,,ii ,calendar ,no4 #bfe #aagth ,,congress #b;d ,session ,s4 #cfjj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,february #h 7legislative day1 ,february #c71 #bjbb,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read the first time ,february #i1 #bjbb,read the second time and placed on the calendar ,a ,,bill ,to improve the cybersecurity of the ,federal ,government1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,strengthening ,american ,cybersecurity ,act of #bjbb4 #b4 ,table of contents ,the table of contents for this ,act is as follows3 ,sec4 #a4 ,short title4,sec4 #b4 ,table of contents4,,title ,i--,federal ,information ,security ,modernization ,act of #bjbb,sec4 #aja4 ,short title4,sec4 #ajb4 ,definitions4,sec4 #ajc4 ,title #dd amendments4,sec4 #ajd4 ,amendments to subtitle ,,iii of title #dj4,sec4 #aje4 ,actions to enhance ,federal incident transparency4,sec4 #ajf4 ,additional guidance to agencies on ,,fisma updates4,sec4 #ajg4 ,agency requirements to notify private sector entities impacted by incidents4,sec4 #ajh4 ,mobile security standards4,sec4 #aji4 ,data and logging retention for incident response4,sec4 #aaj4 ,,cisa agency advisors4,sec4 #aaa4 ,federal penetration testing policy4,sec4 #aab4 ,ongoing threat hunting program4,sec4 #aac4 ,codifying vulnerability disclosure programs4,sec4 #aad4 ,implementing zero trust architecture4,sec4 #aae4 ,automation reports4,sec4 #aaf4 ,extension of ,federal acquisition security council and software inventory4,sec4 #aag4 ,council of the ,inspectors ,general on ,integrity and ,efficiency dashboard4,sec4 #aah4 ,quantitative cybersecurity metrics4,sec4 #aai4 ,establishment of risk-based budget model4,sec4 #abj4 ,active cyber defensive study4,sec4 #aba4 ,security operations center as a service pilot4,sec4 #abb4 ,extension of ,chief ,data ,officer ,council4,,title ,,ii--,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb,sec4 #bja4 ,short title4,sec4 #bjb4 ,definitions4,sec4 #bjc4 ,cyber incident reporting4,sec4 #bjd4 ,federal sharing of incident reports4,sec4 #bje4 ,ransomware vulnerability warning pilot program4,sec4 #bjf4 ,ransomware threat mitigation activities4,sec4 #bjg4 ,congressional reporting4,,title ,,iii--,federal ,secure ,cloud ,improvement and ,jobs ,act of #bjbb,sec4 #cja4 ,short title4,sec4 #cjb4 ,findings4,sec4 #cjc4 ,title #dd amendments4 ,i ,federal ,information ,security ,modernization ,act of #bjbb #aja4 ,short title ,this title may be cited as the ,federal ,information ,security ,modernization ,act of #bjbb4 #ajb4 ,definitions ,in this title1 unless otherwise specified3 7#a7 ,additional cybersecurity procedure ,the term additional cybersecurity procedure has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this title4 7#b7 ,agency ,the term agency has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#c7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 and 7,c7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#d7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#e7 ,incident ,the term incident has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#f7 ,national security system ,the term national security system has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code4 7#g7 ,penetration test ,the term penetration test has the meaning given the term in section #ceeb7;b7 of title #dd1 ,united ,states ,code1 as amended by this title4 7#h7 ,threat hunting ,the term threat hunting means proactively and iteratively searching systems for threats that evade detection by automated threat detection systems4 #ajc4 ,title #dd amendments 7a7 ,subchapter ,i amendments ,subchapter ,i of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #cejd-- 7,a7 in subsection 7a77#a77;,b7-- 7i7 by striking clause 7v7 and inserting the following3 7v7 confidentiality1 privacy1 disclosure1 and sharing of information2 2 7ii7 by redesignating clause 7vi7 as clause 7vii72 and 7iii7 by inserting after clause 7v7 the following3 7vi7 in consultation with the ,national ,cyber ,director1 security of information2 and 2 and 7,b7 in subsection 7g71 by striking paragraph 7#a7 and inserting the following3 7#a7 develop and oversee the implementation of policies1 principles1 standards1 and guidelines on privacy1 confidentiality1 disclosure1 and sharing1 and in consultation with the ,national ,cyber ,director1 oversee the implementation of policies1 principles1 standards1 and guidelines on security1 of information collected or maintained by or for agencies2 and 2 7#b7 in section #ceje-- 7,a7 by striking the first subsection designated as subsection 7c72 7,b7 in paragraph 7#b7 of the second subsection designated as subsection 7c71 by inserting an identification of internet accessible information systems and after an inventory under this subsection shall include2 7,c7 in paragraph 7#c7 of the second subsection designated as subsection 7c7-- 7i7 in subparagraph 7,b7-- 7,i7 by inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and before the ,comptroller ,general2 and 7,,ii7 by striking and at the end2 7ii7 in subparagraph 7,c77v71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 maintained on a continual basis through the use of automation1 machine-readable data1 and scanning1 wherever practicable4 2 7#c7 in section #cejf-- 7,a7 in subsection 7a77#c71 by inserting ,in carrying out these duties1 the ,chief ,information ,officer shall coordinate1 as appropriate1 with the ,chief ,data ,officer in accordance with the designated functions under section #cebj7;c74 after reduction of information collection burdens on the public42 7,b7 in subsection 7b77#a77;,c71 by inserting 1 availability after integrity2 and 7,c7 in subsection 7h77#c71 by inserting security1 after efficiency12 and 7#d7 in section #ceac-- 7,a7 by redesignating subsection 7c7 as subsection 7d72 and 7,b7 by inserting after subsection 7b7 the following3 7c7 ,each agency providing a written plan under subsection 7b7 shall provide any portion of the written plan addressing information security to the ,secretary of the ,department of ,homeland ,security and the ,national ,cyber ,director4 4 7b7 ,subchapter ,,ii definitions 7#a7 ,in general ,section #ceeb7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7,a7 by redesignating paragraphs 7#a71 7#b71 7#c71 7#d71 7#e71 7#f71 and 7#g7 as paragraphs 7#b71 7#d71 7#e71 7#f71 7#g71 7#i71 and 7#aa71 respectively2 7,b7 by inserting before paragraph 7#b71 as so redesignated1 the following3 7#a7 ,the term additional cybersecurity procedure means a process1 procedure1 or other activity that is established in excess of the information security standards promulgated under section #aacca7;b7 of title #dj to increase the security and reduce the cybersecurity risk of agency systems4 2 7,c7 by inserting after paragraph 7#b71 as so redesignated1 the following3 7#c7 ,the term high value asset means information or an information system that the head of an agency1 using policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a71 determines to be so critical to the agency that the loss or corruption of the information or the loss of access to the information system would have a serious impact on the ability of the agency to perform the mission of the agency or conduct business4 2 7,d7 by inserting after paragraph 7#g71 as so redesignated1 the following3 7#h7 ,the term major incident has the meaning given the term in guidance issued by the ,director under section #ceih7;a74 2 7,e7 by inserting after paragraph 7#i71 as so redesignated1 the following3 7#aj7 ,the term penetration test-- 7,a7 means an authorized assessment that emulates attempts to gain unauthorized access to1 or disrupt the operations of1 an information system or component of an information system2 and 7,b7 includes any additional meaning given the term in policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a74 2 and 7,f7 by inserting after paragraph 7#aa71 as so redesignated1 the following3 7#ab7 ,the term shared service means a centralized business or mission capability that is provided to multiple organizations within an agency or to multiple agencies4 4 7#b7 ,conforming amendments 7,a7 ,homeland ,security ,act of #bjjb ,section #ajja7;c77#a77;,a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #eaa7a77;,a77 is amended by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b74 7,b7 ,title #aj 7i7 ,section #bbbb ,section #bbbb7;i77#h7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f77;,a7 and inserting section #ceeb7;b77#i77;,a74 7ii7 ,section #bbbc ,section #bbbc7;c77#c7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iii7 ,section #bcae ,section #bcae of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7iv7 ,section #bcci;a ,section #bcci;a7e77#e7 of title #aj1 ,united ,states ,code1 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,c7 ,high-,performance ,computing ,act of #aiia ,section #bjg7;a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eebg7;a77 is amended by striking section #ceeb7;b77#f77;,a77i7 and inserting section #ceeb7;b77#i77;,a77i74 7,d7 ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj ,section #c7e7 of the ,internet of ,things ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;a7 is amended by striking section #ceeb7;b77#f7 and inserting section #ceeb7;b74 7,e7 ,national ,defense ,authorization ,act for ,fiscal ,year #bjac ,section #icc7;e77#a77;,b7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjac 7#aj ,u4,s4,c4 #bbbd note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,f7 ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa ,the ,ike ,skelton ,national ,defense ,authorization ,act for ,fiscal ,year #bjaa 7,public ,law #aaa-chc7 is amended-- 7i7 in section #hjf7;e77#e7 7#aj ,u4,s4,c4 #bcjd note71 by striking section #cedb7;b7 and inserting section #ceeb7;b72 7ii7 in section #ica7;b77#c7 7#aj ,u4,s4,c4 #bbbc note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b72 and 7iii7 in section #icb7;b77#b7 7#aj ,u4,s4,c4 #bbbd note71 by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,g7 ,e-,government ,act of #bjjb ,section #cja7;c77#a77;,a7 of the ,e-,government ,act of #bjjb 7#dd ,u4,s4,c4 #ceja note7 is amended by striking section #cedb7;b77#b7 and inserting section #ceeb7;b74 7,h7 ,national ,institute of ,standards and ,technology ,act ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7i7 in subsection 7a77#b71 by striking section #ceeb7;b77#e7 and inserting section #ceeb7;b72 and 7ii7 in subsection 7f7-- 7,i7 in paragraph 7#c71 by striking section #cecb7a7 and inserting section #ceeb7;b72 and 7,,ii7 in paragraph 7#e71 by striking section #cecb7;b77#b7 and inserting section #ceeb7;b74 7c7 ,subchapter ,,ii amendments ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in section #ceea-- 7,a7 in paragraph 7#d71 by striking diagnose and improve and inserting integrate1 deliver1 diagnose1 and improve2 7,b7 in paragraph 7#e71 by striking and at the end2 7,c7 in paragraph 7#f71 by striking the period at the end and inserting a semi colon2 and 7,d7 by adding at the end the following3 7#g7 recognize that each agency has specific mission requirements and1 at times1 unique cybersecurity requirements to meet the mission of the agency2 7#h7 recognize that each agency does not have the same resources to secure agency systems1 and an agency should not be expected to have the capability to secure the systems of the agency from advanced adversaries alone2 and 7#i7 recognize that a holistic ,federal cybersecurity model is necessary to account for differences between the missions and capabilities of agencies4 2 7#b7 in section #ceec-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a71 by inserting 1 in consultation with the ,secretary and the ,national ,cyber ,director1 before overseeing2 7ii7 in paragraph 7#e71 by striking and at the end2 and 7iii7 by adding at the end the following3 7#h7 promoting1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 and the ,director of the ,national ,institute of ,standards and ,technology-- 7,a7 the use of automation to improve ,federal cybersecurity and visibility with respect to the implementation of ,federal cybersecurity2 and 7,b7 the use of presumption of compromise and least privilege principles to improve resiliency and timely response actions to incidents on ,federal systems4 2 7,b7 in subsection 7b7-- 7i7 in the matter preceding paragraph 7#a71 by inserting and the ,national ,cyber ,director after ,director2 and 7ii7 in paragraph 7#b77;,a71 by inserting and reporting requirements under subchapter ,,iv of this chapter after section #ceef2 and 7,c7 in subsection 7c7-- 7i7 in the matter preceding paragraph 7#a7-- 7,i7 by striking each year and inserting each year during which agencies are required to submit reports under section #ceed7;c72 and 7,,ii7 by striking preceding year and inserting preceding #b years2 7ii7 by striking paragraph 7#a72 7iii7 by redesignating paragraphs 7#b71 7#c71 and 7#d7 as paragraphs 7#a71 7#b71 and 7#c71 respectively2 7iv7 in paragraph 7#c71 as so redesignated1 by striking and at the end2 7v7 by inserting after paragraph 7#c71 as so redesignated the following3 7#d7 a summary of each assessment of ,federal risk posture performed under subsection 7i72 2 and 7vi7 in paragraph 7#e71 by striking the period at the end and inserting 2 and2 7,d7 by redesignating subsections 7i71 7j71 7k71 and 7l7 as subsections 7j71 7k71 7l71 and 7m7 respectively2 7,e7 by inserting after subsection 7h7 the following3 7i7 ,federal risk assessments ,on an ongoing and continuous basis1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall perform assessments of ,federal risk posture using any available information on the cybersecurity posture of agencies1 and brief the ,director and ,national ,cyber ,director on the findings of those assessments including-- 7#a7 the status of agency cybersecurity remedial actions described in section #ceed7;b77#g72 7#b7 any vulnerability information relating to the systems of an agency that is known by the agency2 7#c7 analysis of incident information under section #ceig2 7#d7 evaluation of penetration testing performed under section #ceei;,a2 7#e7 evaluation of vulnerability disclosure program information under section #ceei;,b2 7#f7 evaluation of agency threat hunting results2 7#g7 evaluation of ,federal and non-,federal cyber threat intelligence2 7#h7 data on agency compliance with standards issued under section #aacca of title #dj2 7#i7 agency system risk assessments performed under section #ceed7;a77#a77;,a72 and 7#aj7 any other information the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines relevant4 2 7,f7 in subsection 7j71 as so redesignated-- 7i7 by striking regarding the specific and inserting 8that includes a summary of-- 7#a7 the specific 2 7ii7 in paragraph 7#a71 as so designated1 by striking the period at the end and inserting 2 and and 7iii7 by adding at the end the following3 7#b7 the trends identified in the ,federal risk assessment performed under subsection 7i74 2 and 7,g7 by adding at the end the following3 7n7 ,binding operational directives ,if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency issues a binding operational directive or an emergency directive under this section1 not later than #d days after the date on which the binding operational directive requires an agency to take an action1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the ,director1 ,national ,cyber ,director1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives the status of the implementation of the binding operational directive at the agency4 2 7#c7 in section #ceed-- 7,a7 in subsection 7a7-- 7i7 in paragraph 7#a7-- 7,i7 by redesignating subparagraphs 7,a71 7,b71 and 7,c7 as subparagraphs 7,b71 7,c71 and 7,d71 respectively2 7,,ii7 by inserting before subparagraph 7,b71 as so redesignated1 the following3 7,a7 on an ongoing and continuous basis1 performing agency system risk assessments that-- 7i7 identify and document the high value assets of the agency using guidance from the ,director2 7ii7 evaluate the data assets inventoried under section #ceaa for sensitivity to compromises in confidentiality1 integrity1 and availability2 7iii7 identify agency systems that have access to or hold the data assets inventoried under section #ceaa2 7iv7 evaluate the threats facing agency systems and data1 including high value assets1 based on ,federal and non-,federal cyber threat intelligence products1 where available2 7v7 evaluate the vulnerability of agency systems and data1 including high value assets1 including by analyzing-- 7,i7 the results of penetration testing performed by the ,department of ,homeland ,security under section #ceec7;b77#i72 7,,ii7 the results of penetration testing performed under section #ceei;,a2 7,,iii7 information provided to the agency through the vulnerability disclosure program of the agency under section #ceei;,b2 7,,iv7 incidents2 and 7,v7 any other vulnerability information relating to agency systems that is known to the agency2 7vi7 assess the impacts of potential agency incidents to agency systems1 data1 and operations based on the evaluations described in clauses 7ii7 and 7iv7 and the agency systems identified under clause 7iii72 and 7vii7 assess the consequences of potential incidents occurring on agency systems that would impact systems at other agencies1 including due to interconnectivity between different agency systems or operational reliance on the operations of the system or data in the system2 2 7,,iii7 in subparagraph 7,b71 as so redesignated1 in the matter preceding clause 7i71 by striking providing information and inserting using information from the assessment conducted under subparagraph 7,a71 providing information2 7,,iv7 in subparagraph 7,c71 as so redesignated-- 7aa7 in clause 7ii7 by inserting binding before operational2 and 7bb7 in clause 7vi71 by striking and at the end2 and 7,v7 by adding at the end the following3 7,e7 providing an update on the ongoing and continuous assessment performed under subparagraph 7,a7-- 7i7 upon request1 to the inspector general of the agency or the ,comptroller ,general of the ,united ,states2 and 7ii7 on a periodic basis1 as determined by guidance issued by the ,director but not less frequently than annually1 to-- 7,i7 the ,director2 7,,ii7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,,iii7 the ,national ,cyber ,director2 7,f7 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and not less frequently than once every #c years1 performing an evaluation of whether additional cybersecurity procedures are appropriate for securing a system of1 or under the supervision of1 the agency1 which shall-- 7i7 be completed considering the agency system risk assessment performed under subparagraph 7,a72 and 7ii7 include a specific evaluation for high value assets2 7,g7 not later than #cj days after completing the evaluation performed under subparagraph 7,f71 providing the evaluation and an implementation plan1 if applicable1 for using additional cybersecurity procedures determined to be appropriate to-- 7i7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7ii7 the ,director2 and 7iii7 the ,national ,cyber ,director2 and 7,h7 if the head of the agency determines there is need for additional cybersecurity procedures1 ensuring that those additional cybersecurity procedures are reflected in the budget request of the agency2 2 7ii7 in paragraph 7#b7-- 7,i7 in subparagraph 7,a71 by inserting in accordance with the agency system risk assessment performed under paragraph 7#a77;,a7 after information systems2 7,,ii7 in subparagraph 7,b7-- 7aa7 by striking in accordance with standards and inserting 8in accordance with-- 7i7 standards 2 and 7bb7 by adding at the end the following3 7ii7 the evaluation performed under paragraph 7#a77;,f72 and 7iii7 the implementation plan described in paragraph 7#a77;,g72 2 and 7,,iii7 in subparagraph 7,d71 by inserting 1 through the use of penetration testing1 the vulnerability disclosure program established under section #ceei;,b1 and other means1 after periodically2 7iii7 in paragraph 7#c7-- 7,i7 in subparagraph 7,a7-- 7aa7 in clause 7iii71 by striking and at the end2 7bb7 in clause 7iv71 by adding and at the end2 and 7cc7 by adding at the end the following3 7v7 ensure that-- 7,i7 senior agency information security officers of component agencies carry out responsibilities under this subchapter1 as directed by the senior agency information security officer of the agency or an equivalent official2 and 7,,ii7 senior agency information security officers of component agencies report to-- 7aa7 the senior information security officer of the agency or an equivalent official2 and 7bb7 the ,chief ,information ,officer of the component agency or an equivalent official2 2 and 7iv7 in paragraph 7#e71 by inserting and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency before on the effectiveness2 7,b7 in subsection 7b7-- 7i7 by striking paragraph 7#a7 and inserting the following3 7#a7 pursuant to subsection 7a77#a77;,a71 performing ongoing and continuous agency system risk assessments1 which may include using guidelines and automated tools consistent with standards and guidelines promulgated under section #aacca of title #dj1 as applicable2 2 7ii7 in paragraph 7#b7-- 7,i7 by striking subparagraph 7,b7 and inserting the following3 7,b7 comply with the risk-based cyber budget model developed pursuant to section #ceec7;a77#g72 2 and 7,,ii7 in subparagraph 7,d7-- 7aa7 by redesignating clauses 7iii7 and 7iv7 as clauses 7iv7 and 7v71 respectively2 7bb7 by inserting after clause 7ii7 the following3 7iii7 binding operational directives and emergency directives promulgated by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency under section #ceec2 2 and 7cc7 in clause 7iv71 as so redesignated1 by striking as determined by the agency2 and and inserting 8as determined by the agency1 considering-- 7,i7 the agency risk assessment performed under subsection 7a77#a77;,a72 and 7,,ii7 the determinations of applying more stringent standards and additional cybersecurity procedures pursuant to section #aacca7;c77#a7 of title #dj2 and 2 7iii7 in paragraph 7#e77;,a71 by inserting 1 including penetration testing1 as appropriate1 after shall include testing2 7iv7 in paragraph 7#f71 by striking planning1 implementing1 evaluating1 and documenting and inserting planning and implementing and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 evaluating and documenting2 7v7 by redesignating paragraphs 7#g7 and 7#h7 as paragraphs 7#h7 and 7#i71 respectively2 7vi7 by inserting after paragraph 7#f7 the following3 7#g7 a process for providing the status of every remedial action and unremediated identified system vulnerability to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable2 2 and 7vii7 in paragraph 7#h77;,c71 as so redesignated-- 7,i7 by striking clause 7ii7 and inserting the following3 7ii7 notifying and consulting with the ,federal information security incident center established under section #ceef pursuant to the requirements of section #ceid2 2 7,,ii7 by redesignating clause 7iii7 as clause 7iv72 7,,iii7 by inserting after clause 7ii7 the following3 7iii7 performing the notifications and other activities required under subchapter ,,iv of this chapter2 and 2 and 7,,iv7 in clause 7iv71 as so redesignated-- 7aa7 in subclause 7,i71 by striking and relevant offices of inspectors general2 7bb7 in subclause 7,,ii71 by adding and at the end2 7cc7 by striking subclause 7,,iii72 and 7dd7 by redesignating subclause 7,,iv7 as subclause 7,,iii72 7,c7 in subsection 7c7-- 7i7 by redesignating paragraph 7#b7 as paragraph 7#e72 7ii7 by striking paragraph 7#a7 and inserting the following3 7#a7 ,biannual report ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbb and not less frequently than once every #b years thereafter1 using the continuous and ongoing agency system risk assessment under subsection 7a77#a77;,a71 the head of each agency shall submit to the ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the majority and minority leaders of the ,senate1 the ,speaker and minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives1 the appropriate authorization and appropriations committees of ,congress1 the ,national ,cyber ,director1 and the ,comptroller ,general of the ,united ,states a report that-- 7,a7 summarizes the agency system risk assessment performed under subsection 7a77#a77;,a72 7,b7 evaluates the adequacy and effectiveness of information security policies1 procedures1 and practices of the agency to address the risks identified in the agency system risk assessment performed under subsection 7a77#a77;,a71 including an analysis of the agency's cybersecurity and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 7,c7 summarizes the evaluation and implementation plans described in subparagraphs 7,f7 and 7,g7 of subsection 7a77#a7 and whether those evaluation and implementation plans call for the use of additional cybersecurity procedures determined to be appropriate by the agency2 and 7,d7 summarizes the status of remedial actions identified by inspector general of the agency1 the ,comptroller ,general of the ,united ,states1 and any other source determined appropriate by the head of the agency4 7#b7 ,unclassified reports ,each report submitted under paragraph 7#a7-- 7,a7 shall be1 to the greatest extent practicable1 in an unclassified and otherwise uncontrolled form2 and 7,b7 may include a classified annex4 7#c7 ,access to information ,the head of an agency shall ensure that1 to the greatest extent practicable1 information is included in the unclassified form of the report submitted by the agency under paragraph 7#b77;,a74 7#d7 ,briefings ,during each year during which a report is not required to be submitted under