,,ii  #aai? ,,congress  #a/ ,session    
,s4 #ccae  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,decemb] #b1 #bjbe,mr4 
,cassidy 7= himself1 ,ms4 ,hassan1 ,mr4 
,cornyn1 & ,mr4 ,w>n]7 introduc$ !      
foll[+ bill2 :i* 0 read twice & ref]r$  
to ! ,committee on ,heal?1 ,education1  
,labor1 & ,p5sions  ,a ,,bill  ,to      
require ! ,secret>y ( ,heal? & ,human   
,s]vices & ! ,director ( ! ,cyb]security
 & ,infra/ructure ,security ,ag5cy to   
coord9ate to improve cyb]security 9 !   
heal? c>e & public heal? sectors1 & =   
o!r purposes4  #a4 ,%ort title ,?is ,act
 may be cit$ z ! ,heal? ,c>e            
,cyb]security & ,resili5cy ,act ( #bjbe4
  #b4 ,def9itions ,9 ?is ,act3 7#a7     
,ag5cy ,! t]m ,ag5cy means !            
,cyb]security & ,infra/ructure ,security
 ,ag5cy4  7#b7 ,cyb]security incid5t ,! 
t]m cyb]security incid5t has ! mean+    
giv5 ! t]m incid5t 9 section #ceeb (    
title #dd1 ,unit$ ,/ates ,code4  7#c7   
,cyb]security ,/ate ,coord9ator ,! t]m  
,cyb]security ,/ate ,coord9ator means a 

,cyb]security ,/ate ,coord9ator appo9t$ 
"u section #bbag7;a7 ( ! ,homel&        
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#ffe;c7a774  7#d7 ,director ,! t]m      
,director means ! ,director ( ! ,ag5cy4 
7#e7 ,heal?c>e & ,public ,heal? ,sector 
,! t]m ,heal?c>e & ,public ,heal?       
,sector means ! ,heal?c>e & ,public     
,heal? sector1 z id5tifi$ 9 ,presid5tial
 ,policy ,directive #ba 7,febru>y #ab1  
#bjac2 relat+ to critical infra/ructure 
security & resili5ce74  7#f7 ,in=mation 
,%>+ & ,analysis ,organization ,! t]m   
,in=mation ,%>+ & ,analysis             
,organization has ! mean+ giv5 su* t]m 9
 section #bbjj ( ! ,homel& ,security    
,act ( #bjjb 7#f ,u4,s4,c4 #fej74  7#g7 
,in=mation sy/em ,! t]m in=mation sy/em 
has ! mean+ giv5 su* t]m 9 section #ajb 
( ! ,cyb]security ,in=mation ,%>+ ,act (
 #bjae 7#f ,u4,s4,c4 #aeja74  7#h7      
,secret>y ,! t]m ,secret>y means !      
,secret>y ( ,heal? & ,human ,s]vices4   
#c4 ,dep>tm5t coord9ation ) ! ,ag5cy    
7a7 ,9 g5]al ,! ,secret>y & ! ,director 

%all coord9ate1 includ+ by ent]+ into a 
coop]ative agreem5t1 z appropriate1 to  
improve cyb]security 9 ! ,heal?c>e &    
,public ,heal? ,sector4  7b7 ,assi/ance 
7#a7 ,9 g5]al ,! ,secret>y %all         
coord9ate ) ! ,director to make res\rces
 available to entities t are receiv+    
in=mation %>$ ?r\gh programs manag$ by !
 ,director or ! ,secret>y1 includ+      
,in=mation ,%>+ & ,analysis             
,organizations1 in=mation %>+ & analysis
 c5t]s1 & non-,f$]al entities4  7#b7    
,scope ,! coord9ation "u p>agraph 7#a7  
%all include-- 7,a7 develop+ products   
specific to ! ne$s ( ,heal?c>e & ,public
 ,heal? ,sector entities2 &  7,b7 %>+   
in=mation relat+ to cyb] ?reat          
indicators & appropriate def5sive       
measures4  #d4 ,cl>ify+ cyb]security    
responsibilities at ! ,dep>tm5t ( ,heal?
 & ,human ,s]vices ,"p ,a ( title ,,iii 
( ! ,public ,heal? ,s]vice ,act 7#db    
,u4,s4,c4 #bda et seq47 is am5d$ by add+
 at ! end ! foll[+3  #caj;,c4 ,ov]sight 
( cyb]security activities ,! ,secret>y1 

