#aag? ,,congress #b;d ,session ,s4 #cfjj ,,an ,,act ,to improve ! cyb]security ( ! ,f$]al ,gov]nm5t1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,/r5g!n+ ,am]ican ,cyb]security ,act ( #bjbb4 #b4 ,table ( cont5ts ,! table ( cont5ts = ?is ,act is z foll[s3 ,sec4 #a4 ,%ort title4,sec4 #b4 ,table ( cont5ts4,,title ,i--,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb,sec4 #aja4 ,%ort title4,sec4 #ajb4 ,def9itions4,sec4 #ajc4 ,title #dd am5dm5ts4,sec4 #ajd4 ,am5dm5ts to subtitle ,,iii ( title #dj4,sec4 #aje4 ,actions to enhance ,f$]al incid5t transp>5cy4,sec4 #ajf4 ,additional guidance to ag5cies on ,,fisma updates4,sec4 #ajg4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts4,sec4 #ajh4 ,mobile security /&>ds4,sec4 #aji4 ,data & logg+ ret5tion = incid5t response4,sec4 #aaj4 ,,cisa ag5cy advisors4,sec4 #aaa4 ,f$]al p5etration te/+ policy4,sec4 #aab4 ,ongo+ ?reat hunt+ program4,sec4 #aac4 ,codify+ vuln]ability disclosure programs4,sec4 #aad4 ,implem5t+ z]o tru/ ar*itecture4,sec4 #aae4 ,automation reports4,sec4 #aaf4 ,ext5sion ( ,f$]al acquisition security c\ncil & s(tw>e inv5tory4,sec4 #aag4 ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy da%bo>d4,sec4 #aah4 ,quantitative cyb]security metrics4,sec4 #aai4 ,e/abli%m5t ( risk-bas$ budget model4,sec4 #abj4 ,active cyb] def5sive /udy4,sec4 #aba4 ,security op]ations c5t] z a s]vice pilot4,sec4 #abb4 ,ext5sion ( ,*ief ,data ,(fic] ,c\ncil4,sec4 #abc4 ,f$]al ,cyb]security ,requirem5ts4,,title ,,ii--,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb,sec4 #bja4 ,%ort title4,sec4 #bjb4 ,def9itions4,sec4 #bjc4 ,cyb] incid5t report+4,sec4 #bjd4 ,f$]al %>+ ( incid5t reports4,sec4 #bje4 ,ransomw>e vuln]ability w>n+ pilot program4,sec4 #bjf4 ,ransomw>e ?reat mitigation activities4,sec4 #bjg4 ,congressional report+4,,title ,,iii--,f$]al ,secure ,cl\d ,improvem5t & ,jobs ,act ( #bjbb,sec4 #cja4 ,%ort title4,sec4 #cjb4 ,f9d+s4,sec4 #cjc4 ,title #dd am5dm5ts4 ,i ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb #aja4 ,%ort title ,?is title may be cit$ z ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb4 #ajb4 ,def9itions ,9 ?is title1 unless o!rwise specifi$3 7#a7 ,additional cyb]security proc$ure ,! t]m additional cyb]security proc$ure has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is title4 7#b7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code4 7#c7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,b7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 & 7,c7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives4 7#d7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#e7 ,incid5t ,! t]m incid5t has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#f7 ,national security sy/em ,! t]m national security sy/em has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7#g7 ,p5etration te/ ,! t]m p5etration te/ has ! mean+ giv5 ! t]m 9 section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is title4 7#h7 ,?reat hunt+ ,! t]m ?reat hunt+ means proactively & it]atively se>*+ sy/ems = ?reats t evade detection by automat$ ?reat detection sy/ems4 #ajc4 ,title #dd am5dm5ts 7a7 ,sub*apt] ,i am5dm5ts ,sub*apt] ,i ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #cejd-- 7,a7 9 subsection 7a77#a77;,b7-- 7i7 by /rik+ clause 7v7 & ins]t+ ! foll[+3 7v7 confid5tiality1 privacy1 disclosure1 & %>+ ( in=mation2 2 7ii7 by r$esignat+ clause 7vi7 z clause 7vii72 & 7iii7 by ins]t+ aft] clause 7v7 ! foll[+3 7vi7 9 consultation ) ! ,national ,cyb] ,director1 security ( in=mation2 & 2 & 7,b7 9 subsection 7g71 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 develop & ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on privacy1 confid5tiality1 disclosure1 & %>+1 & 9 consultation ) ! ,national ,cyb] ,director1 ov]see ! implem5tation ( policies1 pr9ciples1 /&>ds1 & guidel9es on security1 ( in=mation collect$ or ma9ta9$ by or = ag5cies2 & 2 7#b7 9 section #ceje-- 7,a7 by /rik+ ! fir/ subsection designat$ z subsection 7c72 7,b7 9 p>agraph 7#b7 ( ! second subsection designat$ z subsection 7c71 by ins]t+ an id5tification ( int]net accessible in=mation sy/ems & aft] an inv5tory "u ?is subsection %all include2 7,c7 9 p>agraph 7#c7 ( ! second subsection designat$ z subsection 7c7-- 7i7 9 subp>agraph 7,b7-- 7,i7 by ins]t+ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 & be=e ! ,comptroll] ,g5]al2 & 7,,ii7 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c77v71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 ma9ta9$ on a cont9ual basis ?r\gh ! use ( automation1 ma*9e-readable data1 & scann+1 :]ev] practicable4 2 7#c7 9 section #cejf-- 7,a7 9 subsection 7a77#c71 by ins]t+ ,9 c>ry+ out ^! duties1 ! ,*ief ,in=mation ,(fic] %all coord9ate1 z appropriate1 ) ! ,*ief ,data ,(fic] 9 accordance ) ! designat$ functions "u section #cebj7;c74 aft] r$uction ( in=mation collection burd5s on ! public42 7,b7 9 subsection 7b77#a77;,c71 by ins]t+ 1 availability aft] integrity2 & 7,c7 9 subsection 7h77#c71 by ins]t+ security1 aft] effici5cy12 & 7#d7 9 section #ceac-- 7,a7 by r$esignat+ subsection 7c7 z subsection 7d72 & 7,b7 by ins]t+ aft] subsection 7b7 ! foll[+3 7c7 ,ea* ag5cy provid+ a writt5 plan "u subsection 7b7 %all provide any portion ( ! writt5 plan address+ in=mation security to ! ,secret>y ( ! ,dep>tm5t ( ,homel& ,security & ! ,national ,cyb] ,director4 4 7b7 ,sub*apt] ,,ii def9itions 7#a7 ,9 g5]al ,section #ceeb7;b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7,a7 by r$esignat+ p>agraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 & 7#g7 z p>agraphs 7#b71 7#d71 7#e71 7#f71 7#g71 7#i71 & 7#aa71 respectively2 7,b7 by ins]t+ be=e p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#a7 ,! t]m additional cyb]security proc$ure means a process1 proc$ure1 or o!r activity t is e/abli%$ 9 excess ( ! in=mation security /&>ds promulgat$ "u section #aacca7;b7 ( title #dj to increase ! security & r$uce ! cyb]security risk ( ag5cy sy/ems4 2 7,c7 by ins]t+ aft] p>agraph 7#b71 z s r$esignat$1 ! foll[+3 7#c7 ,! t]m high value asset means in=mation or an in=mation sy/em t ! head ( an ag5cy1 us+ policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director "u section #ceec7;a71 det]m9es to be s critical to ! ag5cy t ! loss or corruption ( ! in=mation or ! loss ( access to ! in=mation sy/em w\ld h a s]i\s impact on ! ability ( ! ag5cy to p]=m ! mission ( ! ag5cy or conduct bus9ess4 2 7,d7 by ins]t+ aft] p>agraph 7#g71 z s r$esignat$1 ! foll[+3 7#h7 ,! t]m major incid5t has ! mean+ giv5 ! t]m 9 guidance issu$ by ! ,director "u section #ceih7;a74 2 7,e7 by ins]t+ aft] p>agraph 7#i71 z s r$esignat$1 ! foll[+3 7#aj7 ,! t]m p5etration te/-- 7,a7 means an au?oriz$ assessm5t t emulates attempts to ga9 unau?oriz$ access to1 or disrupt ! op]ations (1 an in=mation sy/em or compon5t ( an in=mation sy/em2 & 7,b7 includes any additional mean+ giv5 ! t]m 9 policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director "u section #ceec7;a74 2 & 7,f7 by ins]t+ aft] p>agraph 7#aa71 z s r$esignat$1 ! foll[+3 7#ab7 ,! t]m %>$ s]vice means a c5traliz$ bus9ess or mission capability t is provid$ to multiple organizations )9 an ag5cy or to multiple ag5cies4 4 7#b7 ,con=m+ am5dm5ts 7,a7 ,homel& ,security ,act ( #bjjb ,section #ajja7;c77#a77;,a7 ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is am5d$ by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f77;,a7 & ins]t+ section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 ( title #aj1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,c7 ,high-,p]=mance ,comput+ ,act ( #aiia ,section #bjg7;a7 ( ! ,high-,p]=mance ,comput+ ,act ( #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is am5d$ by /rik+ section #ceeb7;b77#f77;,a77i7 & ins]t+ section #ceeb7;b77#i77;,a77i74 7,d7 ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj ,section #c7e7 ( ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is am5d$ by /rik+ section #ceeb7;b77#f7 & ins]t+ section #ceeb7;b74 7,e7 ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac ,section #icc7;e77#a77;,b7 ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjac 7#aj ,u4,s4,c4 #bbbd note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa ,! ,ike ,skelton ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjaa 7,public ,law #aaa-chc7 is am5d$-- 7i7 9 section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by /rik+ section #cedb7;b7 & ins]t+ section #ceeb7;b72 7ii7 9 section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b72 & 7iii7 9 section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,g7 ,e-,gov]nm5t ,act ( #bjjb ,section #cja7;c77#a77;,a7 ( ! ,e-,gov]nm5t ,act ( #bjjb 7#dd ,u4,s4,c4 #ceja note7 is am5d$ by /rik+ section #cedb7;b77#b7 & ins]t+ section #ceeb7;b74 7,h7 ,national ,in/itute ( ,/&>ds & ,te*nology ,act ,section #bj ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$-- 7i7 9 subsection 7a77#b71 by /rik+ section #ceeb7;b77#e7 & ins]t+ section #ceeb7;b72 & 7ii7 9 subsection 7f7-- 7,i7 9 p>agraph 7#c71 by /rik+ section #cecb7a7 & ins]t+ section #ceeb7;b72 & 7,,ii7 9 p>agraph 7#e71 by /rik+ section #cecb7;b77#b7 & ins]t+ section #ceeb7;b74 7c7 ,sub*apt] ,,ii am5dm5ts ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #ceea-- 7,a7 9 p>agraph 7#d71 by /rik+ diagnose & improve & ins]t+ integrate1 deliv]1 diagnose1 & improve2 7,b7 9 p>agraph 7#e71 by /rik+ & at ! end2 7,c7 9 p>agraph 7#f71 by /rik+ ! p]iod at ! end & ins]t+ a semi colon2 & 7,d7 by add+ at ! end ! foll[+3 7#g7 recognize t ea* ag5cy has specific mission requirem5ts &1 at times1 unique cyb]security requirem5ts to meet ! mission ( ! ag5cy2 7#h7 recognize t ea* ag5cy does n h ! same res\rces to secure ag5cy sy/ems1 & an ag5cy %\ld n be expect$ to h ! capability to secure ! sy/ems ( ! ag5cy f advanc$ adv]s>ies alone2 & 7#i7 recognize t a holi/ic ,f$]al cyb]security model is necess>y to acc\nt = diff]5ces betwe5 ! missions & capabilities ( ag5cies4 2 7#b7 9 section #ceec-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a71 by ins]t+ 1 9 consultation ) ! ,secret>y & ! ,national ,cyb] ,director1 be=e ov]see+2 7ii7 9 p>agraph 7#e71 by /rik+ & at ! end2 & 7iii7 by add+ at ! end ! foll[+3 7#h7 promot+1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 & ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology-- 7,a7 ! use ( automation to improve ,f$]al cyb]security & visibility ) respect to ! implem5tation ( ,f$]al cyb]security2 & 7,b7 ! use ( presumption ( compromise & lea/ privilege pr9ciples to improve resili5cy & timely response actions to incid5ts on ,f$]al sy/ems4 2 7,b7 9 subsection 7b7-- 7i7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ & ! ,national ,cyb] ,director aft] ,director2 & 7ii7 9 p>agraph 7#b77;,a71 by ins]t+ & report+ requirem5ts "u sub*apt] ,,iv ( ?is *apt] aft] section #ceef2 & 7,c7 9 subsection 7c7-- 7i7 9 ! matt] prec$+ p>agraph 7#a7-- 7,i7 by /rik+ ea* ye> & ins]t+ ea* ye> dur+ :i* ag5cies are requir$ to submit reports "u section #ceed7;c72 & 7,,ii7 by /rik+ prec$+ ye> & ins]t+ prec$+ #b ye>s2 7ii7 by /rik+ p>agraph 7#a72 7iii7 by r$esignat+ p>agraphs 7#b71 7#c71 & 7#d7 z p>agraphs 7#a71 7#b71 & 7#c71 respectively2 7iv7 9 p>agraph 7#c71 z s r$esignat$1 by /rik+ & at ! end2 7v7 by ins]t+ aft] p>agraph 7#c71 z s r$esignat$ ! foll[+3 7#d7 a summ>y ( ea* assessm5t ( ,f$]al risk po/ure p]=m$ "u subsection 7i72 2 & 7vi7 9 p>agraph 7#e71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 7,d7 by r$esignat+ subsections 7i71 7j71 7k71 & 7l7 z subsections 7j71 7k71 7l71 & 7m7 respectively2 7,e7 by ins]t+ aft] subsection 7h7 ! foll[+3 7i7 ,f$]al risk assessm5ts ,on an ongo+ & cont9u\s basis1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all p]=m assessm5ts ( ,f$]al risk po/ure us+ any available in=mation on ! cyb]security po/ure ( ag5cies1 & brief ! ,director & ,national ,cyb] ,director on ! f9d+s ( ^? assessm5ts includ+-- 7#a7 ! /atus ( ag5cy cyb]security rem$ial actions describ$ 9 section #ceed7;b77#g72 7#b7 any vuln]ability in=mation relat+ to ! sy/ems ( an ag5cy t is kn[n by ! ag5cy2 7#c7 analysis ( incid5t in=mation "u section #ceig2 7#d7 evaluation ( p5etration te/+ p]=m$ "u section #ceei;,a2 7#e7 evaluation ( vuln]ability disclosure program in=mation "u section #ceei;,b2 7#f7 evaluation ( ag5cy ?reat hunt+ results2 7#g7 evaluation ( ,f$]al & non-,f$]al cyb] ?reat intellig5ce2 7#h7 data on ag5cy compliance ) /&>ds issu$ "u section #aacca ( title #dj2 7#i7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 & 7#aj7 any o!r in=mation ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es relevant4 2 7,f7 9 subsection 7j71 z s r$esignat$-- 7i7 by /rik+ reg>d+ ! specific & ins]t+ 8t includes a summ>y (-- 7#a7 ! specific 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 & & 7iii7 by add+ at ! end ! foll[+3 7#b7 ! tr5ds id5tifi$ 9 ! ,f$]al risk assessm5t p]=m$ "u subsection 7i74 2 & 7,g7 by add+ at ! end ! foll[+3 7n7 ,b9d+ op]ational directives ,if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy issues a b9d+ op]ational directive or an em]g5cy directive "u ?is section1 n lat] ?an #d days aft] ! date on :i* ! b9d+ op]ational directive requires an ag5cy to take an action1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! ,director1 ,national ,cyb] ,director1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives ! /atus ( ! implem5tation ( ! b9d+ op]ational directive at ! ag5cy4 7o7 ,review ( ,(fice ( ,managem5t & ,budget guidance & policy 7#a7 ,review 7,a7 ,9 g5]al ,n less frequ5tly ?an once e #c ye>s1 ! ,director1 9 consultation ) ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,national ,cyb] ,director1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 %all-- 7i7 review ! efficacy ( ! guidance & policy develop$ by ! ,director "u subsection 7a77#a7 9 r$uc+ cyb]security risks1 includ+ an assessm5t ( ! requirem5ts = ag5cies to report in=mation to ! ,director2 & 7ii7 det]m9e :e!r any *anges to ! guidance or policy develop$ "u subsection 7a77#a7 is appropriate4 7,b7 ,consid]ations ,9 conduct+ ! review requir$ "u subp>agraph 7,a71 ! ,director %all consid]-- 7i7 ! ,f$]al risk assessm5ts p]=m$ "u subsection 7i72 7ii7 ! cumulative report+ & compliance burd5 to ag5cies2 & 7iii7 ! cl>ity ( ! requirem5ts & deadl9es conta9$ 9 guidance & policy docum5ts4 7#b7 ,updat$ guidance ,n lat] ?an #ij days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director %all issue updat$ guidance or policy to ag5cies det]m9$ appropriate by ! ,director1 bas$ on ! results ( ! review4 7#c7 ,public report ,n lat] ?an #cj days aft] ! date on :i* ! ,director completes a review "u p>agraph 7#a71 ! ,director %all make publicly available a report t includes-- 7,a7 an ov]view ( ! guidance & policy develop$ "u subsection 7a77#a7 t is 9 effect2 7,b7 ! cyb]security risk mitigation1 or o!r cyb]security b5efit1 (f]$ by ea* guidance or policy describ$ 9 subp>agraph 7,a72 7,c7 a summ>y ( ! guidance or policy develop$ "u subsection 7a77#a7 to :i* *anges 7 det]m9$ appropriate dur+ ! review2 & 7,d7 ! *anges t are anticipat$ to be includ$ 9 ! updat$ guidance or policy issu$ "u p>agraph 7#b74 7#d7 ,congressional brief+ ,n lat] ?an #fj days aft] ! date on :i* a review is complet$ "u p>agraph 7#a71 ! ,director %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! review4 7p7 ,automat$ /&>d implem5tation v]ification ,:5 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology issues a propos$ /&>d pursuant to p>agraphs 7#b7 or 7#c7 ( section #bj7;a7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology %all consid] develop+ &1 if appropriate & practical1 develop1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 specifications to enable ! automat$ v]ification ( ! implem5tation ( ! controls )9 ! /&>d4 2 7#c7 9 section #ceed-- 7,a7 9 subsection 7a7-- 7i7 9 p>agraph 7#a7-- 7,i7 by r$esignat+ subp>agraphs 7,a71 7,b71 & 7,c7 z subp>agraphs 7,b71 7,c71 & 7,d71 respectively2 7,,ii7 by ins]t+ be=e subp>agraph 7,b71 z s r$esignat$1 ! foll[+3 7,a7 on an ongo+ & cont9u\s basis1 p]=m+ ag5cy sy/em risk assessm5ts t-- 7i7 id5tify & docum5t ! high value assets ( ! ag5cy us+ guidance f ! ,director2 7ii7 evaluate ! data assets inv5tori$ "u section #ceaa = s5sitivity to compromises 9 confid5tiality1 integrity1 & availability2 7iii7 id5tify ag5cy sy/ems t h access to or hold ! data assets inv5tori$ "u section #ceaa2 7iv7 evaluate ! ?reats fac+ ag5cy sy/ems & data1 includ+ high value assets1 bas$ on ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available2 7v7 evaluate ! vuln]ability ( ag5cy sy/ems & data1 includ+ high value assets1 includ+ by analyz+-- 7,i7 ! results ( p5etration te/+ p]=m$ by ! ,dep>tm5t ( ,homel& ,security "u section #ceec7;b77#i72 7,,ii7 ! results ( p5etration te/+ p]=m$ "u section #ceei;,a2 7,,iii7 in=mation provid$ to ! ag5cy ?r\gh ! vuln]ability disclosure program ( ! ag5cy "u section #ceei;,b2 7,,iv7 incid5ts2 & 7,v7 any o!r vuln]ability in=mation relat+ to ag5cy sy/ems t is kn[n to ! ag5cy2 7vi7 assess ! impacts ( pot5tial ag5cy incid5ts to ag5cy sy/ems1 data1 & op]ations bas$ on ! evaluations describ$ 9 clauses 7ii7 & 7iv7 & ! ag5cy sy/ems id5tifi$ "u clause 7iii72 & 7vii7 assess ! consequ5ces ( pot5tial incid5ts occurr+ on ag5cy sy/ems t w\ld impact sy/ems at o!r ag5cies1 includ+ due to int]connectivity betwe5 diff]5t ag5cy sy/ems or op]ational reliance on ! op]ations ( ! sy/em or data 9 ! sy/em2 2 7,,iii7 9 subp>agraph 7,b71 z s r$esignat$1 9 ! matt] prec$+ clause 7i71 by /rik+ provid+ in=mation & ins]t+ us+ in=mation f ! assessm5t conduct$ "u subp>agraph 7,a71 provid+ in=mation2 7,,iv7 9 subp>agraph 7,c71 z s r$esignat$-- 7aa7 9 clause 7ii7 by ins]t+ b9d+ be=e op]ational2 & 7bb7 9 clause 7vi71 by /rik+ & at ! end2 & 7,v7 by add+ at ! end ! foll[+3 7,e7 provid+ an update on ! ongo+ & cont9u\s assessm5t p]=m$ "u subp>agraph 7,a7-- 7i7 ^u reque/1 to ! inspector g5]al ( ! ag5cy or ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7ii7 on a p]iodic basis1 z det]m9$ by guidance issu$ by ! ,director b n less frequ5tly ?an annually1 to-- 7,i7 ! ,director2 7,,ii7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,,iii7 ! ,national ,cyb] ,director2 7,f7 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & n less frequ5tly ?an once e #c ye>s1 p]=m+ an evaluation ( :e!r additional cyb]security proc$ures are appropriate = secur+ a sy/em (1 or "u ! sup]vision (1 ! ag5cy1 :i* %all-- 7i7 be complet$ consid]+ ! ag5cy sy/em risk assessm5t p]=m$ "u subp>agraph 7,a72 & 7ii7 include a specific evaluation = high value assets2 7,g7 n lat] ?an #cj days aft] complet+ ! evaluation p]=m$ "u subp>agraph 7,f71 provid+ ! evaluation & an implem5tation plan1 if applicable1 = us+ additional cyb]security proc$ures det]m9$ to be appropriate to-- 7i7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7ii7 ! ,director2 & 7iii7 ! ,national ,cyb] ,director2 & 7,h7 if ! head ( ! ag5cy det]m9es !re is ne$ = additional cyb]security proc$ures1 ensur+ t ^? additional cyb]security proc$ures are reflect$ 9 ! budget reque/ ( ! ag5cy2 2 7ii7 9 p>agraph 7#b7-- 7,i7 9 subp>agraph 7,a71 by ins]t+ 9 accordance ) ! ag5cy sy/em risk assessm5t p]=m$ "u p>agraph 7#a77;,a7 aft] in=mation sy/ems2 7,,ii7 9 subp>agraph 7,b7-- 7aa7 by /rik+ 9 accordance ) /&>ds & ins]t+ 89 accordance )-- 7i7 /&>ds 2 & 7bb7 by add+ at ! end ! foll[+3 7ii7 ! evaluation p]=m$ "u p>agraph 7#a77;,f72 & 7iii7 ! implem5tation plan describ$ 9 p>agraph 7#a77;,g72 2 & 7,,iii7 9 subp>agraph 7,d71 by ins]t+ 1 ?r\gh ! use ( p5etration te/+1 ! vuln]ability disclosure program e/abli%$ "u section #ceei;,b1 & o!r means1 aft] p]iodically2 7iii7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 9 clause 7iii71 by /rik+ & at ! end2 7bb7 9 clause 7iv71 by add+ & at ! end2 & 7cc7 by add+ at ! end ! foll[+3 7v7 ensure t-- 7,i7 s5ior ag5cy in=mation security (fic]s ( compon5t ag5cies c>ry out responsibilities "u ?is sub*apt]1 z direct$ by ! s5ior ag5cy in=mation security (fic] ( ! ag5cy or an equival5t (ficial2 & 7,,ii7 s5ior ag5cy in=mation security (fic]s ( compon5t ag5cies report to-- 7aa7 ! s5ior in=mation security (fic] ( ! ag5cy or an equival5t (ficial2 & 7bb7 ! ,*ief ,in=mation ,(fic] ( ! compon5t ag5cy or an equival5t (ficial2 2 & 7iv7 9 p>agraph 7#e71 by ins]t+ & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy be=e on ! effectiv5ess2 7,b7 9 subsection 7b7-- 7i7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 pursuant to subsection 7a77#a77;,a71 p]=m+ ongo+ & cont9u\s ag5cy sy/em risk assessm5ts1 :i* may include us+ guidel9es & automat$ tools consi/5t ) /&>ds & guidel9es promulgat$ "u section #aacca ( title #dj1 z applicable2 2 7ii7 9 p>agraph 7#b7-- 7,i7 by /rik+ subp>agraph 7,b7 & ins]t+ ! foll[+3 7,b7 comply ) ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g72 2 & 7,,ii7 9 subp>agraph 7,d7-- 7aa7 by r$esignat+ clauses 7iii7 & 7iv7 z clauses 7iv7 & 7v71 respectively2 7bb7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 b9d+ op]ational directives & em]g5cy directives promulgat$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceec2 2 & 7cc7 9 clause 7iv71 z s r$esignat$1 by /rik+ z det]m9$ by ! ag5cy2 & & ins]t+ 8z det]m9$ by ! ag5cy1 consid]+ ! ag5cy risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 & 7iii7 9 p>agraph 7#e77;,a71 by ins]t+ 1 includ+ p5etration te/+1 z appropriate1 aft] %all include te/+2 7iv7 9 p>agraph 7#f71 by /rik+ plann+1 implem5t+1 evaluat+1 & docum5t+ & ins]t+ plann+ & implem5t+ &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 evaluat+ & docum5t+2 7v7 by r$esignat+ p>agraphs 7#g7 & 7#h7 z p>agraphs 7#h7 & 7#i71 respectively2 7vi7 by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 a process = provid+ ! /atus ( e rem$ial action & unrem$iat$ id5tifi$ sy/em vuln]ability to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable2 2 & 7vii7 9 p>agraph 7#h77;,c71 z s r$esignat$-- 7,i7 by /rik+ clause 7ii7 & ins]t+ ! foll[+3 7ii7 notify+ & consult+ ) ! ,f$]al in=mation security incid5t c5t] e/abli%$ "u section #ceef pursuant to ! requirem5ts ( section #ceid2 2 7,,ii7 by r$esignat+ clause 7iii7 z clause 7iv72 7,,iii7 by ins]t+ aft] clause 7ii7 ! foll[+3 7iii7 p]=m+ ! notifications & o!r activities requir$ "u sub*apt] ,,iv ( ?is *apt]2 & 2 & 7,,iv7 9 clause 7iv71 z s r$esignat$-- 7aa7 9 subclause 7,i71 by /rik+ & relevant (fices ( inspectors g5]al2 7bb7 9 subclause 7,,ii71 by add+ & at ! end2 7cc7 by /rik+ subclause 7,,iii72 & 7dd7 by r$esignat+ subclause 7,,iv7 z subclause 7,,iii72 7,c7 9 subsection 7c7-- 7i7 by r$esignat+ p>agraph 7#b7 z p>agraph 7#e72 7ii7 by /rik+ p>agraph 7#a7 & ins]t+ ! foll[+3 7#a7 ,biannual report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb & n less frequ5tly ?an once e #b ye>s !reaft]1 us+ ! cont9u\s & ongo+ ag5cy sy/em risk assessm5t "u subsection 7a77#a77;,a71 ! head ( ea* ag5cy %all submit to ! ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! majority & m9ority lead]s ( ! ,s5ate1 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate1 ! ,committee on ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se ( ,repres5tatives1 ! appropriate au?orization & appropriations committees ( ,congress1 ! ,national ,cyb] ,director1 & ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates a report t-- 7,a7 summ>izes ! ag5cy sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a72 7,b7 evaluates ! adequacy & effectiv5ess ( in=mation security policies1 proc$ures1 & practices ( ! ag5cy to address ! risks id5tifi$ 9 ! ag5cy sy/em risk assessm5t p]=m$ "u subsection 7a77#a77;,a71 includ+ an analysis ( ! ag5cy's cyb]security & incid5t response capabilities us+ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c772 7,c7 summ>izes ! evaluation & implem5tation plans describ$ 9 subp>agraphs 7,f7 & 7,g7 ( subsection 7a77#a7 & :e!r ^? evaluation & implem5tation plans call = ! use ( additional cyb]security proc$ures det]m9$ to be appropriate by ! ag5cy2 & 7,d7 summ>izes ! /atus ( rem$ial actions id5tifi$ by inspector g5]al ( ! ag5cy1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates1 & any o!r s\rce det]m9$ appropriate by ! head ( ! ag5cy4 7#b7 ,unclassifi$ reports ,ea* report submitt$ "u p>agraph 7#a7-- 7,a7 %all be1 to ! greate/ ext5t practicable1 9 an unclassifi$ & o!rwise uncontroll$ =m2 & 7,b7 may include a classifi$ annex4 7#c7 ,access to in=mation ,! head ( an ag5cy %all ensure t1 to ! greate/ ext5t practicable1 in=mation is includ$ 9 ! unclassifi$ =m ( ! report submitt$ by ! ag5cy "u p>agraph 7#b77;,a74 7#d7 ,brief+s ,dur+ ea* ye> dur+ :i* a report is n requir$ to be submitt$ "u p>agraph 7#a71 ! ,director %all provide to ! congressional committees describ$ 9 p>agraph 7#a7 a brief+ summ>iz+ curr5t ag5cy & ,f$]al risk po/ures4 2 & 7iii7 9 p>agraph 7#e71 z s r$esignat$1 by /rik+ ! p]iod at ! end & ins]t+ 1 includ+ ! report+ proc$ures e/abli%$ "u section #aacae7;d7 ( title #dj & subsection 7a77#c77;,a77v7 ( ?is section2 & 7,d7 9 subsection 7d77#a71 9 ! matt] prec$+ subp>agraph 7,a71 by ins]t+ & ! ,national ,cyb] ,director aft] ! ,director2 & 7,e7 by add+ at ! end ! foll[+3 7f7 ,report+ /ructure exemption 7#a7 ,9 g5]al ,on an annual basis1 ! ,director may exempt an ag5cy f ! report+ /ructure requirem5t "u subsection 7a77#c77;,a77v77,,ii74 7#b7 ,report ,on an annual basis1 ! ,director %all submit a report to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives t includes a li/ ( ea* exemption grant$ "u p>agraph 7#a7 & ! associat$ rationale = ea* exemption4 7#c7 ,compon5t ( o!r report ,! report requir$ "u p>agraph 7#b7 may be incorporat$ into any o!r annual report requir$ "u ?is *apt]4 2 7#d7 9 section #ceee-- 7,a7 9 ! section head+1 by /rik+ ,annual indep5d5t & ins]t+ ,indep5d5t2 7,b7 9 subsection 7a7-- 7i7 9 p>agraph 7#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c71 aft] ,ea* ye>2 7ii7 9 p>agraph 7#b77;,a71 by ins]t+ 1 includ+ by p5etration te/+ & analyz+ ! vuln]ability disclosure program ( ! ag5cy aft] in=mation sy/ems2 & 7iii7 by add+ at ! end ! foll[+3 7#c7 ,an evaluation "u ?is section may include recomm5dations = improv+ ! cyb]security po/ure ( ! ag5cy4 2 7,c7 9 subsection 7b77#a71 by /rik+ annual2 7,d7 9 subsection 7e77#a71 by ins]t+ dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 aft] ,ea* ye>2 7,e7 by /rik+ subsection 7f7 & ins]t+ ! foll[+3 7f7 ,protection ( in=mation 7#a7 ,ag5cies1 evaluators1 & o!r recipi5ts ( in=mation t1 if disclos$1 may cause grave h>m to ! ef=ts ( ,f$]al in=mation security (fic]s1 %all take appropriate /eps to ensure ! protection ( t in=mation1 includ+ safegu>d+ ! in=mation f public disclosure4 7#b7 ,! protections requir$ "u p>agraph 7#a7 %all be comm5surate ) ! risk & comply ) all applicable laws & regulations4 7#c7 ,) respect to in=mation t is n relat$ to national security sy/ems1 ag5cies & evaluators %all make a summ>y ( ! in=mation unclassifi$ & publicly available1 includ+ in=mation t does n id5tify-- 7,a7 specific in=mation sy/em incid5ts2 or 7,b7 specific in=mation sy/em vuln]abilities4 2 7,f7 9 subsection 7g77#b7-- 7i7 by /rik+ ?is subsection %all & ins]t+ 8?is subsection-- 7,a7 %all 2 7ii7 9 subp>agraph 7,a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,b7 id5tify any entity t p]=ms an indep5d5t evaluation "u subsection 7b74 2 & 7,g7 by /rik+ subsection 7j7 & ins]t+ ! foll[+3 7j7 ,guidance 7#a7 ,9 g5]al ,! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 ! ,*ief ,in=mation ,(fic]s ,c\ncil1 ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 & o!r int]e/$ p>ties z appropriate1 %all ensure ! developm5t ( risk-bas$ guidance = evaluat+ ! effectiv5ess ( an in=mation security program & practices 7#b7 ,priorities ,! risk-bas$ guidance develop$ "u p>agraph 7#a7 %all include-- 7,a7 ! id5tification ( ! mo/ common successful ?reat patt]ns exp]i5c$ by ea* ag5cy2 7,b7 ! id5tification ( security controls t address ! ?reat patt]ns describ$ 9 subp>agraph 7,a72 7,c7 any o!r security risks unique to ! networks ( ea* ag5cy2 & 7,d7 any o!r elem5t ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy1 det]m9es appropriate4 2 & 7#e7 9 section #ceef7;a7-- 7,a7 9 ! matt] prec$+ p>agraph 7#a71 by ins]t+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy aft] incid5t c5t]2 & 7,b7 9 p>agraph 7#d71 by /rik+ #ceed7;b7 & ins]t+ #ceed7;a77#a77;,a74 7d7 ,con=m+ am5dm5ts 7#a7 ,table ( sections ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! item relat+ to section #ceee & ins]t+ ! foll[+3 #ceee4 ,indep5d5t evaluation 4 7#b7 ,,omb reports ,section #bbf7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebd7;c77 is am5d$-- 7,a7 9 p>agraph 7#a77;,b71 9 ! matt] prec$+ clause 7i71 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 9 p>agraph 7#b77;,b71 9 ! matt] prec$+ clause 7i7-- 7i7 by /rik+ annually !reaft] & ins]t+ !reaft] dur+ ! ye>s dur+ :i* a report is requir$ to be submitt$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code2 & 7ii7 by /rik+ ! report requir$ "u section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code & ins]t+ t report4 7#c7 ,,ni/ responsibilities ,section #bj7;d77#c77;,b7 ( ! ,national ,in/itute ( ,/&>ds & ,te*nology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is am5d$ by /rik+ annual4 7e7 ,f$]al sy/em incid5t response 7#a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,iv ,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ! def9itions "u sections #cejb & #ceeb %all apply to ?is sub*apt]4 7b7 ,additional def9itions ,z us$ 9 ?is sub*apt]3 7#a7 ,appropriate report+ entities ,! t]m appropriate report+ entities means-- 7,a7 ! majority & m9ority lead]s ( ! ,s5ate2 7,b7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7,c7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7,d7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 7,e7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7,f7 ! appropriate au?orization & appropriations committees ( ,congress2 7,g7 ! ,director2 7,h7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 7,i7 ! ,national ,cyb] ,director2 7,j7 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates2 & 7,k7 ! inspector g5]al ( any impact$ ag5cy4 7#b7 ,aw>dee ,! t]m aw>dee-- 7,a7 means a p]son1 bus9ess1 or o!r entity t receives a grant f1 or is a p>ty to a coop]ative agreem5t or an o!r transaction agreem5t )1 an ag5cy2 & 7,b7 includes any subgrantee ( a p]son1 bus9ess1 or o!r entity describ$ 9 subp>agraph 7,a74 7#c7 ,brea* ,! t]m brea*-- 7,a7 means ! loss1 control1 compromise1 unau?oriz$ disclosure1 or unau?oriz$ acquisition ( p]sonally id5tifiable in=mation or any simil> occurr5ce2 & 7,b7 includes any additional mean+ giv5 ! t]m 9 policies1 pr9ciples1 /&>ds1 or guidel9es issu$ by ! ,director "u section #ceec7;a74 7#d7 ,contractor ,! t]m contractor means a prime contractor ( an ag5cy or a subcontractor ( a prime contractor ( an ag5cy4 7#e7 ,f$]al in=mation ,! t]m ,f$]al in=mation means in=mation creat$1 collect$1 process$1 ma9ta9$1 dissem9at$1 disclos$1 or dispos$ ( by or = ! ,f$]al ,gov]nm5t 9 any m$ium or =m4 7#f7 ,f$]al in=mation sy/em ,! t]m ,f$]al in=mation sy/em means an in=mation sy/em us$ or op]at$ by an ag5cy1 a contractor1 an aw>dee1 or ano!r organization on behalf ( an ag5cy4 7#g7 ,intellig5ce community ,! t]m intellig5ce community has ! mean+ giv5 ! t]m 9 section #c ( ! ,national ,security ,act ( #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consum] report+ ag5cy ,! t]m nationwide consum] report+ ag5cy means a consum] report+ ag5cy describ$ 9 section #fjc7p7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vuln]ability disclosure ,! t]m vuln]ability disclosure means a vuln]ability id5tifi$ "u section #ceei;,b4 #ceib4 ,notification ( brea* 7a7 ,notification ,z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #de days aft] an ag5cy has a reasonable basis to conclude t a brea* has occurr$1 ! head ( ! ag5cy1 9 consultation ) a s5ior privacy (fic] ( ! ag5cy1 %all-- 7#a7 det]m9e :e!r notice to any individual pot5tially affect$ by ! brea* is appropriate bas$ on an assessm5t ( ! risk ( h>m to ! individual t consid]s-- 7,a7 ! nature & s5sitivity ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,b7 ! likelihood ( access to & use ( ! p]sonally id5tifiable in=mation affect$ by ! brea*2 7,c7 ! type ( brea*2 & 7,d7 any o!r factors det]m9$ by ! ,director2 & 7#b7 z appropriate1 provide writt5 notice 9 accordance ) subsection 7b7 to ea* individual pot5tially affect$ by ! brea*-- 7,a7 to ! la/ kn[n mail+ address ( ! individual2 or 7,b7 ?r\gh an appropriate alt]native me?od ( notification t ! head ( ! ag5cy or a designat$ s5ior-level individual ( ! ag5cy selects bas$ on factors det]m9$ by ! ,director4 7b7 ,cont5ts ( notice ,ea* notice ( a brea* provid$ to an individual "u subsection 7a77#b7 %all include-- 7#a7 a brief description ( ! brea*2 7#b7 if possible1 a description ( ! types ( p]sonally id5tifiable in=mation affect$ by ! brea*2 7#c7 contact in=mation ( ! ag5cy t may be us$ to ask que/ions ( ! ag5cy1 :i*-- 7,a7 %all include an e-mail address or ano!r digital contact me*anism2 & 7,b7 may include a telephone numb]1 mail+ address1 or a website2 7#d7 in=mation on any rem$y be+ (f]$ by ! ag5cy2 7#e7 any applicable educational mat]ials relat+ to :at individuals c d 9 response to a brea* t pot5tially affects _! p]sonally id5tifiable in=mation1 includ+ relevant contact in=mation = ,f$]al law en=cem5t ag5cies & ea* nationwide consum] report+ ag5cy2 & 7#f7 any o!r appropriate in=mation1 z det]m9$ by ! head ( ! ag5cy or e/abli%$ 9 guidance by ! ,director4 7c7 ,delay ( notification 7#a7 ,9 g5]al ,! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 or ! ,secret>y ( ,homel& ,security may delay a notification requir$ "u subsection 7a7 or 7d7 if ! notification w\ld-- 7,a7 imp$e a crim9al inve/igation or a national security activity2 7,b7 reveal s5sitive s\rces & me?ods2 7,c7 cause damage to national security2 or 7,d7 hamp] security rem$iation actions4 7#b7 ,docum5tation 7,a7 ,9 g5]al ,any delay "u p>agraph 7#a7 %all be report$ 9 writ+ to ! ,director1 ! ,attorney ,g5]al1 ! ,director ( ,national ,intellig5ce1 ! ,secret>y ( ,homel& ,security1 ! ,national ,cyb] ,director1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & ! head ( ! ag5cy & ! inspector g5]al ( ! ag5cy t exp]i5c$ ! brea*4 7,b7 ,cont5ts ,a report requir$ "u subp>agraph 7,a7 %all include a writt5 /atem5t f ! entity t delay$ ! notification expla9+ ! ne$ = ! delay4 7,c7 ,=m ,! report requir$ "u subp>agraph 7,a7 %all be unclassifi$ b may include a classifi$ annex4 7#c7 ,r5ewal ,a delay "u p>agraph 7#a7 %all be = a p]iod ( #fj days & may be r5ew$4 7d7 ,update notification ,if an ag5cy det]m9es !re is a significant *ange 9 ! reasonable basis to conclude t a brea* occurr$1 a significant *ange to ! det]m9ation made "u subsection 7a77#a71 or t x is necess>y to update ! details ( ! in=mation provid$ to pot5tially affect$ individuals z describ$ 9 subsection 7b71 ! ag5cy %all z exp$iti\sly z practicable & )\t unreasonable delay1 & 9 any case n lat] ?an #cj days aft] su* a det]m9ation1 notify ea* individual :o receiv$ a notification pursuant to subsection 7a7 ( ^? *anges4 7e7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ,director f issu+ guidance relat+ to notifications or ! head ( an ag5cy f notify+ individuals pot5tially affect$ by brea*es t are n det]m9$ to be major incid5ts2 or 7#b7 ! ,director f issu+ guidance relat+ to notifications ( major incid5ts or ! head ( an ag5cy f provid+ m in=mation ?an describ$ 9 subsection 7b7 :5 notify+ individuals pot5tially affect$ by brea*es4 #ceic4 ,congressional & ,executive ,bran* reports 7a7 ,initial report 7#a7 ,9 g5]al ,n lat] ?an #gb h\rs aft] an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy impact$ by ! major incid5t %all submit to ! appropriate report+ entities a writt5 report &1 to ! ext5t practicable1 provide a brief+ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives1 & ! appropriate au?orization & appropriations committees ( ,congress1 tak+ into acc\nt-- 7,a7 ! in=mation kn[n at ! "t ( ! report2 7,b7 ! s5sitivity ( ! details associat$ ) ! major incid5t2 & 7,c7 ! classification level ( ! in=mation conta9$ 9 ! report4 7#b7 ,cont5ts ,a report requir$ "u p>agraph 7#a7 %all include1 9 a mann] t excludes or o!rwise reasonably protects p]sonally id5tifiable in=mation & to ! ext5t p]mitt$ by applicable law1 includ+ privacy & /ati/ical laws-- 7,a7 a summ>y ( ! in=mation available ab\t ! major incid5t1 includ+ h[ ! major incid5t occurr$1 in=mation indicat+ t ! major incid5t may be a brea*1 & in=mation relat+ to ! major incid5t z a brea*1 bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy submits ! report2 7,b7 if applicable1 a description & any associat$ docum5tation ( any circum/ances necessitat+ a delay 9 a notification to individuals pot5tially affect$ by ! major incid5t "u section #ceib7;c72 7,c7 if applicable1 an assessm5t ( ! impacts to ! ag5cy1 ! ,f$]al ,gov]nm5t1 or ! security ( ! ,unit$ ,/ates1 bas$ on in=mation available to ag5cy (ficials on ! date on :i* ! ag5cy submits ! report2 & 7,d7 if applicable1 :e!r any ransom has be5 dem&$ or paid1 or plans to be paid1 by any entity op]at+ a ,f$]al in=mation sy/em or ) access to a ,f$]al in=mation sy/em1 unless disclosure ( su* in=mation may disrupt an active ,f$]al law en=cem5t or national security op]ation4 7b7 ,supplem5tal report ,)9 a reasonable am\nt ( "t1 b n lat] ?an #cj days aft] ! date on :i* an ag5cy submits a writt5 report "u subsection 7a71 ! head ( ! ag5cy %all provide to ! appropriate report+ entities writt5 updates1 :i* may include classifi$ annexes1 on ! major incid5t &1 to ! ext5t practicable1 provide a brief+1 :i* may include a classifi$ compon5t1 to ! congressional committees describ$ 9 subsection 7a77#a71 includ+ summ>ies (-- 7#a7 vuln]abilities1 means by :i* ! major incid5t occurr$1 & impacts to ! ag5cy relat+ to ! major incid5t2 7#b7 any risk assessm5t & subsequ5t risk-bas$ security implem5tation ( ! affect$ in=mation sy/em be=e ! date on :i* ! major incid5t occurr$2 7#c7 ! /atus ( compliance ( ! affect$ in=mation sy/em ) applicable security requirem5ts t are directly relat$ to ! cause ( ! incid5t1 at ! "t ( ! major incid5t2 7#d7 an e/imate ( ! numb] ( individuals pot5tially affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 7#e7 an assessm5t ( ! risk ( h>m to individuals pot5tially affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 7#f7 an update to ! assessm5t ( ! risk to ag5cy op]ations1 or to impacts on o!r ag5cy or non-,f$]al entity op]ations1 affect$ by ! major incid5t bas$ on in=mation available to ag5cy (ficials z ( ! date on :i* ! ag5cy provides ! update2 7#g7 ! detection1 response1 & rem$iation actions ( ! ag5cy1 includ+ any support provid$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u section #ceid7;d7 & /atus updates on ! notification process describ$ 9 section #ceib7;a71 includ+ any delay describ$ 9 section #ceib7;c71 if applicable2 & 7#h7 if applicable1 a description ( any circum/ances or data lead+ ! head ( ! ag5cy to det]m9e1 pursuant to section #ceib7;a77#a71 n to notify individuals pot5tially impact$ by a brea*4 7c7 ,update report ,if ! ag5cy det]m9es t !re is any significant *ange 9 ! und]/&+ ( ! ag5cy ( ! scope1 scale1 or consequ5ce ( a major incid5t = :i* an ag5cy submitt$ a writt5 report "u subsection 7a71 ! ag5cy %all provide an updat$ report to ! appropriate report+ entities t includes in=mation relat+ to ! *ange 9 und]/&+4 7d7 ,biannual report ,ea* ag5cy %all submit z "p ( ! biannual report requir$ "u section #ceed7;c77#a7 ( ?is title a description ( ea* major incid5t t occurr$ dur+ ! #b-ye> p]iod prec$+ ! date on :i* ! biannual report is submitt$4 7e7 ,delay & lack ( notification report 7#a7 ,9 g5]al ,! ,director %all submit to ! appropriate report+ entities an annual report on all notification delays grant$ pursuant to section #ceib7;c74 7#b7 ,lack ( brea* notification ,! ,director %all submit to ! appropriate report+ entities an annual report on ea* brea* ) respect to :i* ! head ( an ag5cy det]m9$1 pursuant to section #ceib7;a77#a71 n to notify individuals pot5tially impact$ by ! brea*4 7#c7 ,compon5t ( o!r report ,! ,director may submit ! report requir$ "u p>agraph 7#a7 z a compon5t ( ! annual report submitt$ "u section #ceig7;b74 7f7 ,report deliv]y ,any writt5 report requir$ to be submitt$ "u ?is section may be submitt$ 9 a pap] or electronic =mat4 7g7 ,?reat brief+ 7#a7 ,9 g5]al ,n lat] ?an #g days aft] ! date on :i* an ag5cy has a reasonable basis to conclude t a major incid5t occurr$1 ! head ( ! ag5cy1 jo9tly ) ! ,director1 ! ,national ,cyb] ,director & any o!r ,f$]al entity det]m9$ appropriate by ! ,national ,cyb] ,director1 %all provide a brief+ to ! congressional committees describ$ 9 subsection 7a77#a7 on ! ?reat caus+ ! major incid5t4 7#b7 ,compon5ts ,! brief+ requir$ "u p>agraph 7#a7-- 7,a7 %all1 to ! greate/ ext5t practicable1 include an unclassifi$ compon5t2 & 7,b7 may include a classifi$ compon5t4 7h7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to limit-- 7#a7 ! ability ( an ag5cy to provide additional reports or brief+s to ,congress2 or 7#b7 ,congress f reque/+ additional in=mation f ag5cies ?r\gh reports1 brief+s1 or o!r means4 #ceid4 ,gov]nm5t in=mation %>+ & incid5t response 7a7 ,9 g5]al 7#a7 ,incid5t report+ ,subject to ! limitations describ$ 9 subsection 7b71 ! head ( ea* ag5cy %all provide any in=mation relat+ to any incid5t affect+ ! ag5cy1 :e!r ! in=mation is obta9$ by ! ,f$]al ,gov]nm5t directly or indirectly1 to ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#b7 ,cont5ts ,a provision ( in=mation relat+ to an incid5t made by ! head ( an ag5cy "u p>agraph 7#a7 %all-- 7,a7 include detail$ in=mation ab\t ! safegu>ds t 7 9 place :5 ! incid5t occurr$2 7,b7 :e!r ! ag5cy implem5t$ ! safegu>ds describ$ 9 subp>agraph 7,a7 correctly2 7,c7 9 ord] to protect aga9/ a simil> incid5t1 id5tify-- 7i7 h[ ! safegu>ds describ$ 9 subp>agraph 7,a7 %\ld be implem5t$ diff]5tly2 & 7ii7 additional necess>y safegu>ds2 & 7,d7 include in=mation to aid 9 incid5t response1 su* z-- 7i7 a description ( ! affect$ sy/ems or networks2 7ii7 ! e/imat$ dates ( :5 ! incid5t occurr$2 & 7iii7 in=mation t c\ld reasonably help id5tify ! p>ty t conduct$ ! incid5t or ! cause ( ! incid5t1 subject to appropriate privacy protections4 7#c7 ,in=mation %>+ ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 make incid5t in=mation provid$ "u p>agraph 7#a7 available to ! ,director & ! ,national ,cyb] ,director2 7,b7 to ! greate/ ext5t practicable1 %>e in=mation relat+ to an incid5t ) ! head ( any ag5cy t may be-- 7i7 impact$ by ! incid5t2 7ii7 simil>ly susceptible to ! incid5t2 or 7iii7 simil>ly t>get$ by ! incid5t2 & 7,c7 coord9ate any necess>y in=mation %>+ ef=ts relat+ to a major incid5t ) ! private sector4 7#d7 ,national security sy/ems ,ea* ag5cy op]at+ or ex]cis+ control ( a national security sy/em %all %>e in=mation ab\t incid5ts t occur on national security sy/ems ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to ! ext5t consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t4 7b7 ,compliance ,9 provid+ in=mation & select+ a me?od to provide in=mation "u subsection 7a71 ! head ( ea* ag5cy %all take into acc\nt ! level ( classification ( ! in=mation & any in=mation %>+ limitations & protections1 su* z limitations & protections relat+ to law en=cem5t1 national security1 privacy1 /ati/ical confid5tiality1 or o!r factors det]m9$ by ! ,director 9 ord] to implem5t subsection 7a77#a7 9 a mann] t enables automat$ & consi/5t report+ to ! greate/ ext5t practicable4 7c7 ,incid5t response ,ea* ag5cy t has a reasonable basis to conclude t a major incid5t occurr$ involv+ ,f$]al in=mation 9 electronic m$ium or =m t does n exclusively involve a national security sy/em1 reg>dless ( delays f notification grant$ = a major incid5t t is also a brea*1 %all coord9ate ) ! ,cyb]security & ,infra/ructure ,security ,ag5cy to facilitate asset response activities & provide recomm5dations = mitigat+ future incid5ts4 #ceie4 ,responsibilities ( contractors & aw>dees 7a7 ,report+ 7#a7 ,9 g5]al ,unless o!rwise specifi$ 9 a contract1 grant1 coop]ative agreem5t1 or an o!r transaction agreem5t1 any contractor or aw>dee ( an ag5cy %all report to ! ag5cy )9 ! same am\nt ( "t su* ag5cy is requir$ to report an incid5t to ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 if ! contractor or aw>dee has a reasonable basis to suspect or conclude t-- 7,a7 an incid5t or brea* has occurr$ ) respect to ,f$]al in=mation collect$1 us$1 or ma9ta9$ by ! contractor or aw>dee 9 connection ) ! contract1 grant1 coop]ative agreem5t1 or o!r transaction agreem5t ( ! contractor or aw>dee2 7,b7 an incid5t or brea* has occurr$ ) respect to a ,f$]al in=mation sy/em us$ or op]at$ by ! contractor or aw>dee 9 connection ) ! contract1 grant1 coop]ative agreem5t1 or o!r transaction agreem5t ( ! contractor or aw>dee2 or 7,c7 ! contractor or aw>dee has receiv$ in=mation f ! ag5cy t ! contractor or aw>dee is n au?oriz$ to receive 9 connection ) ! contract1 grant1 coop]ative agreem5t1 or o!r transaction agreem5t ( ! contractor or aw>dee4 7#b7 ,proc$ures 7,a7 ,major incid5t ,foll[+ a report ( a brea* or major incid5t by a contractor or aw>dee "u p>agraph 7#a71 ! ag5cy1 9 consultation ) ! contractor or aw>dee1 %all c>ry out ! requirem5ts "u sections #ceib1 #ceic1 & #ceid ) respect to ! major incid5t4 7,b7 ,incid5t ,foll[+ a report ( an incid5t by a contractor or aw>dee "u p>agraph 7#a71 an ag5cy1 9 consultation ) ! contractor or aw>dee1 %all c>ry out ! requirem5ts "u section #ceid ) respect to ! incid5t4 7b7 ,effective date ,?is section %all apply-- 7#a7 on & aft] ! date t is #a ye> aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb2 & 7#b7 ) respect to any contract ent]$ into on or aft] ! date describ$ 9 p>agraph 7#a74 #ceif4 ,tra9+ 7a7 ,cov]$ individual def9$ ,9 ?is section1 ! t]m cov]$ individual means an individual :o obta9s access to ,f$]al in=mation or ,f$]al in=mation sy/ems because ( ! /atus ( ! individual z an employee1 contractor1 aw>dee1 volunte]1 or int]n ( an ag5cy4 7b7 ,requirem5t ,! head ( ea* ag5cy %all develop tra9+ = cov]$ individuals on h[ to id5tify & respond to an incid5t1 includ+-- 7#a7 ! int]nal process ( ! ag5cy = report+ an incid5t2 & 7#b7 ! obligation ( a cov]$ individual to report to ! ag5cy a confirm$ major incid5t & any suspect$ incid5t involv+ in=mation 9 any m$ium or =m1 includ+ pap]1 oral1 & electronic4 7c7 ,inclusion 9 annual tra9+ ,! tra9+ develop$ "u subsection 7b7 may be includ$ z "p ( an annual privacy or security aw>5ess tra9+ ( an ag5cy4 #ceig4 ,analysis & report on ,f$]al incid5ts 7a7 ,analysis ( f$]al incid5ts 7#a7 ,quantitative & qualitative analyses ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop1 9 consultation ) ! ,director & ! ,national ,cyb] ,director1 & p]=m cont9u\s monitor+ & quantitative & qualitative analyses ( incid5ts at ag5cies1 includ+ major incid5ts1 includ+-- 7,a7 ! causes ( incid5ts1 includ+-- 7i7 attack] tactics1 te*niques1 & proc$ures2 & 7ii7 sy/em vuln]abilities1 includ+ z]o days1 unpat*$ sy/ems1 & in=mation sy/em misconfigurations2 7,b7 ! scope & scale ( incid5ts at ag5cies2 7,c7 common root causes ( incid5ts across multiple ,f$]al ag5cies2 7,d7 ag5cy incid5t response1 recov]y1 & rem$iation actions & ! effectiv5ess ( ^? actions1 z applicable2 7,e7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,f7 tr5ds across multiple ,f$]al ag5cies to address intrusion detection & incid5t response capabilities us+ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c774 7#b7 ,automat$ analysis ,! analyses develop$ "u p>agraph 7#a7 %all1 to ! greate/ ext5t practicable1 use ma*9e readable data1 automation1 & ma*9e le>n+ processes4 7#c7 ,%>+ ( data & analysis 7,a7 ,9 g5]al ,! ,director %all %>e on an ongo+ basis ! analyses requir$ "u ?is subsection ) ag5cies & ! ,national ,cyb] ,director to-- 7i7 improve ! und]/&+ ( cyb]security risk ( ag5cies2 & 7ii7 support ! cyb]security improvem5t ef=ts ( ag5cies4 7,b7 ,=mat ,9 c>ry+ out subp>agraph 7,a71 ! ,director %all %>e ! analyses-- 7i7 9 human-readable writt5 products2 & 7ii7 to ! greate/ ext5t practicable1 9 ma*9e-readable =mats 9 ord] to enable automat$ intake & use by ag5cies4 7b7 ,annual report on ,f$]al incid5ts ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is section1 & n less frequ5tly ?an annually !