paragraph 7#a71 the ,director shall provide to the congressional committees described in paragraph 7#a7 a briefing summarizing current agency and ,federal risk postures4 2 and 7iii7 in paragraph 7#e71 as so redesignated1 by striking the period at the end and inserting 1 including the reporting procedures established under section #aacae7;d7 of title #dj and subsection 7a77#c77;,a77v7 of this section2 and 7,d7 in subsection 7d77#a71 in the matter preceding subparagraph 7,a71 by inserting and the ,national ,cyber ,director after the ,director2 and 7,e7 by adding at the end the following3 7f7 ,reporting structure exemption 7#a7 ,in general ,on an annual basis1 the ,director may exempt an agency from the reporting structure requirement under subsection 7a77#c77;,a77v77,,ii74 7#b7 ,report ,on an annual basis1 the ,director shall submit a report to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives that includes a list of each exemption granted under paragraph 7#a7 and the associated rationale for each exemption4 7#c7 ,component of other report ,the report required under paragraph 7#b7 may be incorporated into any other annual report required under this chapter4 2 7#d7 in section #ceee-- 7,a7 in the section heading1 by striking ,annual independent and inserting ,independent2 7,b7 in subsection 7a7-- 7i7 in paragraph 7#a71 by inserting during which a report is required to be submitted under section #ceec7;c71 after ,each year2 7ii7 in paragraph 7#b77;,a71 by inserting 1 including by penetration testing and analyzing the vulnerability disclosure program of the agency after information systems2 and 7iii7 by adding at the end the following3 7#c7 ,an evaluation under this section may include recommendations for improving the cybersecurity posture of the agency4 2 7,c7 in subsection 7b77#a71 by striking annual2 7,d7 in subsection 7e77#a71 by inserting during which a report is required to be submitted under section #ceec7;c7 after ,each year2 7,e7 by striking subsection 7f7 and inserting the following3 7f7 ,protection of information 7#a7 ,agencies1 evaluators1 and other recipients of information that1 if disclosed1 may cause grave harm to the efforts of ,federal information security officers1 shall take appropriate steps to ensure the protection of that information1 including safeguarding the information from public disclosure4 7#b7 ,the protections required under paragraph 7#a7 shall be commensurate with the risk and comply with all applicable laws and regulations4 7#c7 ,with respect to information that is not related to national security systems1 agencies and evaluators shall make a summary of the information unclassified and publicly available1 including information that does not identify-- 7,a7 specific information system incidents2 or 7,b7 specific information system vulnerabilities4 2 7,f7 in subsection 7g77#b7-- 7i7 by striking this subsection shall and inserting 8this subsection-- 7,a7 shall 2 7ii7 in subparagraph 7,a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,b7 identify any entity that performs an independent evaluation under subsection 7b74 2 and 7,g7 by striking subsection 7j7 and inserting the following3 7j7 ,guidance 7#a7 ,in general ,the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,chief ,information ,officers ,council1 the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 and other interested parties as appropriate1 shall ensure the development of risk-based guidance for evaluating the effectiveness of an information security program and practices 7#b7 ,priorities ,the risk-based guidance developed under paragraph 7#a7 shall include-- 7,a7 the identification of the most common successful threat patterns experienced by each agency2 7,b7 the identification of security controls that address the threat patterns described in subparagraph 7,a72 7,c7 any other security risks unique to the networks of each agency2 and 7,d7 any other element the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 determines appropriate4 2 and 7#e7 in section #ceef7;a7-- 7,a7 in the matter preceding paragraph 7#a71 by inserting within the ,cybersecurity and ,infrastructure ,security ,agency after incident center2 and 7,b7 in paragraph 7#d71 by striking #ceed7;b7 and inserting #ceed7;a77#a77;,a74 7d7 ,conforming amendments 7#a7 ,table of sections ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the item relating to section #ceee and inserting the following3 #ceee4 ,independent evaluation 4 7#b7 ,,omb reports ,section #bbf7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebd7;c77 is amended-- 7,a7 in paragraph 7#a77;,b71 in the matter preceding clause 7i71 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7,b7 in paragraph 7#b77;,b71 in the matter preceding clause 7i7-- 7i7 by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section #ceec7;c7 of title #dd1 ,united ,states ,code2 and 7ii7 by striking the report required under section #ceec7;c7 of title #dd1 ,united ,states ,code and inserting that report4 7#c7 ,,nist responsibilities ,section #bj7;d77#c77;,b7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;d77#c77;,b77 is amended by striking annual4 7e7 ,federal system incident response 7#a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,iv ,federal ,system ,incident ,response #ceia4 ,definitions 7a7 ,in general ,except as provided in subsection 7b71 the definitions under sections #cejb and #ceeb shall apply to this subchapter4 7b7 ,additional definitions ,as used in this subchapter3 7#a7 ,appropriate reporting entities ,the term appropriate reporting entities means-- 7,a7 the majority and minority leaders of the ,senate2 7,b7 the ,speaker and minority leader of the ,house of ,representatives2 7,c7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,d7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7,e7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7,f7 the appropriate authorization and appropriations committees of ,congress2 7,g7 the ,director2 7,h7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7,i7 the ,national ,cyber ,director2 7,j7 the ,comptroller ,general of the ,united ,states2 and 7,k7 the inspector general of any impacted agency4 7#b7 ,awardee ,the term awardee-- 7,a7 means a person1 business1 or other entity that receives a grant from1 or is a party to a cooperative agreement or an other transaction agreement with1 an agency2 and 7,b7 includes any subgrantee of a person1 business1 or other entity described in subparagraph 7,a74 7#c7 ,breach ,the term breach-- 7,a7 means the loss1 control1 compromise1 unauthorized disclosure1 or unauthorized acquisition of personally identifiable information or any similar occurrence2 and 7,b7 includes any additional meaning given the term in policies1 principles1 standards1 or guidelines issued by the ,director under section #ceec7;a74 7#d7 ,contractor ,the term contractor means a prime contractor of an agency or a subcontractor of a prime contractor of an agency4 7#e7 ,federal information ,the term ,federal information means information created1 collected1 processed1 maintained1 disseminated1 disclosed1 or disposed of by or for the ,federal ,government in any medium or form4 7#f7 ,federal information system ,the term ,federal information system means an information system used or operated by an agency1 a contractor1 an awardee1 or another organization on behalf of an agency4 7#g7 ,intelligence community ,the term intelligence community has the meaning given the term in section #c of the ,national ,security ,act of #aidg 7#ej ,u4,s4,c4 #cjjc74 7#h7 ,nationwide consumer reporting agency ,the term nationwide consumer reporting agency means a consumer reporting agency described in section #fjc7p7 of the ,fair ,credit ,reporting ,act 7#ae ,u4,s4,c4 #afha;a7p774 7#i7 ,vulnerability disclosure ,the term vulnerability disclosure means a vulnerability identified under section #ceei;,b4 #ceib4 ,notification of breach 7a7 ,notification ,as expeditiously as practicable and without unreasonable delay1 and in any case not later than #de days after an agency has a reasonable basis to conclude that a breach has occurred1 the head of the agency1 in consultation with a senior privacy officer of the agency1 shall-- 7#a7 determine whether notice to any individual potentially affected by the breach is appropriate based on an assessment of the risk of harm to the individual that considers-- 7,a7 the nature and sensitivity of the personally identifiable information affected by the breach2 7,b7 the likelihood of access to and use of the personally identifiable information affected by the breach2 7,c7 the type of breach2 and 7,d7 any other factors determined by the ,director2 and 7#b7 as appropriate1 provide written notice in accordance with subsection 7b7 to each individual potentially affected by the breach-- 7,a7 to the last known mailing address of the individual2 or 7,b7 through an appropriate alternative method of notification that the head of the agency or a designated senior-level individual of the agency selects based on factors determined by the ,director4 7b7 ,contents of notice ,each notice of a breach provided to an individual under subsection 7a77#b7 shall include-- 7#a7 a brief description of the breach2 7#b7 if possible1 a description of the types of personally identifiable information affected by the breach2 7#c7 contact information of the agency that may be used to ask questions of the agency1 which-- 7,a7 shall include an e-mail address or another digital contact mechanism2 and 7,b7 may include a telephone number1 mailing address1 or a website2 7#d7 information on any remedy being offered by the agency2 7#e7 any applicable educational materials relating to what individuals can do in response to a breach that potentially affects their personally identifiable information1 including relevant contact information for ,federal law enforcement agencies and each nationwide consumer reporting agency2 and 7#f7 any other appropriate information1 as determined by the head of the agency or established in guidance by the ,director4 7c7 ,delay of notification 7#a7 ,in general ,the ,attorney ,general1 the ,director of ,national ,intelligence1 or the ,secretary of ,homeland ,security may delay a notification required under subsection 7a7 or 7d7 if the notification would-- 7,a7 impede a criminal investigation or a national security activity2 7,b7 reveal sensitive sources and methods2 7,c7 cause damage to national security2 or 7,d7 hamper security remediation actions4 7#b7 ,documentation 7,a7 ,in general ,any delay under paragraph 7#a7 shall be reported in writing to the ,director1 the ,attorney ,general1 the ,director of ,national ,intelligence1 the ,secretary of ,homeland ,security1 the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the head of the agency and the inspector general of the agency that experienced the breach4 7,b7 ,contents ,a report required under subparagraph 7,a7 shall include a written statement from the entity that delayed the notification explaining the need for the delay4 7,c7 ,form ,the report required under subparagraph 7,a7 shall be unclassified but may include a classified annex4 7#c7 ,renewal ,a delay under paragraph 7#a7 shall be for a period of #fj days and may be renewed4 7d7 ,update notification ,if an agency determines there is a significant change in the reasonable basis to conclude that a breach occurred1 a significant change to the determination made under subsection 7a77#a71 or that it is necessary to update the details of the information provided to potentially affected individuals as described in subsection 7b71 the agency shall as expeditiously as practicable and without unreasonable delay1 and in any case not later than #cj days after such a determination1 notify each individual who received a notification pursuant to subsection 7a7 of those changes4 7e7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ,director from issuing guidance relating to notifications or the head of an agency from notifying individuals potentially affected by breaches that are not determined to be major incidents2 or 7#b7 the ,director from issuing guidance relating to notifications of major incidents or the head of an agency from providing more information than described in subsection 7b7 when notifying individuals potentially affected by breaches4 #ceic4 ,congressional and ,executive ,branch reports 7a7 ,initial report 7#a7 ,in general ,not later than #gb hours after an agency has a reasonable basis to conclude that a major incident occurred1 the head of the agency impacted by the major incident shall submit to the appropriate reporting entities a written report and1 to the extent practicable1 provide a briefing to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 the ,committee on ,oversight and ,reform of the ,house of ,representatives1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the appropriate authorization and appropriations committees of ,congress1 taking into account-- 7,a7 the information known at the time of the report2 7,b7 the sensitivity of the details associated with the major incident2 and 7,c7 the classification level of the information contained in the report4 7#b7 ,contents ,a report required under paragraph 7#a7 shall include1 in a manner that excludes or otherwise reasonably protects personally identifiable information and to the extent permitted by applicable law1 including privacy and statistical laws-- 7,a7 a summary of the information available about the major incident1 including how the major incident occurred1 information indicating that the major incident may be a breach1 and information relating to the major incident as a breach1 based on information available to agency officials as of the date on which the agency submits the report2 7,b7 if applicable1 a description and any associated documentation of any circumstances necessitating a delay in a notification to individuals potentially affected by the major incident under section #ceib7;c72 7,c7 if applicable1 an assessment of the impacts to the agency1 the ,federal ,government1 or the security of the ,united ,states1 based on information available to agency officials on the date on which the agency submits the report2 and 7,d7 if applicable1 whether any ransom has been demanded or paid1 or plans to be paid1 by any entity operating a ,federal information system or with access to a ,federal information system1 unless disclosure of such information may disrupt an active ,federal law enforcement or national security operation4 7b7 ,supplemental report ,within a reasonable amount of time1 but not later than #cj days after the date on which an agency submits a written report under subsection 7a71 the head of the agency shall provide to the appropriate reporting entities written updates1 which may include classified annexes1 on the major incident and1 to the extent practicable1 provide a briefing1 which may include a classified component1 to the congressional committees described in subsection 7a77#a71 including summaries of-- 7#a7 vulnerabilities1 means by which the major incident occurred1 and impacts to the agency relating to the major incident2 7#b7 any risk assessment and subsequent risk-based security implementation of the affected information system before the date on which the major incident occurred2 7#c7 the status of compliance of the affected information system with applicable security requirements that are directly related to the cause of the incident1 at the time of the major incident2 7#d7 an estimate of the number of individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 7#e7 an assessment of the risk of harm to individuals potentially affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 7#f7 an update to the assessment of the risk to agency operations1 or to impacts on other agency or non-,federal entity operations1 affected by the major incident based on information available to agency officials as of the date on which the agency provides the update2 7#g7 the detection1 response1 and remediation actions of the agency1 including any support provided by the ,cybersecurity and ,infrastructure ,security ,agency under section #ceid7;d7 and status updates on the notification process described in section #ceib7;a71 including any delay described in section #ceib7;c71 if applicable2 and 7#h7 if applicable1 a description of any circumstances or data leading the head of the agency to determine1 pursuant to section #ceib7;a77#a71 not to notify individuals potentially impacted by a breach4 7c7 ,update report ,if the agency determines that there is any significant change in the understanding of the agency of the scope1 scale1 or consequence of a major incident for which an agency submitted a written report under subsection 7a71 the agency shall provide an updated report to the appropriate reporting entities that includes information relating to the change in understanding4 7d7 ,biannual report ,each agency shall submit as part of the biannual report required under section #ceed7;c77#a7 of this title a description of each major incident that occurred during the #b-year period preceding the date on which the biannual report is submitted4 7e7 ,delay and lack of notification report 7#a7 ,in general ,the ,director shall submit to the appropriate reporting entities an annual report on all notification delays granted pursuant to section #ceib7;c74 7#b7 ,lack of breach notification ,the ,director shall submit to the appropriate reporting entities an annual report on each breach with respect to which the head of an agency determined1 pursuant to section #ceib7;a77#a71 not to notify individuals potentially impacted by the breach4 7#c7 ,component of other report ,the ,director may submit the report required under paragraph 7#a7 as a component of the annual report submitted under section #ceig7;b74 7f7 ,report delivery ,any written report required to be submitted under this section may be submitted in a paper or electronic format4 7g7 ,threat briefing 7#a7 ,in general ,not later than #g days after the date on which an agency has a reasonable basis to conclude that a major incident occurred1 the head of the agency1 jointly with the ,director1 the ,national ,cyber ,director and any other ,federal entity determined appropriate by the ,national ,cyber ,director1 shall provide a briefing to the congressional committees described in subsection 7a77#a7 on the threat causing the major incident4 7#b7 ,components ,the briefing required under paragraph 7#a7-- 7,a7 shall1 to the greatest extent practicable1 include an unclassified component2 and 7,b7 may include a classified component4 7h7 ,rule of construction ,nothing in this section shall be construed to limit-- 7#a7 the ability of an agency to provide additional reports or briefings to ,congress2 or 7#b7 ,congress from requesting additional information from agencies through reports1 briefings1 or other means4 #ceid4 ,government information sharing and incident response 7a7 ,in general 7#a7 ,incident reporting ,subject to the limitations described in subsection 7b71 the head of each agency shall provide any information relating to any incident affecting the agency1 whether the information is obtained by the ,federal ,government directly or indirectly1 to the ,cybersecurity and ,infrastructure ,security ,agency4 7#b7 ,contents ,a provision of information relating to an incident made by the head of an agency under paragraph 7#a7 shall-- 7,a7 include detailed information about the safeguards that were in place when the incident occurred2 7,b7 whether the agency implemented the safeguards described in subparagraph 7,a7 correctly2 7,c7 in order to protect against a similar incident1 identify-- 7i7 how the safeguards described in subparagraph 7,a7 should be implemented differently2 and 7ii7 additional necessary safeguards2 and 7,d7 include information to aid in incident response1 such as-- 7i7 a description of the affected systems or networks2 7ii7 the estimated dates of when the incident occurred2 and 7iii7 information that could reasonably help identify the party that conducted the incident or the cause of the incident1 subject to appropriate privacy protections4 7#c7 ,information sharing ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 make incident information provided under paragraph 7#a7 available to the ,director and the ,national ,cyber ,director2 7,b7 to the greatest extent practicable1 share information relating to an incident with the head of any agency that may be-- 7i7 impacted by the incident2 7ii7 similarly susceptible to the incident2 or 7iii7 similarly targeted by the incident2 and 7,c7 coordinate any necessary information sharing efforts relating to a major incident with the private sector4 7#d7 ,national security systems ,each agency operating or exercising control of a national security system shall share information about incidents that occur on national security systems with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to the extent consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president4 7b7 ,compliance ,in providing information and selecting a method to provide information under subsection 7a71 the head of each agency shall take into account the level of classification of the information and any information sharing limitations and protections1 such as limitations and protections relating to law enforcement1 national security1 privacy1 statistical confidentiality1 or other factors determined by the ,director in order to implement subsection 7a77#a7 in a manner that enables automated and consistent reporting to the greatest extent practicable4 7c7 ,incident response ,each agency that has a reasonable basis to conclude that a major incident occurred involving ,federal information in electronic medium or form that does not exclusively involve a national security system1 regardless of delays from notification granted for a major incident that is also a breach1 shall coordinate with the ,cybersecurity and ,infrastructure ,security ,agency to facilitate asset response activities and provide recommendations for mitigating future incidents4 #ceie4 ,responsibilities of contractors and awardees 7a7 ,reporting 7#a7 ,in general ,unless otherwise specified in a contract1 grant1 cooperative agreement1 or an other transaction agreement1 any contractor or awardee of an agency shall report to the agency within the same amount of time such agency is required to report an incident to the ,cybersecurity and ,infrastructure ,security ,agency1 if the contractor or awardee has a reasonable basis to suspect or conclude that-- 7,a7 an incident or breach has occurred with respect to ,federal information collected1 used1 or maintained by the contractor or awardee in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee2 7,b7 an incident or breach has occurred with respect to a ,federal information system used or operated by the contractor or awardee in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee2 or 7,c7 the contractor or awardee has received information from the agency that the contractor or awardee is not authorized to receive in connection with the contract1 grant1 cooperative agreement1 or other transaction agreement of the contractor or awardee4 7#b7 ,procedures 7,a7 ,major incident ,following a report of a breach or major incident by a contractor or awardee under paragraph 7#a71 the agency1 in consultation with the contractor or awardee1 shall carry out the requirements under sections #ceib1 #ceic1 and #ceid with respect to the major incident4 7,b7 ,incident ,following a report of an incident by a contractor or awardee under paragraph 7#a71 an agency1 in consultation with the contractor or awardee1 shall carry out the requirements under section #ceid with respect to the incident4 7b7 ,effective date ,this section shall apply-- 7#a7 on and after the date that is #a year after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbb2 and 7#b7 with respect to any contract entered into on or after the date described in paragraph 7#a74 #ceif4 ,training 7a7 ,covered individual defined ,in this section1 the term covered individual means an individual who obtains access to ,federal information or ,federal information systems because of the status of the individual as an employee1 contractor1 awardee1 volunteer1 or intern of an agency4 7b7 ,requirement ,the head of each agency shall develop training for covered individuals on how to identify and respond to an incident1 including-- 7#a7 the internal process of the agency for reporting an incident2 and 7#b7 the obligation of a covered individual to report to the agency a confirmed major incident and any suspected incident involving information in any medium or form1 including paper1 oral1 and electronic4 7c7 ,inclusion in annual training ,the training developed under subsection 7b7 may be included as part of an annual privacy or security awareness training of an agency4 #ceig4 ,analysis and report on ,federal incidents 7a7 ,analysis of federal incidents 7#a7 ,quantitative and qualitative analyses ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop1 in consultation with the ,director and the ,national ,cyber ,director1 and perform continuous monitoring and quantitative and qualitative analyses of incidents at agencies1 including major incidents1 including-- 7,a7 the causes of incidents1 including-- 7i7 attacker tactics1 techniques1 and procedures2 and 7ii7 system vulnerabilities1 including zero days1 unpatched systems1 and information system misconfigurations2 7,b7 the scope and scale of incidents at agencies2 7,c7 common root causes of incidents across multiple ,federal agencies2 7,d7 agency incident response1 recovery1 and remediation actions and the effectiveness of those