act+ ?r\gh ! ,assi/ant ,secret>y =      
,prep>$ness & ,response1 9 coord9ation )
 ! ,director ( ! ,cyb]security &        
,infra/ructure ,security ,ag5cy pursuant
 to section #bbah ( ! ,homel& ,security 
,act ( #bjjb1 %all lead ov]sight &      
coord9ation ( activities )9 ! ,dep>tm5t 
( ,heal? & ,human ,s]vices to support   
cyb]security resili5cy )9 ! ,heal?c>e & 
,public ,heal? ,sector 7z def9$ 9       
section #b ( ! ,heal? ,c>e ,cyb]security
 & ,resili5cy ,act ( #bjbe71 includ+    
coord9ation & communication ) o!r public
 & private entities relat$ to prep>$ness
 =1 & responses to1 cyb]security        
incid5ts1 consi/5t ) applicable         
provisions ( ?is ,act1 o!r applicable   
laws1 & ,presid5tial ,policy ,directive 
#ba 7,febru>y #ab1 #bjac2 relat+ to     
critical infra/ructure security &       
resili5ce74  4  #e4 ,cyb]security       
incid5t response plan ,section #dje ( ! 
,cyb]security ,act ( #bjae 7#f ,u4,s4,c4
 #aecc7 is am5d$-- 7#a7 9 subsection    
7a7-- 7,a7 9 p>agraph 7#d7-- 7i7 9 !    

p>agraph head+1 by ins]t+ in=mation     
sy/em2 aft] ,f$]al entity22 &  7ii7 by  
ins]t+ in=mation sy/em1 aft] ,f$]al     
entity12  7,b7 by r$esignat+ p>agraphs  
7#d7 ?r\gh 7#g7 z p>agraphs 7#f7 ?r\gh  
7#i71 respectively2 &  7,c7 by ins]t+   
aft] p>agraph 7#c7 ! foll[+3  7#d7      
,cyb]security incid5t ,! t]m            
cyb]security incid5t has ! mean+ giv5 ! 
t]m incid5t 9 section #ceeb ( title #dd1
 ,unit$ ,/ates ,code4  7#e7             
,cyb]security risk ,! t]m cyb]security  
risk has ! mean+ giv5 su* t]m 9 section 
#bbjj ( ! ,homel& ,security ,act ( #bjjb
 7#f ,u4,s4,c4 #fej74  2 &  7#b7 9      
subsection 7d71 by add+ at ! end !      
foll[+3  7#d7 ,plan  7,a7 ,9 g5]al ,n   
lat] ?an #a ye> aft] ! date ( enactm5t (
 ! ,heal? ,c>e ,cyb]security &          
,resili5cy ,act ( #bjbe1 ! ,secret>y    
%all develop & implem5t a cyb]security  
incid5t response plan to in=m applicable
 p]sonnel )9 ! ,dep>tm5t ( ,heal? &     
,human ,s]vices ( processes & protocols 
to prep>e =1 & respond to1 cyb]security 

incid5ts involv+ in=mation1 includ+     
h>dw>e1 s(tw>e1 databases1 & networks1  
us$ or ma9ta9$ by1 or on behalf (1 !    
,dep>tm5t1 includ+ /rategies-- 7i7 to   
assess cyb]security risks2  7ii7 to     
prev5t cyb]security incid5ts2  7iii7 to 
detect & id5tify cyb]security incid5ts2 
7iv7 to m9imize damage 9 ! ev5t ( a     
cyb]security incid5t2  7v7 to protect   
data2 &  7vi7 to recov] f any           
cyb]security incid5ts exp$iti\sly4  7,b7
 ,consultation ,9 develop+ ! plan "u    
subp>agraph 7,a71 ! ,secret>y %all      
consult ) ! ,director ( ! ,cyb]security 
& ,infra/ructure ,security ,ag5cy1 !    
,director ( ! ,(fice ( ,managem5t &     
,budget1 & ! ,director ( ! ,national    
,in/itute ( ,/&>ds & ,te*nology1 &      
relevant exp]ts1 z appropriate4  7,c7   
,report ,n lat] ?an #fj days be=e ! date
 on :i* ! ,secret>y beg9s implem5t+ !   
plan "u subp>agraph 7,a71 ! ,secret>y   
%all submit to ! ,committee on ,heal?1  
,education1 ,labor1 & ,p5sions & !      
,committee on ,homel& ,security &       