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 ! ,national ,cyb] ,director & ! heads ( o!r ,f$]al ag5cies1 z appropriate1 %all submit to ! appropriate report+ entities a report t includes-- 7#a7 a summ>y ( causes ( incid5ts f across ! ,f$]al ,gov]nm5t t categorizes ^? incid5ts z incid5ts or major incid5ts2 7#b7 ! quantitative & qualitative analyses ( incid5ts develop$ "u subsection 7a77#a7 on an ag5cy-by-ag5cy basis & compreh5sively across ! ,f$]al ,gov]nm5t1 includ+-- 7,a7 a specific analysis ( brea*es2 & 7,b7 an analysis ( ! ,f$]al ,gov]nm5t's p]=mance aga9/ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c772 & 7#c7 an annex = ea* ag5cy t includes-- 7,a7 a description ( ea* major incid5t2 7,b7 ! total numb] ( incid5ts ( ! ag5cy2 & 7,c7 an analysis ( ! ag5cy's p]=mance aga9/ ! metrics e/abli%$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c774 7c7 ,publication 7#a7 ,9 g5]al ,a v]sion ( ea* report submitt$ "u subsection 7b7 %all be made publicly available on ! website ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy dur+ ! ye> 9 :i* ! report is submitt$4 7#b7 ,exemption ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy may exempt all or a portion ( a report describ$ 9 p>agraph 7#a7 f public publication if ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy det]m9es ! exemption is 9 ! int]e/ ( national security4 7#c7 ,limitation on exemption ,an exemption grant$ "u p>agraph 7#b7 %all n apply to any v]sion ( a report submitt$ to ! appropriate report+ entities "u subsection 7b74 7d7 ,in=mation provid$ by ag5cies 7#a7 ,9 g5]al ,! analysis requir$ "u subsection 7a7 & ea* report submitt$ "u subsection 7b7 %all use in=mation provid$ by ag5cies "u section #ceid7;a74 7#b7 ,noncompliance reports 7,a7 ,9 g5]al ,subject to subp>agraph 7,b71 dur+ any ye> dur+ :i* ! head ( an ag5cy does n provide data = an incid5t to ! ,cyb]security & ,infra/ructure ,security ,ag5cy 9 accordance ) section #ceid7;a71 ! head ( ! ag5cy1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,director1 %all submit to ! appropriate report+ entities a report t includes ! in=mation describ$ 9 subsection 7b7 ) respect to ! ag5cy4 7,b7 ,exception = national security sy/ems ,! head ( an ag5cy t owns or ex]cises control ( a national security sy/em %all n include data = an incid5t t occurs on a national security sy/em 9 any report submitt$ "u subp>agraph 7,a74 7#c7 ,national security sy/em reports 7,a7 ,9 g5]al ,annually1 ! head ( an ag5cy t op]ates or ex]cises control ( a national security sy/em %all submit a report t includes ! in=mation describ$ 9 subsection 7b7 ) respect to ! national security sy/em to ! ext5t t ! submission is consi/5t ) /&>ds & guidel9es = national security sy/ems issu$ 9 accordance ) law & z direct$ by ! ,presid5t to-- 7i7 ! majority & m9ority lead]s ( ! ,s5ate1 7ii7 ! ,speak] & m9ority lead] ( ! ,h\se ( ,repres5tatives2 7iii7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate2 7iv7 ! ,select ,committee on ,intellig5ce ( ! ,s5ate2 7v7 ! ,committee on ,arm$ ,s]vices ( ! ,s5ate2 7vi7 ! ,committee on ,appropriations ( ! ,s5ate2 7vii7 ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives2 7viii7 ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives2 7ix7 ! ,p]man5t ,select ,committee on ,intellig5ce ( ! ,h\se ( ,repres5tatives2 7x7 ! ,committee on ,arm$ ,s]vices ( ! ,h\se ( ,repres5tatives2 & 7xi7 ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives4 7,b7 ,classifi$ =m ,a report requir$ "u subp>agraph 7,a7 may be submitt$ 9 a classifi$ =m4 7e7 ,requirem5t = compil+ in=mation ,9 publi%+ ! public report requir$ "u subsection 7c71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all suffici5tly compile in=mation su* t no specific incid5t ( an ag5cy c be id5tifi$1 except ) ! concurr5ce ( ! ,director ( ! ,(fice ( ,managem5t & ,budget & 9 consultation ) ! impact$ ag5cy4 #ceih4 ,major incid5t def9ition 7a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 %all develop & promulgate guidance on ! def9ition ( ! t]m major incid5t = ! purposes ( sub*apt] ,,ii & ?is sub*apt]4 7b7 ,requirem5ts ,) respect to ! guidance issu$ "u subsection 7a71 ! def9ition ( ! t]m major incid5t %all-- 7#a7 include1 ) respect to any in=mation collect$ or ma9ta9$ by or on behalf ( an ag5cy or an in=mation sy/em us$ or op]at$ by an ag5cy or by a contractor ( an ag5cy or ano!r organization on behalf ( an ag5cy-- 7,a7 any incid5t ! head ( ! ag5cy det]m9es is likely to h an impact on-- 7i7 ! national security1 homel& security1 or economic security ( ! ,unit$ ,/ates2 or 7ii7 ! civil lib]ties or public heal? & safety ( ! p ( ! ,unit$ ,/ates2 7,b7 any incid5t ! head ( ! ag5cy det]m9es likely to result 9 an inability = ! ag5cy1 a compon5t ( ! ag5cy1 or ! ,f$]al ,gov]nm5t1 to provide #a or m critical s]vices2 7,c7 any incid5t t ! head ( an ag5cy1 9 consultation ) a s5ior privacy (fic] ( ! ag5cy1 det]m9es is likely to h a significant privacy impact on #a or m individual2 7,d7 any incid5t t ! head ( ! ag5cy1 9 consultation ) a s5ior privacy (ficial ( ! ag5cy1 det]m9es is likely to h a sub/antial privacy impact on a significant numb] ( individuals2 7,e7 any incid5t ! head ( ! ag5cy det]m9es sub/antially disrupts ! op]ations ( a high value asset own$ or op]at$ by ! ag5cy2 7,f7 any incid5t involv+ ! exposure ( s5sitive ag5cy in=mation to a =eign entity1 su* z ! communications ( ! head ( ! ag5cy1 ! head ( a compon5t ( ! ag5cy1 or ! direct reports ( ! head ( ! ag5cy or ! head ( a compon5t ( ! ag5cy2 & 7,g7 any o!r type ( incid5t det]m9$ appropriate by ! ,director2 7#b7 /ipulate t ! ,national ,cyb] ,director1 9 consultation ) ! ,director1 %all decl>e a major incid5t at ea* ag5cy impact$ by an incid5t if x is det]m9$ t an incid5t-- 7,a7 occurs at n less ?an #b ag5cies2 & 7,b7 is enabl$ by-- 7i7 a common te*nical root cause1 su* z a supply *a9 compromise1 a common s(tw>e or h>dw>e vuln]ability2 or 7ii7 ! relat$ activities ( a common ?reat actor2 & 7#c7 /ipulate t1 9 det]m9+ :e!r an incid5t con/itutes a major incid5t because t incid5t is any incid5t describ$ 9 p>agraph 7#a71 ! head ( ! ag5cy %all consult ) ! ,national ,cyb] ,director & may consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,significant numb] ( individuals ,9 det]m9+ :at con/itutes a significant numb] ( individuals "u subsection 7b77#a77;,d71 ! ,director-- 7#a7 may det]m9e a ?re%old = a m9imum numb] ( individuals t con/itutes a significant am\nt2 & 7#b7 may n det]m9e a ?re%old describ$ 9 p>agraph 7#a7 t exce$s #e1jjj individuals4 7d7 ,evaluation & updates ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb1 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director %all provide a brief+ to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives1 :i* %all include-- 7#a7 an evaluation ( any necess>y updates to ! guidance issu$ "u subsection 7a72 7#b7 an evaluation ( any necess>y updates to ! def9ition ( ! t]m major incid5t includ$ 9 ! guidance issu$ "u subsection 7a72 & 7#c7 an explanation (1 & ! analysis t l$ to1 ! def9ition describ$ 9 p>agraph 7#b74 4 7#b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 ,,sub*apt] ,,iv--,f$]al ,sy/em ,incid5t ,response #ceia4 ,def9itions#ceib4 ,notification ( brea*#ceic4 ,congressional & ,executive ,bran* reports#ceid4 ,gov]nm5t in=mation %>+ & incid5t response#ceie4 ,responsibilities ( contractors & aw>dees#ceif4 ,tra9+#ceig4 ,analysis & report on ,f$]al incid5ts#ceih4 ,major incid5t def9ition 4 #ajd4 ,am5dm5ts to subtitle ,,iii ( title #dj 7a7 ,mod]niz+ ,gov]nm5t ,te*nology ,subtitle ,g ( title ,x ( ,division ,a ( ! ,national ,def5se ,au?orization ,act = ,fiscal ,ye> #bjah 7#dj ,u4,s4,c4 #aacja note7 is am5d$ 9 section #ajgh-- 7#a7 by /rik+ subsection 7a7 & ins]t+ ! foll[+3 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 ! t]m 9 section #eea ( title #e1 ,unit$ ,/ates ,code4 7#b7 ,high value asset ,! t]m high value asset has ! mean+ giv5 ! t]m 9 section #ceeb ( title #dd1 ,unit$ ,/ates ,code4 2 7#b7 9 subsection 7b71 by add+ at ! end ! foll[+3 7#h7 ,proposal evaluation ,! ,director %all-- 7,a7 give consid]ation = ! use ( am\nts 9 ! ,fund to improve ! security ( high value assets2 & 7,b7 require t any proposal = ! use ( am\nts 9 ! ,fund includes a cyb]security plan1 includ+ a supply *a9 risk managem5t plan1 to be review$ by ! memb] ( ! ,te*nology ,mod]nization ,bo>d describ$ 9 subsection 7c77#e77;,c74 2 & 7#c7 9 subsection 7c7-- 7,a7 9 p>agraph 7#b77;,a77i71 by ins]t+ 1 includ+ a consid]ation ( ! impact on high value assets aft] op]ational risks2 7,b7 9 p>agraph 7#e7-- 7i7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,b71 by /rik+ ! p]iod at ! end & ins]t+ &2 & 7iii7 by add+ at ! end ! foll[+3 7,c7 a s5ior (ficial f ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security1 appo9t$ by ! ,director4 2 & 7,c7 9 p>agraph 7#f77;,a71 by /rik+ %all be-- & all t foll[s ?r\gh #d employees & ins]t+ %all be #d employees4 7b7 ,sub*apt] ,i ,sub*apt] ,i ( *apt] #aac ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacjb-- 7,a7 9 subsection 7b71 by /rik+ use1 security1 & disposal ( & ins]t+ use1 & disposal (1 &1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director1 promote & improve ! security (12 7,b7 9 subsection 7c7-- 7i7 9 p>agraph 7#c7-- 7,i7 9 subp>agraph 7,a7-- 7aa7 by /rik+ includ+ data & ins]t+ :i* %all-- 7i7 include data 2 & 7bb7 by add+ at ! end ! foll[+3 7ii7 specifically d5ote cyb]security fund+ "u ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g7 ( title #dd4 2 & 7,,ii7 9 subp>agraph 7,b71 by add+ at ! end ! foll[+3 7iii7 ,! ,director %all provide to ! ,national ,cyb] ,director any cyb]security fund+ in=mation describ$ 9 subp>agraph 7,a77ii7 t is provid$ to ! ,director "u clause 7ii7 ( ?is subp>agraph4 2 7,c7 9 subsection 7f7-- 7i7 by /rik+ heads ( executive ag5cies to develop & ins]t+ 8heads ( executive ag5cies to-- 7#a7 develop 2 7ii7 9 p>agraph 7#a71 z s designat$1 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7#b7 consult ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = ! developm5t & use ( supply *a9 security be/ practices4 2 & 7,d7 9 subsection 7h71 by ins]t+ 1 includ+ cyb]security p]=mances1 aft] ! p]=mances2 & 7#b7 9 section #aacjc7;b7-- 7,a7 9 p>agraph 7#b77;,b7-- 7i7 9 clause 7i71 by /rik+ or at ! end2 7ii7 9 clause 7ii71 by add+ or at ! end2 & 7iii7 by add+ at ! end ! foll[+3 7iii7 :e!r ! function %\ld be p]=m$ by a %>$ s]vice (f]$ by ano!r executive ag5cy2 2 & 7,b7 9 p>agraph 7#e77;,b77i71 by ins]t+ 1 :ile tak+ into acc\nt ! risk-bas$ cyb] budget model develop$ pursuant to section #ceec7;a77#g7 ( title #dd aft] title #ca4 7c7 ,sub*apt] ,,ii ,sub*apt] ,,ii ( *apt] #aac ( subtitle ,,iii ( title #dj1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 section #aacab7;a71 by ins]t+ 1 includ+ security risks aft] manag+ ! risks2 7#b7 9 section #aacac7a71 by /rik+ effici5cy & effectiv5ess & ins]t+ effici5cy1 security1 & effectiv5ess2 7#c7 9 section #aacae1 by add+ at ! end ! foll[+3 7d7 ,compon5t ag5cy *ief in=mation (fic]s ,! ,*ief ,in=mation ,(fic] or an equival5t (ficial ( a compon5t ag5cy %all report to-- 7#a7 ! ,*ief ,in=mation ,(fic] designat$ "u section #cejf7;a77#b7 ( title #dd or an equival5t (ficial ( ! ag5cy ( :i* ! compon5t ag5cy is a compon5t2 & 7#b7 ! head ( ! compon5t ag5cy4 7e7 ,report+ /ructure exemption 7#a7 ,9 g5]al ,on annual basis1 ! ,director may exempt any ag5cy f ! report+ /ructure requirem5ts "u subsection 7d74 7#b7 ,report ,on an annual basis1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report t includes a li/ ( ea* exemption grant$ "u p>agraph 7#a7 & ! associat$ rationale = ea* exemption4 7#c7 ,compon5t ( o!r report ,! report requir$ "u p>agraph 7#b7 may be incorporat$ into any o!r annual report requir$ "u *apt] #ce ( title #dd1 ,unit$ ,/ates ,code4 2 7#d7 9 section #aacag1 by ins]t+ security1 be=e or s*$ule2 & 7#e7 9 section #aacai7;b77#a71 9 ! p>agraph head+1 by /rik+ ,,cios & ins]t+ ,*ief ,in=mation ,(fic]s4 #aje4 ,actions to enhance ,f$]al incid5t transp>5cy 7a7 ,responsibilities ( ! cyb]security & infra/ructure security ag5cy 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7,a7 develop a plan = ! developm5t ( ! analysis requir$ "u section #ceig7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title1 & ! report requir$ "u subsection 7b7 ( t section t includes-- 7i7 a description ( any *all5ges ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy anticipates enc\nt]+2 & 7ii7 ! use ( automation & ma*9e-readable =mats = collect+1 compil+1 monitor+1 & analyz+ data2 & 7,b7 provide to ! appropriate congressional committees a brief+ on ! plan develop$ "u subp>agraph 7,a74 7#b7 ,brief+ ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! appropriate congressional committees a brief+ on-- 7,a7 ! execution ( ! plan requir$ "u p>agraph 7#a77;,a72 & 7,b7 ! developm5t ( ! report requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title4 7b7 ,responsibilities ( ! director ( ! (fice ( managem5t & budget 7#a7 ,,fisma ,section #b ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad 7#dd ,u4,s4,c4 #ceed note7 is am5d$-- 7,a7 by /rik+ subsection 7b72 & 7,b7 by r$esignat+ subsections 7c7 ?r\gh 7f7 z subsections 7b7 ?r\gh 7e71 respectively4 7#b7 ,incid5t data %>+ 7,a7 ,9 g5]al ,! ,director %all develop guidance1 to be updat$ n less frequ5tly ?an once e #b ye>s1 on ! cont5t1 timel9ess1 & =mat ( ! in=mation provid$ by ag5cies "u section #ceid7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title4 7,b7 ,requirem5ts ,! guidance develop$ "u subp>agraph 7,a7 %all-- 7i7 prioritize ! availability ( data necess>y to und]/& & analyze-- 7,i7 ! causes ( incid5ts2 7,,ii7 ! scope & scale ( incid5ts )9 ! environm5ts & sy/ems ( an ag5cy2 7,,iii7 a root cause analysis ( incid5ts t-- 7aa7 are common across ! ,f$]al ,gov]nm5t2 or 7bb7 h a ,gov]nm5t-wide impact2 7,,iv7 ag5cy response1 recov]y1 & rem$iation actions & ! effectiv5ess ( ^? actions2 & 7,v7 ! impact ( incid5ts2 7ii7 enable ! effici5t developm5t (-- 7,i7 lessons le>n$ & recomm5dations 9 respond+ to1 recov]+ f1 rem$iat+1 & mitigat+ future incid5ts2 & 7,,ii7 ! report on ,f$]al incid5ts requir$ "u section #ceig7;b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title2 7iii7 include requirem5ts = ! timel9ess ( data production2 & 7iv7 include requirem5ts = us+ automation & ma*9e-readable data = data %>+ & availability4 7#c7 ,guidance on respond+ to in=mation reque/s ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all develop guidance = ag5cies to implem5t ! requirem5t "u section #ceid7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title1 to provide in=mation to o!r ag5cies exp]i5c+ incid5ts4 7#d7 ,/&>d guidance & templates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop guidance & templates1 to be review$ &1 if necess>y1 updat$ n less frequ5tly ?an once e #b ye>s1 = use by ,f$]al ag5cies 9 ! activities requir$ "u sections #ceib1 #ceic1 & #ceif ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title4 7#e7 ,contractor & aw>dee guidance 7,a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,secret>y ( ,homel& ,security1 ! ,secret>y ( ,def5se1 ! ,adm9i/rator ( ,g5]al ,s]vices1 & ! heads ( o!r ag5cies det]m9$ appropriate by ! ,director1 %all issue guidance to ,f$]al ag5cies on h[ to deconflict1 to ! greate/ ext5t practicable1 exi/+ regulations1 policies1 & proc$ures relat+ to ! responsibilities ( contractors & aw>dees e/abli%$ "u section #ceie ( title #dd1 ,unit$ ,/ates ,code1 z add$ by ?is title4 7,b7 ,exi/+ processes ,to ! greate/ ext5t practicable1 ! guidance issu$ "u subp>agraph 7,a7 %all all[ contractors & aw>dees to use exi/+ processes = notify+ ,f$]al ag5cies ( incid5ts involv+ in=mation ( ! ,f$]al ,gov]nm5t4 7#f7 ,updat$ brief+s ,n less frequ5tly ?an once e #b ye>s1 ! ,director %all provide to ! appropriate congressional committees an update on ! guidance & templates develop$ "u p>agraphs 7#b7 ?r\gh 7#d74 7c7 ,update to ! privacy act ( #aigd ,section #eeb;a7b7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,privacy ,act ( #aigd7 is am5d$-- 7#a7 9 p>agraph 7#aa71 by /rik+ or at ! end2 7#b7 9 p>agraph 7#ab71 by /rik+ ! p]iod at ! end & ins]t+ 2 or2 & 7#c7 by add+ at ! end ! foll[+3 7#ac7 to ano!r ag5cy 9 fur!rance ( a response to an incid5t 7z def9$ 9 section #ceeb ( title #dd7 & pursuant to ! in=mation %>+ requirem5ts 9 section #ceid ( title #dd if ! head ( ! reque/+ ag5cy has made a writt5 reque/ to ! ag5cy t ma9ta9s ! record specify+ ! p>ticul> portion desir$ & ! activity = :i* ! record is s\ght4 4 #ajf4 ,additional guidance to ag5cies on ,,fisma updates ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance = ag5cies on-- 7#a7 p]=m+ ! ongo+ & cont9u\s ag5cy sy/em risk assessm5t requir$ "u section #ceed7;a77#a77;,a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is title2 7#b7 implem5t+ additional cyb]security proc$ures1 :i* %all include res\rces = %>$ s]vices2 7#c7 e/abli%+ a process = provid+ ! /atus ( ea* rem$ial action "u section #ceed7;b77#g7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by ?is title1 to ! ,director & ! ,cyb]security & ,infra/ructure ,security ,ag5cy us+ automation & ma*9e-readable data1 z practicable1 :i* %all include-- 7,a7 specific guidance = ! use ( automation & ma*9e-readable data2 & 7,b7 templates = provid+ ! /atus ( ! rem$ial action2 & 7#d7 a requirem5t to coord9ate ) inspectors g5]al ( ag5cies to ensure consi/5t und]/&+ & application ( ag5cy policies = ! purpose ( evaluations by inspectors g5]al4 #ajg4 ,ag5cy requirem5ts to notify private sector entities impact$ by incid5ts 7a7 ,def9itions ,9 ?is section3 7#a7 ,report+ entity ,! t]m report+ entity means private organization or gov]nm5tal unit t is requir$ by /atute or regulation to submit s5sitive in=mation to an ag5cy4 7#b7 ,s5sitive in=mation ,! t]m s5sitive in=mation has ! mean+ giv5 ! t]m by ! ,director 9 guidance issu$ "u subsection 7b74 7b7 ,guidance on notification ( report+ entities ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue guidance requir+ ! head ( ea* ag5cy to notify a report+ entity ( an incid5t t is likely to sub/antially affect-- 7#a7 ! confid5tiality or integrity ( s5sitive in=mation submitt$ by ! report+ entity to ! ag5cy pursuant to a /atutory or regulatory requirem5t2 or 7#b7 ! ag5cy in=mation sy/em or sy/ems us$ 9 ! transmission or /orage ( ! s5sitive in=mation describ$ 9 p>agraph 7#a74 #ajh4 ,mobile security /&>ds 7a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all-- 7#a7 evaluate mobile application security guidance promulgat$ by ! ,director2 & 7#b7 issue guidance to secure mobile devices1 includ+ = mobile applications1 = e ag5cy4 7b7 ,cont5ts ,! guidance issu$ "u subsection 7a77#b7 %all include-- 7#a7 a requirem5t1 pursuant to section #cejf7;b77#d7 ( title #dd1 ,unit$ ,/ates ,code1 = e ag5cy to ma9ta9 a cont9u\s inv5tory ( e-- 7,a7 mobile device op]at$ by or on behalf ( ! ag5cy2 & 7,b7 vuln]ability id5tifi$ by ! ag5cy associat$ ) a mobile device2 & 7#b7 a requirem5t = e ag5cy to p]=m cont9u\s evaluation ( ! vuln]abilities describ$ 9 p>agraph 7#a77;,b7 & o!r risks associat$ ) ! use ( applications on mobile devices4 7c7 ,in=mation %>+ ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies = %>+ ! inv5tory ( ! ag5cy requir$ "u subsection 7b77#a7 ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 us+ automation & ma*9e-readable data to ! greate/ ext5t practicable4 7d7 ,brief+ ,n lat] ?an #fj days aft] ! date on :i* ! ,director issues guidance "u subsection 7a77#b71 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all provide to ! appropriate congressional committees a brief+ on ! guidance4 #aji4 ,data & logg+ ret5tion = incid5t response 7a7 ,recomm5dations ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 & n less frequ5tly ?an e #b ye>s !