actions1 as applicable2 7,e7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,f7 trends across multiple ,federal agencies to address intrusion detection and incident response capabilities using the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7#b7 ,automated analysis ,the analyses developed under paragraph 7#a7 shall1 to the greatest extent practicable1 use machine readable data1 automation1 and machine learning processes4 7#c7 ,sharing of data and analysis 7,a7 ,in general ,the ,director shall share on an ongoing basis the analyses required under this subsection with agencies and the ,national ,cyber ,director to-- 7i7 improve the understanding of cybersecurity risk of agencies2 and 7ii7 support the cybersecurity improvement efforts of agencies4 7,b7 ,format ,in carrying out subparagraph 7,a71 the ,director shall share the analyses-- 7i7 in human-readable written products2 and 7ii7 to the greatest extent practicable1 in machine-readable formats in order to enable automated intake and use by agencies4 7b7 ,annual report on ,federal incidents ,not later than #b years after the date of enactment of this section1 and not less frequently than annually thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 the ,national ,cyber ,director and the heads of other ,federal agencies1 as appropriate1 shall submit to the appropriate reporting entities a report that includes-- 7#a7 a summary of causes of incidents from across the ,federal ,government that categorizes those incidents as incidents or major incidents2 7#b7 the quantitative and qualitative analyses of incidents developed under subsection 7a77#a7 on an agency-by-agency basis and comprehensively across the ,federal ,government1 including-- 7,a7 a specific analysis of breaches2 and 7,b7 an analysis of the ,federal ,government's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c772 and 7#c7 an annex for each agency that includes-- 7,a7 a description of each major incident2 7,b7 the total number of incidents of the agency2 and 7,c7 an analysis of the agency's performance against the metrics established under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7c7 ,publication 7#a7 ,in general ,a version of each report submitted under subsection 7b7 shall be made publicly available on the website of the ,cybersecurity and ,infrastructure ,security ,agency during the year in which the report is submitted4 7#b7 ,exemption ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency may exempt all or a portion of a report described in paragraph 7#a7 from public publication if the ,director of the ,cybersecurity and ,infrastructure ,security ,agency determines the exemption is in the interest of national security4 7#c7 ,limitation on exemption ,an exemption granted under paragraph 7#b7 shall not apply to any version of a report submitted to the appropriate reporting entities under subsection 7b74 7d7 ,information provided by agencies 7#a7 ,in general ,the analysis required under subsection 7a7 and each report submitted under subsection 7b7 shall use information provided by agencies under section #ceid7;a74 7#b7 ,noncompliance reports 7,a7 ,in general ,subject to subparagraph 7,b71 during any year during which the head of an agency does not provide data for an incident to the ,cybersecurity and ,infrastructure ,security ,agency in accordance with section #ceid7;a71 the head of the agency1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,director1 shall submit to the appropriate reporting entities a report that includes the information described in subsection 7b7 with respect to the agency4 7,b7 ,exception for national security systems ,the head of an agency that owns or exercises control of a national security system shall not include data for an incident that occurs on a national security system in any report submitted under subparagraph 7,a74 7#c7 ,national security system reports 7,a7 ,in general ,annually1 the head of an agency that operates or exercises control of a national security system shall submit a report that includes the information described in subsection 7b7 with respect to the national security system to the extent that the submission is consistent with standards and guidelines for national security systems issued in accordance with law and as directed by the ,president to-- 7i7 the majority and minority leaders of the ,senate1 7ii7 the ,speaker and minority leader of the ,house of ,representatives2 7iii7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7iv7 the ,select ,committee on ,intelligence of the ,senate2 7v7 the ,committee on ,armed ,services of the ,senate2 7vi7 the ,committee on ,appropriations of the ,senate2 7vii7 the ,committee on ,oversight and ,reform of the ,house of ,representatives2 7viii7 the ,committee on ,homeland ,security of the ,house of ,representatives2 7ix7 the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives2 7x7 the ,committee on ,armed ,services of the ,house of ,representatives2 and 7xi7 the ,committee on ,appropriations of the ,house of ,representatives4 7,b7 ,classified form ,a report required under subparagraph 7,a7 may be submitted in a classified form4 7e7 ,requirement for compiling information ,in publishing the public report required under subsection 7c71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall sufficiently compile information such that no specific incident of an agency can be identified1 except with the concurrence of the ,director of the ,office of ,management and ,budget and in consultation with the impacted agency4 #ceih4 ,major incident definition 7a7 ,in general ,not later than #ahj days after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director1 shall develop and promulgate guidance on the definition of the term major incident for the purposes of subchapter ,,ii and this subchapter4 7b7 ,requirements ,with respect to the guidance issued under subsection 7a71 the definition of the term major incident shall-- 7#a7 include1 with respect to any information collected or maintained by or on behalf of an agency or an information system used or operated by an agency or by a contractor of an agency or another organization on behalf of an agency-- 7,a7 any incident the head of the agency determines is likely to have an impact on-- 7i7 the national security1 homeland security1 or economic security of the ,united ,states2 or 7ii7 the civil liberties or public health and safety of the people of the ,united ,states2 7,b7 any incident the head of the agency determines likely to result in an inability for the agency1 a component of the agency1 or the ,federal ,government1 to provide #a or more critical services2 7,c7 any incident that the head of an agency1 in consultation with a senior privacy officer of the agency1 determines is likely to have a significant privacy impact on #a or more individual2 7,d7 any incident that the head of the agency1 in consultation with a senior privacy official of the agency1 determines is likely to have a substantial privacy impact on a significant number of individuals2 7,e7 any incident the head of the agency determines substantially disrupts the operations of a high value asset owned or operated by the agency2 7,f7 any incident involving the exposure of sensitive agency information to a foreign entity1 such as the communications of the head of the agency1 the head of a component of the agency1 or the direct reports of the head of the agency or the head of a component of the agency2 and 7,g7 any other type of incident determined appropriate by the ,director2 7#b7 stipulate that the ,national ,cyber ,director1 in consultation with the ,director1 shall declare a major incident at each agency impacted by an incident if it is determined that an incident-- 7,a7 occurs at not less than #b agencies2 and 7,b7 is enabled by-- 7i7 a common technical root cause1 such as a supply chain compromise1 a common software or hardware vulnerability2 or 7ii7 the related activities of a common threat actor2 and 7#c7 stipulate that1 in determining whether an incident constitutes a major incident because that incident is any incident described in paragraph 7#a71 the head of the agency shall consult with the ,national ,cyber ,director and may consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,significant number of individuals ,in determining what constitutes a significant number of individuals under subsection 7b77#a77;,d71 the ,director-- 7#a7 may determine a threshold for a minimum number of individuals that constitutes a significant amount2 and 7#b7 may not determine a threshold described in paragraph 7#a7 that exceeds #e1jjj individuals4 7d7 ,evaluation and updates ,not later than #b years after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 and not less frequently than every #b years thereafter1 the ,director shall provide a briefing to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives1 which shall include-- 7#a7 an evaluation of any necessary updates to the guidance issued under subsection 7a72 7#b7 an evaluation of any necessary updates to the definition of the term major incident included in the guidance issued under subsection 7a72 and 7#c7 an explanation of1 and the analysis that led to1 the definition described in paragraph 7#b74 4 7#b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 ,,subchapter ,,iv--,federal ,system ,incident ,response #ceia4 ,definitions#ceib4 ,notification of breach#ceic4 ,congressional and ,executive ,branch reports#ceid4 ,government information sharing and incident response#ceie4 ,responsibilities of contractors and awardees#ceif4 ,training#ceig4 ,analysis and report on ,federal incidents#ceih4 ,major incident definition 4 #ajd4 ,amendments to subtitle ,,iii of title #dj 7a7 ,modernizing ,government ,technology ,subtitle ,g of title ,x of ,division ,a of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjah 7#dj ,u4,s4,c4 #aacja note7 is amended in section #ajgh-- 7#a7 by striking subsection 7a7 and inserting the following3 7a7 ,definitions ,in this section3 7#a7 ,agency ,the term agency has the meaning given the term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,high value asset ,the term high value asset has the meaning given the term in section #ceeb of title #dd1 ,united ,states ,code4 2 7#b7 in subsection 7b71 by adding at the end the following3 7#h7 ,proposal evaluation ,the ,director shall-- 7,a7 give consideration for the use of amounts in the ,fund to improve the security of high value assets2 and 7,b7 require that any proposal for the use of amounts in the ,fund includes a cybersecurity plan1 including a supply chain risk management plan1 to be reviewed by the member of the ,technology ,modernization ,board described in subsection 7c77#e77;,c74 2 and 7#c7 in subsection 7c7-- 7,a7 in paragraph 7#b77;,a77i71 by inserting 1 including a consideration of the impact on high value assets after operational risks2 7,b7 in paragraph 7#e7-- 7i7 in subparagraph 7,a71 by striking and at the end2 7ii7 in subparagraph 7,b71 by striking the period at the end and inserting and2 and 7iii7 by adding at the end the following3 7,c7 a senior official from the ,cybersecurity and ,infrastructure ,security ,agency of the ,department of ,homeland ,security1 appointed by the ,director4 2 and 7,c7 in paragraph 7#f77;,a71 by striking shall be-- and all that follows through #d employees and inserting shall be #d employees4 7b7 ,subchapter ,i ,subchapter ,i of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacjb-- 7,a7 in subsection 7b71 by striking use1 security1 and disposal of and inserting use1 and disposal of1 and1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director1 promote and improve the security of12 7,b7 in subsection 7c7-- 7i7 in paragraph 7#c7-- 7,i7 in subparagraph 7,a7-- 7aa7 by striking including data and inserting which shall-- 7i7 include data 2 and 7bb7 by adding at the end the following3 7ii7 specifically denote cybersecurity funding under the risk-based cyber budget model developed pursuant to section #ceec7;a77#g7 of title #dd4 2 and 7,,ii7 in subparagraph 7,b71 by adding at the end the following3 7iii7 ,the ,director shall provide to the ,national ,cyber ,director any cybersecurity funding information described in subparagraph 7,a77ii7 that is provided to the ,director under clause 7ii7 of this subparagraph4 2 7,c7 in subsection 7f7-- 7i7 by striking heads of executive agencies to develop and inserting 8heads of executive agencies to-- 7#a7 develop 2 7ii7 in paragraph 7#a71 as so designated1 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7#b7 consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency for the development and use of supply chain security best practices4 2 and 7,d7 in subsection 7h71 by inserting 1 including cybersecurity performances1 after the performances2 and 7#b7 in section #aacjc7;b7-- 7,a7 in paragraph 7#b77;,b7-- 7i7 in clause 7i71 by striking or at the end2 7ii7 in clause 7ii71 by adding or at the end2 and 7iii7 by adding at the end the following3 7iii7 whether the function should be performed by a shared service offered by another executive agency2 2 and 7,b7 in paragraph 7#e77;,b77i71 by inserting 1 while taking into account the risk-based cyber budget model developed pursuant to section #ceec7;a77#g7 of title #dd after title #ca4 7c7 ,subchapter ,,ii ,subchapter ,,ii of chapter #aac of subtitle ,,iii of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in section #aacab7;a71 by inserting 1 including security risks after managing the risks2 7#b7 in section #aacac7a71 by striking efficiency and effectiveness and inserting efficiency1 security1 and effectiveness2 7#c7 in section #aacae1 by adding at the end the following3 7d7 ,component agency chief information officers ,the ,chief ,information ,officer or an equivalent official of a component agency shall report to-- 7#a7 the ,chief ,information ,officer designated under section #cejf7;a77#b7 of title #dd or an equivalent official of the agency of which the component agency is a component2 and 7#b7 the head of the component agency4 7e7 ,reporting structure exemption 7#a7 ,in general ,on annual basis1 the ,director may exempt any agency from the reporting structure requirements under subsection 7d74 7#b7 ,report ,on an annual basis1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report that includes a list of each exemption granted under paragraph 7#a7 and the associated rationale for each exemption4 7#c7 ,component of other report ,the report required under paragraph 7#b7 may be incorporated into any other annual report required under chapter #ce of title #dd1 ,united ,states ,code4 2 7#d7 in section #aacag1 by inserting security1 before or schedule2 and 7#e7 in section #aacai7;b77#a71 in the paragraph heading1 by striking ,,cios and inserting ,chief ,information ,officers4 7d7 ,subchapter ,,iii ,section #aacca of title #dj1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a71 by striking section #cecb7;b77#a7 and inserting section #ceeb7;b72 7#b7 in subsection 7b77#a77;,a71 by striking the ,secretary of ,homeland ,security and inserting the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 7#c7 by striking subsection 7c7 and inserting the following3 7c7 ,application of more stringent standards 7#a7 ,in general ,the head of an agency shall-- 7,a7 evaluate1 in consultation with the senior agency information security officers1 the need to employ standards for cost-effective1 risk-based information security for all systems1 operations1 and assets within or under the supervision of the agency that are more stringent than the standards promulgated by the ,director under this section1 if such standards contain1 at a minimum1 the provisions of those applicable standards made compulsory and binding by the ,director2 and 7,b7 to the greatest extent practicable and if the head of the agency determines that the standards described in subparagraph 7,a7 are necessary1 employ those standards4 7#b7 ,evaluation of more stringent standards ,in evaluating the need to employ more stringent standards under paragraph 7#a71 the head of an agency shall consider available risk information1 such as-- 7,a7 the status of cybersecurity remedial actions of the agency2 7,b7 any vulnerability information relating to agency systems that is known to the agency2 7,c7 incident information of the agency2 7,d7 information from-- 7i7 penetration testing performed under section #ceei;,a of title #dd2 and 7ii7 information from the vulnerability disclosure program established under section #ceei;,b of title #dd2 7,e7 agency threat hunting results under section #aab of the ,federal ,information ,security ,modernization ,act of #bjbb2 7,f7 ,federal and non-,federal cyber threat intelligence2 7,g7 data on compliance with standards issued under this section2 7,h7 agency system risk assessments performed under section #ceed7;a77#a77;,a7 of title #dd2 and 7,i7 any other information determined relevant by the head of the agency4 2 7#d7 in subsection 7d77#b7-- 7,a7 in the paragraph heading1 by striking ,notice and comment and inserting ,consultation1 notice1 and comment2 7,b7 by inserting promulgate1 before significantly modify2 and 7,c7 by striking shall be made after the public is given an opportunity to comment on the ,director's proposed decision4 and inserting 8shall be made-- 7,a7 for a decision to significantly modify or not promulgate such a proposed standard1 after the public is given an opportunity to comment on the ,director's proposed decision2 7,b7 in consultation with the ,chief ,information ,officers ,council1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,comptroller ,general of the ,united ,states1 and the ,council of the ,inspectors ,general on ,integrity and ,efficiency2 7,c7 considering the ,federal risk assessments performed under section #ceec7;i7 of title #dd2 and 7,d7 considering the extent to which the proposed standard reduces risk relative to the cost of implementation of the standard4 2 and 7#e7 by adding at the end the following3 7e7 ,review of office of management and budget guidance and policy 7#a7 ,conduct of review 7,a7 ,in general ,not less frequently than once every #c years1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,chief ,information ,officers ,council1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,comptroller ,general of the ,united ,states1 and the ,council of the ,inspectors ,general on ,integrity and ,efficiency1 shall review the efficacy of the guidance and policy promulgated by the ,director in reducing cybersecurity risks1 including an assessment of the requirements for agencies to report information to the ,director1 and determine whether any changes to that guidance or policy is appropriate4 7,b7 ,federal risk assessments ,in conducting the review described in subparagraph 7,a71 the ,director shall consider the ,federal risk assessments performed under section #ceec7;i7 of title #dd4 7,c7 ,requirements burden reduction and clarity ,in conducting the review described in subparagraph 7,a71 the ,director shall consider-- 7i7 the cumulative reporting and compliance burden to agencies2 and 7ii7 the clarity of the requirements and deadlines contained in guidance and policy documents4 7#b7 ,updated guidance ,not later than #ij days after the date on which a review is completed under paragraph 7#a71 the ,director of the ,office of ,management and ,budget shall issue updated guidance or policy to agencies determined appropriate by the ,director1 based on the results of the review4 7#c7 ,public report ,not later than #cj days after the date on which a review is completed under paragraph 7#a71 the ,director of the ,office of ,management and ,budget shall make publicly available a report that includes-- 7,a7 an overview of the guidance and policy promulgated under this section that is currently in effect2 7,b7 the cybersecurity risk mitigation1 or other cybersecurity benefit1 offered by each guidance or policy document described in subparagraph 7,a72 and 7,c7 a summary of the guidance or policy to which changes were determined appropriate during the review and what the changes are anticipated to include4 7#d7 ,congressional briefing ,not later than #fj days after the date on which a review is completed under paragraph 7#a71 the ,director shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the review4 7f7 ,automated standard implementation verification ,when the ,director of the ,national ,institute of ,standards and ,technology issues a proposed standard pursuant to paragraphs 7#b7 and 7#c7 of section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a771 the ,director of the ,national ,institute of ,standards and ,technology shall consider developing and1 if appropriate and practical1 develop1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 specifications to enable the automated verification of the implementation of the controls within the standard4 4 #aje4 ,actions to enhance ,federal incident transparency 7a7 ,responsibilities of the cybersecurity and infrastructure security agency 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7,a7 develop a plan for the development of the analysis required under section #ceig7;a7 of title #dd1 ,united ,states ,code1 as added by this title1 and the report required under subsection 7b7 of that section that includes-- 7i7 a description of any challenges the ,director of the ,cybersecurity and ,infrastructure ,security ,agency anticipates encountering2 and 7ii7 the use of automation and machine-readable formats for collecting1 compiling1 monitoring1 and analyzing data2 and 7,b7 provide to the appropriate congressional committees a briefing on the plan developed under subparagraph 7,a74 7#b7 ,briefing ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a briefing on-- 7,a7 the execution of the plan required under paragraph 7#a77;,a72 and 7,b7 the development of the report required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this title4 7b7 ,responsibilities of the director of the office of management and budget 7#a7 ,,fisma ,section #b of the ,federal ,information ,security ,modernization ,act of #bjad 7#dd ,u4,s4,c4 #ceed note7 is amended-- 7,a7 by striking subsection 7b72 and 7,b7 by redesignating subsections 7c7 through 7f7 as subsections 7b7 through 7e71 respectively4 7#b7 ,incident data sharing 7,a7 ,in general ,the ,director shall develop guidance1 to be updated not less frequently than once every #b years1 on the content1 timeliness1 and format of the information provided by agencies under section #ceid7;a7 of title #dd1 ,united ,states ,code1 as added by this title4 7,b7 ,requirements ,the guidance developed under subparagraph 7,a7 shall-- 7i7 prioritize the availability of data necessary to understand and analyze-- 7,i7 the causes of incidents2 7,,ii7 the scope and scale of incidents within the environments and systems of an agency2 7,,iii7 a root cause analysis of incidents that-- 7aa7 are common across the ,federal ,government2 or 7bb7 have a ,government-wide impact2 7,,iv7 agency response1 recovery1 and remediation actions and the effectiveness of those actions2 and 7,v7 the impact of incidents2 7ii7 enable the efficient development of-- 7,i7 lessons learned and recommendations in responding to1 recovering from1 remediating1 and mitigating future incidents2 and 7,,ii7 the report on ,federal incidents required under section #ceig7;b7 of title #dd1 ,united ,states ,code1 as added by this title2 7iii7 include requirements for the timeliness of data production2 and 7iv7 include requirements for using automation and machine-readable data for data sharing and availability4 7#c7 ,guidance on responding to information requests ,not later than #a year after the date of enactment of this ,act1 the ,director shall develop guidance for agencies to implement the requirement under section #ceid7;c7 of title #dd1 ,united ,states ,code1 as added by this title1 to provide information to other agencies experiencing incidents4 7#d7 ,standard guidance and templates ,not later than #a year after the date of enactment of this ,act1 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop guidance and templates1 to be reviewed and1 if necessary1 updated not less frequently than once every #b years1 for use by ,federal agencies in the activities required under sections #ceib1 #ceic1 and #ceif of title #dd1 ,united ,states ,code1 as added by this title4 7#e7 ,contractor and awardee guidance 7,a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,secretary of ,homeland ,security1 the ,secretary of ,defense1 the ,administrator of ,general ,services1 and the heads of other agencies determined appropriate by the ,director1 shall issue guidance to ,federal agencies on how to deconflict1 to the greatest extent practicable1 existing regulations1 policies1 and procedures relating to the responsibilities of contractors and awardees established under section #ceie of title #dd1 ,united ,states ,code1 as added by this title4 7,b7 ,existing processes ,to the greatest extent practicable1 the guidance issued under subparagraph 7,a7 shall allow contractors and awardees to use existing processes for notifying ,federal agencies of incidents involving information of the ,federal ,government4 7#f7 ,updated briefings ,not less frequently than once every #b years1 the ,director shall provide to the appropriate congressional committees an update on the guidance and templates developed under paragraphs 7#b7 through 7#d74 7c7 ,update to the privacy act of #aigd ,section #eeb;a7b7 of title #e1 ,united ,states ,code 7commonly known as the ,privacy ,act of #aigd7 is amended-- 7#a7 in paragraph 7#aa71 by striking or at the end2 7#b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 or2 and 7#c7 by adding at the end