,gov]nm5tal ,affairs ( ! ,s5ate & !     
,committee on ,en]gy & ,comm]ce1 !      
,committee on ,ov]sight & ,re=m1 & !    
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives a report t      
describes su* plan4  4  #f4 ,brea*      
report+ portal  7a7 ,updates to brea*   
report+ portal ,section #acdjb ( !      
,,hite* ,act 7#db ,u4,s4,c4 #agicb7 is  
am5d$ by add+ at ! end ! foll[+3  7k7   
,updates to regulations ,n lat] ?an #a  
ye> aft] ! date ( enactm5t ( ! ,heal?   
,c>e ,cyb]security & ,resili5cy ,act (  
#bjbe1 ! ,secret>y %all update !        
regulations promulgat$ pursuant to      
subsection 7j7 to require t in=mation   
requir$ to be publicly display$ 9 !     
brea* report+ portal e/abli%$ pursuant  
to ?is section includes-- 7#a7 in=mation
 on any corrective action tak5 aga9/ a  
cov]$ entity t provid$ notification ( a 
brea* "u ?is section2  7#b7 in=mation on
 :e!r & to :at ext5t1 z appropriate1    
recogniz$ security practices 7z def9$ 9 
section #acdab7;b77#a77 7 consid]$ 9 !  

inve/igation ( su* a brea*2 &  7#c7 su* 
additional in=mation ab\t su* a brea* z 
! ,secret>y may require4  4  #g4        
,cl>ify+ brea* report+ obligations      
,section #acdjb7;f7 ( ! ,,hite* ,act    
7#db ,u4,s4,c4 #agicb7;f77 is am5d$ by  
add+ at ! end ! foll[+3  7#f7 ,! numb] (
 individuals affect$ by ! brea*4  4  #h4
 ,enhanc+ recognition ( security        
practices  7a7 ,recogniz$ security      
practices ,section #acdab7;b77#a7 ( !   
,,hite* ,act 7#db ,u4,s4,c4             
#agida7;b77#a77 is am5d$1 9 ! fir/      
s5t5ce1 by ins]t+ 1 inve/m5ts1 aft] o!r 
programs4  7b7 ,guidance ,n lat] ?an #a 
ye> aft] ! date ( enactm5t ( ?is ,act1 !
 ,secret>y %all issue guidance on !     
implem5tation ( section #acdab ( !      
,,hite* ,act 7#db ,u4,s4,c4 #agida71 :i*
 %all include-- 7#a7 recogniz$ security 
practices 7z def9$ 9 subsection 7b77#a7 
( su* section7 t ! ,secret>y may consid]
 :5 det]m9+ f9es "u su* section2  7#b7 !
 ext5t to :i* su* recogniz$ security    
practices %\ld be 9 place = consid]ation

 by ! ,secret>y2 &  7#c7 proc$ural      
requirem5ts or in=mation t %all be      
submitt$ by a cov]$ entity or bus9ess   
associate 7z su* t]ms are def9$ 9       
section #acdjj ( ! ,,hite* ,act 7#db    
,u4,s4,c4 #agiba77 to ! ,secret>y =     
consid]ation4  7c7 ,annual report ,n    
lat] ?an #b ye>s aft] ! date ( enactm5t 
( ?is ,act1 & annually !reaft]1 !       
,secret>y %all include 9 ! annual report
 requir$ "u section #acdbd7;a7 ( !      
,,hite* ,act 7#db ,u4,s4,c4 #agiec7;a77 
in=mation on implem5tation ( section    
#acdab ( su* ,act 7#db ,u4,s4,c4        
#agida71 includ+ an acc\nt+ ( e case 9  
:i* ! ,secret>y consid]$ recogniz$      
security practices 7z def9$ 9 subsection
 7b77#a7 ( su* section7 :5 effectuat+   
audits & assess+ f9es "u su* section4   
#i4 ,requir$ cyb]security /&>ds  7a7 ,9 
g5]al ,! ,secret>y %all update !        
privacy1 security1 & brea* notification 
regulations "u p>ts #afj & #afd ( title 
#de1 ,code ( ,f$]al ,regulations 7or any
 successor regulation7 to require cov]$ 