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,attorney ,g5]al1 %all submit to ! ,director recomm5dations on requirem5ts = logg+ ev5ts on ag5cy sy/ems & reta9+ o!r relevant data )9 ! sy/ems & networks ( an ag5cy4 7b7 ,cont5ts ,! recomm5dations provid$ "u subsection 7a7 %all include-- 7#a7 ! types ( logs to be ma9ta9$2 7#b7 ! duration t logs & o!r relevant data %\ld be reta9$2 7#c7 ! "t p]iods = ag5cy implem5tation ( recomm5d$ logg+ & security requirem5ts2 7#d7 h[ to ensure ! confid5tiality1 integrity1 & availability ( logs2 7#e7 requirem5ts to ensure t1 ^u reque/1 9 a mann] t excludes or o!rwise reasonably protects p]sonally id5tifiable in=mation1 & to ! ext5t p]mitt$ by applicable law 7includ+ privacy & /ati/ical laws71 ag5cies provide logs to-- 7,a7 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy = a cyb]security purpose2 & 7,b7 ! ,director ( ! ,f$]al ,bureau ( ,inve/igation1 or ! appropriate ,f$]al law en=cem5t ag5cy1 to inve/igate pot5tial crim9al activity2 & 7#f7 requirem5ts to ensure t1 subject to compliance ) /ati/ical laws & o!r relevant data protection requirem5ts1 ! highe/ level security op]ations c5t] ( ea* ag5cy has visibility into all ag5cy logs4 7c7 ,guidance ,n lat] ?an #ij days aft] receiv+ ! recomm5dations submitt$ "u subsection 7a71 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,attorney ,g5]al1 %all1 z det]m9$ to be appropriate by ! ,director1 update guidance to ag5cies reg>d+ requirem5ts = logg+1 log ret5tion1 log managem5t1 %>+ ( log data ) o!r appropriate ag5cies1 or any o!r logg+ activity det]m9$ to be appropriate by ! ,director4 7d7 ,sunset ,?is section %all cease to h =ce or effect on ! date t is #aj ye>s aft] ! date ( ! enactm5t ( ?is ,act4 #aaj4 ,,cisa ag5cy advisors 7a7 ,9 g5]al ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all assign n less ?an #a cyb]security pr(essional employ$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy to be ! ,cyb]security & ,infra/ructure ,security ,ag5cy advisor to ! s5ior ag5cy in=mation security (fic] ( ea* ag5cy4 7b7 ,qualifications ,ea* advisor assign$ "u subsection 7a7 %all h k (-- 7#a7 cyb]security ?reats fac+ ag5cies1 includ+ any specific ?reats to ! assign$ ag5cy2 7#b7 p]=m+ risk assessm5ts ( ag5cy sy/ems2 & 7#c7 o!r ,f$]al cyb]security initiatives4 7c7 ,duties ,! duties ( ea* advisor assign$ "u subsection 7a7 %all include-- 7#a7 provid+ ongo+ assi/ance & advice1 z reque/$1 to ! ag5cy ,*ief ,in=mation ,(fic]2 7#b7 s]v+ z an incid5t response po9t ( contact betwe5 ! assign$ ag5cy & ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7#c7 famili>iz+ !mselves ) ag5cy sy/ems1 processes1 & proc$ures to bett] facilitate support to ! ag5cy 9 respond+ to incid5ts4 7d7 ,limitation ,an advisor assign$ "u subsection 7a7 %all n be a contractor4 7e7 ,multiple assignm5ts ,"o individual advisor may be assign$ to multiple ag5cy ,*ief ,in=mation ,(fic]s "u subsection 7a74 #aaa4 ,f$]al p5etration te/+ policy 7a7 ,9 g5]al ,sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+ 7a7 ,def9itions ,9 ?is section3 7#a7 ,ag5cy op]ational plan ,! t]m ag5cy op]ational plan means a plan ( an ag5cy = ! use ( p5etration te/+4 7#b7 ,rules ( engagem5t ,! t]m rules ( engagem5t means a set ( rules e/abli%$ by an ag5cy = ! use ( p5etration te/+4 7b7 ,guidance 7#a7 ,9 g5]al ,! ,director1 9 consultation ) ! ,secret>y1 act+ ?r\gh ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all issue guidance to ag5cies t-- 7,a7 requires ag5cies to use1 :5 & :]e appropriate1 p5etration te/+ on ag5cy sy/ems by bo? ,f$]al & non-,f$]al entities2 & 7,b7 requires ag5cies to develop an ag5cy op]ational plan & rules ( engagem5t t meet ! requirem5ts "u subsection 7c74 7#b7 ,p5etration te/+ guidance ,! guidance issu$ "u ?is section %all-- 7,a7 p]mit an ag5cy to use1 = ! purpose ( p]=m+ p5etration te/+-- 7i7 a %>$ s]vice ( ! ag5cy or ano!r ag5cy2 or 7ii7 an ext]nal entity1 su* z a v5dor2 & 7,b7 require ag5cies to provide ! rules ( engagem5t & results ( p5etration te/+ to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 )\t reg>d to ! /atus ( ! entity t p]=ms ! p5etration te/+4 7c7 ,ag5cy plans & rules ( engagem5t ,! ag5cy op]ational plan & rules ( engagem5t ( an ag5cy %all-- 7#a7 require ! ag5cy to-- 7,a7 p]=m p5etration te/+1 includ+ on ! high value assets ( ! ag5cy2 or 7,b7 coord9ate ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy to ensure t p5etration te/+ is be+ p]=m$2 7#b7 e/abli% guidel9es = avoid+1 z a result ( p5etration te/+-- 7,a7 adv]se impacts to ! op]ations ( ! ag5cy2 7,b7 adv]se impacts to op]ational environm5ts & sy/ems ( ! ag5cy2 & 7,c7 inappropriate access to data2 7#c7 require ! results ( p5etration te/+ to include fe$back to improve ! cyb]security ( ! ag5cy2 & 7#d7 include me*anisms = provid+ consi/5tly =matt$1 &1 if applicable1 automat$ & ma*9e-readable1 data to ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7d7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 e/abli% a process to assess ! p]=mance ( p5etration te/+ by bo? ,f$]al & non-,f$]al entities t e/abli%es m9imum quality controls = p5etration te/+2 7#b7 develop op]ational guidance = in/itut+ p5etration te/+ programs at ag5cies2 7#c7 develop & ma9ta9 a c5traliz$ capability to (f] p5etration te/+ z a s]vice to ,f$]al & non-,f$]al entities2 & 7#d7 provide guidance to ag5cies on ! be/ use ( p5etration te/+ res\rces4 7e7 ,responsibilities ( ,,omb ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all-- 7#a7 n less frequ5tly ?an annually1 inv5tory all ,f$]al p5etration te/+ assets2 & 7#b7 develop & ma9ta9 a /&>diz$ process = ! use ( p5etration te/+4 7f7 ,prioritization ( p5etration te/+ res\rces 7#a7 ,9 g5]al ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all develop a framework = prioritiz+ ,f$]al p5etration te/+ res\rces among ag5cies4 7#b7 ,consid]ations ,9 develop+ ! framework "u ?is subsection1 ! ,director %all consid]-- 7,a7 ag5cy sy/em risk assessm5ts p]=m$ "u section #ceed7;a77#a77;,a72 7,b7 ! ,f$]al risk assessm5t p]=m$ "u section #ceec7;i72 7,c7 ! analysis ( ,f$]al incid5t data p]=m$ "u section #ceig2 & 7,d7 any o!r in=mation det]m9$ appropriate by ! ,director or ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7g7 ,exception = national security sy/ems ,! guidance issu$ "u subsection 7b7 %all n apply to national security sy/ems4 7h7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director describ$ 9 subsection 7b7 %all be delegat$-- 7#a7 to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#b72 & 7#b7 to ! ,director ( ,national ,intellig5ce 9 ! case ( sy/ems describ$ 9 #ceec7;e77#c74 4 7b7 ,deadl9e = guidance ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all issue ! guidance requir$ "u section #ceei;,a7b7 ( title #dd1 ,unit$ ,/ates ,code1 z add$ by subsection 7a74 7c7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei ! foll[+3 #ceei;,a4 ,f$]al p5etration te/+4 4 7d7 ,sunset 7#a7 ,9 g5]al ,effective on ! date t is #aj ye>s aft] ! date ( enactm5t ( ?is ,act1 sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceei;,a4 7#b7 ,cl]ical am5dm5t ,effective on ! date t is #aj ye>s aft] ! date ( enactm5t ( ?is ,act1 ! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! item relat+ to section #ceei;,a4 #aab4 ,ongo+ ?reat hunt+ program 7a7 ,?reat hunt+ program 7#a7 ,9 g5]al ,n lat] ?an #edj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all e/abli% a program to provide ongo+1 hypo!sis-driv5 ?reat-hunt+ s]vices on ! network ( ea* ag5cy4 7#b7 ,plan ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% ! program requir$ "u p>agraph 7#a7 t describes h[ ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy plans to-- 7,a7 det]m9e ! me?od = collect+1 /or+1 access+1 analyz+1 & safegu>d+ appropriate ag5cy data2 7,b7 provide on-premises support to ag5cies2 7,c7 /aff ?reat hunt+ s]vices2 7,d7 allocate available human & f9ancial res\rces to implem5t ! plan2 & 7,e7 provide input to ! heads ( ag5cies on ! use ( additional cyb]security proc$ures "u section #ceed ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,reports ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! appropriate congressional committees-- 7#a7 n lat] ?an #cj days aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy completes ! plan requir$ "u subsection 7a77#b71 a report on ! plan to provide ?reat hunt+ s]vices to ag5cies2 7#b7 n less ?an #cj days be=e ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices "u ! program "u subsection 7a77#a71 a report provid+ any updates to ! plan develop$ "u subsection 7a77#b72 & 7#c7 n lat] ?an #a ye> aft] ! date on :i* ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy beg9s provid+ ?reat hunt+ s]vices to ag5cies o!r ?an ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 a report describ+ lessons le>n$ f provid+ ^? s]vices4 #aac4 ,codify+ vuln]ability disclosure programs 7a7 ,9 g5]al ,*apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ aft] section #ceei;,a1 z add$ by section #aaa ( ?is title1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs 7a7 ,purpose2 s5se ( ,congress 7#a7 ,purpose ,! purpose ( ,f$]al vuln]ability disclosure programs is to create a me*anism to use ! exp]tise ( ! public to provide a s]vice to ,f$]al ag5cies by id5tify+ in=mation sy/em vuln]abilities4 7#b7 ,s5se ( ,congress ,x is ! s5se ( ,congress t1 9 implem5t+ ! requirem5ts ( ?is section1 ! ,f$]al ,gov]nm5t %\ld take appropriate /eps to r$uce real & p]ceiv$ burd5s 9 communications betwe5 ag5cies & security rese>*]s4 7b7 ,def9itions ,9 ?is section3 7#a7 ,report ,! t]m report means a vuln]ability disclosure made to an ag5cy by a report]4 7#b7 ,report] ,! t]m report] means an individual t submits a vuln]ability report pursuant to ! vuln]ability disclosure process ( an ag5cy4 7c7 ,responsibilities ( ,,omb 7#a7 ,limitation on legal action ,! ,director1 9 consultation ) ! ,attorney ,g5]al1 %all issue guidance to ag5cies to n recomm5d or pursue legal action aga9/ a report] or an individual t conducts a security rese>* activity t ! head ( ! ag5cy det]m9es-- 7,a7 repres5ts a good fai? ef=t to foll[ ! vuln]ability disclosure policy ( ! ag5cy develop$ "u subsection 7e77#b72 & 7,b7 is au?oriz$ "u ! vuln]ability disclosure policy ( ! ag5cy develop$ "u subsection 7e77#b74 7#b7 ,%>+ in=mation ) ,,cisa ,! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & 9 consultation ) ! ,national ,cyb] ,director1 %all issue guidance to ag5cies on %>+ relevant in=mation 9 a consi/5t1 automat$1 & ma*9e readable mann] ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 includ+-- 7,a7 any valid or cr$ible reports ( newly discov]$ or n publicly kn[n vuln]abilities 7includ+ misconfigurations7 on ,f$]al in=mation sy/ems t use comm]cial s(tw>e or s]vices2 7,b7 in=mation relat+ to vuln]ability disclosure1 coord9ation1 or rem$iation activities ( an ag5cy1 p>ticul>ly z ^? activities relate to outside organizations-- 7i7 ) :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy c assi/2 or 7ii7 ab\t :i* ! head ( ! ag5cy believes ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %\ld "k2 & 7,c7 any o!r in=mation ) respect to :i* ! head ( ! ag5cy det]m9es helpful or necess>y to involve ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7#c7 ,ag5cy vuln]ability disclosure policies ,! ,director %all issue guidance to ag5cies on ! requir$ m9imum scope ( ag5cy sy/ems cov]$ by ! vuln]ability disclosure policy ( an ag5cy requir$ "u subsection 7e77#b74 7d7 ,responsibilities ( ,,cisa ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all-- 7#a7 provide support to ag5cies ) respect to ! implem5tation ( ! requirem5ts ( ?is section2 7#b7 develop tools1 processes1 & o!r me*anisms det]m9$ appropriate to (f] ag5cies capabilities to implem5t ! requirem5ts ( ?is section2 & 7#c7 ^u a reque/ by an ag5cy1 assi/ ! ag5cy 9 ! disclosure to v5dors ( newly id5tifi$ vuln]abilities 9 v5dor products & s]vices4 7e7 ,responsibilities ( ag5cies 7#a7 ,public in=mation ,! head ( ea* ag5cy %all make publicly available1 ) respect to ea* int]net doma9 "u ! control ( ! ag5cy t is n a national security sy/em-- 7,a7 an appropriate security contact2 & 7,b7 ! compon5t ( ! ag5cy t is responsible = ! int]net accessible s]vices (f]$ at ! doma94 7#b7 ,vuln]ability disclosure policy ,! head ( ea* ag5cy %all develop & make publicly available a vuln]ability disclosure policy = ! ag5cy1 :i* %all-- 7,a7 describe-- 7i7 ! scope ( ! sy/ems ( ! ag5cy includ$ 9 ! vuln]ability disclosure policy2 7ii7 ! type ( in=mation sy/em te/+ t is au?oriz$ by ! ag5cy2 7iii7 ! type ( in=mation sy/em te/+ t is n au?oriz$ by ! ag5cy2 & 7iv7 ! disclosure policy ( ! ag5cy = s5sitive in=mation2 7,b7 ) respect to a report to an ag5cy1 describe-- 7i7 h[ ! report] %\ld submit ! report2 & 7ii7 if ! report is n anonym\s1 :5 ! report] %\ld anticipate an ackn[l$gm5t ( receipt ( ! report by ! ag5cy2 7,c7 include any o!r relevant in=mation2 & 7,d7 be mature 9 scope & cov] e int]net accessible ,f$]al in=mation sy/em us$ or op]at$ by t ag5cy or on behalf ( t ag5cy4 7#c7 ,id5tifi$ vuln]abilities ,! head ( ea* ag5cy %all incorporate any vuln]abilities report$ "u p>agraph 7#b7 into ! vuln]ability managem5t process ( ! ag5cy 9 ord] to track & rem$iate ! vuln]ability4 7f7 ,congressional report+ ,n lat] ?an #ij days aft] ! date ( enactm5t ( ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjbb1 & annually !reaft] = a #c-ye> p]iod1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! /atus ( ! use ( vuln]ability disclosure policies "u ?is section at ag5cies1 includ+1 ) respect to ! guidance issu$ "u subsection 7c77#c71 an id5tification ( ! ag5cies t are compliant & n compliant4 7g7 ,exemptions ,! au?orities & functions ( ! ,director & ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy "u ?is section %all n apply to national security sy/ems4 7h7 ,delegation ( au?ority = c]ta9 sy/ems ,! au?orities ( ! ,director & ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy describ$ 9 ?is section %all be delegat$-- 7#a7 to ! ,secret>y ( ,def5se 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#b72 & 7#b7 to ! ,director ( ,national ,intellig5ce 9 ! case ( sy/ems describ$ 9 section #ceec7;e77#c74 4 7b7 ,cl]ical am5dm5t ,! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ aft] ! item relat+ to section #ceei;,a1 z add$ by section #aaa1 ! foll[+3 #ceei;,b4 ,f$]al vuln]ability disclosure programs4 4 7c7 ,sunset 7#a7 ,9 g5]al ,effective on ! date t is #aj ye>s aft] ! date ( enactm5t ( ?is ,act1 sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ section #ceei;,b4 7#b7 ,cl]ical am5dm5t ,effective on ! date t is #aj ye>s aft] ! date ( enactm5t ( ?is ,act1 ! table ( sections = *apt] #ce ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! item relat+ to section #ceei;,b4 #aad4 ,implem5t+ z]o tru/ ar*itecture 7a7 ,guidance ,n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all provide an update to ! appropriate congressional committees on progress 9 increas+ ! int]nal def5ses ( ag5cy sy/ems1 includ+-- 7#a7 %ift+ away f tru/$ networks to implem5t security controls bas$ on a presumption ( compromise2 7#b7 implem5t+ pr9ciples ( lea/ privilege 9 adm9i/]+ in=mation security programs2 7#c7 limit+ ! ability ( entities t cause incid5ts to move lat]ally ?r\gh or betwe5 ag5cy sy/ems2 7#d7 id5tify+ incid5ts quickly2 7#e7 isolat+ & remov+ unau?oriz$ entities f ag5cy sy/ems z quickly z practicable1 acc\nt+ = intellig5ce or law en=cem5t purposes2 7#f7 o!rwise increas+ ! res\rce co/s = entities t cause incid5ts to be successful2 & 7#g7 a summ>y ( ! ag5cy progress reports requir$ "u subsection 7b74 7b7 ,ag5cy progress reports ,n lat] ?an #bgj days aft] ! date ( enactm5t ( ?is ,act1 ! head ( ea* ag5cy %all submit to ! ,director a progress report on implem5t+ an in=mation security program bas$ on ! presumption ( compromise & lea/ privilege pr9ciples1 :i* %all include-- 7#a7 a description ( any /eps ! ag5cy has complet$1 includ+ progress t[>d a*iev+ requirem5ts issu$ by ! ,director1 includ+ ! adoption ( any models or ref]5ce ar*itecture2 7#b7 an id5tification ( activities t h n yet be5 complet$ & t w\ld h ! mo/ imm$iate security impact2 & 7#c7 a s*$ule to implem5t any plann$ activities4 #aae4 ,automation reports 7a7 ,,omb report ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all provide to ! appropriate congressional committees an update on ! use ( automation "u p>agraphs 7#a71 7#e77;,c71 & 7#h77;,b7 ( section #ceed7;b7 ( title #dd1 ,unit$ ,/ates ,code4 7b7 ,,gao report ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all p]=m a /udy on ! use ( automation & ma*9e readable data across ! ,f$]al ,gov]nm5t = cyb]security purposes1 includ+ ! automat$ updat+ ( cyb]security tools1 s5sors1 or processes by ag5cies4 #aaf4 ,ext5sion ( ,f$]al acquisition security c\ncil & s(tw>e inv5tory 7a7 ,ext5sion ,section #acbh ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! date t & all t foll[s & ins]t+ ,decemb] #ca1 #bjbf44 7b7 ,requirem5t ,subsection #acbf7;b7 ( title #da1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 p>agraph 7#e71 by /rik+ & at ! end2 7#b7 by r$esignat+ p>agraph 7#f7 z p>agraph 7#g72 & 7#c7 by ins]t+ aft] p>agraph 7#e7 ! foll[+3 7#f7 ma9ta9+ an up-to-date & accurate inv5tory ( s(tw>e 9 use by ! ag5cy &1 if available & applicable1 ! compon5ts ( su* s(tw>e1 t c be communicat$ at ! reque/ ( ! ,f$]al ,acquisition ,security ,c\ncil1 ! ,national ,cyb] ,director1 or ! ,secret>y ( ,homel& ,security1 act+ ?r\gh ! ,director ( ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 4 #aag4 ,c\ncil ( ! ,inspectors ,g5]al on ,integrity & ,effici5cy da%bo>d 7a7 ,da%bo>d requir$ ,section #aa7;e77#b7 ( ! ,inspector ,g5]al ,act ( #aigh 7#e ,u4,s4,c4 ,app47 is am5d$-- 7#a7 9 subp>agraph 7,a71 by /rik+ & at ! end2 7#b7 by r$esignat+ subp>agraph 7,b7 z subp>agraph 7,c72 & 7#c7 by ins]t+ aft] subp>agraph 7,a7 ! foll[+3 7,b7 t %all include a da%bo>d ( op5 in=mation security recomm5dations id5tifi$ 9 ! indep5d5t evaluations requir$ by section #ceee7;a7 ( title #dd1 ,unit$ ,/ates ,code2 & 4 #aah4 ,quantitative cyb]security metrics 7a7 ,def9ition ( cov]$ metrics ,9 ?is section1 ! t]m cov]$ metrics means ! metrics e/abli%$1 review$1 & updat$ "u section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c774 7b7 ,updat+ & e/abli%+ metrics ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & z appropriate !reaft]1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director1 %all-- 7#a7 evaluate any cov]$ metrics e/abli%$ z ( ! date ( enactm5t ( ?is ,act2 & 7#b7 z appropriate & pursuant to section #bbd7;c7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aebb7;c77 update or e/abli% new cov]$ metrics4 7c7 ,implem5tation 7#a7 ,9 g5]al ,n lat] ?an #edj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all promulgate guidance t requires ea* ag5cy to use cov]$ metrics to track tr5ds 9 ! cyb]security & incid5t response capabilities ( ! ag5cy4 7#b7 ,p]=mance demon/ration ,! guidance issu$ "u p>agraph 7#a7 & any subsequ5t guidance %all require ag5cies to %>e ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy data demon/rat+ ! p]=mance ( ! ag5cy us+ ! cov]$ metrics includ$ 9 ! guidance4 7#c7 ,p5etration te/s ,on n less ?an #b occasions dur+ ! #b-ye> p]iod foll[+ ! date on :i* guidance is promulgat$ "u p>agraph 7#a71 ! ,director %all ensure t n less ?an #c ag5cies are subject$ to sub/antially simil> p5etration te/s1 z det]m9$ by ! ,director1 9 coord9ation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 ord] to validate ! utility ( ! cov]$ metrics4 7#d7 ,analysis capacity ,! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a capability t all[s = ! analysis ( ! cov]$ metrics1 includ+ cross-ag5cy p]=mance ( ag5cy cyb]security & incid5t response capability tr5ds4 7#e7 ,"t-bas$ metric ,) respect ! fir/ update or e/abli%m5t ( cov]$ metrics requir$ "u subsection 7b77#b71 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all e/abli% cov]$ metrics t include n less ?an #a metric address+ ! "t x takes = ag5cies to id5tify & respond to incid5ts4 7d7 ,congressional reports ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director1 %all submit to ! appropriate congressional committees a report on ! utility & use ( ! cov]$ metrics4 #aai4 ,e/abli%m5t ( risk-bas$ budget model 7a7 ,def9itions ,9 ?is section3 7#a7 ,appropriate congressional committees ,! t]m appropriate congressional committees means-- 7,a7 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs & ! ,committee on ,appropriations ( ! ,s5ate2 & 7,b7 ! ,committee on ,ov]sight & ,re=m1 ! ,committee on ,homel& ,security1 & ! ,committee on ,appropriations ( ! ,h\se ( ,repres5tatives4 7#b7 ,cov]$ ag5cy ,! t]m cov]$ ag5cy has ! mean+ giv5 ! t]m executive ag5cy 9 section #acc ( title #da1 ,unit$ ,/ates ,code4 7#c7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#d7 ,in=mation te*nology ,! t]m in=mation te*nology-- 7,a7 has ! mean+ giv5 ! t]m 9 section #aaaja ( title #dj1 ,unit$ ,/ates ,code2 & 7,b7 includes ! h>dw>e & s(tw>e sy/ems ( a ,f$]al ag5cy t monitor & control physical equipm5t & processes ( ! ,f$]al ag5cy4 7#e7 ,risk-bas$ budget ,! t]m risk-bas$ budget means a budget-- 7,a7 develop$ by id5tify+ & prioritiz+ cyb]security risks & vuln]abilities1 includ+ impact on ag5cy op]ations 9 ! case ( a cyb] attack1 ?r\gh analysis ( cyb] ?reat intellig5ce1 incid5t data1 & tactics1 te*niques1 proc$ures1 & capabilities ( cyb] ?reats2 & 7,b7 t allocates res\rces bas$ on ! risks id5tifi$ & prioritiz$ "u subp>agraph 7,a74 7b7 ,e/abli%m5t ( risk-bas$ budget model 7#a7 ,9 g5]al 7,a7 ,model ,n lat] ?an #a ye> aft] ! fir/ publication ( ! budget submitt$ by ! ,presid5t "u section #aaje ( title #ca1 ,unit$ ,/ates ,code1 foll[+ ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,cyb] ,director & 9 coord9ation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 %all develop a /&>d model = in=m+ a risk-bas$ budget = cyb]security sp5d+4 7,b7 ,responsibility ( director ,section #ceec7;a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #ajc ( ?is title1 is fur!r am5d$ by ins]t+ aft] p>agraph 7#f7 ! foll[+3 7#g7 develop+ a /&>d risk-bas$ budget model to in=m ,f$]al ag5cy cyb]security budget developm5t2 & 4 7,c7 ,cont5ts ( model ,! model requir$ to be develop$ "u subp>agraph 7,a7 %all utilize appropriate in=mation to evaluate risk1 includ+1 z det]m9$ appropriate by ! ,director-- 7i7 ,f$]al & non-,f$]al cyb] ?reat intellig5ce products1 :]e available1 to id5tify ?reats1 vuln]abilities1 & risks2 7ii7 analysis ( ! impact ( ag5cy op]ations ( compromise ( sy/ems1 includ+ ! int]connectivity to o!r ag5cy sy/ems & ! op]ations ( o!r ag5cies2 & 7iii7 to ! greate/ ext5t practicable1 analysis ( :]e res\rces %\ld be allocat$ to h ! greate/ impact on mitigat+ curr5t & future ?reats & curr5t & future cyb]security capabilities4 7,d7 ,use ( model ,! model requir$ to be develop$ "u subp>agraph 7,a7 %all be us$ to-- 7i7 in=m acquisition & su/a9m5t (-- 7,i7 in=mation te*nology & cyb]security tools2 7,,ii7 in=mation te*nology & cyb]security ar*itectures2 7,,iii7 in=mation te*nology & cyb]security p]sonnel2 & 7,,iv7 cyb]security & in=mation te*nology concepts ( op]ations2 & 7ii7 evaluate & in=m ,gov]nm5t-wide cyb]security programs4 7,e7 ,model v>iation ,! ,director may develop multiple models "u subp>agraph 7,a7 bas$ on diff]5t ag5cy *>act]i/ics1 su* z size or cyb]security maturity4 7,f7 ,requir$ updates ,n less frequ5tly ?an once e #c ye>s1 ! ,director %all review1 & update z necess>y1 ! model requir$ to be develop$ "u subp>agraph 7,a74 7,g7 ,publication ,n e>li] ?an #e ye>s aft] ! date on :i* ! model develop$ "u subp>agraph 7,a7 is complet$1 ! ,director %all1 tak+ into acc\nt any classifi$ or s5sitive in=mation1 publi% ! model1 & any updates necess>y "u subp>agraph 7,f71 on ! public website ( ! ,(fice ( ,managem5t & ,budget4 7,h7 ,reports ,n lat] ?an #b ye>s aft] ! fir/ publication ( ! budget submitt$ by ! ,presid5t "u section #aaje ( title #ca1 ,unit$ ,/ates ,code1 foll[+ ! date ( enactm5t ( ?is ,act1 & annually !reaft] = ea* ( ! #b foll[+ fiscal ye>s or until ! date on :i* ! model requir$ to be develop$ "u subp>agraph 7,a7 is complet$1 :i*ev] is soon]1 ! ,director %all submit to ! appropriate congressional committees a report on ! developm5t ( ! model4 7#b7 ,phas$ implem5tation ( risk-bas$ budget model 7,a7 ,initial phase 7i7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date on :i* ! model develop$ "u p>agraph 7#a7 is complet$1 ! ,director %all require n less ?an #e cov]$ ag5cies to use ! model to in=m ! developm5t ( ! annual cyb]security & in=mation te*nology budget reque/s ( ^? cov]$ ag5cies4 7ii7 ,brief+ ,n lat] ?an #a ye> aft] ! date on :i* ! cov]$ ag5cies select$ "u clause 7i7 beg9 us+ ! model develop$ "u p>agraph 7#a71 ! ,director %all provide to ! appropriate congressional committees a brief+ on implem5tation ( risk-bas$ budget+ = cyb]security sp5d+1 an assessm5t ( ag5cy implem5tation1 & an evaluation ( :e!r ! risk-bas$ budget helps to mitigate cyb]security vuln]abilities4 7,b7 ,full deploym5t ,n lat] ?an #e ye>s aft] ! date on :i* ! model develop$ "u p>agraph 7#a7 is complet$1 ! head ( ea* cov]$ ag5cy %all use ! model1 or any updat$ model pursuant to p>agraph 7#a77;,f71 to ! greate/ ext5t practicable1 to in=m ! developm5t ( ! annual cyb]security & in=mation te*nology budget reque/s ( ! cov]$ ag5cy4 7,c7 ,ag5cy p]=mance plans 7i7 ,am5dm5t ,section #ceed7;d77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ & ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 aft] p>agraph 7#a74 7ii7 ,effective date ,! am5dm5t made by clause 7i7 %all take effect on ! date t is #e ye>s aft] ! date on :i* ! model develop$ "u p>agraph 7#a7 is complet$4 7#c7 ,v]ification 7,a7 ,9 g5]al ,section #aaje7;a77#ce77;,a77i7 ( title #ca1 ,unit$ ,/ates ,code1 is am5d$-- 7i7 9 ! matt] prec$+ subclause 7,i71 by /rik+ by ag5cy1 & by initiative area 7z det]m9$ by ! adm9i/ration7 & ins]t+ & by ag5cy2 7ii7 9 subclause 7,,iii71 by /rik+ & at ! end2 & 7iii7 by add+ at ! end ! foll[+3 7,v7 a validation t ! budgets submitt$ 7 in=m$ by us+ a risk-bas$ me?odology2 & 7,,vi7 a report on ! progress ( ea* ag5cy on clos+ recomm5dations id5tifi$ "u ! indep5d5t evaluation requir$ by section #ceee7;a77#a7 ( title #dd4 4 7,b7 ,effective date ,! am5dm5ts made by subp>agraph 7,a7 %all take effect on ! date t is #e ye>s aft] ! date on :i* ! model develop$ "u p>agraph 7#a7 is complet$4 7#d7 ,reports 7,a7 ,indep5d5t evaluation ,section #ceee7;a77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$-- 7i7 9 subp>agraph 7,b71 by /rik+ & at ! end2 7ii7 9 subp>agraph 7,c71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7iii7 by add+ at ! end ! foll[+3 7,d7 an assessm5t ( h[ ! ag5cy 0 in=m$ by ! risk-bas$ budget model requir$ "u section #ceec7;a77#g7 & an evaluation ( :e!r ! model mitigates ag5cy cyb] vuln]abilities4 4 7,b7 ,assessm5t 7i7 ,am5dm5t ,section #ceec7;c7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #ajc ( ?is title1 is fur!r am5d$ by ins]t+ aft] p>agraph 7#e7 ! foll[+3 7#f7 an assessm5t (-- 7,a7 ,f$]al ag5cy utilization ( ! model requir$ "u subsection 7a77#g72 & 7,b7 :e!r ! model mitigates ! cyb] vuln]abilities ( ! ,f$]al ,gov]nm5t4 4 7ii7 ,effective date ,! am5dm5t made by clause 7i7 %all take effect on ! date t is #e ye>s aft] ! date on :i* ! model develop$ "u p>agraph 7#a7 is complet$4 7#e7 ,,gao report ,n lat] ?an #c ye>s aft] ! date on :i* ! fir/ budget ( ! ,presid5t is submitt$ to ,congress conta9+ ! validation requir$ "u section #aaje7;a77#ce77;,a77i77,v7 ( title #ca1 ,unit$ ,/ates ,code1 z am5d$ by p>agraph 7#c71 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! appropriate congressional committees a report t includes-- 7,a7 an evaluation ( ! success ( cov]$ ag5cies 9 utiliz+ ! risk-bas$ budget model2 7,b7 an evaluation ( ! success ( cov]$ ag5cies 9 implem5t+ risk-bas$ budgets2 7,c7 an evaluation ( :e!r ! risk-bas$ budgets develop$ by cov]$ ag5cies are effective at in=m+ ,f$]al ,gov]nm5t-wide cyb]security programs2 & 7,d7 any o!r in=mation relat+ to risk-bas$ budgets ! ,comptroll] ,g5]al det]m9es appropriate4 #abj4 ,active cyb] def5sive /udy 7a7 ,def9ition ,9 ?is section1 ! t]m active def5se te*nique-- 7#a7 means an action tak5 on ! sy/ems ( an entity to increase ! security ( in=mation on ! network ( an ag5cy by mislead+ an adv]s>y2 & 7#b7 includes a honeypot1 deception1 or purposefully fe$+ false or mislead+ data to an adv]s>y :5 ! adv]s>y is on ! sy/ems ( ! entity4 7b7 ,/udy ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 coord9ation ) ! ,director & ! ,national ,cyb] ,director1 %all p]=m a /udy on ! use ( active def5se te*niques to enhance ! security ( ag5cies1 :i* %all include-- 7#a7 a review ( legal re/rictions on ! use ( diff]5t active cyb] def5se te*niques 9 ,f$]al environm5ts1 9 consultation ) ! ,dep>tm5t ( ,ju/ice2 7#b7 an evaluation (-- 7,a7 ! efficacy ( a selection ( active def5se te*niques det]m9$ by ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy2 & 7,b7 factors t impact ! efficacy ( ! active def5se te*niques evaluat$ "u subp>agraph 7,a72 7#c7 recomm5dations on safegu>ds & proc$ures t %all be e/abli%$ to require t active def5se te*niques are adequately coord9at$ to ensure t active def5se te*niques d n imp$e ag5cy op]ations & mission deliv]y1 ?reat response ef=ts1 crim9al inve/igations1 & national security activities1 includ+ intellig5ce collection2 & 7#d7 ! developm5t ( a framework = ! use ( diff]5t active def5se te*niques by ag5cies4 #aba4 ,security op]ations c5t] z a s]vice pilot 7a7 ,purpose ,! purpose ( ?is section is = ! ,cyb]security & ,infra/ructure ,security ,ag5cy to run a security op]ation c5t] on behalf ( ano!r ag5cy1 alleviat+ ! ne$ to duplicate ?is function at e ag5cy1 & emp[]+ a great] c5traliz$ cyb]security capability4 7b7 ,plan ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all develop a plan to e/abli% a c5traliz$ ,f$]al security op]ations c5t] %>$ s]vice (f]+ )9 ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,cont5ts ,! plan requir$ "u subsection 7b7 %all include consid]ations =-- 7#a7 collect+1 organiz+1 & analyz+ ag5cy in=mation sy/em data 9 real "t2 7#b7 /aff+ & res\rces2 & 7#c7 appropriate int]ag5cy agreem5ts1 concepts ( op]ations1 & gov]nance plans4 7d7 ,pilot program 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* ! plan requir$ "u subsection 7b7 is develop$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 %all ent] into a #a-ye> agreem5t ) n less ?an #b ag5cies to (f] a security op]ations c5t] z a %>$ s]vice4 7#b7 ,additional agreem5ts ,aft] ! date on :i* ! brief+ requir$ "u subsection 7e77#a7 is provid$1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 9 consultation ) ! ,director1 may ent] into additional #a-ye> agreem5ts describ$ 9 p>agraph 7#a7 ) ag5cies4 7e7 ,brief+ & report 7#a7 ,brief+ ,n lat] ?an #bgj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all provide to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a brief+ on ! p>amet]s ( any #a-ye> agreem5ts ent]$ into "u subsection 7d77#a74 7#b7 ,report ,n lat] ?an #ij days aft] ! date on :i* ! fir/ #a-ye> agreem5t ent]$ into "u subsection 7d7 expires1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives a report on-- 7,a7 ! agreem5t2 & 7,b7 any additional agreem5ts ent]$ into ) ag5cies "u subsection 7d74 #abb4 ,ext5sion ( ,*ief ,data ,(fic] ,c\ncil ,section #cebj;,a7e77#b7 ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ^u ! expiration ( ! #b-ye> p]iod t beg9s on ! date ! ,comptroll] ,g5]al submits ! report "u p>agraph 7#a7 to ,congress & ins]t+ ,janu>y #ca1 #bjcj4 #abc4 ,f$]al cyb]security requirem5ts 7a7 ,exemption f ,f$]al requirem5ts ,section #bbe7;b77#b7 ( ! ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae 7#f ,u4,s4,c4 #aebc7;b77#b77 is am5d$ to read z foll[s3 7#b7 ,exception 7,a7 ,9 g5]al ,a p>ticul> requirem5t "u p>agraph 7#a7 %all n apply to an ag5cy in=mation sy/em ( an ag5cy if-- 7i7 ) respect to ! ag5cy in=mation sy/em1 ! head ( ! ag5cy submits to ! ,director an application = an exemption f ! p>ticul> requirem5t1 9 :i* ! head ( ! ag5cy p]sonally c]tifies to ! ,director ) p>ticul>ity t-- 7,i7 op]ational requirem5ts articulat$ 9 ! c]tification & relat$ to ! ag5cy in=mation sy/em w\ld make x excessively burd5some to implem5t ! p>ticul> requirem5t2 7,,ii7 ! p>ticul> requirem5t is n necess>y to secure ! ag5cy in=mation sy/em or ag5cy in=mation /or$ on or transit+ ! ag5cy in=mation sy/em2 & 7,,iii7 ! ag5cy has tak5 all necess>y /eps to secure ! ag5cy in=mation sy/em & ag5cy in=mation /or$ on or transit+ ! ag5cy in=mation sy/em2 7ii7 ! head ( ! ag5cy or ! designee ( ! head ( ! ag5cy has submitt$ ! c]tification describ$ 9 clause 7i7 to ! appropriate congressional committees & any o!r congressional committee ) jurisdiction ov] ! ag5cy2 & 7iii7 ! ,director grants ! exemption f ! p>ticul> requirem5t4 7,b7 ,duration ( exemption 7i7 ,9 g5]al ,an exemption grant$ "u subp>agraph 7,a7 %all expire on ! date t is #a ye> aft] ! date on :i* ! ,director grant$ ! exemption4 7ii7 ,r5ewal ,^u ! expiration ( an exemption grant$ to an ag5cy "u subp>agraph 7,a71 ! head ( ! ag5cy may apply = an additional exemption4 4 7b7 ,report on exemptions ,section #ceed7;c77#a7 ( title #dd1 ,unit$ ,/ates ,code1 z am5d$ by section #ajc7;c7 ( ?is title1 is am5d$-- 7#a7 9 subp>agraph 7,c71 by /rik+ & at ! end2 7#b7 9 subp>agraph 7,d71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7#c7 by add+ at ! end ! foll[+3 7,e7 ) respect to any exemption ! ,director ( ! ,(fice ( ,managem5t & ,budget has grant$ ! ag5cy "u section #bbe7;b77#b7 ( ! ,f$]al ,cyb]security ,enhancem5t ,act ( #bjae 7#f ,u4,s4,c4 #aebc7;b77#b77 t is effective on ! date ( submission ( ! report-- 7i7 an id5tification ( ea* p>ticul> requirem5t f :i* any ag5cy in=mation sy/em 7z def9$ 9 section #bbaj ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #ffj77 is exempt$2 & 7ii7 = ea* requirem5t id5tifi$ "u clause 7i7-- 7,i7 an id5tification ( ! ag5cy in=mation sy/em describ$ 9 clause 7i7 exempt$ f ! requirem5t2 & 7,,ii7 an e/imate ( ! date on :i* ! ag5cy w to be able to comply ) ! requirem5t4 4 7c7 ,effective date ,! am5dm5ts made by ?is section %all take effect on ! date t is #a ye> aft] ! date ( enactm5t ( ?is ,act4 ,,ii ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb #bja4 ,%ort title ,?is title may be cit$ z ! ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb4 #bjb4 ,def9itions ,9 ?is title3 7#a7 ,cov]$ cyb] incid5t2 cov]$ entity2 cyb] incid5t2 in=mation sy/em2 ransom paym5t2 ransomw>e attack2 security vuln]ability ,! t]ms cov]$ cyb] incid5t1 cov]$ entity1 cyb] incid5t1 in=mation sy/em1 ransom paym5t1 ransomw>e attack1 & security vuln]ability h ! mean+s giv5 ^? t]ms 9 section #bbdj ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title4 7#b7 ,director ,! t]m ,director means ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 #bjc4 ,cyb] incid5t report+ 7a7 ,cyb] incid5t report+ ,title ,,xxii ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47 is am5d$-- 7#a7 9 section #bbji7;c7 7#f ,u4,s4,c4 #fei7;c77-- 7,a7 9 p>agraph 7#aa71 by /rik+ 2 & & ins]t+ a semicolon2 7,b7 9 p>agraph 7#ab71 by /rik+ ! p]iod at ! end & ins]t+ 2 &2 & 7,c7 by add+ at ! end ! foll[+3 7#ac7 receiv+1 aggregat+1 & analyz+ reports relat$ to cov]$ cyb] incid5ts 7z def9$ 9 section #bbdj7 submitt$ by cov]$ entities 7z def9$ 9 section #bbdj7 & reports relat$ to ransom paym5ts 7z def9$ 9 section #bbdj7 submitt$ by cov]$ entities 7z def9$ 9 section #bbdj7 9 fur!rance ( ! activities specifi$ 9 sections #bbjb7;e71 #bbjc1 & #bbda1 ?is subsection1 & any o!r au?oriz$ activity ( ! ,director1 to enhance ! situational aw>5ess ( cyb]security ?reats across critical infra/ructure sectors4 2 & 7#b7 by add+ at ! end ! foll[+3 ,d ,cyb] ,incid5t ,report+ #bbdj4 ,def9itions ,9 ?is subtitle3 7#a7 ,c5t] ,! t]m ,c5t] means ! c5t] e/abli%$ "u section #bbji4 7#b7 ,cl\d s]vice provid] ,! t]m cl\d s]vice provid] means an entity (f]+ products or s]vices relat$ to cl\d comput+1 z def9$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology 9 ,,ni/ ,special ,publication #hjj-ade & any am5datory or sup]s$+ docum5t relat+ !reto4 7#c7 ,c\ncil ,! t]m ,c\ncil means ! ,cyb] ,incid5t ,report+ ,c\ncil describ$ 9 section #bbdf4 7#d7 ,cov]$ cyb] incid5t ,! t]m cov]$ cyb] incid5t means a sub/antial cyb] incid5t exp]i5c$ by a cov]$ entity t satisfies ! def9ition & crit]ia e/abli%$ by ! ,director 9 ! f9al rule issu$ pursuant to section #bbdb7;b74 7#e7 ,cov]$ entity ,! t]m cov]$ entity means an entity 9 a critical infra/ructure sector1 z def9$ 9 ,presid5tial ,policy ,directive #ba1 t satisfies ! def9ition e/abli%$ by ! ,director 9 ! f9al rule issu$ pursuant to section #bbdb7;b74 7#f7 ,cyb] incid5t ,! t]m cyb] incid5t-- 7,a7 has ! mean+ giv5 ! t]m incid5t 9 section #bbji2 & 7,b7 does n include an occurr5ce t imm95tly1 b n actually1 jeop>dizes-- 7i7 in=mation on in=mation sy/ems2 or 7ii7 in=mation sy/ems4 7#g7 ,cyb] ?reat ,! t]m cyb] ?reat has ! mean+ giv5 ! t]m cyb]security ?reat 9 section #bbja4 7#h7 ,cyb] ?reat indicator2 cyb]security purpose2 def5sive measure2 ,f$]al entity2 security vuln]ability ,! t]ms cyb] ?reat indicator1 cyb]security purpose1 def5sive measure1 ,f$]al entity1 & security vuln]ability h ! mean+s giv5 ^? t]ms 9 section #ajb ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aeja74 7#i7 ,incid5t2 %>+ ,! t]ms incid5t & %>+ h ! mean+s giv5 ^? t]ms 9 section #bbji4 7#aj7 ,in=mation ,%>+ & ,analysis ,organization ,! t]m ,in=mation ,%>+ & ,analysis ,organization has ! mean+ giv5 ! t]m 9 section #bbbb4 7#aa7 ,in=mation sy/em ,! t]m in=mation sy/em-- 7,a7 has ! mean+ giv5 ! t]m 9 section #cejb ( title #dd1 ,unit$ ,/ates ,code2 & 7,b7 includes indu/rial control sy/ems1 su* z sup]visory control & data acquisition sy/ems1 di/ribut$ control sy/ems1 & programmable logic controll]s4 7#ab7 ,manag$ s]vice provid] ,! t]m manag$ s]vice provid] means an entity t deliv]s s]vices1 su* z network1 application1 infra/ructure1 or security s]vices1 via ongo+ & regul> support & active adm9i/ration on ! premises ( a cu/om]1 9 ! data c5t] ( ! entity 7su* z ho/+71 or 9 a ?ird p>ty data c5t]4 7#ac7 ,ransom paym5t ,! t]m ransom paym5t means ! transmission ( any money or o!r prop]ty or asset1 includ+ virtual curr5cy1 or any portion !re(1 :i* has at any "t be5 deliv]$ z ransom 9 connection ) a ransomw>e attack4 7#ad7 ,ransomw>e attack ,! t]m ransomw>e attack-- 7,a7 means an incid5t t includes ! use or ?reat ( use ( unau?oriz$ or malici\s code on an in=mation sy/em1 or ! use or ?reat ( use ( ano!r digital me*anism su* z a d5ial ( s]vice attack1 to int]rupt or disrupt ! op]ations ( an in=mation sy/em or compromise ! confid5tiality1 availability1 or integrity ( electronic data /or$ on1 process$ by1 or transit+ an in=mation sy/em to extort a dem& = a ransom paym5t2 & 7,b7 does n include any su* ev5t :]e ! dem& = paym5t is-- 7i7 n g5u9e2 or 7ii7 made 9 good fai? by an entity 9 response to a specific reque/ by ! own] or op]ator ( ! in=mation sy/em4 7#ae7 ,sector ,risk ,managem5t ,ag5cy ,! t]m ,sector ,risk ,managem5t ,ag5cy has ! mean+ giv5 ! t]m 9 section #bbja4 7#af7 ,significant cyb] incid5t ,! t]m significant cyb] incid5t means a cyb] incid5t1 or a gr\p ( relat$ cyb] incid5ts1 t ! ,secret>y det]m9es is likely to result 9 demon/rable h>m to ! national security int]e/s1 =eign relations1 or economy ( ! ,unit$ ,/ates or to ! public confid5ce1 civil lib]ties1 or public heal? & safety ( ! p ( ! ,unit$ ,/ates4 7#ag7 ,supply *a9 compromise ,! t]m supply *a9 compromise means an incid5t )9 ! supply *a9 ( an in=mation sy/em t an adv]s>y c lev]age or does lev]age to jeop>dize ! confid5tiality1 integrity1 or availability ( ! in=mation sy/em or ! in=mation ! sy/em processes1 /ores1 or transmits1 & c occur at any po9t dur+ ! life cycle4 7#ah7 ,virtual curr5cy ,! t]m virtual curr5cy means ! digital repres5tation ( value t functions z a m$ium ( ex*ange1 a unit ( acc\nt1 or a /ore ( value4 7#ai7 ,virtual curr5cy address ,! t]m virtual curr5cy address means a unique public cryptographic key id5tify+ ! location to :i* a virtual curr5cy paym5t c be made4 #bbda4 ,cyb] incid5t review 7a7 ,activities ,! ,c5t] %all-- 7#a7 receive1 aggregate1 analyze1 & secure1 us+ processes consi/5t ) ! processes develop$ pursuant to ! ,cyb]security ,in=mation ,%>+ ,act ( #bjae 7#f ,u4,s4,c4 #aeja et seq47 reports f cov]$ entities relat$ to a cov]$ cyb] incid5t to assess ! effectiv5ess ( security controls1 id5tify tactics1 te*niques1 & proc$ures adv]s>ies use to ov]come ^? controls & o!r cyb]security purposes1 includ+ to assess pot5tial impact ( cyb] incid5ts on public heal? & safety & to enhance situational aw>5ess ( cyb] ?reats across critical infra/ructure sectors2 7#b7 coord9ate & %>e in=mation ) appropriate ,f$]al dep>tm5ts & ag5cies to id5tify & track ransom paym5ts1 includ+ ^? utiliz+ virtual curr5cies2 7#c7 lev]age in=mation ga!r$ ab\t cyb] incid5ts to-- 7,a7 enhance ! quality & effectiv5ess ( in=mation %>+ & coord9ation ef=ts ) appropriate entities1 includ+ ag5cies1 sector coord9at+ c\ncils1 ,in=mation ,%>+ & ,analysis ,organizations1 ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts1 te*nology provid]s1 critical infra/ructure own]s & op]ators1 cyb]security & cyb] incid5t response firms1 & security rese>*]s2 & 7,b7 provide appropriate entities1 includ+ sector coord9at+ c\ncils1 ,in=mation ,%>+ & ,analysis ,organizations1 ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts1 te*nology provid]s1 cyb]security & cyb] incid5t response firms1 & security rese>*]s1 ) timely1 actionable1 & anonymiz$ reports ( cyb] incid5t campaigns & tr5ds1 includ+1 to ! maximum ext5t practicable1 relat$ contextual in=mation1 cyb] ?reat indicators1 & def5sive measures1 pursuant to section #bbde2 7#d7 e/abli% me*anisms to receive fe$back f /akehold]s on h[ ! ,ag5cy c mo/ effectively receive cov]$ cyb] incid5t reports1 ransom paym5t reports1 & o!r volunt>ily provid$ in=mation1 & h[ ! ,ag5cy c mo/ effectively support private sector cyb]security2 7#e7 facilitate ! timely %>+1 on a volunt>y basis1 betwe5 relevant critical infra/ructure own]s & op]ators ( in=mation relat+ to cov]$ cyb] incid5ts & ransom paym5ts1 p>ticul>ly ) respect to ongo+ cyb] ?reats or security vuln]abilities & id5tify & dissem9ate ways to prev5t or mitigate simil> cyb] incid5ts 9 ! future2 7#f7 = a cov]$ cyb] incid5t1 includ+ a ransomw>e attack1 t also satisfies ! def9ition ( a significant cyb] incid5t1 or is "p ( a gr\p ( relat$ cyb] incid5ts t toge!r satisfy su* def9ition1 conduct a review ( ! details surr\nd+ ! cov]$ cyb] incid5t or gr\p ( ^? incid5ts & id5tify & dissem9ate ways to prev5t or mitigate simil> incid5ts 9 ! future2 7#g7 ) respect to cov]$ cyb] incid5t reports "u section #bbdb7;a7 & #bbdc involv+ an ongo+ cyb] ?reat or security vuln]ability1 imm$iately review ^? reports = cyb] ?reat indicators t c be anonymiz$ & dissem9at$1 ) def5sive measures1 to appropriate /akehold]s1 9 coord9ation ) o!r divisions )9 ! ,ag5cy1 z appropriate2 7#h7 publi% qu>t]ly unclassifi$1 public reports t describe aggregat$1 anonymiz$ obs]vations1 f9d+s1 & recomm5dations bas$ on cov]$ cyb] incid5t reports1 :i* may be bas$ on ! unclassifi$ in=mation conta9$ 9 ! brief+s requir$ "u subsection 7c72 7#i7 proactively id5tify opportunities1 consi/5t ) ! protections 9 section #bbde1 to lev]age & utilize data on cyb] incid5ts 9 a mann] t enables & /r5g!ns cyb]security rese>* c>ri$ out by academic in/itutions & o!r private sector organizations1 to ! greate/ ext5t practicable2 & 7#aj7 9 accordance ) section #bbde & subsection 7b7 ( ?is section1 z soon z possible b n lat] ?an #bd h\rs aft] receiv+ a cov]$ cyb] incid5t report1 ransom paym5t report1 volunt>ily submitt$ in=mation pursuant to section #bbdc1 or in=mation receiv$ pursuant to a reque/ = in=mation or subpo5a "u section #bbdd1 make available ! in=mation to appropriate ,sector ,risk ,managem5t ,ag5cies & o!r appropriate ,f$]al ag5cies4 7b7 ,int]ag5cy %>+ ,! ,presid5t or a designee ( ! ,presid5t-- 7#a7 may e/abli% a specific "t requirem5t = %>+ in=mation "u subsection 7a77#aa72 & 7#b7 %all det]m9e ! appropriate ,f$]al ag5cies "u subsection 7a77#aa74 7c7 ,p]iodic brief+ ,n lat] ?an #fj days aft] ! effective date ( ! f9al rule requir$ "u section #bbdb7;b71 & on ! fir/ day ( ea* mon? !reaft]1 ! ,director1 9 consultation ) ! ,national ,cyb] ,director1 ! ,attorney ,g5]al1 & ! ,director ( ,national ,intellig5ce1 %all provide to ! majority lead] ( ! ,s5ate1 ! m9ority lead] ( ! ,s5ate1 ! ,speak] ( ! ,h\se ( ,repres5tatives1 ! m9ority lead] ( ! ,h\se ( ,repres5tatives1 ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate1 & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a brief+ t *>act]izes ! national cyb] ?reat l&scape1 includ+ ! ?reat fac+ ,f$]al ag5cies & cov]$ entities1 & applicable intellig5ce & law en=cem5t in=mation1 cov]$ cyb] incid5ts1 & ransomw>e attacks1 z ( ! date ( ! brief+1 :i* %all-- 7#a7 include ! total numb] ( reports submitt$ "u sections #bbdb & #bbdc dur+ ! prec$+ mon?1 includ+ a breakd[n ( requir$ & volunt>y reports2 7#b7 include any id5tifi$ tr5ds 9 cov]$ cyb] incid5ts & ransomw>e attacks ov] ! c\rse ( ! prec$+ mon? & z comp>$ to previ\s reports1 includ+ any tr5ds relat$ to ! in=mation collect$ 9 ! reports submitt$ "u sections #bbdb & #bbdc1 includ+-- 7,a7 ! infra/ructure1 tactics1 & te*niques malici\s cyb] actors commonly use2 & 7,b7 intellig5ce gaps t h imp$$1 or curr5tly are imp$+1 ! ability to c\nt] cov]$ cyb] incid5ts & ransomw>e ?reats2 7#c7 include a summ>y ( ! kn[n uses ( ! in=mation 9 reports submitt$ "u sections #bbdb & #bbdc2 & 7#d7 include an unclassifi$ portion1 b may include a classifi$ compon5t4 #bbdb4 ,requir$ report+ ( c]ta9 cyb] incid5ts 7a7 ,9 g5]al 7#a7 ,cov]$ cyb] incid5t reports 7,a7 ,9 g5]al ,a cov]$ entity t exp]i5ces a cov]$ cyb] incid5t %all report ! cov]$ cyb] incid5t to ! ,ag5cy n lat] ?an #gb h\rs aft] ! cov]$ entity reasonably believes t ! cov]$ cyb] incid5t has occurr$4 7,b7 ,limitation ,! ,director may n require report+ "u subp>agraph 7,a7 any e>li] ?an #gb h\rs aft] ! cov]$ entity reasonably believes t a cov]$ cyb] incid5t has occurr$4 7#b7 ,ransom paym5t reports 7,a7 ,9 g5]al ,a cov]$ entity t makes a ransom paym5t z ! result ( a ransomw>e attack aga9/ ! cov]$ entity %all report ! paym5t to ! ,ag5cy n lat] ?an #bd h\rs aft] ! ransom paym5t has be5 made4 7,b7 ,application ,! requirem5ts "u subp>agraph 7,a7 %all apply ev5 if ! ransomw>e attack is n a cov]$ cyb] incid5t subject to ! report+ requirem5ts "u p>agraph 7#a74 7#c7 ,supplem5tal reports ,a cov]$ entity %all promptly submit to ! ,ag5cy an update or supplem5t to a previ\sly submitt$ cov]$ cyb] incid5t report if sub/antial new or diff]5t in=mation becomes available or if ! cov]$ entity makes a ransom paym5t aft] submitt+ a cov]$ cyb] incid5t report requir$ "u p>agraph 7#a71 until su* date t su* cov]$ entity notifies ! ,ag5cy t ! cov]$ cyb] incid5t at issue has conclud$ & has be5 fully mitigat$ & resolv$4 7#d7 ,pres]vation ( in=mation ,any cov]$ entity subject to requirem5ts ( p>agraph 7#a71 7#b71 or 7#c7 %all pres]ve data relevant to ! cov]$ cyb] incid5t or ransom paym5t 9 accordance ) proc$ures e/abli%$ 9 ! f9al rule issu$ pursuant to subsection 7b74 7#e7 ,exceptions 7,a7 ,report+ ( cov]$ cyb] incid5t ) ransom paym5t ,if a cov]$ entity is ! victim ( a cov]$ cyb] incid5t & makes a ransom paym5t prior to ! #gb h\r requirem5t "u p>agraph 7#a71 su* t ! report+ requirem5ts "u p>agraphs 7#a7 & 7#b7 bo? apply1 ! cov]$ entity may submit a s+le report to satisfy ! requirem5ts ( bo? p>agraphs 9 accordance ) proc$ures e/abli%$ 9 ! f9al rule issu$ pursuant to subsection 7b74 7,b7 ,sub/antially simil> report$ in=mation 7i7 ,9 g5]al ,subject to ! limitation describ$ 9 clause 7ii71 :]e ! ,ag5cy has an agreem5t 9 place t satisfies ! requirem5ts ( section #d7;a7 ( ! ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb1 ! requirem5ts "u p>agraphs 7#a71 7#b71 & 7#c7 %all n apply to a cov]$ entity requir$ by law1 regulation1 or contract to report sub/antially simil> in=mation to ano!r ,f$]al ag5cy )9 a sub/antially simil> timeframe4 7ii7 ,limitation ,! exemption 9 clause 7i7 %all take effect ) respect to a cov]$ entity once an ag5cy agreem5t & %>+ me*anism is 9 place betwe5 ! ,ag5cy & ! respective ,f$]al ag5cy1 pursuant to section #d7;a7 ( ! ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb4 7iii7 ,rules ( con/ruction ,no?+ 9 ?is p>agraph %all be con/ru$ to-- 7,i7 exempt a cov]$ entity f ! report+ requirem5ts "u p>agraph 7#c7 unless ! supplem5tal report also meets ! requirem5ts ( clauses 7i7 & 7ii7 ( ?is p>agraph2 7,,ii7 prev5t ! ,ag5cy f contact+ an entity submitt+ in=mation to ano!r ,f$]al ag5cy t is provid$ to ! ,ag5cy pursuant to section #d ( ! ,cyb] ,incid5t ,report+ = ,critical ,infra/ructure ,act ( #bjbb2 or 7,,iii7 prev5t an entity f communicat+ ) ! ,ag5cy4 7,c7 ,doma9 "n sy/em ,! requirem5ts "u p>agraphs 7#a71 7#b7 & 7#c7 %all n apply to a cov]$ entity or ! functions ( a cov]$ entity t ! ,director det]m9es con/itute critical infra/ructure own$1 op]at$1 or gov]n$ by multi-/akehold] organizations t develop1 implem5t1 & en=ce policies conc]n+ ! ,doma9 ,"n ,sy/em1 su* z ! ,int]net ,corporation = ,assign$ ,names & ,numb]s or ! ,int]net ,assign$ ,numb]s ,au?ority4 7#f7 ,mann]1 tim+1 & =m ( reports ,reports made "u p>agraphs 7#a71 7#b71 & 7#c7 %all be made 9 ! mann] & =m1 & )9 ! "t p]iod 9 ! case ( reports made "u p>agraph 7#c71 prescrib$ 9 ! f9al rule issu$ pursuant to subsection 7b74 7#g7 ,effective date ,p>agraphs 7#a7 ?r\gh 7#d7 %all take effect on ! dates prescrib$ 9 ! f9al rule issu$ pursuant to subsection 7b74 7b7 ,rulemak+ 7#a7 ,notice ( propos$ rulemak+ ,n lat] ?an #bd mon?s aft] ! date ( enactm5t ( ?is section1 ! ,director1 9 consultation ) ,sector ,risk ,managem5t ,ag5cies1 ! ,dep>tm5t ( ,ju/ice1 & o!r ,f$]al ag5cies1 %all publi% 9 ! ,f$]al ,regi/] a notice ( propos$ rulemak+ to implem5t subsection 7a74 7#b7 ,f9al rule ,n lat] ?an #ah mon?s aft] publication ( ! notice ( propos$ rulemak+ "u p>agraph 7#a71 ! ,director %all issue a f9al rule to implem5t subsection 7a74 7#c7 ,subsequ5t rulemak+s 7,a7 ,9 g5]al ,! ,director is au?oriz$ to issue regulations to am5d or revise ! f9al rule issu$ pursuant to p>agraph 7#b74 7,b7 ,proc$ures ,any subsequ5t rules issu$ "u subp>agraph 7,a7 %all comply ) ! requirem5ts "u *apt] #e ( title #e1 ,unit$ ,/ates ,code1 includ+ ! issuance ( a notice ( propos$ rulemak+ "u section #eec ( su* title4 7c7 ,elem5ts ,! f9al rule issu$ pursuant to subsection 7b7 %all be compos$ ( ! foll[+ elem5ts3 7#a7 ,a cle> description ( ! types ( entities t con/itute cov]$ entities1 bas$ on-- 7,a7 ! consequ5ces t disruption to or compromise ( su* an entity c\ld cause to national security1 economic security1 or public heal? & safety2 7,b7 ! likelihood t su* an entity may be t>get$ by a malici\s cyb] actor1 includ+ a =eign c\ntry2 & 7,c7 ! ext5t to :i* damage1 disruption1 or unau?oriz$ access to su* an entity1 includ+ ! access+ ( s5sitive cyb]security vuln]ability in=mation or p5etration te/+ tools or te*niques1 w likely enable ! disruption ( ! reliable op]ation ( critical infra/ructure4 7#b7 ,a cle> description ( ! types ( sub/antial cyb] incid5ts t con/itute cov]$ cyb] incid5ts1 :i* %all-- 7,a7 at a m9imum1 require ! occurr5ce (-- 7i7 a cyb] incid5t t leads to sub/antial loss ( confid5tiality1 integrity1 or availability ( su* in=mation sy/em or network1 or a s]i\s impact on ! safety & resili5cy ( op]ational sy/ems & processes2 7ii7 a disruption ( bus9ess or indu/rial op]ations1 includ+ due to a d5ial ( s]vice attack1 ransomw>e attack1 or exploitation ( a z]o day vuln]ability1 aga9/ 7,i7 an in=mation sy/em or network2 or 7,,ii7 an op]ational te*nology sy/em or process2 or 7iii7 unau?oriz$ access or disruption ( bus9ess or indu/rial op]ations due to loss ( s]vice facilitat$ ?r\gh1 or caus$ by1 a compromise ( a cl\d s]vice provid]1 manag$ s]vice provid]1 or o!r ?ird-p>ty data ho/+ provid] or by a supply *a9 compromise2 7,b7 consid]-- 7i7 ! sophi/ication or novelty ( ! tactics us$ to p]petrate su* a cyb] incid5t1 z well z ! type1 volume1 & s5sitivity ( ! data at issue2 7ii7 ! numb] ( individuals directly or indirectly affect$ or pot5tially affect$ by su* a cyb] incid5t2 & 7iii7 pot5tial impacts on indu/rial control sy/ems1 su* z sup]visory control & data acquisition sy/ems1 di/ribut$ control sy/ems1 & programmable logic controll]s2 & 7,c7 exclude-- 7i7 any ev5t :]e ! cyb] incid5t is p]petrat$ 9 good fai? by an entity 9 response to a specific reque/ by ! own] or op]ator ( ! in=mation sy/em2 & 7ii7 ! ?reat ( disruption z extortion1 z describ$ 9 section #bbdj7ad77;,a74 7#c7 ,a requirem5t t1 if a cov]$ cyb] incid5t or a ransom paym5t occurs foll[+ an exempt$ ?reat describ$ 9 p>agraph 7#b77;,c77ii71 ! cov]$ entity %all comply ) ! requirem5ts 9 ?is subtitle 9 report+ ! cov]$ cyb] incid5t or ransom paym5t4 7#d7 ,a cle> description ( ! specific requir$ cont5ts ( a report pursuant to subsection 7a77#a71 :i* %all include ! foll[+ in=mation1 to ! ext5t applicable & available1 ) respect to a cov]$ cyb] incid5t3 7,a7 ,a description ( ! cov]$ cyb] incid5t1 includ+-- 7i7 id5tification & a description ( ! function ( ! affect$ in=mation sy/ems1 networks1 or devices t 71 or are reasonably believ$ to h be51 affect$ by su* cyb] incid5t2 7ii7 a description ( ! unau?oriz$ access ) sub/antial loss ( confid5tiality1 integrity1 or availability ( ! affect$ in=mation sy/em or network or disruption ( bus9ess or indu/rial op]ations2 7iii7 ! e/imat$ date range ( su* incid5t2 & 7iv7 ! impact to ! op]ations ( ! cov]$ entity4 7,b7 ,:]e applicable1 a description ( ! vuln]abilities exploit$ & ! security def5ses t 7 9 place1 z well z ! tactics1 te*niques1 & proc$ures us$ to p]petrate ! cov]$ cyb] incid5t4 7,c7 ,:]e applicable1 any id5tify+ or contact in=mation relat$ to ea* actor reasonably believ$ to be responsible = su* cyb] incid5t4 7,d7 ,:]e applicable1 id5tification ( ! category or categories ( in=mation t 71 or are reasonably believ$ to h be51 access$ or acquir$ by an unau?oriz$ p]son4 7,e7 ,! "n & o!r in=mation t cle>ly id5tifies ! cov]$ entity impact$ by ! cov]$ cyb] incid5t1 includ+1 z applicable1 ! ,/ate ( incorporation or =mation ( ! cov]$ entity1 trade names1 legal names1 or o!r id5tifi]s4 7,f7 ,contact in=mation1 su* z telephone numb] or electronic mail address1 t ! ,ag5cy may use to contact ! cov]$ entity or an au?oriz$ ag5t ( su* cov]$ entity1 or1 :]e applicable1 ! s]vice provid] ( su* cov]$ entity act+ ) ! express p]mission (1 & at ! direction (1 ! cov]$ entity to assi/ ) compliance ) ! requirem5ts ( ?is subtitle4 7#e7 ,a cle> description ( ! specific requir$ cont5ts ( a report pursuant to subsection 7a77#b71 :i* %all be ! foll[+ in=mation1 to ! ext5t applicable & available1 ) respect to a ransom paym5t3 7,a7 ,a description ( ! ransomw>e attack1 includ+ ! e/imat$ date range ( ! attack4 7,b7 ,:]e applicable1 a description ( ! vuln]abilities1 tactics1 te*niques1 & proc$ures us$ to p]petrate ! ransomw>e attack4 7,c7 ,:]e applicable1 any id5tify+ or contact in=mation relat$ to ! actor or actors reasonably believ$ to be responsible = ! ransomw>e attack4 7,d7 ,! "n & o!r in=mation t cle>ly id5tifies ! cov]$ entity t made ! ransom paym5t or on ^: behalf ! paym5t 0 made4 7,e7 ,contact in=mation1 su* z telephone numb] or electronic mail address1 t ! ,ag5cy may use to contact ! cov]$ entity t made ! ransom paym5t or an au?oriz$ ag5t ( su* cov]$ entity1 or1 :]e applicable1 ! s]vice provid] ( su* cov]$ entity act+ ) ! express p]mission (1 & at ! direction (1 t cov]$ entity to assi/ ) compliance ) ! requirem5ts ( ?is subtitle4 7,f7 ,! date ( ! ransom paym5t4 7,g7 ,! ransom paym5t dem&1 includ+ ! type ( virtual curr5cy or o!r commodity reque/$1 if applicable4 7,h7 ,! ransom paym5t in/ructions1 includ+ in=mation reg>d+ :]e to s5d ! paym5t1 su* z ! virtual curr5cy address or physical address ! funds 7 reque/$ to be s5t to1 if applicable4 7,i7 ,! am\nt ( ! ransom paym5t4 7#f7 ,a cle> description ( ! types ( data requir$ to be pres]v$ pursuant to subsection 7a77#d71 ! p]iod ( "t = :i* ! data is requir$ to be pres]v$1 & all[able uses1 processes1 & proc$ures4 7#g7 ,deadl9es & crit]ia = submitt+ supplem5tal reports to ! ,ag5cy requir$ "u subsection 7a77#c71 :i* %all-- 7,a7 be e/abli%$ by ! ,director 9 consultation ) ! ,c\ncil2 7,b7 consid] any exi/+ regulatory report+ requirem5ts simil> 9 scope1 purpose1 & tim+ to ! report+ requirem5ts to :i* su* a cov]$ entity may also be subject1 & make ef=ts to h>monize ! tim+ & cont5ts ( any su* reports to ! maximum ext5t practicable2 7,c7 balance ! ne$ = situational aw>5ess ) ! ability ( ! cov]$ entity to conduct cyb] incid5t response & inve/igations2 & 7,d7 provide a cle> description ( :at con/itutes sub/antial new or diff]5t in=mation4 7#h7 ,proc$ures =-- 7,a7 entities1 includ+ ?ird p>ties pursuant to subsection 7d77#a71 to submit reports requir$ by p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a71 includ+ ! mann] & =m !re(1 :i* %all include1 at a m9imum1 a concise1 us]-fri5dly web-bas$ =m2 7,b7 ! ,ag5cy to c>ry out-- 7i7 ! en=cem5t provisions ( section #bbdd1 includ+ ) respect to ! issuance1 s]vice1 )drawal1 ref]ral process1 & en=cem5t ( subpo5as1 appeals & due process proc$ures2 7ii7 o!r available en=cem5t me*anisms includ+ acquisition1 susp5sion & deb>m5t proc$ures2 & 7iii7 o!r aspects ( noncompliance2 7,c7 implem5t+ ! exceptions provid$ 9 subsection 7a77#e72 & 7,d7 protect+ privacy & civil lib]ties consi/5t ) processes adopt$ pursuant to section #aje7;b7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aejd7;b77 & anonymiz+ & safegu>d+1 or no long] reta9+1 in=mation receiv$ & disclos$ ?r\gh cov]$ cyb] incid5t reports & ransom paym5t reports t is kn[n to be p]sonal in=mation ( a specific individual or in=mation t id5tifies a specific individual t is n directly relat$ to a cyb]security ?reat4 7#i7 ,o!r proc$ural measures directly necess>y to implem5t subsection 7a74 7d7 ,?ird p>ty report submission & ransom paym5t 7#a7 ,report submission ,a cov]$ entity t is requir$ to submit a cov]$ cyb] incid5t report or a ransom paym5t report may use a ?ird p>ty1 su* z an incid5t response company1 insurance provid]1 s]vice provid]1 ,in=mation ,%>+ & ,analysis ,organization1 or law firm1 to submit ! requir$ report "u subsection 7a74 7#b7 ,ransom paym5t ,if a cov]$ entity impact$ by a ransomw>e attack uses a ?ird p>ty to make a ransom paym5t1 ! ?ird p>ty %all n be requir$ to submit a ransom paym5t report = itself "u subsection 7a77#b74 7#c7 ,duty to report ,?ird-p>ty report+ "u ?is subp>agraph does n relieve a cov]$ entity f ! duty to comply ) ! requirem5ts = cov]$ cyb] incid5t report or ransom paym5t report submission4 7#d7 ,responsibility to advise ,any ?ird p>ty us$ by a cov]$ entity t kn[+ly makes a ransom paym5t on behalf ( a cov]$ entity impact$ by a ransomw>e attack %all advise ! impact$ cov]$ entity ( ! responsibilities ( ! impact$ cov]$ entity reg>d+ report+ ransom paym5ts "u ?is section4 7e7 ,outrea* to cov]$ entities 7#a7 ,9 g5]al ,! ,ag5cy %all conduct an outrea* & education campaign to in=m likely cov]$ entities1 entities t (f] or adv]tise z a s]vice to cu/om]s to make or facilitate ransom paym5ts on behalf ( cov]$ entities impact$ by ransomw>e attacks & o!r appropriate entities ( ! requirem5ts ( p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a74 7#b7 ,elem5ts ,! outrea* & education campaign "u p>agraph 7#a7 %all include ! foll[+3 7,a7 ,an ov]view ( ! f9al rule issu$ pursuant to subsection 7b74 7,b7 ,an ov]view ( me*anisms to submit to ! ,ag5cy cov]$ cyb] incid5t reports1 ransom paym5t reports1 & in=mation relat+ to ! disclosure1 ret5tion1 & use ( cov]$ cyb] incid5t reports & ransom paym5t reports "u ?is section4 7,c7 ,an ov]view ( ! protections af=d$ to cov]$ entities = comply+ ) ! requirem5ts "u p>agraphs 7#a71 7#b71 & 7#c7 ( subsection 7a74 7,d7 ,an ov]view ( ! /eps tak5 "u section #bbdd :5 a cov]$ entity is n 9 compliance ) ! report+ requirem5ts "u subsection 7a74 7,e7 ,specific outrea* to cyb]security v5dors1 cyb] incid5t response provid]s1 cyb]security insurance entities1 & o!r entities t may support cov]$ entities4 7,f7 ,an ov]view ( ! privacy & civil lib]ties requirem5ts 9 ?is subtitle4 7#c7 ,coord9ation ,9 conduct+ ! outrea* & education campaign requir$ "u p>agraph 7#a71 ! ,ag5cy may coord9ate )-- 7,a7 ! ,critical ,infra/ructure ,p>tn]%ip ,advisory ,c\ncil e/abli%$ "u section #hga2 7,b7 ,in=mation ,%>+ & ,analysis ,organizations2 7,c7 trade associations2 7,d7 in=mation %>+ & analysis c5t]s2 7,e7 sector coord9at+ c\ncils2 & 7,f7 any o!r entity z det]m9$ appropriate by ! ,director4 7f7 ,exemption ,sections #cejf7;c71 #cejg1 #cejh1 & #ceji ( title #dd1 ,unit$ ,/ates ,code1 %all n apply to any action to c>ry out ?is section4 7g7 ,rule ( con/ruction ,no?+ 9 ?is section %all affect ! au?orities ( ! ,f$]al ,gov]nm5t to implem5t ! requirem5ts ( ,executive ,ord] #adjbh 7#hf ,f$4 ,reg4 #bffcc2 relat+ to improv+ ! nation's cyb]security71 includ+ *anges to ! ,f$]al ,acquisition ,regulations & rem$ies to include susp5sion & deb>m5t4 7h7 ,sav+s provision ,no?+ 9 ?is section %all be con/ru$ to sup]s$e or to abrogate1 modify1 or o!rwise limit ! au?ority t is ve/$ 9 any (fic] or any ag5cy ( ! ,unit$ ,/ates ,gov]nm5t to regulate or take action ) respect to ! cyb]security ( an entity4 #bbdc4 ,volunt>y report+ ( o!r cyb] incid5ts 7a7 ,9 g5]al ,entities may volunt>ily report cyb] incid5ts or ransom paym5ts to ! ,ag5cy t are n requir$ "u p>agraph 7#a71 7#b71 or 7#c7 ( section #bbdb7;a71 b may enhance ! situational aw>5ess ( cyb] ?reats4 7b7 ,volunt>y provision ( additional in=mation 9 requir$ reports ,cov]$ entities may volunt>ily include 9 reports requir$ "u p>agraph 7#a71 7#b71 or 7#c7 ( section #bbdb7;a7 in=mation t is n requir$ to be includ$1 b may enhance ! situational aw>5ess ( cyb] ?reats4 7c7 ,application ( protections ,! protections "u section #bbde applicable to reports made "u section #bbdb %all apply 9 ! same mann] & to ! same ext5t to reports & in=mation submitt$ "u subsections 7a7 & 7b74 #bbdd4 ,noncompliance ) requir$ report+ 7a7 ,purpose ,9 ! ev5t t a cov]$ entity t is requir$ to submit a report "u section #bbdb7;a7 fails to comply ) ! requirem5t to report1 ! ,director may obta9 in=mation ab\t ! cyb] incid5t or ransom paym5t by engag+ ! cov]$ entity directly to reque/ in=mation ab\t ! cyb] incid5t or ransom paym5t1 & if ! ,director is unable to obta9 in=mation ?r\gh su* engagem5t1 by issu+ a subpo5a to ! cov]$ entity1 pursuant to subsection 7c71 to ga!r in=mation suffici5t to det]m9e :e!r a cov]$ cyb] incid5t or ransom paym5t has occurr$4 7b7 ,initial reque/ = in=mation 7#a7 ,9 g5]al ,if ! ,director has reason to believe1 :e!r ?r\gh public report+ or o!r in=mation 9 ! possession ( ! ,f$]al ,gov]nm5t1 includ+ ?r\gh analysis p]=m$ pursuant to p>agraph 7#a7 or 7#b7 ( section #bbda7;a71 t a cov]$ entity has exp]i5c$ a cov]$ cyb] incid5t or made a ransom paym5t b fail$ to report su* cyb] incid5t or paym5t to ! ,ag5cy 9 accordance ) section #bbdb7;a71 ! ,director may reque/ additional in=mation f ! cov]$ entity to confirm :e!r or n a cov]$ cyb] incid5t or ransom paym5t has occurr$4 7#b7 ,treatm5t ,in=mation provid$ to ! ,ag5cy 9 response to a reque/ "u p>agraph 7#a7 %all be treat$ z if x 0 submitt$ ?r\gh ! report+ proc$ures e/abli%$ 9 section #bbdb4 7c7 ,en=cem5t 7#a7 ,9 g5]al ,if1 aft] ! date t is #gb h\rs f ! date on :i* ! ,director made ! reque/ = in=mation 9 subsection 7b71 ! ,director has receiv$ no response f ! cov]$ entity f :i* su* in=mation 0 reque/$1 or receiv$ an inadequate response1 ! ,director may issue to su* cov]$ entity a subpo5a to compel disclosure ( in=mation ! ,director deems necess>y to det]m9e :e!r a cov]$ cyb] incid5t or ransom paym5t has occurr$ & obta9 ! in=mation requir$ to be report$ pursuant to section #bbdb & any implem5t+ regulations1 & assess pot5tial impacts to national security1 economic security1 or public heal? & safety4 7#b7 ,civil action 7,a7 ,9 g5]al ,if a cov]$ entity fails to comply ) a subpo5a1 ! ,director may ref] ! matt] to ! ,attorney ,g5]al to br+ a civil action 9 a di/rict c\rt ( ! ,unit$ ,/ates to en=ce su* subpo5a4 7,b7 ,v5ue ,an action "u ?is p>agraph may be br\ght 9 ! judicial di/rict 9 :i* ! cov]$ entity aga9/ :i* ! action is br\ght resides1 is f\nd1 or does bus9ess4 7,c7 ,contempt ( c\rt ,a c\rt may puni% a failure to comply ) a subpo5a issu$ "u ?is subsection z contempt ( c\rt4 7#c7 ,non-delegation ,! au?ority ( ! ,director to issue a subpo5a "u ?is subsection may n be delegat$4 7#d7 ,au!ntication 7,a7 ,9 g5]al ,any subpo5a issu$ electronically pursuant to ?is subsection %all be au!nticat$ ) a cryptographic digital signature ( an au?oriz$ repres5tative ( ! ,ag5cy1 or o!r comp>able successor te*nology1 t all[s ! ,ag5cy to demon/rate t su* subpo5a 0 issu$ by ! ,ag5cy & has n be5 alt]$ or modifi$ s9ce su* issuance4 7,b7 ,invalid if n au!nticat$ ,any subpo5a issu$ electronically pursuant to ?is subsection t is n au!nticat$ 9 accordance ) subp>agraph 7,a7 %all n be consid]$ to be valid by ! recipi5t ( su* subpo5a4 7d7 ,provision ( c]ta9 in=mation to ,attorney ,g5]al 7#a7 ,9 g5]al ,not)/&+ section #bbde7;a77#e7 & p>agraph 7b77#b7 ( ?is section1 if ! ,director det]m9es1 bas$ on ! in=mation provid$ 9 response to a subpo5a issu$ pursuant to subsection 7c71 t ! facts relat+ to ! cyb] incid5t or ransom paym5t at issue may con/itute gr\nds = a regulatory en=cem5t action or crim9al prosecution1 ! ,director may provide su* in=mation to ! ,attorney ,g5]al or ! head ( ! appropriate ,f$]al regulatory ag5cy1 :o may use su* in=mation = a regulatory en=cem5t action or crim9al prosecution4 7#b7 ,consultation ,! ,director may consult ) ! ,attorney ,g5]al or ! head ( ! appropriate ,f$]al regulatory ag5cy :5 mak+ ! det]m9ation "u p>agraph 7#a74 7e7 ,consid]ations ,:5 det]m9+ :e!r to ex]cise ! au?orities provid$ "u ?is section1 ! ,director %all take into consid]ation-- 7#a7 ! complexity 9 det]m9+ if a cov]$ cyb] incid5t has occurr$2 & 7#b7 prior int]action ) ! ,ag5cy or aw>5ess ( ! cov]$ entity ( ! policies & proc$ures ( ! ,ag5cy = report+ cov]$ cyb] incid5ts & ransom paym5ts4 7f7 ,exclusions ,?is section %all n apply to a ,/ate1 local1 ,tribal1 or t]ritorial gov]nm5t entity4 7g7 ,report to ,congress ,! ,director %all submit to ,congress an annual report on ! numb] ( times ! ,director-- 7#a7 issu$ an initial reque/ = in=mation pursuant to subsection 7b72 7#b7 issu$ a subpo5a pursuant to subsection 7c72 or 7#c7 ref]r$ a matt] to ! ,attorney ,g5]al = a civil action pursuant to subsection 7c77#b74 7h7 ,publication ( ! annual report ,! ,director %all publi% a v]sion ( ! annual report requir$ "u subsection 7g7 on ! website ( ! ,ag5cy1 :i* %all include1 at a m9imum1 ! numb] ( times ! ,director-- 7#a7 issu$ an initial reque/ = in=mation pursuant to subsection 7b72 or 7#b7 issu$ a subpo5a pursuant to subsection 7c74 7i7 ,anonymization ( reports ,! ,director %all ensure any victim in=mation conta9$ 9 a report requir$ to be publi%$ "u subsection 7h7 be anonymiz$ be=e ! report is publi%$4 #bbde4 ,in=mation %>$ ) or provid$ to ! ,f$]al ,gov]nm5t 7a7 ,disclosure1 ret5tion1 & use 7#a7 ,au?oriz$ activities ,in=mation provid$ to ! ,ag5cy pursuant to section #bbdb or #bbdc may be disclos$ to1 reta9$ by1 & us$ by1 consi/5t ) o!rwise applicable provisions ( ,f$]al law1 any ,f$]al ag5cy or dep>tm5t1 compon5t1 (fic]1 employee1 or ag5t ( ! ,f$]al ,gov]nm5t solely =-- 7,a7 a cyb]security purpose2 7,b7 ! purpose ( id5tify+-- 7i7 a cyb] ?reat1 includ+ ! s\rce ( ! cyb] ?reat2 or 7ii7 a security vuln]ability2 7,c7 ! purpose ( respond+ to1 or o!rwise prev5t+ or mitigat+1 a specific ?reat ( dea?1 a specific ?reat ( s]i\s bodily h>m1 or a specific ?reat ( s]i\s economic h>m1 includ+ a t]rori/ act or use ( a weapon ( mass de/ruction2 7,d7 ! purpose ( respond+ to1 inve/igat+1 prosecut+1 or o!rwise prev5t+ or mitigat+1 a s]i\s ?reat to a m9or1 includ+ sexual exploitation & ?reats to physical safety2 or 7,e7 ! purpose ( prev5t+1 inve/igat+1 disrupt+1 or prosecut+ an (f5se aris+ out ( a cyb] incid5t report$ pursuant to section #bbdb or #bbdc or any ( ! (f5ses li/$ 9 section #aje7;d77#e77;,a77v7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7#b7 ,ag5cy actions aft] receipt 7,a7 ,rapid1 confid5tial %>+ ( cyb] ?reat indicators ,^u receiv+ a cov]$ cyb] incid5t or ransom paym5t report submitt$ pursuant to ?is section1 ! ,ag5cy %all imm$iately review ! report to det]m9e :e!r ! cyb] incid5t t is ! subject ( ! report is connect$ to an ongo+ cyb] ?reat or security vuln]ability & :]e applicable1 use su* report to id5tify1 develop1 & rapidly dissem9ate to appropriate /akehold]s actionable1 anonymiz$ cyb] ?reat indicators & def5sive measures4 7,b7 ,pr9ciples = %>+ security vuln]abilities ,) respect to in=mation 9 a cov]$ cyb] incid5t or ransom paym5t report reg>d+ a security vuln]ability ref]r$ to 9 p>agraph 7#a77;,b77ii71 ! ,director %all develop pr9ciples t gov]n ! tim+ & mann] 9 :i* in=mation relat+ to security vuln]abilities may be %>$1 consi/5t ) common indu/ry be/ practices & ,unit$ ,/ates & int]national /&>ds4 7#c7 ,privacy & civil lib]ties ,in=mation conta9$ 9 cov]$ cyb] incid5t & ransom paym5t reports submitt$ to ! ,ag5cy pursuant to section #bbdb %all be reta9$1 us$1 & dissem9at$1 :]e p]missible & appropriate1 by ! ,f$]al ,gov]nm5t 9 accordance ) processes to be develop$ = ! protection ( p]sonal in=mation consi/5t ) processes adopt$ pursuant to section #aje ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aejd7 & 9 a mann] t protects f unau?oriz$ use or disclosure any in=mation t may conta9-- 7,a7 p]sonal in=mation ( a specific individual t is n directly relat$ to a cyb]security ?reat2 or 7,b7 in=mation t id5tifies a specific individual t is n directly relat$ to a cyb]security ?reat4 7#d7 ,digital security ,! ,ag5cy %all ensure t reports submitt$ to ! ,ag5cy pursuant to section #bbdb1 & any in=mation conta9$ 9 ^? reports1 are collect$1 /or$1 & protect$ at a m9imum 9 accordance ) ! requirem5ts = mod]ate impact ,f$]al in=mation sy/ems1 z describ$ 9 ,f$]al ,in=mation ,process+ ,/&>ds ,publication #aii1 or any successor docum5t4 7#e7 ,prohibition on use ( in=mation 9 regulatory actions 7,a7 ,9 g5]al ,a ,f$]al1 ,/ate1 local1 or ,tribal gov]nm5t %all n use in=mation ab\t a cov]$ cyb] incid5t or ransom paym5t obta9$ solely ?r\gh report+ directly to ! ,ag5cy 9 accordance ) ?is subtitle to regulate1 includ+ ?r\gh an en=cem5t action1 ! activities ( ! cov]$ entity or entity t made a ransom paym5t1 unless ! gov]nm5t entity expressly all[s entities to submit reports to ! ,ag5cy to meet regulatory report+ obligations ( ! entity4 7,b7 ,cl>ification ,a report submitt$ to ! ,ag5cy pursuant to section #bbdb or #bbdc may1 consi/5t ) ,f$]al or ,/ate regulatory au?ority specifically relat+ to ! prev5tion & mitigation ( cyb]security ?reats to in=mation sy/ems1 in=m ! developm5t or implem5tation ( regulations relat+ to su* sy/ems4 7b7 ,protections = report+ entities & in=mation ,reports describ+ cov]$ cyb] incid5ts or ransom paym5ts submitt$ to ! ,ag5cy by entities 9 accordance ) section #bbdb1 z well z volunt>ily-submitt$ cyb] incid5t reports submitt$ to ! ,ag5cy pursuant to section #bbdc1 %all-- 7#a7 be consid]$ ! comm]cial1 f9ancial1 & propriet>y in=mation ( ! cov]$ entity :5 s designat$ by ! cov]$ entity2 7#b7 be exempt f disclosure "u section #eeb7;b77#c7 ( title #e1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,fre$om ( ,in=mation ,act71 z well z any provision ( ,/ate1 ,tribal1 or local fre$om ( in=mation law1 op5 gov]nm5t law1 op5 meet+s law1 op5 records law1 sun%9e law1 or simil> law requir+ disclosure ( in=mation or records2 7#c7 be consid]$ n to con/itute a waiv] ( any applicable privilege or protection provid$ by law1 includ+ trade secret protection2 & 7#d7 n be subject to a rule ( any ,f$]al ag5cy or dep>tm5t or any judicial doctr9e reg>d+ ex p>te communications ) a decision-mak+ (ficial4 7c7 ,liability protections 7#a7 ,9 g5]al ,no cause ( action %all lie or be ma9ta9$ 9 any c\rt by any p]son or entity & any su* action %all be promptly dismiss$ = ! submission ( a report pursuant to section #bbdb7;a7 t is submitt$ 9 con=mance ) ?is subtitle & ! rule promulgat$ "u section #bbdb7;b71 except t ?is subsection %all n apply ) reg>d to an action by ! ,f$]al ,gov]nm5t pursuant to section #bbdd7;c77#b74 7#b7 ,scope ,! liability protections provid$ 9 ?is subsection %all only apply to or affect litigation t is solely bas$ on ! submission ( a cov]$ cyb] incid5t report or ransom paym5t report to ! ,ag5cy4 7#c7 ,re/rictions ,not)/&+ p>agraph 7#b71 no report submitt$ to ! ,ag5cy pursuant to ?is subtitle or any communication1 docum5t1 mat]ial1 or o!r record1 creat$ = ! sole purpose ( prep>+1 draft+1 or submitt+ su* report1 may be receiv$ 9 evid5ce1 subject to discov]y1 or o!rwise us$ 9 any trial1 he>+1 or o!r proce$+ 9 or be=e any c\rt1 regulatory body1 or o!r au?ority ( ! ,unit$ ,/ates1 a ,/ate1 or a political subdivision !re(1 provid$ t no?+ 9 ?is subtitle %all create a def5se to discov]y or o!rwise affect ! discov]y ( any communication1 docum5t1 mat]ial1 or o!r record n creat$ = ! sole purpose ( prep>+1 draft+1 or submitt+ su* report4 7d7 ,%>+ ) non-,f$]al entities ,! ,ag5cy %all anonymize ! victim :o report$ ! in=mation :5 mak+ in=mation provid$ 9 reports receiv$ "u section #bbdb available to critical infra/ructure own]s & op]ators & ! g5]al public4 7e7 ,/or$ ,communications ,act ,no?+ 9 ?is subtitle %all be con/ru$ to p]mit or require disclosure by a provid] ( a remote comput+ s]vice or a provid] ( an electronic communication s]vice to ! public ( in=mation n o!rwise p]mitt$ or requir$ to be disclos$ "u *apt] #aba ( title #ah1 ,unit$ ,/ates ,code 7commonly kn[n z ! ,/or$ ,communications ,act74 #bbdf4 ,cyb] ,incid5t ,report+ ,c\ncil 7a7 ,responsibility ( ! secret>y ,! ,secret>y %all lead an int]gov]nm5tal ,cyb] ,incid5t ,report+ ,c\ncil1 9 consultation ) ! ,director ( ! ,(fice ( ,managem5t & ,budget1 ! ,attorney ,g5]al1 ! ,national ,director ,cyb] ,director1 ,sector ,risk ,managem5t ,ag5cies1 & o!r appropriate ,f$]al ag5cies1 to coord9ate1 deconflict1 & h>monize ,f$]al incid5t report+ requirem5ts1 includ+ ^? issu$ ?r\gh regulations4 7b7 ,rule ( con/ruction ,no?+ 9 subsection 7a7 %all be con/ru$ to provide any additional regulatory au?ority to any ,f$]al entity4 4 7b7 ,te*nical & con=m+ am5dm5t ,! table ( cont5ts 9 section #a7;b7 ( ! ,homel& ,security ,act ( #bjjb 7,public ,law #ajg-bif2 #aaf ,/at4 #bace7 is am5d$ by ins]t+ aft] ! items relat+ to subtitle ,c ( title ,,xxii ! foll[+3 ,subtitle ,d--,cyb] ,incid5t ,reporting,sec4 #bbdj4 ,def9itions4,sec4 #bbda4 ,cyb] ,incid5t ,review4,sec4 #bbdb4 ,requir$ report+ ( c]ta9 cyb] incid5ts4,sec4 #bbdc4 ,volunt>y report+ ( o!r cyb] incid5ts4,sec4 #bbdd4 ,noncompliance ) requir$ report+4,sec4 #bbde4 ,in=mation %>$ ) or provid$ to ! ,f$]al ,gov]nm5t4,sec4 #bbdf4 ,cyb] ,incid5t ,report+ ,c\ncil4 4 #bjd4 ,f$]al %>+ ( incid5t reports 7a7 ,cyb] incid5t report+ %>+ 7#a7 ,9 g5]al ,not)/&+ any o!r provision ( law or regulation1 any ,f$]al ag5cy1 includ+ any indep5d5t e/abli%m5t 7z def9$ 9 section #ajd ( title #e1 ,unit$ ,/ates ,code71 t receives a report f an entity ( a cyb] incid5t1 includ+ a ransomw>e attack1 %all provide ! report to ! ,ag5cy z soon z possible1 b n lat] ?an #bd h\rs aft] receiv+ ! report1 unless a %ort] p]iod is requir$ by an agreem5t made betwe5 ! ,dep>tm5t ( ,homel& ,security 7includ+ ! ,cyb]security & ,infra/ructure ,security ,ag5cy7 & ! recipi5t ,f$]al ag5cy4 ,! ,director %all %>e & coord9ate ea* report pursuant to section #bbda7;b7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title4 7#b7 ,rule ( con/ruction ,! requirem5ts describ$ 9 p>agraph 7#a7 & section #bbde7;d7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 may n be con/ru$ to be a violation ( any provision ( law or policy t w\ld o!rwise prohibit disclosure or provision ( in=mation )9 ! executive bran*4 7#c7 ,protection ( in=mation ,! ,director %all comply ) any obligations ( ! recipi5t ,f$]al ag5cy describ$ 9 p>agraph 7#a7 to protect in=mation1 includ+ ) respect to privacy1 confid5tiality1 or in=mation security1 if ^? obligations w\ld impose great] protection requirem5ts ?an ?is ,act or ! am5dm5ts made by ?is ,act4 7#d7 ,effective date ,?is subsection %all take effect on ! effective date ( ! f9al rule issu$ pursuant to section #bbdb7;b7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title4 7#e7 ,ag5cy agreem5ts 7,a7 ,9 g5]al ,! ,ag5cy & any ,f$]al ag5cy1 includ+ any indep5d5t e/abli%m5t 7z def9$ 9 section #ajd ( title #e1 ,unit$ ,/ates ,code7 t receives incid5t reports f entities1 includ+ due to ransomw>e attacks1 %all1 z appropriate1 ent] into a docum5t$ agreem5t to e/abli% policies1 processes1 proc$ures1 & me*anisms to ensure reports are %>$ ) ! ,ag5cy pursuant to p>agraph 7#a74 7,b7 ,availability ,to ! maximum ext5t practicable1 ea* docum5t$ agreem5t requir$ "u subp>agraph 7,a7 %all be made publicly available4 7,c7 ,requirem5t ,! docum5t$ agreem5ts requir$ by subp>agraph 7,a7 %all require reports be %>$ f ,f$]al ag5cies ) ! ,ag5cy 9 su* "t z to meet ! ov]all timel9e = cov]$ entity report+ ( cov]$ cyb] incid5ts & ransom paym5ts e/abli%$ 9 section #bbdb ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title4 7b7 ,h>moniz+ report+ requirem5ts ,! ,secret>y ( ,homel& ,security1 act+ ?r\gh ! ,director1 %all1 9 consultation ) ! ,cyb] ,incid5t ,report+ ,c\ncil describ$ 9 section #bbdf ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 to ! maximum ext5t practicable-- 7#a7 p]iodically review exi/+ regulatory requirem5ts1 includ+ ! in=mation requir$ 9 su* reports1 to report incid5ts & ensure t any su* report+ requirem5ts & proc$ures avoid conflict+1 duplicative1 or burd5some requirem5ts2 & 7#b7 coord9ate ) appropriate ,f$]al p>tn]s & regulatory au?orities t receive reports relat+ to incid5ts to id5tify opportunities to /reaml9e report+ processes1 & :]e feasible1 facilitate int]ag5cy agreem5ts betwe5 su* au?orities to p]mit ! %>+ ( su* reports1 consi/5t ) applicable law & policy1 )\t impact+ ! ability ( ! ,ag5cy to ga9 timely situational aw>5ess ( a cov]$ cyb] incid5t or ransom paym5t4 #bje4 ,ransomw>e vuln]ability w>n+ pilot program 7a7 ,program ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all e/abli% a ransomw>e vuln]ability w>n+ pilot program to lev]age exi/+ au?orities & te*nology to specifically develop processes & proc$ures =1 & to d$icate res\rces to1 id5tify+ in=mation sy/ems t conta9 security vuln]abilities associat$ ) common ransomw>e attacks1 & to notify ! own]s ( ^? vuln]able sy/ems ( _! security vuln]ability4 7b7 ,id5tification ( vuln]able sy/ems ,! pilot program e/abli%$ "u subsection 7a7 %all-- 7#a7 id5tify ! mo/ common security vuln]abilities utiliz$ 9 ransomw>e attacks & mitigation te*niques2 & 7#b7 utilize exi/+ au?orities to id5tify in=mation sy/ems t conta9 ! security vuln]abilities id5tifi$ 9 p>agraph 7#a74 7c7 ,entity notification 7#a7 ,id5tification ,if ! ,director is able to id5tify ! entity at risk t owns or op]ates a vuln]able in=mation sy/em id5tifi$ 9 subsection 7b71 ! ,director may notify ! own] ( ! in=mation sy/em4 7#b7 ,no id5tification ,if ! ,director is n able to id5tify ! entity at risk t owns or op]ates a vuln]able in=mation sy/em id5tifi$ 9 subsection 7b71 ! ,director may utilize ! subpo5a au?ority pursuant to section #bbji ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fei7 to id5tify & notify ! entity at risk pursuant to ! proc$ures "u t section4 7#c7 ,requir$ in=mation ,a notification made "u p>agraph 7#a7 %all include in=mation on ! id5tifi$ security vuln]ability & mitigation te*niques4 7d7 ,prioritization ( notifications ,to ! ext5t practicable1 ! ,director %all prioritize cov]$ entities = id5tification & notification activities "u ! pilot program e/abli%$ "u ?is section4 7e7 ,limitation on proc$ures ,no proc$ure1 notification1 or o!r au?orities utiliz$ 9 ! execution ( ! pilot program e/abli%$ "u subsection 7a7 %all require an own] or op]ator ( a vuln]able in=mation sy/em to take any action z a result ( a notice ( a security vuln]ability made pursuant to subsection 7c74 7f7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to provide additional au?orities to ! ,director to id5tify vuln]abilities or vuln]able sy/ems4 7g7 ,t]m9ation ,! pilot program e/abli%$ "u subsection 7a7 %all t]m9ate on ! date t is #d ye>s aft] ! date ( enactm5t ( ?is ,act4 #bjf4 ,ransomw>e ?reat mitigation activities 7a7 ,jo9t ransomw>e task =ce 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,director1 9 consultation ) ! ,national ,cyb] ,director1 ! ,attorney ,g5]al1 & ! ,director ( ! ,f$]al ,bureau ( ,inve/igation1 %all e/abli% & *air ! ,jo9t ,ransomw>e ,task ,=ce to coord9ate an ongo+ nationwide campaign aga9/ ransomw>e attacks1 & id5tify & pursue opportunities = int]national coop]ation4 7#b7 ,composition ,! ,jo9t ,ransomw>e ,task ,=ce %all consi/ ( p>ticipants f ,f$]al ag5cies1 z det]m9$ appropriate by ! ,national ,cyb] ,director 9 consultation ) ! ,secret>y ( ,homel& ,security4 7#c7 ,responsibilities ,! ,jo9t ,ransomw>e ,task ,=ce1 utiliz+ only exi/+ au?orities ( ea* p>ticipat+ ,f$]al ag5cy1 %all coord9ate across ! ,f$]al ,gov]nm5t ! foll[+ activities3 7,a7 ,prioritization ( intellig5ce-driv5 op]ations to disrupt specific ransomw>e actors4 7,b7 ,consult ) relevant private sector1 ,/ate1 local1 ,tribal1 & t]ritorial gov]nm5ts & int]national /akehold]s to id5tify ne$s & e/abli% me*anisms = provid+ input into ! ,jo9t ,ransomw>e ,task ,=ce4 7,c7 ,id5tify+1 9 consultation ) relevant entities1 a li/ ( highe/ ?reat ransomw>e entities updat$ on an ongo+ basis1 9 ord] to facilitate-- 7i7 prioritization = ,f$]al action by appropriate ,f$]al ag5cies2 & 7ii7 id5tify metrics = success ( said actions4 7,d7 ,disrupt+ ransomw>e crim9al actors1 associat$ infra/ructure1 & _! f9ances4 7,e7 ,facilitat+ coord9ation & collaboration betwe5 ,f$]al entities & relevant entities1 includ+ ! private sector1 to improve ,f$]al actions aga9/ ransomw>e ?reats4 7,f7 ,collection1 %>+1 & analysis ( ransomw>e tr5ds to in=m ,f$]al actions4 7,g7 ,creation ( aft]-action reports & o!r lessons le>n$ f ,f$]al actions t id5tify successes & failures to improve subsequ5t actions4 7,h7 ,any o!r activities det]m9$ appropriate by ! ,jo9t ,ransomw>e ,task ,=ce to mitigate ! ?reat ( ransomw>e attacks4 7b7 ,rule ( con/ruction ,no?+ 9 ?is section %all be con/ru$ to provide any additional au?ority to any ,f$]al ag5cy4 #bjg4 ,congressional report+ 7a7 ,report on /akehold] engagem5t ,n lat] ?an #cj days aft] ! date on :i* ! ,director issues ! f9al rule "u section #bbdb7;b7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc7;b7 ( ?is title1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t describes h[ ! ,director engag$ /akehold]s 9 ! developm5t ( ! f9al rule4 7b7 ,report on opportunities to /r5g!n security rese>* ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report describ+ h[ ! ,national ,cyb]security & ,communications ,integration ,c5t] e/abli%$ "u section #bbji ( ! ,homel& ,security ,act ( #bjjb 7#f ,u4,s4,c4 #fei7 has c>ri$ out activities "u section #bbda7;a77#i7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc7;a7 ( ?is title1 by proactively id5tify+ opportunities to use cyb] incid5t data to in=m & enable cyb]security rese>* )9 ! academic & private sector4 7c7 ,report on ransomw>e vuln]ability w>n+ pilot program ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is ,act1 & annually !reaft] = ! duration ( ! pilot program e/abli%$ "u section #bje1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report1 :i* may include a classifi$ annex1 on ! effectiv5ess ( ! pilot program1 :i* %all include a discussion ( ! foll[+3 7#a7 ,! effectiv5ess ( ! notifications "u section #bje7;c7 9 mitigat+ security vuln]abilities & ! ?reat ( ransomw>e4 7#b7 ,id5tification ( ! mo/ common vuln]abilities utiliz$ 9 ransomw>e4 7#c7 ,! numb] ( notifications issu$ dur+ ! prec$+ ye>4 7#d7 ,to ! ext5t practicable1 ! numb] ( vuln]able devices or sy/ems mitigat$ "u ! pilot program by ! ,ag5cy dur+ ! prec$+ ye>4 7d7 ,report on h>monization ( report+ regulations 7#a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* ! ,secret>y ( ,homel& ,security conv5es ! ,cyb] ,incid5t ,report+ ,c\ncil describ$ 9 section #bbdf ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 ! ,secret>y ( ,homel& ,security %all submit to ! appropriate congressional committees a report t includes-- 7,a7 a li/ ( duplicative ,f$]al cyb] incid5t report+ requirem5ts on cov]$ entities2 7,b7 a description ( any *all5ges 9 h>moniz+ ! duplicative report+ requirem5ts2 7,c7 any actions ! ,director int5ds to take to facilitate h>moniz+ ! duplicative report+ requirem5ts2 & 7,d7 any propos$ legislative *anges necess>y to address ! duplicative report+4 7#b7 ,rule ( con/ruction ,no?+ 9 p>agraph 7#a7 %all be con/ru$ to provide any additional regulatory au?ority to any ,f$]al ag5cy4 7e7 ,,gao reports 7#a7 ,implem5tation ( ?is ,act ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report on ! implem5tation ( ?is ,act & ! am5dm5ts made by ?is ,act4 7#b7 ,exemptions to report+ ,n lat] ?an #a ye> aft] ! date on :i* ! ,director issues ! f9al rule requir$ "u section #bbdb7;b7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report on ! exemptions to report+ "u p>agraphs 7#b7 & 7#e7 ( section #bbdb7;a7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 :i* %all include-- 7,a7 to ! ext5t practicable1 an evaluation ( ! quantity ( cyb] incid5ts n report$ to ! ,f$]al ,gov]nm5t2 7,b7 an evaluation ( ! impact on impact$ entities1 homel& security1 & ! national economy due to cyb] incid5ts1 ransomw>e attacks1 & ransom paym5ts1 includ+ a discussion on ! scope ( impact ( cyb] incid5ts t 7 n report$ to ! ,f$]al ,gov]nm5t2 7,c7 an evaluation ( ! burd51 f9ancial & o!rwise1 on entities requir$ to report cyb] incid5ts "u ?is ,act1 includ+ an analysis ( entities t meet ! def9ition ( a small bus9ess conc]n "u section #c ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb72 & 7,d7 a description ( ! consequ5ces & effects ( limit+ cov]$ cyb] incid5t & ransom paym5t report+ to only cov]$ entities4 7f7 ,report on effectiv5ess ( en=cem5t me*anisms ,n lat] ?an #a ye> aft] ! date on :i* ! ,director issues ! f9al rule requir$ "u section #bbdb7;b7 ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title1 ! ,director %all submit to ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report on ! effectiv5ess ( ! en=cem5t me*anisms )9 section #bbdd ( ! ,homel& ,security ,act ( #bjjb1 z add$ by section #bjc ( ?is title4 ,,iii ,f$]al ,secure ,cl\d ,improvem5t & ,jobs ,act ( #bjbb #cja4 ,%ort title ,?is title may be cit$ z ! ,f$]al ,secure ,cl\d ,improvem5t & ,jobs ,act ( #bjbb4 #cjb4 ,f9d+s ,congress f9ds ! foll[+3 7#a7 ,ensur+ t ! ,f$]al ,gov]nm5t c securely lev]age cl\d comput+ products & s]vices is key to exp$it+ ! mod]nization ( legacy in=mation te*nology sy/ems1 increas+ cyb]security )9 & across dep>tm5ts & ag5cies1 & support+ ! cont9u$ lead]%ip ( ! ,unit$ ,/ates 9 te*nology innovation & job creation4 7#b7 ,accord+ to indep5d5t analysis1 z ( cal5d> ye> #bjai1 ! size ( ! cl\d comput+ m>ket _h tripl$ s9ce #bjjd1 enabl+ m ?an #b1jjj1jjj jobs & add+ m ?an #bjj1jjj1jjj1jjj to ! gross dome/ic product ( ! ,unit$ ,/ates4 7#c7 ,! ,f$]al ,gov]nm5t1 across multiple presid5tial adm9i/rations & ,congresses1 has cont9u$ to support ! ability ( ag5cies to move to ! cl\d1 includ+ ?r\gh-- 7,a7 ,presid5t ,b>ack ,obama's ,cl\d ,fir/ ,/rategy2 7,b7 ,presid5t ,donald ,trump's ,cl\d ,sm>t ,/rategy2 7,c7 ! prioritization ( cl\d security 9 ,executive ,ord] #adjbh 7#hf ,f$4 ,reg4 #bffcc2 relat+ to improv+ ! nation's cyb]security71 :i* 0 issu$ by ,presid5t ,joe ,bid52 & 7,d7 m ?an a decade ( appropriations & au?orization legislation t provides ag5cies ) relevant au?orities & appropriations to mod]nize on-premises in=mation te*nology sy/ems & m readily adopt cl\d comput+ products & s]vices4 7#d7 ,s9ce x 0 creat$ 9 #bjaa1 ! ,f$]al ,risk & ,au?orization ,managem5t ,program 7ref]r$ to 9 ?is section z ,fed,r,a,m,p7 at ! ,g5]al ,s]vices ,adm9i/ration has made /eady & su/a9$ improvem5ts 9 support+ ! secure au?orization & reuse ( cl\d comput+ products & s]vices )9 ! ,f$]al ,gov]nm5t1 includ+ by r$uc+ ! co/s & burd5s on bo? ag5cies & cl\d companies to quickly & securely ent] ! ,f$]al m>ket4 7#e7 ,accord+ to data f ! ,g5]al ,s]vices ,adm9i/ration1 z ( ! end ( fiscal ye> #bjba1 !re 7 #bci cl\d provid]s ) ,fed,r,a,m,p au?orizations1 & ^? au?orizations _h be5 reus$ m ?an #b1gjj times across v>i\s ag5cies4 7#f7 ,provid+ a legislative framework = ,fed,r,a,m,p & new au?orities to ! ,g5]al ,s]vices ,adm9i/ration1 ! ,(fice ( ,managem5t & ,budget1 & ,f$]al ag5cies w-- 7,a7 improve ! spe$ at :i* new cl\d comput+ products & s]vices c be securely au?oriz$2 7,b7 enhance ! ability ( ag5cies to effectively evaluate ,fed,r,a,m,p au?oriz$ provid]s = reuse2 7,c7 r$uce ! co/s & burd5s to cl\d provid]s seek+ a ,fed,r,a,m,p au?orization2 & 7,d7 provide = m robu/ transp>5cy & dialogue betwe5 indu/ry & ! ,f$]al ,gov]nm5t to drive /rong] adoption ( secure cl\d capabilities1 create jobs1 & r$uce wa/eful legacy in=mation te*nology4 #cjc4 ,title #dd am5dm5ts 7a7 ,am5dm5t ,*apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+3 #cfjg4 ,def9itions 7a7 ,9 g5]al ,except z provid$ "u subsection 7b71 ! def9itions "u sections #cejb & #ceeb apply to ?is section ?r\gh section #cfaf4 7b7 ,additional def9itions ,9 ?is section ?r\gh section #cfaf3 7#a7 ,adm9i/rator ,! t]m ,adm9i/rator means ! ,adm9i/rator ( ,g5]al ,s]vices4 7#b7 ,appropriate congressional committees ,! t]m appropriate congressional committees means ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives4 7#c7 ,au?orization to op]ate2 ,f$]al in=mation ,! t]ms au?orization to