the following3 7#ac7 to another agency in furtherance of a response to an incident 7as defined in section #ceeb of title #dd7 and pursuant to the information sharing requirements in section #ceid of title #dd if the head of the requesting agency has made a written request to the agency that maintains the record specifying the particular portion desired and the activity for which the record is sought4 4 #ajf4 ,additional guidance to agencies on ,,fisma updates ,not later than #a year after the date of enactment of this ,act1 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance for agencies on-- 7#a7 performing the ongoing and continuous agency system risk assessment required under section #ceed7;a77#a77;,a7 of title #dd1 ,united ,states ,code1 as amended by this title2 7#b7 implementing additional cybersecurity procedures1 which shall include resources for shared services2 7#c7 establishing a process for providing the status of each remedial action under section #ceed7;b77#g7 of title #dd1 ,united ,states ,code1 as amended by this title1 to the ,director and the ,cybersecurity and ,infrastructure ,security ,agency using automation and machine-readable data1 as practicable1 which shall include-- 7,a7 specific guidance for the use of automation and machine-readable data2 and 7,b7 templates for providing the status of the remedial action2 and 7#d7 a requirement to coordinate with inspectors general of agencies to ensure consistent understanding and application of agency policies for the purpose of evaluations by inspectors general4 #ajg4 ,agency requirements to notify private sector entities impacted by incidents 7a7 ,definitions ,in this section3 7#a7 ,reporting entity ,the term reporting entity means private organization or governmental unit that is required by statute or regulation to submit sensitive information to an agency4 7#b7 ,sensitive information ,the term sensitive information has the meaning given the term by the ,director in guidance issued under subsection 7b74 7b7 ,guidance on notification of reporting entities ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall issue guidance requiring the head of each agency to notify a reporting entity of an incident that is likely to substantially affect-- 7#a7 the confidentiality or integrity of sensitive information submitted by the reporting entity to the agency pursuant to a statutory or regulatory requirement2 or 7#b7 the agency information system or systems used in the transmission or storage of the sensitive information described in paragraph 7#a74 #ajh4 ,mobile security standards 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director shall-- 7#a7 evaluate mobile application security guidance promulgated by the ,director2 and 7#b7 issue guidance to secure mobile devices1 including for mobile applications1 for every agency4 7b7 ,contents ,the guidance issued under subsection 7a77#b7 shall include-- 7#a7 a requirement1 pursuant to section #cejf7;b77#d7 of title #dd1 ,united ,states ,code1 for every agency to maintain a continuous inventory of every-- 7,a7 mobile device operated by or on behalf of the agency2 and 7,b7 vulnerability identified by the agency associated with a mobile device2 and 7#b7 a requirement for every agency to perform continuous evaluation of the vulnerabilities described in paragraph 7#a77;,b7 and other risks associated with the use of applications on mobile devices4 7c7 ,information sharing ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies for sharing the inventory of the agency required under subsection 7b77#a7 with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 using automation and machine-readable data to the greatest extent practicable4 7d7 ,briefing ,not later than #fj days after the date on which the ,director issues guidance under subsection 7a77#b71 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall provide to the appropriate congressional committees a briefing on the guidance4 #aji4 ,data and logging retention for incident response 7a7 ,recommendations ,not later than #b years after the date of enactment of this ,act1 and not less frequently than every #b years thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,attorney ,general1 shall submit to the ,director recommendations on requirements for logging events on agency systems and retaining other relevant data within the systems and networks of an agency4 7b7 ,contents ,the recommendations provided under subsection 7a7 shall include-- 7#a7 the types of logs to be maintained2 7#b7 the duration that logs and other relevant data should be retained2 7#c7 the time periods for agency implementation of recommended logging and security requirements2 7#d7 how to ensure the confidentiality1 integrity1 and availability of logs2 7#e7 requirements to ensure that1 upon request1 in a manner that excludes or otherwise reasonably protects personally identifiable information1 and to the extent permitted by applicable law 7including privacy and statistical laws71 agencies provide logs to-- 7,a7 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency for a cybersecurity purpose2 and 7,b7 the ,director of the ,federal ,bureau of ,investigation1 or the appropriate ,federal law enforcement agency1 to investigate potential criminal activity2 and 7#f7 requirements to ensure that1 subject to compliance with statistical laws and other relevant data protection requirements1 the highest level security operations center of each agency has visibility into all agency logs4 7c7 ,guidance ,not later than #ij days after receiving the recommendations submitted under subsection 7a71 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,attorney ,general1 shall1 as determined to be appropriate by the ,director1 update guidance to agencies regarding requirements for logging1 log retention1 log management1 sharing of log data with other appropriate agencies1 or any other logging activity determined to be appropriate by the ,director4 7d7 ,sunset ,this section shall cease to have force or effect on the date that is #aj years after the date of the enactment of this ,act4 #aaj4 ,,cisa agency advisors 7a7 ,in general ,not later than #abj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall assign not less than #a cybersecurity professional employed by the ,cybersecurity and ,infrastructure ,security ,agency to be the ,cybersecurity and ,infrastructure ,security ,agency advisor to the senior agency information security officer of each agency4 7b7 ,qualifications ,each advisor assigned under subsection 7a7 shall have knowledge of-- 7#a7 cybersecurity threats facing agencies1 including any specific threats to the assigned agency2 7#b7 performing risk assessments of agency systems2 and 7#c7 other ,federal cybersecurity initiatives4 7c7 ,duties ,the duties of each advisor assigned under subsection 7a7 shall include-- 7#a7 providing ongoing assistance and advice1 as requested1 to the agency ,chief ,information ,officer2 7#b7 serving as an incident response point of contact between the assigned agency and the ,cybersecurity and ,infrastructure ,security ,agency2 and 7#c7 familiarizing themselves with agency systems1 processes1 and procedures to better facilitate support to the agency in responding to incidents4 7d7 ,limitation ,an advisor assigned under subsection 7a7 shall not be a contractor4 7e7 ,multiple assignments ,one individual advisor may be assigned to multiple agency ,chief ,information ,officers under subsection 7a74 #aaa4 ,federal penetration testing policy 7a7 ,in general ,subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #ceei;,a4 ,federal penetration testing 7a7 ,definitions ,in this section3 7#a7 ,agency operational plan ,the term agency operational plan means a plan of an agency for the use of penetration testing4 7#b7 ,rules of engagement ,the term rules of engagement means a set of rules established by an agency for the use of penetration testing4 7b7 ,guidance 7#a7 ,in general ,the ,director1 in consultation with the ,secretary1 acting through the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall issue guidance to agencies that-- 7,a7 requires agencies to use1 when and where appropriate1 penetration testing on agency systems by both ,federal and non-,federal entities2 and 7,b7 requires agencies to develop an agency operational plan and rules of engagement that meet the requirements under subsection 7c74 7#b7 ,penetration testing guidance ,the guidance issued under this section shall-- 7,a7 permit an agency to use1 for the purpose of performing penetration testing-- 7i7 a shared service of the agency or another agency2 or 7ii7 an external entity1 such as a vendor2 and 7,b7 require agencies to provide the rules of engagement and results of penetration testing to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 without regard to the status of the entity that performs the penetration testing4 7c7 ,agency plans and rules of engagement ,the agency operational plan and rules of engagement of an agency shall-- 7#a7 require the agency to-- 7,a7 perform penetration testing1 including on the high value assets of the agency2 or 7,b7 coordinate with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to ensure that penetration testing is being performed2 7#b7 establish guidelines for avoiding1 as a result of penetration testing-- 7,a7 adverse impacts to the operations of the agency2 7,b7 adverse impacts to operational environments and systems of the agency2 and 7,c7 inappropriate access to data2 7#c7 require the results of penetration testing to include feedback to improve the cybersecurity of the agency2 and 7#d7 include mechanisms for providing consistently formatted1 and1 if applicable1 automated and machine-readable1 data to the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7d7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 establish a process to assess the performance of penetration testing by both ,federal and non-,federal entities that establishes minimum quality controls for penetration testing2 7#b7 develop operational guidance for instituting penetration testing programs at agencies2 7#c7 develop and maintain a centralized capability to offer penetration testing as a service to ,federal and non-,federal entities2 and 7#d7 provide guidance to agencies on the best use of penetration testing resources4 7e7 ,responsibilities of ,,omb ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall-- 7#a7 not less frequently than annually1 inventory all ,federal penetration testing assets2 and 7#b7 develop and maintain a standardized process for the use of penetration testing4 7f7 ,prioritization of penetration testing resources 7#a7 ,in general ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall develop a framework for prioritizing ,federal penetration testing resources among agencies4 7#b7 ,considerations ,in developing the framework under this subsection1 the ,director shall consider-- 7,a7 agency system risk assessments performed under section #ceed7;a77#a77;,a72 7,b7 the ,federal risk assessment performed under section #ceec7;i72 7,c7 the analysis of ,federal incident data performed under section #ceig2 and 7,d7 any other information determined appropriate by the ,director or the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7g7 ,exception for national security systems ,the guidance issued under subsection 7b7 shall not apply to national security systems4 7h7 ,delegation of authority for certain systems ,the authorities of the ,director described in subsection 7b7 shall be delegated-- 7#a7 to the ,secretary of ,defense in the case of systems described in section #ceec7;e77#b72 and 7#b7 to the ,director of ,national ,intelligence in the case of systems described in #ceec7;e77#c74 4 7b7 ,deadline for guidance ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall issue the guidance required under section #ceei;,a7b7 of title #dd1 ,united ,states ,code1 as added by subsection 7a74 7c7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei the following3 #ceei;,a4 ,federal penetration testing4 4 7d7 ,sunset 7#a7 ,in general ,effective on the date that is #aj years after the date of enactment of this ,act1 subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking section #ceei;,a4 7#b7 ,clerical amendment ,effective on the date that is #aj years after the date of enactment of this ,act1 the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the item relating to section #ceei;,a4 #aab4 ,ongoing threat hunting program 7a7 ,threat hunting program 7#a7 ,in general ,not later than #edj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall establish a program to provide ongoing1 hypothesis-driven threat-hunting services on the network of each agency4 7#b7 ,plan ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish the program required under paragraph 7#a7 that describes how the ,director of the ,cybersecurity and ,infrastructure ,security ,agency plans to-- 7,a7 determine the method for collecting1 storing1 accessing1 analyzing1 and safeguarding appropriate agency data2 7,b7 provide on-premises support to agencies2 7,c7 staff threat hunting services2 7,d7 allocate available human and financial resources to implement the plan2 and 7,e7 provide input to the heads of agencies on the use of-- 7i7 more stringent standards under section #aacca7;c77#a7 of title #dj1 ,united ,states ,code2 and 7ii7 additional cybersecurity procedures under section #ceed of title #dd1 ,united ,states ,code4 7b7 ,reports ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the appropriate congressional committees-- 7#a7 not later than #cj days after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency completes the plan required under subsection 7a77#b71 a report on the plan to provide threat hunting services to agencies2 7#b7 not less than #cj days before the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services under the program under subsection 7a77#a71 a report providing any updates to the plan developed under subsection 7a77#b72 and 7#c7 not later than #a year after the date on which the ,director of the ,cybersecurity and ,infrastructure ,security ,agency begins providing threat hunting services to agencies other than the ,cybersecurity and ,infrastructure ,security ,agency1 a report describing lessons learned from providing those services4 #aac4 ,codifying vulnerability disclosure programs 7a7 ,in general ,chapter #ce of title #dd1 ,united ,states ,code1 is amended by inserting after section #ceei;,a1 as added by section #aaa of this title1 the following3 #ceei;,b4 ,federal vulnerability disclosure programs 7a7 ,purpose2 sense of ,congress 7#a7 ,purpose ,the purpose of ,federal vulnerability disclosure programs is to create a mechanism to use the expertise of the public to provide a service to ,federal agencies by identifying information system vulnerabilities4 7#b7 ,sense of ,congress ,it is the sense of ,congress that1 in implementing the requirements of this section1 the ,federal ,government should take appropriate steps to reduce real and perceived burdens in communications between agencies and security researchers4 7b7 ,definitions ,in this section3 7#a7 ,report ,the term report means a vulnerability disclosure made to an agency by a reporter4 7#b7 ,reporter ,the term reporter means an individual that submits a vulnerability report pursuant to the vulnerability disclosure process of an agency4 7c7 ,responsibilities of ,,omb 7#a7 ,limitation on legal action ,the ,director1 in consultation with the ,attorney ,general1 shall issue guidance to agencies to not recommend or pursue legal action against a reporter or an individual that conducts a security research activity that the head of the agency determines-- 7,a7 represents a good faith effort to follow the vulnerability disclosure policy of the agency developed under subsection 7e77#b72 and 7,b7 is authorized under the vulnerability disclosure policy of the agency developed under subsection 7e77#b74 7#b7 ,sharing information with ,,cisa ,the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and in consultation with the ,national ,cyber ,director1 shall issue guidance to agencies on sharing relevant information in a consistent1 automated1 and machine readable manner with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 including-- 7,a7 any valid or credible reports of newly discovered or not publicly known vulnerabilities 7including misconfigurations7 on ,federal information systems that use commercial software or services2 7,b7 information relating to vulnerability disclosure1 coordination1 or remediation activities of an agency1 particularly as those activities relate to outside organizations-- 7i7 with which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security ,agency can assist2 or 7ii7 about which the head of the agency believes the ,director of the ,cybersecurity and ,infrastructure ,security ,agency should know2 and 7,c7 any other information with respect to which the head of the agency determines helpful or necessary to involve the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#c7 ,agency vulnerability disclosure policies ,the ,director shall issue guidance to agencies on the required minimum scope of agency systems covered by the vulnerability disclosure policy of an agency required under subsection 7e77#b74 7d7 ,responsibilities of ,,cisa ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall-- 7#a7 provide support to agencies with respect to the implementation of the requirements of this section2 7#b7 develop tools1 processes1 and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section2 and 7#c7 upon a request by an agency1 assist the agency in the disclosure to vendors of newly identified vulnerabilities in vendor products and services4 7e7 ,responsibilities of agencies 7#a7 ,public information ,the head of each agency shall make publicly available1 with respect to each internet domain under the control of the agency that is not a national security system-- 7,a7 an appropriate security contact2 and 7,b7 the component of the agency that is responsible for the internet accessible services offered at the domain4 7#b7 ,vulnerability disclosure policy ,the head of each agency shall develop and make publicly available a vulnerability disclosure policy for the agency1 which shall-- 7,a7 describe-- 7i7 the scope of the systems of the agency included in the vulnerability disclosure policy2 7ii7 the type of information system testing that is authorized by the agency2 7iii7 the type of information system testing that is not authorized by the agency2 and 7iv7 the disclosure policy of the agency for sensitive information2 7,b7 with respect to a report to an agency1 describe-- 7i7 how the reporter should submit the report2 and 7ii7 if the report is not anonymous1 when the reporter should anticipate an acknowledgment of receipt of the report by the agency2 7,c7 include any other relevant information2 and 7,d7 be mature in scope and cover every internet accessible ,federal information system used or operated by that agency or on behalf of that agency4 7#c7 ,identified vulnerabilities ,the head of each agency shall incorporate any vulnerabilities reported under paragraph 7#b7 into the vulnerability management process of the agency in order to track and remediate the vulnerability4 7f7 ,congressional reporting ,not later than #ij days after the date of enactment of the ,federal ,information ,security ,modernization ,act of #bjbb1 and annually thereafter for a #c-year period1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the status of the use of vulnerability disclosure policies under this section at agencies1 including1 with respect to the guidance issued under subsection 7c77#c71 an identification of the agencies that are compliant and not compliant4 7g7 ,exemptions ,the authorities and functions of the ,director and ,director of the ,cybersecurity and ,infrastructure ,security ,agency under this section shall not apply to national security systems4 7h7 ,delegation of authority for certain systems ,the authorities of the ,director and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency described in this section shall be delegated-- 7#a7 to the ,secretary of ,defense in the case of systems described in section #ceec7;e77#b72 and 7#b7 to the ,director of ,national ,intelligence in the case of systems described in section #ceec7;e77#c74 4 7b7 ,clerical amendment ,the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by adding after the item relating to section #ceei;,a1 as added by section #aaa1 the following3 #ceei;,b4 ,federal vulnerability disclosure programs4 4 7c7 ,sunset 7#a7 ,in general ,effective on the date that is #aj years after the date of enactment of this ,act1 subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking section #ceei;,b4 7#b7 ,clerical amendment ,effective on the date that is #aj years after the date of enactment of this ,act1 the table of sections for chapter #ce of title #dd1 ,united ,states ,code1 is amended by striking the item relating to section #ceei;,b4 #aad4 ,implementing zero trust architecture 7a7 ,guidance ,not later than #ah months after the date of enactment of this ,act1 the ,director shall provide an update to the appropriate congressional committees on progress in increasing the internal defenses of agency systems1 including-- 7#a7 shifting away from trusted networks to implement security controls based on a presumption of compromise2 7#b7 implementing principles of least privilege in administering information security programs2 7#c7 limiting the ability of entities that cause incidents to move laterally through or between agency systems2 7#d7 identifying incidents quickly2 7#e7 isolating and removing unauthorized entities from agency systems as quickly as practicable1 accounting for intelligence or law enforcement purposes2 7#f7 otherwise increasing the resource costs for entities that cause incidents to be successful2 and 7#g7 a summary of the agency progress reports required under subsection 7b74 7b7 ,agency progress reports ,not later than #bgj days after the date of enactment of this ,act1 the head of each agency shall submit to the ,director a progress report on implementing an information security program based on the presumption of compromise and least privilege principles1 which shall include-- 7#a7 a description of any steps the agency has completed1 including progress toward achieving requirements issued by the ,director1 including the adoption of any models or reference architecture2 7#b7 an identification of activities that have not yet been completed and that would have the most immediate security impact2 and 7#c7 a schedule to implement any planned activities4 #aae4 ,automation reports 7a7 ,,omb report ,not later than #ahj days after the date of enactment of this ,act1 the ,director shall provide to the appropriate congressional committees an update on the use of automation under paragraphs 7#a71 7#e77;,c71 and 7#h77;,b7 of section #ceed7;b7 of title #dd1 ,united ,states ,code4 7b7 ,,gao report ,not later than #a year after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall perform a study on the use of automation and machine readable data across the ,federal ,government for cybersecurity purposes1 including the automated updating of cybersecurity tools1 sensors1 or processes by agencies4 #aaf4 ,extension of ,federal acquisition security council and software inventory 7a7 ,extension ,section #acbh of title #da1 ,united ,states ,code1 is amended by striking the date that and all that follows and inserting ,december #ca1 #bjbf44 7b7 ,requirement ,subsection #acbf7;b7 of title #da1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#e71 by striking and at the end2 7#b7 by redesignating paragraph 7#f7 as paragraph 7#g72 and 7#c7 by inserting after paragraph 7#e7 the following3 7#f7 maintaining an up-to-date and accurate inventory of software in use by the agency and1 if available and applicable1 the components of such software1 that can be communicated at the request of the ,federal ,acquisition ,security ,council1 the ,national ,cyber ,director1 or the ,secretary of ,homeland ,security1 acting through the ,director of ,cybersecurity and ,infrastructure ,security ,agency2 and 4 #aag4 ,council of the ,inspectors ,general on ,integrity and ,efficiency dashboard 7a7 ,dashboard required ,section #aa7;e77#b7 of the ,inspector ,general ,act of #aigh 7#e ,u4,s4,c4 ,app47 is amended-- 7#a7 in subparagraph 7,a71 by striking and at the end2 7#b7 by redesignating subparagraph 7,b7 as subparagraph 7,c72 and 7#c7 by inserting after subparagraph 7,a7 the following3 7,b7 that shall include a dashboard of open information security recommendations identified in the independent evaluations required by section #ceee7;a7 of title #dd1 ,united ,states ,code2 and 4 #aah4 ,quantitative cybersecurity metrics 7a7 ,definition of covered metrics ,in this section1 the term covered metrics means the metrics established1 reviewed1 and updated under section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c774 7b7 ,updating and establishing metrics ,not later than #a year after the date of enactment of this ,act1 and as appropriate thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall-- 7#a7 evaluate any covered metrics established as of the date of enactment of this ,act2 and 7#b7 as appropriate and pursuant to section #bbd7;c7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aebb7;c77 update or establish new covered metrics4 7c7 ,implementation 7#a7 ,in general ,not later than #edj days after the date of enactment of this ,act1 the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 shall promulgate guidance that requires each agency to use covered metrics to