entities & bus9ess associates to adopt !
 foll[+ cyb]security practices3 7#a7    
,multifactor au!ntication1 or a         
successor te*nology1 = access to any    
in=mation sy/ems t may include protect$ 
heal? in=mation4  7#b7 ,safegu>ds to    
encrypt protect$ heal? in=mation4  7#c7 
,requirem5ts to conduct audits1 includ+ 
p5etration te/+1 to ma9ta9 ! protections
 ( in=mation sy/ems4  7#d7 ,o!r m9imum  
cyb]security /&>ds1 z det]m9$ by !      
,secret>y1 9 consultation ) private     
sector entities1 bas$ on l&scape        
analysis ( em]g+ & exi/+ cyb]security   
vuln]abilities & cons5sus-bas$ be/      
practices4  7b7 ,effective dates ,!     
,secret>y %all specify 9 ! regulations !
 effective date = ea* ( ! new           
requirem5ts "u ! regulations updat$ 9   
accordance ) subsection 7a74 ,ea* su*   
effective date %all provide reasonable  
"t = ! entities subject to ! requirem5t 
to come into compliance4  #aj4 ,guidance
 on rural cyb]security read9ess ,section
 #dje7;d7 ( ! ,cyb]security ,act ( #bjae

 7#f ,u4,s4,c4 #aecc7;d77 7z am5d$ by   
section #e7b77 is am5d$ by add+ at ! end
 ! foll[+3  7#e7 ,rural cyb]security    
guidance  7,a7 ,def9ition ( rural ,9 ?is
 p>agraph1 ! t]m rural has ! mean+ giv5 
su* t]m by ! ,heal? ,res\rces & ,s]vices
 ,adm9i/ration4  7,b7 ,guidance on rural
 cyb]security read9ess ,n lat] ?an #a   
ye> aft] ! date ( enactm5t ( ! ,heal?   
,c>e ,cyb]security & ,resili5cy ,act (  
#bjbe1 ! ,secret>y %all issue guidance  
to rural entities on be/ practices to   
improve cyb] read9ess1 includ+          
/rategies-- 7i7 to improve cyb]         
infra/ructure1 includ+ any te*nical     
safegu>ds to mitigate cyb]security risk2
  7ii7 to integrate be/ practices issu$ 
by ! ,secret>y to improve cyb]security  
prep>$ness2  7iii7 to improve employee  
prep>ation to mitigate any cyb]security 
risks1 includ+ exi/+ public-private     
programs to support educational         
initiatives2 &  7iv7 to implem5t        
policies to facilitate m&atory          
cyb]security incid5t report+ requirem5ts

 "u law4  7,c7 ,,gao /udy & report  7i7 
,9 g5]al ,n lat] ?an #c ye>s aft] ! date
 ( enactm5t ( ! ,heal? ,c>e             
,cyb]security & ,resili5cy ,act ( #bjbe1
 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates 
%all conduct1 & submit to ! ,committee  
on ,heal?1 ,education1 ,labor1 &        
,p5sions ( ! ,s5ate & ! ,committee on   
,en]gy & ,comm]ce ( ! ,h\se (           
,repres5tatives a report t describes !  
results (1 a /udy to exam9e h[ rural    
entities h implem5t$ ! recomm5dations   
includ$ 9 ! guidance "u subp>agraph     
7,b74  7ii7 ,requirem5ts ,! /udy "u     
clause 7i7 %all assess-- 7,i7 h[ rural  
entities h implem5t$ any te*nical       
safegu>ds & any *all5ges fac$ by su*    
rural entities 9 areas = :i* safegu>ds 7
 n implem5t$2  7,,ii7 /eps to fur!r     
support cyb] resili5ce = rural entities2
  7,,iii7 areas to improve coord9ation  
betwe5 ,f$]al ag5cies1 includ+ = !      
purposes ( requir$ cyb] report+2 &      
7,,iv7 any opportunities to support     
public-private collaboration 9 ! area ( 