op]ate & ,f$]al in=mation h ! mean+ giv5 ^? t]m 9 ,circul> ,a-#acj ( ! ,(fice ( ,managem5t & ,budget entitl$ ,manag+ ,in=mation z a ,/rategic ,res\rce1 or any successor docum5t4 7#d7 ,cl\d comput+ ,! t]m cl\d comput+ has ! mean+ giv5 ! t]m 9 ,special ,publication #hjj-ade ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 or any successor docum5t4 7#e7 ,cl\d s]vice provid] ,! t]m cl\d s]vice provid] means an entity (f]+ cl\d comput+ products or s]vices to ag5cies4 7#f7 ,fed,r,a,m,p ,! t]m ,fed,r,a,m,p means ! ,f$]al ,risk & ,au?orization ,managem5t ,program e/abli%$ "u section #cfjh4 7#g7 ,fed,r,a,m,p au?orization ,! t]m ,fed,r,a,m,p au?orization means a c]tification t a cl\d comput+ product or s]vice has-- 7,a7 complet$ a ,fed,r,a,m,p au?orization process1 z det]m9$ by ! ,adm9i/rator2 or 7,b7 receiv$ a ,fed,r,a,m,p provisional au?orization to op]ate1 z det]m9$ by ! ,fed,r,a,m,p ,bo>d4 7#h7 ,f$ramp au?orization package ,! t]m ,fed,r,a,m,p au?orization package means ! ess5tial in=mation t c be us$ by an ag5cy to det]m9e :e!r to au?orize ! op]ation ( an in=mation sy/em or ! use ( a designat$ set ( common controls = all cl\d comput+ products & s]vices au?oriz$ by ,fed,r,a,m,p4 7#i7 ,fed,r,a,m,p ,bo>d ,! t]m ,fed,r,a,m,p ,bo>d means ! bo>d e/abli%$ "u section #cfaj4 7#aj7 ,indep5d5t assessm5t s]vice ,! t]m indep5d5t assessm5t s]vice means a ?ird-p>ty organization accr$it$ by ! ,adm9i/rator to und]take con=mity assessm5ts ( cl\d s]vice provid]s & ! products or s]vices ( cl\d s]vice provid]s4 7#aa7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,homel& ,security4 #cfjh4 ,f$]al ,risk & ,au?orization ,managem5t ,program ,!re is e/abli%$ )9 ! ,g5]al ,s]vices ,adm9i/ration ! ,f$]al ,risk & ,au?orization ,managem5t ,program4 ,! ,adm9i/rator1 subject to section #cfad1 %all e/abli% a ,gov]nm5t-wide program t provides a /&>diz$1 reusable approa* to security assessm5t & au?orization = cl\d comput+ products & s]vices t process unclassifi$ in=mation us$ by ag5cies4 #cfji4 ,roles & responsibilities ( ! ,g5]al ,s]vices ,adm9i/ration 7a7 ,roles & responsibilities ,! ,adm9i/rator %all-- 7#a7 9 consultation ) ! ,secret>y1 develop1 coord9ate1 & implem5t a process to support ag5cy review1 reuse1 & /&>dization1 :]e appropriate1 ( security assessm5ts ( cl\d comput+ products & s]vices1 includ+1 z appropriate1 ov]sight ( cont9u\s monitor+ ( cl\d comput+ products & s]vices1 pursuant to guidance issu$ by ! ,director pursuant to section #cfad2 7#b7 e/abli% processes & id5tify crit]ia consi/5t ) guidance issu$ by ! ,director "u section #cfad to make a cl\d comput+ product or s]vice eligible = a ,fed,r,a,m,p au?orization & validate :e!r a cl\d comput+ product or s]vice has a ,fed,r,a,m,p au?orization2 7#c7 develop & publi% templates1 be/ practices1 te*nical assi/ance1 & o!r mat]ials to support ! au?orization ( cl\d comput+ products & s]vices & increase ! spe$1 effectiv5ess1 & transp>5cy ( ! au?orization process1 consi/5t ) /&>ds & guidel9es e/abli%$ by ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology & relevant /atutes2 7#d7 e/abli% & update guidance on ! b\nd>ies ( ,fed,r,a,m,p au?orization packages to enhance ! security & protection ( ,f$]al in=mation & promote transp>5cy = ag5cies & us]s z to :i* s]vices are includ$ 9 ! scope ( a ,fed,r,a,m,p au?orization2 7#e7 grant ,fed,r,a,m,p au?orizations to cl\d comput+ products & s]vices consi/5t ) ! guidance & direction ( ! ,fed,r,a,m,p ,bo>d2 7#f7 e/abli% & ma9ta9 a public comm5t process = propos$ guidance & o!r ,fed,r,a,m,p directives t may h a direct impact on cl\d s]vice provid]s & ag5cies be=e ! issuance ( su* guidance or o!r ,fed,r,a,m,p directives2 7#g7 coord9ate ) ! ,fed,r,a,m,p ,bo>d1 ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 & o!r entities id5tifi$ by ! ,adm9i/rator1 ) ! concurr5ce ( ! ,director & ! ,secret>y1 to e/abli% & regul>ly update a framework = cont9u\s monitor+ "u section #ceec2 7#h7 provide a secure me*anism = /or+ & %>+ necess>y data1 includ+ ,fed,r,a,m,p au?orization packages1 to enable bett] reuse ( su* packages across ag5cies1 includ+ mak+ available any in=mation & data necess>y = ag5cies to fulfill ! requirem5ts ( section #cfac2 7#i7 provide regul> updates to applicant cl\d s]vice provid]s on ! /atus ( any cl\d comput+ product or s]vice dur+ an assessm5t process2 7#aj7 regul>ly review1 9 consultation ) ! ,fed,r,a,m,p ,bo>d-- 7,a7 ! co/s associat$ ) ! indep5d5t assessm5t s]vices describ$ 9 section #cfaa2 & 7,b7 ! in=mation relat+ to =eign int]e/s submitt$ pursuant to section #cfab2 7#aa7 9 coord9ation ) ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ! ,director1 ! ,secret>y1 & o!r /akehold]s1 z appropriate1 det]m9e ! suffici5cy ( und]ly+ /&>ds & requirem5ts to id5tify & assess ! prov5ance ( ! s(tw>e 9 cl\d s]vices & products2 7#ab7 support ! ,f$]al ,secure ,cl\d ,advisory ,committee e/abli%$ pursuant to section #cfaf2 & 7#ac7 take su* o!r actions z ! ,adm9i/rator may det]m9e necess>y to c>ry out ,fed,r,a,m,p4 7b7 ,website 7#a7 ,9 g5]al ,! ,adm9i/rator %all ma9ta9 a public website to s]ve z ! au?oritative repository = ,fed,r,a,m,p1 includ+ ! timely publication & updates = all relevant in=mation1 guidance1 det]m9ations1 & o!r mat]ials requir$ "u subsection 7a74 7#b7 ,crit]ia & process = ,fed,r,a,m,p au?orization priorities ,! ,adm9i/rator %all develop & make publicly available on ! website describ$ 9 p>agraph 7#a7 ! crit]ia & process = prioritiz+ & select+ cl\d comput+ products & s]vices t w receive a ,fed,r,a,m,p au?orization1 9 consultation ) ! ,fed,r,a,m,p ,bo>d & ! ,*ief ,in=mation ,(fic]s ,c\ncil4 7c7 ,evaluation ( automation proc$ures 7#a7 ,9 g5]al ,! ,adm9i/rator1 9 coord9ation ) ! ,secret>y1 %all assess & evaluate available automation capabilities & proc$ures to improve ! effici5cy & effectiv5ess ( ! issuance ( ,fed,r,a,m,p au?orizations1 includ+ cont9u\s monitor+ ( cl\d comput+ products & s]vices4 7#b7 ,means = automation ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is section1 & updat$ regul>ly !reaft]1 ! ,adm9i/rator %all e/abli% a means = ! automation ( security assessm5ts & reviews4 7d7 ,metrics = au?orization ,! ,adm9i/rator %all e/abli% annual metrics reg>d+ ! "t & quality ( ! assessm5ts necess>y = completion ( a ,fed,r,a,m,p au?orization process 9 a mann] t c be consi/5tly track$ ov] "t 9 conjunction ) ! p]iodic te/+ & evaluation process pursuant to section #ceed 9 a mann] t m9imizes ! ag5cy report+ burd54 #cfaj4 ,fed,r,a,m,p ,bo>d 7a7 ,e/abli%m5t ,!re is e/abli%$ a ,fed,r,a,m,p ,bo>d to provide input & recomm5dations to ! ,adm9i/rator reg>d+ ! requirem5ts & guidel9es =1 & ! prioritization (1 security assessm5ts ( cl\d comput+ products & s]vices4 7b7 ,memb]%ip ,! ,fed,r,a,m,p ,bo>d %all consi/ ( n m ?an #g s5ior (ficials or exp]ts f ag5cies appo9t$ by ! ,director1 9 consultation ) ! ,adm9i/rator1 f ea* ( ! foll[+3 7#a7 ,! ,dep>tm5t ( ,def5se4 7#b7 ,! ,dep>tm5t ( ,homel& ,security4 7#c7 ,! ,g5]al ,s]vices ,adm9i/ration4 7#d7 ,su* o!r ag5cies z det]m9$ by ! ,director1 9 consultation ) ! ,adm9i/rator4 7c7 ,qualifications ,memb]s ( ! ,fed,r,a,m,p ,bo>d appo9t$ "u subsection 7b7 %all h te*nical exp]tise 9 doma9s relevant to ,fed,r,a,m,p1 su* z-- 7#a7 cl\d comput+2 7#b7 cyb]security2 7#c7 privacy2 7#d7 risk managem5t2 & 7#e7 o!r compet5cies id5tifi$ by ! ,director to support ! secure au?orization ( cl\d s]vices & products4 7d7 ,duties ,! ,fed,r,a,m,p ,bo>d %all-- 7#a7 9 consultation ) ! ,adm9i/rator1 s]ve z a res\rce = be/ practices to accel]ate ! process = obta9+ a ,fed,r,a,m,p au?orization2 7#b7 e/abli% & regul>ly update requirem5ts & guidel9es = security au?orizations ( cl\d comput+ products & s]vices1 consi/5t ) /&>ds & guidel9es e/abli%$ by ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 to be us$ 9 ! det]m9ation ( ,fed,r,a,m,p au?orizations2 7#c7 monitor & ov]see1 to ! greate/ ext5t practicable1 ! processes & proc$ures by :i* ag5cies det]m9e & validate requirem5ts = a ,fed,r,a,m,p au?orization1 includ+ p]iodic review ( ! ag5cy det]m9ations describ$ 9 section #cfac7;b72 7#d7 ensure consi/5cy & transp>5cy betwe5 ag5cies & cl\d s]vice provid]s 9 a mann] t m9imizes confusion & eng5d]s tru/2 & 7#e7 p]=m su* o!r roles & responsibilities z ! ,director may assign1 ) concurr5ce f ! ,adm9i/rator4 7e7 ,det]m9ations ( dem& = cl\d comput+ products & s]vices ,! ,fed,r,a,m,p ,bo>d may consult ) ! ,*ief ,in=mation ,(fic]s ,c\ncil to e/abli% a process1 :i* may be made available on ! website ma9ta9$ "u section #cfji7;b71 = prioritiz+ & accept+ ! cl\d comput+ products & s]vices to be grant$ a ,fed,r,a,m,p au?orization4 #cfaa4 ,indep5d5t assessm5t ,! ,adm9i/rator may det]m9e :e!r ,fed,r,a,m,p may use an indep5d5t assessm5t s]vice to analyze1 validate1 & atte/ to ! quality & compliance ( security assessm5t mat]ials provid$ by cl\d s]vice provid]s dur+ ! c\rse ( a det]m9ation ( :e!r to use a cl\d comput+ product or s]vice4 #cfab4 ,decl>ation ( =eign int]e/s 7a7 ,9 g5]al ,an indep5d5t assessm5t s]vice t p]=ms s]vices describ$ 9 section #cfaa %all annually submit to ! ,adm9i/rator in=mation relat+ to any =eign int]e/1 =eign influ5ce1 or =eign control ( ! indep5d5t assessm5t s]vice4 7b7 ,updates ,n lat] ?an #dh h\rs aft] !re is a *ange 9 =eign own]%ip or control ( an indep5d5t assessm5t s]vice t p]=ms s]vices describ$ 9 section #cfaa1 ! indep5d5t assessm5t s]vice %all submit to ! ,adm9i/rator an update to ! in=mation submitt$ "u subsection 7a74 7c7 ,c]tification ,! ,adm9i/rator may require a repres5tative ( an indep5d5t assessm5t s]vice to c]tify ! accuracy & complet5ess ( any in=mation submitt$ "u ?is section4 #cfac4 ,roles & responsibilities ( ag5cies 7a7 ,9 g5]al ,9 implem5t+ ! requirem5ts ( ,fed,r,a,m,p1 ! head ( ea* ag5cy %all1 consi/5t ) guidance issu$ by ! ,director pursuant to section #cfad-- 7#a7 promote ! use ( cl\d comput+ products & s]vices t meet ,fed,r,a,m,p security requirem5ts & o!r risk-bas$ p]=mance requirem5ts z det]m9$ by ! ,director1 9 consultation ) ! ,secret>y2 7#b7 confirm :e!r !re is a ,fed,r,a,m,p au?orization 9 ! secure me*anism provid$ "u section #cfji7;a77#h7 be=e beg9n+ ! process ( grant+ a ,fed,r,a,m,p au?orization = a cl\d comput+ product or s]vice2 7#c7 to ! ext5t practicable1 = any cl\d comput+ product or s]vice ! ag5cy seeks to au?orize t has receiv$ a ,fed,r,a,m,p au?orization1 use ! exi/+ assessm5ts ( security controls & mat]ials )9 any ,fed,r,a,m,p au?orization package = t cl\d comput+ product or s]vice2 & 7#d7 provide to ! ,director data & in=mation requir$ by ! ,director pursuant to section #cfad to det]m9e h[ ag5cies are meet+ metrics e/abli%$ by ! ,adm9i/rator4 7b7 ,atte/ation ,^u complet+ an assessm5t or au?orization activity ) respect to a p>ticul> cl\d comput+ product or s]vice1 if an ag5cy det]m9es t ! in=mation & data ! ag5cy has review$ "u p>agraph 7#b7 or 7#c7 ( subsection 7a7 is :olly or sub/antially defici5t = ! purposes ( p]=m+ an au?orization ( ! cl\d comput+ product or s]vice1 ! head ( ! ag5cy %all docum5t z "p ( ! result+ ,fed,r,a,m,p au?orization package ! reasons = ?is det]m9ation4 7c7 ,submission ( au?orizations to op]ate requir$ ,^u issuance ( an ag5cy au?orization to op]ate bas$ on a ,fed,r,a,m,p au?orization1 ! head ( ! ag5cy %all provide a copy ( its au?orization to op]ate lett] & any supplem5t>y in=mation requir$ pursuant to section #cfji7;a7 to ! ,adm9i/rator4 7d7 ,submission ( policies requir$ ,n lat] ?an #ahj days aft] ! date on :i* ! ,director issues guidance 9 accordance ) section #cfad7a71 ! head ( ea* ag5cy1 act+ ?r\gh ! *ief in=mation (fic] ( ! ag5cy1 %all submit to ! ,director all ag5cy policies relat+ to ! au?orization ( cl\d comput+ products & s]vices4 7e7 ,presumption ( adequacy 7#a7 ,9 g5]al ,! assessm5t ( security controls & mat]ials )9 ! au?orization package = a ,fed,r,a,m,p au?orization %all be presum$ adequate = use 9 an ag5cy au?orization to op]ate cl\d comput+ products & s]vices4 7#b7 ,in=mation security requirem5ts ,! presumption "u p>agraph 7#a7 does n modify or alt]-- 7,a7 ! responsibility ( any ag5cy to ensure compliance ) sub*apt] ,,ii ( *apt] #ce = any cl\d comput+ product or s]vice us$ by ! ag5cy2 or 7,b7 ! au?ority ( ! head ( any ag5cy to make a det]m9ation t !re is a demon/rable ne$ = additional security requirem5ts beyond ! security requirem5ts includ$ 9 a ,fed,r,a,m,p au?orization = a p>ticul> control implem5tation4 #cfad4 ,roles & responsibilities ( ! ,(fice ( ,managem5t & ,budget ,! ,director %all-- 7#a7 9 consultation ) ! ,adm9i/rator & ! ,secret>y1 issue guidance t-- 7,a7 specifies ! categories or *>act]i/ics ( cl\d comput+ products & s]vices t are )9 ! scope ( ,fed,r,a,m,p2 7,b7 includes requirem5ts = ag5cies to obta9 a ,fed,r,a,m,p au?orization :5 op]at+ a cl\d comput+ product or s]vice describ$ 9 subp>agraph 7,a7 z a ,f$]al in=mation sy/em2 & 7,c7 encompasses1 to ! greate/ ext5t practicable1 all necess>y & appropriate cl\d comput+ products & s]vices2 7#b7 issue guidance describ+ additional responsibilities ( ,fed,r,a,m,p & ! ,fed,r,a,m,p ,bo>d to accel]ate ! adoption ( secure cl\d comput+ products & s]vices by ! ,f$]al ,gov]nm5t2 7#c7 9 consultation ) ! ,adm9i/rator1 e/abli% a process to p]iodically review ,fed,r,a,m,p au?orization packages to support ! secure au?orization & reuse ( secure cl\d products & s]vices2 7#d7 ov]see ! effectiv5ess ( ,fed,r,a,m,p & ! ,fed,r,a,m,p ,bo>d1 includ+ ! compliance by ! ,fed,r,a,m,p ,bo>d ) ! duties describ$ 9 section #cfaj7;d72 & 7#e7 to ! greate/ ext5t practicable1 enc\rage & promote consi/5cy ( ! assessm5t1 au?orization1 adoption1 & use ( secure cl\d comput+ products & s]vices )9 & across ag5cies4 #cfae4 ,reports to ,congress2 ,,gao report 7a7 ,reports to congress ,n lat] ?an #a ye> aft] ! date ( enactm5t ( ?is section1 & annually !reaft]1 ! ,director %all submit to ! appropriate congressional committees a report t includes ! foll[+3 7#a7 ,dur+ ! prec$+ ye>1 ! /atus1 effici5cy1 & effectiv5ess ( ! ,g5]al ,s]vices ,adm9i/ration "u section #cfji & ag5cies "u section #cfac & 9 support+ ! spe$1 effectiv5ess1 %>+1 reuse1 & security ( au?orizations to op]ate = secure cl\d comput+ products & s]vices4 7#b7 ,progress t[>ds meet+ ! metrics requir$ "u section #cfji7;d74 7#c7 ,data on ,fed,r,a,m,p au?orizations4 7#d7 ,! av]age l5g? ( "t to issue ,fed,r,a,m,p au?orizations4 7#e7 ,! numb] ( ,fed,r,a,m,p au?orizations submitt$1 issu$1 & d5i$ = ! prec$+ ye>4 7#f7 ,a review ( progress made dur+ ! prec$+ ye> 9 advanc+ automation te*niques to securely automate ,fed,r,a,m,p processes & to accel]ate report+ "u ?is section4 7#g7 ,! numb] & *>act]i/ics ( au?oriz$ cl\d comput+ products & s]vices 9 use at ea* ag5cy consi/5t ) guidance provid$ by ! ,director "u section #cfad4 7#h7 ,a review ( ,fed,r,a,m,p measures to ensure ! security ( data /or$ or process$ by cl\d s]vice provid]s1 :i* may include-- 7,a7 geolocation re/rictions = provid$ products or s]vices2 7,b7 disclosures ( =eign elem5ts ( supply *a9s ( acquir$ products or s]vices2 7,c7 cont9u$ disclosures ( own]%ip ( cl\d s]vice provid]s by =eign entities2 & 7,d7 encryption = data process$1 /or$1 or transmitt$ by cl\d s]vice provid]s4 7b7 ,,gao report ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is section1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all report to ! appropriate congressional committees an assessm5t ( ! foll[+3 7#a7 ,! co/s incurr$ by ag5cies & cl\d s]vice provid]s relat+ to ! issuance ( ,fed,r,a,m,p au?orizations4 7#b7 ,! ext5t to :i* ag5cies h processes 9 place to cont9u\sly monitor ! implem5tation ( cl\d comput+ products & s]vices op]at+ z ,f$]al in=mation sy/ems4 7#c7 ,h[ (t5 & = :i* categories ( products & s]vices ag5cies use ,fed,r,a,m,p au?orizations4 7#d7 ,! unique co/s & pot5tial burd5s incurr$ by cl\d comput+ companies t are small bus9ess conc]ns 7z def9$ 9 section #c7;a7 ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a77 z a "p ( ! ,fed,r,a,m,p au?orization process4 #cfaf4 ,f$]al ,secure ,cl\d ,advisory ,committee 7a7 ,e/abli%m5t1 purposes1 & duties 7#a7 ,e/abli%m5t ,!re is e/abli%$ a ,f$]al ,secure ,cl\d ,advisory ,committee 7ref]r$ to 9 ?is section z ! ,committee7 to ensure effective & ongo+ coord9ation ( ag5cy adoption1 use1 au?orization1 monitor+1 acquisition1 & security ( cl\d comput+ products & s]vices to enable ag5cy mission & adm9i/rative priorities4 7#b7 ,purposes ,! purposes ( ! ,committee are ! foll[+3 7,a7 ,to exam9e ! op]ations ( ,fed,r,a,m,p & det]m9e ways t au?orization processes c cont9u\sly be improv$1 includ+ ! foll[+3 7i7 ,measures to increase ag5cy reuse ( ,fed,r,a,m,p au?orizations4 7ii7 ,propos$ actions t c be adopt$ to r$uce ! burd51 confusion1 & co/ associat$ ) ,fed,r,a,m,p au?orizations = cl\d s]vice provid]s4 7iii7 ,measures to increase ! numb] ( ,fed,r,a,m,p au?orizations = cl\d comput+ products & s]vices (f]$ by small bus9esses conc]ns 7z def9$ by section #c7;a7 ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a774 7iv7 ,propos$ actions t c be adopt$ to r$uce ! burd5 & co/ ( ,fed,r,a,m,p au?orizations = ag5cies4 7,b7 ,collect in=mation & fe$back on ag5cy compliance ) & implem5tation ( ,fed,r,a,m,p requirem5ts4 7,c7 ,s]ve z a =um t facilitates communication & collaboration among ! ,fed,r,a,m,p /akehold] community4 7#c7 ,duties ,! duties ( ! ,committee include provid+ advice & recomm5dations to ! ,adm9i/rator1 ! ,fed,r,a,m,p ,bo>d1 & ag5cies on te*nical1 f9ancial1 programmatic1 & op]ational matt]s reg>d+ secure adoption ( cl\d comput+ products & s]vices4 7b7 ,memb]s 7#a7 ,composition ,! ,committee %all be compris$ ( n m ?an #ae memb]s :o are qualifi$ repres5tatives f ! public & private sectors1 appo9t$ by ! ,adm9i/rator1 9 consultation ) ! ,director1 z foll[s3 7,a7 ,! ,adm9i/rator or ! ,adm9i/rator's designee1 :o %all be ! ,*air ( ! ,committee4 7,b7 ,at lea/ #a repres5tative ea* f ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7,c7 ,at lea/ #b (ficials :o s]ve z ! ,*ief ,in=mation ,security ,(fic] )9 an ag5cy1 :o %all be requir$ to ma9ta9 su* a position ?r\gh\t ! duration ( _! s]vice on ! ,committee4 7,d7 ,at lea/ #a (ficial s]v+ z ,*ief ,procurem5t ,(fic] 7or equival5t7 9 an ag5cy1 :o %all be requir$ to ma9ta9 su* a position ?r\gh\t ! duration ( _! s]vice on ! ,committee4 7,e7 ,at lea/ #a individual repres5t+ an indep5d5t assessm5t s]vice4 7,f7 ,at lea/ #e repres5tatives f unique bus9esses t prim>ily provide cl\d comput+ s]vices or products1 includ+ at lea/ #b repres5tatives f a small bus9ess conc]n 7z def9$ by section #c7;a7 ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7,g7 ,at lea/ #b o!r repres5tatives ( ! ,f$]al ,gov]nm5t z ! ,adm9i/rator det]m9es necess>y to provide suffici5t balance1 insights1 or exp]tise to ! ,committee4 7#b7 ,deadl9e = appo9tm5t ,ea* memb] ( ! ,committee %all be appo9t$ n lat] ?an #ij days aft] ! date ( enactm5t ( ?is section4 7#c7 ,p]iod ( appo9tm5t2 vacancies 7,a7 ,9 g5]al ,ea* non-,f$]al memb] ( ! ,committee %all be appo9t$ = a t]m ( #c ye>s1 except t ! initial t]ms = memb]s may be /agg]$ #a-1 #b-1 or #c-ye> t]ms to e/abli% a rotation 9 :i* "o-?ird ( ! memb]s are select$ ea* ye>4 ,any su* memb] may be appo9t$ = n m ?an #b consecutive t]ms4 7,b7 ,vacancies ,any vacancy 9 ! ,committee %all n affect its p[]s1 b %all be fill$ 9 ! same mann] 9 :i* ! orig9al appo9tm5t 0 made4 ,any memb] appo9t$ to fill a vacancy occurr+ be=e ! expiration ( ! t]m = :i* ! memb]'s pr$ecessor 0 appo9t$ %all be appo9t$ only = ! rema9d] ( t t]m4 ,a memb] may s]ve aft] ! expiration ( t memb]'s t]m until a successor has tak5 (fice4 7c7 ,meet+s & rules ( proc$ures 7#a7 ,meet+s ,! ,committee %all hold n few] ?an #c meet+s 9 a cal5d> ye>1 at su* "t & place z det]m9$ by ! ,*air4 7#b7 ,initial meet+ ,n lat] ?an #abj days aft] ! date ( enactm5t ( ?is section1 ! ,committee %all meet & beg9 ! op]ations ( ! ,committee4 7#c7 ,rules ( proc$ure ,! ,committee may e/abli% rules = ! conduct ( ! bus9ess ( ! ,committee if su* rules are n inconsi/5t ) ?is section or o!r applicable law4 7d7 ,employee /atus 7#a7 ,9 g5]al ,a memb] ( ! ,committee 7o!r ?an a memb] :o is appo9t$ to ! ,committee 9 connection ) ano!r ,f$]al appo9tm5t7 %all n be consid]$ an employee ( ! ,f$]al ,gov]nm5t by reason ( any s]vice z su* a memb]1 except = ! purposes ( section #egjc ( title #e1 relat+ to travel exp5ses4 7#b7 ,pay n p]mitt$ ,a memb] ( ! ,committee cov]$ by p>agraph 7#a7 may n receive pay by reason ( s]vice on ! ,committee4 7e7 ,applicability to ! f$]al advisory committee act ,section #ad ( ! ,f$]al ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 %all n apply to ! ,committee4 7f7 ,detail ( employees ,any ,f$]al ,gov]nm5t employee may be detail$ to ! ,committee )\t reimbursem5t f ! ,committee1 & su* detailee %all reta9 ! rights1 /atus1 & privileges ( 8 or h] regul> employm5t )\t int]ruption4 7g7 ,po/al s]vices ,! ,committee may use ! ,unit$ ,/ates mails 9 ! same mann] & "u ! same conditions z ag5cies4 7h7 ,reports 7#a7 ,int]im reports ,! ,committee may submit to ! ,adm9i/rator & ,congress int]im reports conta9+ su* f9d+s1 conclusions1 & recomm5dations z h be5 agre$ to by ! ,committee4 7#b7 ,annual reports ,n lat] ?an #edj days aft] ! date ( enactm5t ( ?is section1 & annually !reaft]1 ! ,committee %all submit to ! ,adm9i/rator & ,congress a report conta9+ su* f9d+s1 conclusions1 & recomm5dations z h be5 agre$ to by ! ,committee4 4 7b7 ,te*nical & con=m+ am5dm5t ,! table ( sections = *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new items3 #cfjg4 ,def9itions4 #cfjh4 ,f$]al ,risk & ,au?orization ,managem5t ,program4 #cfji4 ,roles & responsibilities ( ! ,g5]al ,s]vices ,adm9i/ration4 #cfaj4 ,fed,r,a,m,p ,bo>d4 #cfaa4 ,indep5d5t assessm5t4 #cfab4 ,decl>ation ( =eign int]e/s4 #cfac4 ,roles & responsibilities ( ag5cies4 #cfad4 ,roles & responsibilities ( ! ,(fice ( ,managem5t & ,budget4 #cfae4 ,reports to ,congress2 ,,gao report4 #cfaf4 ,f$]al ,secure ,cl\d ,advisory ,committee4 4 7c7 ,sunset 7#a7 ,9 g5]al ,effective on ! date t is #e ye>s aft] ! date ( enactm5t ( ?is ,act1 *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ sections #cfjg ?r\gh #cfaf4 7#b7 ,con=m+ am5dm5t ,effective on ! date t is #e ye>s aft] ! date ( enactm5t ( ?is ,act1 ! table ( sections = *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by /rik+ ! items relat+ to sections #cfjg ?r\gh #cfaf4 7d7 ,rule ( con/ruction ,no?+ 9 ?is section or any am5dm5t made by ?is section %all be con/ru$ z alt]+ or impair+ ! au?orities ( ! ,director ( ! ,(fice ( ,managem5t & ,budget or ! ,secret>y ( ,homel& ,security "u sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code4 ,pass$ ! ,s5ate ,m>* #a1 #bjbb4,secret>y