track trends in the cybersecurity and incident response capabilities of the agency4 7#b7 ,performance demonstration ,the guidance issued under paragraph 7#a7 and any subsequent guidance shall require agencies to share with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency data demonstrating the performance of the agency using the covered metrics included in the guidance4 7#c7 ,penetration tests ,on not less than #b occasions during the #b-year period following the date on which guidance is promulgated under paragraph 7#a71 the ,director shall ensure that not less than #c agencies are subjected to substantially similar penetration tests1 as determined by the ,director1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in order to validate the utility of the covered metrics4 7#d7 ,analysis capacity ,the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a capability that allows for the analysis of the covered metrics1 including cross-agency performance of agency cybersecurity and incident response capability trends4 7#e7 ,time-based metric ,with respect the first update or establishment of covered metrics required under subsection 7b77#b71 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall establish covered metrics that include not less than #a metric addressing the time it takes for agencies to identify and respond to incidents4 7d7 ,congressional reports ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director1 shall submit to the appropriate congressional committees a report on the utility and use of the covered metrics4 #aai4 ,establishment of risk-based budget model 7a7 ,definitions ,in this section3 7#a7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs and the ,committee on ,appropriations of the ,senate2 and 7,b7 the ,committee on ,oversight and ,reform1 the ,committee on ,homeland ,security1 and the ,committee on ,appropriations of the ,house of ,representatives4 7#b7 ,covered agency ,the term covered agency has the meaning given the term executive agency in section #acc of title #da1 ,united ,states ,code4 7#c7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#d7 ,information technology ,the term information technology-- 7,a7 has the meaning given the term in section #aaaja of title #dj1 ,united ,states ,code2 and 7,b7 includes the hardware and software systems of a ,federal agency that monitor and control physical equipment and processes of the ,federal agency4 7#e7 ,risk-based budget ,the term risk-based budget means a budget-- 7,a7 developed by identifying and prioritizing cybersecurity risks and vulnerabilities1 including impact on agency operations in the case of a cyber attack1 through analysis of cyber threat intelligence1 incident data1 and tactics1 techniques1 procedures1 and capabilities of cyber threats2 and 7,b7 that allocates resources based on the risks identified and prioritized under subparagraph 7,a74 7b7 ,establishment of risk-based budget model 7#a7 ,in general 7,a7 ,model ,not later than #a year after the first publication of the budget submitted by the ,president under section #aaje of title #ca1 ,united ,states ,code1 following the date of enactment of this ,act1 the ,director1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,cyber ,director and in coordination with the ,director of the ,national ,institute of ,standards and ,technology1 shall develop a standard model for informing a risk-based budget for cybersecurity spending4 7,b7 ,responsibility of director ,section #ceec7;a7 of title #dd1 ,united ,states ,code1 as amended by section #ajc of this title1 is further amended by inserting after paragraph 7#f7 the following3 7#g7 developing a standard risk-based budget model to inform ,federal agency cybersecurity budget development2 and 4 7,c7 ,contents of model ,the model required to be developed under subparagraph 7,a7 shall utilize appropriate information to evaluate risk1 including1 as determined appropriate by the ,director-- 7i7 ,federal and non-,federal cyber threat intelligence products1 where available1 to identify threats1 vulnerabilities1 and risks2 7ii7 analysis of the impact of agency operations of compromise of systems1 including the interconnectivity to other agency systems and the operations of other agencies2 and 7iii7 to the greatest extent practicable1 analysis of where resources should be allocated to have the greatest impact on mitigating current and future threats and current and future cybersecurity capabilities4 7,d7 ,use of model ,the model required to be developed under subparagraph 7,a7 shall be used to-- 7i7 inform acquisition and sustainment of-- 7,i7 information technology and cybersecurity tools2 7,,ii7 information technology and cybersecurity architectures2 7,,iii7 information technology and cybersecurity personnel2 and 7,,iv7 cybersecurity and information technology concepts of operations2 and 7ii7 evaluate and inform ,government-wide cybersecurity programs4 7,e7 ,model variation ,the ,director may develop multiple models under subparagraph 7,a7 based on different agency characteristics1 such as size or cybersecurity maturity4 7,f7 ,required updates ,not less frequently than once every #c years1 the ,director shall review1 and update as necessary1 the model required to be developed under subparagraph 7,a74 7,g7 ,publication ,not earlier than #e years after the date on which the model developed under subparagraph 7,a7 is completed1 the ,director shall1 taking into account any classified or sensitive information1 publish the model1 and any updates necessary under subparagraph 7,f71 on the public website of the ,office of ,management and ,budget4 7,h7 ,reports ,not later than #b years after the first publication of the budget submitted by the ,president under section #aaje of title #ca1 ,united ,states ,code1 following the date of enactment of this ,act1 and annually thereafter for each of the #b following fiscal years or until the date on which the model required to be developed under subparagraph 7,a7 is completed1 whichever is sooner1 the ,director shall submit to the appropriate congressional committees a report on the development of the model4 7#b7 ,phased implementation of risk-based budget model 7,a7 ,initial phase 7i7 ,in general ,not later than #b years after the date on which the model developed under paragraph 7#a7 is completed1 the ,director shall require not less than #e covered agencies to use the model to inform the development of the annual cybersecurity and information technology budget requests of those covered agencies4 7ii7 ,briefing ,not later than #a year after the date on which the covered agencies selected under clause 7i7 begin using the model developed under paragraph 7#a71 the ,director shall provide to the appropriate congressional committees a briefing on implementation of risk-based budgeting for cybersecurity spending1 an assessment of agency implementation1 and an evaluation of whether the risk-based budget helps to mitigate cybersecurity vulnerabilities4 7,b7 ,full deployment ,not later than #e years after the date on which the model developed under paragraph 7#a7 is completed1 the head of each covered agency shall use the model1 or any updated model pursuant to paragraph 7#a77;,f71 to the greatest extent practicable1 to inform the development of the annual cybersecurity and information technology budget requests of the covered agency4 7,c7 ,agency performance plans 7i7 ,amendment ,section #ceed7;d77#b7 of title #dd1 ,united ,states ,code1 is amended by inserting and the risk-based budget model required under section #ceec7;a77#g7 after paragraph 7#a74 7ii7 ,effective date ,the amendment made by clause 7i7 shall take effect on the date that is #e years after the date on which the model developed under paragraph 7#a7 is completed4 7#c7 ,verification 7,a7 ,in general ,section #aaje7;a77#ce77;,a77i7 of title #ca1 ,united ,states ,code1 is amended-- 7i7 in the matter preceding subclause 7,i71 by striking by agency1 and by initiative area 7as determined by the administration7 and inserting and by agency2 7ii7 in subclause 7,,iii71 by striking and at the end2 and 7iii7 by adding at the end the following3 7,v7 a validation that the budgets submitted were informed by using a risk-based methodology2 and 7,,vi7 a report on the progress of each agency on closing recommendations identified under the independent evaluation required by section #ceee7;a77#a7 of title #dd4 4 7,b7 ,effective date ,the amendments made by subparagraph 7,a7 shall take effect on the date that is #e years after the date on which the model developed under paragraph 7#a7 is completed4 7#d7 ,reports 7,a7 ,independent evaluation ,section #ceee7;a77#b7 of title #dd1 ,united ,states ,code1 is amended-- 7i7 in subparagraph 7,b71 by striking and at the end2 7ii7 in subparagraph 7,c71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,d7 an assessment of how the agency was informed by the risk-based budget model required under section #ceec7;a77#g7 and an evaluation of whether the model mitigates agency cyber vulnerabilities4 4 7,b7 ,assessment 7i7 ,amendment ,section #ceec7;c7 of title #dd1 ,united ,states ,code1 as amended by section #ajc of this title1 is further amended by inserting after paragraph 7#e7 the following3 7#f7 an assessment of-- 7,a7 ,federal agency utilization of the model required under subsection 7a77#g72 and 7,b7 whether the model mitigates the cyber vulnerabilities of the ,federal ,government4 4 7ii7 ,effective date ,the amendment made by clause 7i7 shall take effect on the date that is #e years after the date on which the model developed under paragraph 7#a7 is completed4 7#e7 ,,gao report ,not later than #c years after the date on which the first budget of the ,president is submitted to ,congress containing the validation required under section #aaje7;a77#ce77;,a77i77,v7 of title #ca1 ,united ,states ,code1 as amended by paragraph 7#c71 the ,comptroller ,general of the ,united ,states shall submit to the appropriate congressional committees a report that includes-- 7,a7 an evaluation of the success of covered agencies in utilizing the risk-based budget model2 7,b7 an evaluation of the success of covered agencies in implementing risk-based budgets2 7,c7 an evaluation of whether the risk-based budgets developed by covered agencies are effective at informing ,federal ,government-wide cybersecurity programs2 and 7,d7 any other information relating to risk-based budgets the ,comptroller ,general determines appropriate4 #abj4 ,active cyber defensive study 7a7 ,definition ,in this section1 the term active defense technique-- 7#a7 means an action taken on the systems of an entity to increase the security of information on the network of an agency by misleading an adversary2 and 7#b7 includes a honeypot1 deception1 or purposefully feeding false or misleading data to an adversary when the adversary is on the systems of the entity4 7b7 ,study ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in coordination with the ,director and the ,national ,cyber ,director1 shall perform a study on the use of active defense techniques to enhance the security of agencies1 which shall include-- 7#a7 a review of legal restrictions on the use of different active cyber defense techniques in ,federal environments1 in consultation with the ,department of ,justice2 7#b7 an evaluation of-- 7,a7 the efficacy of a selection of active defense techniques determined by the ,director of the ,cybersecurity and ,infrastructure ,security ,agency2 and 7,b7 factors that impact the efficacy of the active defense techniques evaluated under subparagraph 7,a72 7#c7 recommendations on safeguards and procedures that shall be established to require that active defense techniques are adequately coordinated to ensure that active defense techniques do not impede agency operations and mission delivery1 threat response efforts1 criminal investigations1 and national security activities1 including intelligence collection2 and 7#d7 the development of a framework for the use of different active defense techniques by agencies4 #aba4 ,security operations center as a service pilot 7a7 ,purpose ,the purpose of this section is for the ,cybersecurity and ,infrastructure ,security ,agency to run a security operation center on behalf of another agency1 alleviating the need to duplicate this function at every agency1 and empowering a greater centralized cybersecurity capability4 7b7 ,plan ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall develop a plan to establish a centralized ,federal security operations center shared service offering within the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,contents ,the plan required under subsection 7b7 shall include considerations for-- 7#a7 collecting1 organizing1 and analyzing agency information system data in real time2 7#b7 staffing and resources2 and 7#c7 appropriate interagency agreements1 concepts of operations1 and governance plans4 7d7 ,pilot program 7#a7 ,in general ,not later than #ahj days after the date on which the plan required under subsection 7b7 is developed1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 shall enter into a #a-year agreement with not less than #b agencies to offer a security operations center as a shared service4 7#b7 ,additional agreements ,after the date on which the briefing required under subsection 7e77#a7 is provided1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 in consultation with the ,director1 may enter into additional #a-year agreements described in paragraph 7#a7 with agencies4 7e7 ,briefing and report 7#a7 ,briefing ,not later than #bgj days after the date of enactment of this ,act1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a briefing on the parameters of any #a-year agreements entered into under subsection 7d77#a74 7#b7 ,report ,not later than #ij days after the date on which the first #a-year agreement entered into under subsection 7d7 expires1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security and the ,committee on ,oversight and ,reform of the ,house of ,representatives a report on-- 7,a7 the agreement2 and 7,b7 any additional agreements entered into with agencies under subsection 7d74 #abb4 ,extension of ,chief ,data ,officer ,council ,section #cebj;,a7e77#b7 of title #dd1 ,united ,states ,code1 is amended by striking upon the expiration of the #b-year period that begins on the date the ,comptroller ,general submits the report under paragraph 7#a7 to ,congress and inserting ,january #ca1 #bjcj4 ,,ii ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb #bja4 ,short title ,this title may be cited as the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb4 #bjb4 ,definitions ,in this title3 7#a7 ,covered cyber incident2 covered entity2 cyber incident2 information system2 ransom payment2 ransomware attack2 security vulnerability ,the terms covered cyber incident1 covered entity1 cyber incident1 information system1 ransom payment1 ransomware attack1 and security vulnerability have the meanings given those terms in section #bbdj of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title4 7#b7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 #bjc4 ,cyber incident reporting 7a7 ,cyber incident reporting ,title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7#a7 in section #bbji7;c7 7#f ,u4,s4,c4 #fei7;c77-- 7,a7 in paragraph 7#aa71 by striking 2 and and inserting a semicolon2 7,b7 in paragraph 7#ab71 by striking the period at the end and inserting 2 and2 and 7,c7 by adding at the end the following3 7#ac7 receiving1 aggregating1 and analyzing reports related to covered cyber incidents 7as defined in section #bbdj7 submitted by covered entities 7as defined in section #bbdj7 and reports related to ransom payments 7as defined in section #bbdj7 submitted by covered entities 7as defined in section #bbdj7 in furtherance of the activities specified in sections #bbjb7;e71 #bbjc1 and #bbda1 this subsection1 and any other authorized activity of the ,director1 to enhance the situational awareness of cybersecurity threats across critical infrastructure sectors4 2 and 7#b7 by adding at the end the following3 ,d ,cyber ,incident ,reporting #bbdj4 ,definitions ,in this subtitle3 7#a7 ,center ,the term ,center means the center established under section #bbji4 7#b7 ,cloud service provider ,the term cloud service provider means an entity offering products or services related to cloud computing1 as defined by the ,national ,institute of ,standards and ,technology in ,,nist ,special ,publication #hjj-ade and any amendatory or superseding document relating thereto4 7#c7 ,council ,the term ,council means the ,cyber ,incident ,reporting ,council described in section #bbdf4 7#d7 ,covered cyber incident ,the term covered cyber incident means a substantial cyber incident experienced by a covered entity that satisfies the definition and criteria established by the ,director in the final rule issued pursuant to section #bbdb7;b74 7#e7 ,covered entity ,the term covered entity means an entity in a critical infrastructure sector1 as defined in ,presidential ,policy ,directive #ba1 that satisfies the definition established by the ,director in the final rule issued pursuant to section #bbdb7;b74 7#f7 ,cyber incident ,the term cyber incident-- 7,a7 has the meaning given the term incident in section #bbji2 and 7,b7 does not include an occurrence that imminently1 but not actually1 jeopardizes-- 7i7 information on information systems2 or 7ii7 information systems4 7#g7 ,cyber threat ,the term cyber threat has the meaning given the term cybersecurity threat in section #bbja4 7#h7 ,cyber threat indicator2 cybersecurity purpose2 defensive measure2 ,federal entity2 security vulnerability ,the terms cyber threat indicator1 cybersecurity purpose1 defensive measure1 ,federal entity1 and security vulnerability have the meanings given those terms in section #ajb of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#i7 ,incident2 sharing ,the terms incident and sharing have the meanings given those terms in section #bbji4 7#aj7 ,information ,sharing and ,analysis ,organization ,the term ,information ,sharing and ,analysis ,organization has the meaning given the term in section #bbbb4 7#aa7 ,information system ,the term information system-- 7,a7 has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code2 and 7,b7 includes industrial control systems1 such as supervisory control and data acquisition systems1 distributed control systems1 and programmable logic controllers4 7#ab7 ,managed service provider ,the term managed service provider means an entity that delivers services1 such as network1 application1 infrastructure1 or security services1 via ongoing and regular support and active administration on the premises of a customer1 in the data center of the entity 7such as hosting71 or in a third party data center4 7#ac7 ,ransom payment ,the term ransom payment means the transmission of any money or other property or asset1 including virtual currency1 or any portion thereof1 which has at any time been delivered as ransom in connection with a ransomware attack4 7#ad7 ,ransomware attack ,the term ransomware attack-- 7,a7 means an incident that includes the use or threat of use of unauthorized or malicious code on an information system1 or the use or threat of use of another digital mechanism such as a denial of service attack1 to interrupt or disrupt the operations of an information system or compromise the confidentiality1 availability1 or integrity of electronic data stored on1 processed by1 or transiting an information system to extort a demand for a ransom payment2 and 7,b7 does not include any such event where the demand for payment is-- 7i7 not genuine2 or 7ii7 made in good faith by an entity in response to a specific request by the owner or operator of the information system4 7#ae7 ,sector ,risk ,management ,agency ,the term ,sector ,risk ,management ,agency has the meaning given the term in section #bbja4 7#af7 ,significant cyber incident ,the term significant cyber incident means a cyber incident1 or a group of related cyber incidents1 that the ,secretary determines is likely to result in demonstrable harm to the national security interests1 foreign relations1 or economy of the ,united ,states or to the public confidence1 civil liberties1 or public health and safety of the people of the ,united ,states4 7#ag7 ,supply chain compromise ,the term supply chain compromise means an incident within the supply chain of an information system that an adversary can leverage or does leverage to jeopardize the confidentiality1 integrity1 or availability of the information system or the information the system processes1 stores1 or transmits1 and can occur at any point during the life cycle4 7#ah7 ,virtual currency ,the term virtual currency means the digital representation of value that functions as a medium of exchange1 a unit of account1 or a store of value4 7#ai7 ,virtual currency address ,the term virtual currency address means a unique public cryptographic key identifying the location to which a virtual currency payment can be made4 #bbda4 ,cyber incident review 7a7 ,activities ,the ,center shall-- 7#a7 receive1 aggregate1 analyze1 and secure1 using processes consistent with the processes developed pursuant to the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq47 reports from covered entities related to a covered cyber incident to assess the effectiveness of security controls1 identify tactics1 techniques1 and procedures adversaries use to overcome those controls and other cybersecurity purposes1 including to assess potential impact of cyber incidents on public health and safety and to enhance situational awareness of cyber threats across critical infrastructure sectors2 7#b7 coordinate and share information with appropriate ,federal departments and agencies to identify and track ransom payments1 including those utilizing virtual currencies2 7#c7 leverage information gathered about cyber incidents to-- 7,a7 enhance the quality and effectiveness of information sharing and coordination efforts with appropriate entities1 including agencies1 sector coordinating councils1 ,information ,sharing and ,analysis ,organizations1 ,state1 local1 ,tribal1 and territorial governments1 technology providers1 critical infrastructure owners and operators1 cybersecurity and cyber incident response firms1 and security researchers2 and 7,b7 provide appropriate entities1 including sector coordinating councils1 ,information ,sharing and ,analysis ,organizations1 ,state1 local1 ,tribal1 and territorial governments1 technology providers1 cybersecurity and cyber incident response firms1 and security researchers1 with timely1 actionable1 and anonymized reports of cyber incident campaigns and trends1 including1 to the maximum extent practicable1 related contextual information1 cyber threat indicators1 and defensive measures1 pursuant to section #bbde2 7#d7 establish mechanisms to receive feedback from stakeholders on how the ,agency can most effectively receive covered cyber incident reports1 ransom payment reports1 and other voluntarily provided information1 and how the ,agency can most effectively support private sector cybersecurity2 7#e7 facilitate the timely sharing1 on a voluntary basis1 between relevant critical infrastructure owners and operators of information relating to covered cyber incidents and ransom payments1 particularly with respect to ongoing cyber threats or security vulnerabilities and identify and disseminate ways to prevent or mitigate similar cyber incidents in the future2 7#f7 for a covered cyber incident1 including a ransomware attack1 that also satisfies the definition of a significant cyber incident1 or is part of a group of related cyber incidents that together satisfy such definition1 conduct a review of the details surrounding the covered cyber incident or group of those incidents and identify and disseminate ways to prevent or mitigate similar incidents in the future2 7#g7 with respect to covered cyber incident reports under section #bbdb7;a7 and #bbdc involving an ongoing cyber threat or security vulnerability1 immediately review those reports for cyber threat indicators that can be anonymized and disseminated1 with defensive measures1 to appropriate stakeholders1 in coordination with other divisions within the ,agency1 as appropriate2 7#h7 publish quarterly unclassified1 public reports that describe aggregated1 anonymized observations1 findings1 and recommendations based on covered cyber incident reports1 which may be based on the unclassified information contained in the briefings required under subsection 7c72 7#i7 proactively identify opportunities1 consistent with the protections in section #bbde1 to leverage and utilize data on cyber incidents in a manner that enables and strengthens cybersecurity research carried out by academic institutions and other private sector organizations1 to the greatest extent practicable2 and 7#aj7 in accordance with section #bbde and subsection 7b7 of this section1 as soon as possible but not later than #bd hours after receiving a covered cyber incident report1 ransom payment report1 voluntarily submitted information pursuant to section #bbdc1 or information received pursuant to a request for information or subpoena under section #bbdd1 make available the information to appropriate ,sector ,risk ,management ,agencies and other appropriate ,federal agencies4 7b7 ,interagency sharing ,the ,president or a designee of the ,president-- 7#a7 may establish a specific time requirement for sharing information under subsection 7a77#aa72 and 7#b7 shall determine the appropriate ,federal agencies under subsection 7a77#aa74 7c7 ,periodic briefing ,not later than #fj days after the effective date of