ag5cy %all develop & make publicly available a vuln]ability disclosure policy = ! ag5cy1 :i* %all-- 7,a7 describe-- 7i7 ! scope ( ! sy/ems ( ! ag5cy includ$ 9 ! vuln]ability disclosure policy2 7ii7 ! type ( in=mation sy/em te/+ t is au?oriz$ by ! ag5cy2 7iii7 ! type ( in=mation sy/em te/+ t is n au?oriz$ by ! ag5cy2 & 7iv7 ! disclosure policy ( ! ag5cy = s5sitive in=mation2 7,b7 ) respect to a report to an ag5cy1 describe-- 7i7 h[ ! report] %\ld submit ! report2 & 7ii7 if ! report is n anonym\s1 :5 ! report] %\ld anticipate an ackn[l$gm5t ( receipt ( ! report by ! ag5cy2 7,c7 include any o!r relevant in=mation2 & 7,d7 be mature 9 scope1 to cov] all ,f$]al in=mation sy/ems us$ or op]at$ by t ag5cy or on behalf ( t ag5cy4 7#c7 ,id5tifi$ vuln]abilities ,! head ( ea* ag5cy %all incorporate any vuln]abilities report$ "u p>agraph 7#b7 into ! vuln]ability managem5t process ( ! ag5cy 9 ord] to track & rem$iate ! vuln]ability4 7e7 ,pap]work ,r$uction ,act exemption ,! requirem5ts ( sub*apt] ,i 7commonly kn[n z ! ,pap]work ,r$uction ,act7 %all n apply to a vuln]ability disclosure program e/abli%$ "u ?is section4 7f7 ,congressional report+ ,n lat] ?an #ij days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjba1 & annually !reaft] = a #c-ye> p]iod1 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! /atus ( ! use ( vuln]ability disclosure policies "u ?is section at ag5cies1 includ+1 ) respect to ! guidance issu$ "u subsection 7b77#c71 an id5tification ( ! ag5cies t are compliant & n compliant4 7g7 ,exemptions ,! au?orities & functions ( ! ,director & ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u ?is section %all n apply to national security sy/ems4 7h7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy describ$ 9 ?is section %all be delegat$-- 7#a7 to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#b72 & 7#b7 to ! ,director ( ,national ,intellig5ce 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#c74 4 7b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei;,a1 z add$ by section #bjd1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs4 4 #bjg4 ,implem5t+ presumption ( compromise & lea/ privilege pr9ciples 7a7 ,guidance ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all provide an update to ! appropriate congressional committees on progress 9 increas+ ! int]nal def5ses ( ag5cy sy/ems1 includ+-- 7#a7 %ift+ away f tru/$ networks to implem5t security controls bas$ on a presumption ( compromise2 7#b7 implem5t+ pr9ciples ( lea/ privilege 9 adm9i/]+ in=mation security programs2 7#c7 limit+ ! ability ( entities t cause incid5ts to move lat]ally ?r\gh or betwe5 ag5cy sy/ems2 7#d7 id5tify+ incid5ts quickly2 7#e7 isolat+ & remov+ unau?oriz$ entities f ag5cy sy/ems quickly2 7#f7 o!rwise increas+ ! res\rce co/s = entities t cause incid5ts to be successful2 & 7#g7 a summ>y ( ! ag5cy progress reports requir$ "u subsection 7b74 7b7 ,ag5cy progress reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! head ( ea* ag5cy %all submit to ! ,director a progress report on implem5t+ an in=mation security program bas$ on ! presumption ( compromise & lea/ privilege pr9ciples1 :i* %all include-- 7#a7 a description ( any /eps ! ag5cy has complet$1 includ+ progress t[>d a*iev+ requirem5ts issu$ by ! ,director2 7#b7 an id5tification ( activities t h n yet be5 complet$ & t w\ld h ! mo/ imm$iate security impact2 & 7#c7 a s*$ule to implem5t any plann$ activities4 #bjh4 ,automation reports 7a7 ,,omb report ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all submit to ! appropriate congressional committees a report on ! use ( automation "u p>agraphs 7#a71 7#e77;,c7 & 7#h77;,b7 ( section #ceed7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,,gao report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all p]=m a /udy on ! use ( automation & ma*9e readable data across ! ,f$]al ,gov]nm5t = cyb]security purposes1 includ+ ! automat$ updat+ ( cyb]security tools1 s5sors1 or processes by ag5cies4 #bji4 ,ext5sion ( ,f$]al acquisition security c\ncil ,section #acbh ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! date t & all t foll[s & ins]t+ ,decemb] #ca1 #bjbf44 #baj4 ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy da%bo>d 7a7 ,da%bo>d requir$ ,section #aa7;e77#b7 ( ! ,inspector ,g5]al ,act ( #aigh 7#e ,u4,s4,c4 ,app47 is am5d$-- 7#a7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7#b7 by r$esignat+ subp>agraph 7,b7 z subp>agraph 7,c72 & 7#c7 by ins]t+ aft] subp>agraph 7,a7 ! foll[+3 7,b7 t %all include a da%bo>d ( op5 in=mation security recomm5dations id5tifi$ 9 ! indep5d5t evaluations requir$ by section #ceee7;a7 ( title #dd1 ,unit$ ,/ates ,code2 & 4 ,,iii ,risk-bas$ budget model #cja4 ,def9itions ,9 ?is title3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate2 & 7,b7 ! ,committee on ,homel& ,security & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives4 7#b7 ,cov]$ ag5cy ,! t]m cov]$ ag5cy has ! mean+ giv5 ! t]m executive ag5cy 9 section #acc ( title #da1 ,unit$ ,/ates ,code4 7#c7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#d7 ,in=mation te*nology ,! t]m in=mation te*nology-- 7,a7 has ! mean+ giv5 ! t]m 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code2 & 7,b7 includes ! h>dw>e & s(tw>e sy/ems ( a ,f$]al ag5cy t monitor & control physical equipm5t & processes ( ! ,f$]al ag5cy4 7#e7 ,risk-bas$ budget ,! t]m risk-bas$ budget means a budget-- 7,a7 develop$ by id5tify+ & prioritiz+ cyb]security risks & vuln]abilities1 includ+ impact on ag5cy op]ations 9 ! case ( a cyb] attack1 ?r\gh analysis ( ?reat intellig5ce1 incid5t data1 & tactics1 te*niques1 proc$ures1 & capabilities ( cyb] ?reats2 & 7,b7 t allocates res\rces bas$ on ! risks id5tifi$ & prioritiz$ "u subp>agraph 7,a74 #cjb4 ,e/abli%m5t ( risk-bas$ budget model 7a7 ,9 g5]al 7#a7 ,model ,n lat] ?an #a ye> aft] ! fir/ publication ( ! budget submitt$ by ! ,presid5t "u section #aaje ( title #ca1 ,unit$ ,/ates ,code1 foll[+ ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director & 9 coord9ation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all develop a /&>d model = creat+ a risk-bas$ budget = cyb]security sp5d+4 7#b7 ,responsibility ( director ,section #ceec7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #aja1 is fur!r am5d$ by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 develop+ a /&>d risk-bas$ budget model to in=m ,f$]al ag5cy cyb]security budget developm5t2 & 4 7#c7 ,cont5ts ( model ,! model requir$ to be develop$ "u p>agraph 7#a7 %all-- 7,a7 consid] ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available1 to id5tify ?reats1 vuln]abilities1 & risks2 7,b7 consid] ! impact ( ag5cy op]ations ( compromise ( sy/ems1 includ+ ! int]connectivity to o!r ag5cy sy/ems & ! op]ations ( o!r ag5cies2 7,c7 indicate :]e res\rces %\ld be allocat$ to h ! greate/ impact on mitigat+ curr5t & future ?reats & curr5t & future cyb]security capabilities2 7,d7 be us$ to in=m acquisition & su/a9m5t (-- 7i7 in=mation te*nology & cyb]security tools2 7ii7 in=mation te*nology & cyb]security ar*itectures2 7iii7 in=mation te*nology & cyb]security p]sonnel2 & 7iv7 cyb]security & in=mation te*nology concepts ( op]ations2 & 7,e7 be us$ to evaluate & in=m ,gov]nm5t-wide cyb]security programs ( ! ,dep>tm5t ( ,homel& ,security4 7#d7 ,requir$ updates ,n less frequ5tly ?an once e #c ye>s1 ! ,director %all review1 & update z necess>y1 ! model requir$ to be develop$ "u ?is subsection4 7#e7 ,publication ,! ,director %all publi% ! model requir$ to be develop$ "u ?is subsection1 & any updates necess>y "u p>agraph 7#d71 on ! public website ( ! ,(fice ( ,managem5t & ,budget4 7#f7 ,reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] = ea* ( ! #b foll[+ fiscal ye>s or until ! date on :i* ! model requir$ to be develop$ "u ?is subsection is complet$1 :i*ev] is soon]1 ! ,director %all submit a report to ,congress on ! developm5t ( ! model4 7b7 ,requir$ use ( risk-bas$ budget model 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date on :i* ! model develop$ "u subsection 7a7 is publi%$1 ! head ( ea* cov]$ ag5cy %all use ! model to develop ! annual cyb]security & in=mation te*nology budget reque/s ( ! ag5cy4 7#b7 ,ag5cy p]=mance plans ,section #ceed7;d77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ & ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 aft] p>agraph 7#a74 7c7 ,v]ification 7#a7 ,9 g5]al ,section #aaje7;a77#ce77;,a77i7 ( title #ca1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 ! matt] prec$+ subclause 7,i71 by /rik+ by ag5cy1 & by initiative area 7z det]m9$ by ! adm9i/ration7 & ins]t+ & by ag5cy2 7,b7 9 subclause 7,,iii71 by /rik+ & at ! end2 & 7,c7 by add+ at ! end ! foll[+3 7,v7 a validation t ! budgets submitt$ 7 develop$ us+ a risk-bas$ me?odology2 & 7,,vi7 a report on ! progress ( ea* ag5cy on clos+ recomm5dations id5tifi$ "u ! indep5d5t evaluation requir$ by section #ceee7;a77#a7 ( title #dd4 4 7#b7 ,effective date ,! am5dm5ts made by p>agraph 7#a7 %all take effect on ! date t is #b ye>s aft] ! date on :i* ! model develop$ "u subsection 7a7 is publi%$4 7d7 ,reports 7#a7 ,indep5d5t evaluation ,section #ceee7;a77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 9 subp>agraph 7,b71 by /rik+ & at ! end2 7,b7 9 subp>agraph 7,c71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7,c7 by add+ at ! end ! foll[+3 7,d7 an assessm5t ( h[ ! ag5cy implem5t$ ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 & an evaluation ( :e!r ! model mitigates ag5cy cyb] vuln]abilities4 4 7#b7 ,assessm5t ,section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #aja1 is fur!r am5d$ by ins]t+ aft] p>agraph 7#e7 ! foll[+3 7#f7 an assessm5t (-- 7,a7 ,f$]al ag5cy implem5tation ( ! model requir$ "u subsection 7a77#g72 7,b7 h[ cyb] vuln]abilities ( ,f$]al ag5cies *ang$ f ! previ\s ye>2 & 7,c7 :e!r ! model mitigates ! cyb] vuln]abilities ( ! ,f$]al ,gov]nm5t4 4 7e7 ,,gao report ,n lat] ?an #c ye>s aft] ! date on :i* ! fir/ budget ( ! ,presid5t is submitt$ to ,congress conta9+ ! validation requir$ "u section #aaje7;a77#ce77;,a77i77,v7 ( title #ca1 ,unit$ ,/ates ,code1 z am5d$ by subsection 7c71 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! appropriate congressional committees a report t includes-- 7#a7 an evaluation ( ! success ( cov]$ ag5cies 9 develop+ risk-bas$ budgets2 7#b7 an evaluation ( ! success ( cov]$ ag5cies 9 implem5t+ risk-bas$ budgets2 7#c7 an evaluation ( :e!r ! risk-bas$ budgets develop$ by cov]$ ag5cies mitigate cyb] vuln]ability1 includ+ ! ext5t to :i* ! risk-bas$ budgets in=m ,f$]al ,gov]nm5t-wide cyb]security programs2 & 7#d7 any o!r in=mation relat+ to risk-bas$ budgets ! ,comptroll] ,g5]al det]m9es appropriate4 ,,iv ,pilot programs to enhance ,f$]al cyb]security #dja4 ,active cyb] def5sive /udy 7a7 ,def9ition ,9 ?is section1 ! t]m active def5se te*nique-- 7#a7 means an action tak5 on ! sy/ems ( an entity to increase ! security ( in=mation on ! network ( an ag5cy by mislead+ an adv]s>y2 & 7#b7 includes a honeypot1 deception1 or purposefully fe$+ false or mislead+ data to an adv]s>y :5 ! adv]s>y is on ! sy/ems ( ! entity4 7b7 ,/udy ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director1 %all p]=m a /udy on ! use ( active def5se te*niques to enhance ! security ( ag5cies1 :i* %all include-- 7#a7 a review ( legal re/rictions on ! use ( diff]5t active cyb] def5se te*niques 9 ,f$]al environm5ts1 9 consultation ) ! ,dep>tm5t ( ,ju/ice2 7#b7 an evaluation (-- 7,a7 ! efficacy ( a selection ( active def5se te*niques det]m9$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,b7 factors t impact ! efficacy ( ! active def5se te*niques evaluat$ "u subp>agraph 7,a72 7#c7 recomm5dations on safegu>ds & proc$ures t %all be e/abli%$ to require t active def5se te*niques are adequately coord9at$ to ensure t active def5se te*niques d n imp$e ?reat response ef=ts1 crim9al inve/igations1 & national security activities1 includ+ intellig5ce collection2 & 7#d7 ! developm5t ( a framework = ! use ( diff]5t active def5se te*niques by ag5cies4 #djb4 ,security op]ations c5t] z a s]vice pilot 7a7 ,purpose ,! purpose ( ?is section is = ! ,cyb]security & ,infra/ructure ,security ,ag5cy to run a security op]ation c5t] on behalf ( ano!r ag5cy1 alleviat+ ! ne$ to duplicate ?is function at e ag5cy1 & emp[]+ a great] c5traliz$ cyb]security capability4 7b7 ,plan ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% a c5traliz$ ,f$]al security op]ations c5t] %>$ s]vice (f]+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,cont5ts ,! plan requir$ "u subsection 7b7 %all include consid]ations =-- 7#a7 collect+1 organiz+1 & analyz+ ag5cy in=mation sy/em data 9 real "t2 7#b7 /aff+ & res\rces2 & 7#c7 appropriate int]ag5cy agreem5ts1 concepts ( op]ations1 & gov]nance plans4 7d7 ,pilot program 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* ! plan requir$ "u subsection 7b7 is develop$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all ent] into a #a-ye> agreem5t ) n less ?an #b ag5cies to (f] a security op]ations c5t] z a %>$ s]vice4 7#b7 ,additional agreem5ts ,aft] ! date on :i* ! brief+ requir$ "u subsection 7e77#a7 is provid$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 may ent] into additional #a-ye> agreem5ts describ$ 9 p>agraph 7#a7 ) ag5cies4 7e7 ,brief+ & report 7#a7 ,brief+ ,n lat] ?an #bfj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! p>amet]s ( any #a-ye> agreem5ts ent]$ into "u subsection 7d77#a74 7#b7 ,report ,n lat] ?an #ij days aft] ! date on :i* ! fir/ #a-ye> agreem5t ent]$ into "u subsection 7d7 expires1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report on-- 7,a7 ! agreem5t2 & 7,b7 any additional agreem5ts ent]$ into ) ag5cies "u subsection 7d74 ,decemb] #ai1 #bjbb,report$ ) an am5dm5t