cyb] read9ess4  4  #aa4 ,grants to      
enhance cyb]security 9 ! heal? & public 
heal? sectors ,"p ,p ( title ,,iii ( !  
,public ,heal? ,s]vice ,act 7#db        
,u4,s4,c4 #bhj;g et seq47 is am5d$ by   
add+ at ! end ! foll[+3  #cii,v-#h4     
,grants  7a7 ,9 g5]al ,! ,secret>y may  
aw>d grants to eligible entities = !    
adoption & use ( cyb]security be/       
practices4  7b7 ,eligible entity ,to be 
eligible to receive a grant "u          
subsection 7a7 an entity %all be-- 7#a7 
a public or nonpr(it private heal? c5t] 
7includ+ a ,f$]ally qualifi$ heal? c5t] 
7z def9$ 9 section #ahfa7;aa77#d7 ( !   
,social ,security ,act772  7#b7 a heal? 
facility op]at$ by or pursuant to a     
contract ) ! ,indian ,heal? ,s]vice2    
7#c7 a hospital2  7#d7 a canc] c5t]2    
7#e7 a rural heal? cl9ic2  7#f7 an      
academic heal? c5t]2 or  7#g7 a nonpr(it
 entity t ent]s into a p>tn]%ip or      
coord9ates ref]rals ) an entity describ$
 9 any ( p>agraphs 7#a7 ?r\gh 7#f74  7c7
 ,use ( funds ,9 adopt+ & us+           

cyb]security be/ practices pursuant to a
 grant "u subsection 7a71 an eligible   
entity may use grant funds-- 7#a7 to    
hire & tra9 p]sonnel 9 su* cyb]security 
be/ practices2  7#b7 to update          
electronic data sy/ems1 su* z by migrat+
 to cl\d bas$ plat=ms2  7#c7 to jo9 &   
p>ticipate 9 heal? cyb]security ?reat   
in=mation %>+ organizations2  7#d7 to   
r$uce ! use ( legacy sy/ems2 &  7#e7 to 
contract ) ?ird p>ties to assi/ ) !     
activities describ$ 9 p>agraphs 7#a7    
?r\gh 7#e74  7d7 ,grant p]iod ,!        
,secret>y may aw>d a grant "u ?is       
section = a p]iod ( n m ?an #c ye>s4    
7e7 ,application ,an eligible entity    
seek+ a grant "u subsection 7a7 %all    
submit to ! ,secret>y an application at 
su* "t1 9 su* mann]1 & conta9+ su*      
in=mation z ! ,secret>y may require     
includ+1 at a m9imum a description ( h[ 
! eligible entity w e/abli% basel9e     
measures & b5*m>ks t meet ! ,secret>y's 
requirem5ts to evaluate program         
outcomes4  7f7 ,au?orization (          

appropriations ,!re are au?oriz$ to be  
appropriat$ to c>ry out ?is section su* 
sums z may be necess>y = ea* ( fiscal   
ye>s #bjbe ?r\gh #bjcj4  4  #ab4        
,heal?c>e cyb]security work=ce  7a7     
,tra9+ = heal?c>e exp]ts ,! ,secret>y1 9
 coord9ation ) ! ,cyb]security ,/ate    
,coord9ators ( ! ,ag5cy & private sector
 heal? c>e exp]ts1 z appropriate1 %all  
provide tra9+ to ,heal?c>e & ,public    
,heal? ,sector asset own]s & op]ators   
on-- 7#a7 cyb]security risks to         
in=mation sy/ems )9 ! ,heal?c>e &       
,public ,heal? ,sector2 &  7#b7 ways to 
mitigate ! risks to in=mation sy/ems 9 !
 ,heal?c>e & ,public ,heal? ,sector4    
7b7 ,cross-,ag5cy educational tools     
7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is ,act1 ! ,secret>y1
 act+ ?r\gh ! ,adm9i/rator ( ! ,heal?   
,res\rces & ,s]vices ,adm9i/ration1 9   
coord9ation ) ! ,ag5cy1 %all develop a  
/rategic plan to support gr[+ !         
cyb]security work=ce = heal? c>e        
entities4  7#b7  ,inclusions  ,!        

/rategic plan "u p>agraph 7#a7 %all     
include--  7,a7 recomm5dations = exi/+  
educational programs t c be us$ to      
support cyb]security tra9+2  7,b7       
dissem9ation & developm5t ( educational 
mat]ials on h[ to improve cyb]security  
resili5ce2  7,c7 developm5t ( be/       
practices to tra9 ! heal? c>e work=ce on
 cyb]security be/ practices2 &  7,d7    
opportunities = public-private          
collaboration to /r5g!n ! cyb]security  
work=ce4