the final rule required under section #bbdb7;b71 and on the first day of each month thereafter1 the ,director1 in consultation with the ,national ,cyber ,director1 the ,attorney ,general1 and the ,director of ,national ,intelligence1 shall provide to the majority leader of the ,senate1 the minority leader of the ,senate1 the ,speaker of the ,house of ,representatives1 the minority leader of the ,house of ,representatives1 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate1 and the ,committee on ,homeland ,security of the ,house of ,representatives a briefing that characterizes the national cyber threat landscape1 including the threat facing ,federal agencies and covered entities1 and applicable intelligence and law enforcement information1 covered cyber incidents1 and ransomware attacks1 as of the date of the briefing1 which shall-- 7#a7 include the total number of reports submitted under sections #bbdb and #bbdc during the preceding month1 including a breakdown of required and voluntary reports2 7#b7 include any identified trends in covered cyber incidents and ransomware attacks over the course of the preceding month and as compared to previous reports1 including any trends related to the information collected in the reports submitted under sections #bbdb and #bbdc1 including-- 7,a7 the infrastructure1 tactics1 and techniques malicious cyber actors commonly use2 and 7,b7 intelligence gaps that have impeded1 or currently are impeding1 the ability to counter covered cyber incidents and ransomware threats2 7#c7 include a summary of the known uses of the information in reports submitted under sections #bbdb and #bbdc2 and 7#d7 include an unclassified portion1 but may include a classified component4 #bbdb4 ,required reporting of certain cyber incidents 7a7 ,in general 7#a7 ,covered cyber incident reports 7,a7 ,in general ,a covered entity that experiences a covered cyber incident shall report the covered cyber incident to the ,agency not later than #gb hours after the covered entity reasonably believes that the covered cyber incident has occurred4 7,b7 ,limitation ,the ,director may not require reporting under subparagraph 7,a7 any earlier than #gb hours after the covered entity reasonably believes that a covered cyber incident has occurred4 7#b7 ,ransom payment reports 7,a7 ,in general ,a covered entity that makes a ransom payment as the result of a ransomware attack against the covered entity shall report the payment to the ,agency not later than #bd hours after the ransom payment has been made4 7,b7 ,application ,the requirements under subparagraph 7,a7 shall apply even if the ransomware attack is not a covered cyber incident subject to the reporting requirements under paragraph 7#a74 7#c7 ,supplemental reports ,a covered entity shall promptly submit to the ,agency an update or supplement to a previously submitted covered cyber incident report if substantial new or different information becomes available or if the covered entity makes a ransom payment after submitting a covered cyber incident report required under paragraph 7#a71 until such date that such covered entity notifies the ,agency that the covered cyber incident at issue has concluded and has been fully mitigated and resolved4 7#d7 ,preservation of information ,any covered entity subject to requirements of paragraph 7#a71 7#b71 or 7#c7 shall preserve data relevant to the covered cyber incident or ransom payment in accordance with procedures established in the final rule issued pursuant to subsection 7b74 7#e7 ,exceptions 7,a7 ,reporting of covered cyber incident with ransom payment ,if a covered entity is the victim of a covered cyber incident and makes a ransom payment prior to the #gb hour requirement under paragraph 7#a71 such that the reporting requirements under paragraphs 7#a7 and 7#b7 both apply1 the covered entity may submit a single report to satisfy the requirements of both paragraphs in accordance with procedures established in the final rule issued pursuant to subsection 7b74 7,b7 ,substantially similar reported information 7i7 ,in general ,subject to the limitation described in clause 7ii71 where the ,agency has an agreement in place that satisfies the requirements of section #d7;a7 of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb1 the requirements under paragraphs 7#a71 7#b71 and 7#c7 shall not apply to a covered entity required by law1 regulation1 or contract to report substantially similar information to another ,federal agency within a substantially similar timeframe4 7ii7 ,limitation ,the exemption in clause 7i7 shall take effect with respect to a covered entity once an agency agreement and sharing mechanism is in place between the ,agency and the respective ,federal agency1 pursuant to section #d7;a7 of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb4 7iii7 ,rules of construction ,nothing in this paragraph shall be construed to-- 7,i7 exempt a covered entity from the reporting requirements under paragraph 7#c7 unless the supplemental report also meets the requirements of clauses 7i7 and 7ii7 of this paragraph2 7,,ii7 prevent the ,agency from contacting an entity submitting information to another ,federal agency that is provided to the ,agency pursuant to section #d of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb2 or 7,,iii7 prevent an entity from communicating with the ,agency4 7,c7 ,domain name system ,the requirements under paragraphs 7#a71 7#b7 and 7#c7 shall not apply to a covered entity or the functions of a covered entity that the ,director determines constitute critical infrastructure owned1 operated1 or governed by multi-stakeholder organizations that develop1 implement1 and enforce policies concerning the ,domain ,name ,system1 such as the ,internet ,corporation for ,assigned ,names and ,numbers or the ,internet ,assigned ,numbers ,authority4 7#f7 ,manner1 timing1 and form of reports ,reports made under paragraphs 7#a71 7#b71 and 7#c7 shall be made in the manner and form1 and within the time period in the case of reports made under paragraph 7#c71 prescribed in the final rule issued pursuant to subsection 7b74 7#g7 ,effective date ,paragraphs 7#a7 through 7#d7 shall take effect on the dates prescribed in the final rule issued pursuant to subsection 7b74 7b7 ,rulemaking 7#a7 ,notice of proposed rulemaking ,not later than #bd months after the date of enactment of this section1 the ,director1 in consultation with ,sector ,risk ,management ,agencies1 the ,department of ,justice1 and other ,federal agencies1 shall publish in the ,federal ,register a notice of proposed rulemaking to implement subsection 7a74 7#b7 ,final rule ,not later than #ah months after publication of the notice of proposed rulemaking under paragraph 7#a71 the ,director shall issue a final rule to implement subsection 7a74 7#c7 ,subsequent rulemakings 7,a7 ,in general ,the ,director is authorized to issue regulations to amend or revise the final rule issued pursuant to paragraph 7#b74 7,b7 ,procedures ,any subsequent rules issued under subparagraph 7,a7 shall comply with the requirements under chapter #e of title #e1 ,united ,states ,code1 including the issuance of a notice of proposed rulemaking under section #eec of such title4 7c7 ,elements ,the final rule issued pursuant to subsection 7b7 shall be composed of the following elements3 7#a7 ,a clear description of the types of entities that constitute covered entities1 based on-- 7,a7 the consequences that disruption to or compromise of such an entity could cause to national security1 economic security1 or public health and safety2 7,b7 the likelihood that such an entity may be targeted by a malicious cyber actor1 including a foreign country2 and 7,c7 the extent to which damage1 disruption1 or unauthorized access to such an entity1 including the accessing of sensitive cybersecurity vulnerability information or penetration testing tools or techniques1 will likely enable the disruption of the reliable operation of critical infrastructure4 7#b7 ,a clear description of the types of substantial cyber incidents that constitute covered cyber incidents1 which shall-- 7,a7 at a minimum1 require the occurrence of-- 7i7 a cyber incident that leads to substantial loss of confidentiality1 integrity1 or availability of such information system or network1 or a serious impact on the safety and resiliency of operational systems and processes2 7ii7 a disruption of business or industrial operations1 including due to a denial of service attack1 ransomware attack1 or exploitation of a zero day vulnerability1 against 7,i7 an information system or network2 or 7,,ii7 an operational technology system or process2 or 7iii7 unauthorized access or disruption of business or industrial operations due to loss of service facilitated through1 or caused by1 a compromise of a cloud service provider1 managed service provider1 or other third-party data hosting provider or by a supply chain compromise2 7,b7 consider-- 7i7 the sophistication or novelty of the tactics used to perpetrate such a cyber incident1 as well as the type1 volume1 and sensitivity of the data at issue2 7ii7 the number of individuals directly or indirectly affected or potentially affected by such a cyber incident2 and 7iii7 potential impacts on industrial control systems1 such as supervisory control and data acquisition systems1 distributed control systems1 and programmable logic controllers2 and 7,c7 exclude-- 7i7 any event where the cyber incident is perpetrated in good faith by an entity in response to a specific request by the owner or operator of the information system2 and 7ii7 the threat of disruption as extortion1 as described in section #bbdj7ad77;,a74 7#c7 ,a requirement that1 if a covered cyber incident or a ransom payment occurs following an exempted threat described in paragraph 7#b77;,c77ii71 the covered entity shall comply with the requirements in this subtitle in reporting the covered cyber incident or ransom payment4 7#d7 ,a clear description of the specific required contents of a report pursuant to subsection 7a77#a71 which shall include the following information1 to the extent applicable and available1 with respect to a covered cyber incident3 7,a7 ,a description of the covered cyber incident1 including-- 7i7 identification and a description of the function of the affected information systems1 networks1 or devices that were1 or are reasonably believed to have been1 affected by such cyber incident2 7ii7 a description of the unauthorized access with substantial loss of confidentiality1 integrity1 or availability of the affected information system or network or disruption of business or industrial operations2 7iii7 the estimated date range of such incident2 and 7iv7 the impact to the operations of the covered entity4 7,b7 ,where applicable1 a description of the vulnerabilities exploited and the security defenses that were in place1 as well as the tactics1 techniques1 and procedures used to perpetrate the covered cyber incident4 7,c7 ,where applicable1 any identifying or contact information related to each actor reasonably believed to be responsible for such cyber incident4 7,d7 ,where applicable1 identification of the category or categories of information that were1 or are reasonably believed to have been1 accessed or acquired by an unauthorized person4 7,e7 ,the name and other information that clearly identifies the covered entity impacted by the covered cyber incident1 including1 as applicable1 the ,state of incorporation or formation of the covered entity1 trade names1 legal names1 or other identifiers4 7,f7 ,contact information1 such as telephone number or electronic mail address1 that the ,agency may use to contact the covered entity or an authorized agent of such covered entity1 or1 where applicable1 the service provider of such covered entity acting with the express permission of1 and at the direction of1 the covered entity to assist with compliance with the requirements of this subtitle4 7#e7 ,a clear description of the specific required contents of a report pursuant to subsection 7a77#b71 which shall be the following information1 to the extent applicable and available1 with respect to a ransom payment3 7,a7 ,a description of the ransomware attack1 including the estimated date range of the attack4 7,b7 ,where applicable1 a description of the vulnerabilities1 tactics1 techniques1 and procedures used to perpetrate the ransomware attack4 7,c7 ,where applicable1 any identifying or contact information related to the actor or actors reasonably believed to be responsible for the ransomware attack4 7,d7 ,the name and other information that clearly identifies the covered entity that made the ransom payment or on whose behalf the payment was made4 7,e7 ,contact information1 such as telephone number or electronic mail address1 that the ,agency may use to contact the covered entity that made the ransom payment or an authorized agent of such covered entity1 or1 where applicable1 the service provider of such covered entity acting with the express permission of1 and at the direction of1 that covered entity to assist with compliance with the requirements of this subtitle4 7,f7 ,the date of the ransom payment4 7,g7 ,the ransom payment demand1 including the type of virtual currency or other commodity requested1 if applicable4 7,h7 ,the ransom payment instructions1 including information regarding where to send the payment1 such as the virtual currency address or physical address the funds were requested to be sent to1 if applicable4 7,i7 ,the amount of the ransom payment4 7#f7 ,a clear description of the types of data required to be preserved pursuant to subsection 7a77#d71 the period of time for which the data is required to be preserved1 and allowable uses1 processes1 and procedures4 7#g7 ,deadlines and criteria for submitting supplemental reports to the ,agency required under subsection 7a77#c71 which shall-- 7,a7 be established by the ,director in consultation with the ,council2 7,b7 consider any existing regulatory reporting requirements similar in scope1 purpose1 and timing to the reporting requirements to which such a covered entity may also be subject1 and make efforts to harmonize the timing and contents of any such reports to the maximum extent practicable2 7,c7 balance the need for situational awareness with the ability of the covered entity to conduct cyber incident response and investigations2 and 7,d7 provide a clear description of what constitutes substantial new or different information4 7#h7 ,procedures for-- 7,a7 entities1 including third parties pursuant to subsection 7d77#a71 to submit reports required by paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a71 including the manner and form thereof1 which shall include1 at a minimum1 a concise1 user-friendly web-based form2 7,b7 the ,agency to carry out-- 7i7 the enforcement provisions of section #bbdd1 including with respect to the issuance1 service1 withdrawal1 referral process1 and enforcement of subpoenas1 appeals and due process procedures2 7ii7 other available enforcement mechanisms including acquisition1 suspension and debarment procedures2 and 7iii7 other aspects of noncompliance2 7,c7 implementing the exceptions provided in subsection 7a77#e72 and 7,d7 protecting privacy and civil liberties consistent with processes adopted pursuant to section #aje7;b7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7;b77 and anonymizing and safeguarding1 or no longer retaining1 information received and disclosed through covered cyber incident reports and ransom payment reports that is known to be personal information of a specific individual or information that identifies a specific individual that is not directly related to a cybersecurity threat4 7#i7 ,other procedural measures directly necessary to implement subsection 7a74 7d7 ,third party report submission and ransom payment 7#a7 ,report submission ,a covered entity that is required to submit a covered cyber incident report or a ransom payment report may use a third party1 such as an incident response company1 insurance provider1 service provider1 ,information ,sharing and ,analysis ,organization1 or law firm1 to submit the required report under subsection 7a74 7#b7 ,ransom payment ,if a covered entity impacted by a ransomware attack uses a third party to make a ransom payment1 the third party shall not be required to submit a ransom payment report for itself under subsection 7a77#b74 7#c7 ,duty to report ,third-party reporting under this subparagraph does not relieve a covered entity from the duty to comply with the requirements for covered cyber incident report or ransom payment report submission4 7#d7 ,responsibility to advise ,any third party used by a covered entity that knowingly makes a ransom payment on behalf of a covered entity impacted by a ransomware attack shall advise the impacted covered entity of the responsibilities of the impacted covered entity regarding reporting ransom payments under this section4 7e7 ,outreach to covered entities 7#a7 ,in general ,the ,agency shall conduct an outreach and education campaign to inform likely covered entities1 entities that offer or advertise as a service to customers to make or facilitate ransom payments on behalf of covered entities impacted by ransomware attacks and other appropriate entities of the requirements of paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a74 7#b7 ,elements ,the outreach and education campaign under paragraph 7#a7 shall include the following3 7,a7 ,an overview of the final rule issued pursuant to subsection 7b74 7,b7 ,an overview of mechanisms to submit to the ,agency covered cyber incident reports1 ransom payment reports1 and information relating to the disclosure1 retention1 and use of covered cyber incident reports and ransom payment reports under this section4 7,c7 ,an overview of the protections afforded to covered entities for complying with the requirements under paragraphs 7#a71 7#b71 and 7#c7 of subsection 7a74 7,d7 ,an overview of the steps taken under section #bbdd when a covered entity is not in compliance with the reporting requirements under subsection 7a74 7,e7 ,specific outreach to cybersecurity vendors1 cyber incident response providers1 cybersecurity insurance entities1 and other entities that may support covered entities4 7,f7 ,an overview of the privacy and civil liberties requirements in this subtitle4 7#c7 ,coordination ,in conducting the outreach and education campaign required under paragraph 7#a71 the ,agency may coordinate with-- 7,a7 the ,critical ,infrastructure ,partnership ,advisory ,council established under section #hga2 7,b7 ,information ,sharing and ,analysis ,organizations2 7,c7 trade associations2 7,d7 information sharing and analysis centers2 7,e7 sector coordinating councils2 and 7,f7 any other entity as determined appropriate by the ,director4 7f7 ,exemption ,sections #cejf7;c71 #cejg1 #cejh1 and #ceji of title #dd1 ,united ,states ,code1 shall not apply to any action to carry out this section4 7g7 ,rule of construction ,nothing in this section shall affect the authorities of the ,federal ,government to implement the requirements of ,executive ,order #adjbh 7#hf ,fed4 ,reg4 #bffcc2 relating to improving the nation's cybersecurity71 including changes to the ,federal ,acquisition ,regulations and remedies to include suspension and debarment4 7h7 ,savings provision ,nothing in this section shall be construed to supersede or to abrogate1 modify1 or otherwise limit the authority that is vested in any officer or any agency of the ,united ,states ,government to regulate or take action with respect to the cybersecurity of an entity4 #bbdc4 ,voluntary reporting of other cyber incidents 7a7 ,in general ,entities may voluntarily report cyber incidents or ransom payments to the ,agency that are not required under paragraph 7#a71 7#b71 or 7#c7 of section #bbdb7;a71 but may enhance the situational awareness of cyber threats4 7b7 ,voluntary provision of additional information in required reports ,covered entities may voluntarily include in reports required under paragraph 7#a71 7#b71 or 7#c7 of section #bbdb7;a7 information that is not required to be included1 but may enhance the situational awareness of cyber threats4 7c7 ,application of protections ,the protections under section #bbde applicable to reports made under section #bbdb shall apply in the same manner and to the same extent to reports and information submitted under subsections 7a7 and 7b74 #bbdd4 ,noncompliance with required reporting 7a7 ,purpose ,in the event that a covered entity that is required to submit a report under section #bbdb7;a7 fails to comply with the requirement to report1 the ,director may obtain information about the cyber incident or ransom payment by engaging the covered entity directly to request information about the cyber incident or ransom payment1 and if the ,director is unable to obtain information through such engagement1 by issuing a subpoena to the covered entity1 pursuant to subsection 7c71 to gather information sufficient to determine whether a covered cyber incident or ransom payment has occurred4 7b7 ,initial request for information 7#a7 ,in general ,if the ,director has reason to believe1 whether through public reporting or other information in the possession of the ,federal ,government1 including through analysis performed pursuant to paragraph 7#a7 or 7#b7 of section #bbda7;a71 that a covered entity has experienced a covered cyber incident or made a ransom payment but failed to report such cyber incident or payment to the ,agency in accordance with section #bbdb7;a71 the ,director may request additional information from the covered entity to confirm whether or not a covered cyber incident or ransom payment has occurred4 7#b7 ,treatment ,information provided to the ,agency in response to a request under paragraph 7#a7 shall be treated as if it was submitted through the reporting procedures established in section #bbdb4 7c7 ,enforcement 7#a7 ,in general ,if1 after the date that is #gb hours from the date on which the ,director made the request for information in subsection 7b71 the ,director has received no response from the covered entity from which such information was requested1 or received an inadequate response1 the ,director may issue to such covered entity a subpoena to compel disclosure of information the ,director deems necessary to determine whether a covered cyber incident or ransom payment has occurred and obtain the information required to be reported pursuant to section #bbdb and any implementing regulations1 and assess potential impacts to national security1 economic security1 or public health and safety4 7#b7 ,civil action 7,a7 ,in general ,if a covered entity fails to comply with a subpoena1 the ,director may refer the matter to the ,attorney ,general to bring a civil action in a district court of the ,united ,states to enforce such subpoena4 7,b7 ,venue ,an action under this paragraph may be brought in the judicial district in which the covered entity against which the action is brought resides1 is found1 or does business4 7,c7 ,contempt of court ,a court may punish a failure to comply with a subpoena issued under this subsection as contempt of court4 7#c7 ,non-delegation ,the authority of the ,director to issue a subpoena under this subsection may not be delegated4 7#d7 ,authentication 7,a7 ,in general ,any subpoena issued electronically pursuant to this subsection shall be authenticated with a cryptographic digital signature of an authorized representative of the ,agency1 or other comparable successor technology1 that allows the ,agency to demonstrate that such subpoena was issued by the ,agency and has not been altered or modified since such issuance4 7,b7 ,invalid if not authenticated ,any subpoena issued electronically pursuant to this subsection that is not authenticated in accordance with subparagraph 7,a7 shall not be considered to be valid by the recipient of such subpoena4 7d7 ,provision of certain information to ,attorney ,general 7#a7 ,in general ,notwithstanding section #bbde7;a77#e7 and paragraph 7b77#b7 of this section1 if the ,director determines1 based on the information provided in response to a subpoena issued pursuant to subsection 7c71 that the facts relating to the cyber incident or ransom payment at issue may constitute grounds for a regulatory enforcement action or criminal prosecution1 the ,director may provide such information to the ,attorney ,general or the head of the appropriate ,federal regulatory agency1 who may use such information for a regulatory enforcement action or criminal prosecution4 7#b7 ,consultation ,the ,director may consult with the ,attorney ,general or the head of the appropriate ,federal regulatory agency when making the determination under paragraph 7#a74 7e7 ,considerations ,when determining whether to exercise the authorities provided under this section1 the ,director shall take into consideration-- 7#a7 the complexity in determining if a covered cyber incident has occurred2 and 7#b7 prior interaction with the ,agency or awareness of the covered entity of the policies and procedures of the ,agency for reporting covered cyber incidents and ransom payments4 7f7 ,exclusions ,this section shall not apply to a ,state1 local1 ,tribal1 or territorial government entity4 7g7 ,report to ,congress ,the ,director shall submit to ,congress an annual report on the number of times the ,director-- 7#a7 issued an initial request for information pursuant to subsection 7b72 7#b7 issued a subpoena pursuant to subsection 7c72 or 7#c7 referred a matter to the ,attorney ,general for a civil action pursuant to subsection 7c77#b74 7h7 ,publication of the annual report ,the ,director shall publish a version of the annual report required under subsection 7g7 on the website of the ,agency1 which shall include1 at a minimum1 the number of times the ,director-- 7#a7 issued an initial request for information pursuant to subsection 7b72 or 7#b7 issued a subpoena pursuant to subsection 7c74 7i7 ,anonymization of reports ,the ,director shall ensure any victim information contained in a report required to be published under subsection 7h7 be anonymized before the report is published4 #bbde4 ,information shared with or provided to the ,federal ,government 7a7 ,disclosure1 retention1 and use 7#a7 ,authorized activities ,information provided to the ,agency pursuant to section #bbdb or #bbdc may be disclosed to1 retained by1 and used by1 consistent with otherwise applicable provisions of ,federal law1 any ,federal agency or department1 component1 officer1 employee1 or agent of the ,federal ,government solely for-- 7,a7 a cybersecurity purpose2 7,b7 the purpose of identifying-- 7i7 a cyber threat1 including the source of the cyber threat2 or 7ii7 a security vulnerability2 7,c7 the purpose of responding to1 or otherwise preventing or mitigating1 a specific threat of death1 a specific threat of serious bodily harm1 or a specific threat of serious economic harm1 including a terrorist act or use of a weapon of mass destruction2 7,d7 the purpose of responding to1 investigating1 prosecuting1 or otherwise preventing or mitigating1 a serious threat to a minor1 including sexual exploitation and threats to physical safety2 or 7,e7 the purpose of preventing1 investigating1 disrupting1 or prosecuting an offense arising out of a cyber incident reported pursuant to section #bbdb or #bbdc or any of the offenses listed in section #aje7;d77#e77;,a77v7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,a77v774 7#b7 ,agency actions after receipt 7,a7 ,rapid1 confidential sharing of cyber threat indicators ,upon receiving a covered cyber incident or ransom payment report submitted pursuant to this section1 the ,agency shall immediately review the report to determine whether the cyber incident that is the subject of the report is connected to an ongoing cyber threat or security vulnerability and where applicable1 use such report to identify1 develop1 and rapidly disseminate to appropriate stakeholders actionable1 anonymized cyber threat indicators and defensive measures4 7,b7 ,principles for sharing security vulnerabilities ,with respect to information in a covered cyber incident or ransom payment report regarding a security vulnerability referred to in paragraph 7#a77;,b77ii71 the ,director shall develop principles that govern the timing and manner in which information relating to security vulnerabilities may be shared1 consistent with common industry best practices and ,united ,states and international standards4 7#c7 ,privacy and civil liberties ,information contained in covered cyber incident and ransom payment reports submitted to the ,agency pursuant to section #bbdb shall be retained1 used1 and disseminated1 where permissible and appropriate1 by the ,federal ,government in accordance with processes to be developed for the protection of personal information consistent with processes adopted pursuant to section #aje of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aejd7 and in a manner that protects from unauthorized use or disclosure any information that may contain-- 7,a7 personal information of a specific individual that is not directly related to a cybersecurity threat2 or 7,b7 information that identifies a specific individual that is not directly related to a cybersecurity threat4 7#d7 ,digital security ,the ,agency shall ensure that reports submitted to the ,agency pursuant to section #bbdb1 and any information contained in those reports1 are collected1 stored1 and protected at a minimum in accordance with the requirements for moderate impact ,federal information systems1 as described in ,federal ,information ,processing ,standards ,publication #aii1 or any successor document4 7#e7 ,prohibition on use of information in regulatory actions 7,a7 ,in general ,a ,federal1 ,state1 local1 or ,tribal government shall not use information about a covered cyber incident or ransom payment obtained solely through reporting directly to the ,agency in accordance with this subtitle to regulate1 including through an enforcement action1 the activities of the covered entity or entity that made a ransom payment1 unless the government entity expressly allows entities to submit reports to the ,agency to meet regulatory reporting obligations of the entity4 7,b7 ,clarification ,a report submitted to the ,agency pursuant to section #bbdb or #bbdc may1 consistent with ,federal or ,state regulatory authority specifically relating to the prevention and mitigation of cybersecurity threats to information systems1 inform the development or implementation of regulations relating to such systems4 7b7 ,protections for reporting entities and information ,reports describing covered cyber incidents or ransom payments submitted to the ,agency by entities in accordance with section #bbdb1 as well as voluntarily-submitted cyber incident reports submitted to the ,agency pursuant to section #bbdc1 shall-- 7#a7 be considered the commercial1 financial1 and proprietary information of the covered entity when so designated by the covered entity2 7#b7 be exempt from disclosure under section #eeb7;b77#c7 of title #e1 ,united ,states ,code 7commonly known as the ,freedom of ,information ,act71 as well as any provision of ,state1 ,tribal1 or local freedom of information law1 open government law1 open meetings law1 open records law1 sunshine law1 or similar law requiring disclosure of information or records2 7#c7 be considered not to constitute a waiver of any applicable privilege or protection provided by law1 including trade secret protection2 and 7#d7 not be subject to a rule of any ,federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official4 7c7 ,liability protections 7#a7 ,in general ,no cause of action shall lie or be maintained in any court by any person or entity and any such action shall be promptly dismissed for the submission of a report pursuant to section #bbdb7;a7 that is submitted in conformance with this subtitle and the rule promulgated under section #bbdb7;b71 except that this subsection shall not apply with regard to an action by the ,federal ,government pursuant to section #bbdd7;c77#b74 7#b7 ,scope ,the liability protections provided in this subsection shall only apply to or affect litigation that is solely based on the submission of a covered cyber incident report or ransom payment report to the ,agency4 7#c7 ,restrictions ,notwithstanding paragraph 7#b71 no report submitted to the ,agency pursuant to this subtitle or any communication1 document1 material1 or other record1 created for the sole purpose of preparing1 drafting1 or submitting such report1 may be received in evidence1 subject to discovery1 or otherwise used in any trial1 hearing1 or other proceeding in or before any court1 regulatory body1 or other authority of the ,united ,states1 a ,state1 or a political subdivision thereof1 provided that nothing in this subtitle shall create a defense to discovery or otherwise affect the discovery of any communication1 document1 material1 or other record not created for the sole purpose of preparing1 drafting1 or submitting such report4 7d7 ,sharing with non-,federal entities ,the ,agency shall anonymize the victim who reported the information when making information provided in reports received under section #bbdb available to critical infrastructure owners and operators and the general public4 7e7 ,stored ,communications ,act ,nothing in this subtitle shall be construed to permit or require disclosure by a provider of a remote computing service or a provider of an electronic communication service to the public of information not otherwise permitted or required to be disclosed under chapter #aba of title #ah1 ,united ,states ,code 7commonly known as the ,stored ,communications ,act74 #bbdf4 ,cyber ,incident ,reporting ,council 7a7 ,responsibility of the secretary ,the ,secretary shall lead an intergovernmental ,cyber ,incident ,reporting ,council1 in consultation with the ,director of the ,office of ,management and ,budget1 the ,attorney ,general1 the ,national ,director ,cyber ,director1 ,sector ,risk ,management ,agencies1 and other appropriate ,federal agencies1 to coordinate1 deconflict1 and harmonize ,federal incident reporting requirements1 including those issued through regulations4 7b7 ,rule of construction ,nothing in subsection 7a7 shall be construed to provide any additional regulatory authority to any ,federal entity4 4 7b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended by inserting after the items relating to subtitle ,c of title ,,xxii the following3 ,subtitle ,d--,cyber ,incident ,reporting,sec4 #bbdj4 ,definitions4,sec4 #bbda4 ,cyber ,incident ,review4,sec4 #bbdb4 ,required reporting of certain cyber incidents4,sec4 #bbdc4 ,voluntary reporting of other cyber incidents4,sec4 #bbdd4 ,noncompliance with required reporting4,sec4 #bbde4 ,information shared with or provided to the ,federal ,government4,sec4 #bbdf4 ,cyber ,incident ,reporting ,council4 4 #bjd4 ,federal sharing of incident reports 7a7 ,cyber incident reporting sharing 7#a7 ,in general ,notwithstanding any other provision of law or regulation1 any ,federal agency1 including any independent establishment 7as defined in section #ajd of title #e1 ,united ,states ,code71 that receives a report from an entity of a cyber incident1 including a ransomware attack1 shall provide the report to the ,agency as soon as possible1 but not later than #bd hours after receiving the report1 unless a shorter period is required by an agreement made between the ,department of ,homeland ,security 7including the ,cybersecurity and ,infrastructure ,security ,agency7 and the recipient ,federal agency4 ,the ,director shall share and coordinate each report pursuant to section #bbda7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title4 7#b7 ,rule of construction ,the requirements described in paragraph 7#a7 and section #bbde7;d7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 may not be construed to be a violation of any provision of law or policy that would otherwise prohibit disclosure or provision of information within the executive branch4 7#c7 ,protection of information ,the ,director shall comply with any obligations of the recipient ,federal agency described in paragraph 7#a7 to protect information1 including with respect to privacy1 confidentiality1 or information security1 if those obligations would impose greater protection requirements than this ,act or the amendments made by this ,act4 7#d7 ,effective date ,this subsection shall take effect on the effective date of the final rule issued pursuant to section #bbdb7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title4 7#e7 ,agency agreements 7,a7 ,in general ,the ,agency and any ,federal agency1 including any independent establishment 7as defined in section #ajd of title #e1 ,united ,states ,code7 that receives incident reports from entities1 including due to ransomware attacks1 shall1 as appropriate1 enter into a documented agreement to establish policies1 processes1 procedures1 and mechanisms to ensure reports are shared with the ,agency pursuant to paragraph 7#a74 7,b7 ,availability ,to the maximum extent practicable1 each documented agreement required under subparagraph 7,a7 shall be made publicly available4 7,c7 ,requirement ,the documented agreements required by subparagraph 7,a7 shall require reports be shared from ,federal agencies with the ,agency in such time as to meet the overall timeline for covered entity reporting of covered cyber incidents and ransom payments established in section #bbdb of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title4 7b7 ,harmonizing reporting requirements ,the ,secretary of ,homeland ,security1 acting through the ,director1 shall1 in consultation with the ,cyber ,incident ,reporting ,council described in section #bbdf of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 to the maximum extent practicable-- 7#a7 periodically review existing regulatory requirements1 including the information required in such reports1 to report incidents and ensure that any such reporting requirements and procedures avoid conflicting1 duplicative1 or burdensome requirements2 and 7#b7 coordinate with appropriate ,federal partners and regulatory authorities that receive reports relating to incidents to identify opportunities to streamline reporting processes1 and where feasible1 facilitate interagency agreements between such authorities to permit the sharing of such reports1 consistent with applicable law and policy1 without impacting the ability of the ,agency to gain timely situational awareness of a covered cyber incident or ransom payment4 #bje4 ,ransomware vulnerability warning pilot program 7a7 ,program ,not later than #a year after the date of enactment of this ,act1 the ,director shall establish a ransomware vulnerability warning pilot program to leverage existing authorities and technology to specifically develop processes and procedures for1 and to dedicate resources to1 identifying information systems that contain security vulnerabilities associated with common ransomware attacks1 and to notify the owners of those vulnerable systems of their security vulnerability4 7b7 ,identification of vulnerable systems ,the pilot program established under subsection 7a7 shall-- 7#a7 identify the most common security vulnerabilities utilized in ransomware attacks and mitigation techniques2 and 7#b7 utilize existing authorities to identify information systems that contain the security vulnerabilities identified in paragraph 7#a74 7c7 ,entity notification 7#a7 ,identification ,if the ,director is able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection 7b71 the ,director may notify the owner of the information system4 7#b7 ,no identification ,if the ,director is not able to identify the entity at risk that owns or operates a vulnerable information system identified in subsection 7b71 the ,director may utilize the subpoena authority pursuant to section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 to identify and notify the entity at risk pursuant to the procedures under that section4 7#c7 ,required information ,a notification made under paragraph 7#a7 shall include information on the identified security vulnerability and mitigation techniques4 7d7 ,prioritization of notifications ,to the extent practicable1 the ,director shall prioritize covered entities for identification and notification activities under the pilot program established under this section4 7e7 ,limitation on procedures ,no procedure1 notification1 or other authorities utilized in the execution of the pilot program established under subsection 7a7 shall require an owner or operator of a vulnerable information system to take any action as a result of a notice of a security vulnerability made pursuant to subsection 7c74 7f7 ,rule of construction ,nothing in this section shall be construed to provide additional authorities to the ,director to identify vulnerabilities or vulnerable systems4 7g7 ,termination ,the pilot program established under subsection 7a7 shall terminate on the date that is #d years after the date of enactment of this ,act4 #bjf4 ,ransomware threat mitigation activities 7a7 ,joint ransomware task force 7#a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director1 in consultation with the ,national ,cyber ,director1 the ,attorney ,general1 and the ,director of the ,federal ,bureau of ,investigation1 shall establish and chair the ,joint ,ransomware ,task ,force to coordinate an ongoing nationwide campaign against ransomware attacks1 and identify and pursue opportunities for international cooperation4 7#b7 ,composition ,the ,joint ,ransomware ,task ,force shall consist of participants from ,federal agencies1 as determined appropriate by the ,national ,cyber ,director in consultation with the ,secretary of ,homeland ,security4 7#c7 ,responsibilities ,the ,joint ,ransomware ,task ,force1 utilizing only existing authorities of each participating ,federal agency1 shall coordinate across the ,federal ,government the following activities3 7,a7 ,prioritization of intelligence-driven operations to disrupt specific ransomware actors4 7,b7 ,consult with relevant private sector1 ,state1 local1 ,tribal1 and territorial governments and international stakeholders to identify needs and establish mechanisms for providing input into the ,joint ,ransomware ,task ,force4 7,c7 ,identifying1 in consultation with relevant entities1 a list of highest threat ransomware entities updated on an ongoing basis1 in order to facilitate-- 7i7 prioritization for ,federal action by appropriate ,federal agencies2 and 7ii7 identify metrics for success of said actions4 7,d7 ,disrupting ransomware criminal actors1 associated infrastructure1 and their finances4 7,e7 ,facilitating coordination and collaboration between ,federal entities and relevant entities1 including the private sector1 to improve ,federal actions against ransomware threats4 7,f7 ,collection1 sharing1 and analysis of ransomware trends to inform ,federal actions4 7,g7 ,creation of after-action reports and other lessons learned from ,federal actions that identify successes and failures to improve subsequent actions4 7,h7 ,any other activities determined appropriate by the ,joint ,ransomware ,task ,force to mitigate the threat of ransomware attacks4 7b7 ,rule of construction ,nothing in this section shall be construed to provide any additional authority to any ,federal agency4 #bjg4 ,congressional reporting 7a7 ,report on stakeholder engagement ,not later than #cj days after the date on which the ,director issues the final rule under section #bbdb7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc7;b7 of this title1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report that describes how the ,director engaged stakeholders in the development of the final rule4 7b7 ,report on opportunities to strengthen security research ,not later than #a year after the date of enactment of this ,act1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report describing how the ,national ,cybersecurity and ,communications ,integration ,center established under section #bbji of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fei7 has carried out activities under section #bbda7;a77#i7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc7;a7 of this title1 by proactively identifying opportunities to use cyber incident data to inform and enable cybersecurity research within the academic and private sector4 7c7 ,report on ransomware vulnerability warning pilot program ,not later than #a year after the date of enactment of this ,act1 and annually thereafter for the duration of the pilot program established under section #bje1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report1 which may include a classified annex1 on the effectiveness of the pilot program1 which shall include a discussion of the following3 7#a7 ,the effectiveness of the notifications under section #bje7;c7 in mitigating security vulnerabilities and the threat of ransomware4 7#b7 ,identification of the most common vulnerabilities utilized in ransomware4 7#c7 ,the number of notifications issued during the preceding year4 7#d7 ,to the extent practicable1 the number of vulnerable devices or systems mitigated under the pilot program by the ,agency during the preceding year4 7d7 ,report on harmonization of reporting regulations 7#a7 ,in general ,not later than #ahj days after the date on which the ,secretary of ,homeland ,security convenes the ,cyber ,incident ,reporting ,council described in section #bbdf of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 the ,secretary of ,homeland ,security shall submit to the appropriate congressional committees a report that includes-- 7,a7 a list of duplicative ,federal cyber incident reporting requirements on covered entities2 7,b7 a description of any challenges in harmonizing the duplicative reporting requirements2 7,c7 any actions the ,director intends to take to facilitate harmonizing the duplicative reporting requirements2 and 7,d7 any proposed legislative changes necessary to address the duplicative reporting4 7#b7 ,rule of construction ,nothing in paragraph 7#a7 shall be construed to provide any additional regulatory authority to any ,federal agency4 7e7 ,,gao reports 7#a7 ,implementation of this ,act ,not later than #b years after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the implementation of this ,act and the amendments made by this ,act4 7#b7 ,exemptions to reporting ,not later than #a year after the date on which the ,director issues the final rule required under section #bbdb7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 the ,comptroller ,general of the ,united ,states shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the exemptions to reporting under paragraphs 7#b7 and 7#e7 of section #bbdb7;a7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 which shall include-- 7,a7 to the extent practicable1 an evaluation of the quantity of cyber incidents not reported to the ,federal ,government2 7,b7 an evaluation of the impact on impacted entities1 homeland security1 and the national economy due to cyber incidents1 ransomware attacks1 and ransom payments1 including a discussion on the scope of impact of cyber incidents that were not reported to the ,federal ,government2 7,c7 an evaluation of the burden1 financial and otherwise1 on entities required to report cyber incidents under this ,act1 including an analysis of entities that meet the definition of a small business concern under section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb72 and 7,d7 a description of the consequences and effects of limiting covered cyber incident and ransom payment reporting to only covered entities4 7f7 ,report on effectiveness of enforcement mechanisms ,not later than #a year after the date on which the ,director issues the final rule required under section #bbdb7;b7 of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title1 the ,director shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives a report on the effectiveness of the enforcement mechanisms within section #bbdd of the ,homeland ,security ,act of #bjjb1 as added by section #bjc of this title4 ,,iii ,federal ,secure ,cloud ,improvement and ,jobs ,act of #bjbb #cja4 ,short title ,this title may be cited as the ,federal ,secure ,cloud ,improvement and ,jobs ,act of #bjbb4 #cjb4 ,findings ,congress finds the following3 7#a7 ,ensuring that the ,federal ,government can securely leverage cloud computing products and services is key to expediting the modernization of legacy information technology systems1 increasing cybersecurity within and across departments and agencies1 and supporting the continued leadership of the ,united ,states in technology innovation and job creation4 7#b7 ,according to independent analysis1 as of calendar year #bjai1 the size of the cloud computing market had tripled since #bjjd1 enabling more than #b1jjj1jjj jobs and adding more than #bjj1jjj1jjj1jjj to the gross domestic product of the ,united ,states4 7#c7 ,the ,federal ,government1 across multiple presidential administrations and ,congresses1 has continued to support the ability of agencies to move to the cloud1 including through-- 7,a7 ,president ,barack ,obama's ,cloud ,first ,strategy2 7,b7 ,president ,donald ,trump's ,cloud ,smart ,strategy2 7,c7 the prioritization of cloud security in ,executive ,order #adjbh 7#hf ,fed4 ,reg4 #bffcc2 relating to improving the nation's cybersecurity71 which was issued by ,president ,joe ,biden2 and 7,d7 more than a decade of appropriations and authorization legislation that provides agencies with relevant authorities and appropriations to modernize on-premises information technology systems and more readily adopt cloud computing products and services4 7#d7 ,since it was created in #bjaa1 the ,federal ,risk and ,authorization ,management ,program 7referred to in this section as ,fed,r,a,m,p7 at the ,general ,services ,administration has made steady and sustained improvements in supporting the secure authorization and reuse of cloud computing products and services within the ,federal ,government1 including by reducing the costs and burdens on both agencies and cloud companies to quickly and securely enter the ,federal market4 7#e7 ,according to data from the ,general ,services ,administration1 as of the end of fiscal year #bjba1 there were #bci cloud providers with ,fed,r,a,m,p authorizations1 and those authorizations had been reused more than #b1gjj times across various agencies4 7#f7 ,providing a legislative framework for ,fed,r,a,m,p and new authorities to the ,general ,services ,administration1 the ,office of ,management and ,budget1 and ,federal agencies will-- 7,a7 improve the speed at which new cloud computing products and services can be securely authorized2 7,b7 enhance the ability of agencies to effectively evaluate ,fed,r,a,m,p authorized providers for reuse2 7,c7 reduce the costs and burdens to cloud providers seeking a ,fed,r,a,m,p authorization2 and 7,d7 provide for more robust transparency and dialogue between industry and the ,federal ,government to drive stronger adoption of secure cloud capabilities1 create jobs1 and reduce wasteful legacy information technology4 #cjc4 ,title #dd amendments 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following3 #cfjg4 ,definitions 7a7 ,in general ,except as provided under subsection 7b71 the definitions under sections #cejb and #ceeb apply to this section through section #cfaf4 7b7 ,additional definitions ,in this section through section #cfaf3 7#a7 ,administrator ,the term ,administrator means the ,administrator of ,general ,services4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,oversight and ,reform of the ,house of ,representatives4 7#c7 ,authorization to operate2 ,federal information ,the terms authorization to operate and ,federal information have the meaning given those term in ,circular ,a-#acj of the ,office of ,management and ,budget entitled ,managing ,information as a ,strategic ,resource1 or any successor document4 7#d7 ,cloud computing ,the term cloud computing has the meaning given the term in ,special ,publication #hjj-ade of the ,national ,institute of ,standards and ,technology1 or any successor document4 7#e7 ,cloud service provider ,the term cloud service provider means an entity offering cloud computing products or services to agencies4 7#f7 ,fed,r,a,m,p ,the term ,fed,r,a,m,p means the ,federal ,risk and ,authorization ,management ,program established under section #cfjh4 7#g7 ,fed,r,a,m,p authorization ,the term ,fed,r,a,m,p authorization means a certification that a cloud computing product or service has-- 7,a7 completed a ,fed,r,a,m,p authorization process1 as determined by the ,administrator2 or 7,b7 received a ,fed,r,a,m,p provisional authorization to operate1 as determined by the ,fed,r,a,m,p ,board4 7#h7 ,fedramp authorization package ,the term ,fed,r,a,m,p authorization package means the essential information that can be used by an agency to determine whether to authorize the operation of an information system or the use of a designated set of common controls for all cloud computing products and services authorized by ,fed,r,a,m,p4 7#i7 ,fed,r,a,m,p ,board ,the term ,fed,r,a,m,p ,board means the board established under section #cfaj4 7#aj7 ,independent assessment service ,the term independent assessment service means a third-party organization accredited by the ,administrator to undertake conformity assessments of cloud service providers and the products or services of cloud service providers4 7#aa7 ,secretary ,the term ,secretary means the ,secretary of ,homeland ,security4 #cfjh4 ,federal ,risk and ,authorization ,management ,program ,there is established within the ,general ,services ,administration the ,federal ,risk and ,authorization ,management ,program4 ,the ,administrator1 subject to section #cfad1 shall establish a ,government-wide program that provides a standardized1 reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies4 #cfji4 ,roles and responsibilities of the ,general ,services ,administration 7a7 ,roles and responsibilities ,the ,administrator shall-- 7#a7 in consultation with the ,secretary1 develop1 coordinate1 and implement a process to support agency review1 reuse1 and standardization1 where appropriate1 of security assessments of cloud computing products and services1 including1 as appropriate1 oversight of continuous monitoring of cloud computing products and services1 pursuant to guidance issued by the ,director pursuant to section #cfad2 7#b7 establish processes and identify criteria consistent with guidance issued by the ,director under section #cfad to make a cloud computing product or service eligible for a ,fed,r,a,m,p authorization and validate whether a cloud computing product or service has a ,fed,r,a,m,p authorization2 7#c7 develop and publish templates1 best practices1 technical assistance1 and other materials to support the authorization of cloud computing products and services and increase the speed1 effectiveness1 and transparency of the authorization process1 consistent with standards and guidelines established by the ,director of the ,national ,institute of ,standards and ,technology and relevant statutes2 7#d7 establish and update guidance on the boundaries of ,fed,r,a,m,p authorization packages to enhance the security and protection of ,federal information and promote transparency for agencies and users as to which services are included in the scope of a ,fed,r,a,m,p authorization2 7#e7 grant ,fed,r,a,m,p authorizations to cloud computing products and services consistent with the guidance and direction of the ,fed,r,a,m,p ,board2 7#f7 establish and maintain a public comment process for proposed guidance and other ,fed,r,a,m,p directives that may have a direct impact on cloud service providers and agencies before the issuance of such guidance or other ,fed,r,a,m,p directives2 7#g7 coordinate with the ,fed,r,a,m,p ,board1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and other entities identified by the ,administrator1 with the concurrence of the ,director and the ,secretary1 to establish and regularly update a framework for continuous monitoring under section #ceec2 7#h7 provide a secure mechanism for storing and sharing necessary data1 including ,fed,r,a,m,p authorization packages1 to enable better reuse of such packages across agencies1 including making available any information and data necessary for agencies to fulfill the requirements of section #cfac2 7#i7 provide regular updates to applicant cloud service providers on the status of any cloud computing product or service during an assessment process2 7#aj7 regularly review1 in consultation with the ,fed,r,a,m,p ,board-- 7,a7 the costs associated with the independent assessment services described in section #cfaa2 and 7,b7 the information relating to foreign interests submitted pursuant to section #cfab2 7#aa7 in coordination with the ,director of the ,national ,institute of ,standards and ,technology1 the ,director1 the ,secretary1 and other stakeholders1 as appropriate1 determine the sufficiency of underlying standards and requirements to identify and assess the provenance of the software in cloud services and products2 7#ab7 support the ,federal ,secure ,cloud ,advisory ,committee established pursuant to section #cfaf2 and 7#ac7 take such other actions as the ,administrator may determine necessary to carry out ,fed,r,a,m,p4 7b7 ,website 7#a7 ,in general ,the ,administrator shall maintain a public website to serve as the authoritative repository for ,fed,r,a,m,p1 including the timely publication and updates for all relevant information1 guidance1 determinations1 and other materials required under subsection 7a74 7#b7 ,criteria and process for ,fed,r,a,m,p authorization priorities ,the ,administrator shall develop and make publicly available on the website described in paragraph 7#a7 the criteria and process for prioritizing and selecting cloud computing products and services that will receive a ,fed,r,a,m,p authorization1 in consultation with the ,fed,r,a,m,p ,board and the ,chief ,information ,officers ,council4 7c7 ,evaluation of automation procedures 7#a7 ,in general ,the ,administrator1 in coordination with the ,secretary1 shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of ,fed,r,a,m,p authorizations1 including continuous monitoring of cloud computing products and services4 7#b7 ,means for automation ,not later than #a year after the date of enactment of this section1 and updated regularly thereafter1 the ,administrator shall establish a means for the automation of security assessments and reviews4 7d7 ,metrics for authorization ,the ,administrator shall establish annual metrics regarding the time and quality of the assessments necessary for completion of a ,fed,r,a,m,p authorization process in a manner that can be consistently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section #ceed in a manner that minimizes the agency reporting burden4 #cfaj4 ,fed,r,a,m,p ,board 7a7 ,establishment ,there is established a ,fed,r,a,m,p ,board to provide input and recommendations to the ,administrator regarding the requirements and guidelines for1 and the prioritization of1 security assessments of cloud computing products and services4 7b7 ,membership ,the ,fed,r,a,m,p ,board shall consist of not more than #g senior officials or experts from agencies appointed by the ,director1 in consultation with the ,administrator1 from each of the following3 7#a7 ,the ,department of ,defense4 7#b7 ,the ,department of ,homeland ,security4 7#c7 ,the ,general ,services ,administration4 7#d7 ,such other agencies as determined by the ,director1 in consultation with the ,administrator4 7c7 ,qualifications ,members of the ,fed,r,a,m,p ,board appointed under subsection 7b7 shall have technical expertise in domains relevant to ,fed,r,a,m,p1 such as-- 7#a7 cloud computing2 7#b7 cybersecurity2 7#c7 privacy2 7#d7 risk management2 and 7#e7 other competencies identified by the ,director to support the secure authorization of cloud services and products4 7d7 ,duties ,the ,fed,r,a,m,p ,board shall-- 7#a7 in consultation with the ,administrator1 serve as a resource for best practices to accelerate the process for obtaining a ,fed,r,a,m,p authorization2 7#b7 establish and regularly update requirements and guidelines for security authorizations of cloud computing products and services1 consistent with standards and guidelines established by the ,director of the ,national ,institute of ,standards and ,technology1 to be used in the determination of ,fed,r,a,m,p authorizations2 7#c7 monitor and oversee1 to the greatest extent practicable1 the processes and procedures by which agencies determine and validate requirements for a ,fed,r,a,m,p authorization1 including periodic review of the agency determinations described in section #cfac7;b72 7#d7 ensure consistency and transparency between agencies and cloud service providers in a manner that minimizes confusion and engenders trust2 and 7#e7 perform such other roles and responsibilities as the ,director may assign1 with concurrence from the ,administrator4 7e7 ,determinations of demand for cloud computing products and services ,the ,fed,r,a,m,p ,board may consult with the ,chief ,information ,officers ,council to establish a process1 which may be made available on the website maintained under section #cfji7;b71 for prioritizing and accepting the cloud computing products and services to be granted a ,fed,r,a,m,p authorization4 #cfaa4 ,independent assessment ,the ,administrator may determine whether ,fed,r,a,m,p may use an independent assessment service to analyze1 validate1 and attest to the quality and compliance of security assessment materials provided by cloud service providers during the course of a determination of whether to use a cloud computing product or service4 #cfab4 ,declaration of foreign interests 7a7 ,in general ,an independent assessment service that performs services described in section #cfaa shall annually submit to the ,administrator information relating to any foreign interest1 foreign influence1 or foreign control of the independent assessment service4 7b7 ,updates ,not later than #dh hours after there is a change in foreign ownership or control of an independent assessment service that performs services described in section #cfaa1 the independent assessment service shall submit to the ,administrator an update to the information submitted under subsection 7a74 7c7 ,certification ,the ,administrator may require a representative of an independent assessment service to certify the accuracy and completeness of any information submitted under this section4 #cfac4 ,roles and responsibilities of agencies 7a7 ,in general ,in implementing the requirements of ,fed,r,a,m,p1 the head of each agency shall1 consistent with guidance issued by the ,director pursuant to section #cfad-- 7#a7 promote the use of cloud computing products and services that meet ,fed,r,a,m,p security requirements and other risk-based performance requirements as determined by the ,director1 in consultation with the ,secretary2 7#b7 confirm whether there is a ,fed,r,a,m,p authorization in the secure mechanism provided under section #cfji7;a77#h7 before beginning the process of granting a ,fed,r,a,m,p authorization for a cloud computing product or service2 7#c7 to the extent practicable1 for any cloud computing product or service the agency seeks to authorize that has received a ,fed,r,a,m,p authorization1 use the existing assessments of security controls and materials within any ,fed,r,a,m,p authorization package for that cloud computing product or service2 and 7#d7 provide to the ,director data and information required by the ,director pursuant to section #cfad to determine how agencies are meeting metrics established by the ,administrator4 7b7 ,attestation ,upon completing an assessment or authorization activity with respect to a particular cloud computing product or service1 if an agency determines that the information and data the agency has reviewed under paragraph 7#b7 or 7#c7 of subsection 7a7 is wholly or substantially deficient for the purposes of performing an authorization of the cloud computing product or service1 the head of the agency shall document as part of the resulting ,fed,r,a,m,p authorization package the reasons for this determination4 7c7 ,submission of authorizations to operate required ,upon issuance of an agency authorization to operate based on a ,fed,r,a,m,p authorization1 the head of the agency shall provide a copy of its authorization to operate letter and any supplementary information required pursuant to section #cfji7;a7 to the ,administrator4 7d7 ,submission of policies required ,not later than #ahj days after the date on which the ,director issues guidance in accordance with section #cfad7a71 the head of each agency1 acting through the chief information officer of the agency1 shall submit to the ,director all agency policies relating to the authorization of cloud computing products and services4 7e7 ,presumption of adequacy 7#a7 ,in general ,the assessment of security controls and materials within the authorization package for a ,fed,r,a,m,p authorization shall be presumed adequate for use in an agency authorization to operate cloud computing products and services4 7#b7 ,information security requirements ,the presumption under paragraph 7#a7 does not modify or alter-- 7,a7 the responsibility of any agency to ensure compliance with subchapter ,,ii of chapter #ce for any cloud computing product or service used by the agency2 or 7,b7 the authority of the head of any agency to make a determination that there is a demonstrable need for additional security requirements beyond the security requirements included in a ,fed,r,a,m,p authorization for a particular control implementation4 #cfad4 ,roles and responsibilities of the ,office of ,management and ,budget ,the ,director shall-- 7#a7 in consultation with the ,administrator and the ,secretary1 issue guidance that-- 7,a7 specifies the categories or characteristics of cloud computing products and services that are within the scope of ,fed,r,a,m,p2 7,b7 includes requirements for agencies to obtain a ,fed,r,a,m,p authorization when operating a cloud computing product or service described in subparagraph 7,a7 as a ,federal information system2 and 7,c7 encompasses1 to the greatest extent practicable1 all necessary and appropriate cloud computing products and services2 7#b7 issue guidance describing additional responsibilities of ,fed,r,a,m,p and the ,fed,r,a,m,p ,board to accelerate the adoption of secure cloud computing products and services by the ,federal ,government2 7#c7 in consultation with the ,administrator1 establish a process to periodically review ,fed,r,a,m,p authorization packages to support the secure authorization and reuse of secure cloud products and services2 7#d7 oversee the effectiveness of ,fed,r,a,m,p and the ,fed,r,a,m,p ,board1 including the compliance by the ,fed,r,a,m,p ,board with the duties described in section #cfaj7;d72 and 7#e7 to the greatest extent practicable1 encourage and promote consistency of the assessment1 authorization1 adoption1 and use of secure cloud computing products and services within and across agencies4 #cfae4 ,reports to ,congress2 ,,gao report 7a7 ,reports to congress ,not later than #a year after the date of enactment of this section1 and annually thereafter1 the ,director shall submit to the appropriate congressional committees a report that includes the following3 7#a7 ,during the preceding year1 the status1 efficiency1 and effectiveness of the ,general ,services ,administration under section #cfji and agencies under section #cfac and in supporting the speed1 effectiveness1 sharing1 reuse1 and security of authorizations to operate for secure cloud computing products and services4 7#b7 ,progress towards meeting the metrics required under section #cfji7;d74 7#c7 ,data on ,fed,r,a,m,p authorizations4 7#d7 ,the average length of time to issue ,fed,r,a,m,p authorizations4 7#e7 ,the number of ,fed,r,a,m,p authorizations submitted1 issued1 and denied for the preceding year4 7#f7 ,a review of progress made during the preceding year in advancing automation techniques to securely automate ,fed,r,a,m,p processes and to accelerate reporting under this section4 7#g7 ,the number and characteristics of authorized cloud computing products and services in use at each agency consistent with guidance provided by the ,director under section #cfad4 7#h7 ,a review of ,fed,r,a,m,p measures to ensure the security of data stored or processed by cloud service providers1 which may include-- 7,a7 geolocation restrictions for provided products or services2 7,b7 disclosures of foreign elements of supply chains of acquired products or services2 7,c7 continued disclosures of ownership of cloud service providers by foreign entities2 and 7,d7 encryption for data processed1 stored1 or transmitted by cloud service providers4 7b7 ,,gao report ,not later than #ahj days after the date of enactment of this section1 the ,comptroller ,general of the ,united ,states shall report to the appropriate congressional committees an assessment of the following3 7#a7 ,the costs incurred by agencies and cloud service providers relating to the issuance of ,fed,r,a,m,p authorizations4 7#b7 ,the extent to which agencies have processes in place to continuously monitor the implementation of cloud computing products and services operating as ,federal information systems4 7#c7 ,how often and for which categories of products and services agencies use ,fed,r,a,m,p authorizations4 7#d7 ,the unique costs and potential burdens incurred by cloud computing companies that are small business concerns 7as defined in section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a77 as a part of the ,fed,r,a,m,p authorization process4 #cfaf4 ,federal ,secure ,cloud ,advisory ,committee 7a7 ,establishment1 purposes1 and duties 7#a7 ,establishment ,there is established a ,federal ,secure ,cloud ,advisory ,committee 7referred to in this section as the ,committee7 to ensure effective and ongoing coordination of agency adoption1 use1 authorization1 monitoring1 acquisition1 and security of cloud computing products and services to enable agency mission and administrative priorities4 7#b7 ,purposes ,the purposes of the ,committee are the following3 7,a7 ,to examine the operations of ,fed,r,a,m,p and determine ways that authorization processes can continuously be improved1 including the following3 7i7 ,measures to increase agency reuse of ,fed,r,a,m,p authorizations4 7ii7 ,proposed actions that can be adopted to reduce the burden1 confusion1 and cost associated with ,fed,r,a,m,p authorizations for cloud service providers4 7iii7 ,measures to increase the number of ,fed,r,a,m,p authorizations for cloud computing products and services offered by small businesses concerns 7as defined by section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a774 7iv7 ,proposed actions that can be adopted to reduce the burden and cost of ,fed,r,a,m,p authorizations for agencies4 7,b7 ,collect information and feedback on agency compliance with and implementation of ,fed,r,a,m,p requirements4 7,c7 ,serve as a forum that facilitates communication and collaboration among the ,fed,r,a,m,p stakeholder community4 7#c7 ,duties ,the duties of the ,committee include providing advice and recommendations to the ,administrator1 the ,fed,r,a,m,p ,board1 and agencies on technical1 financial1 programmatic1 and operational matters regarding secure adoption of cloud computing products and services4 7b7 ,members 7#a7 ,composition ,the ,committee shall be comprised of not more than #ae members who are qualified representatives from the public and private sectors1 appointed by the ,administrator1 in consultation with the ,director1 as follows3 7,a7 ,the ,administrator or the ,administrator's designee1 who shall be the ,chair of the ,committee4 7,b7 ,at least #a representative each from the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,institute of ,standards and ,technology4 7,c7 ,at least #b officials who serve as the ,chief ,information ,security ,officer within an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,d7 ,at least #a official serving as ,chief ,procurement ,officer 7or equivalent7 in an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,e7 ,at least #a individual representing an independent assessment service4 7,f7 ,at least #e representatives from unique businesses that primarily provide cloud computing services or products1 including at least #b representatives from a small business concern 7as defined by section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7,g7 ,at least #b other representatives of the ,federal ,government as the ,administrator determines necessary to provide sufficient balance1 insights1 or expertise to the ,committee4 7#b7 ,deadline for appointment ,each member of the ,committee shall be appointed not later than #ij days after the date of enactment of this section4 7#c7 ,period of appointment2 vacancies 7,a7 ,in general ,each non-,federal member of the ,committee shall be appointed for a term of #c years1 except that the initial terms for members may be staggered #a-1 #b-1 or #c-year terms to establish a rotation in which one-third of the members are selected each year4 ,any such member may be appointed for not more than #b consecutive terms4 7,b7 ,vacancies ,any vacancy in the ,committee shall not affect its powers1 but shall be filled in the same manner in which the original appointment was made4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of that term4 ,a member may serve after the expiration of that member's term until a successor has taken office4 7c7 ,meetings and rules of procedures 7#a7 ,meetings ,the ,committee shall hold not fewer than #c meetings in a calendar year1 at such time and place as determined by the ,chair4 7#b7 ,initial meeting ,not later than #abj days after the date of enactment of this section1 the ,committee shall meet and begin the operations of the ,committee4 7#c7 ,rules of procedure ,the ,committee may establish rules for the conduct of the business of the ,committee if such rules are not inconsistent with this section or other applicable law4 7d7 ,employee status 7#a7 ,in general ,a member of the ,committee 7other than a member who is appointed to the ,committee in connection with another ,federal appointment7 shall not be considered an employee of the ,federal ,government by reason of any service as such a member1 except for the purposes of section #egjc of title #e1 relating to travel expenses4 7#b7 ,pay not permitted ,a member of the ,committee covered by paragraph 7#a7 may not receive pay by reason of service on the ,committee4 7e7 ,applicability to the federal advisory committee act ,section #ad of the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall not apply to the ,committee4 7f7 ,detail of employees ,any ,federal ,government employee may be detailed to the ,committee without reimbursement from the ,committee1 and such detailee shall retain the rights1 status1 and privileges of his or her regular employment without interruption4 7g7 ,postal services ,the ,committee may use the ,united ,states mails in the same manner and under the same conditions as agencies4 7h7 ,reports 7#a7 ,interim reports ,the ,committee may submit to the ,administrator and ,congress interim reports containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 7#b7 ,annual reports ,not later than #edj days after the date of enactment of this section1 and annually thereafter1 the ,committee shall submit to the ,administrator and ,congress a report containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new items3 #cfjg4 ,definitions4 #cfjh4 ,federal ,risk and ,authorization ,management ,program4 #cfji4 ,roles and responsibilities of the ,general ,services ,administration4 #cfaj4 ,fed,r,a,m,p ,board4 #cfaa4 ,independent assessment4 #cfab4 ,declaration of foreign interests4 #cfac4 ,roles and responsibilities of agencies4 #cfad4 ,roles and responsibilities of the ,office of ,management and ,budget4 #cfae4 ,reports to ,congress2 ,,gao report4 #cfaf4 ,federal ,secure ,cloud ,advisory ,committee4 4 7c7 ,sunset 7#a7 ,in general ,effective on the date that is #e years after the date of enactment of this ,act1 chapter #cf of title #dd1 ,united ,states ,code1 is amended by striking sections #cfjg through #cfaf4 7#b7 ,conforming amendment ,effective on the date that is #e years after the date of enactment of this ,act1 the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by striking the items relating to sections #cfjg through #cfaf4 7d7 ,rule of construction ,nothing in this section or any amendment made by this section shall be construed as altering or impairing the authorities of the ,director of the ,office of ,management and ,budget or the ,secretary of ,homeland ,security under subchapter ,,ii of chapter #ce of title #dd1 ,united ,states ,code4 ,february #i1 #bjbb,read the second time and placed on the calendar